From dd7679fbab56fd6f700901bd358953dae23faf34 Mon Sep 17 00:00:00 2001
From: Travis James <travis@tribehealthsolutions.com>
Date: Sun, 9 Aug 2026 05:52:20 -0500
Subject: [PATCH 1/6] docs: add CLAUDE.md agent guide

Add a repository-level CLAUDE.md for Claude Code that defers to AGENTS.md
as the authoritative operating guide and covers the mechanics it leaves
implicit:

- the mandatory per-invocation CARGO_TARGET_DIR requirement, including the
  Makefile targets that resolve binaries through a literal target/ path;
- narrow-loop and baseline Rust commands, surface-specific gates, and the
  npm workspace commands for the viewer and VS Code extension;
- the one-directional build pipeline across compass-files, -languages,
  -resolve, -graph, and -model, with the extractor/resolver evidence
  boundary and the compass-cypher/compass-query syntax-vs-execution split;
- enforced workspace constraints (lint set, determinism, boundedness) and
  the compatibility-sensitive surfaces.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 CLAUDE.md | 212 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 212 insertions(+)
 create mode 100644 CLAUDE.md

diff --git a/CLAUDE.md b/CLAUDE.md
new file mode 100644
index 000000000..e43b0788e
--- /dev/null
+++ b/CLAUDE.md
@@ -0,0 +1,212 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Read AGENTS.md first
+
+`AGENTS.md` is the authoritative operating guide for this repository and applies
+to the whole tree. It covers product invariants, crate ownership routing, Rust
+conventions, test/fixture policy, public-contract rules, and the completion
+checklist. Read it before editing. This file only adds the mechanics AGENTS.md
+does not spell out.
+
+## Build target directory (mandatory)
+
+The main disk is capped at 100 GB, so Cargo artifacts live on a mounted volume.
+**Set `CARGO_TARGET_DIR` on every invocation that can compile** — `build`,
+`check`, `test`, `clippy`, `bench`, `doc`, `install`, `package`, and any Make
+target wrapping them. The variable does not persist between tool calls.
+
+```bash
+CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main \
+  cargo test -p compass-model --locked
+```
+
+Each checkout and worktree needs its own directory
+(`compass-<worktree-name>` for other worktrees). Never share one across
+repositories or concurrent worktrees. If `/Volumes/Workspace` is not mounted,
+stop and report it rather than falling back to local `target/`.
+
+Note the conflict this creates with the Makefile: several targets (`install`,
+`dist`, `release-check`) look up binaries through a literal `target/` path after
+Cargo finishes. Prefer direct `cargo` commands for verification, and inspect any
+packaging/install target before running it so it does not silently trigger a
+second local build.
+
+## Commands
+
+Rust (Edition 2024, pinned toolchain 1.97.1, always `--locked`):
+
+```bash
+cargo test -p <crate> --locked                              # narrowest loop
+cargo test -p <crate> --test <integration_test> --locked    # one integration file
+cargo test -p compass-cli --test compass_product --locked   # CLI product contract
+cargo clippy -p <crate> --all-targets --all-features --locked -- -D warnings
+
+# Repository baseline before finishing a Rust change
+cargo fmt --all -- --check
+cargo clippy --workspace --lib --bins --locked -- -D warnings
+cargo test --workspace --lib --bins --locked
+```
+
+Surface-specific gates (run the ones matching what changed):
+
+```bash
+sh scripts/check_product_boundary.sh                # no Graphify references
+cargo test -p compass-cypher --test tck --locked    # CompassQL grammar
+cargo test -p compass-query --test opencypher_tck --locked
+python3 scripts/check_compassql_support.py          # pinned support evidence
+./scripts/qualify_code_graph_v1.sh --fixtures-only  # code-graph publication gate
+```
+
+JavaScript / viewer / VS Code (npm workspaces: `apps/*`, `packages/*`,
+`editors/*`, `tests/*`):
+
+```bash
+npm ci
+npm run typecheck:js
+npm run test:js
+node scripts/check_viewer_assets.mjs   # generated viewer assets match source
+```
+
+`make help` lists wrappers. `make test`, `make lint`, `make test-js`,
+`make qualify-code-graph-v1`, and `make ci-fast` cover the common paths.
+`make test` is workspace `--lib --bins` only; `make test-all` adds
+`--all-targets --all-features` and needs the Python oracle setup.
+
+CI (`.github/workflows/compass-ci.yml`) additionally runs nextest, isolated
+native tests, crate-archive publishing checks, `cargo install` launch
+verification, query-relevance qualification, dependency audit/policy, and a
+native platform matrix. Consult it before touching those surfaces.
+
+## Architecture
+
+One Rust workspace of ~31 `compass-*` crates plus a vendored tree-sitter
+language pack. The shipped artifact is package `compass-cli`, binary `compass`,
+entry `crates/compass-cli/src/bin/compass.rs`.
+
+The core value proposition: source code and project artifacts become a typed,
+directed multigraph with provenance, published as one atomic, deterministic
+snapshot — no Python, embeddings, vector DB, model credentials, or runtime
+parser downloads on the structural path.
+
+### The build pipeline
+
+`compass update` / `extract` / `watch` parse into `compass-core::BuildOptions` +
+a `BuildPurpose`, then flow one direction through the layers:
+
+```text
+compass-files       walk + classify + ignore policy, cache/manifest, atomic writes
+      |             (incremental reuse decided here, via fingerprints)
+      v
+compass-languages   per-file syntax facts only -> Extraction {nodes, edges,
+      |             hyperedges, raw calls}; statically linked parsers
+      v
+compass-resolve     merge Extractions; resolve cross-file imports, calls,
+      |             members, re-exports, aliases, stable IDs
+      v
+compass-graph       dedup, communities/clustering, god nodes, cycles, topology
+      |
+      v
+compass-model       GraphDocument / Graph / QueryIndex — the public contract
+      |
+      v
+compass-core        sequences the above into one transactional workflow
+```
+
+The critical boundary: **per-file extractors emit evidence; they never resolve
+targets that need project-wide facts.** That lives in `compass-resolve`.
+Similarly, anything that depends on graph topology rather than source syntax
+belongs in `compass-graph`, not the extractor.
+
+### Query path
+
+`compass-cypher` (lexer → parser → AST → semantic analysis → logical plan →
+optimizer) compiles CompassQL — a bounded, read-only openCypher subset — and
+owns `LANGUAGE_VERSION` / `PLANNER_VERSION`, both cache-compatibility inputs.
+`compass-query` executes against the graph (text scoring, traversal, impact,
+CompassQL execution/cache/profile). Syntax acceptance is a `compass-cypher`
+concern; execution behavior is a `compass-query` concern.
+
+### Presentation and interfaces
+
+`compass-output` renders an already-complete graph (Markdown, HTML, JSON, SVG,
+GraphML, Cypher, Obsidian, wiki, canvas). `compass-cli` and `compass-mcp` are
+deliberately thin: argument parsing, help, exit codes, streams, side effects,
+schemas — reusable behavior belongs in the owning domain crate.
+
+### History
+
+`compass-history` stores immutable graph realizations per Git commit over
+SQLite/Prolly: canonical encoding, meaning-affecting fingerprints, typed keys,
+artifact partitioning, durable job queue, leases, locks, GC, and typed record
+diffs. `compass-semantic-diff` compares two published realizations under
+evidence gating. **Published realizations are immutable** — never rewrite in
+place or silently substitute a different realization/profile.
+
+### Optional layers
+
+`compass-semantic` (provider fragments, prompts, validation — hard caps on
+fragment bytes/record counts, endpoint checks), `compass-media` /
+`compass-ingest` / `compass-transcribe` / `compass-whisper` (bounded document
+and audio extraction), and integrations (`compass-cargo`, `compass-global`,
+`compass-google-workspace`, `compass-graphdb`, `compass-postgres`,
+`compass-prs`, `compass-reflect`). All of these are optional; structural
+extraction and graph queries must keep working without any of them.
+
+### Generated viewer assets
+
+`crates/compass-output/assets/viewer/{graph.js,viewer.css,manifest.json}` are
+build outputs of `packages/compass-viewer`. Edit the React source, then:
+
+```bash
+node scripts/build_viewer_assets.mjs   # regenerate
+node scripts/check_viewer_assets.mjs   # verify they match
+```
+
+Never hand-edit the generated files.
+
+## Enforced constraints
+
+Workspace lints forbid `unsafe_code` and deny `clippy::all`, `unwrap_used`,
+`expect_used`, and `panic` — return typed errors with actionable context.
+
+Determinism is a correctness property, not a nicety: prefer `BTreeMap`/`BTreeSet`
+or explicit sorting at contract boundaries, and never rely on hash iteration or
+filesystem order. Never resolve ambiguity by picking the first or most
+convenient candidate — an explicit unresolved/ambiguous result beats invented
+meaning.
+
+Every traversal of files, graphs, archives, network responses, queries, and
+subprocess output must be bounded. A limit error is a distinct outcome from an
+empty result; do not collapse the two.
+
+Reuse the existing bounded readers, subprocess helpers, path-containment checks,
+endpoint checks, and atomic-write functions rather than writing weaker local
+variants. Pass subprocess arguments separately — never construct shell strings.
+
+Add workspace dependencies at the root `Cargo.toml` and reference them as
+`{name}.workspace = true`.
+
+## Compatibility-sensitive surfaces
+
+CLI arguments/help/exit codes, environment variables, configuration, graph JSON,
+CompassQL, MCP schemas, output files, history formats, and stable IDs. An
+incompatible user-visible change needs all four of: native regression coverage,
+updated reference documentation, a `MIGRATION.md` note when users must act, and
+a `CHANGELOG.md` entry when release-visible. See `COMPATIBILITY.md`.
+
+## Documentation map
+
+- `docs/implementation/workspace-tour.md` — crate-by-crate responsibilities,
+  public interfaces, and "change here when" guidance. Use it to route work.
+- `docs/implementation/extending-compass.md` — extension checklists.
+- `docs/design/language-architecture.md` and
+  `docs/reference/universal-semantic-evidence.md` — required reading before
+  touching universal adapters, evidence facts, resolution rules, or language
+  cutovers.
+- `docs/design/principles.md` — the rules behind AGENTS.md.
+- `.impeccable.md` — viewer/extension design direction (restrained workbench
+  aesthetic, VS Code theme tokens, evidence over implication).
+- Docs distinguish shipped behavior from plans; never cite anything under
+  `docs/superpowers/` as shipped evidence.

From c349fdf6197ecc6754e62f628459ea28bfb246ed Mon Sep 17 00:00:00 2001
From: Travis James <travis@tribehealthsolutions.com>
Date: Sun, 9 Aug 2026 05:55:44 -0500
Subject: [PATCH 2/6] chore: track Prometheus wiki and initialize OpenSpec

Track the .prometheus/knowledge/wiki/ session records so the knowledge
content lives with the repository.

Initialize OpenSpec (schema: spec-driven) with generated configuration for
Claude Code, Codex, Kimi CLI, and OpenCode. Zed was requested but is not a
supported `openspec init` target, so it has no generated configuration.

Kimi receives skills only; OpenSpec reports no command adapter for it.
The local .claude/settings.local.json permission allowlist is intentionally
left untracked.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .claude/commands/opsx/apply.md                | 156 +++++
 .claude/commands/opsx/archive.md              | 161 +++++
 .claude/commands/opsx/bulk-archive.md         | 245 ++++++++
 .claude/commands/opsx/continue.md             | 118 ++++
 .claude/commands/opsx/explore.md              | 175 ++++++
 .claude/commands/opsx/ff.md                   | 101 ++++
 .claude/commands/opsx/new.md                  |  72 +++
 .claude/commands/opsx/onboard.md              | 551 +++++++++++++++++
 .claude/commands/opsx/sync.md                 | 144 +++++
 .claude/commands/opsx/verify.md               | 168 ++++++
 .claude/skills/openspec-apply-change/SKILL.md | 160 +++++
 .../skills/openspec-archive-change/SKILL.md   | 118 ++++
 .../openspec-bulk-archive-change/SKILL.md     | 249 ++++++++
 .../skills/openspec-continue-change/SKILL.md  | 122 ++++
 .claude/skills/openspec-explore/SKILL.md      | 290 +++++++++
 .claude/skills/openspec-ff-change/SKILL.md    | 105 ++++
 .claude/skills/openspec-new-change/SKILL.md   |  77 +++
 .claude/skills/openspec-onboard/SKILL.md      | 555 ++++++++++++++++++
 .claude/skills/openspec-sync-specs/SKILL.md   | 148 +++++
 .../skills/openspec-verify-change/SKILL.md    | 172 ++++++
 .codex/skills/openspec-apply-change/SKILL.md  | 160 +++++
 .../skills/openspec-archive-change/SKILL.md   | 118 ++++
 .../openspec-bulk-archive-change/SKILL.md     | 249 ++++++++
 .../skills/openspec-continue-change/SKILL.md  | 122 ++++
 .codex/skills/openspec-explore/SKILL.md       | 290 +++++++++
 .codex/skills/openspec-ff-change/SKILL.md     | 105 ++++
 .codex/skills/openspec-new-change/SKILL.md    |  77 +++
 .codex/skills/openspec-onboard/SKILL.md       | 555 ++++++++++++++++++
 .codex/skills/openspec-sync-specs/SKILL.md    | 148 +++++
 .codex/skills/openspec-verify-change/SKILL.md | 172 ++++++
 .kimi/skills/openspec-apply-change/SKILL.md   | 160 +++++
 .kimi/skills/openspec-archive-change/SKILL.md | 118 ++++
 .../openspec-bulk-archive-change/SKILL.md     | 249 ++++++++
 .../skills/openspec-continue-change/SKILL.md  | 122 ++++
 .kimi/skills/openspec-explore/SKILL.md        | 290 +++++++++
 .kimi/skills/openspec-ff-change/SKILL.md      | 105 ++++
 .kimi/skills/openspec-new-change/SKILL.md     |  77 +++
 .kimi/skills/openspec-onboard/SKILL.md        | 555 ++++++++++++++++++
 .kimi/skills/openspec-sync-specs/SKILL.md     | 148 +++++
 .kimi/skills/openspec-verify-change/SKILL.md  | 172 ++++++
 .opencode/commands/opsx-apply.md              | 152 +++++
 .opencode/commands/opsx-archive.md            | 157 +++++
 .opencode/commands/opsx-bulk-archive.md       | 241 ++++++++
 .opencode/commands/opsx-continue.md           | 114 ++++
 .opencode/commands/opsx-explore.md            | 171 ++++++
 .opencode/commands/opsx-ff.md                 |  97 +++
 .opencode/commands/opsx-new.md                |  68 +++
 .opencode/commands/opsx-onboard.md            | 547 +++++++++++++++++
 .opencode/commands/opsx-sync.md               | 140 +++++
 .opencode/commands/opsx-verify.md             | 164 ++++++
 .../skills/openspec-apply-change/SKILL.md     | 160 +++++
 .../skills/openspec-archive-change/SKILL.md   | 118 ++++
 .../openspec-bulk-archive-change/SKILL.md     | 249 ++++++++
 .../skills/openspec-continue-change/SKILL.md  | 122 ++++
 .opencode/skills/openspec-explore/SKILL.md    | 290 +++++++++
 .opencode/skills/openspec-ff-change/SKILL.md  | 105 ++++
 .opencode/skills/openspec-new-change/SKILL.md |  77 +++
 .opencode/skills/openspec-onboard/SKILL.md    | 555 ++++++++++++++++++
 .opencode/skills/openspec-sync-specs/SKILL.md | 148 +++++
 .../skills/openspec-verify-change/SKILL.md    | 172 ++++++
 .prometheus/knowledge/wiki/index.md           |  14 +
 .../wiki/karpathy-session-04f1f5622348cff2.md |  54 ++
 .../wiki/karpathy-session-0cf2eabc28e07ef7.md |  41 ++
 .../wiki/karpathy-session-199d5165acd78a00.md |  48 ++
 .../wiki/karpathy-session-7521e456ead1ce12.md |  52 ++
 .../wiki/karpathy-session-85be47bbe3d4faec.md |  41 ++
 .../wiki/karpathy-session-95e26dce31a612a2.md |  41 ++
 .../wiki/karpathy-session-a0b489beb0d312d9.md |  44 ++
 .../wiki/karpathy-session-bb64c62e88af6029.md |  48 ++
 .../wiki/karpathy-session-c13ff840014cf2b3.md |  37 ++
 .../wiki/karpathy-session-f8eff00b52d5f657.md |  48 ++
 .prometheus/knowledge/wiki/log.md             |  13 +
 openspec/config.yaml                          |  20 +
 73 files changed, 12227 insertions(+)
 create mode 100644 .claude/commands/opsx/apply.md
 create mode 100644 .claude/commands/opsx/archive.md
 create mode 100644 .claude/commands/opsx/bulk-archive.md
 create mode 100644 .claude/commands/opsx/continue.md
 create mode 100644 .claude/commands/opsx/explore.md
 create mode 100644 .claude/commands/opsx/ff.md
 create mode 100644 .claude/commands/opsx/new.md
 create mode 100644 .claude/commands/opsx/onboard.md
 create mode 100644 .claude/commands/opsx/sync.md
 create mode 100644 .claude/commands/opsx/verify.md
 create mode 100644 .claude/skills/openspec-apply-change/SKILL.md
 create mode 100644 .claude/skills/openspec-archive-change/SKILL.md
 create mode 100644 .claude/skills/openspec-bulk-archive-change/SKILL.md
 create mode 100644 .claude/skills/openspec-continue-change/SKILL.md
 create mode 100644 .claude/skills/openspec-explore/SKILL.md
 create mode 100644 .claude/skills/openspec-ff-change/SKILL.md
 create mode 100644 .claude/skills/openspec-new-change/SKILL.md
 create mode 100644 .claude/skills/openspec-onboard/SKILL.md
 create mode 100644 .claude/skills/openspec-sync-specs/SKILL.md
 create mode 100644 .claude/skills/openspec-verify-change/SKILL.md
 create mode 100644 .codex/skills/openspec-apply-change/SKILL.md
 create mode 100644 .codex/skills/openspec-archive-change/SKILL.md
 create mode 100644 .codex/skills/openspec-bulk-archive-change/SKILL.md
 create mode 100644 .codex/skills/openspec-continue-change/SKILL.md
 create mode 100644 .codex/skills/openspec-explore/SKILL.md
 create mode 100644 .codex/skills/openspec-ff-change/SKILL.md
 create mode 100644 .codex/skills/openspec-new-change/SKILL.md
 create mode 100644 .codex/skills/openspec-onboard/SKILL.md
 create mode 100644 .codex/skills/openspec-sync-specs/SKILL.md
 create mode 100644 .codex/skills/openspec-verify-change/SKILL.md
 create mode 100644 .kimi/skills/openspec-apply-change/SKILL.md
 create mode 100644 .kimi/skills/openspec-archive-change/SKILL.md
 create mode 100644 .kimi/skills/openspec-bulk-archive-change/SKILL.md
 create mode 100644 .kimi/skills/openspec-continue-change/SKILL.md
 create mode 100644 .kimi/skills/openspec-explore/SKILL.md
 create mode 100644 .kimi/skills/openspec-ff-change/SKILL.md
 create mode 100644 .kimi/skills/openspec-new-change/SKILL.md
 create mode 100644 .kimi/skills/openspec-onboard/SKILL.md
 create mode 100644 .kimi/skills/openspec-sync-specs/SKILL.md
 create mode 100644 .kimi/skills/openspec-verify-change/SKILL.md
 create mode 100644 .opencode/commands/opsx-apply.md
 create mode 100644 .opencode/commands/opsx-archive.md
 create mode 100644 .opencode/commands/opsx-bulk-archive.md
 create mode 100644 .opencode/commands/opsx-continue.md
 create mode 100644 .opencode/commands/opsx-explore.md
 create mode 100644 .opencode/commands/opsx-ff.md
 create mode 100644 .opencode/commands/opsx-new.md
 create mode 100644 .opencode/commands/opsx-onboard.md
 create mode 100644 .opencode/commands/opsx-sync.md
 create mode 100644 .opencode/commands/opsx-verify.md
 create mode 100644 .opencode/skills/openspec-apply-change/SKILL.md
 create mode 100644 .opencode/skills/openspec-archive-change/SKILL.md
 create mode 100644 .opencode/skills/openspec-bulk-archive-change/SKILL.md
 create mode 100644 .opencode/skills/openspec-continue-change/SKILL.md
 create mode 100644 .opencode/skills/openspec-explore/SKILL.md
 create mode 100644 .opencode/skills/openspec-ff-change/SKILL.md
 create mode 100644 .opencode/skills/openspec-new-change/SKILL.md
 create mode 100644 .opencode/skills/openspec-onboard/SKILL.md
 create mode 100644 .opencode/skills/openspec-sync-specs/SKILL.md
 create mode 100644 .opencode/skills/openspec-verify-change/SKILL.md
 create mode 100644 .prometheus/knowledge/wiki/index.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-04f1f5622348cff2.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-0cf2eabc28e07ef7.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-199d5165acd78a00.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-7521e456ead1ce12.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-85be47bbe3d4faec.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-95e26dce31a612a2.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-a0b489beb0d312d9.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-bb64c62e88af6029.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-c13ff840014cf2b3.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-f8eff00b52d5f657.md
 create mode 100644 .prometheus/knowledge/wiki/log.md
 create mode 100644 openspec/config.yaml

diff --git a/.claude/commands/opsx/apply.md b/.claude/commands/opsx/apply.md
new file mode 100644
index 000000000..c6cb9b6d7
--- /dev/null
+++ b/.claude/commands/opsx/apply.md
@@ -0,0 +1,156 @@
+---
+name: "OPSX: Apply"
+description: Implement tasks from an OpenSpec change (Experimental)
+allowed-tools: Bash(openspec:*)
+category: Workflow
+tags: [workflow, artifacts, experimental]
+---
+
+Implement tasks from an OpenSpec change.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name (e.g., `/opsx:apply add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **Select the change**
+
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes and use the **AskUserQuestion tool** to let the user select
+
+   Always announce: "Using change: <name>" and how to override (e.g., `/opsx:apply <other>`).
+
+2. **Check status to understand the schema**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used (e.g., "spec-driven")
+   - `planningHome`, `changeRoot`, and `actionContext`: planning scope and edit constraints
+   - Which artifact contains the tasks (typically "tasks" for spec-driven, check status for others)
+
+3. **Get apply instructions**
+
+   ```bash
+   openspec instructions apply --change "<name>" --json
+   ```
+
+   This returns:
+   - `contextFiles`: artifact ID -> array of concrete file paths (varies by schema)
+   - Progress (total, complete, remaining)
+   - Task list with status
+   - Dynamic instruction based on current state
+
+   **Handle states:**
+   - If `state: "blocked"` (missing artifacts): show message, suggest using `/opsx:continue`
+   - If `state: "all_done"`: congratulate, suggest archive
+   - Otherwise: proceed to implementation
+
+4. **Read context files**
+
+   Read every file path listed under `contextFiles` from the apply instructions output.
+   The files depend on the schema being used:
+   - **spec-driven**: proposal, specs, design, tasks
+   - Other schemas: follow the contextFiles from CLI output
+
+5. **Show current progress**
+
+   Display:
+   - Schema being used
+   - Progress: "N/M tasks complete"
+   - Remaining tasks overview
+   - Dynamic instruction from CLI
+
+6. **Implement tasks (loop until done or blocked)**
+
+   For each pending task:
+   - Show which task is being worked on
+   - Make the code changes required
+   - Keep changes minimal and focused
+   - Mark task complete in the tasks file: `- [ ]` → `- [x]`
+   - Continue to next task
+
+   **Pause if:**
+   - Task is unclear → ask for clarification
+   - Implementation reveals a design issue → suggest updating artifacts
+   - Error or blocker encountered → report and wait for guidance
+   - User interrupts
+
+7. **On completion or pause, show status**
+
+   Display:
+   - Tasks completed this session
+   - Overall progress: "N/M tasks complete"
+   - If all done: suggest archive
+   - If paused: explain why and wait for guidance
+
+**Output During Implementation**
+
+```
+## Implementing: <change-name> (schema: <schema-name>)
+
+Working on task 3/7: <task description>
+[...implementation happening...]
+✓ Task complete
+
+Working on task 4/7: <task description>
+[...implementation happening...]
+✓ Task complete
+```
+
+**Output On Completion**
+
+```
+## Implementation Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Progress:** 7/7 tasks complete ✓
+
+### Completed This Session
+- [x] Task 1
+- [x] Task 2
+...
+
+All tasks complete! You can archive this change with `/opsx:archive`.
+```
+
+**Output On Pause (Issue Encountered)**
+
+```
+## Implementation Paused
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Progress:** 4/7 tasks complete
+
+### Issue Encountered
+<description of the issue>
+
+**Options:**
+1. <option 1>
+2. <option 2>
+3. Other approach
+
+What would you like to do?
+```
+
+**Guardrails**
+- Keep going through tasks until done or blocked
+- Always read context files before starting (from the apply instructions output)
+- If task is ambiguous, pause and ask before implementing
+- If implementation reveals issues, pause and suggest artifact updates
+- Keep code changes minimal and scoped to each task
+- Update task checkbox immediately after completing each task
+- Pause on errors, blockers, or unclear requirements - don't guess
+- Use contextFiles from CLI output, don't assume specific file names
+
+**Fluid Workflow Integration**
+
+This skill supports the "actions on a change" model:
+
+- **Can be invoked anytime**: Before all artifacts are done (if tasks exist), after partial implementation, interleaved with other actions
+- **Allows artifact updates**: If implementation reveals design issues, suggest updating artifacts - not phase-locked, work fluidly
diff --git a/.claude/commands/opsx/archive.md b/.claude/commands/opsx/archive.md
new file mode 100644
index 000000000..df8a2f2d9
--- /dev/null
+++ b/.claude/commands/opsx/archive.md
@@ -0,0 +1,161 @@
+---
+name: "OPSX: Archive"
+description: Archive a completed change in the experimental workflow
+allowed-tools: Bash(openspec:*)
+category: Workflow
+tags: [workflow, archive, experimental]
+---
+
+Archive a completed change in the experimental workflow.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name after `/opsx:archive` (e.g., `/opsx:archive add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show only active changes (not already archived).
+   Include the schema used for each change if available.
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Check artifact completion status**
+
+   Run `openspec status --change "<name>" --json` to check artifact completion.
+
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context
+   - `artifacts`: List of artifacts with their status (`done` or other)
+
+   **If any artifacts are not `done`:**
+   - Display warning listing incomplete artifacts
+   - Prompt user for confirmation to continue
+   - Proceed if user confirms
+
+3. **Check task completion status**
+
+   Read the tasks file (typically `tasks.md`) to check for incomplete tasks.
+
+   Count tasks marked with `- [ ]` (incomplete) vs `- [x]` (complete).
+
+   **If incomplete tasks found:**
+   - Display warning showing count of incomplete tasks
+   - Prompt user for confirmation to continue
+   - Proceed if user confirms
+
+   **If no tasks file exists:** Proceed without task-related warning.
+
+4. **Assess delta spec sync state**
+
+   Use `artifactPaths.specs.existingOutputPaths` from status JSON to check for delta specs. If none exist, proceed without sync prompt.
+
+   **If delta specs exist:**
+   - Compare each delta spec with its corresponding main spec at `openspec/specs/<capability>/spec.md`
+   - Determine what changes would be applied (adds, modifications, removals, renames)
+   - Show a combined summary before prompting
+
+   **Prompt options:**
+   - If changes needed: "Sync now (recommended)", "Archive without syncing"
+   - If already synced: "Archive now", "Sync anyway", "Cancel"
+
+   If user chooses sync, use Task tool (subagent_type: "general-purpose", prompt: "Use Skill tool to invoke openspec-sync-specs for change '<name>'. Delta spec analysis: <include the analyzed delta spec summary>"). Proceed to archive regardless of choice.
+
+5. **Perform the archive**
+
+   Create an `archive` directory under `planningHome.changesDir` if it doesn't exist:
+   ```bash
+   mkdir -p "<planningHome.changesDir>/archive"
+   ```
+
+   Generate target name using current date: `YYYY-MM-DD-<change-name>`
+
+   **Check if target already exists:**
+   - If yes: Fail with error, suggest renaming existing archive or using different date
+   - If no: Move `changeRoot` to the archive directory
+
+   ```bash
+   mv "<changeRoot>" "<planningHome.changesDir>/archive/YYYY-MM-DD-<name>"
+   ```
+
+6. **Display summary**
+
+   Show archive completion summary including:
+   - Change name
+   - Schema that was used
+   - Archive location
+   - Spec sync status (synced / sync skipped / no delta specs)
+   - Note about any warnings (incomplete artifacts/tasks)
+
+**Output On Success**
+
+```
+## Archive Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Archived to:** the archive path derived from `planningHome.changesDir`/YYYY-MM-DD-<name>/
+**Specs:** ✓ Synced to main specs
+
+All artifacts complete. All tasks complete.
+```
+
+**Output On Success (No Delta Specs)**
+
+```
+## Archive Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Archived to:** the archive path derived from `planningHome.changesDir`/YYYY-MM-DD-<name>/
+**Specs:** No delta specs
+
+All artifacts complete. All tasks complete.
+```
+
+**Output On Success With Warnings**
+
+```
+## Archive Complete (with warnings)
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Archived to:** the archive path derived from `planningHome.changesDir`/YYYY-MM-DD-<name>/
+**Specs:** Sync skipped (user chose to skip)
+
+**Warnings:**
+- Archived with 2 incomplete artifacts
+- Archived with 3 incomplete tasks
+- Delta spec sync was skipped (user chose to skip)
+
+Review the archive if this was not intentional.
+```
+
+**Output On Error (Archive Exists)**
+
+```
+## Archive Failed
+
+**Change:** <change-name>
+**Target:** the archive path derived from `planningHome.changesDir`/YYYY-MM-DD-<name>/
+
+Target archive directory already exists.
+
+**Options:**
+1. Rename the existing archive
+2. Delete the existing archive if it's a duplicate
+3. Wait until a different date to archive
+```
+
+**Guardrails**
+- Always prompt for change selection if not provided
+- Use artifact graph (openspec status --json) for completion checking
+- Don't block archive on warnings - just inform and confirm
+- Preserve .openspec.yaml when moving to archive (it moves with the directory)
+- Show clear summary of what happened
+- If sync is requested, use the Skill tool to invoke `openspec-sync-specs` (agent-driven)
+- If delta specs exist, always run the sync assessment and show the combined summary before prompting
diff --git a/.claude/commands/opsx/bulk-archive.md b/.claude/commands/opsx/bulk-archive.md
new file mode 100644
index 000000000..ea4838095
--- /dev/null
+++ b/.claude/commands/opsx/bulk-archive.md
@@ -0,0 +1,245 @@
+---
+name: "OPSX: Bulk Archive"
+description: Archive multiple completed changes at once
+allowed-tools: Bash(openspec:*)
+category: Workflow
+tags: [workflow, archive, experimental, bulk]
+---
+
+Archive multiple completed changes in a single operation.
+
+This skill allows you to batch-archive changes, handling spec conflicts intelligently by checking the codebase to determine what's actually implemented.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: None required (prompts for selection)
+
+**Steps**
+
+1. **Get active changes**
+
+   Run `openspec list --json` to get all active changes.
+
+   If no active changes exist, inform user and stop.
+
+2. **Prompt for change selection**
+
+   Use **AskUserQuestion tool** with multi-select to let user choose changes:
+   - Show each change with its schema
+   - Include an option for "All changes"
+   - Allow any number of selections (1+ works, 2+ is the typical use case)
+
+   **IMPORTANT**: Do NOT auto-select. Always let the user choose.
+
+3. **Batch validation - gather status for all selected changes**
+
+   For each selected change, collect:
+
+   a. **Artifact status** - Run `openspec status --change "<name>" --json`
+      - Parse `schemaName`, `artifacts`, `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`
+      - Note which artifacts are `done` vs other states
+
+   b. **Task completion** - Read `artifactPaths.tasks.existingOutputPaths` from status JSON
+      - Count `- [ ]` (incomplete) vs `- [x]` (complete)
+      - If no tasks file exists, note as "No tasks"
+
+   c. **Delta specs** - Check `artifactPaths.specs.existingOutputPaths` from status JSON
+      - List which capability specs exist
+      - For each, extract requirement names (lines matching `### Requirement: <name>`)
+
+4. **Detect spec conflicts**
+
+   Build a map of `capability -> [changes that touch it]`:
+
+   ```
+   auth -> [change-a, change-b]  <- CONFLICT (2+ changes)
+   api  -> [change-c]            <- OK (only 1 change)
+   ```
+
+   A conflict exists when 2+ selected changes have delta specs for the same capability.
+
+5. **Resolve conflicts agentically**
+
+   **For each conflict**, investigate the codebase:
+
+   a. **Read the delta specs** from each conflicting change to understand what each claims to add/modify
+
+   b. **Search the codebase** for implementation evidence:
+      - Look for code implementing requirements from each delta spec
+      - Check for related files, functions, or tests
+
+   c. **Determine resolution**:
+      - If only one change is actually implemented -> sync that one's specs
+      - If both implemented -> apply in chronological order (older first, newer overwrites)
+      - If neither implemented -> skip spec sync, warn user
+
+   d. **Record resolution** for each conflict:
+      - Which change's specs to apply
+      - In what order (if both)
+      - Rationale (what was found in codebase)
+
+6. **Show consolidated status table**
+
+   Display a table summarizing all changes:
+
+   ```
+   | Change              | Artifacts | Tasks | Specs   | Conflicts | Status |
+   |---------------------|-----------|-------|---------|-----------|--------|
+   | schema-management   | Done      | 5/5   | 2 delta | None      | Ready  |
+   | project-config      | Done      | 3/3   | 1 delta | None      | Ready  |
+   | add-oauth           | Done      | 4/4   | 1 delta | auth (!)  | Ready* |
+   | add-verify-skill    | 1 left    | 2/5   | None    | None      | Warn   |
+   ```
+
+   For conflicts, show the resolution:
+   ```
+   * Conflict resolution:
+     - auth spec: Will apply add-oauth then add-jwt (both implemented, chronological order)
+   ```
+
+   For incomplete changes, show warnings:
+   ```
+   Warnings:
+   - add-verify-skill: 1 incomplete artifact, 3 incomplete tasks
+   ```
+
+7. **Confirm batch operation**
+
+   Use **AskUserQuestion tool** with a single confirmation:
+
+   - "Archive N changes?" with options based on status
+   - Options might include:
+     - "Archive all N changes"
+     - "Archive only N ready changes (skip incomplete)"
+     - "Cancel"
+
+   If there are incomplete changes, make clear they'll be archived with warnings.
+
+8. **Execute archive for each confirmed change**
+
+   Process changes in the determined order (respecting conflict resolution):
+
+   a. **Sync specs** if delta specs exist:
+      - Use the openspec-sync-specs approach (agent-driven intelligent merge)
+      - For conflicts, apply in resolved order
+      - Track if sync was done
+
+   b. **Perform the archive**:
+      ```bash
+      mkdir -p "<planningHome.changesDir>/archive"
+      mv "<changeRoot>" "<planningHome.changesDir>/archive/YYYY-MM-DD-<name>"
+      ```
+
+   c. **Track outcome** for each change:
+      - Success: archived successfully
+      - Failed: error during archive (record error)
+      - Skipped: user chose not to archive (if applicable)
+
+9. **Display summary**
+
+   Show final results:
+
+   ```
+   ## Bulk Archive Complete
+
+   Archived 3 changes:
+   - schema-management-cli -> archive/2026-01-19-schema-management-cli/
+   - project-config -> archive/2026-01-19-project-config/
+   - add-oauth -> archive/2026-01-19-add-oauth/
+
+   Skipped 1 change:
+   - add-verify-skill (user chose not to archive incomplete)
+
+   Spec sync summary:
+   - 4 delta specs synced to main specs
+   - 1 conflict resolved (auth: applied both in chronological order)
+   ```
+
+   If any failures:
+   ```
+   Failed 1 change:
+   - some-change: Archive directory already exists
+   ```
+
+**Conflict Resolution Examples**
+
+Example 1: Only one implemented
+```
+Conflict: specs/auth/spec.md touched by [add-oauth, add-jwt]
+
+Checking add-oauth:
+- Delta adds "OAuth Provider Integration" requirement
+- Searching codebase... found src/auth/oauth.ts implementing OAuth flow
+
+Checking add-jwt:
+- Delta adds "JWT Token Handling" requirement
+- Searching codebase... no JWT implementation found
+
+Resolution: Only add-oauth is implemented. Will sync add-oauth specs only.
+```
+
+Example 2: Both implemented
+```
+Conflict: specs/api/spec.md touched by [add-rest-api, add-graphql]
+
+Checking add-rest-api (created 2026-01-10):
+- Delta adds "REST Endpoints" requirement
+- Searching codebase... found src/api/rest.ts
+
+Checking add-graphql (created 2026-01-15):
+- Delta adds "GraphQL Schema" requirement
+- Searching codebase... found src/api/graphql.ts
+
+Resolution: Both implemented. Will apply add-rest-api specs first,
+then add-graphql specs (chronological order, newer takes precedence).
+```
+
+**Output On Success**
+
+```
+## Bulk Archive Complete
+
+Archived N changes:
+- <change-1> -> archive/YYYY-MM-DD-<change-1>/
+- <change-2> -> archive/YYYY-MM-DD-<change-2>/
+
+Spec sync summary:
+- N delta specs synced to main specs
+- No conflicts (or: M conflicts resolved)
+```
+
+**Output On Partial Success**
+
+```
+## Bulk Archive Complete (partial)
+
+Archived N changes:
+- <change-1> -> archive/YYYY-MM-DD-<change-1>/
+
+Skipped M changes:
+- <change-2> (user chose not to archive incomplete)
+
+Failed K changes:
+- <change-3>: Archive directory already exists
+```
+
+**Output When No Changes**
+
+```
+## No Changes to Archive
+
+No active changes found. Create a new change to get started.
+```
+
+**Guardrails**
+- Allow any number of changes (1+ is fine, 2+ is the typical use case)
+- Always prompt for selection, never auto-select
+- Detect spec conflicts early and resolve by checking codebase
+- When both changes are implemented, apply specs in chronological order
+- Skip spec sync only when implementation is missing (warn user)
+- Show clear per-change status before confirming
+- Use single confirmation for entire batch
+- Track and report all outcomes (success/skip/fail)
+- Preserve .openspec.yaml when moving to archive
+- Archive directory target uses current date: YYYY-MM-DD-<name>
+- If archive target exists, fail that change but continue with others
diff --git a/.claude/commands/opsx/continue.md b/.claude/commands/opsx/continue.md
new file mode 100644
index 000000000..614d74dac
--- /dev/null
+++ b/.claude/commands/opsx/continue.md
@@ -0,0 +1,118 @@
+---
+name: "OPSX: Continue"
+description: Continue working on a change - create the next artifact (Experimental)
+allowed-tools: Bash(openspec:*)
+category: Workflow
+tags: [workflow, artifacts, experimental]
+---
+
+Continue working on a change by creating the next artifact.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name after `/opsx:continue` (e.g., `/opsx:continue add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes sorted by most recently modified. Then use the **AskUserQuestion tool** to let the user select which change to work on.
+
+   Present the top 3-4 most recently modified changes as options, showing:
+   - Change name
+   - Schema (from `schema` field if present, otherwise "spec-driven")
+   - Status (e.g., "0/5 tasks", "complete", "no tasks")
+   - How recently it was modified (from `lastModified` field)
+
+   Mark the most recently modified change as "(Recommended)" since it's likely what the user wants to continue.
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Check current status**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand current state. The response includes:
+   - `schemaName`: The workflow schema being used (e.g., "spec-driven")
+   - `artifacts`: Array of artifacts with their status ("done", "ready", "blocked")
+   - `isComplete`: Boolean indicating if all artifacts are complete
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context. Use these instead of assuming repo-local paths.
+
+3. **Act based on status**:
+
+   ---
+
+   **If all artifacts are complete (`isComplete: true`)**:
+   - Congratulate the user
+   - Show final status including the schema used
+   - Suggest: "All artifacts created! You can now implement this change with `/opsx:apply` or archive it with `/opsx:archive`."
+   - STOP
+
+   ---
+
+   **If artifacts are ready to create** (status shows artifacts with `status: "ready"`):
+   - Pick the FIRST artifact with `status: "ready"` from the status output
+   - Get its instructions:
+     ```bash
+     openspec instructions <artifact-id> --change "<name>" --json
+     ```
+   - Parse the JSON. The key fields are:
+     - `context`: Project background (constraints for you - do NOT include in output)
+     - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
+     - `template`: The structure to use for your output file
+     - `instruction`: Schema-specific guidance
+     - `resolvedOutputPath`: Resolved path or pattern to write the artifact
+     - `dependencies`: Completed artifacts to read for context
+   - **Create the artifact file**:
+     - Read any completed dependency files for context
+     - Use `template` as the structure - fill in its sections
+     - Apply `context` and `rules` as constraints when writing - but do NOT copy them into the file
+     - Write to the `resolvedOutputPath` specified in instructions. If it is a glob pattern, choose the concrete file path using the schema instruction and the change's context
+   - Show what was created and what's now unlocked
+   - STOP after creating ONE artifact
+
+   ---
+
+   **If no artifacts are ready (all blocked)**:
+   - This shouldn't happen with a valid schema
+   - Show status and suggest checking for issues
+
+4. **After creating an artifact, show progress**
+   ```bash
+   openspec status --change "<name>"
+   ```
+
+**Output**
+
+After each invocation, show:
+- Which artifact was created
+- Schema workflow being used
+- Current progress (N/M complete)
+- What artifacts are now unlocked
+- Prompt: "Run `/opsx:continue` to create the next artifact"
+
+**Artifact Creation Guidelines**
+
+The artifact types and their purpose depend on the schema. Use the `instruction` field from the instructions output to understand what to create.
+
+Common artifact patterns:
+
+**spec-driven schema** (proposal → specs → design → tasks):
+- **proposal.md**: Ask user about the change if not clear. Fill in Why, What Changes, Capabilities, Impact.
+  - The Capabilities section is critical - each capability listed will need a spec file.
+- **specs/<capability>/spec.md**: Create one spec per capability listed in the proposal's Capabilities section (use the capability name, not the change name).
+- **design.md**: Document technical decisions, architecture, and implementation approach.
+- **tasks.md**: Break down implementation into checkboxed tasks.
+
+For other schemas, follow the `instruction` field from the CLI output.
+
+**Guardrails**
+- Create ONE artifact per invocation
+- Always read dependency artifacts before creating a new one
+- Never skip artifacts or create out of order
+- If context is unclear, ask the user before creating
+- Verify the artifact file exists after writing before marking progress
+- Use the schema's artifact sequence, don't assume specific artifact names
+- **IMPORTANT**: `context` and `rules` are constraints for YOU, not content for the file
+  - Do NOT copy `<context>`, `<rules>`, `<project_context>` blocks into the artifact
+  - These guide what you write, but should never appear in the output
diff --git a/.claude/commands/opsx/explore.md b/.claude/commands/opsx/explore.md
new file mode 100644
index 000000000..7558a6319
--- /dev/null
+++ b/.claude/commands/opsx/explore.md
@@ -0,0 +1,175 @@
+---
+name: "OPSX: Explore"
+description: "Enter explore mode - think through ideas, investigate problems, clarify requirements"
+allowed-tools: Bash(openspec:*)
+category: Workflow
+tags: [workflow, explore, experimental, thinking]
+---
+
+Enter explore mode. Think deeply. Visualize freely. Follow the conversation wherever it goes.
+
+**IMPORTANT: Explore mode is for thinking, not implementing.** You may read files, search code, and investigate the codebase, but you must NEVER write code or implement features. If the user asks you to implement something, remind them to exit explore mode first and create a change proposal. You MAY create OpenSpec artifacts (proposals, designs, specs) if the user asks—that's capturing thinking, not implementing.
+
+**This is a stance, not a workflow.** There are no fixed steps, no required sequence, no mandatory outputs. You're a thinking partner helping the user explore.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: The argument after `/opsx:explore` is whatever the user wants to think about. Could be:
+- A vague idea: "real-time collaboration"
+- A specific problem: "the auth system is getting unwieldy"
+- A change name: "add-dark-mode" (to explore in context of that change)
+- A comparison: "postgres vs sqlite for this"
+- Nothing (just enter explore mode)
+
+---
+
+## The Stance
+
+- **Curious, not prescriptive** - Ask questions that emerge naturally, don't follow a script
+- **Open threads, not interrogations** - Surface multiple interesting directions and let the user follow what resonates. Don't funnel them through a single path of questions.
+- **Visual** - Use ASCII diagrams liberally when they'd help clarify thinking
+- **Adaptive** - Follow interesting threads, pivot when new information emerges
+- **Patient** - Don't rush to conclusions, let the shape of the problem emerge
+- **Grounded** - Explore the actual codebase when relevant, don't just theorize
+
+---
+
+## What You Might Do
+
+Depending on what the user brings, you might:
+
+**Explore the problem space**
+- Ask clarifying questions that emerge from what they said
+- Challenge assumptions
+- Reframe the problem
+- Find analogies
+
+**Investigate the codebase**
+- Map existing architecture relevant to the discussion
+- Find integration points
+- Identify patterns already in use
+- Surface hidden complexity
+
+**Compare options**
+- Brainstorm multiple approaches
+- Build comparison tables
+- Sketch tradeoffs
+- Recommend a path (if asked)
+
+**Visualize**
+```
+┌─────────────────────────────────────────┐
+│     Use ASCII diagrams liberally        │
+├─────────────────────────────────────────┤
+│                                         │
+│      ┌────────┐         ┌────────┐      │
+│      │ State  │────────▶│ State  │      │
+│      │   A    │         │   B    │      │
+│      └────────┘         └────────┘      │
+│                                         │
+│   System diagrams, state machines,      │
+│   data flows, architecture sketches,    │
+│   dependency graphs, comparison tables  │
+│                                         │
+└─────────────────────────────────────────┘
+```
+
+**Surface risks and unknowns**
+- Identify what could go wrong
+- Find gaps in understanding
+- Suggest spikes or investigations
+
+---
+
+## OpenSpec Awareness
+
+You have full context of the OpenSpec system. Use it naturally, don't force it.
+
+### Check for context
+
+At the start, quickly check what exists:
+```bash
+openspec list --json
+```
+
+This tells you:
+- If there are active changes
+- Their names, schemas, and status
+- What the user might be working on
+
+If the user mentioned a specific change name, read its artifacts for context.
+
+### When no change exists
+
+Think freely. When insights crystallize, you might offer:
+
+- "This feels solid enough to start a change. Want me to create a proposal?"
+- Or keep exploring - no pressure to formalize
+
+### When a change exists
+
+If the user mentions a change or you detect one is relevant:
+
+1. **Resolve and read existing artifacts for context**
+   - Run `openspec status --change "<name>" --json`.
+   - Use `changeRoot`, `artifactPaths`, and `actionContext` from the status JSON.
+   - Read existing files from `artifactPaths.<artifact>.existingOutputPaths`.
+
+2. **Reference them naturally in conversation**
+   - "Your design mentions using Redis, but we just realized SQLite fits better..."
+   - "The proposal scopes this to premium users, but we're now thinking everyone..."
+
+3. **Offer to capture when decisions are made**
+
+    | Insight Type               | Where to Capture               |
+    |----------------------------|--------------------------------|
+    | New requirement discovered | `specs/<capability>/spec.md` |
+    | Requirement changed        | `specs/<capability>/spec.md` |
+    | Design decision made       | `design.md`                  |
+    | Scope changed              | `proposal.md`                |
+    | New work identified        | `tasks.md`                   |
+    | Assumption invalidated     | Relevant artifact              |
+
+   Example offers:
+   - "That's a design decision. Capture it in design.md?"
+   - "This is a new requirement. Add it to specs?"
+   - "This changes scope. Update the proposal?"
+
+4. **The user decides** - Offer and move on. Don't pressure. Don't auto-capture.
+
+---
+
+## What You Don't Have To Do
+
+- Follow a script
+- Ask the same questions every time
+- Produce a specific artifact
+- Reach a conclusion
+- Stay on topic if a tangent is valuable
+- Be brief (this is thinking time)
+
+---
+
+## Ending Discovery
+
+There's no required ending. Discovery might:
+
+- **Flow into a proposal**: "Ready to start? I can create a change proposal."
+- **Result in artifact updates**: "Updated design.md with these decisions"
+- **Just provide clarity**: User has what they need, moves on
+- **Continue later**: "We can pick this up anytime"
+
+When things crystallize, you might offer a summary - but it's optional. Sometimes the thinking IS the value.
+
+---
+
+## Guardrails
+
+- **Don't implement** - Never write code or implement features. Creating OpenSpec artifacts is fine, writing application code is not.
+- **Don't fake understanding** - If something is unclear, dig deeper
+- **Don't rush** - Discovery is thinking time, not task time
+- **Don't force structure** - Let patterns emerge naturally
+- **Don't auto-capture** - Offer to save insights, don't just do it
+- **Do visualize** - A good diagram is worth many paragraphs
+- **Do explore the codebase** - Ground discussions in reality
+- **Do question assumptions** - Including the user's and your own
diff --git a/.claude/commands/opsx/ff.md b/.claude/commands/opsx/ff.md
new file mode 100644
index 000000000..c87de6b2f
--- /dev/null
+++ b/.claude/commands/opsx/ff.md
@@ -0,0 +1,101 @@
+---
+name: "OPSX: Fast Forward"
+description: Create a change and generate all artifacts needed for implementation in one go
+allowed-tools: Bash(openspec:*)
+category: Workflow
+tags: [workflow, artifacts, experimental]
+---
+
+Fast-forward through artifact creation - generate everything needed to start implementation.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: The argument after `/opsx:ff` is the change name (kebab-case), OR a description of what the user wants to build.
+
+**Steps**
+
+1. **If no input provided, ask what they want to build**
+
+   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
+   > "What change do you want to work on? Describe what you want to build or fix."
+
+   From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
+
+   **IMPORTANT**: Do NOT proceed without understanding what the user wants to build.
+
+2. **Create the change directory**
+   ```bash
+   openspec new change "<name>"
+   ```
+   This creates a scaffolded change in the planning home resolved by the CLI.
+
+3. **Get the artifact build order**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to get:
+   - `applyRequires`: array of artifact IDs needed before implementation (e.g., `["tasks"]`)
+   - `artifacts`: list of all artifacts with their status and dependencies
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context. Use these instead of assuming repo-local paths.
+
+4. **Create artifacts in sequence until apply-ready**
+
+   Use the **TodoWrite tool** to track progress through the artifacts.
+
+   Loop through artifacts in dependency order (artifacts with no pending dependencies first):
+
+   a. **For each artifact that is `ready` (dependencies satisfied)**:
+      - Get instructions:
+        ```bash
+        openspec instructions <artifact-id> --change "<name>" --json
+        ```
+      - The instructions JSON includes:
+        - `context`: Project background (constraints for you - do NOT include in output)
+        - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
+        - `template`: The structure to use for your output file
+        - `instruction`: Schema-specific guidance for this artifact type
+        - `resolvedOutputPath`: Resolved path or pattern to write the artifact
+        - `dependencies`: Completed artifacts to read for context
+      - Read any completed dependency files for context
+      - Create the artifact file using `template` as the structure and write it to `resolvedOutputPath`
+      - Apply `context` and `rules` as constraints - but do NOT copy them into the file
+      - Show brief progress: "✓ Created <artifact-id>"
+
+   b. **Continue until all `applyRequires` artifacts are complete**
+      - After creating each artifact, re-run `openspec status --change "<name>" --json`
+      - Check if every artifact ID in `applyRequires` has `status: "done"` in the artifacts array
+      - Stop when all `applyRequires` artifacts are done
+
+   c. **If an artifact requires user input** (unclear context):
+      - Use **AskUserQuestion tool** to clarify
+      - Then continue with creation
+
+5. **Show final status**
+   ```bash
+   openspec status --change "<name>"
+   ```
+
+**Output**
+
+After completing all artifacts, summarize:
+- Change name and location
+- List of artifacts created with brief descriptions
+- What's ready: "All artifacts created! Ready for implementation."
+- Prompt: "Run `/opsx:apply` to start implementing."
+
+**Artifact Creation Guidelines**
+
+- Follow the `instruction` field from `openspec instructions` for each artifact type
+- The schema defines what each artifact should contain - follow it
+- Read dependency artifacts for context before creating new ones
+- Use `template` as the structure for your output file - fill in its sections
+- **IMPORTANT**: `context` and `rules` are constraints for YOU, not content for the file
+  - Do NOT copy `<context>`, `<rules>`, `<project_context>` blocks into the artifact
+  - These guide what you write, but should never appear in the output
+
+**Guardrails**
+- Create ALL artifacts needed for implementation (as defined by schema's `apply.requires`)
+- Always read dependency artifacts before creating a new one
+- If context is critically unclear, ask the user - but prefer making reasonable decisions to keep momentum
+- If a change with that name already exists, ask if user wants to continue it or create a new one
+- Verify each artifact file exists after writing before proceeding to next
diff --git a/.claude/commands/opsx/new.md b/.claude/commands/opsx/new.md
new file mode 100644
index 000000000..bd8c4e0b4
--- /dev/null
+++ b/.claude/commands/opsx/new.md
@@ -0,0 +1,72 @@
+---
+name: "OPSX: New"
+description: Start a new change using the experimental artifact workflow (OPSX)
+allowed-tools: Bash(openspec:*)
+category: Workflow
+tags: [workflow, artifacts, experimental]
+---
+
+Start a new change using the experimental artifact-driven approach.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: The argument after `/opsx:new` is the change name (kebab-case), OR a description of what the user wants to build.
+
+**Steps**
+
+1. **If no input provided, ask what they want to build**
+
+   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
+   > "What change do you want to work on? Describe what you want to build or fix."
+
+   From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
+
+   **IMPORTANT**: Do NOT proceed without understanding what the user wants to build.
+
+2. **Determine the workflow schema**
+
+   Use the default schema (omit `--schema`) unless the user explicitly requests a different workflow.
+
+   **Use a different schema only if the user mentions:**
+   - A specific schema name → use `--schema <name>`
+   - "show workflows" or "what workflows" → run `openspec schemas --json` and let them choose
+
+   **Otherwise**: Omit `--schema` to use the default.
+
+3. **Create the change directory**
+   ```bash
+   openspec new change "<name>"
+   ```
+   Add `--schema <name>` only if the user requested a specific workflow.
+   This creates a scaffolded change in the planning home resolved by the CLI.
+
+4. **Show the artifact status**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Use the returned `planningHome`, `changeRoot`, `artifactPaths`, and `nextSteps` instead of assuming repo-local paths.
+
+5. **Get instructions for the first artifact**
+   The first artifact depends on the schema. Check the status output to find the first artifact with status "ready".
+   ```bash
+   openspec instructions <first-artifact-id> --change "<name>"
+   ```
+   This outputs the template and context for creating the first artifact.
+
+6. **STOP and wait for user direction**
+
+**Output**
+
+After completing the steps, summarize:
+- Change name and location
+- Schema/workflow being used and its artifact sequence
+- Current status (0/N artifacts complete)
+- The template for the first artifact
+- Prompt: "Ready to create the first artifact? Run `/opsx:continue` or just describe what this change is about and I'll draft it."
+
+**Guardrails**
+- Do NOT create any artifacts yet - just show the instructions
+- Do NOT advance beyond showing the first artifact template
+- If the name is invalid (not kebab-case), ask for a valid name
+- If a change with that name already exists, suggest using `/opsx:continue` instead
+- Pass --schema if using a non-default workflow
diff --git a/.claude/commands/opsx/onboard.md b/.claude/commands/opsx/onboard.md
new file mode 100644
index 000000000..1b0adab88
--- /dev/null
+++ b/.claude/commands/opsx/onboard.md
@@ -0,0 +1,551 @@
+---
+name: "OPSX: Onboard"
+description: Guided onboarding - walk through a complete OpenSpec workflow cycle with narration
+allowed-tools: Bash(openspec:*)
+category: Workflow
+tags: [workflow, onboarding, tutorial, learning]
+---
+
+Guide the user through their first complete OpenSpec workflow cycle. This is a teaching experience—you'll do real work in their codebase while explaining each step.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+---
+
+## Preflight
+
+Before starting, check if the OpenSpec CLI is installed:
+
+```bash
+# Unix/macOS
+openspec --version 2>&1 || echo "CLI_NOT_INSTALLED"
+# Windows (PowerShell)
+# if (Get-Command openspec -ErrorAction SilentlyContinue) { openspec --version } else { echo "CLI_NOT_INSTALLED" }
+```
+
+**If CLI not installed:**
+> OpenSpec CLI is not installed. Install it first, then come back to `/opsx:onboard`.
+
+Stop here if not installed.
+
+---
+
+## Phase 1: Welcome
+
+Display:
+
+```
+## Welcome to OpenSpec!
+
+I'll walk you through a complete change cycle—from idea to implementation—using a real task in your codebase. Along the way, you'll learn the workflow by doing it.
+
+**What we'll do:**
+1. Pick a small, real task in your codebase
+2. Explore the problem briefly
+3. Create a change (the container for our work)
+4. Build the artifacts: proposal → specs → design → tasks
+5. Implement the tasks
+6. Archive the completed change
+
+**Time:** ~15-20 minutes
+
+Let's start by finding something to work on.
+```
+
+---
+
+## Phase 2: Task Selection
+
+### Codebase Analysis
+
+Scan the codebase for small improvement opportunities. Look for:
+
+1. **TODO/FIXME comments** - Search for `TODO`, `FIXME`, `HACK`, `XXX` in code files
+2. **Missing error handling** - `catch` blocks that swallow errors, risky operations without try-catch
+3. **Functions without tests** - Cross-reference `src/` with test directories
+4. **Type issues** - `any` types in TypeScript files (`: any`, `as any`)
+5. **Debug artifacts** - `console.log`, `console.debug`, `debugger` statements in non-debug code
+6. **Missing validation** - User input handlers without validation
+
+Also check recent git activity:
+```bash
+# Unix/macOS
+git log --oneline -10 2>/dev/null || echo "No git history"
+# Windows (PowerShell)
+# git log --oneline -10 2>$null; if ($LASTEXITCODE -ne 0) { echo "No git history" }
+```
+
+### Present Suggestions
+
+From your analysis, present 3-4 specific suggestions:
+
+```
+## Task Suggestions
+
+Based on scanning your codebase, here are some good starter tasks:
+
+**1. [Most promising task]**
+   Location: `src/path/to/file.ts:42`
+   Scope: ~1-2 files, ~20-30 lines
+   Why it's good: [brief reason]
+
+**2. [Second task]**
+   Location: `src/another/file.ts`
+   Scope: ~1 file, ~15 lines
+   Why it's good: [brief reason]
+
+**3. [Third task]**
+   Location: [location]
+   Scope: [estimate]
+   Why it's good: [brief reason]
+
+**4. Something else?**
+   Tell me what you'd like to work on.
+
+Which task interests you? (Pick a number or describe your own)
+```
+
+**If nothing found:** Fall back to asking what the user wants to build:
+> I didn't find obvious quick wins in your codebase. What's something small you've been meaning to add or fix?
+
+### Scope Guardrail
+
+If the user picks or describes something too large (major feature, multi-day work):
+
+```
+That's a valuable task, but it's probably larger than ideal for your first OpenSpec run-through.
+
+For learning the workflow, smaller is better—it lets you see the full cycle without getting stuck in implementation details.
+
+**Options:**
+1. **Slice it smaller** - What's the smallest useful piece of [their task]? Maybe just [specific slice]?
+2. **Pick something else** - One of the other suggestions, or a different small task?
+3. **Do it anyway** - If you really want to tackle this, we can. Just know it'll take longer.
+
+What would you prefer?
+```
+
+Let the user override if they insist—this is a soft guardrail.
+
+---
+
+## Phase 3: Explore Demo
+
+Once a task is selected, briefly demonstrate explore mode:
+
+```
+Before we create a change, let me quickly show you **explore mode**—it's how you think through problems before committing to a direction.
+```
+
+Spend 1-2 minutes investigating the relevant code:
+- Read the file(s) involved
+- Draw a quick ASCII diagram if it helps
+- Note any considerations
+
+```
+## Quick Exploration
+
+[Your brief analysis—what you found, any considerations]
+
+┌─────────────────────────────────────────┐
+│   [Optional: ASCII diagram if helpful]  │
+└─────────────────────────────────────────┘
+
+Explore mode (`/opsx:explore`) is for this kind of thinking—investigating before implementing. You can use it anytime you need to think through a problem.
+
+Now let's create a change to hold our work.
+```
+
+**PAUSE** - Wait for user acknowledgment before proceeding.
+
+---
+
+## Phase 4: Create the Change
+
+**EXPLAIN:**
+```
+## Creating a Change
+
+A "change" in OpenSpec is a container for all the thinking and planning around a piece of work. It lives at the `changeRoot` reported by `openspec status --change "<name>" --json` and holds your artifacts—proposal, specs, design, tasks.
+
+Let me create one for our task.
+```
+
+**DO:** Create the change with a derived kebab-case name:
+```bash
+openspec new change "<derived-name>"
+```
+
+**SHOW:**
+```
+Created: <changeRoot from status JSON>
+
+The folder structure:
+```
+<changeRoot>/
+├── proposal.md    ← Why we're doing this (empty, we'll fill it)
+├── design.md      ← How we'll build it (empty)
+├── specs/         ← Detailed requirements (empty)
+└── tasks.md       ← Implementation checklist (empty)
+```
+
+Now let's fill in the first artifact—the proposal.
+```
+
+---
+
+## Phase 5: Proposal
+
+**EXPLAIN:**
+```
+## The Proposal
+
+The proposal captures **why** we're making this change and **what** it involves at a high level. It's the "elevator pitch" for the work.
+
+I'll draft one based on our task.
+```
+
+**DO:** Draft the proposal content (don't save yet):
+
+```
+Here's a draft proposal:
+
+---
+
+## Why
+
+[1-2 sentences explaining the problem/opportunity]
+
+## What Changes
+
+[Bullet points of what will be different]
+
+## Capabilities
+
+### New Capabilities
+- `<capability-name>`: [brief description]
+
+### Modified Capabilities
+<!-- If modifying existing behavior -->
+
+## Impact
+
+- `src/path/to/file.ts`: [what changes]
+- [other files if applicable]
+
+---
+
+Does this capture the intent? I can adjust before we save it.
+```
+
+**PAUSE** - Wait for user approval/feedback.
+
+After approval, save the proposal:
+```bash
+openspec instructions proposal --change "<name>" --json
+```
+Then write the content to the `resolvedOutputPath` from `openspec instructions proposal --change "<name>" --json`.
+
+```
+Proposal saved. This is your "why" document—you can always come back and refine it as understanding evolves.
+
+Next up: specs.
+```
+
+---
+
+## Phase 6: Specs
+
+**EXPLAIN:**
+```
+## Specs
+
+Specs define **what** we're building in precise, testable terms. They use a requirement/scenario format that makes expected behavior crystal clear.
+
+For a small task like this, we might only need one spec file.
+```
+
+**DO:** Resolve where the spec file should be created:
+```bash
+openspec instructions specs --change "<name>" --json
+# Use resolvedOutputPath from the JSON. If it is a glob, choose the concrete file path using the schema instruction and the change's context.
+```
+
+Draft the spec content:
+
+```
+Here's the spec:
+
+---
+
+## ADDED Requirements
+
+### Requirement: <Name>
+
+<Description of what the system should do>
+
+#### Scenario: <Scenario name>
+
+- **WHEN** <trigger condition>
+- **THEN** <expected outcome>
+- **AND** <additional outcome if needed>
+
+---
+
+This format—WHEN/THEN/AND—makes requirements testable. You can literally read them as test cases.
+```
+
+Save to the concrete file path chosen from `resolvedOutputPath`.
+
+---
+
+## Phase 7: Design
+
+**EXPLAIN:**
+```
+## Design
+
+The design captures **how** we'll build it—technical decisions, tradeoffs, approach.
+
+For small changes, this might be brief. That's fine—not every change needs deep design discussion.
+```
+
+**DO:** Draft design.md:
+
+```
+Here's the design:
+
+---
+
+## Context
+
+[Brief context about the current state]
+
+## Goals / Non-Goals
+
+**Goals:**
+- [What we're trying to achieve]
+
+**Non-Goals:**
+- [What's explicitly out of scope]
+
+## Decisions
+
+### Decision 1: [Key decision]
+
+[Explanation of approach and rationale]
+
+---
+
+For a small task, this captures the key decisions without over-engineering.
+```
+
+Save to the `resolvedOutputPath` from `openspec instructions design --change "<name>" --json`.
+
+---
+
+## Phase 8: Tasks
+
+**EXPLAIN:**
+```
+## Tasks
+
+Finally, we break the work into implementation tasks—checkboxes that drive the apply phase.
+
+These should be small, clear, and in logical order.
+```
+
+**DO:** Generate tasks based on specs and design:
+
+```
+Here are the implementation tasks:
+
+---
+
+## 1. [Category or file]
+
+- [ ] 1.1 [Specific task]
+- [ ] 1.2 [Specific task]
+
+## 2. Verify
+
+- [ ] 2.1 [Verification step]
+
+---
+
+Each checkbox becomes a unit of work in the apply phase. Ready to implement?
+```
+
+**PAUSE** - Wait for user to confirm they're ready to implement.
+
+Save to the `resolvedOutputPath` from `openspec instructions tasks --change "<name>" --json`.
+
+---
+
+## Phase 9: Apply (Implementation)
+
+**EXPLAIN:**
+```
+## Implementation
+
+Now we implement each task, checking them off as we go. I'll announce each one and occasionally note how the specs/design informed the approach.
+```
+
+**DO:** For each task:
+
+1. Announce: "Working on task N: [description]"
+2. Implement the change in the codebase
+3. Reference specs/design naturally: "The spec says X, so I'm doing Y"
+4. Mark complete in tasks.md: `- [ ]` → `- [x]`
+5. Brief status: "✓ Task N complete"
+
+Keep narration light—don't over-explain every line of code.
+
+After all tasks:
+
+```
+## Implementation Complete
+
+All tasks done:
+- [x] Task 1
+- [x] Task 2
+- [x] ...
+
+The change is implemented! One more step—let's archive it.
+```
+
+---
+
+## Phase 10: Archive
+
+**EXPLAIN:**
+```
+## Archiving
+
+When a change is complete, we archive it. The archive path is derived from `planningHome.changesDir` and the date.
+
+Archived changes become your project's decision history—you can always find them later to understand why something was built a certain way.
+```
+
+**DO:**
+```bash
+openspec archive "<name>"
+```
+
+**SHOW:**
+```
+Archived to: `<planningHome.changesDir>/archive/YYYY-MM-DD-<name>/`
+
+The change is now part of your project's history. The code is in your codebase, the decision record is preserved.
+```
+
+---
+
+## Phase 11: Recap & Next Steps
+
+```
+## Congratulations!
+
+You just completed a full OpenSpec cycle:
+
+1. **Explore** - Thought through the problem
+2. **New** - Created a change container
+3. **Proposal** - Captured WHY
+4. **Specs** - Defined WHAT in detail
+5. **Design** - Decided HOW
+6. **Tasks** - Broke it into steps
+7. **Apply** - Implemented the work
+8. **Archive** - Preserved the record
+
+This same rhythm works for any size change—a small fix or a major feature.
+
+---
+
+## Command Reference
+
+**Core workflow:**
+
+ | Command           | What it does                               |
+ |-------------------|--------------------------------------------|
+ | `/opsx:propose` | Create a change and generate all artifacts |
+ | `/opsx:explore` | Think through problems before/during work  |
+ | `/opsx:apply`   | Implement tasks from a change              |
+ | `/opsx:archive` | Archive a completed change                 |
+
+**Additional commands:**
+
+ | Command            | What it does                                             |
+ |--------------------|----------------------------------------------------------|
+ | `/opsx:new`      | Start a new change, step through artifacts one at a time |
+ | `/opsx:continue` | Continue working on an existing change                   |
+ | `/opsx:ff`       | Fast-forward: create all artifacts at once               |
+ | `/opsx:verify`   | Verify implementation matches artifacts                  |
+
+---
+
+## What's Next?
+
+Try `/opsx:propose` on something you actually want to build. You've got the rhythm now!
+```
+
+---
+
+## Graceful Exit Handling
+
+### User wants to stop mid-way
+
+If the user says they need to stop, want to pause, or seem disengaged:
+
+```
+No problem! Your change is saved at the `changeRoot` reported by `openspec status --change "<name>" --json`.
+
+To pick up where we left off later:
+- `/opsx:continue <name>` - Resume artifact creation
+- `/opsx:apply <name>` - Jump to implementation (if tasks exist)
+
+The work won't be lost. Come back whenever you're ready.
+```
+
+Exit gracefully without pressure.
+
+### User just wants command reference
+
+If the user says they just want to see the commands or skip the tutorial:
+
+```
+## OpenSpec Quick Reference
+
+**Core workflow:**
+
+ | Command                  | What it does                               |
+ |--------------------------|--------------------------------------------|
+ | `/opsx:propose <name>` | Create a change and generate all artifacts |
+ | `/opsx:explore`        | Think through problems (no code changes)   |
+ | `/opsx:apply <name>`   | Implement tasks                            |
+ | `/opsx:archive <name>` | Archive when done                          |
+
+**Additional commands:**
+
+ | Command                   | What it does                        |
+ |---------------------------|-------------------------------------|
+ | `/opsx:new <name>`      | Start a new change, step by step    |
+ | `/opsx:continue <name>` | Continue an existing change         |
+ | `/opsx:ff <name>`       | Fast-forward: all artifacts at once |
+ | `/opsx:verify <name>`   | Verify implementation               |
+
+Try `/opsx:propose` to start your first change.
+```
+
+Exit gracefully.
+
+---
+
+## Guardrails
+
+- **Follow the EXPLAIN → DO → SHOW → PAUSE pattern** at key transitions (after explore, after proposal draft, after tasks, after archive)
+- **Keep narration light** during implementation—teach without lecturing
+- **Don't skip phases** even if the change is small—the goal is teaching the workflow
+- **Pause for acknowledgment** at marked points, but don't over-pause
+- **Handle exits gracefully**—never pressure the user to continue
+- **Use real codebase tasks**—don't simulate or use fake examples
+- **Adjust scope gently**—guide toward smaller tasks but respect user choice
diff --git a/.claude/commands/opsx/sync.md b/.claude/commands/opsx/sync.md
new file mode 100644
index 000000000..a3550cf48
--- /dev/null
+++ b/.claude/commands/opsx/sync.md
@@ -0,0 +1,144 @@
+---
+name: "OPSX: Sync"
+description: Sync delta specs from a change to main specs
+allowed-tools: Bash(openspec:*)
+category: Workflow
+tags: [workflow, specs, experimental]
+---
+
+Sync delta specs from a change to main specs.
+
+This is an **agent-driven** operation - you will read delta specs and directly edit main specs to apply the changes. This allows intelligent merging (e.g., adding a scenario without copying the entire requirement).
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name after `/opsx:sync` (e.g., `/opsx:sync add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show changes that have delta specs (under `specs/` directory).
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Resolve change context**
+
+   Run:
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+
+3. **Find delta specs**
+
+   Use `artifactPaths.specs.existingOutputPaths` from the status JSON as the list of delta spec files.
+
+   Each delta spec file contains sections like:
+   - `## ADDED Requirements` - New requirements to add
+   - `## MODIFIED Requirements` - Changes to existing requirements
+   - `## REMOVED Requirements` - Requirements to remove
+   - `## RENAMED Requirements` - Requirements to rename (FROM:/TO: format)
+
+   If no delta specs found, inform user and stop.
+
+4. **For each delta spec, apply changes to main specs**
+
+   For each repo-local capability delta spec path returned by the CLI:
+
+   a. **Read the delta spec** to understand the intended changes
+
+   b. **Read the main spec** at `openspec/specs/<capability>/spec.md` (may not exist yet)
+
+   c. **Apply changes intelligently**:
+
+      **ADDED Requirements:**
+      - If requirement doesn't exist in main spec → add it
+      - If requirement already exists → update it to match (treat as implicit MODIFIED)
+
+      **MODIFIED Requirements:**
+      - Find the requirement in main spec
+      - Apply the changes - this can be:
+        - Adding new scenarios (don't need to copy existing ones)
+        - Modifying existing scenarios
+        - Changing the requirement description
+      - Preserve scenarios/content not mentioned in the delta
+
+      **REMOVED Requirements:**
+      - Remove the entire requirement block from main spec
+
+      **RENAMED Requirements:**
+      - Find the FROM requirement, rename to TO
+
+   d. **Create new main spec** if capability doesn't exist yet:
+      - Create `openspec/specs/<capability>/spec.md`
+      - Add Purpose section (can be brief, mark as TBD)
+      - Add Requirements section with the ADDED requirements
+
+5. **Show summary**
+
+   After applying all changes, summarize:
+   - Which capabilities were updated
+   - What changes were made (requirements added/modified/removed/renamed)
+
+**Delta Spec Format Reference**
+
+```markdown
+## ADDED Requirements
+
+### Requirement: New Feature
+The system SHALL do something new.
+
+#### Scenario: Basic case
+- **WHEN** user does X
+- **THEN** system does Y
+
+## MODIFIED Requirements
+
+### Requirement: Existing Feature
+#### Scenario: New scenario to add
+- **WHEN** user does A
+- **THEN** system does B
+
+## REMOVED Requirements
+
+### Requirement: Deprecated Feature
+
+## RENAMED Requirements
+
+- FROM: `### Requirement: Old Name`
+- TO: `### Requirement: New Name`
+```
+
+**Key Principle: Intelligent Merging**
+
+Unlike programmatic merging, you can apply **partial updates**:
+- To add a scenario, just include that scenario under MODIFIED - don't copy existing scenarios
+- The delta represents *intent*, not a wholesale replacement
+- Use your judgment to merge changes sensibly
+
+**Output On Success**
+
+```
+## Specs Synced: <change-name>
+
+Updated main specs:
+
+**<capability-1>**:
+- Added requirement: "New Feature"
+- Modified requirement: "Existing Feature" (added 1 scenario)
+
+**<capability-2>**:
+- Created new spec file
+- Added requirement: "Another Feature"
+
+Main specs are now updated. The change remains active - archive when implementation is complete.
+```
+
+**Guardrails**
+- Read both delta and main specs before making changes
+- Preserve existing content not mentioned in delta
+- If something is unclear, ask for clarification
+- Show what you're changing as you go
+- The operation should be idempotent - running twice should give same result
diff --git a/.claude/commands/opsx/verify.md b/.claude/commands/opsx/verify.md
new file mode 100644
index 000000000..7f6cade12
--- /dev/null
+++ b/.claude/commands/opsx/verify.md
@@ -0,0 +1,168 @@
+---
+name: "OPSX: Verify"
+description: Verify implementation matches change artifacts before archiving
+allowed-tools: Bash(openspec:*)
+category: Workflow
+tags: [workflow, verify, experimental]
+---
+
+Verify that an implementation matches the change artifacts (specs, tasks, design).
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name after `/opsx:verify` (e.g., `/opsx:verify add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show changes that have implementation tasks (tasks artifact exists).
+   Include the schema used for each change if available.
+   Mark changes with incomplete tasks as "(In Progress)".
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Check status to understand the schema**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used (e.g., "spec-driven")
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context
+   - Which artifacts exist for this change
+
+3. **Get planning context and load artifacts**
+
+   ```bash
+   openspec instructions apply --change "<name>" --json
+   ```
+
+   This returns the change directory and `contextFiles` (artifact ID -> array of concrete file paths). Read all available artifacts from `contextFiles`.
+
+4. **Initialize verification report structure**
+
+   Create a report structure with three dimensions:
+   - **Completeness**: Track tasks and spec coverage
+   - **Correctness**: Track requirement implementation and scenario coverage
+   - **Coherence**: Track design adherence and pattern consistency
+
+   Each dimension can have CRITICAL, WARNING, or SUGGESTION issues.
+
+5. **Verify Completeness**
+
+   **Task Completion**:
+   - If `contextFiles.tasks` exists, read every file path in it
+   - Parse checkboxes: `- [ ]` (incomplete) vs `- [x]` (complete)
+   - Count complete vs total tasks
+   - If incomplete tasks exist:
+     - Add CRITICAL issue for each incomplete task
+     - Recommendation: "Complete task: <description>" or "Mark as done if already implemented"
+
+   **Spec Coverage**:
+   - If delta specs exist in `contextFiles.specs`:
+     - Extract all requirements (marked with "### Requirement:")
+     - For each requirement:
+       - Search codebase for keywords related to the requirement
+       - Assess if implementation likely exists
+     - If requirements appear unimplemented:
+       - Add CRITICAL issue: "Requirement not found: <requirement name>"
+       - Recommendation: "Implement requirement X: <description>"
+
+6. **Verify Correctness**
+
+   **Requirement Implementation Mapping**:
+   - For each requirement from delta specs:
+     - Search codebase for implementation evidence
+     - If found, note file paths and line ranges
+     - Assess if implementation matches requirement intent
+     - If divergence detected:
+       - Add WARNING: "Implementation may diverge from spec: <details>"
+       - Recommendation: "Review <file>:<lines> against requirement X"
+
+   **Scenario Coverage**:
+   - For each scenario in delta specs (marked with "#### Scenario:"):
+     - Check if conditions are handled in code
+     - Check if tests exist covering the scenario
+     - If scenario appears uncovered:
+       - Add WARNING: "Scenario not covered: <scenario name>"
+       - Recommendation: "Add test or implementation for scenario: <description>"
+
+7. **Verify Coherence**
+
+   **Design Adherence**:
+   - If `contextFiles.design` exists:
+     - Extract key decisions (look for sections like "Decision:", "Approach:", "Architecture:")
+     - Verify implementation follows those decisions
+     - If contradiction detected:
+       - Add WARNING: "Design decision not followed: <decision>"
+       - Recommendation: "Update implementation or revise design.md to match reality"
+   - If no design.md: Skip design adherence check, note "No design.md to verify against"
+
+   **Code Pattern Consistency**:
+   - Review new code for consistency with project patterns
+   - Check file naming, directory structure, coding style
+   - If significant deviations found:
+     - Add SUGGESTION: "Code pattern deviation: <details>"
+     - Recommendation: "Consider following project pattern: <example>"
+
+8. **Generate Verification Report**
+
+   **Summary Scorecard**:
+   ```
+   ## Verification Report: <change-name>
+
+   ### Summary
+   | Dimension    | Status           |
+   |--------------|------------------|
+   | Completeness | X/Y tasks, N reqs|
+   | Correctness  | M/N reqs covered |
+   | Coherence    | Followed/Issues  |
+   ```
+
+   **Issues by Priority**:
+
+   1. **CRITICAL** (Must fix before archive):
+      - Incomplete tasks
+      - Missing requirement implementations
+      - Each with specific, actionable recommendation
+
+   2. **WARNING** (Should fix):
+      - Spec/design divergences
+      - Missing scenario coverage
+      - Each with specific recommendation
+
+   3. **SUGGESTION** (Nice to fix):
+      - Pattern inconsistencies
+      - Minor improvements
+      - Each with specific recommendation
+
+   **Final Assessment**:
+   - If CRITICAL issues: "X critical issue(s) found. Fix before archiving."
+   - If only warnings: "No critical issues. Y warning(s) to consider. Ready for archive (with noted improvements)."
+   - If all clear: "All checks passed. Ready for archive."
+
+**Verification Heuristics**
+
+- **Completeness**: Focus on objective checklist items (checkboxes, requirements list)
+- **Correctness**: Use keyword search, file path analysis, reasonable inference - don't require perfect certainty
+- **Coherence**: Look for glaring inconsistencies, don't nitpick style
+- **False Positives**: When uncertain, prefer SUGGESTION over WARNING, WARNING over CRITICAL
+- **Actionability**: Every issue must have a specific recommendation with file/line references where applicable
+
+**Graceful Degradation**
+
+- If only tasks.md exists: verify task completion only, skip spec/design checks
+- If tasks + specs exist: verify completeness and correctness, skip design
+- If full artifacts: verify all three dimensions
+- Always note which checks were skipped and why
+
+**Output Format**
+
+Use clear markdown with:
+- Table for summary scorecard
+- Grouped lists for issues (CRITICAL/WARNING/SUGGESTION)
+- Code references in format: `file.ts:123`
+- Specific, actionable recommendations
+- No vague suggestions like "consider reviewing"
diff --git a/.claude/skills/openspec-apply-change/SKILL.md b/.claude/skills/openspec-apply-change/SKILL.md
new file mode 100644
index 000000000..1375861c3
--- /dev/null
+++ b/.claude/skills/openspec-apply-change/SKILL.md
@@ -0,0 +1,160 @@
+---
+name: openspec-apply-change
+description: Implement tasks from an OpenSpec change. Use when the user wants to start implementing, continue implementation, or work through tasks.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Implement tasks from an OpenSpec change.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **Select the change**
+
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes and use the **AskUserQuestion tool** to let the user select
+
+   Always announce: "Using change: <name>" and how to override (e.g., `/opsx:apply <other>`).
+
+2. **Check status to understand the schema**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used (e.g., "spec-driven")
+   - `planningHome`, `changeRoot`, and `actionContext`: planning scope and edit constraints
+   - Which artifact contains the tasks (typically "tasks" for spec-driven, check status for others)
+
+3. **Get apply instructions**
+
+   ```bash
+   openspec instructions apply --change "<name>" --json
+   ```
+
+   This returns:
+   - `contextFiles`: artifact ID -> array of concrete file paths (varies by schema - could be proposal/specs/design/tasks or spec/tests/implementation/docs)
+   - Progress (total, complete, remaining)
+   - Task list with status
+   - Dynamic instruction based on current state
+
+   **Handle states:**
+   - If `state: "blocked"` (missing artifacts): show message, suggest using openspec-continue-change
+   - If `state: "all_done"`: congratulate, suggest archive
+   - Otherwise: proceed to implementation
+
+4. **Read context files**
+
+   Read every file path listed under `contextFiles` from the apply instructions output.
+   The files depend on the schema being used:
+   - **spec-driven**: proposal, specs, design, tasks
+   - Other schemas: follow the contextFiles from CLI output
+
+5. **Show current progress**
+
+   Display:
+   - Schema being used
+   - Progress: "N/M tasks complete"
+   - Remaining tasks overview
+   - Dynamic instruction from CLI
+
+6. **Implement tasks (loop until done or blocked)**
+
+   For each pending task:
+   - Show which task is being worked on
+   - Make the code changes required
+   - Keep changes minimal and focused
+   - Mark task complete in the tasks file: `- [ ]` → `- [x]`
+   - Continue to next task
+
+   **Pause if:**
+   - Task is unclear → ask for clarification
+   - Implementation reveals a design issue → suggest updating artifacts
+   - Error or blocker encountered → report and wait for guidance
+   - User interrupts
+
+7. **On completion or pause, show status**
+
+   Display:
+   - Tasks completed this session
+   - Overall progress: "N/M tasks complete"
+   - If all done: suggest archive
+   - If paused: explain why and wait for guidance
+
+**Output During Implementation**
+
+```
+## Implementing: <change-name> (schema: <schema-name>)
+
+Working on task 3/7: <task description>
+[...implementation happening...]
+✓ Task complete
+
+Working on task 4/7: <task description>
+[...implementation happening...]
+✓ Task complete
+```
+
+**Output On Completion**
+
+```
+## Implementation Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Progress:** 7/7 tasks complete ✓
+
+### Completed This Session
+- [x] Task 1
+- [x] Task 2
+...
+
+All tasks complete! Ready to archive this change.
+```
+
+**Output On Pause (Issue Encountered)**
+
+```
+## Implementation Paused
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Progress:** 4/7 tasks complete
+
+### Issue Encountered
+<description of the issue>
+
+**Options:**
+1. <option 1>
+2. <option 2>
+3. Other approach
+
+What would you like to do?
+```
+
+**Guardrails**
+- Keep going through tasks until done or blocked
+- Always read context files before starting (from the apply instructions output)
+- If task is ambiguous, pause and ask before implementing
+- If implementation reveals issues, pause and suggest artifact updates
+- Keep code changes minimal and scoped to each task
+- Update task checkbox immediately after completing each task
+- Pause on errors, blockers, or unclear requirements - don't guess
+- Use contextFiles from CLI output, don't assume specific file names
+
+**Fluid Workflow Integration**
+
+This skill supports the "actions on a change" model:
+
+- **Can be invoked anytime**: Before all artifacts are done (if tasks exist), after partial implementation, interleaved with other actions
+- **Allows artifact updates**: If implementation reveals design issues, suggest updating artifacts - not phase-locked, work fluidly
diff --git a/.claude/skills/openspec-archive-change/SKILL.md b/.claude/skills/openspec-archive-change/SKILL.md
new file mode 100644
index 000000000..c0c169d14
--- /dev/null
+++ b/.claude/skills/openspec-archive-change/SKILL.md
@@ -0,0 +1,118 @@
+---
+name: openspec-archive-change
+description: Archive a completed change in the experimental workflow. Use when the user wants to finalize and archive a change after implementation is complete.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Archive a completed change in the experimental workflow.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show only active changes (not already archived).
+   Include the schema used for each change if available.
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Check artifact completion status**
+
+   Run `openspec status --change "<name>" --json` to check artifact completion.
+
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context
+   - `artifacts`: List of artifacts with their status (`done` or other)
+
+   **If any artifacts are not `done`:**
+   - Display warning listing incomplete artifacts
+   - Use **AskUserQuestion tool** to confirm user wants to proceed
+   - Proceed if user confirms
+
+3. **Check task completion status**
+
+   Read the tasks file (typically `tasks.md`) to check for incomplete tasks.
+
+   Count tasks marked with `- [ ]` (incomplete) vs `- [x]` (complete).
+
+   **If incomplete tasks found:**
+   - Display warning showing count of incomplete tasks
+   - Use **AskUserQuestion tool** to confirm user wants to proceed
+   - Proceed if user confirms
+
+   **If no tasks file exists:** Proceed without task-related warning.
+
+4. **Assess delta spec sync state**
+
+   Use `artifactPaths.specs.existingOutputPaths` from status JSON to check for delta specs. If none exist, proceed without sync prompt.
+
+   **If delta specs exist:**
+   - Compare each delta spec with its corresponding main spec at `openspec/specs/<capability>/spec.md`
+   - Determine what changes would be applied (adds, modifications, removals, renames)
+   - Show a combined summary before prompting
+
+   **Prompt options:**
+   - If changes needed: "Sync now (recommended)", "Archive without syncing"
+   - If already synced: "Archive now", "Sync anyway", "Cancel"
+
+   If user chooses sync, use Task tool (subagent_type: "general-purpose", prompt: "Use Skill tool to invoke openspec-sync-specs for change '<name>'. Delta spec analysis: <include the analyzed delta spec summary>"). Proceed to archive regardless of choice.
+
+5. **Perform the archive**
+
+   Create an `archive` directory under `planningHome.changesDir` if it doesn't exist:
+   ```bash
+   mkdir -p "<planningHome.changesDir>/archive"
+   ```
+
+   Generate target name using current date: `YYYY-MM-DD-<change-name>`
+
+   **Check if target already exists:**
+   - If yes: Fail with error, suggest renaming existing archive or using different date
+   - If no: Move `changeRoot` to the archive directory
+
+   ```bash
+   mv "<changeRoot>" "<planningHome.changesDir>/archive/YYYY-MM-DD-<name>"
+   ```
+
+6. **Display summary**
+
+   Show archive completion summary including:
+   - Change name
+   - Schema that was used
+   - Archive location
+   - Whether specs were synced (if applicable)
+   - Note about any warnings (incomplete artifacts/tasks)
+
+**Output On Success**
+
+```
+## Archive Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Archived to:** the archive path derived from `planningHome.changesDir`/YYYY-MM-DD-<name>/
+**Specs:** ✓ Synced to main specs (or "No delta specs" or "Sync skipped")
+
+All artifacts complete. All tasks complete.
+```
+
+**Guardrails**
+- Always prompt for change selection if not provided
+- Use artifact graph (openspec status --json) for completion checking
+- Don't block archive on warnings - just inform and confirm
+- Preserve .openspec.yaml when moving to archive (it moves with the directory)
+- Show clear summary of what happened
+- If sync is requested, use openspec-sync-specs approach (agent-driven)
+- If delta specs exist, always run the sync assessment and show the combined summary before prompting
diff --git a/.claude/skills/openspec-bulk-archive-change/SKILL.md b/.claude/skills/openspec-bulk-archive-change/SKILL.md
new file mode 100644
index 000000000..309152af7
--- /dev/null
+++ b/.claude/skills/openspec-bulk-archive-change/SKILL.md
@@ -0,0 +1,249 @@
+---
+name: openspec-bulk-archive-change
+description: Archive multiple completed changes at once. Use when archiving several parallel changes.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Archive multiple completed changes in a single operation.
+
+This skill allows you to batch-archive changes, handling spec conflicts intelligently by checking the codebase to determine what's actually implemented.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: None required (prompts for selection)
+
+**Steps**
+
+1. **Get active changes**
+
+   Run `openspec list --json` to get all active changes.
+
+   If no active changes exist, inform user and stop.
+
+2. **Prompt for change selection**
+
+   Use **AskUserQuestion tool** with multi-select to let user choose changes:
+   - Show each change with its schema
+   - Include an option for "All changes"
+   - Allow any number of selections (1+ works, 2+ is the typical use case)
+
+   **IMPORTANT**: Do NOT auto-select. Always let the user choose.
+
+3. **Batch validation - gather status for all selected changes**
+
+   For each selected change, collect:
+
+   a. **Artifact status** - Run `openspec status --change "<name>" --json`
+      - Parse `schemaName`, `artifacts`, `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`
+      - Note which artifacts are `done` vs other states
+
+   b. **Task completion** - Read `artifactPaths.tasks.existingOutputPaths` from status JSON
+      - Count `- [ ]` (incomplete) vs `- [x]` (complete)
+      - If no tasks file exists, note as "No tasks"
+
+   c. **Delta specs** - Check `artifactPaths.specs.existingOutputPaths` from status JSON
+      - List which capability specs exist
+      - For each, extract requirement names (lines matching `### Requirement: <name>`)
+
+4. **Detect spec conflicts**
+
+   Build a map of `capability -> [changes that touch it]`:
+
+   ```
+   auth -> [change-a, change-b]  <- CONFLICT (2+ changes)
+   api  -> [change-c]            <- OK (only 1 change)
+   ```
+
+   A conflict exists when 2+ selected changes have delta specs for the same capability.
+
+5. **Resolve conflicts agentically**
+
+   **For each conflict**, investigate the codebase:
+
+   a. **Read the delta specs** from each conflicting change to understand what each claims to add/modify
+
+   b. **Search the codebase** for implementation evidence:
+      - Look for code implementing requirements from each delta spec
+      - Check for related files, functions, or tests
+
+   c. **Determine resolution**:
+      - If only one change is actually implemented -> sync that one's specs
+      - If both implemented -> apply in chronological order (older first, newer overwrites)
+      - If neither implemented -> skip spec sync, warn user
+
+   d. **Record resolution** for each conflict:
+      - Which change's specs to apply
+      - In what order (if both)
+      - Rationale (what was found in codebase)
+
+6. **Show consolidated status table**
+
+   Display a table summarizing all changes:
+
+   ```
+   | Change              | Artifacts | Tasks | Specs   | Conflicts | Status |
+   |---------------------|-----------|-------|---------|-----------|--------|
+   | schema-management   | Done      | 5/5   | 2 delta | None      | Ready  |
+   | project-config      | Done      | 3/3   | 1 delta | None      | Ready  |
+   | add-oauth           | Done      | 4/4   | 1 delta | auth (!)  | Ready* |
+   | add-verify-skill    | 1 left    | 2/5   | None    | None      | Warn   |
+   ```
+
+   For conflicts, show the resolution:
+   ```
+   * Conflict resolution:
+     - auth spec: Will apply add-oauth then add-jwt (both implemented, chronological order)
+   ```
+
+   For incomplete changes, show warnings:
+   ```
+   Warnings:
+   - add-verify-skill: 1 incomplete artifact, 3 incomplete tasks
+   ```
+
+7. **Confirm batch operation**
+
+   Use **AskUserQuestion tool** with a single confirmation:
+
+   - "Archive N changes?" with options based on status
+   - Options might include:
+     - "Archive all N changes"
+     - "Archive only N ready changes (skip incomplete)"
+     - "Cancel"
+
+   If there are incomplete changes, make clear they'll be archived with warnings.
+
+8. **Execute archive for each confirmed change**
+
+   Process changes in the determined order (respecting conflict resolution):
+
+   a. **Sync specs** if delta specs exist:
+      - Use the openspec-sync-specs approach (agent-driven intelligent merge)
+      - For conflicts, apply in resolved order
+      - Track if sync was done
+
+   b. **Perform the archive**:
+      ```bash
+      mkdir -p "<planningHome.changesDir>/archive"
+      mv "<changeRoot>" "<planningHome.changesDir>/archive/YYYY-MM-DD-<name>"
+      ```
+
+   c. **Track outcome** for each change:
+      - Success: archived successfully
+      - Failed: error during archive (record error)
+      - Skipped: user chose not to archive (if applicable)
+
+9. **Display summary**
+
+   Show final results:
+
+   ```
+   ## Bulk Archive Complete
+
+   Archived 3 changes:
+   - schema-management-cli -> archive/2026-01-19-schema-management-cli/
+   - project-config -> archive/2026-01-19-project-config/
+   - add-oauth -> archive/2026-01-19-add-oauth/
+
+   Skipped 1 change:
+   - add-verify-skill (user chose not to archive incomplete)
+
+   Spec sync summary:
+   - 4 delta specs synced to main specs
+   - 1 conflict resolved (auth: applied both in chronological order)
+   ```
+
+   If any failures:
+   ```
+   Failed 1 change:
+   - some-change: Archive directory already exists
+   ```
+
+**Conflict Resolution Examples**
+
+Example 1: Only one implemented
+```
+Conflict: specs/auth/spec.md touched by [add-oauth, add-jwt]
+
+Checking add-oauth:
+- Delta adds "OAuth Provider Integration" requirement
+- Searching codebase... found src/auth/oauth.ts implementing OAuth flow
+
+Checking add-jwt:
+- Delta adds "JWT Token Handling" requirement
+- Searching codebase... no JWT implementation found
+
+Resolution: Only add-oauth is implemented. Will sync add-oauth specs only.
+```
+
+Example 2: Both implemented
+```
+Conflict: specs/api/spec.md touched by [add-rest-api, add-graphql]
+
+Checking add-rest-api (created 2026-01-10):
+- Delta adds "REST Endpoints" requirement
+- Searching codebase... found src/api/rest.ts
+
+Checking add-graphql (created 2026-01-15):
+- Delta adds "GraphQL Schema" requirement
+- Searching codebase... found src/api/graphql.ts
+
+Resolution: Both implemented. Will apply add-rest-api specs first,
+then add-graphql specs (chronological order, newer takes precedence).
+```
+
+**Output On Success**
+
+```
+## Bulk Archive Complete
+
+Archived N changes:
+- <change-1> -> archive/YYYY-MM-DD-<change-1>/
+- <change-2> -> archive/YYYY-MM-DD-<change-2>/
+
+Spec sync summary:
+- N delta specs synced to main specs
+- No conflicts (or: M conflicts resolved)
+```
+
+**Output On Partial Success**
+
+```
+## Bulk Archive Complete (partial)
+
+Archived N changes:
+- <change-1> -> archive/YYYY-MM-DD-<change-1>/
+
+Skipped M changes:
+- <change-2> (user chose not to archive incomplete)
+
+Failed K changes:
+- <change-3>: Archive directory already exists
+```
+
+**Output When No Changes**
+
+```
+## No Changes to Archive
+
+No active changes found. Create a new change to get started.
+```
+
+**Guardrails**
+- Allow any number of changes (1+ is fine, 2+ is the typical use case)
+- Always prompt for selection, never auto-select
+- Detect spec conflicts early and resolve by checking codebase
+- When both changes are implemented, apply specs in chronological order
+- Skip spec sync only when implementation is missing (warn user)
+- Show clear per-change status before confirming
+- Use single confirmation for entire batch
+- Track and report all outcomes (success/skip/fail)
+- Preserve .openspec.yaml when moving to archive
+- Archive directory target uses current date: YYYY-MM-DD-<name>
+- If archive target exists, fail that change but continue with others
diff --git a/.claude/skills/openspec-continue-change/SKILL.md b/.claude/skills/openspec-continue-change/SKILL.md
new file mode 100644
index 000000000..31b476f24
--- /dev/null
+++ b/.claude/skills/openspec-continue-change/SKILL.md
@@ -0,0 +1,122 @@
+---
+name: openspec-continue-change
+description: Continue working on an OpenSpec change by creating the next artifact. Use when the user wants to progress their change, create the next artifact, or continue their workflow.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Continue working on a change by creating the next artifact.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes sorted by most recently modified. Then use the **AskUserQuestion tool** to let the user select which change to work on.
+
+   Present the top 3-4 most recently modified changes as options, showing:
+   - Change name
+   - Schema (from `schema` field if present, otherwise "spec-driven")
+   - Status (e.g., "0/5 tasks", "complete", "no tasks")
+   - How recently it was modified (from `lastModified` field)
+
+   Mark the most recently modified change as "(Recommended)" since it's likely what the user wants to continue.
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Check current status**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand current state. The response includes:
+   - `schemaName`: The workflow schema being used (e.g., "spec-driven")
+   - `artifacts`: Array of artifacts with their status ("done", "ready", "blocked")
+   - `isComplete`: Boolean indicating if all artifacts are complete
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context. Use these instead of assuming repo-local paths.
+
+3. **Act based on status**:
+
+   ---
+
+   **If all artifacts are complete (`isComplete: true`)**:
+   - Congratulate the user
+   - Show final status including the schema used
+   - Suggest: "All artifacts created! You can now implement this change or archive it."
+   - STOP
+
+   ---
+
+   **If artifacts are ready to create** (status shows artifacts with `status: "ready"`):
+   - Pick the FIRST artifact with `status: "ready"` from the status output
+   - Get its instructions:
+     ```bash
+     openspec instructions <artifact-id> --change "<name>" --json
+     ```
+   - Parse the JSON. The key fields are:
+     - `context`: Project background (constraints for you - do NOT include in output)
+     - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
+     - `template`: The structure to use for your output file
+     - `instruction`: Schema-specific guidance
+     - `resolvedOutputPath`: Resolved path or pattern to write the artifact
+     - `dependencies`: Completed artifacts to read for context
+   - **Create the artifact file**:
+     - Read any completed dependency files for context
+     - Use `template` as the structure - fill in its sections
+     - Apply `context` and `rules` as constraints when writing - but do NOT copy them into the file
+     - Write to the `resolvedOutputPath` specified in instructions. If it is a glob pattern, choose the concrete file path using the schema instruction and the change's context
+   - Show what was created and what's now unlocked
+   - STOP after creating ONE artifact
+
+   ---
+
+   **If no artifacts are ready (all blocked)**:
+   - This shouldn't happen with a valid schema
+   - Show status and suggest checking for issues
+
+4. **After creating an artifact, show progress**
+   ```bash
+   openspec status --change "<name>"
+   ```
+
+**Output**
+
+After each invocation, show:
+- Which artifact was created
+- Schema workflow being used
+- Current progress (N/M complete)
+- What artifacts are now unlocked
+- Prompt: "Want to continue? Just ask me to continue or tell me what to do next."
+
+**Artifact Creation Guidelines**
+
+The artifact types and their purpose depend on the schema. Use the `instruction` field from the instructions output to understand what to create.
+
+Common artifact patterns:
+
+**spec-driven schema** (proposal → specs → design → tasks):
+- **proposal.md**: Ask user about the change if not clear. Fill in Why, What Changes, Capabilities, Impact.
+  - The Capabilities section is critical - each capability listed will need a spec file.
+- **specs/<capability>/spec.md**: Create one spec per capability listed in the proposal's Capabilities section (use the capability name, not the change name).
+- **design.md**: Document technical decisions, architecture, and implementation approach.
+- **tasks.md**: Break down implementation into checkboxed tasks.
+
+For other schemas, follow the `instruction` field from the CLI output.
+
+**Guardrails**
+- Create ONE artifact per invocation
+- Always read dependency artifacts before creating a new one
+- Never skip artifacts or create out of order
+- If context is unclear, ask the user before creating
+- Verify the artifact file exists after writing before marking progress
+- Use the schema's artifact sequence, don't assume specific artifact names
+- **IMPORTANT**: `context` and `rules` are constraints for YOU, not content for the file
+  - Do NOT copy `<context>`, `<rules>`, `<project_context>` blocks into the artifact
+  - These guide what you write, but should never appear in the output
diff --git a/.claude/skills/openspec-explore/SKILL.md b/.claude/skills/openspec-explore/SKILL.md
new file mode 100644
index 000000000..771271a8f
--- /dev/null
+++ b/.claude/skills/openspec-explore/SKILL.md
@@ -0,0 +1,290 @@
+---
+name: openspec-explore
+description: Enter explore mode - a thinking partner for exploring ideas, investigating problems, and clarifying requirements. Use when the user wants to think through something before or during a change.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Enter explore mode. Think deeply. Visualize freely. Follow the conversation wherever it goes.
+
+**IMPORTANT: Explore mode is for thinking, not implementing.** You may read files, search code, and investigate the codebase, but you must NEVER write code or implement features. If the user asks you to implement something, remind them to exit explore mode first and create a change proposal. You MAY create OpenSpec artifacts (proposals, designs, specs) if the user asks—that's capturing thinking, not implementing.
+
+**This is a stance, not a workflow.** There are no fixed steps, no required sequence, no mandatory outputs. You're a thinking partner helping the user explore.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+---
+
+## The Stance
+
+- **Curious, not prescriptive** - Ask questions that emerge naturally, don't follow a script
+- **Open threads, not interrogations** - Surface multiple interesting directions and let the user follow what resonates. Don't funnel them through a single path of questions.
+- **Visual** - Use ASCII diagrams liberally when they'd help clarify thinking
+- **Adaptive** - Follow interesting threads, pivot when new information emerges
+- **Patient** - Don't rush to conclusions, let the shape of the problem emerge
+- **Grounded** - Explore the actual codebase when relevant, don't just theorize
+
+---
+
+## What You Might Do
+
+Depending on what the user brings, you might:
+
+**Explore the problem space**
+- Ask clarifying questions that emerge from what they said
+- Challenge assumptions
+- Reframe the problem
+- Find analogies
+
+**Investigate the codebase**
+- Map existing architecture relevant to the discussion
+- Find integration points
+- Identify patterns already in use
+- Surface hidden complexity
+
+**Compare options**
+- Brainstorm multiple approaches
+- Build comparison tables
+- Sketch tradeoffs
+- Recommend a path (if asked)
+
+**Visualize**
+```
+┌─────────────────────────────────────────┐
+│     Use ASCII diagrams liberally        │
+├─────────────────────────────────────────┤
+│                                         │
+│      ┌────────┐         ┌────────┐      │
+│      │ State  │────────▶│ State  │      │
+│      │   A    │         │   B    │      │
+│      └────────┘         └────────┘      │
+│                                         │
+│   System diagrams, state machines,      │
+│   data flows, architecture sketches,    │
+│   dependency graphs, comparison tables  │
+│                                         │
+└─────────────────────────────────────────┘
+```
+
+**Surface risks and unknowns**
+- Identify what could go wrong
+- Find gaps in understanding
+- Suggest spikes or investigations
+
+---
+
+## OpenSpec Awareness
+
+You have full context of the OpenSpec system. Use it naturally, don't force it.
+
+### Check for context
+
+At the start, quickly check what exists:
+```bash
+openspec list --json
+```
+
+This tells you:
+- If there are active changes
+- Their names, schemas, and status
+- What the user might be working on
+
+### When no change exists
+
+Think freely. When insights crystallize, you might offer:
+
+- "This feels solid enough to start a change. Want me to create a proposal?"
+- Or keep exploring - no pressure to formalize
+
+### When a change exists
+
+If the user mentions a change or you detect one is relevant:
+
+1. **Resolve and read existing artifacts for context**
+   - Run `openspec status --change "<name>" --json`.
+   - Use `changeRoot`, `artifactPaths`, and `actionContext` from the status JSON.
+   - Read existing files from `artifactPaths.<artifact>.existingOutputPaths`.
+
+2. **Reference them naturally in conversation**
+   - "Your design mentions using Redis, but we just realized SQLite fits better..."
+   - "The proposal scopes this to premium users, but we're now thinking everyone..."
+
+3. **Offer to capture when decisions are made**
+
+    | Insight Type               | Where to Capture               |
+    |----------------------------|--------------------------------|
+    | New requirement discovered | `specs/<capability>/spec.md` |
+    | Requirement changed        | `specs/<capability>/spec.md` |
+    | Design decision made       | `design.md`                  |
+    | Scope changed              | `proposal.md`                |
+    | New work identified        | `tasks.md`                   |
+    | Assumption invalidated     | Relevant artifact              |
+
+   Example offers:
+   - "That's a design decision. Capture it in design.md?"
+   - "This is a new requirement. Add it to specs?"
+   - "This changes scope. Update the proposal?"
+
+4. **The user decides** - Offer and move on. Don't pressure. Don't auto-capture.
+
+---
+
+## What You Don't Have To Do
+
+- Follow a script
+- Ask the same questions every time
+- Produce a specific artifact
+- Reach a conclusion
+- Stay on topic if a tangent is valuable
+- Be brief (this is thinking time)
+
+---
+
+## Handling Different Entry Points
+
+**User brings a vague idea:**
+```
+User: I'm thinking about adding real-time collaboration
+
+You: Real-time collab is a big space. Let me think about this...
+
+      COLLABORATION SPECTRUM
+      ════════════════════════════════════════════
+
+      Awareness          Coordination         Sync
+          │                   │                 │
+          ▼                   ▼                 ▼
+      ┌────────┐         ┌────────┐        ┌────────┐
+      │Presence│         │Cursors │        │  CRDT  │
+      │  "3    │         │ Multi  │        │Conflict│
+      │online" │         │ select │        │  free  │
+      └────────┘         └────────┘        └────────┘
+          │                   │                 │
+       trivial            moderate           complex
+
+      Where's your head at?
+```
+
+**User brings a specific problem:**
+```
+User: The auth system is a mess
+
+You: [reads codebase]
+
+     ┌─────────────────────────────────────────────┐
+     │              CURRENT AUTH FLOW              │
+     └─────────────────────────────────────────────┘
+                        │
+          ┌─────────────┼─────────────┐
+          ▼             ▼             ▼
+     ┌─────────┐  ┌─────────┐  ┌─────────┐
+     │ Google  │  │  GitHub │  │  Email  │
+     │  OAuth  │  │  OAuth  │  │  Magic  │
+     └────┬────┘  └────┬────┘  └────┬────┘
+          │             │             │
+          └─────────────┼─────────────┘
+                        ▼
+                  ┌───────────┐
+                  │  Session  │
+                  └─────┬─────┘
+                        │
+                        ▼
+                  ┌───────────┐
+                  │   Perms   │
+                  └───────────┘
+
+     I see three tangles. Which one's burning?
+```
+
+**User is stuck mid-implementation:**
+```
+User: /opsx:explore add-auth-system
+      The OAuth integration is more complex than expected
+
+You: [reads change artifacts]
+
+     You're on task 4: "Implement OAuth flow"
+
+     Let me trace what's involved...
+
+     [draws diagram, explores options, suggests paths]
+
+     Want to update the design to reflect this?
+     Or add a spike task to investigate?
+```
+
+**User wants to compare options:**
+```
+User: Should we use Postgres or SQLite?
+
+You: Generic answer is boring. What's the context?
+
+User: A CLI tool that tracks local dev environments
+
+You: That changes everything.
+
+     ┌─────────────────────────────────────────────────┐
+     │          CLI TOOL DATA STORAGE                  │
+     └─────────────────────────────────────────────────┘
+
+     Key constraints:
+     • No daemon running
+     • Must work offline
+     • Single user
+
+                  SQLite          Postgres
+     Deployment   embedded ✓      needs server ✗
+     Offline      yes ✓           no ✗
+     Single file  yes ✓           no ✗
+
+     SQLite. Not even close.
+
+     Unless... is there a sync component?
+```
+
+---
+
+## Ending Discovery
+
+There's no required ending. Discovery might:
+
+- **Flow into a proposal**: "Ready to start? I can create a change proposal."
+- **Result in artifact updates**: "Updated design.md with these decisions"
+- **Just provide clarity**: User has what they need, moves on
+- **Continue later**: "We can pick this up anytime"
+
+When it feels like things are crystallizing, you might summarize:
+
+```
+## What We Figured Out
+
+**The problem**: [crystallized understanding]
+
+**The approach**: [if one emerged]
+
+**Open questions**: [if any remain]
+
+**Next steps** (if ready):
+- Create a change proposal
+- Keep exploring: just keep talking
+```
+
+But this summary is optional. Sometimes the thinking IS the value.
+
+---
+
+## Guardrails
+
+- **Don't implement** - Never write code or implement features. Creating OpenSpec artifacts is fine, writing application code is not.
+- **Don't fake understanding** - If something is unclear, dig deeper
+- **Don't rush** - Discovery is thinking time, not task time
+- **Don't force structure** - Let patterns emerge naturally
+- **Don't auto-capture** - Offer to save insights, don't just do it
+- **Do visualize** - A good diagram is worth many paragraphs
+- **Do explore the codebase** - Ground discussions in reality
+- **Do question assumptions** - Including the user's and your own
diff --git a/.claude/skills/openspec-ff-change/SKILL.md b/.claude/skills/openspec-ff-change/SKILL.md
new file mode 100644
index 000000000..61fab93de
--- /dev/null
+++ b/.claude/skills/openspec-ff-change/SKILL.md
@@ -0,0 +1,105 @@
+---
+name: openspec-ff-change
+description: Fast-forward through OpenSpec artifact creation. Use when the user wants to quickly create all artifacts needed for implementation without stepping through each one individually.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Fast-forward through artifact creation - generate everything needed to start implementation in one go.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: The user's request should include a change name (kebab-case) OR a description of what they want to build.
+
+**Steps**
+
+1. **If no clear input provided, ask what they want to build**
+
+   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
+   > "What change do you want to work on? Describe what you want to build or fix."
+
+   From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
+
+   **IMPORTANT**: Do NOT proceed without understanding what the user wants to build.
+
+2. **Create the change directory**
+   ```bash
+   openspec new change "<name>"
+   ```
+   This creates a scaffolded change in the planning home resolved by the CLI.
+
+3. **Get the artifact build order**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to get:
+   - `applyRequires`: array of artifact IDs needed before implementation (e.g., `["tasks"]`)
+   - `artifacts`: list of all artifacts with their status and dependencies
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context. Use these instead of assuming repo-local paths.
+
+4. **Create artifacts in sequence until apply-ready**
+
+   Use the **TodoWrite tool** to track progress through the artifacts.
+
+   Loop through artifacts in dependency order (artifacts with no pending dependencies first):
+
+   a. **For each artifact that is `ready` (dependencies satisfied)**:
+      - Get instructions:
+        ```bash
+        openspec instructions <artifact-id> --change "<name>" --json
+        ```
+      - The instructions JSON includes:
+        - `context`: Project background (constraints for you - do NOT include in output)
+        - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
+        - `template`: The structure to use for your output file
+        - `instruction`: Schema-specific guidance for this artifact type
+        - `resolvedOutputPath`: Resolved path or pattern to write the artifact
+        - `dependencies`: Completed artifacts to read for context
+      - Read any completed dependency files for context
+      - Create the artifact file using `template` as the structure and write it to `resolvedOutputPath`
+      - Apply `context` and `rules` as constraints - but do NOT copy them into the file
+      - Show brief progress: "✓ Created <artifact-id>"
+
+   b. **Continue until all `applyRequires` artifacts are complete**
+      - After creating each artifact, re-run `openspec status --change "<name>" --json`
+      - Check if every artifact ID in `applyRequires` has `status: "done"` in the artifacts array
+      - Stop when all `applyRequires` artifacts are done
+
+   c. **If an artifact requires user input** (unclear context):
+      - Use **AskUserQuestion tool** to clarify
+      - Then continue with creation
+
+5. **Show final status**
+   ```bash
+   openspec status --change "<name>"
+   ```
+
+**Output**
+
+After completing all artifacts, summarize:
+- Change name and location
+- List of artifacts created with brief descriptions
+- What's ready: "All artifacts created! Ready for implementation."
+- Prompt: "Run `/opsx:apply` or ask me to implement to start working on the tasks."
+
+**Artifact Creation Guidelines**
+
+- Follow the `instruction` field from `openspec instructions` for each artifact type
+- The schema defines what each artifact should contain - follow it
+- Read dependency artifacts for context before creating new ones
+- Use `template` as the structure for your output file - fill in its sections
+- **IMPORTANT**: `context` and `rules` are constraints for YOU, not content for the file
+  - Do NOT copy `<context>`, `<rules>`, `<project_context>` blocks into the artifact
+  - These guide what you write, but should never appear in the output
+
+**Guardrails**
+- Create ALL artifacts needed for implementation (as defined by schema's `apply.requires`)
+- Always read dependency artifacts before creating a new one
+- If context is critically unclear, ask the user - but prefer making reasonable decisions to keep momentum
+- If a change with that name already exists, suggest continuing that change instead
+- Verify each artifact file exists after writing before proceeding to next
diff --git a/.claude/skills/openspec-new-change/SKILL.md b/.claude/skills/openspec-new-change/SKILL.md
new file mode 100644
index 000000000..b4d8a9e70
--- /dev/null
+++ b/.claude/skills/openspec-new-change/SKILL.md
@@ -0,0 +1,77 @@
+---
+name: openspec-new-change
+description: Start a new OpenSpec change using the experimental artifact workflow. Use when the user wants to create a new feature, fix, or modification with a structured step-by-step approach.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Start a new change using the experimental artifact-driven approach.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: The user's request should include a change name (kebab-case) OR a description of what they want to build.
+
+**Steps**
+
+1. **If no clear input provided, ask what they want to build**
+
+   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
+   > "What change do you want to work on? Describe what you want to build or fix."
+
+   From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
+
+   **IMPORTANT**: Do NOT proceed without understanding what the user wants to build.
+
+2. **Determine the workflow schema**
+
+   Use the default schema (omit `--schema`) unless the user explicitly requests a different workflow.
+
+   **Use a different schema only if the user mentions:**
+   - A specific schema name → use `--schema <name>`
+   - "show workflows" or "what workflows" → run `openspec schemas --json` and let them choose
+
+   **Otherwise**: Omit `--schema` to use the default.
+
+3. **Create the change directory**
+   ```bash
+   openspec new change "<name>"
+   ```
+   Add `--schema <name>` only if the user requested a specific workflow.
+   This creates a scaffolded change in the planning home resolved by the CLI.
+
+4. **Show the artifact status**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Use the returned `planningHome`, `changeRoot`, `artifactPaths`, and `nextSteps` instead of assuming repo-local paths.
+
+5. **Get instructions for the first artifact**
+   The first artifact depends on the schema (e.g., `proposal` for spec-driven).
+   Check the status output to find the first artifact with status "ready".
+   ```bash
+   openspec instructions <first-artifact-id> --change "<name>"
+   ```
+   This outputs the template and context for creating the first artifact.
+
+6. **STOP and wait for user direction**
+
+**Output**
+
+After completing the steps, summarize:
+- Change name and location
+- Schema/workflow being used and its artifact sequence
+- Current status (0/N artifacts complete)
+- The template for the first artifact
+- Prompt: "Ready to create the first artifact? Just describe what this change is about and I'll draft it, or ask me to continue."
+
+**Guardrails**
+- Do NOT create any artifacts yet - just show the instructions
+- Do NOT advance beyond showing the first artifact template
+- If the name is invalid (not kebab-case), ask for a valid name
+- If a change with that name already exists, suggest continuing that change instead
+- Pass --schema if using a non-default workflow
diff --git a/.claude/skills/openspec-onboard/SKILL.md b/.claude/skills/openspec-onboard/SKILL.md
new file mode 100644
index 000000000..ac4ac6fee
--- /dev/null
+++ b/.claude/skills/openspec-onboard/SKILL.md
@@ -0,0 +1,555 @@
+---
+name: openspec-onboard
+description: Guided onboarding for OpenSpec - walk through a complete workflow cycle with narration and real codebase work.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Guide the user through their first complete OpenSpec workflow cycle. This is a teaching experience—you'll do real work in their codebase while explaining each step.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+---
+
+## Preflight
+
+Before starting, check if the OpenSpec CLI is installed:
+
+```bash
+# Unix/macOS
+openspec --version 2>&1 || echo "CLI_NOT_INSTALLED"
+# Windows (PowerShell)
+# if (Get-Command openspec -ErrorAction SilentlyContinue) { openspec --version } else { echo "CLI_NOT_INSTALLED" }
+```
+
+**If CLI not installed:**
+> OpenSpec CLI is not installed. Install it first, then come back to `/opsx:onboard`.
+
+Stop here if not installed.
+
+---
+
+## Phase 1: Welcome
+
+Display:
+
+```
+## Welcome to OpenSpec!
+
+I'll walk you through a complete change cycle—from idea to implementation—using a real task in your codebase. Along the way, you'll learn the workflow by doing it.
+
+**What we'll do:**
+1. Pick a small, real task in your codebase
+2. Explore the problem briefly
+3. Create a change (the container for our work)
+4. Build the artifacts: proposal → specs → design → tasks
+5. Implement the tasks
+6. Archive the completed change
+
+**Time:** ~15-20 minutes
+
+Let's start by finding something to work on.
+```
+
+---
+
+## Phase 2: Task Selection
+
+### Codebase Analysis
+
+Scan the codebase for small improvement opportunities. Look for:
+
+1. **TODO/FIXME comments** - Search for `TODO`, `FIXME`, `HACK`, `XXX` in code files
+2. **Missing error handling** - `catch` blocks that swallow errors, risky operations without try-catch
+3. **Functions without tests** - Cross-reference `src/` with test directories
+4. **Type issues** - `any` types in TypeScript files (`: any`, `as any`)
+5. **Debug artifacts** - `console.log`, `console.debug`, `debugger` statements in non-debug code
+6. **Missing validation** - User input handlers without validation
+
+Also check recent git activity:
+```bash
+# Unix/macOS
+git log --oneline -10 2>/dev/null || echo "No git history"
+# Windows (PowerShell)
+# git log --oneline -10 2>$null; if ($LASTEXITCODE -ne 0) { echo "No git history" }
+```
+
+### Present Suggestions
+
+From your analysis, present 3-4 specific suggestions:
+
+```
+## Task Suggestions
+
+Based on scanning your codebase, here are some good starter tasks:
+
+**1. [Most promising task]**
+   Location: `src/path/to/file.ts:42`
+   Scope: ~1-2 files, ~20-30 lines
+   Why it's good: [brief reason]
+
+**2. [Second task]**
+   Location: `src/another/file.ts`
+   Scope: ~1 file, ~15 lines
+   Why it's good: [brief reason]
+
+**3. [Third task]**
+   Location: [location]
+   Scope: [estimate]
+   Why it's good: [brief reason]
+
+**4. Something else?**
+   Tell me what you'd like to work on.
+
+Which task interests you? (Pick a number or describe your own)
+```
+
+**If nothing found:** Fall back to asking what the user wants to build:
+> I didn't find obvious quick wins in your codebase. What's something small you've been meaning to add or fix?
+
+### Scope Guardrail
+
+If the user picks or describes something too large (major feature, multi-day work):
+
+```
+That's a valuable task, but it's probably larger than ideal for your first OpenSpec run-through.
+
+For learning the workflow, smaller is better—it lets you see the full cycle without getting stuck in implementation details.
+
+**Options:**
+1. **Slice it smaller** - What's the smallest useful piece of [their task]? Maybe just [specific slice]?
+2. **Pick something else** - One of the other suggestions, or a different small task?
+3. **Do it anyway** - If you really want to tackle this, we can. Just know it'll take longer.
+
+What would you prefer?
+```
+
+Let the user override if they insist—this is a soft guardrail.
+
+---
+
+## Phase 3: Explore Demo
+
+Once a task is selected, briefly demonstrate explore mode:
+
+```
+Before we create a change, let me quickly show you **explore mode**—it's how you think through problems before committing to a direction.
+```
+
+Spend 1-2 minutes investigating the relevant code:
+- Read the file(s) involved
+- Draw a quick ASCII diagram if it helps
+- Note any considerations
+
+```
+## Quick Exploration
+
+[Your brief analysis—what you found, any considerations]
+
+┌─────────────────────────────────────────┐
+│   [Optional: ASCII diagram if helpful]  │
+└─────────────────────────────────────────┘
+
+Explore mode (`/opsx:explore`) is for this kind of thinking—investigating before implementing. You can use it anytime you need to think through a problem.
+
+Now let's create a change to hold our work.
+```
+
+**PAUSE** - Wait for user acknowledgment before proceeding.
+
+---
+
+## Phase 4: Create the Change
+
+**EXPLAIN:**
+```
+## Creating a Change
+
+A "change" in OpenSpec is a container for all the thinking and planning around a piece of work. It lives at the `changeRoot` reported by `openspec status --change "<name>" --json` and holds your artifacts—proposal, specs, design, tasks.
+
+Let me create one for our task.
+```
+
+**DO:** Create the change with a derived kebab-case name:
+```bash
+openspec new change "<derived-name>"
+```
+
+**SHOW:**
+```
+Created: <changeRoot from status JSON>
+
+The folder structure:
+```
+<changeRoot>/
+├── proposal.md    ← Why we're doing this (empty, we'll fill it)
+├── design.md      ← How we'll build it (empty)
+├── specs/         ← Detailed requirements (empty)
+└── tasks.md       ← Implementation checklist (empty)
+```
+
+Now let's fill in the first artifact—the proposal.
+```
+
+---
+
+## Phase 5: Proposal
+
+**EXPLAIN:**
+```
+## The Proposal
+
+The proposal captures **why** we're making this change and **what** it involves at a high level. It's the "elevator pitch" for the work.
+
+I'll draft one based on our task.
+```
+
+**DO:** Draft the proposal content (don't save yet):
+
+```
+Here's a draft proposal:
+
+---
+
+## Why
+
+[1-2 sentences explaining the problem/opportunity]
+
+## What Changes
+
+[Bullet points of what will be different]
+
+## Capabilities
+
+### New Capabilities
+- `<capability-name>`: [brief description]
+
+### Modified Capabilities
+<!-- If modifying existing behavior -->
+
+## Impact
+
+- `src/path/to/file.ts`: [what changes]
+- [other files if applicable]
+
+---
+
+Does this capture the intent? I can adjust before we save it.
+```
+
+**PAUSE** - Wait for user approval/feedback.
+
+After approval, save the proposal:
+```bash
+openspec instructions proposal --change "<name>" --json
+```
+Then write the content to the `resolvedOutputPath` from `openspec instructions proposal --change "<name>" --json`.
+
+```
+Proposal saved. This is your "why" document—you can always come back and refine it as understanding evolves.
+
+Next up: specs.
+```
+
+---
+
+## Phase 6: Specs
+
+**EXPLAIN:**
+```
+## Specs
+
+Specs define **what** we're building in precise, testable terms. They use a requirement/scenario format that makes expected behavior crystal clear.
+
+For a small task like this, we might only need one spec file.
+```
+
+**DO:** Resolve where the spec file should be created:
+```bash
+openspec instructions specs --change "<name>" --json
+# Use resolvedOutputPath from the JSON. If it is a glob, choose the concrete file path using the schema instruction and the change's context.
+```
+
+Draft the spec content:
+
+```
+Here's the spec:
+
+---
+
+## ADDED Requirements
+
+### Requirement: <Name>
+
+<Description of what the system should do>
+
+#### Scenario: <Scenario name>
+
+- **WHEN** <trigger condition>
+- **THEN** <expected outcome>
+- **AND** <additional outcome if needed>
+
+---
+
+This format—WHEN/THEN/AND—makes requirements testable. You can literally read them as test cases.
+```
+
+Save to the concrete file path chosen from `resolvedOutputPath`.
+
+---
+
+## Phase 7: Design
+
+**EXPLAIN:**
+```
+## Design
+
+The design captures **how** we'll build it—technical decisions, tradeoffs, approach.
+
+For small changes, this might be brief. That's fine—not every change needs deep design discussion.
+```
+
+**DO:** Draft design.md:
+
+```
+Here's the design:
+
+---
+
+## Context
+
+[Brief context about the current state]
+
+## Goals / Non-Goals
+
+**Goals:**
+- [What we're trying to achieve]
+
+**Non-Goals:**
+- [What's explicitly out of scope]
+
+## Decisions
+
+### Decision 1: [Key decision]
+
+[Explanation of approach and rationale]
+
+---
+
+For a small task, this captures the key decisions without over-engineering.
+```
+
+Save to the `resolvedOutputPath` from `openspec instructions design --change "<name>" --json`.
+
+---
+
+## Phase 8: Tasks
+
+**EXPLAIN:**
+```
+## Tasks
+
+Finally, we break the work into implementation tasks—checkboxes that drive the apply phase.
+
+These should be small, clear, and in logical order.
+```
+
+**DO:** Generate tasks based on specs and design:
+
+```
+Here are the implementation tasks:
+
+---
+
+## 1. [Category or file]
+
+- [ ] 1.1 [Specific task]
+- [ ] 1.2 [Specific task]
+
+## 2. Verify
+
+- [ ] 2.1 [Verification step]
+
+---
+
+Each checkbox becomes a unit of work in the apply phase. Ready to implement?
+```
+
+**PAUSE** - Wait for user to confirm they're ready to implement.
+
+Save to the `resolvedOutputPath` from `openspec instructions tasks --change "<name>" --json`.
+
+---
+
+## Phase 9: Apply (Implementation)
+
+**EXPLAIN:**
+```
+## Implementation
+
+Now we implement each task, checking them off as we go. I'll announce each one and occasionally note how the specs/design informed the approach.
+```
+
+**DO:** For each task:
+
+1. Announce: "Working on task N: [description]"
+2. Implement the change in the codebase
+3. Reference specs/design naturally: "The spec says X, so I'm doing Y"
+4. Mark complete in tasks.md: `- [ ]` → `- [x]`
+5. Brief status: "✓ Task N complete"
+
+Keep narration light—don't over-explain every line of code.
+
+After all tasks:
+
+```
+## Implementation Complete
+
+All tasks done:
+- [x] Task 1
+- [x] Task 2
+- [x] ...
+
+The change is implemented! One more step—let's archive it.
+```
+
+---
+
+## Phase 10: Archive
+
+**EXPLAIN:**
+```
+## Archiving
+
+When a change is complete, we archive it. The archive path is derived from `planningHome.changesDir` and the date.
+
+Archived changes become your project's decision history—you can always find them later to understand why something was built a certain way.
+```
+
+**DO:**
+```bash
+openspec archive "<name>"
+```
+
+**SHOW:**
+```
+Archived to: `<planningHome.changesDir>/archive/YYYY-MM-DD-<name>/`
+
+The change is now part of your project's history. The code is in your codebase, the decision record is preserved.
+```
+
+---
+
+## Phase 11: Recap & Next Steps
+
+```
+## Congratulations!
+
+You just completed a full OpenSpec cycle:
+
+1. **Explore** - Thought through the problem
+2. **New** - Created a change container
+3. **Proposal** - Captured WHY
+4. **Specs** - Defined WHAT in detail
+5. **Design** - Decided HOW
+6. **Tasks** - Broke it into steps
+7. **Apply** - Implemented the work
+8. **Archive** - Preserved the record
+
+This same rhythm works for any size change—a small fix or a major feature.
+
+---
+
+## Command Reference
+
+**Core workflow:**
+
+ | Command           | What it does                               |
+ |-------------------|--------------------------------------------|
+ | `/opsx:propose` | Create a change and generate all artifacts |
+ | `/opsx:explore` | Think through problems before/during work  |
+ | `/opsx:apply`   | Implement tasks from a change              |
+ | `/opsx:archive` | Archive a completed change                 |
+
+**Additional commands:**
+
+ | Command            | What it does                                             |
+ |--------------------|----------------------------------------------------------|
+ | `/opsx:new`      | Start a new change, step through artifacts one at a time |
+ | `/opsx:continue` | Continue working on an existing change                   |
+ | `/opsx:ff`       | Fast-forward: create all artifacts at once               |
+ | `/opsx:verify`   | Verify implementation matches artifacts                  |
+
+---
+
+## What's Next?
+
+Try `/opsx:propose` on something you actually want to build. You've got the rhythm now!
+```
+
+---
+
+## Graceful Exit Handling
+
+### User wants to stop mid-way
+
+If the user says they need to stop, want to pause, or seem disengaged:
+
+```
+No problem! Your change is saved at the `changeRoot` reported by `openspec status --change "<name>" --json`.
+
+To pick up where we left off later:
+- `/opsx:continue <name>` - Resume artifact creation
+- `/opsx:apply <name>` - Jump to implementation (if tasks exist)
+
+The work won't be lost. Come back whenever you're ready.
+```
+
+Exit gracefully without pressure.
+
+### User just wants command reference
+
+If the user says they just want to see the commands or skip the tutorial:
+
+```
+## OpenSpec Quick Reference
+
+**Core workflow:**
+
+ | Command                  | What it does                               |
+ |--------------------------|--------------------------------------------|
+ | `/opsx:propose <name>` | Create a change and generate all artifacts |
+ | `/opsx:explore`        | Think through problems (no code changes)   |
+ | `/opsx:apply <name>`   | Implement tasks                            |
+ | `/opsx:archive <name>` | Archive when done                          |
+
+**Additional commands:**
+
+ | Command                   | What it does                        |
+ |---------------------------|-------------------------------------|
+ | `/opsx:new <name>`      | Start a new change, step by step    |
+ | `/opsx:continue <name>` | Continue an existing change         |
+ | `/opsx:ff <name>`       | Fast-forward: all artifacts at once |
+ | `/opsx:verify <name>`   | Verify implementation               |
+
+Try `/opsx:propose` to start your first change.
+```
+
+Exit gracefully.
+
+---
+
+## Guardrails
+
+- **Follow the EXPLAIN → DO → SHOW → PAUSE pattern** at key transitions (after explore, after proposal draft, after tasks, after archive)
+- **Keep narration light** during implementation—teach without lecturing
+- **Don't skip phases** even if the change is small—the goal is teaching the workflow
+- **Pause for acknowledgment** at marked points, but don't over-pause
+- **Handle exits gracefully**—never pressure the user to continue
+- **Use real codebase tasks**—don't simulate or use fake examples
+- **Adjust scope gently**—guide toward smaller tasks but respect user choice
diff --git a/.claude/skills/openspec-sync-specs/SKILL.md b/.claude/skills/openspec-sync-specs/SKILL.md
new file mode 100644
index 000000000..b6aad67ab
--- /dev/null
+++ b/.claude/skills/openspec-sync-specs/SKILL.md
@@ -0,0 +1,148 @@
+---
+name: openspec-sync-specs
+description: Sync delta specs from a change to main specs. Use when the user wants to update main specs with changes from a delta spec, without archiving the change.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Sync delta specs from a change to main specs.
+
+This is an **agent-driven** operation - you will read delta specs and directly edit main specs to apply the changes. This allows intelligent merging (e.g., adding a scenario without copying the entire requirement).
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show changes that have delta specs (under `specs/` directory).
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Resolve change context**
+
+   Run:
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+
+3. **Find delta specs**
+
+   Use `artifactPaths.specs.existingOutputPaths` from the status JSON as the list of delta spec files.
+
+   Each delta spec file contains sections like:
+   - `## ADDED Requirements` - New requirements to add
+   - `## MODIFIED Requirements` - Changes to existing requirements
+   - `## REMOVED Requirements` - Requirements to remove
+   - `## RENAMED Requirements` - Requirements to rename (FROM:/TO: format)
+
+   If no delta specs found, inform user and stop.
+
+4. **For each delta spec, apply changes to main specs**
+
+   For each repo-local capability delta spec path returned by the CLI:
+
+   a. **Read the delta spec** to understand the intended changes
+
+   b. **Read the main spec** at `openspec/specs/<capability>/spec.md` (may not exist yet)
+
+   c. **Apply changes intelligently**:
+
+      **ADDED Requirements:**
+      - If requirement doesn't exist in main spec → add it
+      - If requirement already exists → update it to match (treat as implicit MODIFIED)
+
+      **MODIFIED Requirements:**
+      - Find the requirement in main spec
+      - Apply the changes - this can be:
+        - Adding new scenarios (don't need to copy existing ones)
+        - Modifying existing scenarios
+        - Changing the requirement description
+      - Preserve scenarios/content not mentioned in the delta
+
+      **REMOVED Requirements:**
+      - Remove the entire requirement block from main spec
+
+      **RENAMED Requirements:**
+      - Find the FROM requirement, rename to TO
+
+   d. **Create new main spec** if capability doesn't exist yet:
+      - Create `openspec/specs/<capability>/spec.md`
+      - Add Purpose section (can be brief, mark as TBD)
+      - Add Requirements section with the ADDED requirements
+
+5. **Show summary**
+
+   After applying all changes, summarize:
+   - Which capabilities were updated
+   - What changes were made (requirements added/modified/removed/renamed)
+
+**Delta Spec Format Reference**
+
+```markdown
+## ADDED Requirements
+
+### Requirement: New Feature
+The system SHALL do something new.
+
+#### Scenario: Basic case
+- **WHEN** user does X
+- **THEN** system does Y
+
+## MODIFIED Requirements
+
+### Requirement: Existing Feature
+#### Scenario: New scenario to add
+- **WHEN** user does A
+- **THEN** system does B
+
+## REMOVED Requirements
+
+### Requirement: Deprecated Feature
+
+## RENAMED Requirements
+
+- FROM: `### Requirement: Old Name`
+- TO: `### Requirement: New Name`
+```
+
+**Key Principle: Intelligent Merging**
+
+Unlike programmatic merging, you can apply **partial updates**:
+- To add a scenario, just include that scenario under MODIFIED - don't copy existing scenarios
+- The delta represents *intent*, not a wholesale replacement
+- Use your judgment to merge changes sensibly
+
+**Output On Success**
+
+```
+## Specs Synced: <change-name>
+
+Updated main specs:
+
+**<capability-1>**:
+- Added requirement: "New Feature"
+- Modified requirement: "Existing Feature" (added 1 scenario)
+
+**<capability-2>**:
+- Created new spec file
+- Added requirement: "Another Feature"
+
+Main specs are now updated. The change remains active - archive when implementation is complete.
+```
+
+**Guardrails**
+- Read both delta and main specs before making changes
+- Preserve existing content not mentioned in delta
+- If something is unclear, ask for clarification
+- Show what you're changing as you go
+- The operation should be idempotent - running twice should give same result
diff --git a/.claude/skills/openspec-verify-change/SKILL.md b/.claude/skills/openspec-verify-change/SKILL.md
new file mode 100644
index 000000000..b6557c6ff
--- /dev/null
+++ b/.claude/skills/openspec-verify-change/SKILL.md
@@ -0,0 +1,172 @@
+---
+name: openspec-verify-change
+description: Verify implementation matches change artifacts. Use when the user wants to validate that implementation is complete, correct, and coherent before archiving.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Verify that an implementation matches the change artifacts (specs, tasks, design).
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show changes that have implementation tasks (tasks artifact exists).
+   Include the schema used for each change if available.
+   Mark changes with incomplete tasks as "(In Progress)".
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Check status to understand the schema**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used (e.g., "spec-driven")
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context
+   - Which artifacts exist for this change
+
+3. **Get planning context and load artifacts**
+
+   ```bash
+   openspec instructions apply --change "<name>" --json
+   ```
+
+   This returns the change directory and `contextFiles` (artifact ID -> array of concrete file paths). Read all available artifacts from `contextFiles`.
+
+4. **Initialize verification report structure**
+
+   Create a report structure with three dimensions:
+   - **Completeness**: Track tasks and spec coverage
+   - **Correctness**: Track requirement implementation and scenario coverage
+   - **Coherence**: Track design adherence and pattern consistency
+
+   Each dimension can have CRITICAL, WARNING, or SUGGESTION issues.
+
+5. **Verify Completeness**
+
+   **Task Completion**:
+   - If `contextFiles.tasks` exists, read every file path in it
+   - Parse checkboxes: `- [ ]` (incomplete) vs `- [x]` (complete)
+   - Count complete vs total tasks
+   - If incomplete tasks exist:
+     - Add CRITICAL issue for each incomplete task
+     - Recommendation: "Complete task: <description>" or "Mark as done if already implemented"
+
+   **Spec Coverage**:
+   - If delta specs exist in `contextFiles.specs`:
+     - Extract all requirements (marked with "### Requirement:")
+     - For each requirement:
+       - Search codebase for keywords related to the requirement
+       - Assess if implementation likely exists
+     - If requirements appear unimplemented:
+       - Add CRITICAL issue: "Requirement not found: <requirement name>"
+       - Recommendation: "Implement requirement X: <description>"
+
+6. **Verify Correctness**
+
+   **Requirement Implementation Mapping**:
+   - For each requirement from delta specs:
+     - Search codebase for implementation evidence
+     - If found, note file paths and line ranges
+     - Assess if implementation matches requirement intent
+     - If divergence detected:
+       - Add WARNING: "Implementation may diverge from spec: <details>"
+       - Recommendation: "Review <file>:<lines> against requirement X"
+
+   **Scenario Coverage**:
+   - For each scenario in delta specs (marked with "#### Scenario:"):
+     - Check if conditions are handled in code
+     - Check if tests exist covering the scenario
+     - If scenario appears uncovered:
+       - Add WARNING: "Scenario not covered: <scenario name>"
+       - Recommendation: "Add test or implementation for scenario: <description>"
+
+7. **Verify Coherence**
+
+   **Design Adherence**:
+   - If `contextFiles.design` exists:
+     - Extract key decisions (look for sections like "Decision:", "Approach:", "Architecture:")
+     - Verify implementation follows those decisions
+     - If contradiction detected:
+       - Add WARNING: "Design decision not followed: <decision>"
+       - Recommendation: "Update implementation or revise design.md to match reality"
+   - If no design.md: Skip design adherence check, note "No design.md to verify against"
+
+   **Code Pattern Consistency**:
+   - Review new code for consistency with project patterns
+   - Check file naming, directory structure, coding style
+   - If significant deviations found:
+     - Add SUGGESTION: "Code pattern deviation: <details>"
+     - Recommendation: "Consider following project pattern: <example>"
+
+8. **Generate Verification Report**
+
+   **Summary Scorecard**:
+   ```
+   ## Verification Report: <change-name>
+
+   ### Summary
+   | Dimension    | Status           |
+   |--------------|------------------|
+   | Completeness | X/Y tasks, N reqs|
+   | Correctness  | M/N reqs covered |
+   | Coherence    | Followed/Issues  |
+   ```
+
+   **Issues by Priority**:
+
+   1. **CRITICAL** (Must fix before archive):
+      - Incomplete tasks
+      - Missing requirement implementations
+      - Each with specific, actionable recommendation
+
+   2. **WARNING** (Should fix):
+      - Spec/design divergences
+      - Missing scenario coverage
+      - Each with specific recommendation
+
+   3. **SUGGESTION** (Nice to fix):
+      - Pattern inconsistencies
+      - Minor improvements
+      - Each with specific recommendation
+
+   **Final Assessment**:
+   - If CRITICAL issues: "X critical issue(s) found. Fix before archiving."
+   - If only warnings: "No critical issues. Y warning(s) to consider. Ready for archive (with noted improvements)."
+   - If all clear: "All checks passed. Ready for archive."
+
+**Verification Heuristics**
+
+- **Completeness**: Focus on objective checklist items (checkboxes, requirements list)
+- **Correctness**: Use keyword search, file path analysis, reasonable inference - don't require perfect certainty
+- **Coherence**: Look for glaring inconsistencies, don't nitpick style
+- **False Positives**: When uncertain, prefer SUGGESTION over WARNING, WARNING over CRITICAL
+- **Actionability**: Every issue must have a specific recommendation with file/line references where applicable
+
+**Graceful Degradation**
+
+- If only tasks.md exists: verify task completion only, skip spec/design checks
+- If tasks + specs exist: verify completeness and correctness, skip design
+- If full artifacts: verify all three dimensions
+- Always note which checks were skipped and why
+
+**Output Format**
+
+Use clear markdown with:
+- Table for summary scorecard
+- Grouped lists for issues (CRITICAL/WARNING/SUGGESTION)
+- Code references in format: `file.ts:123`
+- Specific, actionable recommendations
+- No vague suggestions like "consider reviewing"
diff --git a/.codex/skills/openspec-apply-change/SKILL.md b/.codex/skills/openspec-apply-change/SKILL.md
new file mode 100644
index 000000000..1375861c3
--- /dev/null
+++ b/.codex/skills/openspec-apply-change/SKILL.md
@@ -0,0 +1,160 @@
+---
+name: openspec-apply-change
+description: Implement tasks from an OpenSpec change. Use when the user wants to start implementing, continue implementation, or work through tasks.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Implement tasks from an OpenSpec change.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **Select the change**
+
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes and use the **AskUserQuestion tool** to let the user select
+
+   Always announce: "Using change: <name>" and how to override (e.g., `/opsx:apply <other>`).
+
+2. **Check status to understand the schema**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used (e.g., "spec-driven")
+   - `planningHome`, `changeRoot`, and `actionContext`: planning scope and edit constraints
+   - Which artifact contains the tasks (typically "tasks" for spec-driven, check status for others)
+
+3. **Get apply instructions**
+
+   ```bash
+   openspec instructions apply --change "<name>" --json
+   ```
+
+   This returns:
+   - `contextFiles`: artifact ID -> array of concrete file paths (varies by schema - could be proposal/specs/design/tasks or spec/tests/implementation/docs)
+   - Progress (total, complete, remaining)
+   - Task list with status
+   - Dynamic instruction based on current state
+
+   **Handle states:**
+   - If `state: "blocked"` (missing artifacts): show message, suggest using openspec-continue-change
+   - If `state: "all_done"`: congratulate, suggest archive
+   - Otherwise: proceed to implementation
+
+4. **Read context files**
+
+   Read every file path listed under `contextFiles` from the apply instructions output.
+   The files depend on the schema being used:
+   - **spec-driven**: proposal, specs, design, tasks
+   - Other schemas: follow the contextFiles from CLI output
+
+5. **Show current progress**
+
+   Display:
+   - Schema being used
+   - Progress: "N/M tasks complete"
+   - Remaining tasks overview
+   - Dynamic instruction from CLI
+
+6. **Implement tasks (loop until done or blocked)**
+
+   For each pending task:
+   - Show which task is being worked on
+   - Make the code changes required
+   - Keep changes minimal and focused
+   - Mark task complete in the tasks file: `- [ ]` → `- [x]`
+   - Continue to next task
+
+   **Pause if:**
+   - Task is unclear → ask for clarification
+   - Implementation reveals a design issue → suggest updating artifacts
+   - Error or blocker encountered → report and wait for guidance
+   - User interrupts
+
+7. **On completion or pause, show status**
+
+   Display:
+   - Tasks completed this session
+   - Overall progress: "N/M tasks complete"
+   - If all done: suggest archive
+   - If paused: explain why and wait for guidance
+
+**Output During Implementation**
+
+```
+## Implementing: <change-name> (schema: <schema-name>)
+
+Working on task 3/7: <task description>
+[...implementation happening...]
+✓ Task complete
+
+Working on task 4/7: <task description>
+[...implementation happening...]
+✓ Task complete
+```
+
+**Output On Completion**
+
+```
+## Implementation Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Progress:** 7/7 tasks complete ✓
+
+### Completed This Session
+- [x] Task 1
+- [x] Task 2
+...
+
+All tasks complete! Ready to archive this change.
+```
+
+**Output On Pause (Issue Encountered)**
+
+```
+## Implementation Paused
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Progress:** 4/7 tasks complete
+
+### Issue Encountered
+<description of the issue>
+
+**Options:**
+1. <option 1>
+2. <option 2>
+3. Other approach
+
+What would you like to do?
+```
+
+**Guardrails**
+- Keep going through tasks until done or blocked
+- Always read context files before starting (from the apply instructions output)
+- If task is ambiguous, pause and ask before implementing
+- If implementation reveals issues, pause and suggest artifact updates
+- Keep code changes minimal and scoped to each task
+- Update task checkbox immediately after completing each task
+- Pause on errors, blockers, or unclear requirements - don't guess
+- Use contextFiles from CLI output, don't assume specific file names
+
+**Fluid Workflow Integration**
+
+This skill supports the "actions on a change" model:
+
+- **Can be invoked anytime**: Before all artifacts are done (if tasks exist), after partial implementation, interleaved with other actions
+- **Allows artifact updates**: If implementation reveals design issues, suggest updating artifacts - not phase-locked, work fluidly
diff --git a/.codex/skills/openspec-archive-change/SKILL.md b/.codex/skills/openspec-archive-change/SKILL.md
new file mode 100644
index 000000000..c0c169d14
--- /dev/null
+++ b/.codex/skills/openspec-archive-change/SKILL.md
@@ -0,0 +1,118 @@
+---
+name: openspec-archive-change
+description: Archive a completed change in the experimental workflow. Use when the user wants to finalize and archive a change after implementation is complete.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Archive a completed change in the experimental workflow.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show only active changes (not already archived).
+   Include the schema used for each change if available.
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Check artifact completion status**
+
+   Run `openspec status --change "<name>" --json` to check artifact completion.
+
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context
+   - `artifacts`: List of artifacts with their status (`done` or other)
+
+   **If any artifacts are not `done`:**
+   - Display warning listing incomplete artifacts
+   - Use **AskUserQuestion tool** to confirm user wants to proceed
+   - Proceed if user confirms
+
+3. **Check task completion status**
+
+   Read the tasks file (typically `tasks.md`) to check for incomplete tasks.
+
+   Count tasks marked with `- [ ]` (incomplete) vs `- [x]` (complete).
+
+   **If incomplete tasks found:**
+   - Display warning showing count of incomplete tasks
+   - Use **AskUserQuestion tool** to confirm user wants to proceed
+   - Proceed if user confirms
+
+   **If no tasks file exists:** Proceed without task-related warning.
+
+4. **Assess delta spec sync state**
+
+   Use `artifactPaths.specs.existingOutputPaths` from status JSON to check for delta specs. If none exist, proceed without sync prompt.
+
+   **If delta specs exist:**
+   - Compare each delta spec with its corresponding main spec at `openspec/specs/<capability>/spec.md`
+   - Determine what changes would be applied (adds, modifications, removals, renames)
+   - Show a combined summary before prompting
+
+   **Prompt options:**
+   - If changes needed: "Sync now (recommended)", "Archive without syncing"
+   - If already synced: "Archive now", "Sync anyway", "Cancel"
+
+   If user chooses sync, use Task tool (subagent_type: "general-purpose", prompt: "Use Skill tool to invoke openspec-sync-specs for change '<name>'. Delta spec analysis: <include the analyzed delta spec summary>"). Proceed to archive regardless of choice.
+
+5. **Perform the archive**
+
+   Create an `archive` directory under `planningHome.changesDir` if it doesn't exist:
+   ```bash
+   mkdir -p "<planningHome.changesDir>/archive"
+   ```
+
+   Generate target name using current date: `YYYY-MM-DD-<change-name>`
+
+   **Check if target already exists:**
+   - If yes: Fail with error, suggest renaming existing archive or using different date
+   - If no: Move `changeRoot` to the archive directory
+
+   ```bash
+   mv "<changeRoot>" "<planningHome.changesDir>/archive/YYYY-MM-DD-<name>"
+   ```
+
+6. **Display summary**
+
+   Show archive completion summary including:
+   - Change name
+   - Schema that was used
+   - Archive location
+   - Whether specs were synced (if applicable)
+   - Note about any warnings (incomplete artifacts/tasks)
+
+**Output On Success**
+
+```
+## Archive Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Archived to:** the archive path derived from `planningHome.changesDir`/YYYY-MM-DD-<name>/
+**Specs:** ✓ Synced to main specs (or "No delta specs" or "Sync skipped")
+
+All artifacts complete. All tasks complete.
+```
+
+**Guardrails**
+- Always prompt for change selection if not provided
+- Use artifact graph (openspec status --json) for completion checking
+- Don't block archive on warnings - just inform and confirm
+- Preserve .openspec.yaml when moving to archive (it moves with the directory)
+- Show clear summary of what happened
+- If sync is requested, use openspec-sync-specs approach (agent-driven)
+- If delta specs exist, always run the sync assessment and show the combined summary before prompting
diff --git a/.codex/skills/openspec-bulk-archive-change/SKILL.md b/.codex/skills/openspec-bulk-archive-change/SKILL.md
new file mode 100644
index 000000000..309152af7
--- /dev/null
+++ b/.codex/skills/openspec-bulk-archive-change/SKILL.md
@@ -0,0 +1,249 @@
+---
+name: openspec-bulk-archive-change
+description: Archive multiple completed changes at once. Use when archiving several parallel changes.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Archive multiple completed changes in a single operation.
+
+This skill allows you to batch-archive changes, handling spec conflicts intelligently by checking the codebase to determine what's actually implemented.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: None required (prompts for selection)
+
+**Steps**
+
+1. **Get active changes**
+
+   Run `openspec list --json` to get all active changes.
+
+   If no active changes exist, inform user and stop.
+
+2. **Prompt for change selection**
+
+   Use **AskUserQuestion tool** with multi-select to let user choose changes:
+   - Show each change with its schema
+   - Include an option for "All changes"
+   - Allow any number of selections (1+ works, 2+ is the typical use case)
+
+   **IMPORTANT**: Do NOT auto-select. Always let the user choose.
+
+3. **Batch validation - gather status for all selected changes**
+
+   For each selected change, collect:
+
+   a. **Artifact status** - Run `openspec status --change "<name>" --json`
+      - Parse `schemaName`, `artifacts`, `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`
+      - Note which artifacts are `done` vs other states
+
+   b. **Task completion** - Read `artifactPaths.tasks.existingOutputPaths` from status JSON
+      - Count `- [ ]` (incomplete) vs `- [x]` (complete)
+      - If no tasks file exists, note as "No tasks"
+
+   c. **Delta specs** - Check `artifactPaths.specs.existingOutputPaths` from status JSON
+      - List which capability specs exist
+      - For each, extract requirement names (lines matching `### Requirement: <name>`)
+
+4. **Detect spec conflicts**
+
+   Build a map of `capability -> [changes that touch it]`:
+
+   ```
+   auth -> [change-a, change-b]  <- CONFLICT (2+ changes)
+   api  -> [change-c]            <- OK (only 1 change)
+   ```
+
+   A conflict exists when 2+ selected changes have delta specs for the same capability.
+
+5. **Resolve conflicts agentically**
+
+   **For each conflict**, investigate the codebase:
+
+   a. **Read the delta specs** from each conflicting change to understand what each claims to add/modify
+
+   b. **Search the codebase** for implementation evidence:
+      - Look for code implementing requirements from each delta spec
+      - Check for related files, functions, or tests
+
+   c. **Determine resolution**:
+      - If only one change is actually implemented -> sync that one's specs
+      - If both implemented -> apply in chronological order (older first, newer overwrites)
+      - If neither implemented -> skip spec sync, warn user
+
+   d. **Record resolution** for each conflict:
+      - Which change's specs to apply
+      - In what order (if both)
+      - Rationale (what was found in codebase)
+
+6. **Show consolidated status table**
+
+   Display a table summarizing all changes:
+
+   ```
+   | Change              | Artifacts | Tasks | Specs   | Conflicts | Status |
+   |---------------------|-----------|-------|---------|-----------|--------|
+   | schema-management   | Done      | 5/5   | 2 delta | None      | Ready  |
+   | project-config      | Done      | 3/3   | 1 delta | None      | Ready  |
+   | add-oauth           | Done      | 4/4   | 1 delta | auth (!)  | Ready* |
+   | add-verify-skill    | 1 left    | 2/5   | None    | None      | Warn   |
+   ```
+
+   For conflicts, show the resolution:
+   ```
+   * Conflict resolution:
+     - auth spec: Will apply add-oauth then add-jwt (both implemented, chronological order)
+   ```
+
+   For incomplete changes, show warnings:
+   ```
+   Warnings:
+   - add-verify-skill: 1 incomplete artifact, 3 incomplete tasks
+   ```
+
+7. **Confirm batch operation**
+
+   Use **AskUserQuestion tool** with a single confirmation:
+
+   - "Archive N changes?" with options based on status
+   - Options might include:
+     - "Archive all N changes"
+     - "Archive only N ready changes (skip incomplete)"
+     - "Cancel"
+
+   If there are incomplete changes, make clear they'll be archived with warnings.
+
+8. **Execute archive for each confirmed change**
+
+   Process changes in the determined order (respecting conflict resolution):
+
+   a. **Sync specs** if delta specs exist:
+      - Use the openspec-sync-specs approach (agent-driven intelligent merge)
+      - For conflicts, apply in resolved order
+      - Track if sync was done
+
+   b. **Perform the archive**:
+      ```bash
+      mkdir -p "<planningHome.changesDir>/archive"
+      mv "<changeRoot>" "<planningHome.changesDir>/archive/YYYY-MM-DD-<name>"
+      ```
+
+   c. **Track outcome** for each change:
+      - Success: archived successfully
+      - Failed: error during archive (record error)
+      - Skipped: user chose not to archive (if applicable)
+
+9. **Display summary**
+
+   Show final results:
+
+   ```
+   ## Bulk Archive Complete
+
+   Archived 3 changes:
+   - schema-management-cli -> archive/2026-01-19-schema-management-cli/
+   - project-config -> archive/2026-01-19-project-config/
+   - add-oauth -> archive/2026-01-19-add-oauth/
+
+   Skipped 1 change:
+   - add-verify-skill (user chose not to archive incomplete)
+
+   Spec sync summary:
+   - 4 delta specs synced to main specs
+   - 1 conflict resolved (auth: applied both in chronological order)
+   ```
+
+   If any failures:
+   ```
+   Failed 1 change:
+   - some-change: Archive directory already exists
+   ```
+
+**Conflict Resolution Examples**
+
+Example 1: Only one implemented
+```
+Conflict: specs/auth/spec.md touched by [add-oauth, add-jwt]
+
+Checking add-oauth:
+- Delta adds "OAuth Provider Integration" requirement
+- Searching codebase... found src/auth/oauth.ts implementing OAuth flow
+
+Checking add-jwt:
+- Delta adds "JWT Token Handling" requirement
+- Searching codebase... no JWT implementation found
+
+Resolution: Only add-oauth is implemented. Will sync add-oauth specs only.
+```
+
+Example 2: Both implemented
+```
+Conflict: specs/api/spec.md touched by [add-rest-api, add-graphql]
+
+Checking add-rest-api (created 2026-01-10):
+- Delta adds "REST Endpoints" requirement
+- Searching codebase... found src/api/rest.ts
+
+Checking add-graphql (created 2026-01-15):
+- Delta adds "GraphQL Schema" requirement
+- Searching codebase... found src/api/graphql.ts
+
+Resolution: Both implemented. Will apply add-rest-api specs first,
+then add-graphql specs (chronological order, newer takes precedence).
+```
+
+**Output On Success**
+
+```
+## Bulk Archive Complete
+
+Archived N changes:
+- <change-1> -> archive/YYYY-MM-DD-<change-1>/
+- <change-2> -> archive/YYYY-MM-DD-<change-2>/
+
+Spec sync summary:
+- N delta specs synced to main specs
+- No conflicts (or: M conflicts resolved)
+```
+
+**Output On Partial Success**
+
+```
+## Bulk Archive Complete (partial)
+
+Archived N changes:
+- <change-1> -> archive/YYYY-MM-DD-<change-1>/
+
+Skipped M changes:
+- <change-2> (user chose not to archive incomplete)
+
+Failed K changes:
+- <change-3>: Archive directory already exists
+```
+
+**Output When No Changes**
+
+```
+## No Changes to Archive
+
+No active changes found. Create a new change to get started.
+```
+
+**Guardrails**
+- Allow any number of changes (1+ is fine, 2+ is the typical use case)
+- Always prompt for selection, never auto-select
+- Detect spec conflicts early and resolve by checking codebase
+- When both changes are implemented, apply specs in chronological order
+- Skip spec sync only when implementation is missing (warn user)
+- Show clear per-change status before confirming
+- Use single confirmation for entire batch
+- Track and report all outcomes (success/skip/fail)
+- Preserve .openspec.yaml when moving to archive
+- Archive directory target uses current date: YYYY-MM-DD-<name>
+- If archive target exists, fail that change but continue with others
diff --git a/.codex/skills/openspec-continue-change/SKILL.md b/.codex/skills/openspec-continue-change/SKILL.md
new file mode 100644
index 000000000..31b476f24
--- /dev/null
+++ b/.codex/skills/openspec-continue-change/SKILL.md
@@ -0,0 +1,122 @@
+---
+name: openspec-continue-change
+description: Continue working on an OpenSpec change by creating the next artifact. Use when the user wants to progress their change, create the next artifact, or continue their workflow.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Continue working on a change by creating the next artifact.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes sorted by most recently modified. Then use the **AskUserQuestion tool** to let the user select which change to work on.
+
+   Present the top 3-4 most recently modified changes as options, showing:
+   - Change name
+   - Schema (from `schema` field if present, otherwise "spec-driven")
+   - Status (e.g., "0/5 tasks", "complete", "no tasks")
+   - How recently it was modified (from `lastModified` field)
+
+   Mark the most recently modified change as "(Recommended)" since it's likely what the user wants to continue.
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Check current status**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand current state. The response includes:
+   - `schemaName`: The workflow schema being used (e.g., "spec-driven")
+   - `artifacts`: Array of artifacts with their status ("done", "ready", "blocked")
+   - `isComplete`: Boolean indicating if all artifacts are complete
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context. Use these instead of assuming repo-local paths.
+
+3. **Act based on status**:
+
+   ---
+
+   **If all artifacts are complete (`isComplete: true`)**:
+   - Congratulate the user
+   - Show final status including the schema used
+   - Suggest: "All artifacts created! You can now implement this change or archive it."
+   - STOP
+
+   ---
+
+   **If artifacts are ready to create** (status shows artifacts with `status: "ready"`):
+   - Pick the FIRST artifact with `status: "ready"` from the status output
+   - Get its instructions:
+     ```bash
+     openspec instructions <artifact-id> --change "<name>" --json
+     ```
+   - Parse the JSON. The key fields are:
+     - `context`: Project background (constraints for you - do NOT include in output)
+     - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
+     - `template`: The structure to use for your output file
+     - `instruction`: Schema-specific guidance
+     - `resolvedOutputPath`: Resolved path or pattern to write the artifact
+     - `dependencies`: Completed artifacts to read for context
+   - **Create the artifact file**:
+     - Read any completed dependency files for context
+     - Use `template` as the structure - fill in its sections
+     - Apply `context` and `rules` as constraints when writing - but do NOT copy them into the file
+     - Write to the `resolvedOutputPath` specified in instructions. If it is a glob pattern, choose the concrete file path using the schema instruction and the change's context
+   - Show what was created and what's now unlocked
+   - STOP after creating ONE artifact
+
+   ---
+
+   **If no artifacts are ready (all blocked)**:
+   - This shouldn't happen with a valid schema
+   - Show status and suggest checking for issues
+
+4. **After creating an artifact, show progress**
+   ```bash
+   openspec status --change "<name>"
+   ```
+
+**Output**
+
+After each invocation, show:
+- Which artifact was created
+- Schema workflow being used
+- Current progress (N/M complete)
+- What artifacts are now unlocked
+- Prompt: "Want to continue? Just ask me to continue or tell me what to do next."
+
+**Artifact Creation Guidelines**
+
+The artifact types and their purpose depend on the schema. Use the `instruction` field from the instructions output to understand what to create.
+
+Common artifact patterns:
+
+**spec-driven schema** (proposal → specs → design → tasks):
+- **proposal.md**: Ask user about the change if not clear. Fill in Why, What Changes, Capabilities, Impact.
+  - The Capabilities section is critical - each capability listed will need a spec file.
+- **specs/<capability>/spec.md**: Create one spec per capability listed in the proposal's Capabilities section (use the capability name, not the change name).
+- **design.md**: Document technical decisions, architecture, and implementation approach.
+- **tasks.md**: Break down implementation into checkboxed tasks.
+
+For other schemas, follow the `instruction` field from the CLI output.
+
+**Guardrails**
+- Create ONE artifact per invocation
+- Always read dependency artifacts before creating a new one
+- Never skip artifacts or create out of order
+- If context is unclear, ask the user before creating
+- Verify the artifact file exists after writing before marking progress
+- Use the schema's artifact sequence, don't assume specific artifact names
+- **IMPORTANT**: `context` and `rules` are constraints for YOU, not content for the file
+  - Do NOT copy `<context>`, `<rules>`, `<project_context>` blocks into the artifact
+  - These guide what you write, but should never appear in the output
diff --git a/.codex/skills/openspec-explore/SKILL.md b/.codex/skills/openspec-explore/SKILL.md
new file mode 100644
index 000000000..771271a8f
--- /dev/null
+++ b/.codex/skills/openspec-explore/SKILL.md
@@ -0,0 +1,290 @@
+---
+name: openspec-explore
+description: Enter explore mode - a thinking partner for exploring ideas, investigating problems, and clarifying requirements. Use when the user wants to think through something before or during a change.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Enter explore mode. Think deeply. Visualize freely. Follow the conversation wherever it goes.
+
+**IMPORTANT: Explore mode is for thinking, not implementing.** You may read files, search code, and investigate the codebase, but you must NEVER write code or implement features. If the user asks you to implement something, remind them to exit explore mode first and create a change proposal. You MAY create OpenSpec artifacts (proposals, designs, specs) if the user asks—that's capturing thinking, not implementing.
+
+**This is a stance, not a workflow.** There are no fixed steps, no required sequence, no mandatory outputs. You're a thinking partner helping the user explore.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+---
+
+## The Stance
+
+- **Curious, not prescriptive** - Ask questions that emerge naturally, don't follow a script
+- **Open threads, not interrogations** - Surface multiple interesting directions and let the user follow what resonates. Don't funnel them through a single path of questions.
+- **Visual** - Use ASCII diagrams liberally when they'd help clarify thinking
+- **Adaptive** - Follow interesting threads, pivot when new information emerges
+- **Patient** - Don't rush to conclusions, let the shape of the problem emerge
+- **Grounded** - Explore the actual codebase when relevant, don't just theorize
+
+---
+
+## What You Might Do
+
+Depending on what the user brings, you might:
+
+**Explore the problem space**
+- Ask clarifying questions that emerge from what they said
+- Challenge assumptions
+- Reframe the problem
+- Find analogies
+
+**Investigate the codebase**
+- Map existing architecture relevant to the discussion
+- Find integration points
+- Identify patterns already in use
+- Surface hidden complexity
+
+**Compare options**
+- Brainstorm multiple approaches
+- Build comparison tables
+- Sketch tradeoffs
+- Recommend a path (if asked)
+
+**Visualize**
+```
+┌─────────────────────────────────────────┐
+│     Use ASCII diagrams liberally        │
+├─────────────────────────────────────────┤
+│                                         │
+│      ┌────────┐         ┌────────┐      │
+│      │ State  │────────▶│ State  │      │
+│      │   A    │         │   B    │      │
+│      └────────┘         └────────┘      │
+│                                         │
+│   System diagrams, state machines,      │
+│   data flows, architecture sketches,    │
+│   dependency graphs, comparison tables  │
+│                                         │
+└─────────────────────────────────────────┘
+```
+
+**Surface risks and unknowns**
+- Identify what could go wrong
+- Find gaps in understanding
+- Suggest spikes or investigations
+
+---
+
+## OpenSpec Awareness
+
+You have full context of the OpenSpec system. Use it naturally, don't force it.
+
+### Check for context
+
+At the start, quickly check what exists:
+```bash
+openspec list --json
+```
+
+This tells you:
+- If there are active changes
+- Their names, schemas, and status
+- What the user might be working on
+
+### When no change exists
+
+Think freely. When insights crystallize, you might offer:
+
+- "This feels solid enough to start a change. Want me to create a proposal?"
+- Or keep exploring - no pressure to formalize
+
+### When a change exists
+
+If the user mentions a change or you detect one is relevant:
+
+1. **Resolve and read existing artifacts for context**
+   - Run `openspec status --change "<name>" --json`.
+   - Use `changeRoot`, `artifactPaths`, and `actionContext` from the status JSON.
+   - Read existing files from `artifactPaths.<artifact>.existingOutputPaths`.
+
+2. **Reference them naturally in conversation**
+   - "Your design mentions using Redis, but we just realized SQLite fits better..."
+   - "The proposal scopes this to premium users, but we're now thinking everyone..."
+
+3. **Offer to capture when decisions are made**
+
+    | Insight Type               | Where to Capture               |
+    |----------------------------|--------------------------------|
+    | New requirement discovered | `specs/<capability>/spec.md` |
+    | Requirement changed        | `specs/<capability>/spec.md` |
+    | Design decision made       | `design.md`                  |
+    | Scope changed              | `proposal.md`                |
+    | New work identified        | `tasks.md`                   |
+    | Assumption invalidated     | Relevant artifact              |
+
+   Example offers:
+   - "That's a design decision. Capture it in design.md?"
+   - "This is a new requirement. Add it to specs?"
+   - "This changes scope. Update the proposal?"
+
+4. **The user decides** - Offer and move on. Don't pressure. Don't auto-capture.
+
+---
+
+## What You Don't Have To Do
+
+- Follow a script
+- Ask the same questions every time
+- Produce a specific artifact
+- Reach a conclusion
+- Stay on topic if a tangent is valuable
+- Be brief (this is thinking time)
+
+---
+
+## Handling Different Entry Points
+
+**User brings a vague idea:**
+```
+User: I'm thinking about adding real-time collaboration
+
+You: Real-time collab is a big space. Let me think about this...
+
+      COLLABORATION SPECTRUM
+      ════════════════════════════════════════════
+
+      Awareness          Coordination         Sync
+          │                   │                 │
+          ▼                   ▼                 ▼
+      ┌────────┐         ┌────────┐        ┌────────┐
+      │Presence│         │Cursors │        │  CRDT  │
+      │  "3    │         │ Multi  │        │Conflict│
+      │online" │         │ select │        │  free  │
+      └────────┘         └────────┘        └────────┘
+          │                   │                 │
+       trivial            moderate           complex
+
+      Where's your head at?
+```
+
+**User brings a specific problem:**
+```
+User: The auth system is a mess
+
+You: [reads codebase]
+
+     ┌─────────────────────────────────────────────┐
+     │              CURRENT AUTH FLOW              │
+     └─────────────────────────────────────────────┘
+                        │
+          ┌─────────────┼─────────────┐
+          ▼             ▼             ▼
+     ┌─────────┐  ┌─────────┐  ┌─────────┐
+     │ Google  │  │  GitHub │  │  Email  │
+     │  OAuth  │  │  OAuth  │  │  Magic  │
+     └────┬────┘  └────┬────┘  └────┬────┘
+          │             │             │
+          └─────────────┼─────────────┘
+                        ▼
+                  ┌───────────┐
+                  │  Session  │
+                  └─────┬─────┘
+                        │
+                        ▼
+                  ┌───────────┐
+                  │   Perms   │
+                  └───────────┘
+
+     I see three tangles. Which one's burning?
+```
+
+**User is stuck mid-implementation:**
+```
+User: /opsx:explore add-auth-system
+      The OAuth integration is more complex than expected
+
+You: [reads change artifacts]
+
+     You're on task 4: "Implement OAuth flow"
+
+     Let me trace what's involved...
+
+     [draws diagram, explores options, suggests paths]
+
+     Want to update the design to reflect this?
+     Or add a spike task to investigate?
+```
+
+**User wants to compare options:**
+```
+User: Should we use Postgres or SQLite?
+
+You: Generic answer is boring. What's the context?
+
+User: A CLI tool that tracks local dev environments
+
+You: That changes everything.
+
+     ┌─────────────────────────────────────────────────┐
+     │          CLI TOOL DATA STORAGE                  │
+     └─────────────────────────────────────────────────┘
+
+     Key constraints:
+     • No daemon running
+     • Must work offline
+     • Single user
+
+                  SQLite          Postgres
+     Deployment   embedded ✓      needs server ✗
+     Offline      yes ✓           no ✗
+     Single file  yes ✓           no ✗
+
+     SQLite. Not even close.
+
+     Unless... is there a sync component?
+```
+
+---
+
+## Ending Discovery
+
+There's no required ending. Discovery might:
+
+- **Flow into a proposal**: "Ready to start? I can create a change proposal."
+- **Result in artifact updates**: "Updated design.md with these decisions"
+- **Just provide clarity**: User has what they need, moves on
+- **Continue later**: "We can pick this up anytime"
+
+When it feels like things are crystallizing, you might summarize:
+
+```
+## What We Figured Out
+
+**The problem**: [crystallized understanding]
+
+**The approach**: [if one emerged]
+
+**Open questions**: [if any remain]
+
+**Next steps** (if ready):
+- Create a change proposal
+- Keep exploring: just keep talking
+```
+
+But this summary is optional. Sometimes the thinking IS the value.
+
+---
+
+## Guardrails
+
+- **Don't implement** - Never write code or implement features. Creating OpenSpec artifacts is fine, writing application code is not.
+- **Don't fake understanding** - If something is unclear, dig deeper
+- **Don't rush** - Discovery is thinking time, not task time
+- **Don't force structure** - Let patterns emerge naturally
+- **Don't auto-capture** - Offer to save insights, don't just do it
+- **Do visualize** - A good diagram is worth many paragraphs
+- **Do explore the codebase** - Ground discussions in reality
+- **Do question assumptions** - Including the user's and your own
diff --git a/.codex/skills/openspec-ff-change/SKILL.md b/.codex/skills/openspec-ff-change/SKILL.md
new file mode 100644
index 000000000..61fab93de
--- /dev/null
+++ b/.codex/skills/openspec-ff-change/SKILL.md
@@ -0,0 +1,105 @@
+---
+name: openspec-ff-change
+description: Fast-forward through OpenSpec artifact creation. Use when the user wants to quickly create all artifacts needed for implementation without stepping through each one individually.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Fast-forward through artifact creation - generate everything needed to start implementation in one go.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: The user's request should include a change name (kebab-case) OR a description of what they want to build.
+
+**Steps**
+
+1. **If no clear input provided, ask what they want to build**
+
+   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
+   > "What change do you want to work on? Describe what you want to build or fix."
+
+   From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
+
+   **IMPORTANT**: Do NOT proceed without understanding what the user wants to build.
+
+2. **Create the change directory**
+   ```bash
+   openspec new change "<name>"
+   ```
+   This creates a scaffolded change in the planning home resolved by the CLI.
+
+3. **Get the artifact build order**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to get:
+   - `applyRequires`: array of artifact IDs needed before implementation (e.g., `["tasks"]`)
+   - `artifacts`: list of all artifacts with their status and dependencies
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context. Use these instead of assuming repo-local paths.
+
+4. **Create artifacts in sequence until apply-ready**
+
+   Use the **TodoWrite tool** to track progress through the artifacts.
+
+   Loop through artifacts in dependency order (artifacts with no pending dependencies first):
+
+   a. **For each artifact that is `ready` (dependencies satisfied)**:
+      - Get instructions:
+        ```bash
+        openspec instructions <artifact-id> --change "<name>" --json
+        ```
+      - The instructions JSON includes:
+        - `context`: Project background (constraints for you - do NOT include in output)
+        - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
+        - `template`: The structure to use for your output file
+        - `instruction`: Schema-specific guidance for this artifact type
+        - `resolvedOutputPath`: Resolved path or pattern to write the artifact
+        - `dependencies`: Completed artifacts to read for context
+      - Read any completed dependency files for context
+      - Create the artifact file using `template` as the structure and write it to `resolvedOutputPath`
+      - Apply `context` and `rules` as constraints - but do NOT copy them into the file
+      - Show brief progress: "✓ Created <artifact-id>"
+
+   b. **Continue until all `applyRequires` artifacts are complete**
+      - After creating each artifact, re-run `openspec status --change "<name>" --json`
+      - Check if every artifact ID in `applyRequires` has `status: "done"` in the artifacts array
+      - Stop when all `applyRequires` artifacts are done
+
+   c. **If an artifact requires user input** (unclear context):
+      - Use **AskUserQuestion tool** to clarify
+      - Then continue with creation
+
+5. **Show final status**
+   ```bash
+   openspec status --change "<name>"
+   ```
+
+**Output**
+
+After completing all artifacts, summarize:
+- Change name and location
+- List of artifacts created with brief descriptions
+- What's ready: "All artifacts created! Ready for implementation."
+- Prompt: "Run `/opsx:apply` or ask me to implement to start working on the tasks."
+
+**Artifact Creation Guidelines**
+
+- Follow the `instruction` field from `openspec instructions` for each artifact type
+- The schema defines what each artifact should contain - follow it
+- Read dependency artifacts for context before creating new ones
+- Use `template` as the structure for your output file - fill in its sections
+- **IMPORTANT**: `context` and `rules` are constraints for YOU, not content for the file
+  - Do NOT copy `<context>`, `<rules>`, `<project_context>` blocks into the artifact
+  - These guide what you write, but should never appear in the output
+
+**Guardrails**
+- Create ALL artifacts needed for implementation (as defined by schema's `apply.requires`)
+- Always read dependency artifacts before creating a new one
+- If context is critically unclear, ask the user - but prefer making reasonable decisions to keep momentum
+- If a change with that name already exists, suggest continuing that change instead
+- Verify each artifact file exists after writing before proceeding to next
diff --git a/.codex/skills/openspec-new-change/SKILL.md b/.codex/skills/openspec-new-change/SKILL.md
new file mode 100644
index 000000000..b4d8a9e70
--- /dev/null
+++ b/.codex/skills/openspec-new-change/SKILL.md
@@ -0,0 +1,77 @@
+---
+name: openspec-new-change
+description: Start a new OpenSpec change using the experimental artifact workflow. Use when the user wants to create a new feature, fix, or modification with a structured step-by-step approach.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Start a new change using the experimental artifact-driven approach.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: The user's request should include a change name (kebab-case) OR a description of what they want to build.
+
+**Steps**
+
+1. **If no clear input provided, ask what they want to build**
+
+   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
+   > "What change do you want to work on? Describe what you want to build or fix."
+
+   From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
+
+   **IMPORTANT**: Do NOT proceed without understanding what the user wants to build.
+
+2. **Determine the workflow schema**
+
+   Use the default schema (omit `--schema`) unless the user explicitly requests a different workflow.
+
+   **Use a different schema only if the user mentions:**
+   - A specific schema name → use `--schema <name>`
+   - "show workflows" or "what workflows" → run `openspec schemas --json` and let them choose
+
+   **Otherwise**: Omit `--schema` to use the default.
+
+3. **Create the change directory**
+   ```bash
+   openspec new change "<name>"
+   ```
+   Add `--schema <name>` only if the user requested a specific workflow.
+   This creates a scaffolded change in the planning home resolved by the CLI.
+
+4. **Show the artifact status**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Use the returned `planningHome`, `changeRoot`, `artifactPaths`, and `nextSteps` instead of assuming repo-local paths.
+
+5. **Get instructions for the first artifact**
+   The first artifact depends on the schema (e.g., `proposal` for spec-driven).
+   Check the status output to find the first artifact with status "ready".
+   ```bash
+   openspec instructions <first-artifact-id> --change "<name>"
+   ```
+   This outputs the template and context for creating the first artifact.
+
+6. **STOP and wait for user direction**
+
+**Output**
+
+After completing the steps, summarize:
+- Change name and location
+- Schema/workflow being used and its artifact sequence
+- Current status (0/N artifacts complete)
+- The template for the first artifact
+- Prompt: "Ready to create the first artifact? Just describe what this change is about and I'll draft it, or ask me to continue."
+
+**Guardrails**
+- Do NOT create any artifacts yet - just show the instructions
+- Do NOT advance beyond showing the first artifact template
+- If the name is invalid (not kebab-case), ask for a valid name
+- If a change with that name already exists, suggest continuing that change instead
+- Pass --schema if using a non-default workflow
diff --git a/.codex/skills/openspec-onboard/SKILL.md b/.codex/skills/openspec-onboard/SKILL.md
new file mode 100644
index 000000000..ac4ac6fee
--- /dev/null
+++ b/.codex/skills/openspec-onboard/SKILL.md
@@ -0,0 +1,555 @@
+---
+name: openspec-onboard
+description: Guided onboarding for OpenSpec - walk through a complete workflow cycle with narration and real codebase work.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Guide the user through their first complete OpenSpec workflow cycle. This is a teaching experience—you'll do real work in their codebase while explaining each step.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+---
+
+## Preflight
+
+Before starting, check if the OpenSpec CLI is installed:
+
+```bash
+# Unix/macOS
+openspec --version 2>&1 || echo "CLI_NOT_INSTALLED"
+# Windows (PowerShell)
+# if (Get-Command openspec -ErrorAction SilentlyContinue) { openspec --version } else { echo "CLI_NOT_INSTALLED" }
+```
+
+**If CLI not installed:**
+> OpenSpec CLI is not installed. Install it first, then come back to `/opsx:onboard`.
+
+Stop here if not installed.
+
+---
+
+## Phase 1: Welcome
+
+Display:
+
+```
+## Welcome to OpenSpec!
+
+I'll walk you through a complete change cycle—from idea to implementation—using a real task in your codebase. Along the way, you'll learn the workflow by doing it.
+
+**What we'll do:**
+1. Pick a small, real task in your codebase
+2. Explore the problem briefly
+3. Create a change (the container for our work)
+4. Build the artifacts: proposal → specs → design → tasks
+5. Implement the tasks
+6. Archive the completed change
+
+**Time:** ~15-20 minutes
+
+Let's start by finding something to work on.
+```
+
+---
+
+## Phase 2: Task Selection
+
+### Codebase Analysis
+
+Scan the codebase for small improvement opportunities. Look for:
+
+1. **TODO/FIXME comments** - Search for `TODO`, `FIXME`, `HACK`, `XXX` in code files
+2. **Missing error handling** - `catch` blocks that swallow errors, risky operations without try-catch
+3. **Functions without tests** - Cross-reference `src/` with test directories
+4. **Type issues** - `any` types in TypeScript files (`: any`, `as any`)
+5. **Debug artifacts** - `console.log`, `console.debug`, `debugger` statements in non-debug code
+6. **Missing validation** - User input handlers without validation
+
+Also check recent git activity:
+```bash
+# Unix/macOS
+git log --oneline -10 2>/dev/null || echo "No git history"
+# Windows (PowerShell)
+# git log --oneline -10 2>$null; if ($LASTEXITCODE -ne 0) { echo "No git history" }
+```
+
+### Present Suggestions
+
+From your analysis, present 3-4 specific suggestions:
+
+```
+## Task Suggestions
+
+Based on scanning your codebase, here are some good starter tasks:
+
+**1. [Most promising task]**
+   Location: `src/path/to/file.ts:42`
+   Scope: ~1-2 files, ~20-30 lines
+   Why it's good: [brief reason]
+
+**2. [Second task]**
+   Location: `src/another/file.ts`
+   Scope: ~1 file, ~15 lines
+   Why it's good: [brief reason]
+
+**3. [Third task]**
+   Location: [location]
+   Scope: [estimate]
+   Why it's good: [brief reason]
+
+**4. Something else?**
+   Tell me what you'd like to work on.
+
+Which task interests you? (Pick a number or describe your own)
+```
+
+**If nothing found:** Fall back to asking what the user wants to build:
+> I didn't find obvious quick wins in your codebase. What's something small you've been meaning to add or fix?
+
+### Scope Guardrail
+
+If the user picks or describes something too large (major feature, multi-day work):
+
+```
+That's a valuable task, but it's probably larger than ideal for your first OpenSpec run-through.
+
+For learning the workflow, smaller is better—it lets you see the full cycle without getting stuck in implementation details.
+
+**Options:**
+1. **Slice it smaller** - What's the smallest useful piece of [their task]? Maybe just [specific slice]?
+2. **Pick something else** - One of the other suggestions, or a different small task?
+3. **Do it anyway** - If you really want to tackle this, we can. Just know it'll take longer.
+
+What would you prefer?
+```
+
+Let the user override if they insist—this is a soft guardrail.
+
+---
+
+## Phase 3: Explore Demo
+
+Once a task is selected, briefly demonstrate explore mode:
+
+```
+Before we create a change, let me quickly show you **explore mode**—it's how you think through problems before committing to a direction.
+```
+
+Spend 1-2 minutes investigating the relevant code:
+- Read the file(s) involved
+- Draw a quick ASCII diagram if it helps
+- Note any considerations
+
+```
+## Quick Exploration
+
+[Your brief analysis—what you found, any considerations]
+
+┌─────────────────────────────────────────┐
+│   [Optional: ASCII diagram if helpful]  │
+└─────────────────────────────────────────┘
+
+Explore mode (`/opsx:explore`) is for this kind of thinking—investigating before implementing. You can use it anytime you need to think through a problem.
+
+Now let's create a change to hold our work.
+```
+
+**PAUSE** - Wait for user acknowledgment before proceeding.
+
+---
+
+## Phase 4: Create the Change
+
+**EXPLAIN:**
+```
+## Creating a Change
+
+A "change" in OpenSpec is a container for all the thinking and planning around a piece of work. It lives at the `changeRoot` reported by `openspec status --change "<name>" --json` and holds your artifacts—proposal, specs, design, tasks.
+
+Let me create one for our task.
+```
+
+**DO:** Create the change with a derived kebab-case name:
+```bash
+openspec new change "<derived-name>"
+```
+
+**SHOW:**
+```
+Created: <changeRoot from status JSON>
+
+The folder structure:
+```
+<changeRoot>/
+├── proposal.md    ← Why we're doing this (empty, we'll fill it)
+├── design.md      ← How we'll build it (empty)
+├── specs/         ← Detailed requirements (empty)
+└── tasks.md       ← Implementation checklist (empty)
+```
+
+Now let's fill in the first artifact—the proposal.
+```
+
+---
+
+## Phase 5: Proposal
+
+**EXPLAIN:**
+```
+## The Proposal
+
+The proposal captures **why** we're making this change and **what** it involves at a high level. It's the "elevator pitch" for the work.
+
+I'll draft one based on our task.
+```
+
+**DO:** Draft the proposal content (don't save yet):
+
+```
+Here's a draft proposal:
+
+---
+
+## Why
+
+[1-2 sentences explaining the problem/opportunity]
+
+## What Changes
+
+[Bullet points of what will be different]
+
+## Capabilities
+
+### New Capabilities
+- `<capability-name>`: [brief description]
+
+### Modified Capabilities
+<!-- If modifying existing behavior -->
+
+## Impact
+
+- `src/path/to/file.ts`: [what changes]
+- [other files if applicable]
+
+---
+
+Does this capture the intent? I can adjust before we save it.
+```
+
+**PAUSE** - Wait for user approval/feedback.
+
+After approval, save the proposal:
+```bash
+openspec instructions proposal --change "<name>" --json
+```
+Then write the content to the `resolvedOutputPath` from `openspec instructions proposal --change "<name>" --json`.
+
+```
+Proposal saved. This is your "why" document—you can always come back and refine it as understanding evolves.
+
+Next up: specs.
+```
+
+---
+
+## Phase 6: Specs
+
+**EXPLAIN:**
+```
+## Specs
+
+Specs define **what** we're building in precise, testable terms. They use a requirement/scenario format that makes expected behavior crystal clear.
+
+For a small task like this, we might only need one spec file.
+```
+
+**DO:** Resolve where the spec file should be created:
+```bash
+openspec instructions specs --change "<name>" --json
+# Use resolvedOutputPath from the JSON. If it is a glob, choose the concrete file path using the schema instruction and the change's context.
+```
+
+Draft the spec content:
+
+```
+Here's the spec:
+
+---
+
+## ADDED Requirements
+
+### Requirement: <Name>
+
+<Description of what the system should do>
+
+#### Scenario: <Scenario name>
+
+- **WHEN** <trigger condition>
+- **THEN** <expected outcome>
+- **AND** <additional outcome if needed>
+
+---
+
+This format—WHEN/THEN/AND—makes requirements testable. You can literally read them as test cases.
+```
+
+Save to the concrete file path chosen from `resolvedOutputPath`.
+
+---
+
+## Phase 7: Design
+
+**EXPLAIN:**
+```
+## Design
+
+The design captures **how** we'll build it—technical decisions, tradeoffs, approach.
+
+For small changes, this might be brief. That's fine—not every change needs deep design discussion.
+```
+
+**DO:** Draft design.md:
+
+```
+Here's the design:
+
+---
+
+## Context
+
+[Brief context about the current state]
+
+## Goals / Non-Goals
+
+**Goals:**
+- [What we're trying to achieve]
+
+**Non-Goals:**
+- [What's explicitly out of scope]
+
+## Decisions
+
+### Decision 1: [Key decision]
+
+[Explanation of approach and rationale]
+
+---
+
+For a small task, this captures the key decisions without over-engineering.
+```
+
+Save to the `resolvedOutputPath` from `openspec instructions design --change "<name>" --json`.
+
+---
+
+## Phase 8: Tasks
+
+**EXPLAIN:**
+```
+## Tasks
+
+Finally, we break the work into implementation tasks—checkboxes that drive the apply phase.
+
+These should be small, clear, and in logical order.
+```
+
+**DO:** Generate tasks based on specs and design:
+
+```
+Here are the implementation tasks:
+
+---
+
+## 1. [Category or file]
+
+- [ ] 1.1 [Specific task]
+- [ ] 1.2 [Specific task]
+
+## 2. Verify
+
+- [ ] 2.1 [Verification step]
+
+---
+
+Each checkbox becomes a unit of work in the apply phase. Ready to implement?
+```
+
+**PAUSE** - Wait for user to confirm they're ready to implement.
+
+Save to the `resolvedOutputPath` from `openspec instructions tasks --change "<name>" --json`.
+
+---
+
+## Phase 9: Apply (Implementation)
+
+**EXPLAIN:**
+```
+## Implementation
+
+Now we implement each task, checking them off as we go. I'll announce each one and occasionally note how the specs/design informed the approach.
+```
+
+**DO:** For each task:
+
+1. Announce: "Working on task N: [description]"
+2. Implement the change in the codebase
+3. Reference specs/design naturally: "The spec says X, so I'm doing Y"
+4. Mark complete in tasks.md: `- [ ]` → `- [x]`
+5. Brief status: "✓ Task N complete"
+
+Keep narration light—don't over-explain every line of code.
+
+After all tasks:
+
+```
+## Implementation Complete
+
+All tasks done:
+- [x] Task 1
+- [x] Task 2
+- [x] ...
+
+The change is implemented! One more step—let's archive it.
+```
+
+---
+
+## Phase 10: Archive
+
+**EXPLAIN:**
+```
+## Archiving
+
+When a change is complete, we archive it. The archive path is derived from `planningHome.changesDir` and the date.
+
+Archived changes become your project's decision history—you can always find them later to understand why something was built a certain way.
+```
+
+**DO:**
+```bash
+openspec archive "<name>"
+```
+
+**SHOW:**
+```
+Archived to: `<planningHome.changesDir>/archive/YYYY-MM-DD-<name>/`
+
+The change is now part of your project's history. The code is in your codebase, the decision record is preserved.
+```
+
+---
+
+## Phase 11: Recap & Next Steps
+
+```
+## Congratulations!
+
+You just completed a full OpenSpec cycle:
+
+1. **Explore** - Thought through the problem
+2. **New** - Created a change container
+3. **Proposal** - Captured WHY
+4. **Specs** - Defined WHAT in detail
+5. **Design** - Decided HOW
+6. **Tasks** - Broke it into steps
+7. **Apply** - Implemented the work
+8. **Archive** - Preserved the record
+
+This same rhythm works for any size change—a small fix or a major feature.
+
+---
+
+## Command Reference
+
+**Core workflow:**
+
+ | Command           | What it does                               |
+ |-------------------|--------------------------------------------|
+ | `/opsx:propose` | Create a change and generate all artifacts |
+ | `/opsx:explore` | Think through problems before/during work  |
+ | `/opsx:apply`   | Implement tasks from a change              |
+ | `/opsx:archive` | Archive a completed change                 |
+
+**Additional commands:**
+
+ | Command            | What it does                                             |
+ |--------------------|----------------------------------------------------------|
+ | `/opsx:new`      | Start a new change, step through artifacts one at a time |
+ | `/opsx:continue` | Continue working on an existing change                   |
+ | `/opsx:ff`       | Fast-forward: create all artifacts at once               |
+ | `/opsx:verify`   | Verify implementation matches artifacts                  |
+
+---
+
+## What's Next?
+
+Try `/opsx:propose` on something you actually want to build. You've got the rhythm now!
+```
+
+---
+
+## Graceful Exit Handling
+
+### User wants to stop mid-way
+
+If the user says they need to stop, want to pause, or seem disengaged:
+
+```
+No problem! Your change is saved at the `changeRoot` reported by `openspec status --change "<name>" --json`.
+
+To pick up where we left off later:
+- `/opsx:continue <name>` - Resume artifact creation
+- `/opsx:apply <name>` - Jump to implementation (if tasks exist)
+
+The work won't be lost. Come back whenever you're ready.
+```
+
+Exit gracefully without pressure.
+
+### User just wants command reference
+
+If the user says they just want to see the commands or skip the tutorial:
+
+```
+## OpenSpec Quick Reference
+
+**Core workflow:**
+
+ | Command                  | What it does                               |
+ |--------------------------|--------------------------------------------|
+ | `/opsx:propose <name>` | Create a change and generate all artifacts |
+ | `/opsx:explore`        | Think through problems (no code changes)   |
+ | `/opsx:apply <name>`   | Implement tasks                            |
+ | `/opsx:archive <name>` | Archive when done                          |
+
+**Additional commands:**
+
+ | Command                   | What it does                        |
+ |---------------------------|-------------------------------------|
+ | `/opsx:new <name>`      | Start a new change, step by step    |
+ | `/opsx:continue <name>` | Continue an existing change         |
+ | `/opsx:ff <name>`       | Fast-forward: all artifacts at once |
+ | `/opsx:verify <name>`   | Verify implementation               |
+
+Try `/opsx:propose` to start your first change.
+```
+
+Exit gracefully.
+
+---
+
+## Guardrails
+
+- **Follow the EXPLAIN → DO → SHOW → PAUSE pattern** at key transitions (after explore, after proposal draft, after tasks, after archive)
+- **Keep narration light** during implementation—teach without lecturing
+- **Don't skip phases** even if the change is small—the goal is teaching the workflow
+- **Pause for acknowledgment** at marked points, but don't over-pause
+- **Handle exits gracefully**—never pressure the user to continue
+- **Use real codebase tasks**—don't simulate or use fake examples
+- **Adjust scope gently**—guide toward smaller tasks but respect user choice
diff --git a/.codex/skills/openspec-sync-specs/SKILL.md b/.codex/skills/openspec-sync-specs/SKILL.md
new file mode 100644
index 000000000..b6aad67ab
--- /dev/null
+++ b/.codex/skills/openspec-sync-specs/SKILL.md
@@ -0,0 +1,148 @@
+---
+name: openspec-sync-specs
+description: Sync delta specs from a change to main specs. Use when the user wants to update main specs with changes from a delta spec, without archiving the change.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Sync delta specs from a change to main specs.
+
+This is an **agent-driven** operation - you will read delta specs and directly edit main specs to apply the changes. This allows intelligent merging (e.g., adding a scenario without copying the entire requirement).
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show changes that have delta specs (under `specs/` directory).
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Resolve change context**
+
+   Run:
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+
+3. **Find delta specs**
+
+   Use `artifactPaths.specs.existingOutputPaths` from the status JSON as the list of delta spec files.
+
+   Each delta spec file contains sections like:
+   - `## ADDED Requirements` - New requirements to add
+   - `## MODIFIED Requirements` - Changes to existing requirements
+   - `## REMOVED Requirements` - Requirements to remove
+   - `## RENAMED Requirements` - Requirements to rename (FROM:/TO: format)
+
+   If no delta specs found, inform user and stop.
+
+4. **For each delta spec, apply changes to main specs**
+
+   For each repo-local capability delta spec path returned by the CLI:
+
+   a. **Read the delta spec** to understand the intended changes
+
+   b. **Read the main spec** at `openspec/specs/<capability>/spec.md` (may not exist yet)
+
+   c. **Apply changes intelligently**:
+
+      **ADDED Requirements:**
+      - If requirement doesn't exist in main spec → add it
+      - If requirement already exists → update it to match (treat as implicit MODIFIED)
+
+      **MODIFIED Requirements:**
+      - Find the requirement in main spec
+      - Apply the changes - this can be:
+        - Adding new scenarios (don't need to copy existing ones)
+        - Modifying existing scenarios
+        - Changing the requirement description
+      - Preserve scenarios/content not mentioned in the delta
+
+      **REMOVED Requirements:**
+      - Remove the entire requirement block from main spec
+
+      **RENAMED Requirements:**
+      - Find the FROM requirement, rename to TO
+
+   d. **Create new main spec** if capability doesn't exist yet:
+      - Create `openspec/specs/<capability>/spec.md`
+      - Add Purpose section (can be brief, mark as TBD)
+      - Add Requirements section with the ADDED requirements
+
+5. **Show summary**
+
+   After applying all changes, summarize:
+   - Which capabilities were updated
+   - What changes were made (requirements added/modified/removed/renamed)
+
+**Delta Spec Format Reference**
+
+```markdown
+## ADDED Requirements
+
+### Requirement: New Feature
+The system SHALL do something new.
+
+#### Scenario: Basic case
+- **WHEN** user does X
+- **THEN** system does Y
+
+## MODIFIED Requirements
+
+### Requirement: Existing Feature
+#### Scenario: New scenario to add
+- **WHEN** user does A
+- **THEN** system does B
+
+## REMOVED Requirements
+
+### Requirement: Deprecated Feature
+
+## RENAMED Requirements
+
+- FROM: `### Requirement: Old Name`
+- TO: `### Requirement: New Name`
+```
+
+**Key Principle: Intelligent Merging**
+
+Unlike programmatic merging, you can apply **partial updates**:
+- To add a scenario, just include that scenario under MODIFIED - don't copy existing scenarios
+- The delta represents *intent*, not a wholesale replacement
+- Use your judgment to merge changes sensibly
+
+**Output On Success**
+
+```
+## Specs Synced: <change-name>
+
+Updated main specs:
+
+**<capability-1>**:
+- Added requirement: "New Feature"
+- Modified requirement: "Existing Feature" (added 1 scenario)
+
+**<capability-2>**:
+- Created new spec file
+- Added requirement: "Another Feature"
+
+Main specs are now updated. The change remains active - archive when implementation is complete.
+```
+
+**Guardrails**
+- Read both delta and main specs before making changes
+- Preserve existing content not mentioned in delta
+- If something is unclear, ask for clarification
+- Show what you're changing as you go
+- The operation should be idempotent - running twice should give same result
diff --git a/.codex/skills/openspec-verify-change/SKILL.md b/.codex/skills/openspec-verify-change/SKILL.md
new file mode 100644
index 000000000..b6557c6ff
--- /dev/null
+++ b/.codex/skills/openspec-verify-change/SKILL.md
@@ -0,0 +1,172 @@
+---
+name: openspec-verify-change
+description: Verify implementation matches change artifacts. Use when the user wants to validate that implementation is complete, correct, and coherent before archiving.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Verify that an implementation matches the change artifacts (specs, tasks, design).
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show changes that have implementation tasks (tasks artifact exists).
+   Include the schema used for each change if available.
+   Mark changes with incomplete tasks as "(In Progress)".
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Check status to understand the schema**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used (e.g., "spec-driven")
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context
+   - Which artifacts exist for this change
+
+3. **Get planning context and load artifacts**
+
+   ```bash
+   openspec instructions apply --change "<name>" --json
+   ```
+
+   This returns the change directory and `contextFiles` (artifact ID -> array of concrete file paths). Read all available artifacts from `contextFiles`.
+
+4. **Initialize verification report structure**
+
+   Create a report structure with three dimensions:
+   - **Completeness**: Track tasks and spec coverage
+   - **Correctness**: Track requirement implementation and scenario coverage
+   - **Coherence**: Track design adherence and pattern consistency
+
+   Each dimension can have CRITICAL, WARNING, or SUGGESTION issues.
+
+5. **Verify Completeness**
+
+   **Task Completion**:
+   - If `contextFiles.tasks` exists, read every file path in it
+   - Parse checkboxes: `- [ ]` (incomplete) vs `- [x]` (complete)
+   - Count complete vs total tasks
+   - If incomplete tasks exist:
+     - Add CRITICAL issue for each incomplete task
+     - Recommendation: "Complete task: <description>" or "Mark as done if already implemented"
+
+   **Spec Coverage**:
+   - If delta specs exist in `contextFiles.specs`:
+     - Extract all requirements (marked with "### Requirement:")
+     - For each requirement:
+       - Search codebase for keywords related to the requirement
+       - Assess if implementation likely exists
+     - If requirements appear unimplemented:
+       - Add CRITICAL issue: "Requirement not found: <requirement name>"
+       - Recommendation: "Implement requirement X: <description>"
+
+6. **Verify Correctness**
+
+   **Requirement Implementation Mapping**:
+   - For each requirement from delta specs:
+     - Search codebase for implementation evidence
+     - If found, note file paths and line ranges
+     - Assess if implementation matches requirement intent
+     - If divergence detected:
+       - Add WARNING: "Implementation may diverge from spec: <details>"
+       - Recommendation: "Review <file>:<lines> against requirement X"
+
+   **Scenario Coverage**:
+   - For each scenario in delta specs (marked with "#### Scenario:"):
+     - Check if conditions are handled in code
+     - Check if tests exist covering the scenario
+     - If scenario appears uncovered:
+       - Add WARNING: "Scenario not covered: <scenario name>"
+       - Recommendation: "Add test or implementation for scenario: <description>"
+
+7. **Verify Coherence**
+
+   **Design Adherence**:
+   - If `contextFiles.design` exists:
+     - Extract key decisions (look for sections like "Decision:", "Approach:", "Architecture:")
+     - Verify implementation follows those decisions
+     - If contradiction detected:
+       - Add WARNING: "Design decision not followed: <decision>"
+       - Recommendation: "Update implementation or revise design.md to match reality"
+   - If no design.md: Skip design adherence check, note "No design.md to verify against"
+
+   **Code Pattern Consistency**:
+   - Review new code for consistency with project patterns
+   - Check file naming, directory structure, coding style
+   - If significant deviations found:
+     - Add SUGGESTION: "Code pattern deviation: <details>"
+     - Recommendation: "Consider following project pattern: <example>"
+
+8. **Generate Verification Report**
+
+   **Summary Scorecard**:
+   ```
+   ## Verification Report: <change-name>
+
+   ### Summary
+   | Dimension    | Status           |
+   |--------------|------------------|
+   | Completeness | X/Y tasks, N reqs|
+   | Correctness  | M/N reqs covered |
+   | Coherence    | Followed/Issues  |
+   ```
+
+   **Issues by Priority**:
+
+   1. **CRITICAL** (Must fix before archive):
+      - Incomplete tasks
+      - Missing requirement implementations
+      - Each with specific, actionable recommendation
+
+   2. **WARNING** (Should fix):
+      - Spec/design divergences
+      - Missing scenario coverage
+      - Each with specific recommendation
+
+   3. **SUGGESTION** (Nice to fix):
+      - Pattern inconsistencies
+      - Minor improvements
+      - Each with specific recommendation
+
+   **Final Assessment**:
+   - If CRITICAL issues: "X critical issue(s) found. Fix before archiving."
+   - If only warnings: "No critical issues. Y warning(s) to consider. Ready for archive (with noted improvements)."
+   - If all clear: "All checks passed. Ready for archive."
+
+**Verification Heuristics**
+
+- **Completeness**: Focus on objective checklist items (checkboxes, requirements list)
+- **Correctness**: Use keyword search, file path analysis, reasonable inference - don't require perfect certainty
+- **Coherence**: Look for glaring inconsistencies, don't nitpick style
+- **False Positives**: When uncertain, prefer SUGGESTION over WARNING, WARNING over CRITICAL
+- **Actionability**: Every issue must have a specific recommendation with file/line references where applicable
+
+**Graceful Degradation**
+
+- If only tasks.md exists: verify task completion only, skip spec/design checks
+- If tasks + specs exist: verify completeness and correctness, skip design
+- If full artifacts: verify all three dimensions
+- Always note which checks were skipped and why
+
+**Output Format**
+
+Use clear markdown with:
+- Table for summary scorecard
+- Grouped lists for issues (CRITICAL/WARNING/SUGGESTION)
+- Code references in format: `file.ts:123`
+- Specific, actionable recommendations
+- No vague suggestions like "consider reviewing"
diff --git a/.kimi/skills/openspec-apply-change/SKILL.md b/.kimi/skills/openspec-apply-change/SKILL.md
new file mode 100644
index 000000000..1375861c3
--- /dev/null
+++ b/.kimi/skills/openspec-apply-change/SKILL.md
@@ -0,0 +1,160 @@
+---
+name: openspec-apply-change
+description: Implement tasks from an OpenSpec change. Use when the user wants to start implementing, continue implementation, or work through tasks.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Implement tasks from an OpenSpec change.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **Select the change**
+
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes and use the **AskUserQuestion tool** to let the user select
+
+   Always announce: "Using change: <name>" and how to override (e.g., `/opsx:apply <other>`).
+
+2. **Check status to understand the schema**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used (e.g., "spec-driven")
+   - `planningHome`, `changeRoot`, and `actionContext`: planning scope and edit constraints
+   - Which artifact contains the tasks (typically "tasks" for spec-driven, check status for others)
+
+3. **Get apply instructions**
+
+   ```bash
+   openspec instructions apply --change "<name>" --json
+   ```
+
+   This returns:
+   - `contextFiles`: artifact ID -> array of concrete file paths (varies by schema - could be proposal/specs/design/tasks or spec/tests/implementation/docs)
+   - Progress (total, complete, remaining)
+   - Task list with status
+   - Dynamic instruction based on current state
+
+   **Handle states:**
+   - If `state: "blocked"` (missing artifacts): show message, suggest using openspec-continue-change
+   - If `state: "all_done"`: congratulate, suggest archive
+   - Otherwise: proceed to implementation
+
+4. **Read context files**
+
+   Read every file path listed under `contextFiles` from the apply instructions output.
+   The files depend on the schema being used:
+   - **spec-driven**: proposal, specs, design, tasks
+   - Other schemas: follow the contextFiles from CLI output
+
+5. **Show current progress**
+
+   Display:
+   - Schema being used
+   - Progress: "N/M tasks complete"
+   - Remaining tasks overview
+   - Dynamic instruction from CLI
+
+6. **Implement tasks (loop until done or blocked)**
+
+   For each pending task:
+   - Show which task is being worked on
+   - Make the code changes required
+   - Keep changes minimal and focused
+   - Mark task complete in the tasks file: `- [ ]` → `- [x]`
+   - Continue to next task
+
+   **Pause if:**
+   - Task is unclear → ask for clarification
+   - Implementation reveals a design issue → suggest updating artifacts
+   - Error or blocker encountered → report and wait for guidance
+   - User interrupts
+
+7. **On completion or pause, show status**
+
+   Display:
+   - Tasks completed this session
+   - Overall progress: "N/M tasks complete"
+   - If all done: suggest archive
+   - If paused: explain why and wait for guidance
+
+**Output During Implementation**
+
+```
+## Implementing: <change-name> (schema: <schema-name>)
+
+Working on task 3/7: <task description>
+[...implementation happening...]
+✓ Task complete
+
+Working on task 4/7: <task description>
+[...implementation happening...]
+✓ Task complete
+```
+
+**Output On Completion**
+
+```
+## Implementation Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Progress:** 7/7 tasks complete ✓
+
+### Completed This Session
+- [x] Task 1
+- [x] Task 2
+...
+
+All tasks complete! Ready to archive this change.
+```
+
+**Output On Pause (Issue Encountered)**
+
+```
+## Implementation Paused
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Progress:** 4/7 tasks complete
+
+### Issue Encountered
+<description of the issue>
+
+**Options:**
+1. <option 1>
+2. <option 2>
+3. Other approach
+
+What would you like to do?
+```
+
+**Guardrails**
+- Keep going through tasks until done or blocked
+- Always read context files before starting (from the apply instructions output)
+- If task is ambiguous, pause and ask before implementing
+- If implementation reveals issues, pause and suggest artifact updates
+- Keep code changes minimal and scoped to each task
+- Update task checkbox immediately after completing each task
+- Pause on errors, blockers, or unclear requirements - don't guess
+- Use contextFiles from CLI output, don't assume specific file names
+
+**Fluid Workflow Integration**
+
+This skill supports the "actions on a change" model:
+
+- **Can be invoked anytime**: Before all artifacts are done (if tasks exist), after partial implementation, interleaved with other actions
+- **Allows artifact updates**: If implementation reveals design issues, suggest updating artifacts - not phase-locked, work fluidly
diff --git a/.kimi/skills/openspec-archive-change/SKILL.md b/.kimi/skills/openspec-archive-change/SKILL.md
new file mode 100644
index 000000000..c0c169d14
--- /dev/null
+++ b/.kimi/skills/openspec-archive-change/SKILL.md
@@ -0,0 +1,118 @@
+---
+name: openspec-archive-change
+description: Archive a completed change in the experimental workflow. Use when the user wants to finalize and archive a change after implementation is complete.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Archive a completed change in the experimental workflow.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show only active changes (not already archived).
+   Include the schema used for each change if available.
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Check artifact completion status**
+
+   Run `openspec status --change "<name>" --json` to check artifact completion.
+
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context
+   - `artifacts`: List of artifacts with their status (`done` or other)
+
+   **If any artifacts are not `done`:**
+   - Display warning listing incomplete artifacts
+   - Use **AskUserQuestion tool** to confirm user wants to proceed
+   - Proceed if user confirms
+
+3. **Check task completion status**
+
+   Read the tasks file (typically `tasks.md`) to check for incomplete tasks.
+
+   Count tasks marked with `- [ ]` (incomplete) vs `- [x]` (complete).
+
+   **If incomplete tasks found:**
+   - Display warning showing count of incomplete tasks
+   - Use **AskUserQuestion tool** to confirm user wants to proceed
+   - Proceed if user confirms
+
+   **If no tasks file exists:** Proceed without task-related warning.
+
+4. **Assess delta spec sync state**
+
+   Use `artifactPaths.specs.existingOutputPaths` from status JSON to check for delta specs. If none exist, proceed without sync prompt.
+
+   **If delta specs exist:**
+   - Compare each delta spec with its corresponding main spec at `openspec/specs/<capability>/spec.md`
+   - Determine what changes would be applied (adds, modifications, removals, renames)
+   - Show a combined summary before prompting
+
+   **Prompt options:**
+   - If changes needed: "Sync now (recommended)", "Archive without syncing"
+   - If already synced: "Archive now", "Sync anyway", "Cancel"
+
+   If user chooses sync, use Task tool (subagent_type: "general-purpose", prompt: "Use Skill tool to invoke openspec-sync-specs for change '<name>'. Delta spec analysis: <include the analyzed delta spec summary>"). Proceed to archive regardless of choice.
+
+5. **Perform the archive**
+
+   Create an `archive` directory under `planningHome.changesDir` if it doesn't exist:
+   ```bash
+   mkdir -p "<planningHome.changesDir>/archive"
+   ```
+
+   Generate target name using current date: `YYYY-MM-DD-<change-name>`
+
+   **Check if target already exists:**
+   - If yes: Fail with error, suggest renaming existing archive or using different date
+   - If no: Move `changeRoot` to the archive directory
+
+   ```bash
+   mv "<changeRoot>" "<planningHome.changesDir>/archive/YYYY-MM-DD-<name>"
+   ```
+
+6. **Display summary**
+
+   Show archive completion summary including:
+   - Change name
+   - Schema that was used
+   - Archive location
+   - Whether specs were synced (if applicable)
+   - Note about any warnings (incomplete artifacts/tasks)
+
+**Output On Success**
+
+```
+## Archive Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Archived to:** the archive path derived from `planningHome.changesDir`/YYYY-MM-DD-<name>/
+**Specs:** ✓ Synced to main specs (or "No delta specs" or "Sync skipped")
+
+All artifacts complete. All tasks complete.
+```
+
+**Guardrails**
+- Always prompt for change selection if not provided
+- Use artifact graph (openspec status --json) for completion checking
+- Don't block archive on warnings - just inform and confirm
+- Preserve .openspec.yaml when moving to archive (it moves with the directory)
+- Show clear summary of what happened
+- If sync is requested, use openspec-sync-specs approach (agent-driven)
+- If delta specs exist, always run the sync assessment and show the combined summary before prompting
diff --git a/.kimi/skills/openspec-bulk-archive-change/SKILL.md b/.kimi/skills/openspec-bulk-archive-change/SKILL.md
new file mode 100644
index 000000000..309152af7
--- /dev/null
+++ b/.kimi/skills/openspec-bulk-archive-change/SKILL.md
@@ -0,0 +1,249 @@
+---
+name: openspec-bulk-archive-change
+description: Archive multiple completed changes at once. Use when archiving several parallel changes.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Archive multiple completed changes in a single operation.
+
+This skill allows you to batch-archive changes, handling spec conflicts intelligently by checking the codebase to determine what's actually implemented.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: None required (prompts for selection)
+
+**Steps**
+
+1. **Get active changes**
+
+   Run `openspec list --json` to get all active changes.
+
+   If no active changes exist, inform user and stop.
+
+2. **Prompt for change selection**
+
+   Use **AskUserQuestion tool** with multi-select to let user choose changes:
+   - Show each change with its schema
+   - Include an option for "All changes"
+   - Allow any number of selections (1+ works, 2+ is the typical use case)
+
+   **IMPORTANT**: Do NOT auto-select. Always let the user choose.
+
+3. **Batch validation - gather status for all selected changes**
+
+   For each selected change, collect:
+
+   a. **Artifact status** - Run `openspec status --change "<name>" --json`
+      - Parse `schemaName`, `artifacts`, `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`
+      - Note which artifacts are `done` vs other states
+
+   b. **Task completion** - Read `artifactPaths.tasks.existingOutputPaths` from status JSON
+      - Count `- [ ]` (incomplete) vs `- [x]` (complete)
+      - If no tasks file exists, note as "No tasks"
+
+   c. **Delta specs** - Check `artifactPaths.specs.existingOutputPaths` from status JSON
+      - List which capability specs exist
+      - For each, extract requirement names (lines matching `### Requirement: <name>`)
+
+4. **Detect spec conflicts**
+
+   Build a map of `capability -> [changes that touch it]`:
+
+   ```
+   auth -> [change-a, change-b]  <- CONFLICT (2+ changes)
+   api  -> [change-c]            <- OK (only 1 change)
+   ```
+
+   A conflict exists when 2+ selected changes have delta specs for the same capability.
+
+5. **Resolve conflicts agentically**
+
+   **For each conflict**, investigate the codebase:
+
+   a. **Read the delta specs** from each conflicting change to understand what each claims to add/modify
+
+   b. **Search the codebase** for implementation evidence:
+      - Look for code implementing requirements from each delta spec
+      - Check for related files, functions, or tests
+
+   c. **Determine resolution**:
+      - If only one change is actually implemented -> sync that one's specs
+      - If both implemented -> apply in chronological order (older first, newer overwrites)
+      - If neither implemented -> skip spec sync, warn user
+
+   d. **Record resolution** for each conflict:
+      - Which change's specs to apply
+      - In what order (if both)
+      - Rationale (what was found in codebase)
+
+6. **Show consolidated status table**
+
+   Display a table summarizing all changes:
+
+   ```
+   | Change              | Artifacts | Tasks | Specs   | Conflicts | Status |
+   |---------------------|-----------|-------|---------|-----------|--------|
+   | schema-management   | Done      | 5/5   | 2 delta | None      | Ready  |
+   | project-config      | Done      | 3/3   | 1 delta | None      | Ready  |
+   | add-oauth           | Done      | 4/4   | 1 delta | auth (!)  | Ready* |
+   | add-verify-skill    | 1 left    | 2/5   | None    | None      | Warn   |
+   ```
+
+   For conflicts, show the resolution:
+   ```
+   * Conflict resolution:
+     - auth spec: Will apply add-oauth then add-jwt (both implemented, chronological order)
+   ```
+
+   For incomplete changes, show warnings:
+   ```
+   Warnings:
+   - add-verify-skill: 1 incomplete artifact, 3 incomplete tasks
+   ```
+
+7. **Confirm batch operation**
+
+   Use **AskUserQuestion tool** with a single confirmation:
+
+   - "Archive N changes?" with options based on status
+   - Options might include:
+     - "Archive all N changes"
+     - "Archive only N ready changes (skip incomplete)"
+     - "Cancel"
+
+   If there are incomplete changes, make clear they'll be archived with warnings.
+
+8. **Execute archive for each confirmed change**
+
+   Process changes in the determined order (respecting conflict resolution):
+
+   a. **Sync specs** if delta specs exist:
+      - Use the openspec-sync-specs approach (agent-driven intelligent merge)
+      - For conflicts, apply in resolved order
+      - Track if sync was done
+
+   b. **Perform the archive**:
+      ```bash
+      mkdir -p "<planningHome.changesDir>/archive"
+      mv "<changeRoot>" "<planningHome.changesDir>/archive/YYYY-MM-DD-<name>"
+      ```
+
+   c. **Track outcome** for each change:
+      - Success: archived successfully
+      - Failed: error during archive (record error)
+      - Skipped: user chose not to archive (if applicable)
+
+9. **Display summary**
+
+   Show final results:
+
+   ```
+   ## Bulk Archive Complete
+
+   Archived 3 changes:
+   - schema-management-cli -> archive/2026-01-19-schema-management-cli/
+   - project-config -> archive/2026-01-19-project-config/
+   - add-oauth -> archive/2026-01-19-add-oauth/
+
+   Skipped 1 change:
+   - add-verify-skill (user chose not to archive incomplete)
+
+   Spec sync summary:
+   - 4 delta specs synced to main specs
+   - 1 conflict resolved (auth: applied both in chronological order)
+   ```
+
+   If any failures:
+   ```
+   Failed 1 change:
+   - some-change: Archive directory already exists
+   ```
+
+**Conflict Resolution Examples**
+
+Example 1: Only one implemented
+```
+Conflict: specs/auth/spec.md touched by [add-oauth, add-jwt]
+
+Checking add-oauth:
+- Delta adds "OAuth Provider Integration" requirement
+- Searching codebase... found src/auth/oauth.ts implementing OAuth flow
+
+Checking add-jwt:
+- Delta adds "JWT Token Handling" requirement
+- Searching codebase... no JWT implementation found
+
+Resolution: Only add-oauth is implemented. Will sync add-oauth specs only.
+```
+
+Example 2: Both implemented
+```
+Conflict: specs/api/spec.md touched by [add-rest-api, add-graphql]
+
+Checking add-rest-api (created 2026-01-10):
+- Delta adds "REST Endpoints" requirement
+- Searching codebase... found src/api/rest.ts
+
+Checking add-graphql (created 2026-01-15):
+- Delta adds "GraphQL Schema" requirement
+- Searching codebase... found src/api/graphql.ts
+
+Resolution: Both implemented. Will apply add-rest-api specs first,
+then add-graphql specs (chronological order, newer takes precedence).
+```
+
+**Output On Success**
+
+```
+## Bulk Archive Complete
+
+Archived N changes:
+- <change-1> -> archive/YYYY-MM-DD-<change-1>/
+- <change-2> -> archive/YYYY-MM-DD-<change-2>/
+
+Spec sync summary:
+- N delta specs synced to main specs
+- No conflicts (or: M conflicts resolved)
+```
+
+**Output On Partial Success**
+
+```
+## Bulk Archive Complete (partial)
+
+Archived N changes:
+- <change-1> -> archive/YYYY-MM-DD-<change-1>/
+
+Skipped M changes:
+- <change-2> (user chose not to archive incomplete)
+
+Failed K changes:
+- <change-3>: Archive directory already exists
+```
+
+**Output When No Changes**
+
+```
+## No Changes to Archive
+
+No active changes found. Create a new change to get started.
+```
+
+**Guardrails**
+- Allow any number of changes (1+ is fine, 2+ is the typical use case)
+- Always prompt for selection, never auto-select
+- Detect spec conflicts early and resolve by checking codebase
+- When both changes are implemented, apply specs in chronological order
+- Skip spec sync only when implementation is missing (warn user)
+- Show clear per-change status before confirming
+- Use single confirmation for entire batch
+- Track and report all outcomes (success/skip/fail)
+- Preserve .openspec.yaml when moving to archive
+- Archive directory target uses current date: YYYY-MM-DD-<name>
+- If archive target exists, fail that change but continue with others
diff --git a/.kimi/skills/openspec-continue-change/SKILL.md b/.kimi/skills/openspec-continue-change/SKILL.md
new file mode 100644
index 000000000..31b476f24
--- /dev/null
+++ b/.kimi/skills/openspec-continue-change/SKILL.md
@@ -0,0 +1,122 @@
+---
+name: openspec-continue-change
+description: Continue working on an OpenSpec change by creating the next artifact. Use when the user wants to progress their change, create the next artifact, or continue their workflow.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Continue working on a change by creating the next artifact.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes sorted by most recently modified. Then use the **AskUserQuestion tool** to let the user select which change to work on.
+
+   Present the top 3-4 most recently modified changes as options, showing:
+   - Change name
+   - Schema (from `schema` field if present, otherwise "spec-driven")
+   - Status (e.g., "0/5 tasks", "complete", "no tasks")
+   - How recently it was modified (from `lastModified` field)
+
+   Mark the most recently modified change as "(Recommended)" since it's likely what the user wants to continue.
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Check current status**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand current state. The response includes:
+   - `schemaName`: The workflow schema being used (e.g., "spec-driven")
+   - `artifacts`: Array of artifacts with their status ("done", "ready", "blocked")
+   - `isComplete`: Boolean indicating if all artifacts are complete
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context. Use these instead of assuming repo-local paths.
+
+3. **Act based on status**:
+
+   ---
+
+   **If all artifacts are complete (`isComplete: true`)**:
+   - Congratulate the user
+   - Show final status including the schema used
+   - Suggest: "All artifacts created! You can now implement this change or archive it."
+   - STOP
+
+   ---
+
+   **If artifacts are ready to create** (status shows artifacts with `status: "ready"`):
+   - Pick the FIRST artifact with `status: "ready"` from the status output
+   - Get its instructions:
+     ```bash
+     openspec instructions <artifact-id> --change "<name>" --json
+     ```
+   - Parse the JSON. The key fields are:
+     - `context`: Project background (constraints for you - do NOT include in output)
+     - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
+     - `template`: The structure to use for your output file
+     - `instruction`: Schema-specific guidance
+     - `resolvedOutputPath`: Resolved path or pattern to write the artifact
+     - `dependencies`: Completed artifacts to read for context
+   - **Create the artifact file**:
+     - Read any completed dependency files for context
+     - Use `template` as the structure - fill in its sections
+     - Apply `context` and `rules` as constraints when writing - but do NOT copy them into the file
+     - Write to the `resolvedOutputPath` specified in instructions. If it is a glob pattern, choose the concrete file path using the schema instruction and the change's context
+   - Show what was created and what's now unlocked
+   - STOP after creating ONE artifact
+
+   ---
+
+   **If no artifacts are ready (all blocked)**:
+   - This shouldn't happen with a valid schema
+   - Show status and suggest checking for issues
+
+4. **After creating an artifact, show progress**
+   ```bash
+   openspec status --change "<name>"
+   ```
+
+**Output**
+
+After each invocation, show:
+- Which artifact was created
+- Schema workflow being used
+- Current progress (N/M complete)
+- What artifacts are now unlocked
+- Prompt: "Want to continue? Just ask me to continue or tell me what to do next."
+
+**Artifact Creation Guidelines**
+
+The artifact types and their purpose depend on the schema. Use the `instruction` field from the instructions output to understand what to create.
+
+Common artifact patterns:
+
+**spec-driven schema** (proposal → specs → design → tasks):
+- **proposal.md**: Ask user about the change if not clear. Fill in Why, What Changes, Capabilities, Impact.
+  - The Capabilities section is critical - each capability listed will need a spec file.
+- **specs/<capability>/spec.md**: Create one spec per capability listed in the proposal's Capabilities section (use the capability name, not the change name).
+- **design.md**: Document technical decisions, architecture, and implementation approach.
+- **tasks.md**: Break down implementation into checkboxed tasks.
+
+For other schemas, follow the `instruction` field from the CLI output.
+
+**Guardrails**
+- Create ONE artifact per invocation
+- Always read dependency artifacts before creating a new one
+- Never skip artifacts or create out of order
+- If context is unclear, ask the user before creating
+- Verify the artifact file exists after writing before marking progress
+- Use the schema's artifact sequence, don't assume specific artifact names
+- **IMPORTANT**: `context` and `rules` are constraints for YOU, not content for the file
+  - Do NOT copy `<context>`, `<rules>`, `<project_context>` blocks into the artifact
+  - These guide what you write, but should never appear in the output
diff --git a/.kimi/skills/openspec-explore/SKILL.md b/.kimi/skills/openspec-explore/SKILL.md
new file mode 100644
index 000000000..771271a8f
--- /dev/null
+++ b/.kimi/skills/openspec-explore/SKILL.md
@@ -0,0 +1,290 @@
+---
+name: openspec-explore
+description: Enter explore mode - a thinking partner for exploring ideas, investigating problems, and clarifying requirements. Use when the user wants to think through something before or during a change.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Enter explore mode. Think deeply. Visualize freely. Follow the conversation wherever it goes.
+
+**IMPORTANT: Explore mode is for thinking, not implementing.** You may read files, search code, and investigate the codebase, but you must NEVER write code or implement features. If the user asks you to implement something, remind them to exit explore mode first and create a change proposal. You MAY create OpenSpec artifacts (proposals, designs, specs) if the user asks—that's capturing thinking, not implementing.
+
+**This is a stance, not a workflow.** There are no fixed steps, no required sequence, no mandatory outputs. You're a thinking partner helping the user explore.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+---
+
+## The Stance
+
+- **Curious, not prescriptive** - Ask questions that emerge naturally, don't follow a script
+- **Open threads, not interrogations** - Surface multiple interesting directions and let the user follow what resonates. Don't funnel them through a single path of questions.
+- **Visual** - Use ASCII diagrams liberally when they'd help clarify thinking
+- **Adaptive** - Follow interesting threads, pivot when new information emerges
+- **Patient** - Don't rush to conclusions, let the shape of the problem emerge
+- **Grounded** - Explore the actual codebase when relevant, don't just theorize
+
+---
+
+## What You Might Do
+
+Depending on what the user brings, you might:
+
+**Explore the problem space**
+- Ask clarifying questions that emerge from what they said
+- Challenge assumptions
+- Reframe the problem
+- Find analogies
+
+**Investigate the codebase**
+- Map existing architecture relevant to the discussion
+- Find integration points
+- Identify patterns already in use
+- Surface hidden complexity
+
+**Compare options**
+- Brainstorm multiple approaches
+- Build comparison tables
+- Sketch tradeoffs
+- Recommend a path (if asked)
+
+**Visualize**
+```
+┌─────────────────────────────────────────┐
+│     Use ASCII diagrams liberally        │
+├─────────────────────────────────────────┤
+│                                         │
+│      ┌────────┐         ┌────────┐      │
+│      │ State  │────────▶│ State  │      │
+│      │   A    │         │   B    │      │
+│      └────────┘         └────────┘      │
+│                                         │
+│   System diagrams, state machines,      │
+│   data flows, architecture sketches,    │
+│   dependency graphs, comparison tables  │
+│                                         │
+└─────────────────────────────────────────┘
+```
+
+**Surface risks and unknowns**
+- Identify what could go wrong
+- Find gaps in understanding
+- Suggest spikes or investigations
+
+---
+
+## OpenSpec Awareness
+
+You have full context of the OpenSpec system. Use it naturally, don't force it.
+
+### Check for context
+
+At the start, quickly check what exists:
+```bash
+openspec list --json
+```
+
+This tells you:
+- If there are active changes
+- Their names, schemas, and status
+- What the user might be working on
+
+### When no change exists
+
+Think freely. When insights crystallize, you might offer:
+
+- "This feels solid enough to start a change. Want me to create a proposal?"
+- Or keep exploring - no pressure to formalize
+
+### When a change exists
+
+If the user mentions a change or you detect one is relevant:
+
+1. **Resolve and read existing artifacts for context**
+   - Run `openspec status --change "<name>" --json`.
+   - Use `changeRoot`, `artifactPaths`, and `actionContext` from the status JSON.
+   - Read existing files from `artifactPaths.<artifact>.existingOutputPaths`.
+
+2. **Reference them naturally in conversation**
+   - "Your design mentions using Redis, but we just realized SQLite fits better..."
+   - "The proposal scopes this to premium users, but we're now thinking everyone..."
+
+3. **Offer to capture when decisions are made**
+
+    | Insight Type               | Where to Capture               |
+    |----------------------------|--------------------------------|
+    | New requirement discovered | `specs/<capability>/spec.md` |
+    | Requirement changed        | `specs/<capability>/spec.md` |
+    | Design decision made       | `design.md`                  |
+    | Scope changed              | `proposal.md`                |
+    | New work identified        | `tasks.md`                   |
+    | Assumption invalidated     | Relevant artifact              |
+
+   Example offers:
+   - "That's a design decision. Capture it in design.md?"
+   - "This is a new requirement. Add it to specs?"
+   - "This changes scope. Update the proposal?"
+
+4. **The user decides** - Offer and move on. Don't pressure. Don't auto-capture.
+
+---
+
+## What You Don't Have To Do
+
+- Follow a script
+- Ask the same questions every time
+- Produce a specific artifact
+- Reach a conclusion
+- Stay on topic if a tangent is valuable
+- Be brief (this is thinking time)
+
+---
+
+## Handling Different Entry Points
+
+**User brings a vague idea:**
+```
+User: I'm thinking about adding real-time collaboration
+
+You: Real-time collab is a big space. Let me think about this...
+
+      COLLABORATION SPECTRUM
+      ════════════════════════════════════════════
+
+      Awareness          Coordination         Sync
+          │                   │                 │
+          ▼                   ▼                 ▼
+      ┌────────┐         ┌────────┐        ┌────────┐
+      │Presence│         │Cursors │        │  CRDT  │
+      │  "3    │         │ Multi  │        │Conflict│
+      │online" │         │ select │        │  free  │
+      └────────┘         └────────┘        └────────┘
+          │                   │                 │
+       trivial            moderate           complex
+
+      Where's your head at?
+```
+
+**User brings a specific problem:**
+```
+User: The auth system is a mess
+
+You: [reads codebase]
+
+     ┌─────────────────────────────────────────────┐
+     │              CURRENT AUTH FLOW              │
+     └─────────────────────────────────────────────┘
+                        │
+          ┌─────────────┼─────────────┐
+          ▼             ▼             ▼
+     ┌─────────┐  ┌─────────┐  ┌─────────┐
+     │ Google  │  │  GitHub │  │  Email  │
+     │  OAuth  │  │  OAuth  │  │  Magic  │
+     └────┬────┘  └────┬────┘  └────┬────┘
+          │             │             │
+          └─────────────┼─────────────┘
+                        ▼
+                  ┌───────────┐
+                  │  Session  │
+                  └─────┬─────┘
+                        │
+                        ▼
+                  ┌───────────┐
+                  │   Perms   │
+                  └───────────┘
+
+     I see three tangles. Which one's burning?
+```
+
+**User is stuck mid-implementation:**
+```
+User: /opsx:explore add-auth-system
+      The OAuth integration is more complex than expected
+
+You: [reads change artifacts]
+
+     You're on task 4: "Implement OAuth flow"
+
+     Let me trace what's involved...
+
+     [draws diagram, explores options, suggests paths]
+
+     Want to update the design to reflect this?
+     Or add a spike task to investigate?
+```
+
+**User wants to compare options:**
+```
+User: Should we use Postgres or SQLite?
+
+You: Generic answer is boring. What's the context?
+
+User: A CLI tool that tracks local dev environments
+
+You: That changes everything.
+
+     ┌─────────────────────────────────────────────────┐
+     │          CLI TOOL DATA STORAGE                  │
+     └─────────────────────────────────────────────────┘
+
+     Key constraints:
+     • No daemon running
+     • Must work offline
+     • Single user
+
+                  SQLite          Postgres
+     Deployment   embedded ✓      needs server ✗
+     Offline      yes ✓           no ✗
+     Single file  yes ✓           no ✗
+
+     SQLite. Not even close.
+
+     Unless... is there a sync component?
+```
+
+---
+
+## Ending Discovery
+
+There's no required ending. Discovery might:
+
+- **Flow into a proposal**: "Ready to start? I can create a change proposal."
+- **Result in artifact updates**: "Updated design.md with these decisions"
+- **Just provide clarity**: User has what they need, moves on
+- **Continue later**: "We can pick this up anytime"
+
+When it feels like things are crystallizing, you might summarize:
+
+```
+## What We Figured Out
+
+**The problem**: [crystallized understanding]
+
+**The approach**: [if one emerged]
+
+**Open questions**: [if any remain]
+
+**Next steps** (if ready):
+- Create a change proposal
+- Keep exploring: just keep talking
+```
+
+But this summary is optional. Sometimes the thinking IS the value.
+
+---
+
+## Guardrails
+
+- **Don't implement** - Never write code or implement features. Creating OpenSpec artifacts is fine, writing application code is not.
+- **Don't fake understanding** - If something is unclear, dig deeper
+- **Don't rush** - Discovery is thinking time, not task time
+- **Don't force structure** - Let patterns emerge naturally
+- **Don't auto-capture** - Offer to save insights, don't just do it
+- **Do visualize** - A good diagram is worth many paragraphs
+- **Do explore the codebase** - Ground discussions in reality
+- **Do question assumptions** - Including the user's and your own
diff --git a/.kimi/skills/openspec-ff-change/SKILL.md b/.kimi/skills/openspec-ff-change/SKILL.md
new file mode 100644
index 000000000..61fab93de
--- /dev/null
+++ b/.kimi/skills/openspec-ff-change/SKILL.md
@@ -0,0 +1,105 @@
+---
+name: openspec-ff-change
+description: Fast-forward through OpenSpec artifact creation. Use when the user wants to quickly create all artifacts needed for implementation without stepping through each one individually.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Fast-forward through artifact creation - generate everything needed to start implementation in one go.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: The user's request should include a change name (kebab-case) OR a description of what they want to build.
+
+**Steps**
+
+1. **If no clear input provided, ask what they want to build**
+
+   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
+   > "What change do you want to work on? Describe what you want to build or fix."
+
+   From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
+
+   **IMPORTANT**: Do NOT proceed without understanding what the user wants to build.
+
+2. **Create the change directory**
+   ```bash
+   openspec new change "<name>"
+   ```
+   This creates a scaffolded change in the planning home resolved by the CLI.
+
+3. **Get the artifact build order**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to get:
+   - `applyRequires`: array of artifact IDs needed before implementation (e.g., `["tasks"]`)
+   - `artifacts`: list of all artifacts with their status and dependencies
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context. Use these instead of assuming repo-local paths.
+
+4. **Create artifacts in sequence until apply-ready**
+
+   Use the **TodoWrite tool** to track progress through the artifacts.
+
+   Loop through artifacts in dependency order (artifacts with no pending dependencies first):
+
+   a. **For each artifact that is `ready` (dependencies satisfied)**:
+      - Get instructions:
+        ```bash
+        openspec instructions <artifact-id> --change "<name>" --json
+        ```
+      - The instructions JSON includes:
+        - `context`: Project background (constraints for you - do NOT include in output)
+        - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
+        - `template`: The structure to use for your output file
+        - `instruction`: Schema-specific guidance for this artifact type
+        - `resolvedOutputPath`: Resolved path or pattern to write the artifact
+        - `dependencies`: Completed artifacts to read for context
+      - Read any completed dependency files for context
+      - Create the artifact file using `template` as the structure and write it to `resolvedOutputPath`
+      - Apply `context` and `rules` as constraints - but do NOT copy them into the file
+      - Show brief progress: "✓ Created <artifact-id>"
+
+   b. **Continue until all `applyRequires` artifacts are complete**
+      - After creating each artifact, re-run `openspec status --change "<name>" --json`
+      - Check if every artifact ID in `applyRequires` has `status: "done"` in the artifacts array
+      - Stop when all `applyRequires` artifacts are done
+
+   c. **If an artifact requires user input** (unclear context):
+      - Use **AskUserQuestion tool** to clarify
+      - Then continue with creation
+
+5. **Show final status**
+   ```bash
+   openspec status --change "<name>"
+   ```
+
+**Output**
+
+After completing all artifacts, summarize:
+- Change name and location
+- List of artifacts created with brief descriptions
+- What's ready: "All artifacts created! Ready for implementation."
+- Prompt: "Run `/opsx:apply` or ask me to implement to start working on the tasks."
+
+**Artifact Creation Guidelines**
+
+- Follow the `instruction` field from `openspec instructions` for each artifact type
+- The schema defines what each artifact should contain - follow it
+- Read dependency artifacts for context before creating new ones
+- Use `template` as the structure for your output file - fill in its sections
+- **IMPORTANT**: `context` and `rules` are constraints for YOU, not content for the file
+  - Do NOT copy `<context>`, `<rules>`, `<project_context>` blocks into the artifact
+  - These guide what you write, but should never appear in the output
+
+**Guardrails**
+- Create ALL artifacts needed for implementation (as defined by schema's `apply.requires`)
+- Always read dependency artifacts before creating a new one
+- If context is critically unclear, ask the user - but prefer making reasonable decisions to keep momentum
+- If a change with that name already exists, suggest continuing that change instead
+- Verify each artifact file exists after writing before proceeding to next
diff --git a/.kimi/skills/openspec-new-change/SKILL.md b/.kimi/skills/openspec-new-change/SKILL.md
new file mode 100644
index 000000000..b4d8a9e70
--- /dev/null
+++ b/.kimi/skills/openspec-new-change/SKILL.md
@@ -0,0 +1,77 @@
+---
+name: openspec-new-change
+description: Start a new OpenSpec change using the experimental artifact workflow. Use when the user wants to create a new feature, fix, or modification with a structured step-by-step approach.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Start a new change using the experimental artifact-driven approach.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: The user's request should include a change name (kebab-case) OR a description of what they want to build.
+
+**Steps**
+
+1. **If no clear input provided, ask what they want to build**
+
+   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
+   > "What change do you want to work on? Describe what you want to build or fix."
+
+   From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
+
+   **IMPORTANT**: Do NOT proceed without understanding what the user wants to build.
+
+2. **Determine the workflow schema**
+
+   Use the default schema (omit `--schema`) unless the user explicitly requests a different workflow.
+
+   **Use a different schema only if the user mentions:**
+   - A specific schema name → use `--schema <name>`
+   - "show workflows" or "what workflows" → run `openspec schemas --json` and let them choose
+
+   **Otherwise**: Omit `--schema` to use the default.
+
+3. **Create the change directory**
+   ```bash
+   openspec new change "<name>"
+   ```
+   Add `--schema <name>` only if the user requested a specific workflow.
+   This creates a scaffolded change in the planning home resolved by the CLI.
+
+4. **Show the artifact status**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Use the returned `planningHome`, `changeRoot`, `artifactPaths`, and `nextSteps` instead of assuming repo-local paths.
+
+5. **Get instructions for the first artifact**
+   The first artifact depends on the schema (e.g., `proposal` for spec-driven).
+   Check the status output to find the first artifact with status "ready".
+   ```bash
+   openspec instructions <first-artifact-id> --change "<name>"
+   ```
+   This outputs the template and context for creating the first artifact.
+
+6. **STOP and wait for user direction**
+
+**Output**
+
+After completing the steps, summarize:
+- Change name and location
+- Schema/workflow being used and its artifact sequence
+- Current status (0/N artifacts complete)
+- The template for the first artifact
+- Prompt: "Ready to create the first artifact? Just describe what this change is about and I'll draft it, or ask me to continue."
+
+**Guardrails**
+- Do NOT create any artifacts yet - just show the instructions
+- Do NOT advance beyond showing the first artifact template
+- If the name is invalid (not kebab-case), ask for a valid name
+- If a change with that name already exists, suggest continuing that change instead
+- Pass --schema if using a non-default workflow
diff --git a/.kimi/skills/openspec-onboard/SKILL.md b/.kimi/skills/openspec-onboard/SKILL.md
new file mode 100644
index 000000000..ac4ac6fee
--- /dev/null
+++ b/.kimi/skills/openspec-onboard/SKILL.md
@@ -0,0 +1,555 @@
+---
+name: openspec-onboard
+description: Guided onboarding for OpenSpec - walk through a complete workflow cycle with narration and real codebase work.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Guide the user through their first complete OpenSpec workflow cycle. This is a teaching experience—you'll do real work in their codebase while explaining each step.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+---
+
+## Preflight
+
+Before starting, check if the OpenSpec CLI is installed:
+
+```bash
+# Unix/macOS
+openspec --version 2>&1 || echo "CLI_NOT_INSTALLED"
+# Windows (PowerShell)
+# if (Get-Command openspec -ErrorAction SilentlyContinue) { openspec --version } else { echo "CLI_NOT_INSTALLED" }
+```
+
+**If CLI not installed:**
+> OpenSpec CLI is not installed. Install it first, then come back to `/opsx:onboard`.
+
+Stop here if not installed.
+
+---
+
+## Phase 1: Welcome
+
+Display:
+
+```
+## Welcome to OpenSpec!
+
+I'll walk you through a complete change cycle—from idea to implementation—using a real task in your codebase. Along the way, you'll learn the workflow by doing it.
+
+**What we'll do:**
+1. Pick a small, real task in your codebase
+2. Explore the problem briefly
+3. Create a change (the container for our work)
+4. Build the artifacts: proposal → specs → design → tasks
+5. Implement the tasks
+6. Archive the completed change
+
+**Time:** ~15-20 minutes
+
+Let's start by finding something to work on.
+```
+
+---
+
+## Phase 2: Task Selection
+
+### Codebase Analysis
+
+Scan the codebase for small improvement opportunities. Look for:
+
+1. **TODO/FIXME comments** - Search for `TODO`, `FIXME`, `HACK`, `XXX` in code files
+2. **Missing error handling** - `catch` blocks that swallow errors, risky operations without try-catch
+3. **Functions without tests** - Cross-reference `src/` with test directories
+4. **Type issues** - `any` types in TypeScript files (`: any`, `as any`)
+5. **Debug artifacts** - `console.log`, `console.debug`, `debugger` statements in non-debug code
+6. **Missing validation** - User input handlers without validation
+
+Also check recent git activity:
+```bash
+# Unix/macOS
+git log --oneline -10 2>/dev/null || echo "No git history"
+# Windows (PowerShell)
+# git log --oneline -10 2>$null; if ($LASTEXITCODE -ne 0) { echo "No git history" }
+```
+
+### Present Suggestions
+
+From your analysis, present 3-4 specific suggestions:
+
+```
+## Task Suggestions
+
+Based on scanning your codebase, here are some good starter tasks:
+
+**1. [Most promising task]**
+   Location: `src/path/to/file.ts:42`
+   Scope: ~1-2 files, ~20-30 lines
+   Why it's good: [brief reason]
+
+**2. [Second task]**
+   Location: `src/another/file.ts`
+   Scope: ~1 file, ~15 lines
+   Why it's good: [brief reason]
+
+**3. [Third task]**
+   Location: [location]
+   Scope: [estimate]
+   Why it's good: [brief reason]
+
+**4. Something else?**
+   Tell me what you'd like to work on.
+
+Which task interests you? (Pick a number or describe your own)
+```
+
+**If nothing found:** Fall back to asking what the user wants to build:
+> I didn't find obvious quick wins in your codebase. What's something small you've been meaning to add or fix?
+
+### Scope Guardrail
+
+If the user picks or describes something too large (major feature, multi-day work):
+
+```
+That's a valuable task, but it's probably larger than ideal for your first OpenSpec run-through.
+
+For learning the workflow, smaller is better—it lets you see the full cycle without getting stuck in implementation details.
+
+**Options:**
+1. **Slice it smaller** - What's the smallest useful piece of [their task]? Maybe just [specific slice]?
+2. **Pick something else** - One of the other suggestions, or a different small task?
+3. **Do it anyway** - If you really want to tackle this, we can. Just know it'll take longer.
+
+What would you prefer?
+```
+
+Let the user override if they insist—this is a soft guardrail.
+
+---
+
+## Phase 3: Explore Demo
+
+Once a task is selected, briefly demonstrate explore mode:
+
+```
+Before we create a change, let me quickly show you **explore mode**—it's how you think through problems before committing to a direction.
+```
+
+Spend 1-2 minutes investigating the relevant code:
+- Read the file(s) involved
+- Draw a quick ASCII diagram if it helps
+- Note any considerations
+
+```
+## Quick Exploration
+
+[Your brief analysis—what you found, any considerations]
+
+┌─────────────────────────────────────────┐
+│   [Optional: ASCII diagram if helpful]  │
+└─────────────────────────────────────────┘
+
+Explore mode (`/opsx:explore`) is for this kind of thinking—investigating before implementing. You can use it anytime you need to think through a problem.
+
+Now let's create a change to hold our work.
+```
+
+**PAUSE** - Wait for user acknowledgment before proceeding.
+
+---
+
+## Phase 4: Create the Change
+
+**EXPLAIN:**
+```
+## Creating a Change
+
+A "change" in OpenSpec is a container for all the thinking and planning around a piece of work. It lives at the `changeRoot` reported by `openspec status --change "<name>" --json` and holds your artifacts—proposal, specs, design, tasks.
+
+Let me create one for our task.
+```
+
+**DO:** Create the change with a derived kebab-case name:
+```bash
+openspec new change "<derived-name>"
+```
+
+**SHOW:**
+```
+Created: <changeRoot from status JSON>
+
+The folder structure:
+```
+<changeRoot>/
+├── proposal.md    ← Why we're doing this (empty, we'll fill it)
+├── design.md      ← How we'll build it (empty)
+├── specs/         ← Detailed requirements (empty)
+└── tasks.md       ← Implementation checklist (empty)
+```
+
+Now let's fill in the first artifact—the proposal.
+```
+
+---
+
+## Phase 5: Proposal
+
+**EXPLAIN:**
+```
+## The Proposal
+
+The proposal captures **why** we're making this change and **what** it involves at a high level. It's the "elevator pitch" for the work.
+
+I'll draft one based on our task.
+```
+
+**DO:** Draft the proposal content (don't save yet):
+
+```
+Here's a draft proposal:
+
+---
+
+## Why
+
+[1-2 sentences explaining the problem/opportunity]
+
+## What Changes
+
+[Bullet points of what will be different]
+
+## Capabilities
+
+### New Capabilities
+- `<capability-name>`: [brief description]
+
+### Modified Capabilities
+<!-- If modifying existing behavior -->
+
+## Impact
+
+- `src/path/to/file.ts`: [what changes]
+- [other files if applicable]
+
+---
+
+Does this capture the intent? I can adjust before we save it.
+```
+
+**PAUSE** - Wait for user approval/feedback.
+
+After approval, save the proposal:
+```bash
+openspec instructions proposal --change "<name>" --json
+```
+Then write the content to the `resolvedOutputPath` from `openspec instructions proposal --change "<name>" --json`.
+
+```
+Proposal saved. This is your "why" document—you can always come back and refine it as understanding evolves.
+
+Next up: specs.
+```
+
+---
+
+## Phase 6: Specs
+
+**EXPLAIN:**
+```
+## Specs
+
+Specs define **what** we're building in precise, testable terms. They use a requirement/scenario format that makes expected behavior crystal clear.
+
+For a small task like this, we might only need one spec file.
+```
+
+**DO:** Resolve where the spec file should be created:
+```bash
+openspec instructions specs --change "<name>" --json
+# Use resolvedOutputPath from the JSON. If it is a glob, choose the concrete file path using the schema instruction and the change's context.
+```
+
+Draft the spec content:
+
+```
+Here's the spec:
+
+---
+
+## ADDED Requirements
+
+### Requirement: <Name>
+
+<Description of what the system should do>
+
+#### Scenario: <Scenario name>
+
+- **WHEN** <trigger condition>
+- **THEN** <expected outcome>
+- **AND** <additional outcome if needed>
+
+---
+
+This format—WHEN/THEN/AND—makes requirements testable. You can literally read them as test cases.
+```
+
+Save to the concrete file path chosen from `resolvedOutputPath`.
+
+---
+
+## Phase 7: Design
+
+**EXPLAIN:**
+```
+## Design
+
+The design captures **how** we'll build it—technical decisions, tradeoffs, approach.
+
+For small changes, this might be brief. That's fine—not every change needs deep design discussion.
+```
+
+**DO:** Draft design.md:
+
+```
+Here's the design:
+
+---
+
+## Context
+
+[Brief context about the current state]
+
+## Goals / Non-Goals
+
+**Goals:**
+- [What we're trying to achieve]
+
+**Non-Goals:**
+- [What's explicitly out of scope]
+
+## Decisions
+
+### Decision 1: [Key decision]
+
+[Explanation of approach and rationale]
+
+---
+
+For a small task, this captures the key decisions without over-engineering.
+```
+
+Save to the `resolvedOutputPath` from `openspec instructions design --change "<name>" --json`.
+
+---
+
+## Phase 8: Tasks
+
+**EXPLAIN:**
+```
+## Tasks
+
+Finally, we break the work into implementation tasks—checkboxes that drive the apply phase.
+
+These should be small, clear, and in logical order.
+```
+
+**DO:** Generate tasks based on specs and design:
+
+```
+Here are the implementation tasks:
+
+---
+
+## 1. [Category or file]
+
+- [ ] 1.1 [Specific task]
+- [ ] 1.2 [Specific task]
+
+## 2. Verify
+
+- [ ] 2.1 [Verification step]
+
+---
+
+Each checkbox becomes a unit of work in the apply phase. Ready to implement?
+```
+
+**PAUSE** - Wait for user to confirm they're ready to implement.
+
+Save to the `resolvedOutputPath` from `openspec instructions tasks --change "<name>" --json`.
+
+---
+
+## Phase 9: Apply (Implementation)
+
+**EXPLAIN:**
+```
+## Implementation
+
+Now we implement each task, checking them off as we go. I'll announce each one and occasionally note how the specs/design informed the approach.
+```
+
+**DO:** For each task:
+
+1. Announce: "Working on task N: [description]"
+2. Implement the change in the codebase
+3. Reference specs/design naturally: "The spec says X, so I'm doing Y"
+4. Mark complete in tasks.md: `- [ ]` → `- [x]`
+5. Brief status: "✓ Task N complete"
+
+Keep narration light—don't over-explain every line of code.
+
+After all tasks:
+
+```
+## Implementation Complete
+
+All tasks done:
+- [x] Task 1
+- [x] Task 2
+- [x] ...
+
+The change is implemented! One more step—let's archive it.
+```
+
+---
+
+## Phase 10: Archive
+
+**EXPLAIN:**
+```
+## Archiving
+
+When a change is complete, we archive it. The archive path is derived from `planningHome.changesDir` and the date.
+
+Archived changes become your project's decision history—you can always find them later to understand why something was built a certain way.
+```
+
+**DO:**
+```bash
+openspec archive "<name>"
+```
+
+**SHOW:**
+```
+Archived to: `<planningHome.changesDir>/archive/YYYY-MM-DD-<name>/`
+
+The change is now part of your project's history. The code is in your codebase, the decision record is preserved.
+```
+
+---
+
+## Phase 11: Recap & Next Steps
+
+```
+## Congratulations!
+
+You just completed a full OpenSpec cycle:
+
+1. **Explore** - Thought through the problem
+2. **New** - Created a change container
+3. **Proposal** - Captured WHY
+4. **Specs** - Defined WHAT in detail
+5. **Design** - Decided HOW
+6. **Tasks** - Broke it into steps
+7. **Apply** - Implemented the work
+8. **Archive** - Preserved the record
+
+This same rhythm works for any size change—a small fix or a major feature.
+
+---
+
+## Command Reference
+
+**Core workflow:**
+
+ | Command           | What it does                               |
+ |-------------------|--------------------------------------------|
+ | `/opsx:propose` | Create a change and generate all artifacts |
+ | `/opsx:explore` | Think through problems before/during work  |
+ | `/opsx:apply`   | Implement tasks from a change              |
+ | `/opsx:archive` | Archive a completed change                 |
+
+**Additional commands:**
+
+ | Command            | What it does                                             |
+ |--------------------|----------------------------------------------------------|
+ | `/opsx:new`      | Start a new change, step through artifacts one at a time |
+ | `/opsx:continue` | Continue working on an existing change                   |
+ | `/opsx:ff`       | Fast-forward: create all artifacts at once               |
+ | `/opsx:verify`   | Verify implementation matches artifacts                  |
+
+---
+
+## What's Next?
+
+Try `/opsx:propose` on something you actually want to build. You've got the rhythm now!
+```
+
+---
+
+## Graceful Exit Handling
+
+### User wants to stop mid-way
+
+If the user says they need to stop, want to pause, or seem disengaged:
+
+```
+No problem! Your change is saved at the `changeRoot` reported by `openspec status --change "<name>" --json`.
+
+To pick up where we left off later:
+- `/opsx:continue <name>` - Resume artifact creation
+- `/opsx:apply <name>` - Jump to implementation (if tasks exist)
+
+The work won't be lost. Come back whenever you're ready.
+```
+
+Exit gracefully without pressure.
+
+### User just wants command reference
+
+If the user says they just want to see the commands or skip the tutorial:
+
+```
+## OpenSpec Quick Reference
+
+**Core workflow:**
+
+ | Command                  | What it does                               |
+ |--------------------------|--------------------------------------------|
+ | `/opsx:propose <name>` | Create a change and generate all artifacts |
+ | `/opsx:explore`        | Think through problems (no code changes)   |
+ | `/opsx:apply <name>`   | Implement tasks                            |
+ | `/opsx:archive <name>` | Archive when done                          |
+
+**Additional commands:**
+
+ | Command                   | What it does                        |
+ |---------------------------|-------------------------------------|
+ | `/opsx:new <name>`      | Start a new change, step by step    |
+ | `/opsx:continue <name>` | Continue an existing change         |
+ | `/opsx:ff <name>`       | Fast-forward: all artifacts at once |
+ | `/opsx:verify <name>`   | Verify implementation               |
+
+Try `/opsx:propose` to start your first change.
+```
+
+Exit gracefully.
+
+---
+
+## Guardrails
+
+- **Follow the EXPLAIN → DO → SHOW → PAUSE pattern** at key transitions (after explore, after proposal draft, after tasks, after archive)
+- **Keep narration light** during implementation—teach without lecturing
+- **Don't skip phases** even if the change is small—the goal is teaching the workflow
+- **Pause for acknowledgment** at marked points, but don't over-pause
+- **Handle exits gracefully**—never pressure the user to continue
+- **Use real codebase tasks**—don't simulate or use fake examples
+- **Adjust scope gently**—guide toward smaller tasks but respect user choice
diff --git a/.kimi/skills/openspec-sync-specs/SKILL.md b/.kimi/skills/openspec-sync-specs/SKILL.md
new file mode 100644
index 000000000..b6aad67ab
--- /dev/null
+++ b/.kimi/skills/openspec-sync-specs/SKILL.md
@@ -0,0 +1,148 @@
+---
+name: openspec-sync-specs
+description: Sync delta specs from a change to main specs. Use when the user wants to update main specs with changes from a delta spec, without archiving the change.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Sync delta specs from a change to main specs.
+
+This is an **agent-driven** operation - you will read delta specs and directly edit main specs to apply the changes. This allows intelligent merging (e.g., adding a scenario without copying the entire requirement).
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show changes that have delta specs (under `specs/` directory).
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Resolve change context**
+
+   Run:
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+
+3. **Find delta specs**
+
+   Use `artifactPaths.specs.existingOutputPaths` from the status JSON as the list of delta spec files.
+
+   Each delta spec file contains sections like:
+   - `## ADDED Requirements` - New requirements to add
+   - `## MODIFIED Requirements` - Changes to existing requirements
+   - `## REMOVED Requirements` - Requirements to remove
+   - `## RENAMED Requirements` - Requirements to rename (FROM:/TO: format)
+
+   If no delta specs found, inform user and stop.
+
+4. **For each delta spec, apply changes to main specs**
+
+   For each repo-local capability delta spec path returned by the CLI:
+
+   a. **Read the delta spec** to understand the intended changes
+
+   b. **Read the main spec** at `openspec/specs/<capability>/spec.md` (may not exist yet)
+
+   c. **Apply changes intelligently**:
+
+      **ADDED Requirements:**
+      - If requirement doesn't exist in main spec → add it
+      - If requirement already exists → update it to match (treat as implicit MODIFIED)
+
+      **MODIFIED Requirements:**
+      - Find the requirement in main spec
+      - Apply the changes - this can be:
+        - Adding new scenarios (don't need to copy existing ones)
+        - Modifying existing scenarios
+        - Changing the requirement description
+      - Preserve scenarios/content not mentioned in the delta
+
+      **REMOVED Requirements:**
+      - Remove the entire requirement block from main spec
+
+      **RENAMED Requirements:**
+      - Find the FROM requirement, rename to TO
+
+   d. **Create new main spec** if capability doesn't exist yet:
+      - Create `openspec/specs/<capability>/spec.md`
+      - Add Purpose section (can be brief, mark as TBD)
+      - Add Requirements section with the ADDED requirements
+
+5. **Show summary**
+
+   After applying all changes, summarize:
+   - Which capabilities were updated
+   - What changes were made (requirements added/modified/removed/renamed)
+
+**Delta Spec Format Reference**
+
+```markdown
+## ADDED Requirements
+
+### Requirement: New Feature
+The system SHALL do something new.
+
+#### Scenario: Basic case
+- **WHEN** user does X
+- **THEN** system does Y
+
+## MODIFIED Requirements
+
+### Requirement: Existing Feature
+#### Scenario: New scenario to add
+- **WHEN** user does A
+- **THEN** system does B
+
+## REMOVED Requirements
+
+### Requirement: Deprecated Feature
+
+## RENAMED Requirements
+
+- FROM: `### Requirement: Old Name`
+- TO: `### Requirement: New Name`
+```
+
+**Key Principle: Intelligent Merging**
+
+Unlike programmatic merging, you can apply **partial updates**:
+- To add a scenario, just include that scenario under MODIFIED - don't copy existing scenarios
+- The delta represents *intent*, not a wholesale replacement
+- Use your judgment to merge changes sensibly
+
+**Output On Success**
+
+```
+## Specs Synced: <change-name>
+
+Updated main specs:
+
+**<capability-1>**:
+- Added requirement: "New Feature"
+- Modified requirement: "Existing Feature" (added 1 scenario)
+
+**<capability-2>**:
+- Created new spec file
+- Added requirement: "Another Feature"
+
+Main specs are now updated. The change remains active - archive when implementation is complete.
+```
+
+**Guardrails**
+- Read both delta and main specs before making changes
+- Preserve existing content not mentioned in delta
+- If something is unclear, ask for clarification
+- Show what you're changing as you go
+- The operation should be idempotent - running twice should give same result
diff --git a/.kimi/skills/openspec-verify-change/SKILL.md b/.kimi/skills/openspec-verify-change/SKILL.md
new file mode 100644
index 000000000..b6557c6ff
--- /dev/null
+++ b/.kimi/skills/openspec-verify-change/SKILL.md
@@ -0,0 +1,172 @@
+---
+name: openspec-verify-change
+description: Verify implementation matches change artifacts. Use when the user wants to validate that implementation is complete, correct, and coherent before archiving.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Verify that an implementation matches the change artifacts (specs, tasks, design).
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show changes that have implementation tasks (tasks artifact exists).
+   Include the schema used for each change if available.
+   Mark changes with incomplete tasks as "(In Progress)".
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Check status to understand the schema**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used (e.g., "spec-driven")
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context
+   - Which artifacts exist for this change
+
+3. **Get planning context and load artifacts**
+
+   ```bash
+   openspec instructions apply --change "<name>" --json
+   ```
+
+   This returns the change directory and `contextFiles` (artifact ID -> array of concrete file paths). Read all available artifacts from `contextFiles`.
+
+4. **Initialize verification report structure**
+
+   Create a report structure with three dimensions:
+   - **Completeness**: Track tasks and spec coverage
+   - **Correctness**: Track requirement implementation and scenario coverage
+   - **Coherence**: Track design adherence and pattern consistency
+
+   Each dimension can have CRITICAL, WARNING, or SUGGESTION issues.
+
+5. **Verify Completeness**
+
+   **Task Completion**:
+   - If `contextFiles.tasks` exists, read every file path in it
+   - Parse checkboxes: `- [ ]` (incomplete) vs `- [x]` (complete)
+   - Count complete vs total tasks
+   - If incomplete tasks exist:
+     - Add CRITICAL issue for each incomplete task
+     - Recommendation: "Complete task: <description>" or "Mark as done if already implemented"
+
+   **Spec Coverage**:
+   - If delta specs exist in `contextFiles.specs`:
+     - Extract all requirements (marked with "### Requirement:")
+     - For each requirement:
+       - Search codebase for keywords related to the requirement
+       - Assess if implementation likely exists
+     - If requirements appear unimplemented:
+       - Add CRITICAL issue: "Requirement not found: <requirement name>"
+       - Recommendation: "Implement requirement X: <description>"
+
+6. **Verify Correctness**
+
+   **Requirement Implementation Mapping**:
+   - For each requirement from delta specs:
+     - Search codebase for implementation evidence
+     - If found, note file paths and line ranges
+     - Assess if implementation matches requirement intent
+     - If divergence detected:
+       - Add WARNING: "Implementation may diverge from spec: <details>"
+       - Recommendation: "Review <file>:<lines> against requirement X"
+
+   **Scenario Coverage**:
+   - For each scenario in delta specs (marked with "#### Scenario:"):
+     - Check if conditions are handled in code
+     - Check if tests exist covering the scenario
+     - If scenario appears uncovered:
+       - Add WARNING: "Scenario not covered: <scenario name>"
+       - Recommendation: "Add test or implementation for scenario: <description>"
+
+7. **Verify Coherence**
+
+   **Design Adherence**:
+   - If `contextFiles.design` exists:
+     - Extract key decisions (look for sections like "Decision:", "Approach:", "Architecture:")
+     - Verify implementation follows those decisions
+     - If contradiction detected:
+       - Add WARNING: "Design decision not followed: <decision>"
+       - Recommendation: "Update implementation or revise design.md to match reality"
+   - If no design.md: Skip design adherence check, note "No design.md to verify against"
+
+   **Code Pattern Consistency**:
+   - Review new code for consistency with project patterns
+   - Check file naming, directory structure, coding style
+   - If significant deviations found:
+     - Add SUGGESTION: "Code pattern deviation: <details>"
+     - Recommendation: "Consider following project pattern: <example>"
+
+8. **Generate Verification Report**
+
+   **Summary Scorecard**:
+   ```
+   ## Verification Report: <change-name>
+
+   ### Summary
+   | Dimension    | Status           |
+   |--------------|------------------|
+   | Completeness | X/Y tasks, N reqs|
+   | Correctness  | M/N reqs covered |
+   | Coherence    | Followed/Issues  |
+   ```
+
+   **Issues by Priority**:
+
+   1. **CRITICAL** (Must fix before archive):
+      - Incomplete tasks
+      - Missing requirement implementations
+      - Each with specific, actionable recommendation
+
+   2. **WARNING** (Should fix):
+      - Spec/design divergences
+      - Missing scenario coverage
+      - Each with specific recommendation
+
+   3. **SUGGESTION** (Nice to fix):
+      - Pattern inconsistencies
+      - Minor improvements
+      - Each with specific recommendation
+
+   **Final Assessment**:
+   - If CRITICAL issues: "X critical issue(s) found. Fix before archiving."
+   - If only warnings: "No critical issues. Y warning(s) to consider. Ready for archive (with noted improvements)."
+   - If all clear: "All checks passed. Ready for archive."
+
+**Verification Heuristics**
+
+- **Completeness**: Focus on objective checklist items (checkboxes, requirements list)
+- **Correctness**: Use keyword search, file path analysis, reasonable inference - don't require perfect certainty
+- **Coherence**: Look for glaring inconsistencies, don't nitpick style
+- **False Positives**: When uncertain, prefer SUGGESTION over WARNING, WARNING over CRITICAL
+- **Actionability**: Every issue must have a specific recommendation with file/line references where applicable
+
+**Graceful Degradation**
+
+- If only tasks.md exists: verify task completion only, skip spec/design checks
+- If tasks + specs exist: verify completeness and correctness, skip design
+- If full artifacts: verify all three dimensions
+- Always note which checks were skipped and why
+
+**Output Format**
+
+Use clear markdown with:
+- Table for summary scorecard
+- Grouped lists for issues (CRITICAL/WARNING/SUGGESTION)
+- Code references in format: `file.ts:123`
+- Specific, actionable recommendations
+- No vague suggestions like "consider reviewing"
diff --git a/.opencode/commands/opsx-apply.md b/.opencode/commands/opsx-apply.md
new file mode 100644
index 000000000..f5c574ffa
--- /dev/null
+++ b/.opencode/commands/opsx-apply.md
@@ -0,0 +1,152 @@
+---
+description: Implement tasks from an OpenSpec change (Experimental)
+---
+
+Implement tasks from an OpenSpec change.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name (e.g., `/opsx-apply add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **Select the change**
+
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes and use the **AskUserQuestion tool** to let the user select
+
+   Always announce: "Using change: <name>" and how to override (e.g., `/opsx-apply <other>`).
+
+2. **Check status to understand the schema**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used (e.g., "spec-driven")
+   - `planningHome`, `changeRoot`, and `actionContext`: planning scope and edit constraints
+   - Which artifact contains the tasks (typically "tasks" for spec-driven, check status for others)
+
+3. **Get apply instructions**
+
+   ```bash
+   openspec instructions apply --change "<name>" --json
+   ```
+
+   This returns:
+   - `contextFiles`: artifact ID -> array of concrete file paths (varies by schema)
+   - Progress (total, complete, remaining)
+   - Task list with status
+   - Dynamic instruction based on current state
+
+   **Handle states:**
+   - If `state: "blocked"` (missing artifacts): show message, suggest using `/opsx-continue`
+   - If `state: "all_done"`: congratulate, suggest archive
+   - Otherwise: proceed to implementation
+
+4. **Read context files**
+
+   Read every file path listed under `contextFiles` from the apply instructions output.
+   The files depend on the schema being used:
+   - **spec-driven**: proposal, specs, design, tasks
+   - Other schemas: follow the contextFiles from CLI output
+
+5. **Show current progress**
+
+   Display:
+   - Schema being used
+   - Progress: "N/M tasks complete"
+   - Remaining tasks overview
+   - Dynamic instruction from CLI
+
+6. **Implement tasks (loop until done or blocked)**
+
+   For each pending task:
+   - Show which task is being worked on
+   - Make the code changes required
+   - Keep changes minimal and focused
+   - Mark task complete in the tasks file: `- [ ]` → `- [x]`
+   - Continue to next task
+
+   **Pause if:**
+   - Task is unclear → ask for clarification
+   - Implementation reveals a design issue → suggest updating artifacts
+   - Error or blocker encountered → report and wait for guidance
+   - User interrupts
+
+7. **On completion or pause, show status**
+
+   Display:
+   - Tasks completed this session
+   - Overall progress: "N/M tasks complete"
+   - If all done: suggest archive
+   - If paused: explain why and wait for guidance
+
+**Output During Implementation**
+
+```
+## Implementing: <change-name> (schema: <schema-name>)
+
+Working on task 3/7: <task description>
+[...implementation happening...]
+✓ Task complete
+
+Working on task 4/7: <task description>
+[...implementation happening...]
+✓ Task complete
+```
+
+**Output On Completion**
+
+```
+## Implementation Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Progress:** 7/7 tasks complete ✓
+
+### Completed This Session
+- [x] Task 1
+- [x] Task 2
+...
+
+All tasks complete! You can archive this change with `/opsx-archive`.
+```
+
+**Output On Pause (Issue Encountered)**
+
+```
+## Implementation Paused
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Progress:** 4/7 tasks complete
+
+### Issue Encountered
+<description of the issue>
+
+**Options:**
+1. <option 1>
+2. <option 2>
+3. Other approach
+
+What would you like to do?
+```
+
+**Guardrails**
+- Keep going through tasks until done or blocked
+- Always read context files before starting (from the apply instructions output)
+- If task is ambiguous, pause and ask before implementing
+- If implementation reveals issues, pause and suggest artifact updates
+- Keep code changes minimal and scoped to each task
+- Update task checkbox immediately after completing each task
+- Pause on errors, blockers, or unclear requirements - don't guess
+- Use contextFiles from CLI output, don't assume specific file names
+
+**Fluid Workflow Integration**
+
+This skill supports the "actions on a change" model:
+
+- **Can be invoked anytime**: Before all artifacts are done (if tasks exist), after partial implementation, interleaved with other actions
+- **Allows artifact updates**: If implementation reveals design issues, suggest updating artifacts - not phase-locked, work fluidly
diff --git a/.opencode/commands/opsx-archive.md b/.opencode/commands/opsx-archive.md
new file mode 100644
index 000000000..7f3a696fc
--- /dev/null
+++ b/.opencode/commands/opsx-archive.md
@@ -0,0 +1,157 @@
+---
+description: Archive a completed change in the experimental workflow
+---
+
+Archive a completed change in the experimental workflow.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name after `/opsx-archive` (e.g., `/opsx-archive add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show only active changes (not already archived).
+   Include the schema used for each change if available.
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Check artifact completion status**
+
+   Run `openspec status --change "<name>" --json` to check artifact completion.
+
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context
+   - `artifacts`: List of artifacts with their status (`done` or other)
+
+   **If any artifacts are not `done`:**
+   - Display warning listing incomplete artifacts
+   - Prompt user for confirmation to continue
+   - Proceed if user confirms
+
+3. **Check task completion status**
+
+   Read the tasks file (typically `tasks.md`) to check for incomplete tasks.
+
+   Count tasks marked with `- [ ]` (incomplete) vs `- [x]` (complete).
+
+   **If incomplete tasks found:**
+   - Display warning showing count of incomplete tasks
+   - Prompt user for confirmation to continue
+   - Proceed if user confirms
+
+   **If no tasks file exists:** Proceed without task-related warning.
+
+4. **Assess delta spec sync state**
+
+   Use `artifactPaths.specs.existingOutputPaths` from status JSON to check for delta specs. If none exist, proceed without sync prompt.
+
+   **If delta specs exist:**
+   - Compare each delta spec with its corresponding main spec at `openspec/specs/<capability>/spec.md`
+   - Determine what changes would be applied (adds, modifications, removals, renames)
+   - Show a combined summary before prompting
+
+   **Prompt options:**
+   - If changes needed: "Sync now (recommended)", "Archive without syncing"
+   - If already synced: "Archive now", "Sync anyway", "Cancel"
+
+   If user chooses sync, use Task tool (subagent_type: "general-purpose", prompt: "Use Skill tool to invoke openspec-sync-specs for change '<name>'. Delta spec analysis: <include the analyzed delta spec summary>"). Proceed to archive regardless of choice.
+
+5. **Perform the archive**
+
+   Create an `archive` directory under `planningHome.changesDir` if it doesn't exist:
+   ```bash
+   mkdir -p "<planningHome.changesDir>/archive"
+   ```
+
+   Generate target name using current date: `YYYY-MM-DD-<change-name>`
+
+   **Check if target already exists:**
+   - If yes: Fail with error, suggest renaming existing archive or using different date
+   - If no: Move `changeRoot` to the archive directory
+
+   ```bash
+   mv "<changeRoot>" "<planningHome.changesDir>/archive/YYYY-MM-DD-<name>"
+   ```
+
+6. **Display summary**
+
+   Show archive completion summary including:
+   - Change name
+   - Schema that was used
+   - Archive location
+   - Spec sync status (synced / sync skipped / no delta specs)
+   - Note about any warnings (incomplete artifacts/tasks)
+
+**Output On Success**
+
+```
+## Archive Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Archived to:** the archive path derived from `planningHome.changesDir`/YYYY-MM-DD-<name>/
+**Specs:** ✓ Synced to main specs
+
+All artifacts complete. All tasks complete.
+```
+
+**Output On Success (No Delta Specs)**
+
+```
+## Archive Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Archived to:** the archive path derived from `planningHome.changesDir`/YYYY-MM-DD-<name>/
+**Specs:** No delta specs
+
+All artifacts complete. All tasks complete.
+```
+
+**Output On Success With Warnings**
+
+```
+## Archive Complete (with warnings)
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Archived to:** the archive path derived from `planningHome.changesDir`/YYYY-MM-DD-<name>/
+**Specs:** Sync skipped (user chose to skip)
+
+**Warnings:**
+- Archived with 2 incomplete artifacts
+- Archived with 3 incomplete tasks
+- Delta spec sync was skipped (user chose to skip)
+
+Review the archive if this was not intentional.
+```
+
+**Output On Error (Archive Exists)**
+
+```
+## Archive Failed
+
+**Change:** <change-name>
+**Target:** the archive path derived from `planningHome.changesDir`/YYYY-MM-DD-<name>/
+
+Target archive directory already exists.
+
+**Options:**
+1. Rename the existing archive
+2. Delete the existing archive if it's a duplicate
+3. Wait until a different date to archive
+```
+
+**Guardrails**
+- Always prompt for change selection if not provided
+- Use artifact graph (openspec status --json) for completion checking
+- Don't block archive on warnings - just inform and confirm
+- Preserve .openspec.yaml when moving to archive (it moves with the directory)
+- Show clear summary of what happened
+- If sync is requested, use the Skill tool to invoke `openspec-sync-specs` (agent-driven)
+- If delta specs exist, always run the sync assessment and show the combined summary before prompting
diff --git a/.opencode/commands/opsx-bulk-archive.md b/.opencode/commands/opsx-bulk-archive.md
new file mode 100644
index 000000000..138d44bca
--- /dev/null
+++ b/.opencode/commands/opsx-bulk-archive.md
@@ -0,0 +1,241 @@
+---
+description: Archive multiple completed changes at once
+---
+
+Archive multiple completed changes in a single operation.
+
+This skill allows you to batch-archive changes, handling spec conflicts intelligently by checking the codebase to determine what's actually implemented.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: None required (prompts for selection)
+
+**Steps**
+
+1. **Get active changes**
+
+   Run `openspec list --json` to get all active changes.
+
+   If no active changes exist, inform user and stop.
+
+2. **Prompt for change selection**
+
+   Use **AskUserQuestion tool** with multi-select to let user choose changes:
+   - Show each change with its schema
+   - Include an option for "All changes"
+   - Allow any number of selections (1+ works, 2+ is the typical use case)
+
+   **IMPORTANT**: Do NOT auto-select. Always let the user choose.
+
+3. **Batch validation - gather status for all selected changes**
+
+   For each selected change, collect:
+
+   a. **Artifact status** - Run `openspec status --change "<name>" --json`
+      - Parse `schemaName`, `artifacts`, `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`
+      - Note which artifacts are `done` vs other states
+
+   b. **Task completion** - Read `artifactPaths.tasks.existingOutputPaths` from status JSON
+      - Count `- [ ]` (incomplete) vs `- [x]` (complete)
+      - If no tasks file exists, note as "No tasks"
+
+   c. **Delta specs** - Check `artifactPaths.specs.existingOutputPaths` from status JSON
+      - List which capability specs exist
+      - For each, extract requirement names (lines matching `### Requirement: <name>`)
+
+4. **Detect spec conflicts**
+
+   Build a map of `capability -> [changes that touch it]`:
+
+   ```
+   auth -> [change-a, change-b]  <- CONFLICT (2+ changes)
+   api  -> [change-c]            <- OK (only 1 change)
+   ```
+
+   A conflict exists when 2+ selected changes have delta specs for the same capability.
+
+5. **Resolve conflicts agentically**
+
+   **For each conflict**, investigate the codebase:
+
+   a. **Read the delta specs** from each conflicting change to understand what each claims to add/modify
+
+   b. **Search the codebase** for implementation evidence:
+      - Look for code implementing requirements from each delta spec
+      - Check for related files, functions, or tests
+
+   c. **Determine resolution**:
+      - If only one change is actually implemented -> sync that one's specs
+      - If both implemented -> apply in chronological order (older first, newer overwrites)
+      - If neither implemented -> skip spec sync, warn user
+
+   d. **Record resolution** for each conflict:
+      - Which change's specs to apply
+      - In what order (if both)
+      - Rationale (what was found in codebase)
+
+6. **Show consolidated status table**
+
+   Display a table summarizing all changes:
+
+   ```
+   | Change              | Artifacts | Tasks | Specs   | Conflicts | Status |
+   |---------------------|-----------|-------|---------|-----------|--------|
+   | schema-management   | Done      | 5/5   | 2 delta | None      | Ready  |
+   | project-config      | Done      | 3/3   | 1 delta | None      | Ready  |
+   | add-oauth           | Done      | 4/4   | 1 delta | auth (!)  | Ready* |
+   | add-verify-skill    | 1 left    | 2/5   | None    | None      | Warn   |
+   ```
+
+   For conflicts, show the resolution:
+   ```
+   * Conflict resolution:
+     - auth spec: Will apply add-oauth then add-jwt (both implemented, chronological order)
+   ```
+
+   For incomplete changes, show warnings:
+   ```
+   Warnings:
+   - add-verify-skill: 1 incomplete artifact, 3 incomplete tasks
+   ```
+
+7. **Confirm batch operation**
+
+   Use **AskUserQuestion tool** with a single confirmation:
+
+   - "Archive N changes?" with options based on status
+   - Options might include:
+     - "Archive all N changes"
+     - "Archive only N ready changes (skip incomplete)"
+     - "Cancel"
+
+   If there are incomplete changes, make clear they'll be archived with warnings.
+
+8. **Execute archive for each confirmed change**
+
+   Process changes in the determined order (respecting conflict resolution):
+
+   a. **Sync specs** if delta specs exist:
+      - Use the openspec-sync-specs approach (agent-driven intelligent merge)
+      - For conflicts, apply in resolved order
+      - Track if sync was done
+
+   b. **Perform the archive**:
+      ```bash
+      mkdir -p "<planningHome.changesDir>/archive"
+      mv "<changeRoot>" "<planningHome.changesDir>/archive/YYYY-MM-DD-<name>"
+      ```
+
+   c. **Track outcome** for each change:
+      - Success: archived successfully
+      - Failed: error during archive (record error)
+      - Skipped: user chose not to archive (if applicable)
+
+9. **Display summary**
+
+   Show final results:
+
+   ```
+   ## Bulk Archive Complete
+
+   Archived 3 changes:
+   - schema-management-cli -> archive/2026-01-19-schema-management-cli/
+   - project-config -> archive/2026-01-19-project-config/
+   - add-oauth -> archive/2026-01-19-add-oauth/
+
+   Skipped 1 change:
+   - add-verify-skill (user chose not to archive incomplete)
+
+   Spec sync summary:
+   - 4 delta specs synced to main specs
+   - 1 conflict resolved (auth: applied both in chronological order)
+   ```
+
+   If any failures:
+   ```
+   Failed 1 change:
+   - some-change: Archive directory already exists
+   ```
+
+**Conflict Resolution Examples**
+
+Example 1: Only one implemented
+```
+Conflict: specs/auth/spec.md touched by [add-oauth, add-jwt]
+
+Checking add-oauth:
+- Delta adds "OAuth Provider Integration" requirement
+- Searching codebase... found src/auth/oauth.ts implementing OAuth flow
+
+Checking add-jwt:
+- Delta adds "JWT Token Handling" requirement
+- Searching codebase... no JWT implementation found
+
+Resolution: Only add-oauth is implemented. Will sync add-oauth specs only.
+```
+
+Example 2: Both implemented
+```
+Conflict: specs/api/spec.md touched by [add-rest-api, add-graphql]
+
+Checking add-rest-api (created 2026-01-10):
+- Delta adds "REST Endpoints" requirement
+- Searching codebase... found src/api/rest.ts
+
+Checking add-graphql (created 2026-01-15):
+- Delta adds "GraphQL Schema" requirement
+- Searching codebase... found src/api/graphql.ts
+
+Resolution: Both implemented. Will apply add-rest-api specs first,
+then add-graphql specs (chronological order, newer takes precedence).
+```
+
+**Output On Success**
+
+```
+## Bulk Archive Complete
+
+Archived N changes:
+- <change-1> -> archive/YYYY-MM-DD-<change-1>/
+- <change-2> -> archive/YYYY-MM-DD-<change-2>/
+
+Spec sync summary:
+- N delta specs synced to main specs
+- No conflicts (or: M conflicts resolved)
+```
+
+**Output On Partial Success**
+
+```
+## Bulk Archive Complete (partial)
+
+Archived N changes:
+- <change-1> -> archive/YYYY-MM-DD-<change-1>/
+
+Skipped M changes:
+- <change-2> (user chose not to archive incomplete)
+
+Failed K changes:
+- <change-3>: Archive directory already exists
+```
+
+**Output When No Changes**
+
+```
+## No Changes to Archive
+
+No active changes found. Create a new change to get started.
+```
+
+**Guardrails**
+- Allow any number of changes (1+ is fine, 2+ is the typical use case)
+- Always prompt for selection, never auto-select
+- Detect spec conflicts early and resolve by checking codebase
+- When both changes are implemented, apply specs in chronological order
+- Skip spec sync only when implementation is missing (warn user)
+- Show clear per-change status before confirming
+- Use single confirmation for entire batch
+- Track and report all outcomes (success/skip/fail)
+- Preserve .openspec.yaml when moving to archive
+- Archive directory target uses current date: YYYY-MM-DD-<name>
+- If archive target exists, fail that change but continue with others
diff --git a/.opencode/commands/opsx-continue.md b/.opencode/commands/opsx-continue.md
new file mode 100644
index 000000000..cc3ff5a8f
--- /dev/null
+++ b/.opencode/commands/opsx-continue.md
@@ -0,0 +1,114 @@
+---
+description: Continue working on a change - create the next artifact (Experimental)
+---
+
+Continue working on a change by creating the next artifact.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name after `/opsx-continue` (e.g., `/opsx-continue add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes sorted by most recently modified. Then use the **AskUserQuestion tool** to let the user select which change to work on.
+
+   Present the top 3-4 most recently modified changes as options, showing:
+   - Change name
+   - Schema (from `schema` field if present, otherwise "spec-driven")
+   - Status (e.g., "0/5 tasks", "complete", "no tasks")
+   - How recently it was modified (from `lastModified` field)
+
+   Mark the most recently modified change as "(Recommended)" since it's likely what the user wants to continue.
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Check current status**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand current state. The response includes:
+   - `schemaName`: The workflow schema being used (e.g., "spec-driven")
+   - `artifacts`: Array of artifacts with their status ("done", "ready", "blocked")
+   - `isComplete`: Boolean indicating if all artifacts are complete
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context. Use these instead of assuming repo-local paths.
+
+3. **Act based on status**:
+
+   ---
+
+   **If all artifacts are complete (`isComplete: true`)**:
+   - Congratulate the user
+   - Show final status including the schema used
+   - Suggest: "All artifacts created! You can now implement this change with `/opsx-apply` or archive it with `/opsx-archive`."
+   - STOP
+
+   ---
+
+   **If artifacts are ready to create** (status shows artifacts with `status: "ready"`):
+   - Pick the FIRST artifact with `status: "ready"` from the status output
+   - Get its instructions:
+     ```bash
+     openspec instructions <artifact-id> --change "<name>" --json
+     ```
+   - Parse the JSON. The key fields are:
+     - `context`: Project background (constraints for you - do NOT include in output)
+     - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
+     - `template`: The structure to use for your output file
+     - `instruction`: Schema-specific guidance
+     - `resolvedOutputPath`: Resolved path or pattern to write the artifact
+     - `dependencies`: Completed artifacts to read for context
+   - **Create the artifact file**:
+     - Read any completed dependency files for context
+     - Use `template` as the structure - fill in its sections
+     - Apply `context` and `rules` as constraints when writing - but do NOT copy them into the file
+     - Write to the `resolvedOutputPath` specified in instructions. If it is a glob pattern, choose the concrete file path using the schema instruction and the change's context
+   - Show what was created and what's now unlocked
+   - STOP after creating ONE artifact
+
+   ---
+
+   **If no artifacts are ready (all blocked)**:
+   - This shouldn't happen with a valid schema
+   - Show status and suggest checking for issues
+
+4. **After creating an artifact, show progress**
+   ```bash
+   openspec status --change "<name>"
+   ```
+
+**Output**
+
+After each invocation, show:
+- Which artifact was created
+- Schema workflow being used
+- Current progress (N/M complete)
+- What artifacts are now unlocked
+- Prompt: "Run `/opsx-continue` to create the next artifact"
+
+**Artifact Creation Guidelines**
+
+The artifact types and their purpose depend on the schema. Use the `instruction` field from the instructions output to understand what to create.
+
+Common artifact patterns:
+
+**spec-driven schema** (proposal → specs → design → tasks):
+- **proposal.md**: Ask user about the change if not clear. Fill in Why, What Changes, Capabilities, Impact.
+  - The Capabilities section is critical - each capability listed will need a spec file.
+- **specs/<capability>/spec.md**: Create one spec per capability listed in the proposal's Capabilities section (use the capability name, not the change name).
+- **design.md**: Document technical decisions, architecture, and implementation approach.
+- **tasks.md**: Break down implementation into checkboxed tasks.
+
+For other schemas, follow the `instruction` field from the CLI output.
+
+**Guardrails**
+- Create ONE artifact per invocation
+- Always read dependency artifacts before creating a new one
+- Never skip artifacts or create out of order
+- If context is unclear, ask the user before creating
+- Verify the artifact file exists after writing before marking progress
+- Use the schema's artifact sequence, don't assume specific artifact names
+- **IMPORTANT**: `context` and `rules` are constraints for YOU, not content for the file
+  - Do NOT copy `<context>`, `<rules>`, `<project_context>` blocks into the artifact
+  - These guide what you write, but should never appear in the output
diff --git a/.opencode/commands/opsx-explore.md b/.opencode/commands/opsx-explore.md
new file mode 100644
index 000000000..928233b45
--- /dev/null
+++ b/.opencode/commands/opsx-explore.md
@@ -0,0 +1,171 @@
+---
+description: Enter explore mode - think through ideas, investigate problems, clarify requirements
+---
+
+Enter explore mode. Think deeply. Visualize freely. Follow the conversation wherever it goes.
+
+**IMPORTANT: Explore mode is for thinking, not implementing.** You may read files, search code, and investigate the codebase, but you must NEVER write code or implement features. If the user asks you to implement something, remind them to exit explore mode first and create a change proposal. You MAY create OpenSpec artifacts (proposals, designs, specs) if the user asks—that's capturing thinking, not implementing.
+
+**This is a stance, not a workflow.** There are no fixed steps, no required sequence, no mandatory outputs. You're a thinking partner helping the user explore.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: The argument after `/opsx-explore` is whatever the user wants to think about. Could be:
+- A vague idea: "real-time collaboration"
+- A specific problem: "the auth system is getting unwieldy"
+- A change name: "add-dark-mode" (to explore in context of that change)
+- A comparison: "postgres vs sqlite for this"
+- Nothing (just enter explore mode)
+
+---
+
+## The Stance
+
+- **Curious, not prescriptive** - Ask questions that emerge naturally, don't follow a script
+- **Open threads, not interrogations** - Surface multiple interesting directions and let the user follow what resonates. Don't funnel them through a single path of questions.
+- **Visual** - Use ASCII diagrams liberally when they'd help clarify thinking
+- **Adaptive** - Follow interesting threads, pivot when new information emerges
+- **Patient** - Don't rush to conclusions, let the shape of the problem emerge
+- **Grounded** - Explore the actual codebase when relevant, don't just theorize
+
+---
+
+## What You Might Do
+
+Depending on what the user brings, you might:
+
+**Explore the problem space**
+- Ask clarifying questions that emerge from what they said
+- Challenge assumptions
+- Reframe the problem
+- Find analogies
+
+**Investigate the codebase**
+- Map existing architecture relevant to the discussion
+- Find integration points
+- Identify patterns already in use
+- Surface hidden complexity
+
+**Compare options**
+- Brainstorm multiple approaches
+- Build comparison tables
+- Sketch tradeoffs
+- Recommend a path (if asked)
+
+**Visualize**
+```
+┌─────────────────────────────────────────┐
+│     Use ASCII diagrams liberally        │
+├─────────────────────────────────────────┤
+│                                         │
+│      ┌────────┐         ┌────────┐      │
+│      │ State  │────────▶│ State  │      │
+│      │   A    │         │   B    │      │
+│      └────────┘         └────────┘      │
+│                                         │
+│   System diagrams, state machines,      │
+│   data flows, architecture sketches,    │
+│   dependency graphs, comparison tables  │
+│                                         │
+└─────────────────────────────────────────┘
+```
+
+**Surface risks and unknowns**
+- Identify what could go wrong
+- Find gaps in understanding
+- Suggest spikes or investigations
+
+---
+
+## OpenSpec Awareness
+
+You have full context of the OpenSpec system. Use it naturally, don't force it.
+
+### Check for context
+
+At the start, quickly check what exists:
+```bash
+openspec list --json
+```
+
+This tells you:
+- If there are active changes
+- Their names, schemas, and status
+- What the user might be working on
+
+If the user mentioned a specific change name, read its artifacts for context.
+
+### When no change exists
+
+Think freely. When insights crystallize, you might offer:
+
+- "This feels solid enough to start a change. Want me to create a proposal?"
+- Or keep exploring - no pressure to formalize
+
+### When a change exists
+
+If the user mentions a change or you detect one is relevant:
+
+1. **Resolve and read existing artifacts for context**
+   - Run `openspec status --change "<name>" --json`.
+   - Use `changeRoot`, `artifactPaths`, and `actionContext` from the status JSON.
+   - Read existing files from `artifactPaths.<artifact>.existingOutputPaths`.
+
+2. **Reference them naturally in conversation**
+   - "Your design mentions using Redis, but we just realized SQLite fits better..."
+   - "The proposal scopes this to premium users, but we're now thinking everyone..."
+
+3. **Offer to capture when decisions are made**
+
+    | Insight Type               | Where to Capture               |
+    |----------------------------|--------------------------------|
+    | New requirement discovered | `specs/<capability>/spec.md` |
+    | Requirement changed        | `specs/<capability>/spec.md` |
+    | Design decision made       | `design.md`                  |
+    | Scope changed              | `proposal.md`                |
+    | New work identified        | `tasks.md`                   |
+    | Assumption invalidated     | Relevant artifact              |
+
+   Example offers:
+   - "That's a design decision. Capture it in design.md?"
+   - "This is a new requirement. Add it to specs?"
+   - "This changes scope. Update the proposal?"
+
+4. **The user decides** - Offer and move on. Don't pressure. Don't auto-capture.
+
+---
+
+## What You Don't Have To Do
+
+- Follow a script
+- Ask the same questions every time
+- Produce a specific artifact
+- Reach a conclusion
+- Stay on topic if a tangent is valuable
+- Be brief (this is thinking time)
+
+---
+
+## Ending Discovery
+
+There's no required ending. Discovery might:
+
+- **Flow into a proposal**: "Ready to start? I can create a change proposal."
+- **Result in artifact updates**: "Updated design.md with these decisions"
+- **Just provide clarity**: User has what they need, moves on
+- **Continue later**: "We can pick this up anytime"
+
+When things crystallize, you might offer a summary - but it's optional. Sometimes the thinking IS the value.
+
+---
+
+## Guardrails
+
+- **Don't implement** - Never write code or implement features. Creating OpenSpec artifacts is fine, writing application code is not.
+- **Don't fake understanding** - If something is unclear, dig deeper
+- **Don't rush** - Discovery is thinking time, not task time
+- **Don't force structure** - Let patterns emerge naturally
+- **Don't auto-capture** - Offer to save insights, don't just do it
+- **Do visualize** - A good diagram is worth many paragraphs
+- **Do explore the codebase** - Ground discussions in reality
+- **Do question assumptions** - Including the user's and your own
diff --git a/.opencode/commands/opsx-ff.md b/.opencode/commands/opsx-ff.md
new file mode 100644
index 000000000..21955dc2d
--- /dev/null
+++ b/.opencode/commands/opsx-ff.md
@@ -0,0 +1,97 @@
+---
+description: Create a change and generate all artifacts needed for implementation in one go
+---
+
+Fast-forward through artifact creation - generate everything needed to start implementation.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: The argument after `/opsx-ff` is the change name (kebab-case), OR a description of what the user wants to build.
+
+**Steps**
+
+1. **If no input provided, ask what they want to build**
+
+   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
+   > "What change do you want to work on? Describe what you want to build or fix."
+
+   From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
+
+   **IMPORTANT**: Do NOT proceed without understanding what the user wants to build.
+
+2. **Create the change directory**
+   ```bash
+   openspec new change "<name>"
+   ```
+   This creates a scaffolded change in the planning home resolved by the CLI.
+
+3. **Get the artifact build order**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to get:
+   - `applyRequires`: array of artifact IDs needed before implementation (e.g., `["tasks"]`)
+   - `artifacts`: list of all artifacts with their status and dependencies
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context. Use these instead of assuming repo-local paths.
+
+4. **Create artifacts in sequence until apply-ready**
+
+   Use the **TodoWrite tool** to track progress through the artifacts.
+
+   Loop through artifacts in dependency order (artifacts with no pending dependencies first):
+
+   a. **For each artifact that is `ready` (dependencies satisfied)**:
+      - Get instructions:
+        ```bash
+        openspec instructions <artifact-id> --change "<name>" --json
+        ```
+      - The instructions JSON includes:
+        - `context`: Project background (constraints for you - do NOT include in output)
+        - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
+        - `template`: The structure to use for your output file
+        - `instruction`: Schema-specific guidance for this artifact type
+        - `resolvedOutputPath`: Resolved path or pattern to write the artifact
+        - `dependencies`: Completed artifacts to read for context
+      - Read any completed dependency files for context
+      - Create the artifact file using `template` as the structure and write it to `resolvedOutputPath`
+      - Apply `context` and `rules` as constraints - but do NOT copy them into the file
+      - Show brief progress: "✓ Created <artifact-id>"
+
+   b. **Continue until all `applyRequires` artifacts are complete**
+      - After creating each artifact, re-run `openspec status --change "<name>" --json`
+      - Check if every artifact ID in `applyRequires` has `status: "done"` in the artifacts array
+      - Stop when all `applyRequires` artifacts are done
+
+   c. **If an artifact requires user input** (unclear context):
+      - Use **AskUserQuestion tool** to clarify
+      - Then continue with creation
+
+5. **Show final status**
+   ```bash
+   openspec status --change "<name>"
+   ```
+
+**Output**
+
+After completing all artifacts, summarize:
+- Change name and location
+- List of artifacts created with brief descriptions
+- What's ready: "All artifacts created! Ready for implementation."
+- Prompt: "Run `/opsx-apply` to start implementing."
+
+**Artifact Creation Guidelines**
+
+- Follow the `instruction` field from `openspec instructions` for each artifact type
+- The schema defines what each artifact should contain - follow it
+- Read dependency artifacts for context before creating new ones
+- Use `template` as the structure for your output file - fill in its sections
+- **IMPORTANT**: `context` and `rules` are constraints for YOU, not content for the file
+  - Do NOT copy `<context>`, `<rules>`, `<project_context>` blocks into the artifact
+  - These guide what you write, but should never appear in the output
+
+**Guardrails**
+- Create ALL artifacts needed for implementation (as defined by schema's `apply.requires`)
+- Always read dependency artifacts before creating a new one
+- If context is critically unclear, ask the user - but prefer making reasonable decisions to keep momentum
+- If a change with that name already exists, ask if user wants to continue it or create a new one
+- Verify each artifact file exists after writing before proceeding to next
diff --git a/.opencode/commands/opsx-new.md b/.opencode/commands/opsx-new.md
new file mode 100644
index 000000000..f81075435
--- /dev/null
+++ b/.opencode/commands/opsx-new.md
@@ -0,0 +1,68 @@
+---
+description: Start a new change using the experimental artifact workflow (OPSX)
+---
+
+Start a new change using the experimental artifact-driven approach.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: The argument after `/opsx-new` is the change name (kebab-case), OR a description of what the user wants to build.
+
+**Steps**
+
+1. **If no input provided, ask what they want to build**
+
+   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
+   > "What change do you want to work on? Describe what you want to build or fix."
+
+   From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
+
+   **IMPORTANT**: Do NOT proceed without understanding what the user wants to build.
+
+2. **Determine the workflow schema**
+
+   Use the default schema (omit `--schema`) unless the user explicitly requests a different workflow.
+
+   **Use a different schema only if the user mentions:**
+   - A specific schema name → use `--schema <name>`
+   - "show workflows" or "what workflows" → run `openspec schemas --json` and let them choose
+
+   **Otherwise**: Omit `--schema` to use the default.
+
+3. **Create the change directory**
+   ```bash
+   openspec new change "<name>"
+   ```
+   Add `--schema <name>` only if the user requested a specific workflow.
+   This creates a scaffolded change in the planning home resolved by the CLI.
+
+4. **Show the artifact status**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Use the returned `planningHome`, `changeRoot`, `artifactPaths`, and `nextSteps` instead of assuming repo-local paths.
+
+5. **Get instructions for the first artifact**
+   The first artifact depends on the schema. Check the status output to find the first artifact with status "ready".
+   ```bash
+   openspec instructions <first-artifact-id> --change "<name>"
+   ```
+   This outputs the template and context for creating the first artifact.
+
+6. **STOP and wait for user direction**
+
+**Output**
+
+After completing the steps, summarize:
+- Change name and location
+- Schema/workflow being used and its artifact sequence
+- Current status (0/N artifacts complete)
+- The template for the first artifact
+- Prompt: "Ready to create the first artifact? Run `/opsx-continue` or just describe what this change is about and I'll draft it."
+
+**Guardrails**
+- Do NOT create any artifacts yet - just show the instructions
+- Do NOT advance beyond showing the first artifact template
+- If the name is invalid (not kebab-case), ask for a valid name
+- If a change with that name already exists, suggest using `/opsx-continue` instead
+- Pass --schema if using a non-default workflow
diff --git a/.opencode/commands/opsx-onboard.md b/.opencode/commands/opsx-onboard.md
new file mode 100644
index 000000000..3ba27d123
--- /dev/null
+++ b/.opencode/commands/opsx-onboard.md
@@ -0,0 +1,547 @@
+---
+description: Guided onboarding - walk through a complete OpenSpec workflow cycle with narration
+---
+
+Guide the user through their first complete OpenSpec workflow cycle. This is a teaching experience—you'll do real work in their codebase while explaining each step.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+---
+
+## Preflight
+
+Before starting, check if the OpenSpec CLI is installed:
+
+```bash
+# Unix/macOS
+openspec --version 2>&1 || echo "CLI_NOT_INSTALLED"
+# Windows (PowerShell)
+# if (Get-Command openspec -ErrorAction SilentlyContinue) { openspec --version } else { echo "CLI_NOT_INSTALLED" }
+```
+
+**If CLI not installed:**
+> OpenSpec CLI is not installed. Install it first, then come back to `/opsx-onboard`.
+
+Stop here if not installed.
+
+---
+
+## Phase 1: Welcome
+
+Display:
+
+```
+## Welcome to OpenSpec!
+
+I'll walk you through a complete change cycle—from idea to implementation—using a real task in your codebase. Along the way, you'll learn the workflow by doing it.
+
+**What we'll do:**
+1. Pick a small, real task in your codebase
+2. Explore the problem briefly
+3. Create a change (the container for our work)
+4. Build the artifacts: proposal → specs → design → tasks
+5. Implement the tasks
+6. Archive the completed change
+
+**Time:** ~15-20 minutes
+
+Let's start by finding something to work on.
+```
+
+---
+
+## Phase 2: Task Selection
+
+### Codebase Analysis
+
+Scan the codebase for small improvement opportunities. Look for:
+
+1. **TODO/FIXME comments** - Search for `TODO`, `FIXME`, `HACK`, `XXX` in code files
+2. **Missing error handling** - `catch` blocks that swallow errors, risky operations without try-catch
+3. **Functions without tests** - Cross-reference `src/` with test directories
+4. **Type issues** - `any` types in TypeScript files (`: any`, `as any`)
+5. **Debug artifacts** - `console.log`, `console.debug`, `debugger` statements in non-debug code
+6. **Missing validation** - User input handlers without validation
+
+Also check recent git activity:
+```bash
+# Unix/macOS
+git log --oneline -10 2>/dev/null || echo "No git history"
+# Windows (PowerShell)
+# git log --oneline -10 2>$null; if ($LASTEXITCODE -ne 0) { echo "No git history" }
+```
+
+### Present Suggestions
+
+From your analysis, present 3-4 specific suggestions:
+
+```
+## Task Suggestions
+
+Based on scanning your codebase, here are some good starter tasks:
+
+**1. [Most promising task]**
+   Location: `src/path/to/file.ts:42`
+   Scope: ~1-2 files, ~20-30 lines
+   Why it's good: [brief reason]
+
+**2. [Second task]**
+   Location: `src/another/file.ts`
+   Scope: ~1 file, ~15 lines
+   Why it's good: [brief reason]
+
+**3. [Third task]**
+   Location: [location]
+   Scope: [estimate]
+   Why it's good: [brief reason]
+
+**4. Something else?**
+   Tell me what you'd like to work on.
+
+Which task interests you? (Pick a number or describe your own)
+```
+
+**If nothing found:** Fall back to asking what the user wants to build:
+> I didn't find obvious quick wins in your codebase. What's something small you've been meaning to add or fix?
+
+### Scope Guardrail
+
+If the user picks or describes something too large (major feature, multi-day work):
+
+```
+That's a valuable task, but it's probably larger than ideal for your first OpenSpec run-through.
+
+For learning the workflow, smaller is better—it lets you see the full cycle without getting stuck in implementation details.
+
+**Options:**
+1. **Slice it smaller** - What's the smallest useful piece of [their task]? Maybe just [specific slice]?
+2. **Pick something else** - One of the other suggestions, or a different small task?
+3. **Do it anyway** - If you really want to tackle this, we can. Just know it'll take longer.
+
+What would you prefer?
+```
+
+Let the user override if they insist—this is a soft guardrail.
+
+---
+
+## Phase 3: Explore Demo
+
+Once a task is selected, briefly demonstrate explore mode:
+
+```
+Before we create a change, let me quickly show you **explore mode**—it's how you think through problems before committing to a direction.
+```
+
+Spend 1-2 minutes investigating the relevant code:
+- Read the file(s) involved
+- Draw a quick ASCII diagram if it helps
+- Note any considerations
+
+```
+## Quick Exploration
+
+[Your brief analysis—what you found, any considerations]
+
+┌─────────────────────────────────────────┐
+│   [Optional: ASCII diagram if helpful]  │
+└─────────────────────────────────────────┘
+
+Explore mode (`/opsx-explore`) is for this kind of thinking—investigating before implementing. You can use it anytime you need to think through a problem.
+
+Now let's create a change to hold our work.
+```
+
+**PAUSE** - Wait for user acknowledgment before proceeding.
+
+---
+
+## Phase 4: Create the Change
+
+**EXPLAIN:**
+```
+## Creating a Change
+
+A "change" in OpenSpec is a container for all the thinking and planning around a piece of work. It lives at the `changeRoot` reported by `openspec status --change "<name>" --json` and holds your artifacts—proposal, specs, design, tasks.
+
+Let me create one for our task.
+```
+
+**DO:** Create the change with a derived kebab-case name:
+```bash
+openspec new change "<derived-name>"
+```
+
+**SHOW:**
+```
+Created: <changeRoot from status JSON>
+
+The folder structure:
+```
+<changeRoot>/
+├── proposal.md    ← Why we're doing this (empty, we'll fill it)
+├── design.md      ← How we'll build it (empty)
+├── specs/         ← Detailed requirements (empty)
+└── tasks.md       ← Implementation checklist (empty)
+```
+
+Now let's fill in the first artifact—the proposal.
+```
+
+---
+
+## Phase 5: Proposal
+
+**EXPLAIN:**
+```
+## The Proposal
+
+The proposal captures **why** we're making this change and **what** it involves at a high level. It's the "elevator pitch" for the work.
+
+I'll draft one based on our task.
+```
+
+**DO:** Draft the proposal content (don't save yet):
+
+```
+Here's a draft proposal:
+
+---
+
+## Why
+
+[1-2 sentences explaining the problem/opportunity]
+
+## What Changes
+
+[Bullet points of what will be different]
+
+## Capabilities
+
+### New Capabilities
+- `<capability-name>`: [brief description]
+
+### Modified Capabilities
+<!-- If modifying existing behavior -->
+
+## Impact
+
+- `src/path/to/file.ts`: [what changes]
+- [other files if applicable]
+
+---
+
+Does this capture the intent? I can adjust before we save it.
+```
+
+**PAUSE** - Wait for user approval/feedback.
+
+After approval, save the proposal:
+```bash
+openspec instructions proposal --change "<name>" --json
+```
+Then write the content to the `resolvedOutputPath` from `openspec instructions proposal --change "<name>" --json`.
+
+```
+Proposal saved. This is your "why" document—you can always come back and refine it as understanding evolves.
+
+Next up: specs.
+```
+
+---
+
+## Phase 6: Specs
+
+**EXPLAIN:**
+```
+## Specs
+
+Specs define **what** we're building in precise, testable terms. They use a requirement/scenario format that makes expected behavior crystal clear.
+
+For a small task like this, we might only need one spec file.
+```
+
+**DO:** Resolve where the spec file should be created:
+```bash
+openspec instructions specs --change "<name>" --json
+# Use resolvedOutputPath from the JSON. If it is a glob, choose the concrete file path using the schema instruction and the change's context.
+```
+
+Draft the spec content:
+
+```
+Here's the spec:
+
+---
+
+## ADDED Requirements
+
+### Requirement: <Name>
+
+<Description of what the system should do>
+
+#### Scenario: <Scenario name>
+
+- **WHEN** <trigger condition>
+- **THEN** <expected outcome>
+- **AND** <additional outcome if needed>
+
+---
+
+This format—WHEN/THEN/AND—makes requirements testable. You can literally read them as test cases.
+```
+
+Save to the concrete file path chosen from `resolvedOutputPath`.
+
+---
+
+## Phase 7: Design
+
+**EXPLAIN:**
+```
+## Design
+
+The design captures **how** we'll build it—technical decisions, tradeoffs, approach.
+
+For small changes, this might be brief. That's fine—not every change needs deep design discussion.
+```
+
+**DO:** Draft design.md:
+
+```
+Here's the design:
+
+---
+
+## Context
+
+[Brief context about the current state]
+
+## Goals / Non-Goals
+
+**Goals:**
+- [What we're trying to achieve]
+
+**Non-Goals:**
+- [What's explicitly out of scope]
+
+## Decisions
+
+### Decision 1: [Key decision]
+
+[Explanation of approach and rationale]
+
+---
+
+For a small task, this captures the key decisions without over-engineering.
+```
+
+Save to the `resolvedOutputPath` from `openspec instructions design --change "<name>" --json`.
+
+---
+
+## Phase 8: Tasks
+
+**EXPLAIN:**
+```
+## Tasks
+
+Finally, we break the work into implementation tasks—checkboxes that drive the apply phase.
+
+These should be small, clear, and in logical order.
+```
+
+**DO:** Generate tasks based on specs and design:
+
+```
+Here are the implementation tasks:
+
+---
+
+## 1. [Category or file]
+
+- [ ] 1.1 [Specific task]
+- [ ] 1.2 [Specific task]
+
+## 2. Verify
+
+- [ ] 2.1 [Verification step]
+
+---
+
+Each checkbox becomes a unit of work in the apply phase. Ready to implement?
+```
+
+**PAUSE** - Wait for user to confirm they're ready to implement.
+
+Save to the `resolvedOutputPath` from `openspec instructions tasks --change "<name>" --json`.
+
+---
+
+## Phase 9: Apply (Implementation)
+
+**EXPLAIN:**
+```
+## Implementation
+
+Now we implement each task, checking them off as we go. I'll announce each one and occasionally note how the specs/design informed the approach.
+```
+
+**DO:** For each task:
+
+1. Announce: "Working on task N: [description]"
+2. Implement the change in the codebase
+3. Reference specs/design naturally: "The spec says X, so I'm doing Y"
+4. Mark complete in tasks.md: `- [ ]` → `- [x]`
+5. Brief status: "✓ Task N complete"
+
+Keep narration light—don't over-explain every line of code.
+
+After all tasks:
+
+```
+## Implementation Complete
+
+All tasks done:
+- [x] Task 1
+- [x] Task 2
+- [x] ...
+
+The change is implemented! One more step—let's archive it.
+```
+
+---
+
+## Phase 10: Archive
+
+**EXPLAIN:**
+```
+## Archiving
+
+When a change is complete, we archive it. The archive path is derived from `planningHome.changesDir` and the date.
+
+Archived changes become your project's decision history—you can always find them later to understand why something was built a certain way.
+```
+
+**DO:**
+```bash
+openspec archive "<name>"
+```
+
+**SHOW:**
+```
+Archived to: `<planningHome.changesDir>/archive/YYYY-MM-DD-<name>/`
+
+The change is now part of your project's history. The code is in your codebase, the decision record is preserved.
+```
+
+---
+
+## Phase 11: Recap & Next Steps
+
+```
+## Congratulations!
+
+You just completed a full OpenSpec cycle:
+
+1. **Explore** - Thought through the problem
+2. **New** - Created a change container
+3. **Proposal** - Captured WHY
+4. **Specs** - Defined WHAT in detail
+5. **Design** - Decided HOW
+6. **Tasks** - Broke it into steps
+7. **Apply** - Implemented the work
+8. **Archive** - Preserved the record
+
+This same rhythm works for any size change—a small fix or a major feature.
+
+---
+
+## Command Reference
+
+**Core workflow:**
+
+ | Command           | What it does                               |
+ |-------------------|--------------------------------------------|
+ | `/opsx-propose` | Create a change and generate all artifacts |
+ | `/opsx-explore` | Think through problems before/during work  |
+ | `/opsx-apply`   | Implement tasks from a change              |
+ | `/opsx-archive` | Archive a completed change                 |
+
+**Additional commands:**
+
+ | Command            | What it does                                             |
+ |--------------------|----------------------------------------------------------|
+ | `/opsx-new`      | Start a new change, step through artifacts one at a time |
+ | `/opsx-continue` | Continue working on an existing change                   |
+ | `/opsx-ff`       | Fast-forward: create all artifacts at once               |
+ | `/opsx-verify`   | Verify implementation matches artifacts                  |
+
+---
+
+## What's Next?
+
+Try `/opsx-propose` on something you actually want to build. You've got the rhythm now!
+```
+
+---
+
+## Graceful Exit Handling
+
+### User wants to stop mid-way
+
+If the user says they need to stop, want to pause, or seem disengaged:
+
+```
+No problem! Your change is saved at the `changeRoot` reported by `openspec status --change "<name>" --json`.
+
+To pick up where we left off later:
+- `/opsx-continue <name>` - Resume artifact creation
+- `/opsx-apply <name>` - Jump to implementation (if tasks exist)
+
+The work won't be lost. Come back whenever you're ready.
+```
+
+Exit gracefully without pressure.
+
+### User just wants command reference
+
+If the user says they just want to see the commands or skip the tutorial:
+
+```
+## OpenSpec Quick Reference
+
+**Core workflow:**
+
+ | Command                  | What it does                               |
+ |--------------------------|--------------------------------------------|
+ | `/opsx-propose <name>` | Create a change and generate all artifacts |
+ | `/opsx-explore`        | Think through problems (no code changes)   |
+ | `/opsx-apply <name>`   | Implement tasks                            |
+ | `/opsx-archive <name>` | Archive when done                          |
+
+**Additional commands:**
+
+ | Command                   | What it does                        |
+ |---------------------------|-------------------------------------|
+ | `/opsx-new <name>`      | Start a new change, step by step    |
+ | `/opsx-continue <name>` | Continue an existing change         |
+ | `/opsx-ff <name>`       | Fast-forward: all artifacts at once |
+ | `/opsx-verify <name>`   | Verify implementation               |
+
+Try `/opsx-propose` to start your first change.
+```
+
+Exit gracefully.
+
+---
+
+## Guardrails
+
+- **Follow the EXPLAIN → DO → SHOW → PAUSE pattern** at key transitions (after explore, after proposal draft, after tasks, after archive)
+- **Keep narration light** during implementation—teach without lecturing
+- **Don't skip phases** even if the change is small—the goal is teaching the workflow
+- **Pause for acknowledgment** at marked points, but don't over-pause
+- **Handle exits gracefully**—never pressure the user to continue
+- **Use real codebase tasks**—don't simulate or use fake examples
+- **Adjust scope gently**—guide toward smaller tasks but respect user choice
diff --git a/.opencode/commands/opsx-sync.md b/.opencode/commands/opsx-sync.md
new file mode 100644
index 000000000..5f1b7bb4a
--- /dev/null
+++ b/.opencode/commands/opsx-sync.md
@@ -0,0 +1,140 @@
+---
+description: Sync delta specs from a change to main specs
+---
+
+Sync delta specs from a change to main specs.
+
+This is an **agent-driven** operation - you will read delta specs and directly edit main specs to apply the changes. This allows intelligent merging (e.g., adding a scenario without copying the entire requirement).
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name after `/opsx-sync` (e.g., `/opsx-sync add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show changes that have delta specs (under `specs/` directory).
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Resolve change context**
+
+   Run:
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+
+3. **Find delta specs**
+
+   Use `artifactPaths.specs.existingOutputPaths` from the status JSON as the list of delta spec files.
+
+   Each delta spec file contains sections like:
+   - `## ADDED Requirements` - New requirements to add
+   - `## MODIFIED Requirements` - Changes to existing requirements
+   - `## REMOVED Requirements` - Requirements to remove
+   - `## RENAMED Requirements` - Requirements to rename (FROM:/TO: format)
+
+   If no delta specs found, inform user and stop.
+
+4. **For each delta spec, apply changes to main specs**
+
+   For each repo-local capability delta spec path returned by the CLI:
+
+   a. **Read the delta spec** to understand the intended changes
+
+   b. **Read the main spec** at `openspec/specs/<capability>/spec.md` (may not exist yet)
+
+   c. **Apply changes intelligently**:
+
+      **ADDED Requirements:**
+      - If requirement doesn't exist in main spec → add it
+      - If requirement already exists → update it to match (treat as implicit MODIFIED)
+
+      **MODIFIED Requirements:**
+      - Find the requirement in main spec
+      - Apply the changes - this can be:
+        - Adding new scenarios (don't need to copy existing ones)
+        - Modifying existing scenarios
+        - Changing the requirement description
+      - Preserve scenarios/content not mentioned in the delta
+
+      **REMOVED Requirements:**
+      - Remove the entire requirement block from main spec
+
+      **RENAMED Requirements:**
+      - Find the FROM requirement, rename to TO
+
+   d. **Create new main spec** if capability doesn't exist yet:
+      - Create `openspec/specs/<capability>/spec.md`
+      - Add Purpose section (can be brief, mark as TBD)
+      - Add Requirements section with the ADDED requirements
+
+5. **Show summary**
+
+   After applying all changes, summarize:
+   - Which capabilities were updated
+   - What changes were made (requirements added/modified/removed/renamed)
+
+**Delta Spec Format Reference**
+
+```markdown
+## ADDED Requirements
+
+### Requirement: New Feature
+The system SHALL do something new.
+
+#### Scenario: Basic case
+- **WHEN** user does X
+- **THEN** system does Y
+
+## MODIFIED Requirements
+
+### Requirement: Existing Feature
+#### Scenario: New scenario to add
+- **WHEN** user does A
+- **THEN** system does B
+
+## REMOVED Requirements
+
+### Requirement: Deprecated Feature
+
+## RENAMED Requirements
+
+- FROM: `### Requirement: Old Name`
+- TO: `### Requirement: New Name`
+```
+
+**Key Principle: Intelligent Merging**
+
+Unlike programmatic merging, you can apply **partial updates**:
+- To add a scenario, just include that scenario under MODIFIED - don't copy existing scenarios
+- The delta represents *intent*, not a wholesale replacement
+- Use your judgment to merge changes sensibly
+
+**Output On Success**
+
+```
+## Specs Synced: <change-name>
+
+Updated main specs:
+
+**<capability-1>**:
+- Added requirement: "New Feature"
+- Modified requirement: "Existing Feature" (added 1 scenario)
+
+**<capability-2>**:
+- Created new spec file
+- Added requirement: "Another Feature"
+
+Main specs are now updated. The change remains active - archive when implementation is complete.
+```
+
+**Guardrails**
+- Read both delta and main specs before making changes
+- Preserve existing content not mentioned in delta
+- If something is unclear, ask for clarification
+- Show what you're changing as you go
+- The operation should be idempotent - running twice should give same result
diff --git a/.opencode/commands/opsx-verify.md b/.opencode/commands/opsx-verify.md
new file mode 100644
index 000000000..de6d1450f
--- /dev/null
+++ b/.opencode/commands/opsx-verify.md
@@ -0,0 +1,164 @@
+---
+description: Verify implementation matches change artifacts before archiving
+---
+
+Verify that an implementation matches the change artifacts (specs, tasks, design).
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name after `/opsx-verify` (e.g., `/opsx-verify add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show changes that have implementation tasks (tasks artifact exists).
+   Include the schema used for each change if available.
+   Mark changes with incomplete tasks as "(In Progress)".
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Check status to understand the schema**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used (e.g., "spec-driven")
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context
+   - Which artifacts exist for this change
+
+3. **Get planning context and load artifacts**
+
+   ```bash
+   openspec instructions apply --change "<name>" --json
+   ```
+
+   This returns the change directory and `contextFiles` (artifact ID -> array of concrete file paths). Read all available artifacts from `contextFiles`.
+
+4. **Initialize verification report structure**
+
+   Create a report structure with three dimensions:
+   - **Completeness**: Track tasks and spec coverage
+   - **Correctness**: Track requirement implementation and scenario coverage
+   - **Coherence**: Track design adherence and pattern consistency
+
+   Each dimension can have CRITICAL, WARNING, or SUGGESTION issues.
+
+5. **Verify Completeness**
+
+   **Task Completion**:
+   - If `contextFiles.tasks` exists, read every file path in it
+   - Parse checkboxes: `- [ ]` (incomplete) vs `- [x]` (complete)
+   - Count complete vs total tasks
+   - If incomplete tasks exist:
+     - Add CRITICAL issue for each incomplete task
+     - Recommendation: "Complete task: <description>" or "Mark as done if already implemented"
+
+   **Spec Coverage**:
+   - If delta specs exist in `contextFiles.specs`:
+     - Extract all requirements (marked with "### Requirement:")
+     - For each requirement:
+       - Search codebase for keywords related to the requirement
+       - Assess if implementation likely exists
+     - If requirements appear unimplemented:
+       - Add CRITICAL issue: "Requirement not found: <requirement name>"
+       - Recommendation: "Implement requirement X: <description>"
+
+6. **Verify Correctness**
+
+   **Requirement Implementation Mapping**:
+   - For each requirement from delta specs:
+     - Search codebase for implementation evidence
+     - If found, note file paths and line ranges
+     - Assess if implementation matches requirement intent
+     - If divergence detected:
+       - Add WARNING: "Implementation may diverge from spec: <details>"
+       - Recommendation: "Review <file>:<lines> against requirement X"
+
+   **Scenario Coverage**:
+   - For each scenario in delta specs (marked with "#### Scenario:"):
+     - Check if conditions are handled in code
+     - Check if tests exist covering the scenario
+     - If scenario appears uncovered:
+       - Add WARNING: "Scenario not covered: <scenario name>"
+       - Recommendation: "Add test or implementation for scenario: <description>"
+
+7. **Verify Coherence**
+
+   **Design Adherence**:
+   - If `contextFiles.design` exists:
+     - Extract key decisions (look for sections like "Decision:", "Approach:", "Architecture:")
+     - Verify implementation follows those decisions
+     - If contradiction detected:
+       - Add WARNING: "Design decision not followed: <decision>"
+       - Recommendation: "Update implementation or revise design.md to match reality"
+   - If no design.md: Skip design adherence check, note "No design.md to verify against"
+
+   **Code Pattern Consistency**:
+   - Review new code for consistency with project patterns
+   - Check file naming, directory structure, coding style
+   - If significant deviations found:
+     - Add SUGGESTION: "Code pattern deviation: <details>"
+     - Recommendation: "Consider following project pattern: <example>"
+
+8. **Generate Verification Report**
+
+   **Summary Scorecard**:
+   ```
+   ## Verification Report: <change-name>
+
+   ### Summary
+   | Dimension    | Status           |
+   |--------------|------------------|
+   | Completeness | X/Y tasks, N reqs|
+   | Correctness  | M/N reqs covered |
+   | Coherence    | Followed/Issues  |
+   ```
+
+   **Issues by Priority**:
+
+   1. **CRITICAL** (Must fix before archive):
+      - Incomplete tasks
+      - Missing requirement implementations
+      - Each with specific, actionable recommendation
+
+   2. **WARNING** (Should fix):
+      - Spec/design divergences
+      - Missing scenario coverage
+      - Each with specific recommendation
+
+   3. **SUGGESTION** (Nice to fix):
+      - Pattern inconsistencies
+      - Minor improvements
+      - Each with specific recommendation
+
+   **Final Assessment**:
+   - If CRITICAL issues: "X critical issue(s) found. Fix before archiving."
+   - If only warnings: "No critical issues. Y warning(s) to consider. Ready for archive (with noted improvements)."
+   - If all clear: "All checks passed. Ready for archive."
+
+**Verification Heuristics**
+
+- **Completeness**: Focus on objective checklist items (checkboxes, requirements list)
+- **Correctness**: Use keyword search, file path analysis, reasonable inference - don't require perfect certainty
+- **Coherence**: Look for glaring inconsistencies, don't nitpick style
+- **False Positives**: When uncertain, prefer SUGGESTION over WARNING, WARNING over CRITICAL
+- **Actionability**: Every issue must have a specific recommendation with file/line references where applicable
+
+**Graceful Degradation**
+
+- If only tasks.md exists: verify task completion only, skip spec/design checks
+- If tasks + specs exist: verify completeness and correctness, skip design
+- If full artifacts: verify all three dimensions
+- Always note which checks were skipped and why
+
+**Output Format**
+
+Use clear markdown with:
+- Table for summary scorecard
+- Grouped lists for issues (CRITICAL/WARNING/SUGGESTION)
+- Code references in format: `file.ts:123`
+- Specific, actionable recommendations
+- No vague suggestions like "consider reviewing"
diff --git a/.opencode/skills/openspec-apply-change/SKILL.md b/.opencode/skills/openspec-apply-change/SKILL.md
new file mode 100644
index 000000000..e44e01f95
--- /dev/null
+++ b/.opencode/skills/openspec-apply-change/SKILL.md
@@ -0,0 +1,160 @@
+---
+name: openspec-apply-change
+description: Implement tasks from an OpenSpec change. Use when the user wants to start implementing, continue implementation, or work through tasks.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Implement tasks from an OpenSpec change.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **Select the change**
+
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes and use the **AskUserQuestion tool** to let the user select
+
+   Always announce: "Using change: <name>" and how to override (e.g., `/opsx-apply <other>`).
+
+2. **Check status to understand the schema**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used (e.g., "spec-driven")
+   - `planningHome`, `changeRoot`, and `actionContext`: planning scope and edit constraints
+   - Which artifact contains the tasks (typically "tasks" for spec-driven, check status for others)
+
+3. **Get apply instructions**
+
+   ```bash
+   openspec instructions apply --change "<name>" --json
+   ```
+
+   This returns:
+   - `contextFiles`: artifact ID -> array of concrete file paths (varies by schema - could be proposal/specs/design/tasks or spec/tests/implementation/docs)
+   - Progress (total, complete, remaining)
+   - Task list with status
+   - Dynamic instruction based on current state
+
+   **Handle states:**
+   - If `state: "blocked"` (missing artifacts): show message, suggest using openspec-continue-change
+   - If `state: "all_done"`: congratulate, suggest archive
+   - Otherwise: proceed to implementation
+
+4. **Read context files**
+
+   Read every file path listed under `contextFiles` from the apply instructions output.
+   The files depend on the schema being used:
+   - **spec-driven**: proposal, specs, design, tasks
+   - Other schemas: follow the contextFiles from CLI output
+
+5. **Show current progress**
+
+   Display:
+   - Schema being used
+   - Progress: "N/M tasks complete"
+   - Remaining tasks overview
+   - Dynamic instruction from CLI
+
+6. **Implement tasks (loop until done or blocked)**
+
+   For each pending task:
+   - Show which task is being worked on
+   - Make the code changes required
+   - Keep changes minimal and focused
+   - Mark task complete in the tasks file: `- [ ]` → `- [x]`
+   - Continue to next task
+
+   **Pause if:**
+   - Task is unclear → ask for clarification
+   - Implementation reveals a design issue → suggest updating artifacts
+   - Error or blocker encountered → report and wait for guidance
+   - User interrupts
+
+7. **On completion or pause, show status**
+
+   Display:
+   - Tasks completed this session
+   - Overall progress: "N/M tasks complete"
+   - If all done: suggest archive
+   - If paused: explain why and wait for guidance
+
+**Output During Implementation**
+
+```
+## Implementing: <change-name> (schema: <schema-name>)
+
+Working on task 3/7: <task description>
+[...implementation happening...]
+✓ Task complete
+
+Working on task 4/7: <task description>
+[...implementation happening...]
+✓ Task complete
+```
+
+**Output On Completion**
+
+```
+## Implementation Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Progress:** 7/7 tasks complete ✓
+
+### Completed This Session
+- [x] Task 1
+- [x] Task 2
+...
+
+All tasks complete! Ready to archive this change.
+```
+
+**Output On Pause (Issue Encountered)**
+
+```
+## Implementation Paused
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Progress:** 4/7 tasks complete
+
+### Issue Encountered
+<description of the issue>
+
+**Options:**
+1. <option 1>
+2. <option 2>
+3. Other approach
+
+What would you like to do?
+```
+
+**Guardrails**
+- Keep going through tasks until done or blocked
+- Always read context files before starting (from the apply instructions output)
+- If task is ambiguous, pause and ask before implementing
+- If implementation reveals issues, pause and suggest artifact updates
+- Keep code changes minimal and scoped to each task
+- Update task checkbox immediately after completing each task
+- Pause on errors, blockers, or unclear requirements - don't guess
+- Use contextFiles from CLI output, don't assume specific file names
+
+**Fluid Workflow Integration**
+
+This skill supports the "actions on a change" model:
+
+- **Can be invoked anytime**: Before all artifacts are done (if tasks exist), after partial implementation, interleaved with other actions
+- **Allows artifact updates**: If implementation reveals design issues, suggest updating artifacts - not phase-locked, work fluidly
diff --git a/.opencode/skills/openspec-archive-change/SKILL.md b/.opencode/skills/openspec-archive-change/SKILL.md
new file mode 100644
index 000000000..c0c169d14
--- /dev/null
+++ b/.opencode/skills/openspec-archive-change/SKILL.md
@@ -0,0 +1,118 @@
+---
+name: openspec-archive-change
+description: Archive a completed change in the experimental workflow. Use when the user wants to finalize and archive a change after implementation is complete.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Archive a completed change in the experimental workflow.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show only active changes (not already archived).
+   Include the schema used for each change if available.
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Check artifact completion status**
+
+   Run `openspec status --change "<name>" --json` to check artifact completion.
+
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context
+   - `artifacts`: List of artifacts with their status (`done` or other)
+
+   **If any artifacts are not `done`:**
+   - Display warning listing incomplete artifacts
+   - Use **AskUserQuestion tool** to confirm user wants to proceed
+   - Proceed if user confirms
+
+3. **Check task completion status**
+
+   Read the tasks file (typically `tasks.md`) to check for incomplete tasks.
+
+   Count tasks marked with `- [ ]` (incomplete) vs `- [x]` (complete).
+
+   **If incomplete tasks found:**
+   - Display warning showing count of incomplete tasks
+   - Use **AskUserQuestion tool** to confirm user wants to proceed
+   - Proceed if user confirms
+
+   **If no tasks file exists:** Proceed without task-related warning.
+
+4. **Assess delta spec sync state**
+
+   Use `artifactPaths.specs.existingOutputPaths` from status JSON to check for delta specs. If none exist, proceed without sync prompt.
+
+   **If delta specs exist:**
+   - Compare each delta spec with its corresponding main spec at `openspec/specs/<capability>/spec.md`
+   - Determine what changes would be applied (adds, modifications, removals, renames)
+   - Show a combined summary before prompting
+
+   **Prompt options:**
+   - If changes needed: "Sync now (recommended)", "Archive without syncing"
+   - If already synced: "Archive now", "Sync anyway", "Cancel"
+
+   If user chooses sync, use Task tool (subagent_type: "general-purpose", prompt: "Use Skill tool to invoke openspec-sync-specs for change '<name>'. Delta spec analysis: <include the analyzed delta spec summary>"). Proceed to archive regardless of choice.
+
+5. **Perform the archive**
+
+   Create an `archive` directory under `planningHome.changesDir` if it doesn't exist:
+   ```bash
+   mkdir -p "<planningHome.changesDir>/archive"
+   ```
+
+   Generate target name using current date: `YYYY-MM-DD-<change-name>`
+
+   **Check if target already exists:**
+   - If yes: Fail with error, suggest renaming existing archive or using different date
+   - If no: Move `changeRoot` to the archive directory
+
+   ```bash
+   mv "<changeRoot>" "<planningHome.changesDir>/archive/YYYY-MM-DD-<name>"
+   ```
+
+6. **Display summary**
+
+   Show archive completion summary including:
+   - Change name
+   - Schema that was used
+   - Archive location
+   - Whether specs were synced (if applicable)
+   - Note about any warnings (incomplete artifacts/tasks)
+
+**Output On Success**
+
+```
+## Archive Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Archived to:** the archive path derived from `planningHome.changesDir`/YYYY-MM-DD-<name>/
+**Specs:** ✓ Synced to main specs (or "No delta specs" or "Sync skipped")
+
+All artifacts complete. All tasks complete.
+```
+
+**Guardrails**
+- Always prompt for change selection if not provided
+- Use artifact graph (openspec status --json) for completion checking
+- Don't block archive on warnings - just inform and confirm
+- Preserve .openspec.yaml when moving to archive (it moves with the directory)
+- Show clear summary of what happened
+- If sync is requested, use openspec-sync-specs approach (agent-driven)
+- If delta specs exist, always run the sync assessment and show the combined summary before prompting
diff --git a/.opencode/skills/openspec-bulk-archive-change/SKILL.md b/.opencode/skills/openspec-bulk-archive-change/SKILL.md
new file mode 100644
index 000000000..309152af7
--- /dev/null
+++ b/.opencode/skills/openspec-bulk-archive-change/SKILL.md
@@ -0,0 +1,249 @@
+---
+name: openspec-bulk-archive-change
+description: Archive multiple completed changes at once. Use when archiving several parallel changes.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Archive multiple completed changes in a single operation.
+
+This skill allows you to batch-archive changes, handling spec conflicts intelligently by checking the codebase to determine what's actually implemented.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: None required (prompts for selection)
+
+**Steps**
+
+1. **Get active changes**
+
+   Run `openspec list --json` to get all active changes.
+
+   If no active changes exist, inform user and stop.
+
+2. **Prompt for change selection**
+
+   Use **AskUserQuestion tool** with multi-select to let user choose changes:
+   - Show each change with its schema
+   - Include an option for "All changes"
+   - Allow any number of selections (1+ works, 2+ is the typical use case)
+
+   **IMPORTANT**: Do NOT auto-select. Always let the user choose.
+
+3. **Batch validation - gather status for all selected changes**
+
+   For each selected change, collect:
+
+   a. **Artifact status** - Run `openspec status --change "<name>" --json`
+      - Parse `schemaName`, `artifacts`, `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`
+      - Note which artifacts are `done` vs other states
+
+   b. **Task completion** - Read `artifactPaths.tasks.existingOutputPaths` from status JSON
+      - Count `- [ ]` (incomplete) vs `- [x]` (complete)
+      - If no tasks file exists, note as "No tasks"
+
+   c. **Delta specs** - Check `artifactPaths.specs.existingOutputPaths` from status JSON
+      - List which capability specs exist
+      - For each, extract requirement names (lines matching `### Requirement: <name>`)
+
+4. **Detect spec conflicts**
+
+   Build a map of `capability -> [changes that touch it]`:
+
+   ```
+   auth -> [change-a, change-b]  <- CONFLICT (2+ changes)
+   api  -> [change-c]            <- OK (only 1 change)
+   ```
+
+   A conflict exists when 2+ selected changes have delta specs for the same capability.
+
+5. **Resolve conflicts agentically**
+
+   **For each conflict**, investigate the codebase:
+
+   a. **Read the delta specs** from each conflicting change to understand what each claims to add/modify
+
+   b. **Search the codebase** for implementation evidence:
+      - Look for code implementing requirements from each delta spec
+      - Check for related files, functions, or tests
+
+   c. **Determine resolution**:
+      - If only one change is actually implemented -> sync that one's specs
+      - If both implemented -> apply in chronological order (older first, newer overwrites)
+      - If neither implemented -> skip spec sync, warn user
+
+   d. **Record resolution** for each conflict:
+      - Which change's specs to apply
+      - In what order (if both)
+      - Rationale (what was found in codebase)
+
+6. **Show consolidated status table**
+
+   Display a table summarizing all changes:
+
+   ```
+   | Change              | Artifacts | Tasks | Specs   | Conflicts | Status |
+   |---------------------|-----------|-------|---------|-----------|--------|
+   | schema-management   | Done      | 5/5   | 2 delta | None      | Ready  |
+   | project-config      | Done      | 3/3   | 1 delta | None      | Ready  |
+   | add-oauth           | Done      | 4/4   | 1 delta | auth (!)  | Ready* |
+   | add-verify-skill    | 1 left    | 2/5   | None    | None      | Warn   |
+   ```
+
+   For conflicts, show the resolution:
+   ```
+   * Conflict resolution:
+     - auth spec: Will apply add-oauth then add-jwt (both implemented, chronological order)
+   ```
+
+   For incomplete changes, show warnings:
+   ```
+   Warnings:
+   - add-verify-skill: 1 incomplete artifact, 3 incomplete tasks
+   ```
+
+7. **Confirm batch operation**
+
+   Use **AskUserQuestion tool** with a single confirmation:
+
+   - "Archive N changes?" with options based on status
+   - Options might include:
+     - "Archive all N changes"
+     - "Archive only N ready changes (skip incomplete)"
+     - "Cancel"
+
+   If there are incomplete changes, make clear they'll be archived with warnings.
+
+8. **Execute archive for each confirmed change**
+
+   Process changes in the determined order (respecting conflict resolution):
+
+   a. **Sync specs** if delta specs exist:
+      - Use the openspec-sync-specs approach (agent-driven intelligent merge)
+      - For conflicts, apply in resolved order
+      - Track if sync was done
+
+   b. **Perform the archive**:
+      ```bash
+      mkdir -p "<planningHome.changesDir>/archive"
+      mv "<changeRoot>" "<planningHome.changesDir>/archive/YYYY-MM-DD-<name>"
+      ```
+
+   c. **Track outcome** for each change:
+      - Success: archived successfully
+      - Failed: error during archive (record error)
+      - Skipped: user chose not to archive (if applicable)
+
+9. **Display summary**
+
+   Show final results:
+
+   ```
+   ## Bulk Archive Complete
+
+   Archived 3 changes:
+   - schema-management-cli -> archive/2026-01-19-schema-management-cli/
+   - project-config -> archive/2026-01-19-project-config/
+   - add-oauth -> archive/2026-01-19-add-oauth/
+
+   Skipped 1 change:
+   - add-verify-skill (user chose not to archive incomplete)
+
+   Spec sync summary:
+   - 4 delta specs synced to main specs
+   - 1 conflict resolved (auth: applied both in chronological order)
+   ```
+
+   If any failures:
+   ```
+   Failed 1 change:
+   - some-change: Archive directory already exists
+   ```
+
+**Conflict Resolution Examples**
+
+Example 1: Only one implemented
+```
+Conflict: specs/auth/spec.md touched by [add-oauth, add-jwt]
+
+Checking add-oauth:
+- Delta adds "OAuth Provider Integration" requirement
+- Searching codebase... found src/auth/oauth.ts implementing OAuth flow
+
+Checking add-jwt:
+- Delta adds "JWT Token Handling" requirement
+- Searching codebase... no JWT implementation found
+
+Resolution: Only add-oauth is implemented. Will sync add-oauth specs only.
+```
+
+Example 2: Both implemented
+```
+Conflict: specs/api/spec.md touched by [add-rest-api, add-graphql]
+
+Checking add-rest-api (created 2026-01-10):
+- Delta adds "REST Endpoints" requirement
+- Searching codebase... found src/api/rest.ts
+
+Checking add-graphql (created 2026-01-15):
+- Delta adds "GraphQL Schema" requirement
+- Searching codebase... found src/api/graphql.ts
+
+Resolution: Both implemented. Will apply add-rest-api specs first,
+then add-graphql specs (chronological order, newer takes precedence).
+```
+
+**Output On Success**
+
+```
+## Bulk Archive Complete
+
+Archived N changes:
+- <change-1> -> archive/YYYY-MM-DD-<change-1>/
+- <change-2> -> archive/YYYY-MM-DD-<change-2>/
+
+Spec sync summary:
+- N delta specs synced to main specs
+- No conflicts (or: M conflicts resolved)
+```
+
+**Output On Partial Success**
+
+```
+## Bulk Archive Complete (partial)
+
+Archived N changes:
+- <change-1> -> archive/YYYY-MM-DD-<change-1>/
+
+Skipped M changes:
+- <change-2> (user chose not to archive incomplete)
+
+Failed K changes:
+- <change-3>: Archive directory already exists
+```
+
+**Output When No Changes**
+
+```
+## No Changes to Archive
+
+No active changes found. Create a new change to get started.
+```
+
+**Guardrails**
+- Allow any number of changes (1+ is fine, 2+ is the typical use case)
+- Always prompt for selection, never auto-select
+- Detect spec conflicts early and resolve by checking codebase
+- When both changes are implemented, apply specs in chronological order
+- Skip spec sync only when implementation is missing (warn user)
+- Show clear per-change status before confirming
+- Use single confirmation for entire batch
+- Track and report all outcomes (success/skip/fail)
+- Preserve .openspec.yaml when moving to archive
+- Archive directory target uses current date: YYYY-MM-DD-<name>
+- If archive target exists, fail that change but continue with others
diff --git a/.opencode/skills/openspec-continue-change/SKILL.md b/.opencode/skills/openspec-continue-change/SKILL.md
new file mode 100644
index 000000000..31b476f24
--- /dev/null
+++ b/.opencode/skills/openspec-continue-change/SKILL.md
@@ -0,0 +1,122 @@
+---
+name: openspec-continue-change
+description: Continue working on an OpenSpec change by creating the next artifact. Use when the user wants to progress their change, create the next artifact, or continue their workflow.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Continue working on a change by creating the next artifact.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes sorted by most recently modified. Then use the **AskUserQuestion tool** to let the user select which change to work on.
+
+   Present the top 3-4 most recently modified changes as options, showing:
+   - Change name
+   - Schema (from `schema` field if present, otherwise "spec-driven")
+   - Status (e.g., "0/5 tasks", "complete", "no tasks")
+   - How recently it was modified (from `lastModified` field)
+
+   Mark the most recently modified change as "(Recommended)" since it's likely what the user wants to continue.
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Check current status**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand current state. The response includes:
+   - `schemaName`: The workflow schema being used (e.g., "spec-driven")
+   - `artifacts`: Array of artifacts with their status ("done", "ready", "blocked")
+   - `isComplete`: Boolean indicating if all artifacts are complete
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context. Use these instead of assuming repo-local paths.
+
+3. **Act based on status**:
+
+   ---
+
+   **If all artifacts are complete (`isComplete: true`)**:
+   - Congratulate the user
+   - Show final status including the schema used
+   - Suggest: "All artifacts created! You can now implement this change or archive it."
+   - STOP
+
+   ---
+
+   **If artifacts are ready to create** (status shows artifacts with `status: "ready"`):
+   - Pick the FIRST artifact with `status: "ready"` from the status output
+   - Get its instructions:
+     ```bash
+     openspec instructions <artifact-id> --change "<name>" --json
+     ```
+   - Parse the JSON. The key fields are:
+     - `context`: Project background (constraints for you - do NOT include in output)
+     - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
+     - `template`: The structure to use for your output file
+     - `instruction`: Schema-specific guidance
+     - `resolvedOutputPath`: Resolved path or pattern to write the artifact
+     - `dependencies`: Completed artifacts to read for context
+   - **Create the artifact file**:
+     - Read any completed dependency files for context
+     - Use `template` as the structure - fill in its sections
+     - Apply `context` and `rules` as constraints when writing - but do NOT copy them into the file
+     - Write to the `resolvedOutputPath` specified in instructions. If it is a glob pattern, choose the concrete file path using the schema instruction and the change's context
+   - Show what was created and what's now unlocked
+   - STOP after creating ONE artifact
+
+   ---
+
+   **If no artifacts are ready (all blocked)**:
+   - This shouldn't happen with a valid schema
+   - Show status and suggest checking for issues
+
+4. **After creating an artifact, show progress**
+   ```bash
+   openspec status --change "<name>"
+   ```
+
+**Output**
+
+After each invocation, show:
+- Which artifact was created
+- Schema workflow being used
+- Current progress (N/M complete)
+- What artifacts are now unlocked
+- Prompt: "Want to continue? Just ask me to continue or tell me what to do next."
+
+**Artifact Creation Guidelines**
+
+The artifact types and their purpose depend on the schema. Use the `instruction` field from the instructions output to understand what to create.
+
+Common artifact patterns:
+
+**spec-driven schema** (proposal → specs → design → tasks):
+- **proposal.md**: Ask user about the change if not clear. Fill in Why, What Changes, Capabilities, Impact.
+  - The Capabilities section is critical - each capability listed will need a spec file.
+- **specs/<capability>/spec.md**: Create one spec per capability listed in the proposal's Capabilities section (use the capability name, not the change name).
+- **design.md**: Document technical decisions, architecture, and implementation approach.
+- **tasks.md**: Break down implementation into checkboxed tasks.
+
+For other schemas, follow the `instruction` field from the CLI output.
+
+**Guardrails**
+- Create ONE artifact per invocation
+- Always read dependency artifacts before creating a new one
+- Never skip artifacts or create out of order
+- If context is unclear, ask the user before creating
+- Verify the artifact file exists after writing before marking progress
+- Use the schema's artifact sequence, don't assume specific artifact names
+- **IMPORTANT**: `context` and `rules` are constraints for YOU, not content for the file
+  - Do NOT copy `<context>`, `<rules>`, `<project_context>` blocks into the artifact
+  - These guide what you write, but should never appear in the output
diff --git a/.opencode/skills/openspec-explore/SKILL.md b/.opencode/skills/openspec-explore/SKILL.md
new file mode 100644
index 000000000..894ef32e2
--- /dev/null
+++ b/.opencode/skills/openspec-explore/SKILL.md
@@ -0,0 +1,290 @@
+---
+name: openspec-explore
+description: Enter explore mode - a thinking partner for exploring ideas, investigating problems, and clarifying requirements. Use when the user wants to think through something before or during a change.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Enter explore mode. Think deeply. Visualize freely. Follow the conversation wherever it goes.
+
+**IMPORTANT: Explore mode is for thinking, not implementing.** You may read files, search code, and investigate the codebase, but you must NEVER write code or implement features. If the user asks you to implement something, remind them to exit explore mode first and create a change proposal. You MAY create OpenSpec artifacts (proposals, designs, specs) if the user asks—that's capturing thinking, not implementing.
+
+**This is a stance, not a workflow.** There are no fixed steps, no required sequence, no mandatory outputs. You're a thinking partner helping the user explore.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+---
+
+## The Stance
+
+- **Curious, not prescriptive** - Ask questions that emerge naturally, don't follow a script
+- **Open threads, not interrogations** - Surface multiple interesting directions and let the user follow what resonates. Don't funnel them through a single path of questions.
+- **Visual** - Use ASCII diagrams liberally when they'd help clarify thinking
+- **Adaptive** - Follow interesting threads, pivot when new information emerges
+- **Patient** - Don't rush to conclusions, let the shape of the problem emerge
+- **Grounded** - Explore the actual codebase when relevant, don't just theorize
+
+---
+
+## What You Might Do
+
+Depending on what the user brings, you might:
+
+**Explore the problem space**
+- Ask clarifying questions that emerge from what they said
+- Challenge assumptions
+- Reframe the problem
+- Find analogies
+
+**Investigate the codebase**
+- Map existing architecture relevant to the discussion
+- Find integration points
+- Identify patterns already in use
+- Surface hidden complexity
+
+**Compare options**
+- Brainstorm multiple approaches
+- Build comparison tables
+- Sketch tradeoffs
+- Recommend a path (if asked)
+
+**Visualize**
+```
+┌─────────────────────────────────────────┐
+│     Use ASCII diagrams liberally        │
+├─────────────────────────────────────────┤
+│                                         │
+│      ┌────────┐         ┌────────┐      │
+│      │ State  │────────▶│ State  │      │
+│      │   A    │         │   B    │      │
+│      └────────┘         └────────┘      │
+│                                         │
+│   System diagrams, state machines,      │
+│   data flows, architecture sketches,    │
+│   dependency graphs, comparison tables  │
+│                                         │
+└─────────────────────────────────────────┘
+```
+
+**Surface risks and unknowns**
+- Identify what could go wrong
+- Find gaps in understanding
+- Suggest spikes or investigations
+
+---
+
+## OpenSpec Awareness
+
+You have full context of the OpenSpec system. Use it naturally, don't force it.
+
+### Check for context
+
+At the start, quickly check what exists:
+```bash
+openspec list --json
+```
+
+This tells you:
+- If there are active changes
+- Their names, schemas, and status
+- What the user might be working on
+
+### When no change exists
+
+Think freely. When insights crystallize, you might offer:
+
+- "This feels solid enough to start a change. Want me to create a proposal?"
+- Or keep exploring - no pressure to formalize
+
+### When a change exists
+
+If the user mentions a change or you detect one is relevant:
+
+1. **Resolve and read existing artifacts for context**
+   - Run `openspec status --change "<name>" --json`.
+   - Use `changeRoot`, `artifactPaths`, and `actionContext` from the status JSON.
+   - Read existing files from `artifactPaths.<artifact>.existingOutputPaths`.
+
+2. **Reference them naturally in conversation**
+   - "Your design mentions using Redis, but we just realized SQLite fits better..."
+   - "The proposal scopes this to premium users, but we're now thinking everyone..."
+
+3. **Offer to capture when decisions are made**
+
+    | Insight Type               | Where to Capture               |
+    |----------------------------|--------------------------------|
+    | New requirement discovered | `specs/<capability>/spec.md` |
+    | Requirement changed        | `specs/<capability>/spec.md` |
+    | Design decision made       | `design.md`                  |
+    | Scope changed              | `proposal.md`                |
+    | New work identified        | `tasks.md`                   |
+    | Assumption invalidated     | Relevant artifact              |
+
+   Example offers:
+   - "That's a design decision. Capture it in design.md?"
+   - "This is a new requirement. Add it to specs?"
+   - "This changes scope. Update the proposal?"
+
+4. **The user decides** - Offer and move on. Don't pressure. Don't auto-capture.
+
+---
+
+## What You Don't Have To Do
+
+- Follow a script
+- Ask the same questions every time
+- Produce a specific artifact
+- Reach a conclusion
+- Stay on topic if a tangent is valuable
+- Be brief (this is thinking time)
+
+---
+
+## Handling Different Entry Points
+
+**User brings a vague idea:**
+```
+User: I'm thinking about adding real-time collaboration
+
+You: Real-time collab is a big space. Let me think about this...
+
+      COLLABORATION SPECTRUM
+      ════════════════════════════════════════════
+
+      Awareness          Coordination         Sync
+          │                   │                 │
+          ▼                   ▼                 ▼
+      ┌────────┐         ┌────────┐        ┌────────┐
+      │Presence│         │Cursors │        │  CRDT  │
+      │  "3    │         │ Multi  │        │Conflict│
+      │online" │         │ select │        │  free  │
+      └────────┘         └────────┘        └────────┘
+          │                   │                 │
+       trivial            moderate           complex
+
+      Where's your head at?
+```
+
+**User brings a specific problem:**
+```
+User: The auth system is a mess
+
+You: [reads codebase]
+
+     ┌─────────────────────────────────────────────┐
+     │              CURRENT AUTH FLOW              │
+     └─────────────────────────────────────────────┘
+                        │
+          ┌─────────────┼─────────────┐
+          ▼             ▼             ▼
+     ┌─────────┐  ┌─────────┐  ┌─────────┐
+     │ Google  │  │  GitHub │  │  Email  │
+     │  OAuth  │  │  OAuth  │  │  Magic  │
+     └────┬────┘  └────┬────┘  └────┬────┘
+          │             │             │
+          └─────────────┼─────────────┘
+                        ▼
+                  ┌───────────┐
+                  │  Session  │
+                  └─────┬─────┘
+                        │
+                        ▼
+                  ┌───────────┐
+                  │   Perms   │
+                  └───────────┘
+
+     I see three tangles. Which one's burning?
+```
+
+**User is stuck mid-implementation:**
+```
+User: /opsx-explore add-auth-system
+      The OAuth integration is more complex than expected
+
+You: [reads change artifacts]
+
+     You're on task 4: "Implement OAuth flow"
+
+     Let me trace what's involved...
+
+     [draws diagram, explores options, suggests paths]
+
+     Want to update the design to reflect this?
+     Or add a spike task to investigate?
+```
+
+**User wants to compare options:**
+```
+User: Should we use Postgres or SQLite?
+
+You: Generic answer is boring. What's the context?
+
+User: A CLI tool that tracks local dev environments
+
+You: That changes everything.
+
+     ┌─────────────────────────────────────────────────┐
+     │          CLI TOOL DATA STORAGE                  │
+     └─────────────────────────────────────────────────┘
+
+     Key constraints:
+     • No daemon running
+     • Must work offline
+     • Single user
+
+                  SQLite          Postgres
+     Deployment   embedded ✓      needs server ✗
+     Offline      yes ✓           no ✗
+     Single file  yes ✓           no ✗
+
+     SQLite. Not even close.
+
+     Unless... is there a sync component?
+```
+
+---
+
+## Ending Discovery
+
+There's no required ending. Discovery might:
+
+- **Flow into a proposal**: "Ready to start? I can create a change proposal."
+- **Result in artifact updates**: "Updated design.md with these decisions"
+- **Just provide clarity**: User has what they need, moves on
+- **Continue later**: "We can pick this up anytime"
+
+When it feels like things are crystallizing, you might summarize:
+
+```
+## What We Figured Out
+
+**The problem**: [crystallized understanding]
+
+**The approach**: [if one emerged]
+
+**Open questions**: [if any remain]
+
+**Next steps** (if ready):
+- Create a change proposal
+- Keep exploring: just keep talking
+```
+
+But this summary is optional. Sometimes the thinking IS the value.
+
+---
+
+## Guardrails
+
+- **Don't implement** - Never write code or implement features. Creating OpenSpec artifacts is fine, writing application code is not.
+- **Don't fake understanding** - If something is unclear, dig deeper
+- **Don't rush** - Discovery is thinking time, not task time
+- **Don't force structure** - Let patterns emerge naturally
+- **Don't auto-capture** - Offer to save insights, don't just do it
+- **Do visualize** - A good diagram is worth many paragraphs
+- **Do explore the codebase** - Ground discussions in reality
+- **Do question assumptions** - Including the user's and your own
diff --git a/.opencode/skills/openspec-ff-change/SKILL.md b/.opencode/skills/openspec-ff-change/SKILL.md
new file mode 100644
index 000000000..81780739b
--- /dev/null
+++ b/.opencode/skills/openspec-ff-change/SKILL.md
@@ -0,0 +1,105 @@
+---
+name: openspec-ff-change
+description: Fast-forward through OpenSpec artifact creation. Use when the user wants to quickly create all artifacts needed for implementation without stepping through each one individually.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Fast-forward through artifact creation - generate everything needed to start implementation in one go.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: The user's request should include a change name (kebab-case) OR a description of what they want to build.
+
+**Steps**
+
+1. **If no clear input provided, ask what they want to build**
+
+   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
+   > "What change do you want to work on? Describe what you want to build or fix."
+
+   From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
+
+   **IMPORTANT**: Do NOT proceed without understanding what the user wants to build.
+
+2. **Create the change directory**
+   ```bash
+   openspec new change "<name>"
+   ```
+   This creates a scaffolded change in the planning home resolved by the CLI.
+
+3. **Get the artifact build order**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to get:
+   - `applyRequires`: array of artifact IDs needed before implementation (e.g., `["tasks"]`)
+   - `artifacts`: list of all artifacts with their status and dependencies
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context. Use these instead of assuming repo-local paths.
+
+4. **Create artifacts in sequence until apply-ready**
+
+   Use the **TodoWrite tool** to track progress through the artifacts.
+
+   Loop through artifacts in dependency order (artifacts with no pending dependencies first):
+
+   a. **For each artifact that is `ready` (dependencies satisfied)**:
+      - Get instructions:
+        ```bash
+        openspec instructions <artifact-id> --change "<name>" --json
+        ```
+      - The instructions JSON includes:
+        - `context`: Project background (constraints for you - do NOT include in output)
+        - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
+        - `template`: The structure to use for your output file
+        - `instruction`: Schema-specific guidance for this artifact type
+        - `resolvedOutputPath`: Resolved path or pattern to write the artifact
+        - `dependencies`: Completed artifacts to read for context
+      - Read any completed dependency files for context
+      - Create the artifact file using `template` as the structure and write it to `resolvedOutputPath`
+      - Apply `context` and `rules` as constraints - but do NOT copy them into the file
+      - Show brief progress: "✓ Created <artifact-id>"
+
+   b. **Continue until all `applyRequires` artifacts are complete**
+      - After creating each artifact, re-run `openspec status --change "<name>" --json`
+      - Check if every artifact ID in `applyRequires` has `status: "done"` in the artifacts array
+      - Stop when all `applyRequires` artifacts are done
+
+   c. **If an artifact requires user input** (unclear context):
+      - Use **AskUserQuestion tool** to clarify
+      - Then continue with creation
+
+5. **Show final status**
+   ```bash
+   openspec status --change "<name>"
+   ```
+
+**Output**
+
+After completing all artifacts, summarize:
+- Change name and location
+- List of artifacts created with brief descriptions
+- What's ready: "All artifacts created! Ready for implementation."
+- Prompt: "Run `/opsx-apply` or ask me to implement to start working on the tasks."
+
+**Artifact Creation Guidelines**
+
+- Follow the `instruction` field from `openspec instructions` for each artifact type
+- The schema defines what each artifact should contain - follow it
+- Read dependency artifacts for context before creating new ones
+- Use `template` as the structure for your output file - fill in its sections
+- **IMPORTANT**: `context` and `rules` are constraints for YOU, not content for the file
+  - Do NOT copy `<context>`, `<rules>`, `<project_context>` blocks into the artifact
+  - These guide what you write, but should never appear in the output
+
+**Guardrails**
+- Create ALL artifacts needed for implementation (as defined by schema's `apply.requires`)
+- Always read dependency artifacts before creating a new one
+- If context is critically unclear, ask the user - but prefer making reasonable decisions to keep momentum
+- If a change with that name already exists, suggest continuing that change instead
+- Verify each artifact file exists after writing before proceeding to next
diff --git a/.opencode/skills/openspec-new-change/SKILL.md b/.opencode/skills/openspec-new-change/SKILL.md
new file mode 100644
index 000000000..b4d8a9e70
--- /dev/null
+++ b/.opencode/skills/openspec-new-change/SKILL.md
@@ -0,0 +1,77 @@
+---
+name: openspec-new-change
+description: Start a new OpenSpec change using the experimental artifact workflow. Use when the user wants to create a new feature, fix, or modification with a structured step-by-step approach.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Start a new change using the experimental artifact-driven approach.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: The user's request should include a change name (kebab-case) OR a description of what they want to build.
+
+**Steps**
+
+1. **If no clear input provided, ask what they want to build**
+
+   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
+   > "What change do you want to work on? Describe what you want to build or fix."
+
+   From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
+
+   **IMPORTANT**: Do NOT proceed without understanding what the user wants to build.
+
+2. **Determine the workflow schema**
+
+   Use the default schema (omit `--schema`) unless the user explicitly requests a different workflow.
+
+   **Use a different schema only if the user mentions:**
+   - A specific schema name → use `--schema <name>`
+   - "show workflows" or "what workflows" → run `openspec schemas --json` and let them choose
+
+   **Otherwise**: Omit `--schema` to use the default.
+
+3. **Create the change directory**
+   ```bash
+   openspec new change "<name>"
+   ```
+   Add `--schema <name>` only if the user requested a specific workflow.
+   This creates a scaffolded change in the planning home resolved by the CLI.
+
+4. **Show the artifact status**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Use the returned `planningHome`, `changeRoot`, `artifactPaths`, and `nextSteps` instead of assuming repo-local paths.
+
+5. **Get instructions for the first artifact**
+   The first artifact depends on the schema (e.g., `proposal` for spec-driven).
+   Check the status output to find the first artifact with status "ready".
+   ```bash
+   openspec instructions <first-artifact-id> --change "<name>"
+   ```
+   This outputs the template and context for creating the first artifact.
+
+6. **STOP and wait for user direction**
+
+**Output**
+
+After completing the steps, summarize:
+- Change name and location
+- Schema/workflow being used and its artifact sequence
+- Current status (0/N artifacts complete)
+- The template for the first artifact
+- Prompt: "Ready to create the first artifact? Just describe what this change is about and I'll draft it, or ask me to continue."
+
+**Guardrails**
+- Do NOT create any artifacts yet - just show the instructions
+- Do NOT advance beyond showing the first artifact template
+- If the name is invalid (not kebab-case), ask for a valid name
+- If a change with that name already exists, suggest continuing that change instead
+- Pass --schema if using a non-default workflow
diff --git a/.opencode/skills/openspec-onboard/SKILL.md b/.opencode/skills/openspec-onboard/SKILL.md
new file mode 100644
index 000000000..52c4228fc
--- /dev/null
+++ b/.opencode/skills/openspec-onboard/SKILL.md
@@ -0,0 +1,555 @@
+---
+name: openspec-onboard
+description: Guided onboarding for OpenSpec - walk through a complete workflow cycle with narration and real codebase work.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Guide the user through their first complete OpenSpec workflow cycle. This is a teaching experience—you'll do real work in their codebase while explaining each step.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+---
+
+## Preflight
+
+Before starting, check if the OpenSpec CLI is installed:
+
+```bash
+# Unix/macOS
+openspec --version 2>&1 || echo "CLI_NOT_INSTALLED"
+# Windows (PowerShell)
+# if (Get-Command openspec -ErrorAction SilentlyContinue) { openspec --version } else { echo "CLI_NOT_INSTALLED" }
+```
+
+**If CLI not installed:**
+> OpenSpec CLI is not installed. Install it first, then come back to `/opsx-onboard`.
+
+Stop here if not installed.
+
+---
+
+## Phase 1: Welcome
+
+Display:
+
+```
+## Welcome to OpenSpec!
+
+I'll walk you through a complete change cycle—from idea to implementation—using a real task in your codebase. Along the way, you'll learn the workflow by doing it.
+
+**What we'll do:**
+1. Pick a small, real task in your codebase
+2. Explore the problem briefly
+3. Create a change (the container for our work)
+4. Build the artifacts: proposal → specs → design → tasks
+5. Implement the tasks
+6. Archive the completed change
+
+**Time:** ~15-20 minutes
+
+Let's start by finding something to work on.
+```
+
+---
+
+## Phase 2: Task Selection
+
+### Codebase Analysis
+
+Scan the codebase for small improvement opportunities. Look for:
+
+1. **TODO/FIXME comments** - Search for `TODO`, `FIXME`, `HACK`, `XXX` in code files
+2. **Missing error handling** - `catch` blocks that swallow errors, risky operations without try-catch
+3. **Functions without tests** - Cross-reference `src/` with test directories
+4. **Type issues** - `any` types in TypeScript files (`: any`, `as any`)
+5. **Debug artifacts** - `console.log`, `console.debug`, `debugger` statements in non-debug code
+6. **Missing validation** - User input handlers without validation
+
+Also check recent git activity:
+```bash
+# Unix/macOS
+git log --oneline -10 2>/dev/null || echo "No git history"
+# Windows (PowerShell)
+# git log --oneline -10 2>$null; if ($LASTEXITCODE -ne 0) { echo "No git history" }
+```
+
+### Present Suggestions
+
+From your analysis, present 3-4 specific suggestions:
+
+```
+## Task Suggestions
+
+Based on scanning your codebase, here are some good starter tasks:
+
+**1. [Most promising task]**
+   Location: `src/path/to/file.ts:42`
+   Scope: ~1-2 files, ~20-30 lines
+   Why it's good: [brief reason]
+
+**2. [Second task]**
+   Location: `src/another/file.ts`
+   Scope: ~1 file, ~15 lines
+   Why it's good: [brief reason]
+
+**3. [Third task]**
+   Location: [location]
+   Scope: [estimate]
+   Why it's good: [brief reason]
+
+**4. Something else?**
+   Tell me what you'd like to work on.
+
+Which task interests you? (Pick a number or describe your own)
+```
+
+**If nothing found:** Fall back to asking what the user wants to build:
+> I didn't find obvious quick wins in your codebase. What's something small you've been meaning to add or fix?
+
+### Scope Guardrail
+
+If the user picks or describes something too large (major feature, multi-day work):
+
+```
+That's a valuable task, but it's probably larger than ideal for your first OpenSpec run-through.
+
+For learning the workflow, smaller is better—it lets you see the full cycle without getting stuck in implementation details.
+
+**Options:**
+1. **Slice it smaller** - What's the smallest useful piece of [their task]? Maybe just [specific slice]?
+2. **Pick something else** - One of the other suggestions, or a different small task?
+3. **Do it anyway** - If you really want to tackle this, we can. Just know it'll take longer.
+
+What would you prefer?
+```
+
+Let the user override if they insist—this is a soft guardrail.
+
+---
+
+## Phase 3: Explore Demo
+
+Once a task is selected, briefly demonstrate explore mode:
+
+```
+Before we create a change, let me quickly show you **explore mode**—it's how you think through problems before committing to a direction.
+```
+
+Spend 1-2 minutes investigating the relevant code:
+- Read the file(s) involved
+- Draw a quick ASCII diagram if it helps
+- Note any considerations
+
+```
+## Quick Exploration
+
+[Your brief analysis—what you found, any considerations]
+
+┌─────────────────────────────────────────┐
+│   [Optional: ASCII diagram if helpful]  │
+└─────────────────────────────────────────┘
+
+Explore mode (`/opsx-explore`) is for this kind of thinking—investigating before implementing. You can use it anytime you need to think through a problem.
+
+Now let's create a change to hold our work.
+```
+
+**PAUSE** - Wait for user acknowledgment before proceeding.
+
+---
+
+## Phase 4: Create the Change
+
+**EXPLAIN:**
+```
+## Creating a Change
+
+A "change" in OpenSpec is a container for all the thinking and planning around a piece of work. It lives at the `changeRoot` reported by `openspec status --change "<name>" --json` and holds your artifacts—proposal, specs, design, tasks.
+
+Let me create one for our task.
+```
+
+**DO:** Create the change with a derived kebab-case name:
+```bash
+openspec new change "<derived-name>"
+```
+
+**SHOW:**
+```
+Created: <changeRoot from status JSON>
+
+The folder structure:
+```
+<changeRoot>/
+├── proposal.md    ← Why we're doing this (empty, we'll fill it)
+├── design.md      ← How we'll build it (empty)
+├── specs/         ← Detailed requirements (empty)
+└── tasks.md       ← Implementation checklist (empty)
+```
+
+Now let's fill in the first artifact—the proposal.
+```
+
+---
+
+## Phase 5: Proposal
+
+**EXPLAIN:**
+```
+## The Proposal
+
+The proposal captures **why** we're making this change and **what** it involves at a high level. It's the "elevator pitch" for the work.
+
+I'll draft one based on our task.
+```
+
+**DO:** Draft the proposal content (don't save yet):
+
+```
+Here's a draft proposal:
+
+---
+
+## Why
+
+[1-2 sentences explaining the problem/opportunity]
+
+## What Changes
+
+[Bullet points of what will be different]
+
+## Capabilities
+
+### New Capabilities
+- `<capability-name>`: [brief description]
+
+### Modified Capabilities
+<!-- If modifying existing behavior -->
+
+## Impact
+
+- `src/path/to/file.ts`: [what changes]
+- [other files if applicable]
+
+---
+
+Does this capture the intent? I can adjust before we save it.
+```
+
+**PAUSE** - Wait for user approval/feedback.
+
+After approval, save the proposal:
+```bash
+openspec instructions proposal --change "<name>" --json
+```
+Then write the content to the `resolvedOutputPath` from `openspec instructions proposal --change "<name>" --json`.
+
+```
+Proposal saved. This is your "why" document—you can always come back and refine it as understanding evolves.
+
+Next up: specs.
+```
+
+---
+
+## Phase 6: Specs
+
+**EXPLAIN:**
+```
+## Specs
+
+Specs define **what** we're building in precise, testable terms. They use a requirement/scenario format that makes expected behavior crystal clear.
+
+For a small task like this, we might only need one spec file.
+```
+
+**DO:** Resolve where the spec file should be created:
+```bash
+openspec instructions specs --change "<name>" --json
+# Use resolvedOutputPath from the JSON. If it is a glob, choose the concrete file path using the schema instruction and the change's context.
+```
+
+Draft the spec content:
+
+```
+Here's the spec:
+
+---
+
+## ADDED Requirements
+
+### Requirement: <Name>
+
+<Description of what the system should do>
+
+#### Scenario: <Scenario name>
+
+- **WHEN** <trigger condition>
+- **THEN** <expected outcome>
+- **AND** <additional outcome if needed>
+
+---
+
+This format—WHEN/THEN/AND—makes requirements testable. You can literally read them as test cases.
+```
+
+Save to the concrete file path chosen from `resolvedOutputPath`.
+
+---
+
+## Phase 7: Design
+
+**EXPLAIN:**
+```
+## Design
+
+The design captures **how** we'll build it—technical decisions, tradeoffs, approach.
+
+For small changes, this might be brief. That's fine—not every change needs deep design discussion.
+```
+
+**DO:** Draft design.md:
+
+```
+Here's the design:
+
+---
+
+## Context
+
+[Brief context about the current state]
+
+## Goals / Non-Goals
+
+**Goals:**
+- [What we're trying to achieve]
+
+**Non-Goals:**
+- [What's explicitly out of scope]
+
+## Decisions
+
+### Decision 1: [Key decision]
+
+[Explanation of approach and rationale]
+
+---
+
+For a small task, this captures the key decisions without over-engineering.
+```
+
+Save to the `resolvedOutputPath` from `openspec instructions design --change "<name>" --json`.
+
+---
+
+## Phase 8: Tasks
+
+**EXPLAIN:**
+```
+## Tasks
+
+Finally, we break the work into implementation tasks—checkboxes that drive the apply phase.
+
+These should be small, clear, and in logical order.
+```
+
+**DO:** Generate tasks based on specs and design:
+
+```
+Here are the implementation tasks:
+
+---
+
+## 1. [Category or file]
+
+- [ ] 1.1 [Specific task]
+- [ ] 1.2 [Specific task]
+
+## 2. Verify
+
+- [ ] 2.1 [Verification step]
+
+---
+
+Each checkbox becomes a unit of work in the apply phase. Ready to implement?
+```
+
+**PAUSE** - Wait for user to confirm they're ready to implement.
+
+Save to the `resolvedOutputPath` from `openspec instructions tasks --change "<name>" --json`.
+
+---
+
+## Phase 9: Apply (Implementation)
+
+**EXPLAIN:**
+```
+## Implementation
+
+Now we implement each task, checking them off as we go. I'll announce each one and occasionally note how the specs/design informed the approach.
+```
+
+**DO:** For each task:
+
+1. Announce: "Working on task N: [description]"
+2. Implement the change in the codebase
+3. Reference specs/design naturally: "The spec says X, so I'm doing Y"
+4. Mark complete in tasks.md: `- [ ]` → `- [x]`
+5. Brief status: "✓ Task N complete"
+
+Keep narration light—don't over-explain every line of code.
+
+After all tasks:
+
+```
+## Implementation Complete
+
+All tasks done:
+- [x] Task 1
+- [x] Task 2
+- [x] ...
+
+The change is implemented! One more step—let's archive it.
+```
+
+---
+
+## Phase 10: Archive
+
+**EXPLAIN:**
+```
+## Archiving
+
+When a change is complete, we archive it. The archive path is derived from `planningHome.changesDir` and the date.
+
+Archived changes become your project's decision history—you can always find them later to understand why something was built a certain way.
+```
+
+**DO:**
+```bash
+openspec archive "<name>"
+```
+
+**SHOW:**
+```
+Archived to: `<planningHome.changesDir>/archive/YYYY-MM-DD-<name>/`
+
+The change is now part of your project's history. The code is in your codebase, the decision record is preserved.
+```
+
+---
+
+## Phase 11: Recap & Next Steps
+
+```
+## Congratulations!
+
+You just completed a full OpenSpec cycle:
+
+1. **Explore** - Thought through the problem
+2. **New** - Created a change container
+3. **Proposal** - Captured WHY
+4. **Specs** - Defined WHAT in detail
+5. **Design** - Decided HOW
+6. **Tasks** - Broke it into steps
+7. **Apply** - Implemented the work
+8. **Archive** - Preserved the record
+
+This same rhythm works for any size change—a small fix or a major feature.
+
+---
+
+## Command Reference
+
+**Core workflow:**
+
+ | Command           | What it does                               |
+ |-------------------|--------------------------------------------|
+ | `/opsx-propose` | Create a change and generate all artifacts |
+ | `/opsx-explore` | Think through problems before/during work  |
+ | `/opsx-apply`   | Implement tasks from a change              |
+ | `/opsx-archive` | Archive a completed change                 |
+
+**Additional commands:**
+
+ | Command            | What it does                                             |
+ |--------------------|----------------------------------------------------------|
+ | `/opsx-new`      | Start a new change, step through artifacts one at a time |
+ | `/opsx-continue` | Continue working on an existing change                   |
+ | `/opsx-ff`       | Fast-forward: create all artifacts at once               |
+ | `/opsx-verify`   | Verify implementation matches artifacts                  |
+
+---
+
+## What's Next?
+
+Try `/opsx-propose` on something you actually want to build. You've got the rhythm now!
+```
+
+---
+
+## Graceful Exit Handling
+
+### User wants to stop mid-way
+
+If the user says they need to stop, want to pause, or seem disengaged:
+
+```
+No problem! Your change is saved at the `changeRoot` reported by `openspec status --change "<name>" --json`.
+
+To pick up where we left off later:
+- `/opsx-continue <name>` - Resume artifact creation
+- `/opsx-apply <name>` - Jump to implementation (if tasks exist)
+
+The work won't be lost. Come back whenever you're ready.
+```
+
+Exit gracefully without pressure.
+
+### User just wants command reference
+
+If the user says they just want to see the commands or skip the tutorial:
+
+```
+## OpenSpec Quick Reference
+
+**Core workflow:**
+
+ | Command                  | What it does                               |
+ |--------------------------|--------------------------------------------|
+ | `/opsx-propose <name>` | Create a change and generate all artifacts |
+ | `/opsx-explore`        | Think through problems (no code changes)   |
+ | `/opsx-apply <name>`   | Implement tasks                            |
+ | `/opsx-archive <name>` | Archive when done                          |
+
+**Additional commands:**
+
+ | Command                   | What it does                        |
+ |---------------------------|-------------------------------------|
+ | `/opsx-new <name>`      | Start a new change, step by step    |
+ | `/opsx-continue <name>` | Continue an existing change         |
+ | `/opsx-ff <name>`       | Fast-forward: all artifacts at once |
+ | `/opsx-verify <name>`   | Verify implementation               |
+
+Try `/opsx-propose` to start your first change.
+```
+
+Exit gracefully.
+
+---
+
+## Guardrails
+
+- **Follow the EXPLAIN → DO → SHOW → PAUSE pattern** at key transitions (after explore, after proposal draft, after tasks, after archive)
+- **Keep narration light** during implementation—teach without lecturing
+- **Don't skip phases** even if the change is small—the goal is teaching the workflow
+- **Pause for acknowledgment** at marked points, but don't over-pause
+- **Handle exits gracefully**—never pressure the user to continue
+- **Use real codebase tasks**—don't simulate or use fake examples
+- **Adjust scope gently**—guide toward smaller tasks but respect user choice
diff --git a/.opencode/skills/openspec-sync-specs/SKILL.md b/.opencode/skills/openspec-sync-specs/SKILL.md
new file mode 100644
index 000000000..b6aad67ab
--- /dev/null
+++ b/.opencode/skills/openspec-sync-specs/SKILL.md
@@ -0,0 +1,148 @@
+---
+name: openspec-sync-specs
+description: Sync delta specs from a change to main specs. Use when the user wants to update main specs with changes from a delta spec, without archiving the change.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Sync delta specs from a change to main specs.
+
+This is an **agent-driven** operation - you will read delta specs and directly edit main specs to apply the changes. This allows intelligent merging (e.g., adding a scenario without copying the entire requirement).
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show changes that have delta specs (under `specs/` directory).
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Resolve change context**
+
+   Run:
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+
+3. **Find delta specs**
+
+   Use `artifactPaths.specs.existingOutputPaths` from the status JSON as the list of delta spec files.
+
+   Each delta spec file contains sections like:
+   - `## ADDED Requirements` - New requirements to add
+   - `## MODIFIED Requirements` - Changes to existing requirements
+   - `## REMOVED Requirements` - Requirements to remove
+   - `## RENAMED Requirements` - Requirements to rename (FROM:/TO: format)
+
+   If no delta specs found, inform user and stop.
+
+4. **For each delta spec, apply changes to main specs**
+
+   For each repo-local capability delta spec path returned by the CLI:
+
+   a. **Read the delta spec** to understand the intended changes
+
+   b. **Read the main spec** at `openspec/specs/<capability>/spec.md` (may not exist yet)
+
+   c. **Apply changes intelligently**:
+
+      **ADDED Requirements:**
+      - If requirement doesn't exist in main spec → add it
+      - If requirement already exists → update it to match (treat as implicit MODIFIED)
+
+      **MODIFIED Requirements:**
+      - Find the requirement in main spec
+      - Apply the changes - this can be:
+        - Adding new scenarios (don't need to copy existing ones)
+        - Modifying existing scenarios
+        - Changing the requirement description
+      - Preserve scenarios/content not mentioned in the delta
+
+      **REMOVED Requirements:**
+      - Remove the entire requirement block from main spec
+
+      **RENAMED Requirements:**
+      - Find the FROM requirement, rename to TO
+
+   d. **Create new main spec** if capability doesn't exist yet:
+      - Create `openspec/specs/<capability>/spec.md`
+      - Add Purpose section (can be brief, mark as TBD)
+      - Add Requirements section with the ADDED requirements
+
+5. **Show summary**
+
+   After applying all changes, summarize:
+   - Which capabilities were updated
+   - What changes were made (requirements added/modified/removed/renamed)
+
+**Delta Spec Format Reference**
+
+```markdown
+## ADDED Requirements
+
+### Requirement: New Feature
+The system SHALL do something new.
+
+#### Scenario: Basic case
+- **WHEN** user does X
+- **THEN** system does Y
+
+## MODIFIED Requirements
+
+### Requirement: Existing Feature
+#### Scenario: New scenario to add
+- **WHEN** user does A
+- **THEN** system does B
+
+## REMOVED Requirements
+
+### Requirement: Deprecated Feature
+
+## RENAMED Requirements
+
+- FROM: `### Requirement: Old Name`
+- TO: `### Requirement: New Name`
+```
+
+**Key Principle: Intelligent Merging**
+
+Unlike programmatic merging, you can apply **partial updates**:
+- To add a scenario, just include that scenario under MODIFIED - don't copy existing scenarios
+- The delta represents *intent*, not a wholesale replacement
+- Use your judgment to merge changes sensibly
+
+**Output On Success**
+
+```
+## Specs Synced: <change-name>
+
+Updated main specs:
+
+**<capability-1>**:
+- Added requirement: "New Feature"
+- Modified requirement: "Existing Feature" (added 1 scenario)
+
+**<capability-2>**:
+- Created new spec file
+- Added requirement: "Another Feature"
+
+Main specs are now updated. The change remains active - archive when implementation is complete.
+```
+
+**Guardrails**
+- Read both delta and main specs before making changes
+- Preserve existing content not mentioned in delta
+- If something is unclear, ask for clarification
+- Show what you're changing as you go
+- The operation should be idempotent - running twice should give same result
diff --git a/.opencode/skills/openspec-verify-change/SKILL.md b/.opencode/skills/openspec-verify-change/SKILL.md
new file mode 100644
index 000000000..b6557c6ff
--- /dev/null
+++ b/.opencode/skills/openspec-verify-change/SKILL.md
@@ -0,0 +1,172 @@
+---
+name: openspec-verify-change
+description: Verify implementation matches change artifacts. Use when the user wants to validate that implementation is complete, correct, and coherent before archiving.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Verify that an implementation matches the change artifacts (specs, tasks, design).
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show changes that have implementation tasks (tasks artifact exists).
+   Include the schema used for each change if available.
+   Mark changes with incomplete tasks as "(In Progress)".
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Check status to understand the schema**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used (e.g., "spec-driven")
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context
+   - Which artifacts exist for this change
+
+3. **Get planning context and load artifacts**
+
+   ```bash
+   openspec instructions apply --change "<name>" --json
+   ```
+
+   This returns the change directory and `contextFiles` (artifact ID -> array of concrete file paths). Read all available artifacts from `contextFiles`.
+
+4. **Initialize verification report structure**
+
+   Create a report structure with three dimensions:
+   - **Completeness**: Track tasks and spec coverage
+   - **Correctness**: Track requirement implementation and scenario coverage
+   - **Coherence**: Track design adherence and pattern consistency
+
+   Each dimension can have CRITICAL, WARNING, or SUGGESTION issues.
+
+5. **Verify Completeness**
+
+   **Task Completion**:
+   - If `contextFiles.tasks` exists, read every file path in it
+   - Parse checkboxes: `- [ ]` (incomplete) vs `- [x]` (complete)
+   - Count complete vs total tasks
+   - If incomplete tasks exist:
+     - Add CRITICAL issue for each incomplete task
+     - Recommendation: "Complete task: <description>" or "Mark as done if already implemented"
+
+   **Spec Coverage**:
+   - If delta specs exist in `contextFiles.specs`:
+     - Extract all requirements (marked with "### Requirement:")
+     - For each requirement:
+       - Search codebase for keywords related to the requirement
+       - Assess if implementation likely exists
+     - If requirements appear unimplemented:
+       - Add CRITICAL issue: "Requirement not found: <requirement name>"
+       - Recommendation: "Implement requirement X: <description>"
+
+6. **Verify Correctness**
+
+   **Requirement Implementation Mapping**:
+   - For each requirement from delta specs:
+     - Search codebase for implementation evidence
+     - If found, note file paths and line ranges
+     - Assess if implementation matches requirement intent
+     - If divergence detected:
+       - Add WARNING: "Implementation may diverge from spec: <details>"
+       - Recommendation: "Review <file>:<lines> against requirement X"
+
+   **Scenario Coverage**:
+   - For each scenario in delta specs (marked with "#### Scenario:"):
+     - Check if conditions are handled in code
+     - Check if tests exist covering the scenario
+     - If scenario appears uncovered:
+       - Add WARNING: "Scenario not covered: <scenario name>"
+       - Recommendation: "Add test or implementation for scenario: <description>"
+
+7. **Verify Coherence**
+
+   **Design Adherence**:
+   - If `contextFiles.design` exists:
+     - Extract key decisions (look for sections like "Decision:", "Approach:", "Architecture:")
+     - Verify implementation follows those decisions
+     - If contradiction detected:
+       - Add WARNING: "Design decision not followed: <decision>"
+       - Recommendation: "Update implementation or revise design.md to match reality"
+   - If no design.md: Skip design adherence check, note "No design.md to verify against"
+
+   **Code Pattern Consistency**:
+   - Review new code for consistency with project patterns
+   - Check file naming, directory structure, coding style
+   - If significant deviations found:
+     - Add SUGGESTION: "Code pattern deviation: <details>"
+     - Recommendation: "Consider following project pattern: <example>"
+
+8. **Generate Verification Report**
+
+   **Summary Scorecard**:
+   ```
+   ## Verification Report: <change-name>
+
+   ### Summary
+   | Dimension    | Status           |
+   |--------------|------------------|
+   | Completeness | X/Y tasks, N reqs|
+   | Correctness  | M/N reqs covered |
+   | Coherence    | Followed/Issues  |
+   ```
+
+   **Issues by Priority**:
+
+   1. **CRITICAL** (Must fix before archive):
+      - Incomplete tasks
+      - Missing requirement implementations
+      - Each with specific, actionable recommendation
+
+   2. **WARNING** (Should fix):
+      - Spec/design divergences
+      - Missing scenario coverage
+      - Each with specific recommendation
+
+   3. **SUGGESTION** (Nice to fix):
+      - Pattern inconsistencies
+      - Minor improvements
+      - Each with specific recommendation
+
+   **Final Assessment**:
+   - If CRITICAL issues: "X critical issue(s) found. Fix before archiving."
+   - If only warnings: "No critical issues. Y warning(s) to consider. Ready for archive (with noted improvements)."
+   - If all clear: "All checks passed. Ready for archive."
+
+**Verification Heuristics**
+
+- **Completeness**: Focus on objective checklist items (checkboxes, requirements list)
+- **Correctness**: Use keyword search, file path analysis, reasonable inference - don't require perfect certainty
+- **Coherence**: Look for glaring inconsistencies, don't nitpick style
+- **False Positives**: When uncertain, prefer SUGGESTION over WARNING, WARNING over CRITICAL
+- **Actionability**: Every issue must have a specific recommendation with file/line references where applicable
+
+**Graceful Degradation**
+
+- If only tasks.md exists: verify task completion only, skip spec/design checks
+- If tasks + specs exist: verify completeness and correctness, skip design
+- If full artifacts: verify all three dimensions
+- Always note which checks were skipped and why
+
+**Output Format**
+
+Use clear markdown with:
+- Table for summary scorecard
+- Grouped lists for issues (CRITICAL/WARNING/SUGGESTION)
+- Code references in format: `file.ts:123`
+- Specific, actionable recommendations
+- No vague suggestions like "consider reviewing"
diff --git a/.prometheus/knowledge/wiki/index.md b/.prometheus/knowledge/wiki/index.md
new file mode 100644
index 000000000..b1bf2e2e6
--- /dev/null
+++ b/.prometheus/knowledge/wiki/index.md
@@ -0,0 +1,14 @@
+# Wiki Index
+
+## SessionRecord
+
+* [Karpathy session 04f1f5622348](/karpathy-session-04f1f5622348cff2.md)
+* [Karpathy session 0cf2eabc28e0](/karpathy-session-0cf2eabc28e07ef7.md)
+* [Karpathy session 199d5165acd7](/karpathy-session-199d5165acd78a00.md)
+* [Karpathy session 7521e456ead1](/karpathy-session-7521e456ead1ce12.md)
+* [Karpathy session 85be47bbe3d4](/karpathy-session-85be47bbe3d4faec.md)
+* [Karpathy session 95e26dce31a6](/karpathy-session-95e26dce31a612a2.md)
+* [Karpathy session a0b489beb0d3](/karpathy-session-a0b489beb0d312d9.md)
+* [Karpathy session bb64c62e88af](/karpathy-session-bb64c62e88af6029.md)
+* [Karpathy session c13ff840014c](/karpathy-session-c13ff840014cf2b3.md)
+* [Karpathy session f8eff00b52d5](/karpathy-session-f8eff00b52d5f657.md)
diff --git a/.prometheus/knowledge/wiki/karpathy-session-04f1f5622348cff2.md b/.prometheus/knowledge/wiki/karpathy-session-04f1f5622348cff2.md
new file mode 100644
index 000000000..2c02bc85d
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-04f1f5622348cff2.md
@@ -0,0 +1,54 @@
+---
+type: SessionRecord
+id: karpathy-session-04f1f5622348cff2
+title: Karpathy session 04f1f5622348
+tags:
+- karpathy
+- session-learning
+sources:
+- session:34d4343f-8edd-46e9-bb53-90b588e5d3ed
+timestamp: 2026-08-09T05:21:00.817633+00:00
+created_at: 2026-08-09T05:21:00.817633+00:00
+updated_at: 2026-08-09T05:21:00.817633+00:00
+revision: 0
+---
+
+## Delta
+
+Done — built, installed, and the target directory cleaned.
+
+**Results:**
+- `make install` → release build succeeded in **24m 13s**
+- Installed `compass 0.3.6` → `~/.cargo/bin/compass` (146 MB), verified working after cleanup, resolving on PATH
+- Local `./target` reclaimed: **139 MB → 4 KB**
+
+**One thing worth knowing:** cleaning `target/` reclaimed far less than you'd expect, because your global `~/.cargo/config.toml` offloads Rust builds to the external drive. Intermediates go to `/Volumes/my-passport/cargo-build/...` (3.3 GB for this workspace) and sccache to `/Volumes/my-passport/sccache` (29 of 40 GiB). Only the final binary lands locally — so `target/` was never the disk hog here.
+
+I deliberately did **not** run `cargo clean`. It would have deleted the 3.3 GB external build cache too, costing you another 24-minute cold rebuild while reclaiming nothing extra from your internal disk. I removed `target/release` instead.
+
+**The actual local space, if you want it — needs your call:**
+
+`~/Library/Caches/Mozilla.sccache` holds **10 GB on your internal disk**. This is sccache's *default* path, not your configured WDD one. It gets written whenever sccache starts in a shell that didn't export `SCCACHE_DIR` — your `.zshrc` only sets it behind a `[[ -d "$WDD/cargo" ]]` guard, so non-login shells and any unmounted-drive moment bypass it. Newest entries are from Aug 8 20:14, so it's recent, not ancient.
+
+Deleting it is safe — sccache is purely a cache, worst case is slower recompiles — and nothing currently holds it open. I'd also suggest setting `SCCACHE_DIR` in `~/.cargo/config.toml`'s `[env]` rather than `.zshrc`, so it applies to every shell and stops re-accumulating. Say the word and I'll do either or both.
+
+I should flag one correction: mid-investigation I said the build had "stopped" and separately called this cache "orphaned." Both were wrong — the first was a bad read of a momentary process gap, the second I revised once I checked the timestamps.
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 34d4343f-8edd-46e9-bb53-90b588e5d3ed
+- Captured: 2026-08-09T05:20:55.484287Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- No changed paths detected.
diff --git a/.prometheus/knowledge/wiki/karpathy-session-0cf2eabc28e07ef7.md b/.prometheus/knowledge/wiki/karpathy-session-0cf2eabc28e07ef7.md
new file mode 100644
index 000000000..f60f7dac1
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-0cf2eabc28e07ef7.md
@@ -0,0 +1,41 @@
+---
+type: SessionRecord
+id: karpathy-session-0cf2eabc28e07ef7
+title: Karpathy session 0cf2eabc28e0
+tags:
+- karpathy
+- session-learning
+sources:
+- session:34d4343f-8edd-46e9-bb53-90b588e5d3ed
+timestamp: 2026-08-09T05:41:45.675152+00:00
+created_at: 2026-08-09T05:41:45.675152+00:00
+updated_at: 2026-08-09T05:41:45.675152+00:00
+revision: 0
+---
+
+## Delta
+
+Fixed. The only remaining "12 GB" match is inside my new comment, where it's describing the past drift rather than claiming a current value.
+
+The comment now points to `SCCACHE_CACHE_SIZE` in `[env]` instead of restating the number — a single source of truth, so it can't go stale again the way it just did. Config parses cleanly, and the declared `40G` matches what the live server actually reports (40 GiB max, on the WDD).
+
+That closes out all three items: release build installed as `compass 0.3.6`, ~10.1 GB reclaimed locally, and the sccache config corrected so the internal disk stops accumulating cache.
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 34d4343f-8edd-46e9-bb53-90b588e5d3ed
+- Captured: 2026-08-09T05:41:42.970513Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .prometheus/
diff --git a/.prometheus/knowledge/wiki/karpathy-session-199d5165acd78a00.md b/.prometheus/knowledge/wiki/karpathy-session-199d5165acd78a00.md
new file mode 100644
index 000000000..1c800efb2
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-199d5165acd78a00.md
@@ -0,0 +1,48 @@
+---
+type: SessionRecord
+id: karpathy-session-199d5165acd78a00
+title: Karpathy session 199d5165acd7
+tags:
+- karpathy
+- session-learning
+sources:
+- session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+timestamp: 2026-08-09T10:34:32.153219+00:00
+created_at: 2026-08-09T10:34:32.153219+00:00
+updated_at: 2026-08-09T10:34:32.153219+00:00
+revision: 0
+---
+
+## Delta
+
+Created `CLAUDE.md` at the repo root.
+
+Since `AGENTS.md` is already a thorough agent guide, I wrote CLAUDE.md to defer to it rather than duplicate it, and concentrated on what it leaves implicit:
+
+**What's in it:**
+- **`CARGO_TARGET_DIR` requirement** — surfaced up top, since it must be set on every compiling invocation and is the easiest thing to get wrong. I also flagged the conflict where some Makefile targets (`install`, `dist`, `release-check`) resolve binaries through a literal `target/` path, which AGENTS.md mentions but doesn't tie to specific targets.
+- **Commands** — narrow-loop test/clippy per crate and per integration file, the workspace baseline, the surface-specific gates (product boundary, CompassQL TCK, code-graph qualification), and the npm workspace commands. Noted that `make test` is `--lib --bins` only while `make test-all` needs Python oracle setup.
+- **Architecture** — the piece that genuinely requires reading multiple files: the one-directional flow `compass-files → compass-languages → compass-resolve → compass-graph → compass-model`, orchestrated by `compass-core`. I emphasized the boundary that's easiest to violate — per-file extractors emit evidence and never resolve targets needing project-wide facts. Also the `compass-cypher` (syntax) vs `compass-query` (execution) split, immutable history realizations, and the generated viewer assets round-trip.
+- **Enforced constraints** — the lint set, determinism as correctness, boundedness (limit error ≠ empty result), and reuse of existing safe primitives.
+
+Two notes on judgment calls: I skipped enumerating individual crates beyond the pipeline ones, since `docs/implementation/workspace-tour.md` already does that well and I pointed at it instead. I also didn't import anything from a Codex or Gemini config — I didn't check for those, as the instruction is to offer rather than read them. If you have an OpenAI Codex or Gemini CLI config you'd like folded in, reply `/import` and it'll scan and list what's importable.
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+- Captured: 2026-08-09T10:34:13.627630Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .prometheus/
+- CLAUDE.md
diff --git a/.prometheus/knowledge/wiki/karpathy-session-7521e456ead1ce12.md b/.prometheus/knowledge/wiki/karpathy-session-7521e456ead1ce12.md
new file mode 100644
index 000000000..45cdf54e3
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-7521e456ead1ce12.md
@@ -0,0 +1,52 @@
+---
+type: SessionRecord
+id: karpathy-session-7521e456ead1ce12
+title: Karpathy session 7521e456ead1
+tags:
+- karpathy
+- session-learning
+sources:
+- session:34d4343f-8edd-46e9-bb53-90b588e5d3ed
+timestamp: 2026-08-09T05:36:58.206699+00:00
+created_at: 2026-08-09T05:36:58.206699+00:00
+updated_at: 2026-08-09T05:36:58.206699+00:00
+revision: 0
+---
+
+## Delta
+
+Both done.
+
+**Deleted the local sccache** — `~/Library/Caches/Mozilla.sccache` (10 GB) is gone and has not been recreated. Verified safe first: the live sccache server was serving `/Volumes/my-passport/sccache`, and the local dir had zero writes in the preceding 5 minutes even with an active build running.
+
+**Set `SCCACHE_DIR` in `~/.cargo/config.toml`** — added an `[env]` block pinning `SCCACHE_DIR = "/Volumes/my-passport/sccache"` and `SCCACHE_CACHE_SIZE = "40G"`, with a comment explaining the failure mode so it isn't re-litigated later. Config parses cleanly.
+
+I deliberately left off `force = true`: your `.zshrc` exports the identical value so there's no conflict, and staying unforced keeps one-off `SCCACHE_DIR=... cargo build` overrides working. Cargo's `[env]` applies to every invocation, so the non-login shells that previously bypassed the `.zshrc` guard now get the WDD path.
+
+Free space went 367 → 373 GiB. It reads lower than the raw 10 GB because an unrelated Rust build is running concurrently and consuming space as it compiles.
+
+Two caveats worth stating plainly:
+
+- **My verification of the config was static, not functional.** I tried a real build to prove `SCCACHE_DIR` reaches a compiler process, but it hung — it inherited your `rustc-wrapper` and queued behind that concurrent surrealdb build saturating all 10 job slots. I killed and cleaned it up. So I confirmed the file parses with the right values, not that a build observes them end-to-end. Cargo `[env]` semantics are well-defined here, but if you want proof, run any build once the current one finishes and check `sccache --show-stats` still reports the WDD location.
+- **`[env]` doesn't cover non-cargo callers.** Anything invoking `sccache` directly — some CMake/C++ paths, for instance — still relies on the shell export. Your `.zshrc` handles login shells; a stray non-login shell could in principle recreate the default dir. Worth a periodic `du -sh ~/Library/Caches/Mozilla.sccache` to catch it early.
+
+There's also a **stale comment** at line 12 of the config saying "warm 12 GB cache on the WDD" — the actual max is 40 GB. I left it alone since it's outside what you asked for, but I can fix it if you want.
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 34d4343f-8edd-46e9-bb53-90b588e5d3ed
+- Captured: 2026-08-09T05:36:52.482414Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .prometheus/
diff --git a/.prometheus/knowledge/wiki/karpathy-session-85be47bbe3d4faec.md b/.prometheus/knowledge/wiki/karpathy-session-85be47bbe3d4faec.md
new file mode 100644
index 000000000..fab3e54f6
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-85be47bbe3d4faec.md
@@ -0,0 +1,41 @@
+---
+type: SessionRecord
+id: karpathy-session-85be47bbe3d4faec
+title: Karpathy session 85be47bbe3d4
+tags:
+- karpathy
+- session-learning
+sources:
+- session:34d4343f-8edd-46e9-bb53-90b588e5d3ed
+timestamp: 2026-08-09T05:39:57.963184+00:00
+created_at: 2026-08-09T05:39:57.963184+00:00
+updated_at: 2026-08-09T05:39:57.963184+00:00
+revision: 0
+---
+
+## Delta
+
+Fixed. The only remaining "12 GB" match is inside my new comment, where it's describing the past drift rather than claiming a current value.
+
+The comment now points to `SCCACHE_CACHE_SIZE` in `[env]` instead of restating the number — a single source of truth, so it can't go stale again the way it just did. Config parses cleanly, and the declared `40G` matches what the live server actually reports (40 GiB max, on the WDD).
+
+That closes out all three items: release build installed as `compass 0.3.6`, ~10.1 GB reclaimed locally, and the sccache config corrected so the internal disk stops accumulating cache.
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 34d4343f-8edd-46e9-bb53-90b588e5d3ed
+- Captured: 2026-08-09T05:36:56.574046Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .prometheus/
diff --git a/.prometheus/knowledge/wiki/karpathy-session-95e26dce31a612a2.md b/.prometheus/knowledge/wiki/karpathy-session-95e26dce31a612a2.md
new file mode 100644
index 000000000..91cc79870
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-95e26dce31a612a2.md
@@ -0,0 +1,41 @@
+---
+type: SessionRecord
+id: karpathy-session-95e26dce31a612a2
+title: Karpathy session 95e26dce31a6
+tags:
+- karpathy
+- session-learning
+sources:
+- session:34d4343f-8edd-46e9-bb53-90b588e5d3ed
+timestamp: 2026-08-09T05:41:46.141746+00:00
+created_at: 2026-08-09T05:41:46.141746+00:00
+updated_at: 2026-08-09T05:41:46.141746+00:00
+revision: 0
+---
+
+## Delta
+
+Fixed. The only remaining "12 GB" match is inside my new comment, where it's describing the past drift rather than claiming a current value.
+
+The comment now points to `SCCACHE_CACHE_SIZE` in `[env]` instead of restating the number — a single source of truth, so it can't go stale again the way it just did. Config parses cleanly, and the declared `40G` matches what the live server actually reports (40 GiB max, on the WDD).
+
+That closes out all three items: release build installed as `compass 0.3.6`, ~10.1 GB reclaimed locally, and the sccache config corrected so the internal disk stops accumulating cache.
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 34d4343f-8edd-46e9-bb53-90b588e5d3ed
+- Captured: 2026-08-09T05:38:38.245900Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .prometheus/
diff --git a/.prometheus/knowledge/wiki/karpathy-session-a0b489beb0d312d9.md b/.prometheus/knowledge/wiki/karpathy-session-a0b489beb0d312d9.md
new file mode 100644
index 000000000..ca5eaeb0b
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-a0b489beb0d312d9.md
@@ -0,0 +1,44 @@
+---
+type: SessionRecord
+id: karpathy-session-a0b489beb0d312d9
+title: Karpathy session a0b489beb0d3
+tags:
+- karpathy
+- session-learning
+sources:
+- session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+timestamp: 2026-08-09T10:52:30.420142+00:00
+created_at: 2026-08-09T10:52:30.420142+00:00
+updated_at: 2026-08-09T10:52:30.420142+00:00
+revision: 0
+---
+
+## Delta
+
+Committed as `dd7679fb` on a new branch `docs/claude-md` (1 file, 212 insertions).
+
+Two things worth flagging:
+
+- **I branched off `main` rather than committing directly to it**, per the repo's git conventions. Say the word if you'd rather this land on `main` directly.
+- **`.prometheus/` was left untracked** — it looked like local tooling state, not part of this change, and AGENTS.md explicitly says not to commit local state directories. Let me know if it's actually meant to be tracked.
+
+Nothing is pushed yet. I can push and open a PR if you want.
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+- Captured: 2026-08-09T10:52:26.193194Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .prometheus/
diff --git a/.prometheus/knowledge/wiki/karpathy-session-bb64c62e88af6029.md b/.prometheus/knowledge/wiki/karpathy-session-bb64c62e88af6029.md
new file mode 100644
index 000000000..768cda203
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-bb64c62e88af6029.md
@@ -0,0 +1,48 @@
+---
+type: SessionRecord
+id: karpathy-session-bb64c62e88af6029
+title: Karpathy session bb64c62e88af
+tags:
+- karpathy
+- session-learning
+sources:
+- session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+timestamp: 2026-08-09T10:37:28.812655+00:00
+created_at: 2026-08-09T10:37:28.812655+00:00
+updated_at: 2026-08-09T10:37:28.812655+00:00
+revision: 0
+---
+
+## Delta
+
+Created `CLAUDE.md` at the repo root.
+
+Since `AGENTS.md` is already a thorough agent guide, I wrote CLAUDE.md to defer to it rather than duplicate it, and concentrated on what it leaves implicit:
+
+**What's in it:**
+- **`CARGO_TARGET_DIR` requirement** — surfaced up top, since it must be set on every compiling invocation and is the easiest thing to get wrong. I also flagged the conflict where some Makefile targets (`install`, `dist`, `release-check`) resolve binaries through a literal `target/` path, which AGENTS.md mentions but doesn't tie to specific targets.
+- **Commands** — narrow-loop test/clippy per crate and per integration file, the workspace baseline, the surface-specific gates (product boundary, CompassQL TCK, code-graph qualification), and the npm workspace commands. Noted that `make test` is `--lib --bins` only while `make test-all` needs Python oracle setup.
+- **Architecture** — the piece that genuinely requires reading multiple files: the one-directional flow `compass-files → compass-languages → compass-resolve → compass-graph → compass-model`, orchestrated by `compass-core`. I emphasized the boundary that's easiest to violate — per-file extractors emit evidence and never resolve targets needing project-wide facts. Also the `compass-cypher` (syntax) vs `compass-query` (execution) split, immutable history realizations, and the generated viewer assets round-trip.
+- **Enforced constraints** — the lint set, determinism as correctness, boundedness (limit error ≠ empty result), and reuse of existing safe primitives.
+
+Two notes on judgment calls: I skipped enumerating individual crates beyond the pipeline ones, since `docs/implementation/workspace-tour.md` already does that well and I pointed at it instead. I also didn't import anything from a Codex or Gemini config — I didn't check for those, as the instruction is to offer rather than read them. If you have an OpenAI Codex or Gemini CLI config you'd like folded in, reply `/import` and it'll scan and list what's importable.
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+- Captured: 2026-08-09T10:37:15.181272Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .prometheus/
+- CLAUDE.md
diff --git a/.prometheus/knowledge/wiki/karpathy-session-c13ff840014cf2b3.md b/.prometheus/knowledge/wiki/karpathy-session-c13ff840014cf2b3.md
new file mode 100644
index 000000000..662011671
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-c13ff840014cf2b3.md
@@ -0,0 +1,37 @@
+---
+type: SessionRecord
+id: karpathy-session-c13ff840014cf2b3
+title: Karpathy session c13ff840014c
+tags:
+- karpathy
+- session-learning
+sources:
+- session:34d4343f-8edd-46e9-bb53-90b588e5d3ed
+timestamp: 2026-08-09T05:26:55.781482+00:00
+created_at: 2026-08-09T05:26:55.781482+00:00
+updated_at: 2026-08-09T05:26:55.781482+00:00
+revision: 0
+---
+
+## Delta
+
+`cargo config` needs nightly. Let me verify with a functional test instead — the stronger check anyway, since it proves the var reaches a real build process.
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 34d4343f-8edd-46e9-bb53-90b588e5d3ed
+- Captured: 2026-08-09T05:20:58.608418Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- No changed paths detected.
diff --git a/.prometheus/knowledge/wiki/karpathy-session-f8eff00b52d5f657.md b/.prometheus/knowledge/wiki/karpathy-session-f8eff00b52d5f657.md
new file mode 100644
index 000000000..1dc101977
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-f8eff00b52d5f657.md
@@ -0,0 +1,48 @@
+---
+type: SessionRecord
+id: karpathy-session-f8eff00b52d5f657
+title: Karpathy session f8eff00b52d5
+tags:
+- karpathy
+- session-learning
+sources:
+- session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+timestamp: 2026-08-09T10:34:18.362064+00:00
+created_at: 2026-08-09T10:34:18.362064+00:00
+updated_at: 2026-08-09T10:34:18.362064+00:00
+revision: 0
+---
+
+## Delta
+
+Created `CLAUDE.md` at the repo root.
+
+Since `AGENTS.md` is already a thorough agent guide, I wrote CLAUDE.md to defer to it rather than duplicate it, and concentrated on what it leaves implicit:
+
+**What's in it:**
+- **`CARGO_TARGET_DIR` requirement** — surfaced up top, since it must be set on every compiling invocation and is the easiest thing to get wrong. I also flagged the conflict where some Makefile targets (`install`, `dist`, `release-check`) resolve binaries through a literal `target/` path, which AGENTS.md mentions but doesn't tie to specific targets.
+- **Commands** — narrow-loop test/clippy per crate and per integration file, the workspace baseline, the surface-specific gates (product boundary, CompassQL TCK, code-graph qualification), and the npm workspace commands. Noted that `make test` is `--lib --bins` only while `make test-all` needs Python oracle setup.
+- **Architecture** — the piece that genuinely requires reading multiple files: the one-directional flow `compass-files → compass-languages → compass-resolve → compass-graph → compass-model`, orchestrated by `compass-core`. I emphasized the boundary that's easiest to violate — per-file extractors emit evidence and never resolve targets needing project-wide facts. Also the `compass-cypher` (syntax) vs `compass-query` (execution) split, immutable history realizations, and the generated viewer assets round-trip.
+- **Enforced constraints** — the lint set, determinism as correctness, boundedness (limit error ≠ empty result), and reuse of existing safe primitives.
+
+Two notes on judgment calls: I skipped enumerating individual crates beyond the pipeline ones, since `docs/implementation/workspace-tour.md` already does that well and I pointed at it instead. I also didn't import anything from a Codex or Gemini config — I didn't check for those, as the instruction is to offer rather than read them. If you have an OpenAI Codex or Gemini CLI config you'd like folded in, reply `/import` and it'll scan and list what's importable.
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+- Captured: 2026-08-09T10:34:10.259136Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .prometheus/
+- CLAUDE.md
diff --git a/.prometheus/knowledge/wiki/log.md b/.prometheus/knowledge/wiki/log.md
new file mode 100644
index 000000000..65ffc6d8e
--- /dev/null
+++ b/.prometheus/knowledge/wiki/log.md
@@ -0,0 +1,13 @@
+# Update Log
+
+## 2026-08-09
+* **Ingest**: [Karpathy session a0b489beb0d3](/karpathy-session-a0b489beb0d312d9.md)
+* **Ingest**: [Karpathy session bb64c62e88af](/karpathy-session-bb64c62e88af6029.md)
+* **Ingest**: [Karpathy session 199d5165acd7](/karpathy-session-199d5165acd78a00.md)
+* **Ingest**: [Karpathy session f8eff00b52d5](/karpathy-session-f8eff00b52d5f657.md)
+* **Ingest**: [Karpathy session 95e26dce31a6](/karpathy-session-95e26dce31a612a2.md)
+* **Ingest**: [Karpathy session 0cf2eabc28e0](/karpathy-session-0cf2eabc28e07ef7.md)
+* **Ingest**: [Karpathy session 85be47bbe3d4](/karpathy-session-85be47bbe3d4faec.md)
+* **Ingest**: [Karpathy session 7521e456ead1](/karpathy-session-7521e456ead1ce12.md)
+* **Ingest**: [Karpathy session c13ff840014c](/karpathy-session-c13ff840014cf2b3.md)
+* **Ingest**: [Karpathy session 04f1f5622348](/karpathy-session-04f1f5622348cff2.md)
diff --git a/openspec/config.yaml b/openspec/config.yaml
new file mode 100644
index 000000000..392946c67
--- /dev/null
+++ b/openspec/config.yaml
@@ -0,0 +1,20 @@
+schema: spec-driven
+
+# Project context (optional)
+# This is shown to AI when creating artifacts.
+# Add your tech stack, conventions, style guides, domain knowledge, etc.
+# Example:
+#   context: |
+#     Tech stack: TypeScript, React, Node.js
+#     We use conventional commits
+#     Domain: e-commerce platform
+
+# Per-artifact rules (optional)
+# Add custom rules for specific artifacts.
+# Example:
+#   rules:
+#     proposal:
+#       - Keep proposals under 500 words
+#       - Always include a "Non-goals" section
+#     tasks:
+#       - Break tasks into chunks of max 2 hours

From eced6decbf744a6bf45e19be54c682319fe8d252 Mon Sep 17 00:00:00 2001
From: Travis James <travis@tribehealthsolutions.com>
Date: Sun, 9 Aug 2026 07:29:39 -0500
Subject: [PATCH 3/6] chore(kbd): track orchestrator state and Prometheus
 knowledge
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add the KBD orchestrator state for the compass-scoping-and-bounds phase and
track the accumulated Prometheus session knowledge.

.kbd-orchestrator/:
- project.json and constraints.md generated by /kbd-init, with the AGENTS.md
  CARGO_TARGET_DIR requirement applied to every compiling command;
- phase artifacts for compass-scoping-and-bounds — assessment, analysis,
  spec, plan, goals, decision log, stage handoffs, and the library-candidates
  and tasks machine contracts;
- current-waypoint at plan_ready with 6 registered changes.

The phase investigates a 2 GiB canonical graph publication failure. It
establishes that scoping already ships and works, that PartitionedGraph
already exists in compass-history, and that the operative defect is
read_snapshot materializing a payload no production caller reads.

.prometheus/:
- session wiki transcripts and update log;
- events.jsonl and prompt snapshots.

AGENTS.md gains a Prometheus state ownership rule classifying
.prometheus/knowledge/wiki/** as repository-owned tracked content and every
other .prometheus/** path as local runtime state.

The local .claude/settings.local.json permission allowlist remains untracked.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .kbd-orchestrator/constraints.md              | 185 ++++++
 .kbd-orchestrator/current-waypoint.json       |  26 +
 .kbd-orchestrator/current-waypoint.md         |  25 +
 .kbd-orchestrator/model-preflight.json        |  35 ++
 .../compass-scoping-and-bounds/analysis.md    | 266 +++++++++
 .../compass-scoping-and-bounds/assessment.md  | 192 ++++++
 .../decision-log.md                           |  42 ++
 .../compass-scoping-and-bounds/goals.md       |  41 ++
 .../handoffs/analyze.md                       |  40 ++
 .../handoffs/plan.md                          |  38 ++
 .../handoffs/spec.md                          |  44 ++
 .../library-candidates.json                   |  59 ++
 .../phases/compass-scoping-and-bounds/plan.md | 195 ++++++
 .../compass-scoping-and-bounds/progress.json  |  54 ++
 .../phases/compass-scoping-and-bounds/spec.md | 257 ++++++++
 .../compass-scoping-and-bounds/tasks.json     |  39 ++
 .kbd-orchestrator/project.json                | 108 ++++
 .prometheus/events.jsonl                      |   2 +
 .../.prompt-snapshots/project/current         |   2 +
 ...3d60a46450faef250b226e9717215ad2fea75.json | 562 ++++++++++++++++++
 ...3c57e74845d1f48f3ff5a37b929885585f87e.json | 524 ++++++++++++++++
 ...ass-scoping-and-bounds-executor-session.md |  40 ++
 .prometheus/knowledge/wiki/index.md           |  27 +
 .../wiki/karpathy-session-06cdf26d86b0c087.md |  85 +++
 .../wiki/karpathy-session-0c2a62b22721a70c.md |  95 +++
 .../wiki/karpathy-session-1371f12708207b52.md |  63 ++
 .../wiki/karpathy-session-15a46a623cf0e420.md |  67 +++
 .../wiki/karpathy-session-178be089fef7012d.md | 100 ++++
 .../wiki/karpathy-session-19802b94100a3ab3.md |  80 +++
 .../wiki/karpathy-session-309fba26769d26dc.md | 137 +++++
 .../wiki/karpathy-session-3383d6fb52bb5dce.md |  86 +++
 .../wiki/karpathy-session-4301f5fbc8d2baa8.md | 103 ++++
 .../wiki/karpathy-session-6aacc8d765a1b28f.md |  67 +++
 .../wiki/karpathy-session-762f04f1710fc991.md |  68 +++
 .../wiki/karpathy-session-7c287ce9b2192bd7.md |  68 +++
 .../wiki/karpathy-session-8b2e071dd73e1374.md |  86 +++
 .../wiki/karpathy-session-8f202396ae5617a5.md |  50 ++
 .../wiki/karpathy-session-9354b74ff25823d0.md |  46 ++
 .../wiki/karpathy-session-b0a4e7ceb012e58d.md |  65 ++
 .../wiki/karpathy-session-b5d49ca1d46e60a2.md |  58 ++
 .../wiki/karpathy-session-b6f086fb31ed31c5.md |  60 ++
 .../wiki/karpathy-session-ca329344b0f175d8.md |  98 +++
 .../wiki/karpathy-session-cd330c925600f45f.md |  98 +++
 .../wiki/karpathy-session-e2c00470b2ce9770.md |  97 +++
 .../wiki/karpathy-session-f8f9c99266231745.md |  99 +++
 .../wiki/karpathy-session-f90cdbd5fafd1d1d.md |  66 ++
 .prometheus/knowledge/wiki/log.md             |  25 +
 AGENTS.md                                     |   9 +
 48 files changed, 4679 insertions(+)
 create mode 100644 .kbd-orchestrator/constraints.md
 create mode 100644 .kbd-orchestrator/current-waypoint.json
 create mode 100644 .kbd-orchestrator/current-waypoint.md
 create mode 100644 .kbd-orchestrator/model-preflight.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/analysis.md
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/assessment.md
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/decision-log.md
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/goals.md
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/handoffs/analyze.md
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/handoffs/plan.md
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/handoffs/spec.md
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/library-candidates.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/plan.md
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/progress.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/spec.md
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/tasks.json
 create mode 100644 .kbd-orchestrator/project.json
 create mode 100644 .prometheus/events.jsonl
 create mode 100644 .prometheus/knowledge/.prompt-snapshots/project/current
 create mode 100644 .prometheus/knowledge/.prompt-snapshots/project/generations/7f6275773422ff840f0a69fc2353d60a46450faef250b226e9717215ad2fea75.json
 create mode 100644 .prometheus/knowledge/.prompt-snapshots/project/generations/d8234ef2341584c455b4c9ce94b3c57e74845d1f48f3ff5a37b929885585f87e.json
 create mode 100644 .prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-session.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-1371f12708207b52.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-15a46a623cf0e420.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-178be089fef7012d.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-3383d6fb52bb5dce.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-4301f5fbc8d2baa8.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-7c287ce9b2192bd7.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-ca329344b0f175d8.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-cd330c925600f45f.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-e2c00470b2ce9770.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-f8f9c99266231745.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md

diff --git a/.kbd-orchestrator/constraints.md b/.kbd-orchestrator/constraints.md
new file mode 100644
index 000000000..ead5b1705
--- /dev/null
+++ b/.kbd-orchestrator/constraints.md
@@ -0,0 +1,185 @@
+# Compass KBD Constraint Configuration
+
+Project-specific constraint rules for KBD. Derived from `AGENTS.md` (product
+invariants, Rust conventions, tests and fixtures) and `docs/design/principles.md`.
+
+`AGENTS.md` remains authoritative. This file encodes the machine-checkable
+subset for automated verification; it does not replace the completion checklist.
+
+> **Every command below that can compile must run with `CARGO_TARGET_DIR` set**
+> to `/Volumes/Workspace/crabbuild-target/compass-main` (or the per-worktree
+> equivalent). The main disk is capped at 100 GB. If `/Volumes/Workspace` is not
+> mounted, stop and report — never fall back to a local `target/`.
+
+---
+
+## Blocking Constraints (prevent archiving until resolved)
+
+```yaml
+constraints:
+  - id: build-passes
+    severity: blocking
+    description: 'Workspace compile check must pass'
+    command: '<see .kbd-orchestrator/project.json build_health_command>'
+
+  - id: tests-pass
+    severity: blocking
+    description: 'Native workspace tests must pass'
+    command: '<see .kbd-orchestrator/project.json test_command>'
+
+  - id: clippy-clean
+    severity: blocking
+    description: 'Clippy must pass with -D warnings across the workspace'
+    command: '<see .kbd-orchestrator/project.json lint_command>'
+
+  - id: fmt-clean
+    severity: blocking
+    description: 'Rust formatting must be clean'
+    command: 'cargo fmt --all -- --check'
+
+  - id: no-unsafe-code
+    severity: blocking
+    description: 'Workspace policy forbids unsafe code'
+    check: "rg -n 'unsafe\\s*\\{|unsafe fn' crates/ --glob '*.rs'"
+
+  - id: no-unwrap-expect-panic
+    severity: blocking
+    description: 'Workspace denies unwrap_used, expect_used, and panic. Return typed errors with actionable context.'
+    check: "rg -n '\\.unwrap\\(\\)|\\.expect\\(|panic!\\(' crates/ --glob '*/src/**/*.rs'"
+    note: 'Test modules may differ; verify against the crate lint configuration rather than raw grep count.'
+
+  - id: product-boundary
+    severity: blocking
+    description: 'Production Compass must not reference Graphify, or use non-Compass configuration/artifact names'
+    command: 'sh scripts/check_product_boundary.sh'
+
+  - id: no-graphify-dependency
+    severity: blocking
+    description: 'No Graphify runtime, test, configuration, artifact, or fallback dependency may be introduced'
+    note: 'Enforced by product-boundary above; also verify no new build/CI automation checks out or executes Graphify.'
+
+  - id: local-first-preserved
+    severity: blocking
+    description: 'Structural extraction and graph queries must work without Python, model credentials, embeddings, a vector database, runtime grammar downloads, or Graphify'
+
+  - id: no-secrets-or-machine-paths
+    severity: blocking
+    description: 'No credentials, machine-specific paths, generated graphs, local .compass/ state, compass-out/, or private repository content committed outside the repository-owned .prometheus/knowledge/wiki transcript exception'
+    check: "rg -n 'sk-|api_key|API_KEY|BEGIN [A-Z ]*PRIVATE KEY' crates/ scripts/ --glob '!*.lock'"
+
+  - id: locked-dependencies
+    severity: blocking
+    description: 'Build and test commands use --locked; Cargo.lock is updated when dependency resolution changes'
+
+  - id: regression-test-present
+    severity: blocking
+    description: 'Behavior changes require a regression test at the lowest useful layer, plus an interface/contract test when user-visible behavior changes'
+
+  - id: determinism-preserved
+    severity: blocking
+    description: 'Discovery, identities, ordering, canonical encoding, and output stay deterministic for equivalent inputs. Ambiguity is never resolved by taking the first or most convenient candidate.'
+    check: "rg -n 'HashMap|HashSet' crates/ --glob '*/src/**/*.rs'"
+    note: 'Prefer BTreeMap/BTreeSet or explicit sorting at contract boundaries. Hits are not automatically failures — confirm no contract boundary depends on hash iteration order.'
+
+  - id: bounded-work
+    severity: blocking
+    description: 'All work over source files, graphs, archives, network responses, queries, and subprocess output remains bounded. A limit error is a distinct outcome from an empty result.'
+
+  - id: immutable-realizations
+    severity: blocking
+    description: 'Published historical realizations are immutable — never rewritten in place, never silently substituted with a different realization/profile'
+
+  - id: no-real-credentials-in-tests
+    severity: blocking
+    description: 'Network/provider tests use local mock servers and fixtures; subprocess work uses bounded fake runners. Never real credentials or services.'
+
+  - id: viewer-assets-generated
+    severity: blocking
+    description: 'Generated viewer assets must match their packages/compass-viewer source and never be hand-edited'
+    command: 'node scripts/check_viewer_assets.mjs'
+```
+
+---
+
+## Warning Constraints (acknowledge before archiving)
+
+```yaml
+- id: correct-ownership-boundary
+  severity: warning
+  description: 'Change lives in the lowest crate that owns the behavior (see the AGENTS.md ownership table). CLI and MCP layers stay thin.'
+
+- id: extractor-resolver-separation
+  severity: warning
+  description: 'Per-file extractors emit evidence only; project-wide target selection belongs in compass-resolve'
+
+- id: compatibility-documented
+  severity: warning
+  description: 'Incompatible user-visible changes include regression coverage, updated reference docs, a MIGRATION.md note when users must act, and a CHANGELOG.md entry when release-visible'
+  note: 'Compatibility-sensitive: CLI args/help/exits, env vars, configuration, graph JSON, CompassQL, MCP schemas, output files, history formats, stable IDs.'
+
+- id: compassql-gates
+  severity: warning
+  description: 'CompassQL grammar, execution, or support claims run their gates'
+  command: 'CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo test -p compass-cypher --test tck --locked && CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo test -p compass-query --test opencypher_tck --locked && python3 scripts/check_compassql_support.py'
+
+- id: code-graph-qualification
+  severity: warning
+  description: 'Code-graph publication, language, resolver, or viewer contract changes run the fixture release gate'
+  command: './scripts/qualify_code_graph_v1.sh --fixtures-only'
+
+- id: js-surface-verified
+  severity: warning
+  description: 'JavaScript, viewer, or VS Code changes typecheck and test'
+  command: 'npm ci && npm run typecheck:js && npm run test:js'
+
+- id: cli-product-contract
+  severity: warning
+  description: 'Public CLI or product identity changes run the product contract test'
+  command: 'CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo test -p compass-cli --test compass_product --locked'
+
+- id: ambiguity-and-negative-cases
+  severity: warning
+  description: 'Language/resolution tests cover ambiguity and negative cases — asserting identity, direction, occurrence/source range, provenance, multiplicity, and deterministic ordering — not just a happy-path symbol match'
+
+- id: workspace-dependencies-reused
+  severity: warning
+  description: 'Dependencies come from root Cargo.toml via {name}.workspace = true; new dependencies are justified'
+
+- id: platform-portable
+  severity: warning
+  description: 'Behavior stays portable across Linux, macOS, and Windows. No assumption of UTF-8 paths, Unix separators, or Unix-only process behavior without a guarded implementation and test.'
+
+- id: no-shell-construction
+  severity: warning
+  description: 'Subprocess integrations pass arguments separately and bound duration plus captured output — never construct shell command strings'
+
+- id: safe-primitives-reused
+  severity: warning
+  description: 'Existing bounded readers, subprocess helpers, path containment, endpoint checks, and atomic writes are reused rather than reimplemented as weaker local variants'
+
+- id: security-docs-updated
+  severity: warning
+  description: 'SECURITY.md or the security/privacy design docs are updated when a trust, credential, network, path, subprocess, or disclosure boundary changes'
+
+- id: performance-claims-qualified
+  severity: warning
+  description: 'PERFORMANCE.md is updated and the documented qualification is run when making performance claims. Correctness and deterministic equivalence take priority over speed.'
+
+- id: no-unrelated-diff-noise
+  severity: warning
+  description: 'git diff and git status --short contain no unrelated or generated noise; user changes are preserved'
+```
+
+---
+
+## Notes
+
+- `docs/superpowers/` describes designs, not shipped evidence — never cite it as
+  proof a behavior exists.
+- Unknown graph attributes are preserved unless the relevant contract explicitly
+  rejects them.
+- `make test` is workspace `--lib --bins` only. `make test-all` adds
+  `--all-targets --all-features` and requires the documented Python oracle setup.
+- Some Makefile targets (`install`, `dist`, `release-check`) resolve binaries
+  through a literal `target/` path after Cargo finishes. Inspect them before use
+  so they do not silently trigger a second local build.
diff --git a/.kbd-orchestrator/current-waypoint.json b/.kbd-orchestrator/current-waypoint.json
new file mode 100644
index 000000000..61b8d23d4
--- /dev/null
+++ b/.kbd-orchestrator/current-waypoint.json
@@ -0,0 +1,26 @@
+{
+  "schemaVersion": "5",
+  "path": [
+    "compass-scoping-and-bounds"
+  ],
+  "phase": "compass-scoping-and-bounds",
+  "previousPhase": null,
+  "change": null,
+  "status": "plan_ready",
+  "currentTask": "Apply C-001 \u2014 read_snapshot API split",
+  "nextPendingChange": "C-001",
+  "sourceTool": "claude",
+  "exactNextCommand": "/opsx:new stream-snapshot-read",
+  "parentPhase": null,
+  "childPhases": [],
+  "childPointer": null,
+  "backend": "openspec",
+  "wave": 1,
+  "lastCompletedChange": null,
+  "completionMetric": "implementation",
+  "implementationCompleted": 0,
+  "implementationTotal": 6,
+  "certificationStatus": "NOT_TRACKED",
+  "publicationStatus": "NOT_TRACKED",
+  "updatedAt": "2026-08-09T12:27:19Z"
+}
\ No newline at end of file
diff --git a/.kbd-orchestrator/current-waypoint.md b/.kbd-orchestrator/current-waypoint.md
new file mode 100644
index 000000000..0c991a3de
--- /dev/null
+++ b/.kbd-orchestrator/current-waypoint.md
@@ -0,0 +1,25 @@
+# Current waypoint
+
+**Phase:** compass-scoping-and-bounds
+**Status:** plan_ready
+**Progress:** 0 of 6 changes complete
+**Next command:** `/opsx:new stream-snapshot-read` (then `/kbd-execute`)
+
+## First change to apply
+
+**C-001 — Stop materializing the snapshot payload in `read_snapshot`**
+Owner: `compass-store`. Wave 1. Unblocks C-004 and C-005.
+
+## Blockers
+
+- **/Volumes/Workspace is NOT mounted.** Every compiling command requires
+  CARGO_TARGET_DIR beneath it; AGENTS.md forbids falling back to a local target/.
+  No change can be verified until this is resolved.
+- Identity/namespacing decision blocks C-005 *adoption* (not extraction).
+
+## Waves
+
+Wave 1 (parallel): C-001, C-002, C-003, C-006
+Wave 2 (gated on C-001): C-004 [HARD GATE], C-005
+
+_Updated: 
diff --git a/.kbd-orchestrator/model-preflight.json b/.kbd-orchestrator/model-preflight.json
new file mode 100644
index 000000000..47d5706f7
--- /dev/null
+++ b/.kbd-orchestrator/model-preflight.json
@@ -0,0 +1,35 @@
+{
+  "status": "ok",
+  "gateway": "http://localhost:4000/v1",
+  "roles": {
+    "judge": {
+      "model": "k3",
+      "source": "/Users/gqadonis/.prometheus/kbd/models.toml"
+    },
+    "critic": {
+      "model": "MiniMax-M3",
+      "source": "/Users/gqadonis/.prometheus/kbd/models.toml"
+    },
+    "generator": {
+      "model": "kbd-frontier",
+      "source": "/Users/gqadonis/.prometheus/kbd/models.toml"
+    }
+  },
+  "providers_detected": [
+    "openai",
+    "gemini",
+    "groq",
+    "fireworks",
+    "openrouter"
+  ],
+  "classes_available": [
+    "small",
+    "medium",
+    "frontier"
+  ],
+  "distinct_models": 2,
+  "config_path": "/Users/gqadonis/.config/liter-llm/liter-llm-proxy.toml",
+  "config_exists": true,
+  "config_defects": [],
+  "checked_at": "2026-08-09T11:08:23Z"
+}
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/analysis.md b/.kbd-orchestrator/phases/compass-scoping-and-bounds/analysis.md
new file mode 100644
index 000000000..64b49467c
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/analysis.md
@@ -0,0 +1,266 @@
+# Analysis — compass-scoping-and-bounds
+
+**Stage:** Analyze (between Assess and Spec)
+**Mode:** stack-specified (Rust workspace, Edition 2024 — no stack discovery needed)
+**Date:** 2026-08-09
+**Question carried from assessment:** *If a repository genuinely cannot publish under
+2 GiB even with correct exclusions, is the right answer graph partitioning/sharding
+rather than a larger number?*
+
+**Verdict: No — do not shard. Partitioning already exists and is unused on this path.
+The 2 GiB cap is a policy ceiling, not a capacity limit, and one read-path
+implementation detail undermines the invariant it claims to uphold.**
+
+---
+
+## The decisive finding
+
+`compass-store/src/lib.rs:44-51` documents the 2 GiB cap with this rationale:
+
+> "The local store is the bounded large-graph path and therefore accepts up to 2 GiB
+> **while serving records through indexed scans instead of materializing the whole
+> document**."
+
+That claim does not hold on the read path. `load_active_snapshot`
+(`compass-store/src/lib.rs:838-853`) does exactly what the comment says it avoids:
+
+```rust
+let capacity = usize::try_from(manifest.payload_bytes).unwrap_or(MAX_GRAPH_BYTES);
+let mut bytes = Vec::with_capacity(capacity);
+for index in 0..manifest.chunk_count {
+    ...
+    bytes.extend_from_slice(&chunk.value);
+```
+
+It pre-allocates up to the full payload size and concatenates every chunk into one
+contiguous `Vec<u8>`. Chunking (`CHUNK_BYTES` = 255 KiB, `compass-store/src/lib.rs:60`)
+bounds each *stored value*, not the reconstructed document. **A 2 GiB snapshot means a
+2 GiB allocation at read time.**
+
+Meanwhile the write path is genuinely streaming. `DigestWriter`
+(`compass-graph/src/snapshot.rs:3100-3126`) implements `io::Write`, hashing incrementally
+and counting bytes; `serde_json::to_writer` never builds the payload in memory:
+
+```rust
+fn write(&mut self, buffer: &[u8]) -> std::io::Result<usize> {
+    let next = self.bytes.saturating_add(buffer.len());
+    if next > self.maximum { self.exceeded = true; return Err(...); }
+    self.hasher.update(buffer);
+    self.bytes = next;
+    Ok(buffer.len())
+}
+```
+
+**So the cap is asymmetric with reality:** the write path could stream any size; the
+read path allocates the whole thing. The number 2 GiB is not protecting the writer —
+it is protecting the reader, but the doc comment claims the opposite. Whatever else
+this phase does, that inconsistency must be resolved, because it is the actual
+justification for the ceiling.
+
+---
+
+## Partitioning already exists — and is unused here
+
+`compass-history` has a complete partitioned graph representation
+(`compass-history/src/artifacts.rs:76-84`):
+
+```rust
+pub struct PartitionedGraph {
+    pub nodes: Vec<(Vec<u8>, Vec<u8>)>,
+    pub edges: Vec<(Vec<u8>, Vec<u8>)>,
+    pub hyperedges: Vec<(Vec<u8>, Vec<u8>)>,
+    pub analysis: Vec<(Vec<u8>, Vec<u8>)>,
+    pub metadata: Vec<(Vec<u8>, Vec<u8>)>,
+    pub program_facts: Vec<(Vec<u8>, Vec<u8>)>,
+    pub program_summaries: Vec<(Vec<u8>, Vec<u8>)>,
+}
+```
+
+with `partition()`, `into_partition()`, and `reconstruct()`
+(`artifacts.rs:168-181`, `341-345`). It splits a graph by *record class* and keys each
+record individually — precisely the shape a bounded publication path needs.
+
+A grep across all crates for `PartitionedGraph` / `into_partition` outside
+`compass-history` returns **nothing**. The current-graph publication path
+(`compass-graph::snapshot` → `compass-store`) does not use it. Compass therefore
+already owns the mechanism the assessment proposed building, applied to historical
+realizations but not to `compass init`.
+
+**This reframes the question.** It is not "should we build partitioning?" but "why
+does the current-graph path serialize one monolithic `CanonicalGraphDocument`
+(`snapshot.rs:2124-2131`) when a record-partitioned path already exists next door?"
+
+---
+
+## Research: sharding vs partitioning (firecrawl, tiers 1–4)
+
+Tier 1 (`gh`-equivalent code search) and internal inspection answered the primary
+question, so tier 4 was used only to validate the architectural direction. Budget:
+well under `max_queries_per_tier` (8) and `max_minutes` (20).
+
+The literature is consistent and points *away* from sharding for this problem:
+
+1. **Sharding is for multi-machine scaling — not applicable.** PuppyGraph: sharding's
+   goal "is no longer organizing data on one machine but scaling past the limits of any
+   one machine, in storage, in write throughput, and in total query capacity."
+   Compass is explicitly a **local-first single-process product** (AGENTS.md product
+   invariants). There is no second machine. Sharding solves a problem Compass does not
+   have and would import distributed-query costs for nothing.
+
+2. **Partitioning is the correct tool at a fixed ceiling.** Same source: "Partitioning
+   lowers the cost of operating under a fixed ceiling and is nearly free operationally;
+   sharding raises the ceiling itself but introduces a class of distributed-query costs."
+   Compass wants exactly the former — it *wants* the ceiling to stay.
+
+3. **Graph partitioning is uniquely hard and should be avoided when possible.**
+   PuppyGraph: "the inherent interconnectivity of graph data complicates the division of
+   the graph across machines while minimizing the edges that span partitions...
+   especially problematic for nodes with numerous relationships." Compass's existing
+   `PartitionedGraph` sidesteps this entirely by partitioning **by record class, not by
+   graph topology** — no cut edges, no cross-partition traversal penalty. That is the
+   right design and it is already written.
+
+4. **Azure Architecture Center:** "Prefer many small shards over few large ones," and
+   use the pattern only when "total data volume exceeds the storage capacity of a single
+   database instance, and no vertical scaling option addresses the shortfall." Neither
+   condition holds — a 2 GiB graph fits comfortably on disk; the constraint is a
+   self-imposed in-memory reconstruction.
+
+5. **Citus** notes sharding a graph is "perhaps the most unique approach," yielding
+   "multiple copies for your data sharded in different ways, eventual consistency...
+   and some application logic you have to map to your sharding strategy." Eventual
+   consistency is flatly incompatible with Compass's determinism invariant.
+
+**Conclusion from research:** sharding is rejected on architectural grounds. Streaming
+the read path is the intervention that matches both the literature and Compass's
+constraints.
+
+---
+
+## Candidate approaches evaluated
+
+### A — Stream the read path (recommended)
+
+Replace the `Vec::with_capacity(payload_bytes)` concatenation in
+`load_active_snapshot` with a chunk-streaming reader, so reconstruction never
+materializes the full document. This makes the store's doc comment *true*.
+
+- **Pros:** removes the actual memory constraint; no new abstraction; no contract or
+  format change; the cap becomes a genuine policy bound rather than an allocation
+  guard; unblocks any decision about the ceiling on honest terms.
+- **Cons:** every consumer of `load_active_snapshot` must accept a streaming/iterator
+  interface or the reconstruction must be pushed down — needs a consumer audit.
+- **Owner:** `compass-store`, with `compass-graph` adjusting to the new read shape.
+- **Risk:** medium — touches a public boundary. Requires round-trip, reopen, and
+  corruption/interruption coverage per AGENTS.md history/storage test policy.
+
+### B — Route current-graph publication through `PartitionedGraph` (recommended, sequenced after A)
+
+Reuse `compass-history`'s existing record-class partitioning for the current-graph
+path instead of one canonical JSON document.
+
+- **Pros:** the mechanism exists and is already tested for historical realizations;
+  partitions by record class so no edge-cut problem; naturally bounded per record.
+- **Cons:** `compass-history` currently owns it — moving or sharing it is an ownership
+  decision (AGENTS.md routes graph publication to `compass-graph`, immutable history to
+  `compass-history`). The two paths have different identity/fingerprint semantics that
+  must not be conflated.
+- **Owner:** requires an explicit ownership call before implementation.
+- **Risk:** medium-high — do not attempt before A; the ownership question is real.
+
+### C — Honor `COMPASS_MAX_GRAPH_BYTES` on the publication path (assessment G1)
+
+- **Pros:** small, resolves the documented inconsistency (4 crates honor it, 2 do not),
+  immediately unblocks the reported failure.
+- **Cons:** **unsafe until A lands.** Raising the cap today raises a real allocation.
+  Granting an override that lets a user request a 4 GiB contiguous `Vec` is a worse
+  failure than the current clean error.
+- **Sequencing:** must follow A. This is the single most important ordering constraint
+  in this analysis.
+
+### D — Shard the graph across stores — **rejected**
+
+Rejected on all five research points above, and on AGENTS.md grounds: local-first
+single-process product, determinism required, no eventual consistency permitted.
+
+### E — Raise the default cap — **rejected**
+
+AGENTS.md: work must remain bounded and "a limit error is not an empty result."
+Raising the default weakens an intentional invariant without addressing the read-path
+allocation. Rejected in assessment; re-affirmed here.
+
+---
+
+## Recommended sequence
+
+| Order | Change | Gap | Owner | Rationale |
+| --- | --- | --- | --- | --- |
+| 1 | Stream `load_active_snapshot`; correct or satisfy the doc comment | new (A) | `compass-store` | Removes the real constraint; prerequisite for everything else |
+| 2 | Make the limit error actionable | G2 | `compass-graph`, `compass-cli` | Cheap, independent, immediately useful |
+| 3 | Pre-flight size estimate — fail before 331 s | G3 | `compass-core` | Independent of 1; large UX win |
+| 4 | Honor `COMPASS_MAX_GRAPH_BYTES` on publication | G1 | `compass-graph`, `compass-store` | **Only after 1** |
+| 5 | Decide `vendor/` skip policy | G4 | `compass-files` | Independent; needs a deliberate call |
+| 6 | Evaluate routing current-graph publication through `PartitionedGraph` | — | TBD | Needs the ownership decision first |
+
+Items 2, 3, and 5 are independent of the partitioning question and can proceed in
+parallel with 1.
+
+---
+
+## Open questions for Spec/Plan
+
+1. **Ownership (blocks item 6):** `PartitionedGraph` lives in `compass-history`, but
+   AGENTS.md routes current-graph publication to `compass-graph`. Does the partitioning
+   primitive move to a shared crate, get duplicated with distinct identity semantics, or
+   does `compass-graph` depend on `compass-history`? This is an architecture decision,
+   not an implementation detail.
+2. **Consumer audit (blocks item 1):** who calls `load_active_snapshot`, and can they
+   accept a streaming interface? Not yet enumerated.
+3. **Unmeasured:** which node/edge classes dominate the 2 GiB payload in the failing
+   repo. Without this, item 3's estimator has no calibration data.
+4. **Untested:** whether `--exclude` on `universal-agent-runtime` lands under 2 GiB.
+   With 4,827 markdown files under `crates/` — undeletable without gutting the graph —
+   it may not. Still unverified, as flagged in the assessment.
+
+---
+
+## Adversarial review
+
+Preflight `status: ok` (judge `k3`, critic `MiniMax-M3`, generator `kbd-frontier`;
+2 distinct models, judge ≠ producer).
+
+**CRITICAL — raised and incorporated:** the original framing ("should we build
+partitioning?") would have produced a duplicate of `PartitionedGraph`. Refuted by
+grep — the primitive exists in `compass-history` and simply is not used on this path.
+Second CRITICAL: recommending option C (honor the override) *before* A would let a
+user request a multi-gigabyte contiguous allocation. Sequencing corrected; C is now
+explicitly gated behind A.
+
+**WARNING — carried to Spec:**
+- The `compass-store` doc comment is materially inaccurate about its own read path.
+  Whether the fix is the code or the comment, do not leave both as they are.
+- Item 6 must not start before the ownership question is answered.
+- Three of four open questions are unmeasured/untested. Confidence in the *direction*
+  is high (it rests on source inspection and convergent literature); confidence in
+  *sizing* any of this work is low.
+
+**Sycophancy check:** this analysis rejects the very framing the phase goal proposed
+(partitioning as the answer). The honest result is "the mechanism already exists, and
+the real defect is a read-path allocation nobody documented." Recorded as such rather
+than dressed up as a new feature.
+
+---
+
+## Evidence index
+
+- `crates/compass-store/src/lib.rs:44-51` — cap rationale (claims non-materialization)
+- `crates/compass-store/src/lib.rs:838-853` — read path that *does* materialize
+- `crates/compass-store/src/lib.rs:39,60` — `MAX_VALUE_BYTES`, `CHUNK_BYTES`
+- `crates/compass-graph/src/snapshot.rs:3100-3126` — streaming `DigestWriter`
+- `crates/compass-graph/src/snapshot.rs:2124-2131` — monolithic canonical document
+- `crates/compass-graph/src/snapshot.rs:39` — `GRAPH_SNAPSHOT_MAX_ITEMS` = 5,000,000
+- `crates/compass-history/src/artifacts.rs:76-84,168-181,341-345` — `PartitionedGraph`
+- puppygraph.com/learn/sharding-vs-partitioning — partitioning vs sharding at a ceiling
+- puppygraph.com/blog/when-to-use-graph-database — graph partitioning difficulty
+- learn.microsoft.com/azure/architecture/patterns/sharding — when sharding applies
+- citusdata.com/blog/2017/08/28/five-data-models-for-sharding — graph sharding costs
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/assessment.md b/.kbd-orchestrator/phases/compass-scoping-and-bounds/assessment.md
new file mode 100644
index 000000000..30eebe271
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/assessment.md
@@ -0,0 +1,192 @@
+# Assessment — compass-scoping-and-bounds
+
+**Phase:** compass-scoping-and-bounds (provisional — not yet created via `/kbd-new-phase`)
+**Date:** 2026-08-09
+**Question:** Should scoping be added as a feature right now?
+**Verdict:** **No — scoping already exists and already works. The real defects are elsewhere.**
+
+---
+
+## Correction to the initial diagnosis
+
+An earlier hypothesis in this session claimed the default ignore policy was missing
+`node_modules/`, `target/`, and `compass-out/`. **That was wrong.** Direct source
+inspection disproves it:
+
+| Claim | Reality | Evidence |
+| --- | --- | --- |
+| Defaults miss `node_modules`/`target`/`compass-out` | All three are present | `crates/compass-files/src/detect.rs:61-102` (`SKIP_DIRS`) |
+| Gitignore not respected | Respected by default | `detect.rs:163` (`gitignore: true`) |
+| Scoping absent | `--include`/`--exclude` + interactive prompts exist | `crates/compass-cli/src/init_commands.rs:438-462` |
+
+`SKIP_DIRS` holds ~40 entries and additionally skips dot-directories, `*_venv`,
+`*_env`, and `*.egg-info` (`detect.rs:252-268`, `484-500`). `.compassignore` is
+supported alongside `.gitignore` (`detect.rs:390-392`).
+
+**Scoping is not the gap. Building the feature would be duplicated work.**
+
+---
+
+## What actually happened
+
+The target repository is a genuinely large, document-dense monorepo. Measured
+directly:
+
+```text
+9,320  markdown files in scope AFTER all default exclusions
+4,827    └── under crates/ alone
+1,092    └── openspec/
+  780    └── frontend/
+```
+
+The reported `Matched: 19666 files (9470 code, 9679 documents, ...)` is therefore
+**correct behavior over real content**, not a discovery leak. The exclusions fired;
+there is simply that much in-scope material.
+
+The failure is a true capacity limit:
+
+```text
+error: snapshot limit exceeded: canonical graph exceeds the 2147483648-byte limit
+Compass init failed after 331.90s wall time.
+```
+
+Origin: `crates/compass-graph/src/snapshot.rs:3138` (`digest_json`), enforcing
+`MAX_GRAPH_BYTES` = 2 GiB from `crates/compass-store/src/lib.rs:51`.
+
+---
+
+## Confirmed gaps
+
+### G1 — The 2 GiB cap has no override on the publication path (blocking UX defect)
+
+`COMPASS_MAX_GRAPH_BYTES` is honored in `compass-model` (`graph.rs:370`),
+`compass-output` (`json.rs:414`), `compass-global` (`lib.rs:370`), and
+`compass-core` (`diagnostics.rs:713`). Those crates' errors *advertise* the
+override:
+
+> `(set COMPASS_MAX_GRAPH_BYTES=<bytes> or COMPASS_MAX_GRAPH_BYTES=<N>GB to raise the limit)`
+
+Neither `compass-graph/src/snapshot.rs` nor `compass-store/src/lib.rs` reads that
+variable (verified by grep — zero occurrences in either file). The user hits a
+limit that the rest of the product treats as adjustable, with **no override and no
+remedy in the message**.
+
+This is an internal inconsistency, not merely a missing feature.
+
+### G2 — The error is unactionable (blocking UX defect)
+
+The message states a fact and stops. It does not name the override, suggest
+`--exclude`, mention `.compassignore`, or report which content dominated the graph.
+Compare `compass-core/src/diagnostics.rs:453`, which does guide the user.
+
+### G3 — Failure occurs after 331 s, at the end (efficiency defect)
+
+The cap is enforced at serialization time. All extraction, resolution, and analysis
+completes first, then publication fails and the work is discarded. No pre-flight
+estimate, no progressive warning.
+
+### G4 — `vendor/` is absent from `SKIP_DIRS` (minor, genuine)
+
+`vendor/` (126 MB in the target repo; 441 markdown files) is not skipped. Note this
+is deliberate for some ecosystems — Go's `vendor/` holds real dependency source —
+so this needs a decision, not a reflex addition. Compass's own tree has a
+`vendor/` it legitimately reads.
+
+---
+
+## Research: current practice (firecrawl, 2026-08-09)
+
+Convergent evidence across indexers and formatters:
+
+1. **Respect `.gitignore` by default** — described in a comparative formatter study
+   as "the single most important default" and "the single highest-value default"
+   (Ruff ✅, Prettier v3+ ✅, dprint ✅, Black ✅; Biome opt-in).
+   → **Compass already does this.**
+
+2. **Ship hardcoded defaults beyond VCS ignore** — `ck` (`.ckignore`),
+   `codegraphcontext` (`.cgcignore`), `understand-anything` (`.understandignore`)
+   all bundle `node_modules/`, `target/`, `dist/`, `build/`.
+   → **Compass already does this, with a larger list than the examples surveyed.**
+
+3. **Provide a tool-specific ignore file layered over `.gitignore`** — universal
+   across the sample (`.ckignore`, `.cursorignore`, `.rgignore`, `.ignore`).
+   → **Compass already does this (`.compassignore`).**
+
+4. **Explicit paths override ignore rules.** From the MemSearch discussion
+   (zilliztech/memsearch#612, Jul 2026): "If the user explicitly specifies a file
+   path to index, that file should still be indexed... since that represents an
+   explicit user choice."
+   → Worth verifying Compass's behavior; not assessed here.
+
+5. **ripgrep's `--no-ignore-vcs` precedent** (BurntSushi, ripgrep#645): the
+   maintainer holds that an explicit paired flag is "the 'right' answer" over
+   changing defaults.
+   → Supports G1's remedy shape: an *explicit override*, not a raised default.
+
+**Nothing in the research supports building a scoping feature. It supports the
+opposite — Compass is already at or above the surveyed baseline on scoping.**
+
+---
+
+## Adversarial review
+
+Applied per `/adversarial-review --mode artifact assess`. Preflight `status: ok`,
+judge `k3` ≠ generator `kbd-frontier`, so judge ≠ producer.
+
+**CRITICAL — raised and resolved:** the original framing ("add scoping") would have
+shipped a duplicate of `SKIP_DIRS` + `--exclude` + `.compassignore`. Refuted by
+source inspection; assessment rewritten. This is the finding that changes the
+recommendation, and it came from checking the code rather than trusting the
+initial hypothesis.
+
+**WARNING — carried forward:**
+
+- **Do not raise the 2 GiB cap.** `AGENTS.md` requires bounded work and states a
+  limit error is a distinct outcome from an empty result. Raising the default
+  weakens an intentional invariant. Grant an *explicit, opt-in* override instead.
+- **G4 needs a decision, not a reflex.** Skipping `vendor/` breaks Go monorepos and
+  conflicts with Compass's own vendored tree.
+- **Sycophancy check:** the prior turn's confident "not a bug — three defects"
+  framing was partly wrong (the ignore-policy claim). Recorded rather than quietly
+  dropped.
+
+**Unverified / open:**
+
+- Whether the suggested `--exclude` workaround actually lands under 2 GiB is
+  **untested**. With 4,827 markdown files under `crates/` — a directory that cannot
+  be excluded without gutting the graph — it may well still exceed the cap.
+- No measurement of which node/edge classes dominate the 2 GiB payload.
+
+---
+
+## Recommendation
+
+**Do not build scoping.** Sequence instead:
+
+| Pri | Gap | Change | Owner crate |
+| --- | --- | --- | --- |
+| 1 | G1 | Honor `COMPASS_MAX_GRAPH_BYTES` on the snapshot/publication path, or explicitly document why it must not be honored | `compass-graph`, `compass-store` |
+| 2 | G2 | Make the limit error actionable — name the override, `--exclude`, `.compassignore`, and the dominant content class | `compass-graph` (message), `compass-cli` (thin) |
+| 3 | G3 | Pre-flight size estimate so a doomed build fails early rather than after 331 s | `compass-core` |
+| 4 | G4 | Decide `vendor/` policy deliberately | `compass-files` |
+
+G1 and G2 together resolve the reported failure. G3 is the quality-of-life fix.
+
+**Open question for the next stage:** if a repo of this size genuinely cannot
+publish under 2 GiB even with sane exclusions, is the correct answer a graph
+partitioning/sharding strategy rather than a bigger number? That is an
+architecture question, not a scoping one, and it should be settled in `/kbd-analyze`
+before any code is written.
+
+---
+
+## Evidence index
+
+- `crates/compass-files/src/detect.rs:61-102` — `SKIP_DIRS`
+- `crates/compass-files/src/detect.rs:163` — `gitignore: true`
+- `crates/compass-files/src/detect.rs:252-268`, `484-500` — skip enforcement
+- `crates/compass-files/src/detect.rs:390-392` — `.compassignore`
+- `crates/compass-cli/src/init_commands.rs:365-377`, `438-462` — scoping surface
+- `crates/compass-store/src/lib.rs:51` — `MAX_GRAPH_BYTES`
+- `crates/compass-graph/src/snapshot.rs:3138` — failure site
+- `crates/compass-core/src/diagnostics.rs:453` — actionable-message precedent
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/decision-log.md b/.kbd-orchestrator/phases/compass-scoping-and-bounds/decision-log.md
new file mode 100644
index 000000000..a14e5c49c
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/decision-log.md
@@ -0,0 +1,42 @@
+# Decision log — compass-scoping-and-bounds
+
+### 2026-08-09T12:03:31Z — Scoping rejected as a feature (Assess)
+Decision: do NOT build scoping. Provenance: source inspection.
+SKIP_DIRS (~40 entries), gitignore-by-default, .compassignore, and --include/--exclude
+all already ship and worked correctly. Corrected an earlier in-session claim that the
+default ignore policy was missing node_modules/target/compass-out — that claim was wrong.
+
+### 2026-08-09T12:03:31Z — Sharding rejected (Analyze)
+Options: record-class partitioning (existing) vs distributed sharding.
+Decision: partitioning; sharding rejected. Provenance: research + AGENTS.md invariants.
+Not contested (>15% gap): sharding is a multi-machine technique and Compass is
+local-first single-process; it would import eventual consistency, which the determinism
+invariant forbids.
+
+### 2026-08-09T12:03:31Z — Partitioning already exists
+Decision: do not build it. Provenance: grep.
+compass-history::PartitionedGraph implements record-class partitioning with
+partition()/into_partition()/reconstruct(). Unused outside compass-history. The real
+question is why the current-graph path serializes a monolithic document instead.
+
+### 2026-08-09T12:03:31Z — Read-path allocation identified as the true constraint
+Decision: stream load_active_snapshot first; gate the COMPASS_MAX_GRAPH_BYTES override
+behind it. Provenance: source inspection.
+compass-store/src/lib.rs:838-853 pre-allocates payload_bytes and concatenates every
+chunk into one contiguous Vec, contradicting the crate's own doc comment at lines 44-51.
+The write path streams (DigestWriter); the read path does not. Granting the override
+before fixing this would let a user request a multi-gigabyte contiguous allocation.
+
+### 2026-08-09T12:21:35Z — PartitionedGraph to a shared crate (user decision)
+Decision: extract to `compass-partition`. Provenance: user directive.
+Analysis had recommended deferring behind the streaming fix; user directed extraction.
+Scope constrained by dependency reality: the container + key/canonical helpers move;
+into_partition and history-coupled logic (CompletionEvidence, sidecars, AnalysisBundle,
+ProgramBundle, prolly) stay. Blocking rule: the new crate must not pull prolly-map,
+prolly-store-sqlite, compass-ir, or compass-analysis onto the current-graph path.
+
+### 2026-08-09T12:21:35Z — Consumer audit changes C-001 scope (Spec)
+Decision: spec C-001 as an API split, not a streaming refactor. Provenance: source audit.
+read_snapshot has 8 call sites; both production callers discard the payload with `_`,
+and compass-query already uses GraphSnapshotReader::open_selector. The 2 GiB allocation
+is incurred for a value nothing in production reads.
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/goals.md b/.kbd-orchestrator/phases/compass-scoping-and-bounds/goals.md
new file mode 100644
index 000000000..2ccf71370
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/goals.md
@@ -0,0 +1,41 @@
+# Phase goals — compass-scoping-and-bounds
+
+## Objective
+
+Make Compass fail gracefully and act recoverably when a repository's canonical
+graph exceeds the 2 GiB `MAX_GRAPH_BYTES` publication limit, without weakening
+the bounded-work invariant that limit exists to enforce.
+
+Triggered by a real failure: `compass init` on a 6.8 GB monorepo
+(`universal-agent-runtime`, 9,320 in-scope markdown files, 4,827 under `crates/`)
+failed after 331.90s with:
+
+    error: snapshot limit exceeded: canonical graph exceeds the 2147483648-byte limit
+
+Assessment established that scoping is NOT the gap — `SKIP_DIRS`, `.gitignore`
+respect, `.compassignore`, and `--include`/`--exclude` all already ship and all
+worked correctly. The matched content was legitimately in scope.
+
+## Goals
+
+- **G1** — Resolve the override inconsistency: `COMPASS_MAX_GRAPH_BYTES` is
+  honored in `compass-model`, `compass-output`, `compass-global`, and
+  `compass-core` (whose errors advertise it), but not on the
+  `compass-graph`/`compass-store` publication path that actually fails. Either
+  honor it there or document explicitly why it must not be.
+- **G2** — Make the limit error actionable: name the remedy, not just the fact.
+- **G3** — Fail fast: a doomed build should not consume 331s before reporting.
+- **G4** — Decide `vendor/` default-skip policy deliberately (Go vendor dirs and
+  Compass's own `vendor/` are legitimate source).
+
+## Open architecture question (this phase's Analyze target)
+
+If a repository of this size genuinely cannot publish under 2 GiB even with
+correct exclusions, is the right answer **graph partitioning/sharding** rather
+than a larger number? Settle this before writing code.
+
+## Non-goals
+
+- Building a scoping feature (already exists).
+- Raising the 2 GiB default. AGENTS.md requires bounded work and states a limit
+  error is a distinct outcome from an empty result.
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/handoffs/analyze.md b/.kbd-orchestrator/phases/compass-scoping-and-bounds/handoffs/analyze.md
new file mode 100644
index 000000000..a6061bc84
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/handoffs/analyze.md
@@ -0,0 +1,40 @@
+# Stage handoff — analyze
+
+**Stage:** analyze
+**Completed:** 2026-08-09T12:03:31Z
+**Next stage:** spec
+
+## Summary
+
+Sharding is rejected; partitioning already exists in compass-history
+(PartitionedGraph) and is unused by the current-graph publication path. The true
+constraint is not the 2 GiB number but load_active_snapshot
+(compass-store/src/lib.rs:838-853), which pre-allocates payload_bytes and concatenates
+all chunks into one contiguous Vec — directly contradicting the crate's doc comment at
+lines 44-51 claiming records are served without materializing the whole document. The
+write path already streams via DigestWriter.
+
+## Blocking sequencing constraint
+
+Honoring COMPASS_MAX_GRAPH_BYTES on the publication path (G1) MUST NOT land before the
+read path streams. Raising the cap today raises a real allocation; an override would let
+a user request a multi-gigabyte contiguous Vec — a worse failure than the current clean
+error.
+
+## Open questions for spec
+
+1. Ownership: PartitionedGraph lives in compass-history, but AGENTS.md routes
+   current-graph publication to compass-graph. Move to a shared crate, duplicate with
+   distinct identity semantics, or add a dependency? Architecture decision — blocks item 6.
+2. Consumer audit of load_active_snapshot — not yet enumerated; blocks item 1 sizing.
+3. Unmeasured: which node/edge classes dominate the 2 GiB payload.
+4. Untested: whether --exclude on universal-agent-runtime lands under 2 GiB. With 4,827
+   markdown files under crates/ it may not.
+
+## WARNING findings from adversarial review
+
+- compass-store doc comment is materially inaccurate about its own read path; fix the
+  code or the comment, but do not leave both.
+- Item 6 must not start before the ownership question is answered.
+- Confidence in direction is high (source inspection + convergent literature);
+  confidence in sizing is low — 3 of 4 open questions are unmeasured.
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/handoffs/plan.md b/.kbd-orchestrator/phases/compass-scoping-and-bounds/handoffs/plan.md
new file mode 100644
index 000000000..46f82773d
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/handoffs/plan.md
@@ -0,0 +1,38 @@
+# Stage handoff — plan
+
+**Stage:** plan
+**Completed:** 2026-08-09T12:27:19Z
+**Next stage:** execute
+
+## Summary
+
+6 changes in 2 waves. Wave 1 (C-001, C-002, C-003, C-006) has no dependencies and can run
+in parallel; Wave 2 (C-004, C-005) is gated on C-001. Apply **C-001** first — it is the
+only Wave 1 item that unblocks others, and the spec-stage consumer audit showed it is an
+API split rather than the streaming refactor originally assumed. Backend is OpenSpec.
+
+## Ordering rationale
+
+C-004 must not precede C-001: an override before the read path streams lets a user request
+a multi-gigabyte contiguous Vec, strictly worse than today's clean error. C-005 is also
+sequenced after C-001 so the extraction happens against an honest read path.
+
+## WARNING findings from adversarial review
+
+- C-003 has testable acceptance criteria but no calibration data. Measuring payload
+  composition is its first task, not an afterthought.
+- C-002 and C-004 are coupled through the error text: C-002 omits the override, C-004 adds
+  it. If C-004 slips, C-002's message stays permanently incomplete — track explicitly.
+- C-005's dependency rule (no prolly-map / prolly-store-sqlite / compass-ir /
+  compass-analysis) is a stop-and-report gate, not a preference.
+- Every acceptance box is unverifiable while /Volumes/Workspace is unmounted.
+
+## Blockers
+
+1. **/Volumes/Workspace NOT mounted** — blocks all verification. Re-checked at plan time.
+2. Identity/namespacing for shared record keys — blocks C-005 adoption, not extraction.
+
+## Unmeasured
+
+- Payload composition (blocks C-003 calibration).
+- Whether --exclude on universal-agent-runtime lands under 2 GiB.
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/handoffs/spec.md b/.kbd-orchestrator/phases/compass-scoping-and-bounds/handoffs/spec.md
new file mode 100644
index 000000000..163947bd8
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/handoffs/spec.md
@@ -0,0 +1,44 @@
+# Stage handoff — spec
+
+**Stage:** spec
+**Completed:** 2026-08-09T12:21:35Z
+**Next stage:** plan (or execute)
+
+## Summary
+
+Six changes specced with a hard sequencing gate. The consumer audit that analyze flagged
+as blocking is complete and shrank C-001 substantially: read_snapshot's 8 call sites
+include only two production callers, both of which discard the payload with `_`, while
+compass-query already reads through GraphSnapshotReader::open_selector. C-001 is an API
+split, not a streaming rewrite.
+
+## Hard gates
+
+1. C-004 (COMPASS_MAX_GRAPH_BYTES override) MUST NOT land before C-001. An override
+   before the read path stops materializing lets a user request a multi-gigabyte
+   contiguous Vec.
+2. C-005: compass-partition MUST NOT depend on prolly-map, prolly-store-sqlite,
+   compass-ir, or compass-analysis. If that cannot be satisfied, STOP and report —
+   it means the shared-crate framing does not hold.
+3. C-002 must not advertise the override before C-004 exists.
+
+## Scope honesty
+
+C-005 as directed extracts PartitionedGraph plus key/canonical helpers — a struct and
+four functions out of a 2,317-line module. It positions for current-graph partitioned
+publication; it does not deliver it. That is a further change requiring the identity
+decision below.
+
+## Open questions
+
+1. Identity/namespacing for shared record keys — blocks C-005 adoption (not extraction).
+   History fingerprints are meaning-affecting and realizations immutable; shared keys
+   must not collide or conflate across paths.
+2. Payload composition unmeasured — blocks C-003 calibration.
+3. Untested: whether --exclude on universal-agent-runtime lands under 2 GiB.
+
+## Environment blocker
+
+/Volumes/Workspace is NOT mounted. Every compiling command requires
+CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main. Execution cannot
+verify anything until that volume is available.
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/library-candidates.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/library-candidates.json
new file mode 100644
index 000000000..9470658b0
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/library-candidates.json
@@ -0,0 +1,59 @@
+{
+  "phase": "compass-scoping-and-bounds",
+  "generated_at": "2026-08-09T11:30:19Z",
+  "research_budget": {
+    "max_queries_per_tier": 8,
+    "max_minutes": 20,
+    "queries_used": { "tier1": 2, "tier2": 0, "tier3": 0, "tier4": 2 }
+  },
+  "gaps_addressed": ["G1", "G2", "G3", "G4", "ARCH-partitioning"],
+  "candidates": [
+    {
+      "id": "cand-001",
+      "name": "compass-history::PartitionedGraph",
+      "kind": "framework",
+      "verdict": "adopt",
+      "fit_for_gap": "ARCH-partitioning",
+      "notes": "Record-class partitioning already implemented and tested in-repo for historical realizations; unused by the current-graph publication path. Partitions by record class, not graph topology, so no edge-cut problem. Adoption blocked on an ownership decision (compass-history vs compass-graph).",
+      "evidence": [
+        { "tier": 1, "source_url": "crates/compass-history/src/artifacts.rs:76-84", "claim": "PartitionedGraph splits nodes/edges/hyperedges/analysis/metadata/program_facts/program_summaries into individually keyed records" },
+        { "tier": 1, "source_url": "crates/compass-history/src/artifacts.rs:168-181", "claim": "partition(), into_partition(), and reconstruct() exist and round-trip" },
+        { "tier": 1, "source_url": "grep PartitionedGraph across crates/", "claim": "No usage outside compass-history; current-graph path does not use it" }
+      ]
+    },
+    {
+      "id": "cand-002",
+      "name": "Distributed graph sharding (multi-store)",
+      "kind": "pattern",
+      "verdict": "reject",
+      "fit_for_gap": "ARCH-partitioning",
+      "notes": "Solves multi-machine scaling. Compass is local-first single-process; sharding would add distributed-query cost and eventual consistency, violating the determinism invariant.",
+      "evidence": [
+        { "tier": 4, "source_url": "https://www.puppygraph.com/learn/sharding-vs-partitioning", "claim": "Sharding targets scaling past the limits of any one machine; partitioning lowers cost under a fixed ceiling and is nearly free operationally" },
+        { "tier": 4, "source_url": "https://learn.microsoft.com/en-us/azure/architecture/patterns/sharding", "claim": "Apply only when total data volume exceeds single-instance capacity and vertical scaling cannot address it" },
+        { "tier": 4, "source_url": "https://www.citusdata.com/blog/2017/08/28/five-data-models-for-sharding/", "claim": "Graph sharding yields multiple differently-sharded copies and typically eventual consistency" },
+        { "tier": 4, "source_url": "https://www.puppygraph.com/blog/when-to-use-graph-database", "claim": "Graph interconnectivity makes topological partitioning hard, especially for high-degree nodes" }
+      ]
+    },
+    {
+      "id": "cand-003",
+      "name": "Streaming chunk reader for load_active_snapshot",
+      "kind": "build",
+      "verdict": "adopt",
+      "fit_for_gap": "ARCH-partitioning",
+      "notes": "No external library needed. The write path already streams via DigestWriter; the read path does not. Making the read path stream removes the real memory constraint and makes the crate's own doc comment true. Prerequisite for G1.",
+      "evidence": [
+        { "tier": 1, "source_url": "crates/compass-store/src/lib.rs:838-853", "claim": "load_active_snapshot pre-allocates payload_bytes and concatenates all chunks into one contiguous Vec<u8>" },
+        { "tier": 1, "source_url": "crates/compass-store/src/lib.rs:44-51", "claim": "Doc comment claims records are served through indexed scans instead of materializing the whole document" },
+        { "tier": 1, "source_url": "crates/compass-graph/src/snapshot.rs:3100-3126", "claim": "DigestWriter implements io::Write and hashes incrementally; the write path never materializes the payload" }
+      ]
+    }
+  ],
+  "build_required": [
+    { "gap": "A", "description": "Stream load_active_snapshot so reconstruction never materializes the full document" },
+    { "gap": "G2", "description": "Make the snapshot limit error actionable (name override, --exclude, .compassignore, dominant content class)" },
+    { "gap": "G3", "description": "Pre-flight graph size estimate so oversized builds fail before full extraction" },
+    { "gap": "G1", "description": "Honor COMPASS_MAX_GRAPH_BYTES on the publication path — ONLY after A" },
+    { "gap": "G4", "description": "Decide vendor/ default-skip policy deliberately" }
+  ]
+}
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/plan.md b/.kbd-orchestrator/phases/compass-scoping-and-bounds/plan.md
new file mode 100644
index 000000000..7242cf65c
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/plan.md
@@ -0,0 +1,195 @@
+# Plan — compass-scoping-and-bounds
+
+**Stage:** Plan
+**Date:** 2026-08-09
+**Backend:** OpenSpec (`openspec/` present, `openspec_available: true`)
+**Evolver cycle:** none
+**Changes:** 6 — 0 complete
+
+Reads `assessment.md`, `analysis.md`, `spec.md`, `library-candidates.json`,
+`handoffs/{analyze,spec}.md`.
+
+---
+
+## Ordering rationale
+
+Wave 1 is everything with no dependency. Wave 2 is gated on C-001, because until the read
+path stops materializing the payload, both dependents are unsafe or premature.
+
+```
+Wave 1 (parallel)          Wave 2 (after C-001)
+├── C-001  read_snapshot   ├── C-004  env override   [HARD GATE]
+├── C-002  error message   └── C-005  compass-partition
+├── C-003  size estimate
+└── C-006  vendor/ policy
+```
+
+**Apply C-001 first.** It is the only Wave 1 item that unblocks others, and the audit
+showed it is smaller than originally scoped.
+
+---
+
+## Wave 1
+
+### C-001 — Stop materializing the snapshot payload in `read_snapshot`
+
+- **OpenSpec:** `/opsx:new stream-snapshot-read`
+- **Owner:** `compass-store` · **Agent:** claude · **Risk:** medium
+- **Library:** `cand-003` (build — no external library; verdict `adopt`)
+- **Compatibility-sensitive:** yes (`read_snapshot` is `pub`)
+
+Add `read_snapshot_manifest()`; reimplement `validate_snapshot` (`lib.rs:935`) and
+`snapshot_reference` (`lib.rs:1184`) on it. Replace the
+`Vec::with_capacity(payload_bytes)` concatenation (`lib.rs:838-853`) with a streaming
+chunk form. Keep the per-chunk running total and `MAX_GRAPH_BYTES` check.
+
+**Done when**
+- [ ] No production path allocates proportional to `payload_bytes`
+- [ ] `validate_snapshot` / `snapshot_reference` return identical results for valid **and**
+      corrupt snapshots
+- [ ] Round-trip, reopen, corruption/interruption, publication-atomicity tests
+- [ ] `lib.rs:44-51` doc comment satisfied or corrected — not left as is
+- [ ] `CHANGELOG.md`; `MIGRATION.md` only if the public signature changes
+
+### C-002 — Make the snapshot limit error actionable
+
+- **OpenSpec:** `/opsx:new actionable-snapshot-limit-error`
+- **Owner:** `compass-graph` (message), `compass-cli` (presentation) · **Agent:** claude
+- **Risk:** low · **Compatibility-sensitive:** yes (error text)
+
+Follow the precedent at `compass-core/src/diagnostics.rs:453`. Name `--exclude` /
+`.compassignore`. **Do not mention `COMPASS_MAX_GRAPH_BYTES` until C-004 ships.**
+
+**Done when**
+- [ ] Error names at least one concrete next action
+- [ ] CLI test under `crates/compass-cli/tests/` asserts rendered text and exit code
+- [ ] No override advertised that does not exist on this path
+
+### C-003 — Pre-flight graph size estimate
+
+- **OpenSpec:** `/opsx:new preflight-graph-size-estimate`
+- **Owner:** `compass-core` · **Agent:** claude · **Risk:** medium
+
+The reported failure burned 331.90 s then discarded everything. Estimate before publication.
+
+**Done when**
+- [ ] Oversized build reports before full extraction completes
+- [ ] Estimate deterministic for equivalent inputs
+- [ ] Limit outcome stays distinct from an empty result
+- [ ] Estimation itself bounded
+
+> **Measure first.** Payload composition is unmeasured — which node/edge classes dominate
+> the 2 GiB is unknown. Start by measuring against a real oversized repo; do not invent a
+> heuristic.
+
+### C-006 — Decide `vendor/` default-skip policy
+
+- **OpenSpec:** `/opsx:new vendor-skip-policy`
+- **Owner:** `compass-files` · **Agent:** claude · **Risk:** low
+- **Compatibility-sensitive:** yes (discovery scope)
+
+`vendor/` is absent from `SKIP_DIRS` (`detect.rs:61-102`). Go vendor dirs hold real source,
+and `vendor/compass-tree-sitter-language-pack` is a workspace member of this repo.
+
+**Done when**
+- [ ] Deliberate documented decision: skip / skip-unless-workspace-member / leave
+- [ ] Test pins the chosen behavior
+- [ ] Compass's own `vendor/` workspace member still discovered if that is the decision
+
+---
+
+## Wave 2 — gated on C-001
+
+### C-004 — Honor `COMPASS_MAX_GRAPH_BYTES` on the publication path
+
+- **OpenSpec:** `/opsx:new honor-max-graph-bytes-on-publication`
+- **Owner:** `compass-graph`, `compass-store` · **Agent:** claude · **Risk:** medium
+- **Depends on:** C-001 — **HARD GATE**
+
+> **Do not start before C-001 is merged.** An override before the read path streams lets a
+> user request a multi-gigabyte contiguous `Vec` — strictly worse than today's clean error.
+
+Resolve the inconsistency: honored in `compass-model` (`graph.rs:370`), `compass-output`
+(`json.rs:414`), `compass-global` (`lib.rs:370`), `compass-core` (`diagnostics.rs:713`);
+not in `compass-graph/snapshot.rs` or `compass-store`.
+
+**Done when**
+- [ ] Consistent with the four crates that honor it, or a documented exception
+- [ ] Default stays 2 GiB (no default increase — AGENTS.md bounded work)
+- [ ] Override explicit and opt-in
+- [ ] C-002's message updated to advertise it, in the same change or immediately after
+
+### C-005 — Extract `compass-partition` shared crate
+
+- **OpenSpec:** `/opsx:new extract-compass-partition`
+- **Owner:** new crate `compass-partition` · **Agent:** claude · **Risk:** medium
+- **Depends on:** C-001 · **Library:** `cand-001` (adopt — in-repo, `compass-history`)
+
+**Moves:** `PartitionedGraph` (`artifacts.rs:76-84`), `node_key`/`edge_key`/`hyperedge_key`
+(`keys.rs:10,20,46`), `canonical_json_bytes` (`canonical.rs:9`).
+
+**Does not move:** `into_partition` and all history-coupled logic — `CompletionEvidence`,
+`authoritative_sidecars`, `AnalysisBundle`, `compass_ir::ProgramBundle`, `HistoryError`,
+`prolly::{KeyBuilder, VersionedValue}`.
+
+> **Blocking dependency rule.** `compass-partition` must NOT depend on `prolly-map`,
+> `prolly-store-sqlite`, `compass-ir`, or `compass-analysis`. `compass-graph` depends on
+> none of these today. **If this cannot be satisfied, STOP and report** — it means the
+> shared-crate framing does not hold and the decision needs revisiting.
+
+**Done when**
+- [ ] `compass-history` behavior byte-identical; existing canonical-encoding, round-trip,
+      and diff tests pass **unchanged**
+- [ ] Workspace member added to root `Cargo.toml`; deps via `{name}.workspace = true`
+- [ ] Workspace lint policy applies (no `unsafe`, no `unwrap`/`expect`/`panic`)
+- [ ] No new transitive dependency reaches `compass-graph`
+- [ ] Own error type; `compass-history` converts at its boundary
+
+**Scope note (carried from spec):** this extracts a struct and four helpers from a
+2,317-line module. It positions for current-graph partitioned publication; it does not
+deliver it. That is a further change requiring the identity decision below.
+
+---
+
+## Blocked before execution
+
+### Environment — blocks all verification
+
+`/Volumes/Workspace` is **not mounted** (re-checked at plan time). Every compiling command
+requires `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main`. Per AGENTS.md,
+falling back to a local `target/` is forbidden — stop and report instead. **No change can be
+verified until that volume is available.**
+
+### Decision — blocks C-005 adoption (not extraction)
+
+Identity/namespacing for shared record keys. History fingerprints are meaning-affecting and
+published realizations immutable. Before any current-graph consumer adopts the shared keys,
+either namespace per path or prove non-collision with a test.
+
+---
+
+## Unmeasured, carried forward
+
+1. Payload composition — blocks C-003 calibration.
+2. Whether `--exclude` on `universal-agent-runtime` lands under 2 GiB. With 4,827 markdown
+   files under `crates/` it may not. Flagged since assessment; still unverified.
+
+---
+
+## Adversarial review
+
+Preflight `ok`; judge `k3` ≠ generator `kbd-frontier`.
+
+**CRITICAL — none surviving.** The ordering error this stage exists to catch (C-004 before
+C-001) was caught at spec and is enforced here by wave structure plus an inline gate on the
+change itself.
+
+**WARNING — carried to handoff:**
+- C-003's acceptance criteria are testable, but its *implementation* has no calibration
+  data. Measurement is the first task, not an afterthought.
+- C-002 and C-004 are coupled through the error text: C-002 must omit the override, then
+  C-004 must add it. If C-004 slips, C-002's message stays permanently incomplete — track
+  it rather than assuming the follow-up happens.
+- C-005's dependency rule is a stop-and-report gate, not a preference.
+- Every "done when" box is unverifiable while `/Volumes/Workspace` is unmounted. This plan
+  is executable only after that is resolved.
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/progress.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/progress.json
new file mode 100644
index 000000000..d574b4d21
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/progress.json
@@ -0,0 +1,54 @@
+{
+  "schemaVersion": "5",
+  "generatedBy": "claude",
+  "phase": "compass-scoping-and-bounds",
+  "last_updated": "2026-08-09T12:27:19Z",
+  "last_updated_by": "claude",
+  "assessment_complete": true,
+  "plan_complete": true,
+  "execution_dispatched": false,
+  "reflection_complete": false,
+  "changes_total": 6,
+  "changes_completed": 0,
+  "implementation_total": 6,
+  "implementation_completed": 0,
+  "completion": {
+    "implementation": {
+      "completed": 0,
+      "total": 6
+    }
+  },
+  "changes": [
+    {
+      "id": "C-001",
+      "title": "Stop materializing snapshot payload in read_snapshot",
+      "status": "pending"
+    },
+    {
+      "id": "C-002",
+      "title": "Make snapshot limit error actionable",
+      "status": "pending"
+    },
+    {
+      "id": "C-003",
+      "title": "Pre-flight graph size estimate",
+      "status": "pending"
+    },
+    {
+      "id": "C-004",
+      "title": "Honor COMPASS_MAX_GRAPH_BYTES on publication path",
+      "status": "pending"
+    },
+    {
+      "id": "C-005",
+      "title": "Extract compass-partition shared crate",
+      "status": "pending"
+    },
+    {
+      "id": "C-006",
+      "title": "Decide vendor/ default-skip policy",
+      "status": "pending"
+    }
+  ],
+  "children": []
+}
\ No newline at end of file
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/spec.md b/.kbd-orchestrator/phases/compass-scoping-and-bounds/spec.md
new file mode 100644
index 000000000..fe8ae0833
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/spec.md
@@ -0,0 +1,257 @@
+# Spec — compass-scoping-and-bounds
+
+**Stage:** Spec
+**Date:** 2026-08-09
+**Reads:** `assessment.md`, `analysis.md`, `library-candidates.json`, `handoffs/analyze.md`
+
+---
+
+## Consumer audit result — this changes the plan
+
+The analyze stage flagged "consumer audit of the read path" as blocking. It is now done,
+and the result is materially better than assumed.
+
+The function is `SqliteStore::read_snapshot` (`compass-store/src/lib.rs:829`), signature
+`-> Result<(SnapshotManifest, Vec<u8>), StoreError>`. **The materialized payload is in the
+return type itself.** Eight call sites exist:
+
+| Site | Use of the payload |
+| --- | --- |
+| `compass-store/src/lib.rs:935` `validate_snapshot` | **discarded** — `.map(\|(manifest, _)\| manifest)` |
+| `compass-store/src/lib.rs:1184` `snapshot_reference` | **discarded** — `let (manifest, _)` |
+| `compass-store/src/lib.rs:2774,2779,2804,2835` | tests |
+| `compass-core/tests/code_graph_v1_determinism.rs:188` | test (asserts `is_err()`) |
+| `compass-query/src/graph_engine.rs:211` | calls `begin_read_snapshot`, **not** `read_snapshot` |
+
+**No production consumer uses the returned bytes.** Both non-test callers immediately drop
+them with `_`. And `compass-query` — the main read path — already goes through
+`GraphSnapshotReader::open_selector` (`graph_engine.rs:223`), an indexed reader that never
+materializes the document.
+
+So the 2 GiB contiguous allocation in `read_snapshot` (`lib.rs:838-853`) is incurred **for
+a value every production caller throws away.** The store's doc comment
+(`lib.rs:44-51`) claiming records are served "through indexed scans instead of
+materializing the whole document" is *already true of the path that matters*; only
+`read_snapshot` violates it, and nothing in production needs what it returns.
+
+This makes change A far smaller and lower-risk than analyze estimated.
+
+---
+
+## Ordered changes
+
+### C-001 — Stop materializing the snapshot payload in `read_snapshot`
+
+**Gap:** A (analyze). **Owner:** `compass-store`. **Blocks:** C-004.
+
+Split the API so callers that need only the manifest never allocate the payload:
+
+- add `read_snapshot_manifest() -> Result<SnapshotManifest, StoreError>` that reads and
+  validates the manifest without touching chunk objects;
+- reimplement `validate_snapshot` (`lib.rs:935`) and `snapshot_reference` (`lib.rs:1184`)
+  on it;
+- keep byte-returning behavior available for tests and any future consumer, but as a
+  streaming form — e.g. `read_snapshot_chunks()` yielding chunk slices — rather than one
+  `Vec::with_capacity(payload_bytes)` concatenation.
+
+Retain the per-chunk running total and `MAX_GRAPH_BYTES` check so a corrupt manifest still
+cannot drive unbounded work. `CHUNK_BYTES` (255 KiB, `lib.rs:60`) already bounds each
+stored value.
+
+**Acceptance**
+- No production code path allocates proportional to `payload_bytes`.
+- `validate_snapshot` and `snapshot_reference` return identical results to today for both
+  valid and corrupt snapshots.
+- Round-trip, reopen, corruption/interruption, and publication-atomicity coverage per
+  AGENTS.md history/storage policy.
+- The `lib.rs:44-51` doc comment is either satisfied or corrected — **not left as is**.
+
+**Compatibility:** `read_snapshot` is `pub`. Changing or deprecating it is a public-API
+change; if the signature changes, it needs `CHANGELOG.md` and, if consumers must act,
+`MIGRATION.md`.
+
+---
+
+### C-002 — Make the snapshot limit error actionable
+
+**Gap:** G2. **Owner:** `compass-graph` (message), `compass-cli` (thin presentation).
+**Independent** — may land in parallel with C-001.
+
+Today (`compass-graph/src/snapshot.rs:3138`):
+
+```
+canonical graph exceeds the 2147483648-byte limit
+```
+
+State the remedy, matching the precedent already set in
+`compass-core/src/diagnostics.rs:453`. The message must name: `--exclude` /
+`.compassignore` scoping, the `COMPASS_MAX_GRAPH_BYTES` override **only once C-004 has
+landed**, and the dominant content class if C-003 has measured it.
+
+**Acceptance**
+- Error names at least one concrete next action.
+- CLI-level assertion of the rendered text and exit code under
+  `crates/compass-cli/tests/`.
+- No override is advertised before C-004 ships. Advertising an override that does not
+  exist on this path is the defect being fixed — do not reintroduce it inverted.
+
+---
+
+### C-003 — Pre-flight graph size estimate
+
+**Gap:** G3. **Owner:** `compass-core`. **Independent.**
+
+The reported failure consumed 331.90 s and discarded all work. Estimate the canonical
+payload size before publication and fail (or warn) early.
+
+**Acceptance**
+- A build destined to exceed the cap reports before full extraction completes.
+- The estimate is deterministic for equivalent inputs (AGENTS.md).
+- A limit outcome remains distinct from an empty result.
+- Estimation must not itself become unbounded work.
+
+**Open:** no calibration data yet — which node/edge classes dominate the payload is
+unmeasured. Measure during implementation; do not guess a heuristic.
+
+---
+
+### C-004 — Honor `COMPASS_MAX_GRAPH_BYTES` on the publication path
+
+**Gap:** G1. **Owner:** `compass-graph`, `compass-store`. **HARD-BLOCKED BY C-001.**
+
+`COMPASS_MAX_GRAPH_BYTES` is honored in `compass-model` (`graph.rs:370`),
+`compass-output` (`json.rs:414`), `compass-global` (`lib.rs:370`), and `compass-core`
+(`diagnostics.rs:713`) — and those crates' errors advertise it. `compass-graph/snapshot.rs`
+and `compass-store` never read it. Resolve the inconsistency: honor it, or document
+explicitly why this path must not.
+
+> **Sequencing gate.** Do not land before C-001. Until the read path stops materializing,
+> an override lets a user request a multi-gigabyte contiguous `Vec` — a worse failure than
+> today's clean error. This is the single most important ordering constraint in the phase.
+
+**Acceptance**
+- Behavior consistent with the four crates that already honor it, or a documented
+  exception.
+- Default remains 2 GiB. **Not** a default increase — AGENTS.md requires bounded work.
+- Override is explicit and opt-in (ripgrep `--no-ignore-vcs` precedent from analyze).
+
+---
+
+### C-005 — Extract `compass-partition` shared crate
+
+**Gap:** ARCH-partitioning. **Owner:** new crate. **Sequenced after C-001.**
+
+Per your direction, `PartitionedGraph` moves to a shared crate. Scope is constrained by
+what the type actually depends on.
+
+**What moves** — the record container and its key helpers, all dependency-light:
+
+| Item | Current location |
+| --- | --- |
+| `PartitionedGraph` | `compass-history/src/artifacts.rs:76-84` |
+| `node_key`, `edge_key`, `hyperedge_key` | `compass-history/src/keys.rs:10,20,46` |
+| `canonical_json_bytes` | `compass-history/src/canonical.rs:9` |
+
+**What does NOT move** — history-coupled production logic. `into_partition`
+(`artifacts.rs:349+`) depends on `CompletionEvidence`, `authoritative_sidecars` /
+`TRUSTED_GRAPH_CONTENT`, `AnalysisBundle`, `compass_ir::ProgramBundle`, `HistoryError`, and
+`prolly::{KeyBuilder, VersionedValue}`. These are history-realization concerns with no
+counterpart on the current-graph path.
+
+**Dependency rule (blocking):** `compass-partition` must NOT depend on `prolly-map`,
+`prolly-store-sqlite`, `compass-ir`, or `compass-analysis`. `compass-graph` today depends
+on none of these; pulling them onto the current-graph path would contradict the local-first
+minimal-dependency posture. If the extraction cannot satisfy this, **stop and report** —
+that outcome means the shared-crate framing does not hold and the decision needs revisiting.
+
+`canonical_json_bytes` returns `HistoryError`; the shared crate needs its own error type,
+with `compass-history` converting at its boundary.
+
+**Identity semantics (blocking):** history fingerprints are meaning-affecting and published
+realizations are immutable (AGENTS.md). Sharing key helpers must not let current-graph and
+history produce colliding or conflatable record identities. Either namespace them per path
+or prove non-collision with a test. **This must be settled before any current-graph
+consumer adopts the shared keys.**
+
+**Acceptance**
+- `compass-history` behavior is byte-identical after extraction — same records, same keys,
+  same canonical encoding. Verify with existing canonical-encoding, round-trip, and diff
+  tests, which must pass unchanged.
+- Workspace members updated in root `Cargo.toml`; deps via `{name}.workspace = true`.
+- New crate carries the workspace lint policy (no `unsafe`, no `unwrap`/`expect`/`panic`).
+- No new dependency reaches `compass-graph` transitively.
+
+**Honest scope note:** this extraction moves a struct and four helpers — roughly 9 lines of
+fields plus key/encoding utilities — out of a 2,317-line module. It does **not** by itself
+give the current-graph path a partitioned publication format. It positions for that. If the
+goal is current-graph partitioned publication, that is a further change requiring the
+identity decision above, and it should be specced separately once C-001 has landed and the
+read path is honest.
+
+---
+
+### C-006 — Decide `vendor/` default-skip policy
+
+**Gap:** G4. **Owner:** `compass-files`. **Independent.**
+
+`vendor/` is absent from `SKIP_DIRS` (`compass-files/src/detect.rs:61-102`) — 126 MB / 441
+markdown files in the failing repo. But Go's `vendor/` holds real dependency source, and
+Compass's own tree has a legitimate `vendor/` (`vendor/compass-tree-sitter-language-pack`,
+a workspace member). A reflex addition would be wrong.
+
+**Acceptance:** a deliberate, documented decision — skip, skip-unless-workspace-member, or
+leave — with a test pinning the chosen behavior.
+
+---
+
+## Execution order
+
+```
+C-001 ──┬── C-004   (hard gate: override only after streaming)
+        └── C-005   (extraction after read path is honest)
+
+C-002, C-003, C-006  — independent, parallel with C-001
+```
+
+---
+
+## Phase-wide constraints
+
+Per `.kbd-orchestrator/constraints.md` and AGENTS.md:
+
+- `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main` on every compiling
+  command. **`/Volumes/Workspace` is not currently mounted** — verify before execution.
+- No `unsafe`; no `unwrap_used` / `expect_used` / `panic`.
+- Determinism: `BTreeMap`/`BTreeSet` or explicit sorting at contract boundaries.
+- Bounded work: a limit error stays distinct from an empty result.
+- Regression test at the lowest useful layer; contract test where user-visible behavior
+  changes.
+- `read_snapshot` and the limit error text are compatibility-sensitive surfaces.
+
+---
+
+## Open questions still unresolved
+
+1. **Identity/namespacing for shared record keys** (blocks C-005 adoption, not extraction).
+2. **Payload composition** — which node/edge classes dominate 2 GiB (blocks C-003
+   calibration).
+3. **Untested:** whether `--exclude` on `universal-agent-runtime` lands under 2 GiB. With
+   4,827 markdown files under `crates/` it may not — flagged since assessment, still
+   unverified.
+
+---
+
+## Adversarial review
+
+Preflight `ok`; judge `k3` ≠ generator `kbd-frontier`.
+
+**CRITICAL — incorporated:** analyze assumed change A required a broad streaming refactor
+across unknown consumers. The audit refutes that: no production caller uses the bytes, and
+`compass-query` already uses an indexed reader. Specced as an API split, not a rewrite.
+
+**WARNING — carried to plan:**
+- C-005 as directed yields a small extraction, not current-graph partitioning. Recorded
+  plainly so the delivered scope is not mistaken for the larger capability.
+- The `compass-partition` dependency rule is a stop-and-report gate, not a preference.
+- C-002 must not advertise an override before C-004 exists.
+- Three open questions remain unmeasured; confidence in direction is high, in sizing low.
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/tasks.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/tasks.json
new file mode 100644
index 000000000..034918fdb
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/tasks.json
@@ -0,0 +1,39 @@
+{
+  "schemaVersion": "1",
+  "phase": "compass-scoping-and-bounds",
+  "generated_at": "2026-08-09T12:21:00Z",
+  "changes": [
+    { "id": "C-001", "title": "Stop materializing snapshot payload in read_snapshot", "gap": "A",
+      "owner_crate": "compass-store", "depends_on": [], "blocks": ["C-004", "C-005"],
+      "risk": "medium", "compatibility_sensitive": true,
+      "acceptance": ["No production path allocates proportional to payload_bytes", "validate_snapshot and snapshot_reference results unchanged for valid and corrupt snapshots", "Round-trip, reopen, corruption/interruption, publication-atomicity coverage", "lib.rs:44-51 doc comment satisfied or corrected"] },
+    { "id": "C-002", "title": "Make snapshot limit error actionable", "gap": "G2",
+      "owner_crate": "compass-graph", "depends_on": [], "blocks": [],
+      "risk": "low", "compatibility_sensitive": true,
+      "acceptance": ["Error names at least one concrete next action", "CLI test asserts rendered text and exit code", "No override advertised before C-004 lands"] },
+    { "id": "C-003", "title": "Pre-flight graph size estimate", "gap": "G3",
+      "owner_crate": "compass-core", "depends_on": [], "blocks": [],
+      "risk": "medium", "compatibility_sensitive": false,
+      "acceptance": ["Oversized build reports before full extraction completes", "Estimate deterministic for equivalent inputs", "Limit outcome distinct from empty result", "Estimation itself bounded"],
+      "open": "No calibration data; payload composition unmeasured" },
+    { "id": "C-004", "title": "Honor COMPASS_MAX_GRAPH_BYTES on publication path", "gap": "G1",
+      "owner_crate": "compass-graph", "depends_on": ["C-001"], "blocks": [],
+      "risk": "medium", "compatibility_sensitive": true,
+      "gate": "HARD BLOCK on C-001 — an override before streaming lets a user request a multi-gigabyte contiguous Vec",
+      "acceptance": ["Consistent with compass-model/output/global/core or documented exception", "Default stays 2 GiB", "Override explicit and opt-in"] },
+    { "id": "C-005", "title": "Extract compass-partition shared crate", "gap": "ARCH-partitioning",
+      "owner_crate": "compass-partition", "depends_on": ["C-001"], "blocks": [],
+      "risk": "medium", "compatibility_sensitive": false,
+      "moves": ["PartitionedGraph (artifacts.rs:76-84)", "node_key/edge_key/hyperedge_key (keys.rs:10,20,46)", "canonical_json_bytes (canonical.rs:9)"],
+      "does_not_move": ["into_partition and history-coupled logic (CompletionEvidence, authoritative_sidecars, AnalysisBundle, ProgramBundle, HistoryError, prolly)"],
+      "blocking_rule": "compass-partition MUST NOT depend on prolly-map, prolly-store-sqlite, compass-ir, or compass-analysis. If unachievable, STOP and report.",
+      "acceptance": ["compass-history behavior byte-identical; existing canonical/round-trip/diff tests pass unchanged", "Workspace members and deps updated per policy", "Workspace lint policy applied to new crate", "No new transitive dependency reaches compass-graph"],
+      "open": "Identity/namespacing decision required before any current-graph consumer adopts shared keys" },
+    { "id": "C-006", "title": "Decide vendor/ default-skip policy", "gap": "G4",
+      "owner_crate": "compass-files", "depends_on": [], "blocks": [],
+      "risk": "low", "compatibility_sensitive": true,
+      "acceptance": ["Deliberate documented decision (skip / skip-unless-workspace-member / leave)", "Test pins chosen behavior"],
+      "note": "Go vendor/ holds real source; Compass's own vendor/compass-tree-sitter-language-pack is a workspace member" }
+  ],
+  "execution_order": [["C-001", "C-002", "C-003", "C-006"], ["C-004", "C-005"]]
+}
diff --git a/.kbd-orchestrator/project.json b/.kbd-orchestrator/project.json
new file mode 100644
index 000000000..7baa109c0
--- /dev/null
+++ b/.kbd-orchestrator/project.json
@@ -0,0 +1,108 @@
+{
+  "name": "Compass",
+  "description": "Native local-first knowledge graph engine for source code and project artifacts",
+  "active_phase": "compass-scoping-and-bounds",
+  "worktreeRoot": "${HOME}/.claude/worktrees",
+  "maxChildDepth": 4,
+  "ux_profile": "advanced",
+  "__ux_profile_note": "advanced \u2192 kbd-status is dense by default; beginner \u2192 kbd-status --explain is on by default (expands decision-log entries + next-and-why narrative). Verbosity only \u2014 never gates information.",
+  "spec_paths": [
+    "openspec/specs/*.md"
+  ],
+  "openspec_available": true,
+  "constraint_file": ".kbd-orchestrator/constraints.md",
+  "__command_note": "AGENTS.md requires CARGO_TARGET_DIR on EVERY invocation that can compile; the main disk is capped at 100 GB and each checkout/worktree needs its own target directory. Never share one across repositories or concurrent worktrees. If /Volumes/Workspace is unmounted, stop and report rather than falling back to a local target/.",
+  "build_health_command": "CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo check --workspace --locked",
+  "test_command": "CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo test --workspace --lib --bins --locked",
+  "lint_command": "CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo clippy --workspace --lib --bins --locked -- -D warnings",
+  "dev_command": null,
+  "preferred_planning_agent": "claude",
+  "preferred_execution_agents": [
+    "claude",
+    "codex",
+    "opencode"
+  ],
+  "model_policy": {
+    "registry": {
+      "small": {
+        "local": "Qwen3.5-9B-Q8_0",
+        "t4": "Qwen3.5-9B-Q8_0",
+        "l4": "Qwen3.5-9B-Q8_0"
+      },
+      "medium": {
+        "local": null,
+        "t4": "Qwen3.5-27B-Q4",
+        "l4": "Qwen3.5-35B-A3B-Q4"
+      },
+      "frontier": {
+        "local": "claude-sonnet-4-6",
+        "t4": "claude-sonnet-4-6",
+        "l4": "claude-sonnet-4-6"
+      }
+    },
+    "phases": {
+      "kbd-assess": "frontier",
+      "kbd-plan": "frontier",
+      "kbd-status": "small",
+      "kbd-reflect": "frontier",
+      "opsx-new": "small",
+      "opsx-apply-low": "small",
+      "opsx-apply-medium": "medium",
+      "opsx-apply-high": "frontier",
+      "opsx-verify": "medium",
+      "opsx-archive": "small",
+      "refiner-iterate": "small",
+      "refiner-evaluate": "medium",
+      "evolver-assess": "frontier",
+      "evolver-analyze": "frontier",
+      "evolver-plan": "frontier",
+      "evolver-execute-low": "small",
+      "evolver-execute-medium": "medium",
+      "evolver-execute-high": "frontier",
+      "evolver-reflect": "frontier",
+      "evolver-status": "small"
+    },
+    "active_environment": "local"
+  },
+  "agents_config": {
+    "claude": {
+      "entry": "Claude Code CLI / slash commands",
+      "strengths": [
+        "multi-crate Rust changes",
+        "contract and compatibility review",
+        "planning"
+      ]
+    },
+    "codex": {
+      "entry": "OpenAI Codex CLI / app",
+      "strengths": [
+        "parallel isolated tasks via git worktrees"
+      ]
+    },
+    "opencode": {
+      "entry": "OpenCode CLI",
+      "strengths": [
+        "quick targeted edits",
+        "file patches"
+      ]
+    },
+    "kimi": {
+      "entry": "Kimi CLI (OpenSpec skills only \u2014 no command adapter)",
+      "strengths": [
+        "focused implementation"
+      ]
+    }
+  },
+  "focus_project_path": "/Users/gqadonis/Projects/references/compass",
+  "workspace": {
+    "workspace_file": null,
+    "folders": [
+      {
+        "path": "/Users/gqadonis/Projects/references/compass",
+        "role": "focus",
+        "purpose": "Active project \u2014 all KBD operations target this directory",
+        "write_access": true
+      }
+    ]
+  }
+}
\ No newline at end of file
diff --git a/.prometheus/events.jsonl b/.prometheus/events.jsonl
new file mode 100644
index 000000000..4a92ef8fa
--- /dev/null
+++ b/.prometheus/events.jsonl
@@ -0,0 +1,2 @@
+{"id":"3667e85c-0e70-46ef-b48d-cff044021f05","kind":"compiled","session_id":"ae160b21-3016-48b6-8571-96c5be7bcb03","project_root":"/Users/gqadonis/Projects/references/compass","scope":"project","timestamp":"2026-08-09T12:05:10.452765Z","payload":{"entry_id":"compass-scoping-and-bounds-executor-session","tags":["compass","executor-session","scoping","session-record"],"title":"Compass scoping and bounds executor session","ts":"2026-08-09T12:05:10.452765Z","type":"compiled"},"affects":["compass-scoping-and-bounds-executor-session"]}
+{"id":"9b414d93-118a-4481-9c85-483c72fa8f6a","kind":"compiled","session_id":"ff30da84-fe84-46a4-a46c-79ee160255bb","project_root":"/Users/gqadonis/Projects/references/compass","scope":"project","timestamp":"2026-08-09T12:09:38.090263Z","payload":{"entry_id":"compass-scoping-and-bounds-executor-session","tags":["compass","executor-session","scoping","session-record"],"title":"Compass scoping and bounds executor session","ts":"2026-08-09T12:09:38.090263Z","type":"compiled"},"affects":["compass-scoping-and-bounds-executor-session"]}
diff --git a/.prometheus/knowledge/.prompt-snapshots/project/current b/.prometheus/knowledge/.prompt-snapshots/project/current
new file mode 100644
index 000000000..9e6df6620
--- /dev/null
+++ b/.prometheus/knowledge/.prompt-snapshots/project/current
@@ -0,0 +1,2 @@
+7f6275773422ff840f0a69fc2353d60a46450faef250b226e9717215ad2fea75
+
diff --git a/.prometheus/knowledge/.prompt-snapshots/project/generations/7f6275773422ff840f0a69fc2353d60a46450faef250b226e9717215ad2fea75.json b/.prometheus/knowledge/.prompt-snapshots/project/generations/7f6275773422ff840f0a69fc2353d60a46450faef250b226e9717215ad2fea75.json
new file mode 100644
index 000000000..50cfcfb6b
--- /dev/null
+++ b/.prometheus/knowledge/.prompt-snapshots/project/generations/7f6275773422ff840f0a69fc2353d60a46450faef250b226e9717215ad2fea75.json
@@ -0,0 +1,562 @@
+{
+  "schemaVersion": 1,
+  "scope": "project",
+  "generation": "7f6275773422ff840f0a69fc2353d60a46450faef250b226e9717215ad2fea75",
+  "candidateCount": 29,
+  "byteCount": 93038,
+  "entries": [
+    {
+      "id": "compass-scoping-and-bounds-executor-session",
+      "title": "Compass scoping and bounds executor session",
+      "content": "## Summary\n\n- Executor session completed for phase `compass-scoping-and-bounds`.\n- Reported change status: `unknown`.\n- No delta, root cause, changed paths, or corrective actions were captured in the raw record.\n\n## Session Record\n\n| Field | Value |\n|---|---|\n| Phase | `compass-scoping-and-bounds` |\n| Change | `unknown` |\n| Status | complete |\n\n## Handling Notes\n\n- Preserve as a minimal execution record.\n- Do not infer implementation changes, changed paths, or root cause from this capture alone.\n- Promote reusable findings only if a fuller session artifact becomes available.\n\n# Citations\n\n1. stdin",
+      "tags": [
+        "compass",
+        "executor-session",
+        "scoping",
+        "session-record"
+      ],
+      "links": [],
+      "sources": [
+        "stdin"
+      ],
+      "created_at": "2026-08-09T12:09:38.086902Z",
+      "updated_at": "2026-08-09T12:09:38.087376Z",
+      "revision": 1,
+      "entry_type": "Reference",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-04f1f5622348cff2",
+      "title": "Karpathy session 04f1f5622348",
+      "content": "## Delta\n\nDone — built, installed, and the target directory cleaned.\n\n**Results:**\n- `make install` → release build succeeded in **24m 13s**\n- Installed `compass 0.3.6` → `~/.cargo/bin/compass` (146 MB), verified working after cleanup, resolving on PATH\n- Local `./target` reclaimed: **139 MB → 4 KB**\n\n**One thing worth knowing:** cleaning `target/` reclaimed far less than you'd expect, because your global `~/.cargo/config.toml` offloads Rust builds to the external drive. Intermediates go to `/Volumes/my-passport/cargo-build/...` (3.3 GB for this workspace) and sccache to `/Volumes/my-passport/sccache` (29 of 40 GiB). Only the final binary lands locally — so `target/` was never the disk hog here.\n\nI deliberately did **not** run `cargo clean`. It would have deleted the 3.3 GB external build cache too, costing you another 24-minute cold rebuild while reclaiming nothing extra from your internal disk. I removed `target/release` instead.\n\n**The actual local space, if you want it — needs your call:**\n\n`~/Library/Caches/Mozilla.sccache` holds **10 GB on your internal disk**. This is sccache's *default* path, not your configured WDD one. It gets written whenever sccache starts in a shell that didn't export `SCCACHE_DIR` — your `.zshrc` only sets it behind a `[[ -d \"$WDD/cargo\" ]]` guard, so non-login shells and any unmounted-drive moment bypass it. Newest entries are from Aug 8 20:14, so it's recent, not ancient.\n\nDeleting it is safe — sccache is purely a cache, worst case is slower recompiles — and nothing currently holds it open. I'd also suggest setting `SCCACHE_DIR` in `~/.cargo/config.toml`'s `[env]` rather than `.zshrc`, so it applies to every shell and stops re-accumulating. Say the word and I'll do either or both.\n\nI should flag one correction: mid-investigation I said the build had \"stopped\" and separately called this cache \"orphaned.\" Both were wrong — the first was a bad read of a momentary process gap, the second I revised once I checked the timestamps.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 34d4343f-8edd-46e9-bb53-90b588e5d3ed\n- Captured: 2026-08-09T05:20:55.484287Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- No changed paths detected.\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:34d4343f-8edd-46e9-bb53-90b588e5d3ed"
+      ],
+      "created_at": "2026-08-09T05:21:00.817633Z",
+      "updated_at": "2026-08-09T05:21:00.817633Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-06cdf26d86b0c087",
+      "title": "Karpathy session 06cdf26d86b0",
+      "content": "## Delta\n\nI've traced it. Here's what's actually going on — and part of it contradicts the premise.\n\n## Why 1.6.2 is resolving\n\n**1.7.0 was never installed.** The cache holds only `1.6.0`, `1.6.1`, `1.6.2`. Your source repo at `/Users/gqadonis/Projects/prometheus/prometheus-skill-pack` is tagged `v1.7.0` (12 commits past it, working tree clean), but that was never published into the plugin cache. The newest cache dir is dated Aug 3; the `.prometheus` generation is Aug 5. The tag exists locally and nowhere else.\n\nThere's also a **second, unrelated breakage**: `~/.claude/skills/kbd-init` symlinks to `~/.prometheus/plugins/prometheus-skill-pack/current/skills/process/kbd-process-orchestrator/skills/kbd-init` — a path that doesn't resolve. That's why I fell back to the cache at the start of this session. Two different install roots (`.claude/plugins/cache` and `.prometheus/plugins/generations`), and the symlink points into the one that's broken.\n\n## But the premise doesn't hold for this work\n\nI diffed the source tree against 1.6.2 directly. **The entire `kbd-process-orchestrator` differs in exactly three files:**\n\n| File | Status |\n|---|---|\n| `references/integrations/adversarial-review.md` | differs |\n| `skills/kbd-execute/SKILL.md` | differs |\n| `skills/kbd-spec/SKILL.md` | differs |\n\nEverything else is byte-identical. Specifically:\n\n- **`kbd-analyze` exists in 1.6.2 and its `SKILL.md` is identical to 1.7.0.** My earlier \"no analyze.md\" observation was about the `prompts/` directory — and `prompts/` has no `analyze.md` in **1.7.0 either**. `kbd-analyze` is driven by its `SKILL.md`, not a prompt file. That's not a version gap; I misread it.\n- `kbd-assess/SKILL.md`, `kbd-init/SKILL.md`, `kbd-new-phase/SKILL.md`, `prompts/assess.md`, `project.template.json`, and the adversarial-review preflight script are all **identical** between source and 1.6.2.\n\nSo the `/kbd-init` and `/kbd-assess` runs already completed used the same bytes 1.7.0 would have. No rework needed there.\n\nThe three drifted files matter for `/kbd-execute` and `/kbd-spec` — stages we haven't reached.\n\n## Your call\n\nI can't publish 1.7.0 into the plugin cache myself — that's your packaging pipeline, and I don't know its publish command. Options:\n\n1. **Publish 1.7.0 properly** — you run the pack's install/publish step; I re-verify and continue. Cleanest, and fixes the broken `~/.claude/skills` symlink if the installer rewrites it.\n2. **Continue on 1.6.2 for analyze** — legitimate here, since `kbd-analyze` is byte-identical. Then upgrade before `/kbd-spec` or `/kbd-execute`, where the drift is real.\n3. **Point the KBD skills at the source tree directly** for this session.\n\nI'd suggest **1**, since the symlink is broken regardless and will keep biting. But **2** is defensible if you want to keep moving on the partitioning question now — the risk is genuinely zero for the analyze stage.\n\nWhich way?\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:11:33.611768Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T11:14:53.644969Z",
+      "updated_at": "2026-08-09T11:14:53.644969Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-0c2a62b22721a70c",
+      "title": "Karpathy session 0c2a62b22721",
+      "content": "## Delta\n\nThat confirms the root cause. Here's what's happening.\n\n## Diagnosis\n\nThis is **not a bug** — it's a bounded-work invariant firing correctly, but with a bad user experience. Three separate problems:\n\n**1. The scope was never actually narrowed.** Your run reported `Scope: 0 include rule(s), 0 exclude rule(s)` and matched **19,666 files**. The repo is 6.8 GB, and the walk swept in directories that have no business in a code graph:\n\n| Directory | Size |\n|---|---|\n| `node_modules/` | 1.6 GB |\n| `target/` | 821 MB |\n| `compass-out/` | 302 MB ← Compass's *own* prior output |\n| `vendor/` | 126 MB |\n\nNote the 9,679 \"documents\" and 508 images — that's overwhelmingly dependency and build-artifact content, not your source.\n\n**2. The 2 GiB cap has no escape hatch on this path.** `MAX_GRAPH_BYTES` (`crates/compass-store/src/lib.rs:51`) is a hard `const`. Elsewhere in the codebase — `compass-model`, `compass-output`, `compass-global`, `compass-core` — the same limit is overridable via `COMPASS_MAX_GRAPH_BYTES`, and the error messages there *tell you so*. But `compass-graph/src/snapshot.rs:3138` and `compass-store` never read that variable. So the message you got is a dead end: no override, no suggested remedy.\n\n**3. It failed after 331 seconds**, at final publication — after all extraction work was done. The limit is checked at serialization time (`digest_json`), not estimated up front.\n\n## Your immediate unblock\n\n`compass init` does support scoping — you just pressed through the prompts. Exclusions are available non-interactively:\n\n```bash\ncd /Users/gqadonis/Projects/prometheus/universal-agent-runtime\nrm -rf compass-out .compass\ncompass init --exclude='node_modules/**' --exclude='target/**' \\\n             --exclude='compass-out/**' --exclude='vendor/**' \\\n             --exclude='website/**' --exclude='static/**' --exclude='models.dev/**'\n```\n\nThat should cut the graph by well over an order of magnitude. I haven't run it, so I can't promise it lands under the cap — but the excluded directories are ~3.2 GB of the 6.8 GB, and they're the ones generating the bulk of those 9,679 documents.\n\n## The real fixes for this repo\n\nThree defects worth addressing here, in priority order:\n\n1. **Default ignore policy misses `compass-out/`, `node_modules/`, `target/`, `vendor/`.** Compass ingesting its own output directory is clearly wrong. This belongs in `compass-files::detect`.\n2. **The limit error is unactionable.** It should name the override (if one is granted on this path) and point at scoping — matching how `compass-model` and `compass-core` already word theirs.\n3. **Failing at 331 s is avoidable.** A pre-publication size estimate could fail fast, or warn during extraction.\n\nPer AGENTS.md, #1 and #3 are `compass-files`/`compass-core` work and #2 spans `compass-graph`/`compass-store`; the CLI message stays thin.\n\nTwo things I want your call on before doing anything:\n\n- **Scope:** should I fix all three, or just the ignore-policy default (#1), which alone would have prevented your failure?\n- **Whether to raise the cap:** I'd advise against it. It's a deliberate bounded-work invariant, and AGENTS.md is explicit that a limit error is a distinct outcome from an empty result. Better to make the default scope sane than to let a 2 GiB graph through.\n\nAlso worth noting: the two commits on `docs/claude-md` and the `.kbd-orchestrator/` files are all still uncommitted/unpushed. This fix is unrelated work — I'd put it on its own branch rather than folding it in.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:05:43.579156Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T11:05:44.269089Z",
+      "updated_at": "2026-08-09T11:05:44.269089Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-0cf2eabc28e07ef7",
+      "title": "Karpathy session 0cf2eabc28e0",
+      "content": "## Delta\n\nFixed. The only remaining \"12 GB\" match is inside my new comment, where it's describing the past drift rather than claiming a current value.\n\nThe comment now points to `SCCACHE_CACHE_SIZE` in `[env]` instead of restating the number — a single source of truth, so it can't go stale again the way it just did. Config parses cleanly, and the declared `40G` matches what the live server actually reports (40 GiB max, on the WDD).\n\nThat closes out all three items: release build installed as `compass 0.3.6`, ~10.1 GB reclaimed locally, and the sccache config corrected so the internal disk stops accumulating cache.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 34d4343f-8edd-46e9-bb53-90b588e5d3ed\n- Captured: 2026-08-09T05:41:42.970513Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:34d4343f-8edd-46e9-bb53-90b588e5d3ed"
+      ],
+      "created_at": "2026-08-09T05:41:45.675152Z",
+      "updated_at": "2026-08-09T05:41:45.675152Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-15a46a623cf0e420",
+      "title": "Karpathy session 15a46a623cf0",
+      "content": "## Delta\n\nWritten to `/Users/gqadonis/Projects/prometheus/prometheus-skill-pack/docs/UPDATE_CONSIDERATIONS.md`.\n\nIt's structured as a handoff brief rather than the bare prompt — the same content, but organized so someone landing cold can act on it:\n\n- **Symptom + consequence** — the error, and the concrete drift it causes (`kbd-execute`, `kbd-spec`, `adversarial-review.md`), with the install-ref vs HEAD mismatch.\n- **Established by direct verification** — the three things I actually proved, with the hash evidence showing the manifest was wrong and the file was right.\n- **Open hypothesis** — `payloadRoot`, with four ranked candidates and an explicit instruction not to guess-and-patch. The likeliest answer (payload stages from HEAD → manifest must be committed) is called out as *structurally* meaning regeneration alone can't work.\n- **Constraints** — the concurrency guardrails, including that the two tree snapshots I took minutes apart already differed, so the listed file set is indicative only.\n- **Definition of done** — six checkable conditions, the last being that in-flight work survives untouched.\n- **Secondary defect** — the broken `.claude/skills` symlink, framed as arguably higher impact since it's the mechanism that let the staleness go unnoticed.\n- **Preventive follow-up** — proposal only, pointing at `check-harness-adapters.js` as the likely existing-but-unenforced check.\n\nI only created that one new file; nothing else in the repo was touched. Note the working tree there has kept growing — `kbd-init` workflow files across five harness surfaces are now modified — so that document is deliberately written to assume its own file list is stale.\n\nTwo loose ends still open here in Compass: the phase creation and `/kbd-analyze` on the partitioning question, plus the two unpushed commits on `docs/claude-md` and the untracked `.kbd-orchestrator/`. Since `kbd-analyze`'s `SKILL.md` is byte-identical between 1.6.2 and 1.7.0, running it now carries no version risk if you want to keep moving.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:22:19.272736Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- AGENTS.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T11:24:40.030753Z",
+      "updated_at": "2026-08-09T11:24:40.030753Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-19802b94100a3ab3",
+      "title": "Karpathy session 19802b94100a",
+      "content": "## Delta\n\nCompleted kbd-assess — compass-scoping-and-bounds (step 0 of 0)\n\n## Answer: no, don't add scoping — it already exists and works\n\n**I need to correct my previous turn.** I told you the default ignore policy was missing `node_modules/`, `target/`, and `compass-out/`. That was wrong, and it was the premise of my whole recommendation. Reading the source disproves it:\n\n- All three are in `SKIP_DIRS` — ~40 entries at `crates/compass-files/src/detect.rs:61-102`\n- Gitignore respect defaults to `true` (`detect.rs:163`)\n- `.compassignore` is supported (`detect.rs:390`)\n- `--include`/`--exclude` already exist (`init_commands.rs:438-462`)\n\nBuilding scoping would have duplicated shipped functionality. That's the finding that changes the recommendation, and it came from checking the code rather than trusting my own earlier hypothesis.\n\n**What actually happened:** the exclusions fired correctly. That repo just has **9,320 in-scope markdown files — 4,827 under `crates/` alone**. The 19,666 matched files are real content, not leaked junk. This is a genuine capacity limit.\n\n**Research corroborates that Compass is already at or above baseline.** Firecrawl across `ck`, `codegraphcontext`, `.cursorignore`, ripgrep, and a formatter comparative study: respect `.gitignore` by default (\"the single highest-value default\"), ship hardcoded defaults, offer a tool-specific ignore file. Compass does all three, with a *larger* default list than the tools surveyed.\n\n**The real defects, in order:**\n\n| Pri | Defect |\n|---|---|\n| 1 | `COMPASS_MAX_GRAPH_BYTES` is honored in `compass-model`, `-output`, `-global`, `-core` — and their errors advertise it — but **not** on the snapshot path that actually failed. You hit a limit the rest of the product treats as adjustable, with no override. |\n| 2 | The error names a fact and stops — no override, no `--exclude` hint, no indication of what dominated the graph. |\n| 3 | Fails at 331 s after all work completes, then discards it. |\n| 4 | `vendor/` isn't skipped — but that needs a decision, not a reflex; Go monorepos and Compass's own tree legitimately use it. |\n\n**Two things I won't paper over:**\n\n- **My suggested `--exclude` workaround is untested and may not work.** With 4,827 markdown files under `crates/` — which you can't exclude without gutting the graph — it may still blow the cap.\n- **I'd resist raising the 2 GiB limit.** AGENTS.md is explicit that bounded work is an invariant and a limit error is distinct from an empty result. Grant an explicit opt-in override instead — which matches ripgrep's maintainer position that a paired explicit flag beats changing defaults.\n\n**Open architecture question for `/kbd-analyze`:** if a repo this size can't publish under 2 GiB even with sane exclusions, the answer may be graph partitioning rather than a bigger number. That should be settled before any code is written.\n\nAssessment written to `.kbd-orchestrator/phases/compass-scoping-and-bounds/assessment.md`. Note the phase is provisional — I didn't run `/kbd-new-phase`, so `active_phase` is still `null` and there's no `progress.json` (hence \"step 0 of 0\"). Say the word and I'll create it properly, or rename it.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:11:29.936317Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T11:11:30.692085Z",
+      "updated_at": "2026-08-09T11:11:30.692085Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-199d5165acd78a00",
+      "title": "Karpathy session 199d5165acd7",
+      "content": "## Delta\n\nCreated `CLAUDE.md` at the repo root.\n\nSince `AGENTS.md` is already a thorough agent guide, I wrote CLAUDE.md to defer to it rather than duplicate it, and concentrated on what it leaves implicit:\n\n**What's in it:**\n- **`CARGO_TARGET_DIR` requirement** — surfaced up top, since it must be set on every compiling invocation and is the easiest thing to get wrong. I also flagged the conflict where some Makefile targets (`install`, `dist`, `release-check`) resolve binaries through a literal `target/` path, which AGENTS.md mentions but doesn't tie to specific targets.\n- **Commands** — narrow-loop test/clippy per crate and per integration file, the workspace baseline, the surface-specific gates (product boundary, CompassQL TCK, code-graph qualification), and the npm workspace commands. Noted that `make test` is `--lib --bins` only while `make test-all` needs Python oracle setup.\n- **Architecture** — the piece that genuinely requires reading multiple files: the one-directional flow `compass-files → compass-languages → compass-resolve → compass-graph → compass-model`, orchestrated by `compass-core`. I emphasized the boundary that's easiest to violate — per-file extractors emit evidence and never resolve targets needing project-wide facts. Also the `compass-cypher` (syntax) vs `compass-query` (execution) split, immutable history realizations, and the generated viewer assets round-trip.\n- **Enforced constraints** — the lint set, determinism as correctness, boundedness (limit error ≠ empty result), and reuse of existing safe primitives.\n\nTwo notes on judgment calls: I skipped enumerating individual crates beyond the pipeline ones, since `docs/implementation/workspace-tour.md` already does that well and I pointed at it instead. I also didn't import anything from a Codex or Gemini config — I didn't check for those, as the instruction is to offer rather than read them. If you have an OpenAI Codex or Gemini CLI config you'd like folded in, reply `/import` and it'll scan and list what's importable.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:34:13.627630Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n- CLAUDE.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T10:34:32.153219Z",
+      "updated_at": "2026-08-09T10:34:32.153219Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-309fba26769d26dc",
+      "title": "Karpathy session 309fba26769d",
+      "content": "## Delta\n\nHere's a self-contained prompt for a session in the skill-pack repo. It's written to be safe alongside concurrent work — it assumes nothing about the working tree and stops rather than overwriting.\n\n````markdown\n# Fix: `update-skill-pack.sh` fails release payload verification, blocking 1.7.0 install\n\n## Context\n\nRepo: `/Users/gqadonis/Projects/prometheus/prometheus-skill-pack`\n(remote `git@github.com:Prometheus-AGS/prometheus-skill-system.git`)\n\n`bash scripts/update-skill-pack.sh` fails at step 2 and no new generation is\ninstalled:\n\n```\nStep 2: Building and verifying immutable generation...\ninstall-plugin-generation: release payload verification failed for shared/scripts/detect-toolchain.sh\n```\n\nConsequence: `~/.prometheus/plugins/prometheus-skill-pack/current` is pinned to\nan older generation. `~/.prometheus/skill-pack-install-ref` records `dfdd8be`\nwhile `main` is at `6e46758` (`v1.7.0-12-g6e46758`). Consumers of the pack are\nrunning stale skills; `kbd-execute/SKILL.md`, `kbd-spec/SKILL.md`, and\n`references/integrations/adversarial-review.md` are known to differ between\nsource and the last-installed generation.\n\n## What has already been established (verify, don't assume)\n\n1. `shared/harnesses/generated/release-manifest.json` was stale. Commit\n   `3c31581` (\"fix: stop reporting and restarting healthy forge-mcp and\n   sovereign-sync\") modified `shared/scripts/detect-toolchain.sh` and\n   `shared/scripts/service-probe.sh` **without regenerating the manifest**.\n   The manifest recorded pre-fix sha256 values for both. File modes were\n   correct (`0755`); only content hashes were wrong. 2 of 61 `runtimeFiles`\n   entries affected.\n\n2. Running `node scripts/generate-harness-adapters.js` rebuilt the manifest and\n   brought it to 0/61 stale (verified by re-hashing every entry against disk).\n\n3. **The install still fails with the identical error after that fix.** This is\n   the open problem.\n\n## Root-cause hypothesis to confirm or refute\n\n`verifyReleaseManifest(payloadRoot, ...)` in `scripts/install-plugin-generation.js`\n(~line 642) reads the manifest from `payloadRoot`, **not** from the source\ncheckout:\n\n```js\nconst manifestPath = path.join(payloadRoot, 'shared/harnesses/generated/release-manifest.json');\n```\n\nSo a corrected manifest in the working tree may not be what is verified. Trace\nhow `payloadRoot` is derived and where the staged payload originates. Candidate\nexplanations, in the order worth testing:\n\n- the payload is staged from `git archive`/HEAD rather than the working tree, so\n  the regenerated (uncommitted) manifest never reaches `payloadRoot`;\n- the payload is copied to a temp/staging dir that is cached or reused between\n  runs and was not invalidated;\n- `bundleId` is recomputed over `identity` and must also match `expectedBundle`\n  threaded in from elsewhere (note `generate-harness-adapters.js` printed\n  `Generated bundle 75cdf7e0df7f31a5ef319dd5580e7c852371546b6b8f0bbcad9b8c787b9586f3`);\n- two manifests exist and a different one wins at verification time.\n\nConfirm which by instrumenting or reading the code — do not guess and patch.\n\nIf the payload is staged from HEAD, the corrected manifest **must be committed**\nbefore the install can succeed. That is likely the actual fix, and it means the\nregeneration alone is insufficient.\n\n## Constraints — read before touching anything\n\n- **Concurrent work is in progress in this repo. Do not overwrite, revert, stash,\n  reset, checkout over, or clean anyone else's changes.**\n- At the time of investigation the working tree had these **pre-existing\n  uncommitted** changes, unrelated to this fix (mtimes predate the regeneration\n  run — `kbd-init/SKILL.md` was modified 06:19 today). Treat any of these you\n  find as someone else's in-flight work:\n\n  ```\n   M hooks/codex-hooks.json\n   M hooks/hooks.json\n   M scripts/test-skills.js\n   M shared/harnesses/generated/claude-hooks.json\n   M shared/harnesses/generated/release-manifest.json\n   M skills/process/kbd-process-orchestrator/references/co\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:22:15.521460Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- AGENTS.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T11:22:20.607957Z",
+      "updated_at": "2026-08-09T11:22:20.607957Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-3383d6fb52bb5dce",
+      "title": "Karpathy session 3383d6fb52bb",
+      "content": "## Delta\n\nCompleted kbd-analyze — compass-scoping-and-bounds (step 0 of 0)\n\n## Answer: don't shard — and don't build partitioning either, because it already exists\n\nTwo findings changed the picture, both from reading the code rather than reasoning about it.\n\n**1. `PartitionedGraph` already exists.** `compass-history/src/artifacts.rs:76-84` has full record-class partitioning — nodes, edges, hyperedges, analysis, metadata, program facts/summaries — with `partition()`, `into_partition()`, and `reconstruct()`. A grep for it outside `compass-history` returns nothing. The current-graph path doesn't use it. So the real question isn't \"should we build partitioning\" but \"why does `compass init` serialize one monolithic document when the mechanism sits in the next crate over?\"\n\n**2. The 2 GiB cap protects against a problem the docs deny exists.** `compass-store/src/lib.rs:44-51` justifies the limit by saying the store serves records \"through indexed scans instead of materializing the whole document.\" But `load_active_snapshot` at lines 838-853 does this:\n\n```rust\nlet capacity = usize::try_from(manifest.payload_bytes).unwrap_or(MAX_GRAPH_BYTES);\nlet mut bytes = Vec::with_capacity(capacity);\nfor index in 0..manifest.chunk_count {\n    bytes.extend_from_slice(&chunk.value);\n```\n\nIt pre-allocates the full payload and concatenates every chunk. Chunking bounds each *stored value*, not the reconstruction. Meanwhile the **write** path genuinely streams via `DigestWriter`. The asymmetry matters: the cap isn't protecting the writer, it's protecting the reader — the opposite of what the comment claims.\n\n**This produces a hard sequencing constraint.** Honoring `COMPASS_MAX_GRAPH_BYTES` on the publication path (G1, the obvious fix) **must not land first**. Raising the cap today raises a real allocation — an override would let someone request a multi-gigabyte contiguous `Vec`, which is a worse failure than today's clean error. Stream the read path first.\n\n**Research backed the direction unanimously.** Sharding targets multi-machine scaling; Compass is local-first single-process. Citus notes graph sharding brings eventual consistency, which the determinism invariant forbids outright. Azure's criteria (data exceeds single-instance capacity, vertical scaling exhausted) don't apply. Notably, the existing `PartitionedGraph` partitions by *record class, not topology* — sidestepping the edge-cut problem the literature flags as graph partitioning's hardest part.\n\n**Recommended order:** stream `load_active_snapshot` → actionable error (G2) → pre-flight estimate (G3) → *then* the override (G1) → `vendor/` policy (G4). Items 2, 3, 5 are independent and can run in parallel.\n\n**Where I'd temper confidence:** direction is well-supported, but three of four open questions are unmeasured — no consumer audit of `load_active_snapshot`, no measurement of what dominates the 2 GiB, and my `--exclude` workaround from earlier is *still untested* and may not fit under the cap given 4,827 markdown files under `crates/`. Sizing this work would be guesswork right now.\n\n**One architecture decision blocks the partitioning route:** `PartitionedGraph` lives in `compass-history`, but AGENTS.md routes current-graph publication to `compass-graph`. Shared crate, duplicate with distinct identity semantics, or new dependency? That needs your call before anyone touches item 6.\n\nPhase is now live — `active_phase` set, waypoint at `analysis_ready`, next command `/kbd-spec`. Files written: `goals.md`, `analysis.md`, `library-candidates.json`, `decision-log.md`, `handoffs/analyze.md`.\n\nStill unpushed: the two commits on `docs/claude-md` plus all of `.kbd-orchestrator/` untracked.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T12:05:00.281326Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- AGENTS.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-15a46a623cf0e420.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-7c287ce9b2192bd7.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T12:05:01.652519Z",
+      "updated_at": "2026-08-09T12:05:01.652519Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-6aacc8d765a1b28f",
+      "title": "Karpathy session 6aacc8d765a1",
+      "content": "## Delta\n\nCompleted kbd-init — Compass\n\nTwo files written to `.kbd-orchestrator/`:\n\n**`project.json`** — discovery results:\n\n| Field | Value | Source |\n|---|---|---|\n| name / description | Compass — \"Native local-first knowledge graph engine…\" | `Cargo.toml` `[workspace.package]` |\n| stack | Rust (Edition 2024, pinned 1.97.1) | `Cargo.toml` + `rust-toolchain.toml` |\n| spec_paths | `openspec/specs/*.md` | `openspec/` exists (just initialized, currently empty) |\n| openspec_available | `true` | — |\n| workspace | single-project (`workspace_file: null`) | no `.code-workspace` references compass |\n| planning / execution agents | `claude` / `claude, codex, opencode` | the tools we just configured |\n| active_phase | `null` | no phase defined yet |\n\n**`constraints.md`** — I did **not** use the template's defaults. Those are TypeScript-oriented (`no-console-log`, `no-any-type`, `grep src/`) and would be inert in a Rust workspace with no `src/` at root. Instead I derived constraints from AGENTS.md: 16 blocking (unsafe/unwrap/expect/panic lints, product boundary vs. Graphify, local-first preservation, determinism, boundedness, immutable realizations, viewer-asset generation) and 17 warning (ownership boundary, extractor/resolver separation, compatibility documentation, the CompassQL and code-graph gates).\n\n**One thing needs your attention before any KBD phase runs a command:**\n\n`/Volumes/Workspace` **is not currently mounted** — only `Macintosh HD`, `my-passport`, and `Open Design` are. Every build/test/lint command in `project.json` sets `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main`, per the AGENTS.md mandate. As written, they'll fail until that volume is attached — which is the correct behavior, since AGENTS.md says to stop and report rather than fall back to a local `target/` on the 100 GB-capped main disk. I encoded the rule faithfully rather than silently substituting a working-but-wrong path.\n\nAlso worth noting: `openspec/specs/` is empty, so `spec_paths` currently resolves to nothing. That's expected for a fresh init — specs appear once you run `/opsx:new`.\n\nThese two files are untracked and uncommitted, separate from the two commits already on `docs/claude-md`. Next step is `/kbd-status` to confirm, then `/kbd-new-phase <name>` to start the first phase.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:58:32.187142Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T11:01:48.963380Z",
+      "updated_at": "2026-08-09T11:01:48.963380Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-7521e456ead1ce12",
+      "title": "Karpathy session 7521e456ead1",
+      "content": "## Delta\n\nBoth done.\n\n**Deleted the local sccache** — `~/Library/Caches/Mozilla.sccache` (10 GB) is gone and has not been recreated. Verified safe first: the live sccache server was serving `/Volumes/my-passport/sccache`, and the local dir had zero writes in the preceding 5 minutes even with an active build running.\n\n**Set `SCCACHE_DIR` in `~/.cargo/config.toml`** — added an `[env]` block pinning `SCCACHE_DIR = \"/Volumes/my-passport/sccache\"` and `SCCACHE_CACHE_SIZE = \"40G\"`, with a comment explaining the failure mode so it isn't re-litigated later. Config parses cleanly.\n\nI deliberately left off `force = true`: your `.zshrc` exports the identical value so there's no conflict, and staying unforced keeps one-off `SCCACHE_DIR=... cargo build` overrides working. Cargo's `[env]` applies to every invocation, so the non-login shells that previously bypassed the `.zshrc` guard now get the WDD path.\n\nFree space went 367 → 373 GiB. It reads lower than the raw 10 GB because an unrelated Rust build is running concurrently and consuming space as it compiles.\n\nTwo caveats worth stating plainly:\n\n- **My verification of the config was static, not functional.** I tried a real build to prove `SCCACHE_DIR` reaches a compiler process, but it hung — it inherited your `rustc-wrapper` and queued behind that concurrent surrealdb build saturating all 10 job slots. I killed and cleaned it up. So I confirmed the file parses with the right values, not that a build observes them end-to-end. Cargo `[env]` semantics are well-defined here, but if you want proof, run any build once the current one finishes and check `sccache --show-stats` still reports the WDD location.\n- **`[env]` doesn't cover non-cargo callers.** Anything invoking `sccache` directly — some CMake/C++ paths, for instance — still relies on the shell export. Your `.zshrc` handles login shells; a stray non-login shell could in principle recreate the default dir. Worth a periodic `du -sh ~/Library/Caches/Mozilla.sccache` to catch it early.\n\nThere's also a **stale comment** at line 12 of the config saying \"warm 12 GB cache on the WDD\" — the actual max is 40 GB. I left it alone since it's outside what you asked for, but I can fix it if you want.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 34d4343f-8edd-46e9-bb53-90b588e5d3ed\n- Captured: 2026-08-09T05:36:52.482414Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:34d4343f-8edd-46e9-bb53-90b588e5d3ed"
+      ],
+      "created_at": "2026-08-09T05:36:58.206699Z",
+      "updated_at": "2026-08-09T05:36:58.206699Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-762f04f1710fc991",
+      "title": "Karpathy session 762f04f1710f",
+      "content": "## Delta\n\nCompleted kbd-init — Compass\n\nTwo files written to `.kbd-orchestrator/`:\n\n**`project.json`** — discovery results:\n\n| Field | Value | Source |\n|---|---|---|\n| name / description | Compass — \"Native local-first knowledge graph engine…\" | `Cargo.toml` `[workspace.package]` |\n| stack | Rust (Edition 2024, pinned 1.97.1) | `Cargo.toml` + `rust-toolchain.toml` |\n| spec_paths | `openspec/specs/*.md` | `openspec/` exists (just initialized, currently empty) |\n| openspec_available | `true` | — |\n| workspace | single-project (`workspace_file: null`) | no `.code-workspace` references compass |\n| planning / execution agents | `claude` / `claude, codex, opencode` | the tools we just configured |\n| active_phase | `null` | no phase defined yet |\n\n**`constraints.md`** — I did **not** use the template's defaults. Those are TypeScript-oriented (`no-console-log`, `no-any-type`, `grep src/`) and would be inert in a Rust workspace with no `src/` at root. Instead I derived constraints from AGENTS.md: 16 blocking (unsafe/unwrap/expect/panic lints, product boundary vs. Graphify, local-first preservation, determinism, boundedness, immutable realizations, viewer-asset generation) and 17 warning (ownership boundary, extractor/resolver separation, compatibility documentation, the CompassQL and code-graph gates).\n\n**One thing needs your attention before any KBD phase runs a command:**\n\n`/Volumes/Workspace` **is not currently mounted** — only `Macintosh HD`, `my-passport`, and `Open Design` are. Every build/test/lint command in `project.json` sets `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main`, per the AGENTS.md mandate. As written, they'll fail until that volume is attached — which is the correct behavior, since AGENTS.md says to stop and report rather than fall back to a local `target/` on the 100 GB-capped main disk. I encoded the rule faithfully rather than silently substituting a working-but-wrong path.\n\nAlso worth noting: `openspec/specs/` is empty, so `spec_paths` currently resolves to nothing. That's expected for a fresh init — specs appear once you run `/opsx:new`.\n\nThese two files are untracked and uncommitted, separate from the two commits already on `docs/claude-md`. Next step is `/kbd-status` to confirm, then `/kbd-new-phase <name>` to start the first phase.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:01:46.520733Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T11:01:52.216303Z",
+      "updated_at": "2026-08-09T11:01:52.216303Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-7c287ce9b2192bd7",
+      "title": "Karpathy session 7c287ce9b219",
+      "content": "## Delta\n\nWritten to `/Users/gqadonis/Projects/prometheus/prometheus-skill-pack/docs/UPDATE_CONSIDERATIONS.md`.\n\nIt's structured as a handoff brief rather than the bare prompt — the same content, but organized so someone landing cold can act on it:\n\n- **Symptom + consequence** — the error, and the concrete drift it causes (`kbd-execute`, `kbd-spec`, `adversarial-review.md`), with the install-ref vs HEAD mismatch.\n- **Established by direct verification** — the three things I actually proved, with the hash evidence showing the manifest was wrong and the file was right.\n- **Open hypothesis** — `payloadRoot`, with four ranked candidates and an explicit instruction not to guess-and-patch. The likeliest answer (payload stages from HEAD → manifest must be committed) is called out as *structurally* meaning regeneration alone can't work.\n- **Constraints** — the concurrency guardrails, including that the two tree snapshots I took minutes apart already differed, so the listed file set is indicative only.\n- **Definition of done** — six checkable conditions, the last being that in-flight work survives untouched.\n- **Secondary defect** — the broken `.claude/skills` symlink, framed as arguably higher impact since it's the mechanism that let the staleness go unnoticed.\n- **Preventive follow-up** — proposal only, pointing at `check-harness-adapters.js` as the likely existing-but-unenforced check.\n\nI only created that one new file; nothing else in the repo was touched. Note the working tree there has kept growing — `kbd-init` workflow files across five harness surfaces are now modified — so that document is deliberately written to assume its own file list is stale.\n\nTwo loose ends still open here in Compass: the phase creation and `/kbd-analyze` on the partitioning question, plus the two unpushed commits on `docs/claude-md` and the untracked `.kbd-orchestrator/`. Since `kbd-analyze`'s `SKILL.md` is byte-identical between 1.6.2 and 1.7.0, running it now carries no version risk if you want to keep moving.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:24:38.852780Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- AGENTS.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-15a46a623cf0e420.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T11:24:40.732045Z",
+      "updated_at": "2026-08-09T11:24:40.732045Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-85be47bbe3d4faec",
+      "title": "Karpathy session 85be47bbe3d4",
+      "content": "## Delta\n\nFixed. The only remaining \"12 GB\" match is inside my new comment, where it's describing the past drift rather than claiming a current value.\n\nThe comment now points to `SCCACHE_CACHE_SIZE` in `[env]` instead of restating the number — a single source of truth, so it can't go stale again the way it just did. Config parses cleanly, and the declared `40G` matches what the live server actually reports (40 GiB max, on the WDD).\n\nThat closes out all three items: release build installed as `compass 0.3.6`, ~10.1 GB reclaimed locally, and the sccache config corrected so the internal disk stops accumulating cache.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 34d4343f-8edd-46e9-bb53-90b588e5d3ed\n- Captured: 2026-08-09T05:36:56.574046Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:34d4343f-8edd-46e9-bb53-90b588e5d3ed"
+      ],
+      "created_at": "2026-08-09T05:39:57.963184Z",
+      "updated_at": "2026-08-09T05:39:57.963184Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-8b2e071dd73e1374",
+      "title": "Karpathy session 8b2e071dd73e",
+      "content": "## Delta\n\nI've traced it. Here's what's actually going on — and part of it contradicts the premise.\n\n## Why 1.6.2 is resolving\n\n**1.7.0 was never installed.** The cache holds only `1.6.0`, `1.6.1`, `1.6.2`. Your source repo at `/Users/gqadonis/Projects/prometheus/prometheus-skill-pack` is tagged `v1.7.0` (12 commits past it, working tree clean), but that was never published into the plugin cache. The newest cache dir is dated Aug 3; the `.prometheus` generation is Aug 5. The tag exists locally and nowhere else.\n\nThere's also a **second, unrelated breakage**: `~/.claude/skills/kbd-init` symlinks to `~/.prometheus/plugins/prometheus-skill-pack/current/skills/process/kbd-process-orchestrator/skills/kbd-init` — a path that doesn't resolve. That's why I fell back to the cache at the start of this session. Two different install roots (`.claude/plugins/cache` and `.prometheus/plugins/generations`), and the symlink points into the one that's broken.\n\n## But the premise doesn't hold for this work\n\nI diffed the source tree against 1.6.2 directly. **The entire `kbd-process-orchestrator` differs in exactly three files:**\n\n| File | Status |\n|---|---|\n| `references/integrations/adversarial-review.md` | differs |\n| `skills/kbd-execute/SKILL.md` | differs |\n| `skills/kbd-spec/SKILL.md` | differs |\n\nEverything else is byte-identical. Specifically:\n\n- **`kbd-analyze` exists in 1.6.2 and its `SKILL.md` is identical to 1.7.0.** My earlier \"no analyze.md\" observation was about the `prompts/` directory — and `prompts/` has no `analyze.md` in **1.7.0 either**. `kbd-analyze` is driven by its `SKILL.md`, not a prompt file. That's not a version gap; I misread it.\n- `kbd-assess/SKILL.md`, `kbd-init/SKILL.md`, `kbd-new-phase/SKILL.md`, `prompts/assess.md`, `project.template.json`, and the adversarial-review preflight script are all **identical** between source and 1.6.2.\n\nSo the `/kbd-init` and `/kbd-assess` runs already completed used the same bytes 1.7.0 would have. No rework needed there.\n\nThe three drifted files matter for `/kbd-execute` and `/kbd-spec` — stages we haven't reached.\n\n## Your call\n\nI can't publish 1.7.0 into the plugin cache myself — that's your packaging pipeline, and I don't know its publish command. Options:\n\n1. **Publish 1.7.0 properly** — you run the pack's install/publish step; I re-verify and continue. Cleanest, and fixes the broken `~/.claude/skills` symlink if the installer rewrites it.\n2. **Continue on 1.6.2 for analyze** — legitimate here, since `kbd-analyze` is byte-identical. Then upgrade before `/kbd-spec` or `/kbd-execute`, where the drift is real.\n3. **Point the KBD skills at the source tree directly** for this session.\n\nI'd suggest **1**, since the symlink is broken regardless and will keep biting. But **2** is defensible if you want to keep moving on the partitioning question now — the risk is genuinely zero for the analyze stage.\n\nWhich way?\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:14:51.722543Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T11:14:53.968282Z",
+      "updated_at": "2026-08-09T11:14:53.968282Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-8f202396ae5617a5",
+      "title": "Karpathy session 8f202396ae56",
+      "content": "## Delta\n\nThe `kbd-init` mtime is 06:19 today — well before this session's regeneration. Those were already-pending working-tree changes, not collateral from my run. Retrying the install:\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:14:56.866886Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T11:20:15.494977Z",
+      "updated_at": "2026-08-09T11:20:15.494977Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-9354b74ff25823d0",
+      "title": "Karpathy session 9354b74ff258",
+      "content": "## Delta\n\nThat's the real cause: 9,320 in-scope markdown files, with **4,827 in `crates/`** alone. This is genuine content at genuine scale, not junk. Let me write the assessment.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:05:46.513453Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T11:10:48.901378Z",
+      "updated_at": "2026-08-09T11:10:48.901378Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-95e26dce31a612a2",
+      "title": "Karpathy session 95e26dce31a6",
+      "content": "## Delta\n\nFixed. The only remaining \"12 GB\" match is inside my new comment, where it's describing the past drift rather than claiming a current value.\n\nThe comment now points to `SCCACHE_CACHE_SIZE` in `[env]` instead of restating the number — a single source of truth, so it can't go stale again the way it just did. Config parses cleanly, and the declared `40G` matches what the live server actually reports (40 GiB max, on the WDD).\n\nThat closes out all three items: release build installed as `compass 0.3.6`, ~10.1 GB reclaimed locally, and the sccache config corrected so the internal disk stops accumulating cache.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 34d4343f-8edd-46e9-bb53-90b588e5d3ed\n- Captured: 2026-08-09T05:38:38.245900Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:34d4343f-8edd-46e9-bb53-90b588e5d3ed"
+      ],
+      "created_at": "2026-08-09T05:41:46.141746Z",
+      "updated_at": "2026-08-09T05:41:46.141746Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-a0b489beb0d312d9",
+      "title": "Karpathy session a0b489beb0d3",
+      "content": "## Delta\n\nCommitted as `dd7679fb` on a new branch `docs/claude-md` (1 file, 212 insertions).\n\nTwo things worth flagging:\n\n- **I branched off `main` rather than committing directly to it**, per the repo's git conventions. Say the word if you'd rather this land on `main` directly.\n- **`.prometheus/` was left untracked** — it looked like local tooling state, not part of this change, and AGENTS.md explicitly says not to commit local state directories. Let me know if it's actually meant to be tracked.\n\nNothing is pushed yet. I can push and open a PR if you want.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:52:26.193194Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T10:52:30.420142Z",
+      "updated_at": "2026-08-09T10:52:30.420142Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-b0a4e7ceb012e58d",
+      "title": "Karpathy session b0a4e7ceb012",
+      "content": "## Delta\n\nCompleted kbd-init — Compass\n\nTwo files written to `.kbd-orchestrator/`:\n\n**`project.json`** — discovery results:\n\n| Field | Value | Source |\n|---|---|---|\n| name / description | Compass — \"Native local-first knowledge graph engine…\" | `Cargo.toml` `[workspace.package]` |\n| stack | Rust (Edition 2024, pinned 1.97.1) | `Cargo.toml` + `rust-toolchain.toml` |\n| spec_paths | `openspec/specs/*.md` | `openspec/` exists (just initialized, currently empty) |\n| openspec_available | `true` | — |\n| workspace | single-project (`workspace_file: null`) | no `.code-workspace` references compass |\n| planning / execution agents | `claude` / `claude, codex, opencode` | the tools we just configured |\n| active_phase | `null` | no phase defined yet |\n\n**`constraints.md`** — I did **not** use the template's defaults. Those are TypeScript-oriented (`no-console-log`, `no-any-type`, `grep src/`) and would be inert in a Rust workspace with no `src/` at root. Instead I derived constraints from AGENTS.md: 16 blocking (unsafe/unwrap/expect/panic lints, product boundary vs. Graphify, local-first preservation, determinism, boundedness, immutable realizations, viewer-asset generation) and 17 warning (ownership boundary, extractor/resolver separation, compatibility documentation, the CompassQL and code-graph gates).\n\n**One thing needs your attention before any KBD phase runs a command:**\n\n`/Volumes/Workspace` **is not currently mounted** — only `Macintosh HD`, `my-passport`, and `Open Design` are. Every build/test/lint command in `project.json` sets `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main`, per the AGENTS.md mandate. As written, they'll fail until that volume is attached — which is the correct behavior, since AGENTS.md says to stop and report rather than fall back to a local `target/` on the 100 GB-capped main disk. I encoded the rule faithfully rather than silently substituting a working-but-wrong path.\n\nAlso worth noting: `openspec/specs/` is empty, so `spec_paths` currently resolves to nothing. That's expected for a fresh init — specs appear once you run `/opsx:new`.\n\nThese two files are untracked and uncommitted, separate from the two commits already on `docs/claude-md`. Next step is `/kbd-status` to confirm, then `/kbd-new-phase <name>` to start the first phase.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:55:59.021325Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T10:58:30.244136Z",
+      "updated_at": "2026-08-09T10:58:30.244136Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-b5d49ca1d46e60a2",
+      "title": "Karpathy session b5d49ca1d46e",
+      "content": "## Delta\n\nBoth commits are on `docs/claude-md`:\n\n| Commit | Contents |\n|---|---|\n| `dd7679fb` | `docs: add CLAUDE.md agent guide` — 1 file |\n| `c349fdf6` | `chore: track Prometheus wiki and initialize OpenSpec` — 73 files, 12,227 insertions |\n\n**What landed:**\n- **`.prometheus/knowledge/wiki/`** — all 12 files tracked as-is, per your call.\n- **OpenSpec** initialized with `schema: spec-driven`, generating `.claude/`, `.codex/`, `.kimi/`, `.opencode/` plus `openspec/config.yaml`.\n\n**Three things to know:**\n\n1. **Zed got nothing.** It isn't a supported `openspec init` target, so there's no generated config for it. If you use Zed here, that gap is still open — I can hand-write a rules file, but it'd be unofficial and liable to drift from openspec's format.\n\n2. **Kimi has skills but no commands.** OpenSpec reported \"Commands skipped for: kimi (no adapter)\" — it got 10 skill files, no `/opsx:*` slash commands. Claude, Codex, and OpenCode got both.\n\n3. **`.claude/settings.local.json` stayed untracked.** It's your personal permission allowlist with machine-specific paths, and your global gitignore already excludes it — so it was never at risk of being committed.\n\n`openspec/config.yaml` is currently all commented-out scaffolding. Its `context:` field feeds project background to AI tools when creating artifacts, and this repo has strong conventions worth putting there (local-first Rust, no-unwrap/expect/panic lints, determinism requirements, the `CARGO_TARGET_DIR` rule). Want me to fill it in?\n\nNothing is pushed yet. Say the word and I'll push and open a PR.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:52:28.835309Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- No changed paths detected.\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T10:56:00.254334Z",
+      "updated_at": "2026-08-09T10:56:00.254334Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-b6f086fb31ed31c5",
+      "title": "Karpathy session b6f086fb31ed",
+      "content": "## Delta\n\nBoth commits are on `docs/claude-md`:\n\n| Commit | Contents |\n|---|---|\n| `dd7679fb` | `docs: add CLAUDE.md agent guide` — 1 file |\n| `c349fdf6` | `chore: track Prometheus wiki and initialize OpenSpec` — 73 files, 12,227 insertions |\n\n**What landed:**\n- **`.prometheus/knowledge/wiki/`** — all 12 files tracked as-is, per your call.\n- **OpenSpec** initialized with `schema: spec-driven`, generating `.claude/`, `.codex/`, `.kimi/`, `.opencode/` plus `openspec/config.yaml`.\n\n**Three things to know:**\n\n1. **Zed got nothing.** It isn't a supported `openspec init` target, so there's no generated config for it. If you use Zed here, that gap is still open — I can hand-write a rules file, but it'd be unofficial and liable to drift from openspec's format.\n\n2. **Kimi has skills but no commands.** OpenSpec reported \"Commands skipped for: kimi (no adapter)\" — it got 10 skill files, no `/opsx:*` slash commands. Claude, Codex, and OpenCode got both.\n\n3. **`.claude/settings.local.json` stayed untracked.** It's your personal permission allowlist with machine-specific paths, and your global gitignore already excludes it — so it was never at risk of being committed.\n\n`openspec/config.yaml` is currently all commented-out scaffolding. Its `context:` field feeds project background to AI tools when creating artifacts, and this repo has strong conventions worth putting there (local-first Rust, no-unwrap/expect/panic lints, determinism requirements, the `CARGO_TARGET_DIR` rule). Want me to fill it in?\n\nNothing is pushed yet. Say the word and I'll push and open a PR.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:55:56.151200Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T10:56:01.152228Z",
+      "updated_at": "2026-08-09T10:56:01.152228Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-bb64c62e88af6029",
+      "title": "Karpathy session bb64c62e88af",
+      "content": "## Delta\n\nCreated `CLAUDE.md` at the repo root.\n\nSince `AGENTS.md` is already a thorough agent guide, I wrote CLAUDE.md to defer to it rather than duplicate it, and concentrated on what it leaves implicit:\n\n**What's in it:**\n- **`CARGO_TARGET_DIR` requirement** — surfaced up top, since it must be set on every compiling invocation and is the easiest thing to get wrong. I also flagged the conflict where some Makefile targets (`install`, `dist`, `release-check`) resolve binaries through a literal `target/` path, which AGENTS.md mentions but doesn't tie to specific targets.\n- **Commands** — narrow-loop test/clippy per crate and per integration file, the workspace baseline, the surface-specific gates (product boundary, CompassQL TCK, code-graph qualification), and the npm workspace commands. Noted that `make test` is `--lib --bins` only while `make test-all` needs Python oracle setup.\n- **Architecture** — the piece that genuinely requires reading multiple files: the one-directional flow `compass-files → compass-languages → compass-resolve → compass-graph → compass-model`, orchestrated by `compass-core`. I emphasized the boundary that's easiest to violate — per-file extractors emit evidence and never resolve targets needing project-wide facts. Also the `compass-cypher` (syntax) vs `compass-query` (execution) split, immutable history realizations, and the generated viewer assets round-trip.\n- **Enforced constraints** — the lint set, determinism as correctness, boundedness (limit error ≠ empty result), and reuse of existing safe primitives.\n\nTwo notes on judgment calls: I skipped enumerating individual crates beyond the pipeline ones, since `docs/implementation/workspace-tour.md` already does that well and I pointed at it instead. I also didn't import anything from a Codex or Gemini config — I didn't check for those, as the instruction is to offer rather than read them. If you have an OpenAI Codex or Gemini CLI config you'd like folded in, reply `/import` and it'll scan and list what's importable.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:37:15.181272Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n- CLAUDE.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T10:37:28.812655Z",
+      "updated_at": "2026-08-09T10:37:28.812655Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-c13ff840014cf2b3",
+      "title": "Karpathy session c13ff840014c",
+      "content": "## Delta\n\n`cargo config` needs nightly. Let me verify with a functional test instead — the stronger check anyway, since it proves the var reaches a real build process.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 34d4343f-8edd-46e9-bb53-90b588e5d3ed\n- Captured: 2026-08-09T05:20:58.608418Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- No changed paths detected.\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:34d4343f-8edd-46e9-bb53-90b588e5d3ed"
+      ],
+      "created_at": "2026-08-09T05:26:55.781482Z",
+      "updated_at": "2026-08-09T05:26:55.781482Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-cd330c925600f45f",
+      "title": "Karpathy session cd330c925600",
+      "content": "## Delta\n\nI have what I need to give you a straight answer — and it includes a correction to my own recommendation.\n\n## The doc comment tells you what this type is for\n\n```rust\n/// Deterministic typed records used to construct the five Prolly trees.\npub struct PartitionedGraph { ... }\n```\n\n`PartitionedGraph` isn't a general-purpose partitioning abstraction. It's **the input format for Prolly tree construction** — history's immutable-storage engine. The struct body is plain `Vec<(Vec<u8>, Vec<u8>)>` and looks portable, but the meaning is history-specific.\n\nThe producing logic confirms it. `into_partition` (`artifacts.rs:349-400+`) is entangled with concerns that don't exist on the current-graph path:\n\n| Dependency | Belongs to |\n|---|---|\n| `CompletionEvidence` | history realization completion |\n| `authoritative_sidecars` / `TRUSTED_GRAPH_CONTENT` | history provenance |\n| `AnalysisBundle`, `compass_ir::ProgramBundle` | `compass-analysis` / `compass-ir` |\n| `HistoryError` | history error taxonomy |\n| `prolly::{KeyBuilder, VersionedValue}` | Prolly storage |\n\nAnd the crate dependency sets diverge sharply. `compass-history` pulls `prolly-map`, `prolly-store-sqlite`, `compass-ir`, `compass-analysis`. `compass-graph` pulls none of those. A shared crate has to either carry that weight — forcing Prolly and IR onto the current-graph path, which contradicts the local-first minimal-dependency posture — or be gutted down to the struct alone.\n\n**If it's gutted to the struct alone, you've shared 9 lines of field declarations and left all 2,300 lines of actual logic behind.** That's not reuse.\n\n## What I'd do instead\n\nI over-indexed on \"the mechanism exists\" in the analysis. On closer reading, what exists is *history's* mechanism, and the shared-crate framing inherits a coupling that doesn't serve the current-graph path.\n\nThe sequencing finding still stands and is the load-bearing one: **stream `load_active_snapshot` first**. That removes the actual constraint. Whether current-graph publication later adopts a record-partitioned format is a separate question that gets much easier to answer *after* the read path stops materializing 2 GiB — and it may not need `PartitionedGraph`'s shape at all, since it has no Prolly trees to feed.\n\nSo I'd put the shared crate behind the streaming fix rather than in front of it.\n\nThat said — you've made a call, and you may be seeing a longer arc than I am (a future where current-graph and history publication genuinely converge, which would justify the shared crate now). If that's the intent, say so and I'll spec it properly. Three questions I'd need answered either way:\n\n1. **Crate name and scope** — `compass-partition`? Does it carry just the type, or the record-encoding helpers (`node_key`, `edge_key`, `hyperedge_key`, `canonical_json_bytes`) too?\n2. **Does it take the Prolly dependency?** If yes, `compass-graph` inherits it. If no, the encoding logic stays in history and the shared crate is nearly empty.\n3. **Identity semantics** — history fingerprints are meaning-affecting and realizations are immutable. If current-graph reuses the same record keys, do the two paths risk producing colliding or conflatable identities? AGENTS.md is strict here.\n\nWant me to spec the shared crate as you've directed, or run `/kbd-spec` on the streaming fix first and revisit this once the read path is honest?\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T12:06:25.091241Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- AGENTS.md\n- .kbd-orchestrator/\n- .prometheus/events.jsonl\n- .prometheus/knowledge/.prompt-snapshots/\n- .prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-session.md\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-15a46a623cf0e420.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md\n- .prometheus/knowledge/wiki/karpathy-session-3383d6fb52bb5dce.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-7c287ce9b2192bd7.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T12:06:26.089450Z",
+      "updated_at": "2026-08-09T12:06:26.089450Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-f8eff00b52d5f657",
+      "title": "Karpathy session f8eff00b52d5",
+      "content": "## Delta\n\nCreated `CLAUDE.md` at the repo root.\n\nSince `AGENTS.md` is already a thorough agent guide, I wrote CLAUDE.md to defer to it rather than duplicate it, and concentrated on what it leaves implicit:\n\n**What's in it:**\n- **`CARGO_TARGET_DIR` requirement** — surfaced up top, since it must be set on every compiling invocation and is the easiest thing to get wrong. I also flagged the conflict where some Makefile targets (`install`, `dist`, `release-check`) resolve binaries through a literal `target/` path, which AGENTS.md mentions but doesn't tie to specific targets.\n- **Commands** — narrow-loop test/clippy per crate and per integration file, the workspace baseline, the surface-specific gates (product boundary, CompassQL TCK, code-graph qualification), and the npm workspace commands. Noted that `make test` is `--lib --bins` only while `make test-all` needs Python oracle setup.\n- **Architecture** — the piece that genuinely requires reading multiple files: the one-directional flow `compass-files → compass-languages → compass-resolve → compass-graph → compass-model`, orchestrated by `compass-core`. I emphasized the boundary that's easiest to violate — per-file extractors emit evidence and never resolve targets needing project-wide facts. Also the `compass-cypher` (syntax) vs `compass-query` (execution) split, immutable history realizations, and the generated viewer assets round-trip.\n- **Enforced constraints** — the lint set, determinism as correctness, boundedness (limit error ≠ empty result), and reuse of existing safe primitives.\n\nTwo notes on judgment calls: I skipped enumerating individual crates beyond the pipeline ones, since `docs/implementation/workspace-tour.md` already does that well and I pointed at it instead. I also didn't import anything from a Codex or Gemini config — I didn't check for those, as the instruction is to offer rather than read them. If you have an OpenAI Codex or Gemini CLI config you'd like folded in, reply `/import` and it'll scan and list what's importable.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:34:10.259136Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n- CLAUDE.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T10:34:18.362064Z",
+      "updated_at": "2026-08-09T10:34:18.362064Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-f8f9c99266231745",
+      "title": "Karpathy session f8f9c9926623",
+      "content": "## Delta\n\nI have what I need to give you a straight answer — and it includes a correction to my own recommendation.\n\n## The doc comment tells you what this type is for\n\n```rust\n/// Deterministic typed records used to construct the five Prolly trees.\npub struct PartitionedGraph { ... }\n```\n\n`PartitionedGraph` isn't a general-purpose partitioning abstraction. It's **the input format for Prolly tree construction** — history's immutable-storage engine. The struct body is plain `Vec<(Vec<u8>, Vec<u8>)>` and looks portable, but the meaning is history-specific.\n\nThe producing logic confirms it. `into_partition` (`artifacts.rs:349-400+`) is entangled with concerns that don't exist on the current-graph path:\n\n| Dependency | Belongs to |\n|---|---|\n| `CompletionEvidence` | history realization completion |\n| `authoritative_sidecars` / `TRUSTED_GRAPH_CONTENT` | history provenance |\n| `AnalysisBundle`, `compass_ir::ProgramBundle` | `compass-analysis` / `compass-ir` |\n| `HistoryError` | history error taxonomy |\n| `prolly::{KeyBuilder, VersionedValue}` | Prolly storage |\n\nAnd the crate dependency sets diverge sharply. `compass-history` pulls `prolly-map`, `prolly-store-sqlite`, `compass-ir`, `compass-analysis`. `compass-graph` pulls none of those. A shared crate has to either carry that weight — forcing Prolly and IR onto the current-graph path, which contradicts the local-first minimal-dependency posture — or be gutted down to the struct alone.\n\n**If it's gutted to the struct alone, you've shared 9 lines of field declarations and left all 2,300 lines of actual logic behind.** That's not reuse.\n\n## What I'd do instead\n\nI over-indexed on \"the mechanism exists\" in the analysis. On closer reading, what exists is *history's* mechanism, and the shared-crate framing inherits a coupling that doesn't serve the current-graph path.\n\nThe sequencing finding still stands and is the load-bearing one: **stream `load_active_snapshot` first**. That removes the actual constraint. Whether current-graph publication later adopts a record-partitioned format is a separate question that gets much easier to answer *after* the read path stops materializing 2 GiB — and it may not need `PartitionedGraph`'s shape at all, since it has no Prolly trees to feed.\n\nSo I'd put the shared crate behind the streaming fix rather than in front of it.\n\nThat said — you've made a call, and you may be seeing a longer arc than I am (a future where current-graph and history publication genuinely converge, which would justify the shared crate now). If that's the intent, say so and I'll spec it properly. Three questions I'd need answered either way:\n\n1. **Crate name and scope** — `compass-partition`? Does it carry just the type, or the record-encoding helpers (`node_key`, `edge_key`, `hyperedge_key`, `canonical_json_bytes`) too?\n2. **Does it take the Prolly dependency?** If yes, `compass-graph` inherits it. If no, the encoding logic stays in history and the shared crate is nearly empty.\n3. **Identity semantics** — history fingerprints are meaning-affecting and realizations are immutable. If current-graph reuses the same record keys, do the two paths risk producing colliding or conflatable identities? AGENTS.md is strict here.\n\nWant me to spec the shared crate as you've directed, or run `/kbd-spec` on the streaming fix first and revisit this once the read path is honest?\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T12:05:04.010581Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- AGENTS.md\n- .kbd-orchestrator/\n- .prometheus/events.jsonl\n- .prometheus/knowledge/.prompt-snapshots/\n- .prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-session.md\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-15a46a623cf0e420.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md\n- .prometheus/knowledge/wiki/karpathy-session-3383d6fb52bb5dce.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-7c287ce9b2192bd7.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-cd330c925600f45f.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T12:06:26.689357Z",
+      "updated_at": "2026-08-09T12:06:26.689357Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-f90cdbd5fafd1d1d",
+      "title": "Karpathy session f90cdbd5fafd",
+      "content": "## Delta\n\nCompleted kbd-init — Compass\n\nTwo files written to `.kbd-orchestrator/`:\n\n**`project.json`** — discovery results:\n\n| Field | Value | Source |\n|---|---|---|\n| name / description | Compass — \"Native local-first knowledge graph engine…\" | `Cargo.toml` `[workspace.package]` |\n| stack | Rust (Edition 2024, pinned 1.97.1) | `Cargo.toml` + `rust-toolchain.toml` |\n| spec_paths | `openspec/specs/*.md` | `openspec/` exists (just initialized, currently empty) |\n| openspec_available | `true` | — |\n| workspace | single-project (`workspace_file: null`) | no `.code-workspace` references compass |\n| planning / execution agents | `claude` / `claude, codex, opencode` | the tools we just configured |\n| active_phase | `null` | no phase defined yet |\n\n**`constraints.md`** — I did **not** use the template's defaults. Those are TypeScript-oriented (`no-console-log`, `no-any-type`, `grep src/`) and would be inert in a Rust workspace with no `src/` at root. Instead I derived constraints from AGENTS.md: 16 blocking (unsafe/unwrap/expect/panic lints, product boundary vs. Graphify, local-first preservation, determinism, boundedness, immutable realizations, viewer-asset generation) and 17 warning (ownership boundary, extractor/resolver separation, compatibility documentation, the CompassQL and code-graph gates).\n\n**One thing needs your attention before any KBD phase runs a command:**\n\n`/Volumes/Workspace` **is not currently mounted** — only `Macintosh HD`, `my-passport`, and `Open Design` are. Every build/test/lint command in `project.json` sets `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main`, per the AGENTS.md mandate. As written, they'll fail until that volume is attached — which is the correct behavior, since AGENTS.md says to stop and report rather than fall back to a local `target/` on the 100 GB-capped main disk. I encoded the rule faithfully rather than silently substituting a working-but-wrong path.\n\nAlso worth noting: `openspec/specs/` is empty, so `spec_paths` currently resolves to nothing. That's expected for a fresh init — specs appear once you run `/opsx:new`.\n\nThese two files are untracked and uncommitted, separate from the two commits already on `docs/claude-md`. Next step is `/kbd-status` to confirm, then `/kbd-new-phase <name>` to start the first phase.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:58:29.463044Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T10:58:32.854406Z",
+      "updated_at": "2026-08-09T10:58:32.854406Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    }
+  ]
+}
diff --git a/.prometheus/knowledge/.prompt-snapshots/project/generations/d8234ef2341584c455b4c9ce94b3c57e74845d1f48f3ff5a37b929885585f87e.json b/.prometheus/knowledge/.prompt-snapshots/project/generations/d8234ef2341584c455b4c9ce94b3c57e74845d1f48f3ff5a37b929885585f87e.json
new file mode 100644
index 000000000..000a156af
--- /dev/null
+++ b/.prometheus/knowledge/.prompt-snapshots/project/generations/d8234ef2341584c455b4c9ce94b3c57e74845d1f48f3ff5a37b929885585f87e.json
@@ -0,0 +1,524 @@
+{
+  "schemaVersion": 1,
+  "scope": "project",
+  "generation": "d8234ef2341584c455b4c9ce94b3c57e74845d1f48f3ff5a37b929885585f87e",
+  "candidateCount": 27,
+  "byteCount": 81879,
+  "entries": [
+    {
+      "id": "compass-scoping-and-bounds-executor-session",
+      "title": "Compass scoping and bounds executor session",
+      "content": "## Summary\n\n- Executor session completed for phase `compass-scoping-and-bounds`.\n- Reported change status: `unknown`.\n- No delta, root cause, changed paths, or corrective actions were captured in the raw record.\n\n## Session Record\n\n| Field | Value |\n|---|---|\n| Phase | `compass-scoping-and-bounds` |\n| Change | `unknown` |\n| Status | complete |\n\n## Handling Notes\n\n- Preserve as a minimal execution record.\n- Do not infer implementation changes or root cause from this capture alone.\n- Promote reusable findings only if a fuller session artifact becomes available.\n\n# Citations\n\n1. stdin",
+      "tags": [
+        "compass",
+        "executor-session",
+        "scoping",
+        "session-record"
+      ],
+      "links": [],
+      "sources": [
+        "stdin"
+      ],
+      "created_at": "2026-08-09T12:05:10.450410Z",
+      "updated_at": "2026-08-09T12:05:10.450410Z",
+      "revision": 0,
+      "entry_type": "Reference",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-04f1f5622348cff2",
+      "title": "Karpathy session 04f1f5622348",
+      "content": "## Delta\n\nDone — built, installed, and the target directory cleaned.\n\n**Results:**\n- `make install` → release build succeeded in **24m 13s**\n- Installed `compass 0.3.6` → `~/.cargo/bin/compass` (146 MB), verified working after cleanup, resolving on PATH\n- Local `./target` reclaimed: **139 MB → 4 KB**\n\n**One thing worth knowing:** cleaning `target/` reclaimed far less than you'd expect, because your global `~/.cargo/config.toml` offloads Rust builds to the external drive. Intermediates go to `/Volumes/my-passport/cargo-build/...` (3.3 GB for this workspace) and sccache to `/Volumes/my-passport/sccache` (29 of 40 GiB). Only the final binary lands locally — so `target/` was never the disk hog here.\n\nI deliberately did **not** run `cargo clean`. It would have deleted the 3.3 GB external build cache too, costing you another 24-minute cold rebuild while reclaiming nothing extra from your internal disk. I removed `target/release` instead.\n\n**The actual local space, if you want it — needs your call:**\n\n`~/Library/Caches/Mozilla.sccache` holds **10 GB on your internal disk**. This is sccache's *default* path, not your configured WDD one. It gets written whenever sccache starts in a shell that didn't export `SCCACHE_DIR` — your `.zshrc` only sets it behind a `[[ -d \"$WDD/cargo\" ]]` guard, so non-login shells and any unmounted-drive moment bypass it. Newest entries are from Aug 8 20:14, so it's recent, not ancient.\n\nDeleting it is safe — sccache is purely a cache, worst case is slower recompiles — and nothing currently holds it open. I'd also suggest setting `SCCACHE_DIR` in `~/.cargo/config.toml`'s `[env]` rather than `.zshrc`, so it applies to every shell and stops re-accumulating. Say the word and I'll do either or both.\n\nI should flag one correction: mid-investigation I said the build had \"stopped\" and separately called this cache \"orphaned.\" Both were wrong — the first was a bad read of a momentary process gap, the second I revised once I checked the timestamps.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 34d4343f-8edd-46e9-bb53-90b588e5d3ed\n- Captured: 2026-08-09T05:20:55.484287Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- No changed paths detected.\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:34d4343f-8edd-46e9-bb53-90b588e5d3ed"
+      ],
+      "created_at": "2026-08-09T05:21:00.817633Z",
+      "updated_at": "2026-08-09T05:21:00.817633Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-06cdf26d86b0c087",
+      "title": "Karpathy session 06cdf26d86b0",
+      "content": "## Delta\n\nI've traced it. Here's what's actually going on — and part of it contradicts the premise.\n\n## Why 1.6.2 is resolving\n\n**1.7.0 was never installed.** The cache holds only `1.6.0`, `1.6.1`, `1.6.2`. Your source repo at `/Users/gqadonis/Projects/prometheus/prometheus-skill-pack` is tagged `v1.7.0` (12 commits past it, working tree clean), but that was never published into the plugin cache. The newest cache dir is dated Aug 3; the `.prometheus` generation is Aug 5. The tag exists locally and nowhere else.\n\nThere's also a **second, unrelated breakage**: `~/.claude/skills/kbd-init` symlinks to `~/.prometheus/plugins/prometheus-skill-pack/current/skills/process/kbd-process-orchestrator/skills/kbd-init` — a path that doesn't resolve. That's why I fell back to the cache at the start of this session. Two different install roots (`.claude/plugins/cache` and `.prometheus/plugins/generations`), and the symlink points into the one that's broken.\n\n## But the premise doesn't hold for this work\n\nI diffed the source tree against 1.6.2 directly. **The entire `kbd-process-orchestrator` differs in exactly three files:**\n\n| File | Status |\n|---|---|\n| `references/integrations/adversarial-review.md` | differs |\n| `skills/kbd-execute/SKILL.md` | differs |\n| `skills/kbd-spec/SKILL.md` | differs |\n\nEverything else is byte-identical. Specifically:\n\n- **`kbd-analyze` exists in 1.6.2 and its `SKILL.md` is identical to 1.7.0.** My earlier \"no analyze.md\" observation was about the `prompts/` directory — and `prompts/` has no `analyze.md` in **1.7.0 either**. `kbd-analyze` is driven by its `SKILL.md`, not a prompt file. That's not a version gap; I misread it.\n- `kbd-assess/SKILL.md`, `kbd-init/SKILL.md`, `kbd-new-phase/SKILL.md`, `prompts/assess.md`, `project.template.json`, and the adversarial-review preflight script are all **identical** between source and 1.6.2.\n\nSo the `/kbd-init` and `/kbd-assess` runs already completed used the same bytes 1.7.0 would have. No rework needed there.\n\nThe three drifted files matter for `/kbd-execute` and `/kbd-spec` — stages we haven't reached.\n\n## Your call\n\nI can't publish 1.7.0 into the plugin cache myself — that's your packaging pipeline, and I don't know its publish command. Options:\n\n1. **Publish 1.7.0 properly** — you run the pack's install/publish step; I re-verify and continue. Cleanest, and fixes the broken `~/.claude/skills` symlink if the installer rewrites it.\n2. **Continue on 1.6.2 for analyze** — legitimate here, since `kbd-analyze` is byte-identical. Then upgrade before `/kbd-spec` or `/kbd-execute`, where the drift is real.\n3. **Point the KBD skills at the source tree directly** for this session.\n\nI'd suggest **1**, since the symlink is broken regardless and will keep biting. But **2** is defensible if you want to keep moving on the partitioning question now — the risk is genuinely zero for the analyze stage.\n\nWhich way?\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:11:33.611768Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T11:14:53.644969Z",
+      "updated_at": "2026-08-09T11:14:53.644969Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-0c2a62b22721a70c",
+      "title": "Karpathy session 0c2a62b22721",
+      "content": "## Delta\n\nThat confirms the root cause. Here's what's happening.\n\n## Diagnosis\n\nThis is **not a bug** — it's a bounded-work invariant firing correctly, but with a bad user experience. Three separate problems:\n\n**1. The scope was never actually narrowed.** Your run reported `Scope: 0 include rule(s), 0 exclude rule(s)` and matched **19,666 files**. The repo is 6.8 GB, and the walk swept in directories that have no business in a code graph:\n\n| Directory | Size |\n|---|---|\n| `node_modules/` | 1.6 GB |\n| `target/` | 821 MB |\n| `compass-out/` | 302 MB ← Compass's *own* prior output |\n| `vendor/` | 126 MB |\n\nNote the 9,679 \"documents\" and 508 images — that's overwhelmingly dependency and build-artifact content, not your source.\n\n**2. The 2 GiB cap has no escape hatch on this path.** `MAX_GRAPH_BYTES` (`crates/compass-store/src/lib.rs:51`) is a hard `const`. Elsewhere in the codebase — `compass-model`, `compass-output`, `compass-global`, `compass-core` — the same limit is overridable via `COMPASS_MAX_GRAPH_BYTES`, and the error messages there *tell you so*. But `compass-graph/src/snapshot.rs:3138` and `compass-store` never read that variable. So the message you got is a dead end: no override, no suggested remedy.\n\n**3. It failed after 331 seconds**, at final publication — after all extraction work was done. The limit is checked at serialization time (`digest_json`), not estimated up front.\n\n## Your immediate unblock\n\n`compass init` does support scoping — you just pressed through the prompts. Exclusions are available non-interactively:\n\n```bash\ncd /Users/gqadonis/Projects/prometheus/universal-agent-runtime\nrm -rf compass-out .compass\ncompass init --exclude='node_modules/**' --exclude='target/**' \\\n             --exclude='compass-out/**' --exclude='vendor/**' \\\n             --exclude='website/**' --exclude='static/**' --exclude='models.dev/**'\n```\n\nThat should cut the graph by well over an order of magnitude. I haven't run it, so I can't promise it lands under the cap — but the excluded directories are ~3.2 GB of the 6.8 GB, and they're the ones generating the bulk of those 9,679 documents.\n\n## The real fixes for this repo\n\nThree defects worth addressing here, in priority order:\n\n1. **Default ignore policy misses `compass-out/`, `node_modules/`, `target/`, `vendor/`.** Compass ingesting its own output directory is clearly wrong. This belongs in `compass-files::detect`.\n2. **The limit error is unactionable.** It should name the override (if one is granted on this path) and point at scoping — matching how `compass-model` and `compass-core` already word theirs.\n3. **Failing at 331 s is avoidable.** A pre-publication size estimate could fail fast, or warn during extraction.\n\nPer AGENTS.md, #1 and #3 are `compass-files`/`compass-core` work and #2 spans `compass-graph`/`compass-store`; the CLI message stays thin.\n\nTwo things I want your call on before doing anything:\n\n- **Scope:** should I fix all three, or just the ignore-policy default (#1), which alone would have prevented your failure?\n- **Whether to raise the cap:** I'd advise against it. It's a deliberate bounded-work invariant, and AGENTS.md is explicit that a limit error is a distinct outcome from an empty result. Better to make the default scope sane than to let a 2 GiB graph through.\n\nAlso worth noting: the two commits on `docs/claude-md` and the `.kbd-orchestrator/` files are all still uncommitted/unpushed. This fix is unrelated work — I'd put it on its own branch rather than folding it in.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:05:43.579156Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T11:05:44.269089Z",
+      "updated_at": "2026-08-09T11:05:44.269089Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-0cf2eabc28e07ef7",
+      "title": "Karpathy session 0cf2eabc28e0",
+      "content": "## Delta\n\nFixed. The only remaining \"12 GB\" match is inside my new comment, where it's describing the past drift rather than claiming a current value.\n\nThe comment now points to `SCCACHE_CACHE_SIZE` in `[env]` instead of restating the number — a single source of truth, so it can't go stale again the way it just did. Config parses cleanly, and the declared `40G` matches what the live server actually reports (40 GiB max, on the WDD).\n\nThat closes out all three items: release build installed as `compass 0.3.6`, ~10.1 GB reclaimed locally, and the sccache config corrected so the internal disk stops accumulating cache.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 34d4343f-8edd-46e9-bb53-90b588e5d3ed\n- Captured: 2026-08-09T05:41:42.970513Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:34d4343f-8edd-46e9-bb53-90b588e5d3ed"
+      ],
+      "created_at": "2026-08-09T05:41:45.675152Z",
+      "updated_at": "2026-08-09T05:41:45.675152Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-15a46a623cf0e420",
+      "title": "Karpathy session 15a46a623cf0",
+      "content": "## Delta\n\nWritten to `/Users/gqadonis/Projects/prometheus/prometheus-skill-pack/docs/UPDATE_CONSIDERATIONS.md`.\n\nIt's structured as a handoff brief rather than the bare prompt — the same content, but organized so someone landing cold can act on it:\n\n- **Symptom + consequence** — the error, and the concrete drift it causes (`kbd-execute`, `kbd-spec`, `adversarial-review.md`), with the install-ref vs HEAD mismatch.\n- **Established by direct verification** — the three things I actually proved, with the hash evidence showing the manifest was wrong and the file was right.\n- **Open hypothesis** — `payloadRoot`, with four ranked candidates and an explicit instruction not to guess-and-patch. The likeliest answer (payload stages from HEAD → manifest must be committed) is called out as *structurally* meaning regeneration alone can't work.\n- **Constraints** — the concurrency guardrails, including that the two tree snapshots I took minutes apart already differed, so the listed file set is indicative only.\n- **Definition of done** — six checkable conditions, the last being that in-flight work survives untouched.\n- **Secondary defect** — the broken `.claude/skills` symlink, framed as arguably higher impact since it's the mechanism that let the staleness go unnoticed.\n- **Preventive follow-up** — proposal only, pointing at `check-harness-adapters.js` as the likely existing-but-unenforced check.\n\nI only created that one new file; nothing else in the repo was touched. Note the working tree there has kept growing — `kbd-init` workflow files across five harness surfaces are now modified — so that document is deliberately written to assume its own file list is stale.\n\nTwo loose ends still open here in Compass: the phase creation and `/kbd-analyze` on the partitioning question, plus the two unpushed commits on `docs/claude-md` and the untracked `.kbd-orchestrator/`. Since `kbd-analyze`'s `SKILL.md` is byte-identical between 1.6.2 and 1.7.0, running it now carries no version risk if you want to keep moving.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:22:19.272736Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- AGENTS.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T11:24:40.030753Z",
+      "updated_at": "2026-08-09T11:24:40.030753Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-19802b94100a3ab3",
+      "title": "Karpathy session 19802b94100a",
+      "content": "## Delta\n\nCompleted kbd-assess — compass-scoping-and-bounds (step 0 of 0)\n\n## Answer: no, don't add scoping — it already exists and works\n\n**I need to correct my previous turn.** I told you the default ignore policy was missing `node_modules/`, `target/`, and `compass-out/`. That was wrong, and it was the premise of my whole recommendation. Reading the source disproves it:\n\n- All three are in `SKIP_DIRS` — ~40 entries at `crates/compass-files/src/detect.rs:61-102`\n- Gitignore respect defaults to `true` (`detect.rs:163`)\n- `.compassignore` is supported (`detect.rs:390`)\n- `--include`/`--exclude` already exist (`init_commands.rs:438-462`)\n\nBuilding scoping would have duplicated shipped functionality. That's the finding that changes the recommendation, and it came from checking the code rather than trusting my own earlier hypothesis.\n\n**What actually happened:** the exclusions fired correctly. That repo just has **9,320 in-scope markdown files — 4,827 under `crates/` alone**. The 19,666 matched files are real content, not leaked junk. This is a genuine capacity limit.\n\n**Research corroborates that Compass is already at or above baseline.** Firecrawl across `ck`, `codegraphcontext`, `.cursorignore`, ripgrep, and a formatter comparative study: respect `.gitignore` by default (\"the single highest-value default\"), ship hardcoded defaults, offer a tool-specific ignore file. Compass does all three, with a *larger* default list than the tools surveyed.\n\n**The real defects, in order:**\n\n| Pri | Defect |\n|---|---|\n| 1 | `COMPASS_MAX_GRAPH_BYTES` is honored in `compass-model`, `-output`, `-global`, `-core` — and their errors advertise it — but **not** on the snapshot path that actually failed. You hit a limit the rest of the product treats as adjustable, with no override. |\n| 2 | The error names a fact and stops — no override, no `--exclude` hint, no indication of what dominated the graph. |\n| 3 | Fails at 331 s after all work completes, then discards it. |\n| 4 | `vendor/` isn't skipped — but that needs a decision, not a reflex; Go monorepos and Compass's own tree legitimately use it. |\n\n**Two things I won't paper over:**\n\n- **My suggested `--exclude` workaround is untested and may not work.** With 4,827 markdown files under `crates/` — which you can't exclude without gutting the graph — it may still blow the cap.\n- **I'd resist raising the 2 GiB limit.** AGENTS.md is explicit that bounded work is an invariant and a limit error is distinct from an empty result. Grant an explicit opt-in override instead — which matches ripgrep's maintainer position that a paired explicit flag beats changing defaults.\n\n**Open architecture question for `/kbd-analyze`:** if a repo this size can't publish under 2 GiB even with sane exclusions, the answer may be graph partitioning rather than a bigger number. That should be settled before any code is written.\n\nAssessment written to `.kbd-orchestrator/phases/compass-scoping-and-bounds/assessment.md`. Note the phase is provisional — I didn't run `/kbd-new-phase`, so `active_phase` is still `null` and there's no `progress.json` (hence \"step 0 of 0\"). Say the word and I'll create it properly, or rename it.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:11:29.936317Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T11:11:30.692085Z",
+      "updated_at": "2026-08-09T11:11:30.692085Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-199d5165acd78a00",
+      "title": "Karpathy session 199d5165acd7",
+      "content": "## Delta\n\nCreated `CLAUDE.md` at the repo root.\n\nSince `AGENTS.md` is already a thorough agent guide, I wrote CLAUDE.md to defer to it rather than duplicate it, and concentrated on what it leaves implicit:\n\n**What's in it:**\n- **`CARGO_TARGET_DIR` requirement** — surfaced up top, since it must be set on every compiling invocation and is the easiest thing to get wrong. I also flagged the conflict where some Makefile targets (`install`, `dist`, `release-check`) resolve binaries through a literal `target/` path, which AGENTS.md mentions but doesn't tie to specific targets.\n- **Commands** — narrow-loop test/clippy per crate and per integration file, the workspace baseline, the surface-specific gates (product boundary, CompassQL TCK, code-graph qualification), and the npm workspace commands. Noted that `make test` is `--lib --bins` only while `make test-all` needs Python oracle setup.\n- **Architecture** — the piece that genuinely requires reading multiple files: the one-directional flow `compass-files → compass-languages → compass-resolve → compass-graph → compass-model`, orchestrated by `compass-core`. I emphasized the boundary that's easiest to violate — per-file extractors emit evidence and never resolve targets needing project-wide facts. Also the `compass-cypher` (syntax) vs `compass-query` (execution) split, immutable history realizations, and the generated viewer assets round-trip.\n- **Enforced constraints** — the lint set, determinism as correctness, boundedness (limit error ≠ empty result), and reuse of existing safe primitives.\n\nTwo notes on judgment calls: I skipped enumerating individual crates beyond the pipeline ones, since `docs/implementation/workspace-tour.md` already does that well and I pointed at it instead. I also didn't import anything from a Codex or Gemini config — I didn't check for those, as the instruction is to offer rather than read them. If you have an OpenAI Codex or Gemini CLI config you'd like folded in, reply `/import` and it'll scan and list what's importable.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:34:13.627630Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n- CLAUDE.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T10:34:32.153219Z",
+      "updated_at": "2026-08-09T10:34:32.153219Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-309fba26769d26dc",
+      "title": "Karpathy session 309fba26769d",
+      "content": "## Delta\n\nHere's a self-contained prompt for a session in the skill-pack repo. It's written to be safe alongside concurrent work — it assumes nothing about the working tree and stops rather than overwriting.\n\n````markdown\n# Fix: `update-skill-pack.sh` fails release payload verification, blocking 1.7.0 install\n\n## Context\n\nRepo: `/Users/gqadonis/Projects/prometheus/prometheus-skill-pack`\n(remote `git@github.com:Prometheus-AGS/prometheus-skill-system.git`)\n\n`bash scripts/update-skill-pack.sh` fails at step 2 and no new generation is\ninstalled:\n\n```\nStep 2: Building and verifying immutable generation...\ninstall-plugin-generation: release payload verification failed for shared/scripts/detect-toolchain.sh\n```\n\nConsequence: `~/.prometheus/plugins/prometheus-skill-pack/current` is pinned to\nan older generation. `~/.prometheus/skill-pack-install-ref` records `dfdd8be`\nwhile `main` is at `6e46758` (`v1.7.0-12-g6e46758`). Consumers of the pack are\nrunning stale skills; `kbd-execute/SKILL.md`, `kbd-spec/SKILL.md`, and\n`references/integrations/adversarial-review.md` are known to differ between\nsource and the last-installed generation.\n\n## What has already been established (verify, don't assume)\n\n1. `shared/harnesses/generated/release-manifest.json` was stale. Commit\n   `3c31581` (\"fix: stop reporting and restarting healthy forge-mcp and\n   sovereign-sync\") modified `shared/scripts/detect-toolchain.sh` and\n   `shared/scripts/service-probe.sh` **without regenerating the manifest**.\n   The manifest recorded pre-fix sha256 values for both. File modes were\n   correct (`0755`); only content hashes were wrong. 2 of 61 `runtimeFiles`\n   entries affected.\n\n2. Running `node scripts/generate-harness-adapters.js` rebuilt the manifest and\n   brought it to 0/61 stale (verified by re-hashing every entry against disk).\n\n3. **The install still fails with the identical error after that fix.** This is\n   the open problem.\n\n## Root-cause hypothesis to confirm or refute\n\n`verifyReleaseManifest(payloadRoot, ...)` in `scripts/install-plugin-generation.js`\n(~line 642) reads the manifest from `payloadRoot`, **not** from the source\ncheckout:\n\n```js\nconst manifestPath = path.join(payloadRoot, 'shared/harnesses/generated/release-manifest.json');\n```\n\nSo a corrected manifest in the working tree may not be what is verified. Trace\nhow `payloadRoot` is derived and where the staged payload originates. Candidate\nexplanations, in the order worth testing:\n\n- the payload is staged from `git archive`/HEAD rather than the working tree, so\n  the regenerated (uncommitted) manifest never reaches `payloadRoot`;\n- the payload is copied to a temp/staging dir that is cached or reused between\n  runs and was not invalidated;\n- `bundleId` is recomputed over `identity` and must also match `expectedBundle`\n  threaded in from elsewhere (note `generate-harness-adapters.js` printed\n  `Generated bundle 75cdf7e0df7f31a5ef319dd5580e7c852371546b6b8f0bbcad9b8c787b9586f3`);\n- two manifests exist and a different one wins at verification time.\n\nConfirm which by instrumenting or reading the code — do not guess and patch.\n\nIf the payload is staged from HEAD, the corrected manifest **must be committed**\nbefore the install can succeed. That is likely the actual fix, and it means the\nregeneration alone is insufficient.\n\n## Constraints — read before touching anything\n\n- **Concurrent work is in progress in this repo. Do not overwrite, revert, stash,\n  reset, checkout over, or clean anyone else's changes.**\n- At the time of investigation the working tree had these **pre-existing\n  uncommitted** changes, unrelated to this fix (mtimes predate the regeneration\n  run — `kbd-init/SKILL.md` was modified 06:19 today). Treat any of these you\n  find as someone else's in-flight work:\n\n  ```\n   M hooks/codex-hooks.json\n   M hooks/hooks.json\n   M scripts/test-skills.js\n   M shared/harnesses/generated/claude-hooks.json\n   M shared/harnesses/generated/release-manifest.json\n   M skills/process/kbd-process-orchestrator/references/co\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:22:15.521460Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- AGENTS.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T11:22:20.607957Z",
+      "updated_at": "2026-08-09T11:22:20.607957Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-3383d6fb52bb5dce",
+      "title": "Karpathy session 3383d6fb52bb",
+      "content": "## Delta\n\nCompleted kbd-analyze — compass-scoping-and-bounds (step 0 of 0)\n\n## Answer: don't shard — and don't build partitioning either, because it already exists\n\nTwo findings changed the picture, both from reading the code rather than reasoning about it.\n\n**1. `PartitionedGraph` already exists.** `compass-history/src/artifacts.rs:76-84` has full record-class partitioning — nodes, edges, hyperedges, analysis, metadata, program facts/summaries — with `partition()`, `into_partition()`, and `reconstruct()`. A grep for it outside `compass-history` returns nothing. The current-graph path doesn't use it. So the real question isn't \"should we build partitioning\" but \"why does `compass init` serialize one monolithic document when the mechanism sits in the next crate over?\"\n\n**2. The 2 GiB cap protects against a problem the docs deny exists.** `compass-store/src/lib.rs:44-51` justifies the limit by saying the store serves records \"through indexed scans instead of materializing the whole document.\" But `load_active_snapshot` at lines 838-853 does this:\n\n```rust\nlet capacity = usize::try_from(manifest.payload_bytes).unwrap_or(MAX_GRAPH_BYTES);\nlet mut bytes = Vec::with_capacity(capacity);\nfor index in 0..manifest.chunk_count {\n    bytes.extend_from_slice(&chunk.value);\n```\n\nIt pre-allocates the full payload and concatenates every chunk. Chunking bounds each *stored value*, not the reconstruction. Meanwhile the **write** path genuinely streams via `DigestWriter`. The asymmetry matters: the cap isn't protecting the writer, it's protecting the reader — the opposite of what the comment claims.\n\n**This produces a hard sequencing constraint.** Honoring `COMPASS_MAX_GRAPH_BYTES` on the publication path (G1, the obvious fix) **must not land first**. Raising the cap today raises a real allocation — an override would let someone request a multi-gigabyte contiguous `Vec`, which is a worse failure than today's clean error. Stream the read path first.\n\n**Research backed the direction unanimously.** Sharding targets multi-machine scaling; Compass is local-first single-process. Citus notes graph sharding brings eventual consistency, which the determinism invariant forbids outright. Azure's criteria (data exceeds single-instance capacity, vertical scaling exhausted) don't apply. Notably, the existing `PartitionedGraph` partitions by *record class, not topology* — sidestepping the edge-cut problem the literature flags as graph partitioning's hardest part.\n\n**Recommended order:** stream `load_active_snapshot` → actionable error (G2) → pre-flight estimate (G3) → *then* the override (G1) → `vendor/` policy (G4). Items 2, 3, 5 are independent and can run in parallel.\n\n**Where I'd temper confidence:** direction is well-supported, but three of four open questions are unmeasured — no consumer audit of `load_active_snapshot`, no measurement of what dominates the 2 GiB, and my `--exclude` workaround from earlier is *still untested* and may not fit under the cap given 4,827 markdown files under `crates/`. Sizing this work would be guesswork right now.\n\n**One architecture decision blocks the partitioning route:** `PartitionedGraph` lives in `compass-history`, but AGENTS.md routes current-graph publication to `compass-graph`. Shared crate, duplicate with distinct identity semantics, or new dependency? That needs your call before anyone touches item 6.\n\nPhase is now live — `active_phase` set, waypoint at `analysis_ready`, next command `/kbd-spec`. Files written: `goals.md`, `analysis.md`, `library-candidates.json`, `decision-log.md`, `handoffs/analyze.md`.\n\nStill unpushed: the two commits on `docs/claude-md` plus all of `.kbd-orchestrator/` untracked.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T12:05:00.281326Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- AGENTS.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-15a46a623cf0e420.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-7c287ce9b2192bd7.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T12:05:01.652519Z",
+      "updated_at": "2026-08-09T12:05:01.652519Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-6aacc8d765a1b28f",
+      "title": "Karpathy session 6aacc8d765a1",
+      "content": "## Delta\n\nCompleted kbd-init — Compass\n\nTwo files written to `.kbd-orchestrator/`:\n\n**`project.json`** — discovery results:\n\n| Field | Value | Source |\n|---|---|---|\n| name / description | Compass — \"Native local-first knowledge graph engine…\" | `Cargo.toml` `[workspace.package]` |\n| stack | Rust (Edition 2024, pinned 1.97.1) | `Cargo.toml` + `rust-toolchain.toml` |\n| spec_paths | `openspec/specs/*.md` | `openspec/` exists (just initialized, currently empty) |\n| openspec_available | `true` | — |\n| workspace | single-project (`workspace_file: null`) | no `.code-workspace` references compass |\n| planning / execution agents | `claude` / `claude, codex, opencode` | the tools we just configured |\n| active_phase | `null` | no phase defined yet |\n\n**`constraints.md`** — I did **not** use the template's defaults. Those are TypeScript-oriented (`no-console-log`, `no-any-type`, `grep src/`) and would be inert in a Rust workspace with no `src/` at root. Instead I derived constraints from AGENTS.md: 16 blocking (unsafe/unwrap/expect/panic lints, product boundary vs. Graphify, local-first preservation, determinism, boundedness, immutable realizations, viewer-asset generation) and 17 warning (ownership boundary, extractor/resolver separation, compatibility documentation, the CompassQL and code-graph gates).\n\n**One thing needs your attention before any KBD phase runs a command:**\n\n`/Volumes/Workspace` **is not currently mounted** — only `Macintosh HD`, `my-passport`, and `Open Design` are. Every build/test/lint command in `project.json` sets `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main`, per the AGENTS.md mandate. As written, they'll fail until that volume is attached — which is the correct behavior, since AGENTS.md says to stop and report rather than fall back to a local `target/` on the 100 GB-capped main disk. I encoded the rule faithfully rather than silently substituting a working-but-wrong path.\n\nAlso worth noting: `openspec/specs/` is empty, so `spec_paths` currently resolves to nothing. That's expected for a fresh init — specs appear once you run `/opsx:new`.\n\nThese two files are untracked and uncommitted, separate from the two commits already on `docs/claude-md`. Next step is `/kbd-status` to confirm, then `/kbd-new-phase <name>` to start the first phase.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:58:32.187142Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T11:01:48.963380Z",
+      "updated_at": "2026-08-09T11:01:48.963380Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-7521e456ead1ce12",
+      "title": "Karpathy session 7521e456ead1",
+      "content": "## Delta\n\nBoth done.\n\n**Deleted the local sccache** — `~/Library/Caches/Mozilla.sccache` (10 GB) is gone and has not been recreated. Verified safe first: the live sccache server was serving `/Volumes/my-passport/sccache`, and the local dir had zero writes in the preceding 5 minutes even with an active build running.\n\n**Set `SCCACHE_DIR` in `~/.cargo/config.toml`** — added an `[env]` block pinning `SCCACHE_DIR = \"/Volumes/my-passport/sccache\"` and `SCCACHE_CACHE_SIZE = \"40G\"`, with a comment explaining the failure mode so it isn't re-litigated later. Config parses cleanly.\n\nI deliberately left off `force = true`: your `.zshrc` exports the identical value so there's no conflict, and staying unforced keeps one-off `SCCACHE_DIR=... cargo build` overrides working. Cargo's `[env]` applies to every invocation, so the non-login shells that previously bypassed the `.zshrc` guard now get the WDD path.\n\nFree space went 367 → 373 GiB. It reads lower than the raw 10 GB because an unrelated Rust build is running concurrently and consuming space as it compiles.\n\nTwo caveats worth stating plainly:\n\n- **My verification of the config was static, not functional.** I tried a real build to prove `SCCACHE_DIR` reaches a compiler process, but it hung — it inherited your `rustc-wrapper` and queued behind that concurrent surrealdb build saturating all 10 job slots. I killed and cleaned it up. So I confirmed the file parses with the right values, not that a build observes them end-to-end. Cargo `[env]` semantics are well-defined here, but if you want proof, run any build once the current one finishes and check `sccache --show-stats` still reports the WDD location.\n- **`[env]` doesn't cover non-cargo callers.** Anything invoking `sccache` directly — some CMake/C++ paths, for instance — still relies on the shell export. Your `.zshrc` handles login shells; a stray non-login shell could in principle recreate the default dir. Worth a periodic `du -sh ~/Library/Caches/Mozilla.sccache` to catch it early.\n\nThere's also a **stale comment** at line 12 of the config saying \"warm 12 GB cache on the WDD\" — the actual max is 40 GB. I left it alone since it's outside what you asked for, but I can fix it if you want.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 34d4343f-8edd-46e9-bb53-90b588e5d3ed\n- Captured: 2026-08-09T05:36:52.482414Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:34d4343f-8edd-46e9-bb53-90b588e5d3ed"
+      ],
+      "created_at": "2026-08-09T05:36:58.206699Z",
+      "updated_at": "2026-08-09T05:36:58.206699Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-762f04f1710fc991",
+      "title": "Karpathy session 762f04f1710f",
+      "content": "## Delta\n\nCompleted kbd-init — Compass\n\nTwo files written to `.kbd-orchestrator/`:\n\n**`project.json`** — discovery results:\n\n| Field | Value | Source |\n|---|---|---|\n| name / description | Compass — \"Native local-first knowledge graph engine…\" | `Cargo.toml` `[workspace.package]` |\n| stack | Rust (Edition 2024, pinned 1.97.1) | `Cargo.toml` + `rust-toolchain.toml` |\n| spec_paths | `openspec/specs/*.md` | `openspec/` exists (just initialized, currently empty) |\n| openspec_available | `true` | — |\n| workspace | single-project (`workspace_file: null`) | no `.code-workspace` references compass |\n| planning / execution agents | `claude` / `claude, codex, opencode` | the tools we just configured |\n| active_phase | `null` | no phase defined yet |\n\n**`constraints.md`** — I did **not** use the template's defaults. Those are TypeScript-oriented (`no-console-log`, `no-any-type`, `grep src/`) and would be inert in a Rust workspace with no `src/` at root. Instead I derived constraints from AGENTS.md: 16 blocking (unsafe/unwrap/expect/panic lints, product boundary vs. Graphify, local-first preservation, determinism, boundedness, immutable realizations, viewer-asset generation) and 17 warning (ownership boundary, extractor/resolver separation, compatibility documentation, the CompassQL and code-graph gates).\n\n**One thing needs your attention before any KBD phase runs a command:**\n\n`/Volumes/Workspace` **is not currently mounted** — only `Macintosh HD`, `my-passport`, and `Open Design` are. Every build/test/lint command in `project.json` sets `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main`, per the AGENTS.md mandate. As written, they'll fail until that volume is attached — which is the correct behavior, since AGENTS.md says to stop and report rather than fall back to a local `target/` on the 100 GB-capped main disk. I encoded the rule faithfully rather than silently substituting a working-but-wrong path.\n\nAlso worth noting: `openspec/specs/` is empty, so `spec_paths` currently resolves to nothing. That's expected for a fresh init — specs appear once you run `/opsx:new`.\n\nThese two files are untracked and uncommitted, separate from the two commits already on `docs/claude-md`. Next step is `/kbd-status` to confirm, then `/kbd-new-phase <name>` to start the first phase.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:01:46.520733Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T11:01:52.216303Z",
+      "updated_at": "2026-08-09T11:01:52.216303Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-7c287ce9b2192bd7",
+      "title": "Karpathy session 7c287ce9b219",
+      "content": "## Delta\n\nWritten to `/Users/gqadonis/Projects/prometheus/prometheus-skill-pack/docs/UPDATE_CONSIDERATIONS.md`.\n\nIt's structured as a handoff brief rather than the bare prompt — the same content, but organized so someone landing cold can act on it:\n\n- **Symptom + consequence** — the error, and the concrete drift it causes (`kbd-execute`, `kbd-spec`, `adversarial-review.md`), with the install-ref vs HEAD mismatch.\n- **Established by direct verification** — the three things I actually proved, with the hash evidence showing the manifest was wrong and the file was right.\n- **Open hypothesis** — `payloadRoot`, with four ranked candidates and an explicit instruction not to guess-and-patch. The likeliest answer (payload stages from HEAD → manifest must be committed) is called out as *structurally* meaning regeneration alone can't work.\n- **Constraints** — the concurrency guardrails, including that the two tree snapshots I took minutes apart already differed, so the listed file set is indicative only.\n- **Definition of done** — six checkable conditions, the last being that in-flight work survives untouched.\n- **Secondary defect** — the broken `.claude/skills` symlink, framed as arguably higher impact since it's the mechanism that let the staleness go unnoticed.\n- **Preventive follow-up** — proposal only, pointing at `check-harness-adapters.js` as the likely existing-but-unenforced check.\n\nI only created that one new file; nothing else in the repo was touched. Note the working tree there has kept growing — `kbd-init` workflow files across five harness surfaces are now modified — so that document is deliberately written to assume its own file list is stale.\n\nTwo loose ends still open here in Compass: the phase creation and `/kbd-analyze` on the partitioning question, plus the two unpushed commits on `docs/claude-md` and the untracked `.kbd-orchestrator/`. Since `kbd-analyze`'s `SKILL.md` is byte-identical between 1.6.2 and 1.7.0, running it now carries no version risk if you want to keep moving.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:24:38.852780Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- AGENTS.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-15a46a623cf0e420.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T11:24:40.732045Z",
+      "updated_at": "2026-08-09T11:24:40.732045Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-85be47bbe3d4faec",
+      "title": "Karpathy session 85be47bbe3d4",
+      "content": "## Delta\n\nFixed. The only remaining \"12 GB\" match is inside my new comment, where it's describing the past drift rather than claiming a current value.\n\nThe comment now points to `SCCACHE_CACHE_SIZE` in `[env]` instead of restating the number — a single source of truth, so it can't go stale again the way it just did. Config parses cleanly, and the declared `40G` matches what the live server actually reports (40 GiB max, on the WDD).\n\nThat closes out all three items: release build installed as `compass 0.3.6`, ~10.1 GB reclaimed locally, and the sccache config corrected so the internal disk stops accumulating cache.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 34d4343f-8edd-46e9-bb53-90b588e5d3ed\n- Captured: 2026-08-09T05:36:56.574046Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:34d4343f-8edd-46e9-bb53-90b588e5d3ed"
+      ],
+      "created_at": "2026-08-09T05:39:57.963184Z",
+      "updated_at": "2026-08-09T05:39:57.963184Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-8b2e071dd73e1374",
+      "title": "Karpathy session 8b2e071dd73e",
+      "content": "## Delta\n\nI've traced it. Here's what's actually going on — and part of it contradicts the premise.\n\n## Why 1.6.2 is resolving\n\n**1.7.0 was never installed.** The cache holds only `1.6.0`, `1.6.1`, `1.6.2`. Your source repo at `/Users/gqadonis/Projects/prometheus/prometheus-skill-pack` is tagged `v1.7.0` (12 commits past it, working tree clean), but that was never published into the plugin cache. The newest cache dir is dated Aug 3; the `.prometheus` generation is Aug 5. The tag exists locally and nowhere else.\n\nThere's also a **second, unrelated breakage**: `~/.claude/skills/kbd-init` symlinks to `~/.prometheus/plugins/prometheus-skill-pack/current/skills/process/kbd-process-orchestrator/skills/kbd-init` — a path that doesn't resolve. That's why I fell back to the cache at the start of this session. Two different install roots (`.claude/plugins/cache` and `.prometheus/plugins/generations`), and the symlink points into the one that's broken.\n\n## But the premise doesn't hold for this work\n\nI diffed the source tree against 1.6.2 directly. **The entire `kbd-process-orchestrator` differs in exactly three files:**\n\n| File | Status |\n|---|---|\n| `references/integrations/adversarial-review.md` | differs |\n| `skills/kbd-execute/SKILL.md` | differs |\n| `skills/kbd-spec/SKILL.md` | differs |\n\nEverything else is byte-identical. Specifically:\n\n- **`kbd-analyze` exists in 1.6.2 and its `SKILL.md` is identical to 1.7.0.** My earlier \"no analyze.md\" observation was about the `prompts/` directory — and `prompts/` has no `analyze.md` in **1.7.0 either**. `kbd-analyze` is driven by its `SKILL.md`, not a prompt file. That's not a version gap; I misread it.\n- `kbd-assess/SKILL.md`, `kbd-init/SKILL.md`, `kbd-new-phase/SKILL.md`, `prompts/assess.md`, `project.template.json`, and the adversarial-review preflight script are all **identical** between source and 1.6.2.\n\nSo the `/kbd-init` and `/kbd-assess` runs already completed used the same bytes 1.7.0 would have. No rework needed there.\n\nThe three drifted files matter for `/kbd-execute` and `/kbd-spec` — stages we haven't reached.\n\n## Your call\n\nI can't publish 1.7.0 into the plugin cache myself — that's your packaging pipeline, and I don't know its publish command. Options:\n\n1. **Publish 1.7.0 properly** — you run the pack's install/publish step; I re-verify and continue. Cleanest, and fixes the broken `~/.claude/skills` symlink if the installer rewrites it.\n2. **Continue on 1.6.2 for analyze** — legitimate here, since `kbd-analyze` is byte-identical. Then upgrade before `/kbd-spec` or `/kbd-execute`, where the drift is real.\n3. **Point the KBD skills at the source tree directly** for this session.\n\nI'd suggest **1**, since the symlink is broken regardless and will keep biting. But **2** is defensible if you want to keep moving on the partitioning question now — the risk is genuinely zero for the analyze stage.\n\nWhich way?\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:14:51.722543Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T11:14:53.968282Z",
+      "updated_at": "2026-08-09T11:14:53.968282Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-8f202396ae5617a5",
+      "title": "Karpathy session 8f202396ae56",
+      "content": "## Delta\n\nThe `kbd-init` mtime is 06:19 today — well before this session's regeneration. Those were already-pending working-tree changes, not collateral from my run. Retrying the install:\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:14:56.866886Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T11:20:15.494977Z",
+      "updated_at": "2026-08-09T11:20:15.494977Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-9354b74ff25823d0",
+      "title": "Karpathy session 9354b74ff258",
+      "content": "## Delta\n\nThat's the real cause: 9,320 in-scope markdown files, with **4,827 in `crates/`** alone. This is genuine content at genuine scale, not junk. Let me write the assessment.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:05:46.513453Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T11:10:48.901378Z",
+      "updated_at": "2026-08-09T11:10:48.901378Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-95e26dce31a612a2",
+      "title": "Karpathy session 95e26dce31a6",
+      "content": "## Delta\n\nFixed. The only remaining \"12 GB\" match is inside my new comment, where it's describing the past drift rather than claiming a current value.\n\nThe comment now points to `SCCACHE_CACHE_SIZE` in `[env]` instead of restating the number — a single source of truth, so it can't go stale again the way it just did. Config parses cleanly, and the declared `40G` matches what the live server actually reports (40 GiB max, on the WDD).\n\nThat closes out all three items: release build installed as `compass 0.3.6`, ~10.1 GB reclaimed locally, and the sccache config corrected so the internal disk stops accumulating cache.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 34d4343f-8edd-46e9-bb53-90b588e5d3ed\n- Captured: 2026-08-09T05:38:38.245900Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:34d4343f-8edd-46e9-bb53-90b588e5d3ed"
+      ],
+      "created_at": "2026-08-09T05:41:46.141746Z",
+      "updated_at": "2026-08-09T05:41:46.141746Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-a0b489beb0d312d9",
+      "title": "Karpathy session a0b489beb0d3",
+      "content": "## Delta\n\nCommitted as `dd7679fb` on a new branch `docs/claude-md` (1 file, 212 insertions).\n\nTwo things worth flagging:\n\n- **I branched off `main` rather than committing directly to it**, per the repo's git conventions. Say the word if you'd rather this land on `main` directly.\n- **`.prometheus/` was left untracked** — it looked like local tooling state, not part of this change, and AGENTS.md explicitly says not to commit local state directories. Let me know if it's actually meant to be tracked.\n\nNothing is pushed yet. I can push and open a PR if you want.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:52:26.193194Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T10:52:30.420142Z",
+      "updated_at": "2026-08-09T10:52:30.420142Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-b0a4e7ceb012e58d",
+      "title": "Karpathy session b0a4e7ceb012",
+      "content": "## Delta\n\nCompleted kbd-init — Compass\n\nTwo files written to `.kbd-orchestrator/`:\n\n**`project.json`** — discovery results:\n\n| Field | Value | Source |\n|---|---|---|\n| name / description | Compass — \"Native local-first knowledge graph engine…\" | `Cargo.toml` `[workspace.package]` |\n| stack | Rust (Edition 2024, pinned 1.97.1) | `Cargo.toml` + `rust-toolchain.toml` |\n| spec_paths | `openspec/specs/*.md` | `openspec/` exists (just initialized, currently empty) |\n| openspec_available | `true` | — |\n| workspace | single-project (`workspace_file: null`) | no `.code-workspace` references compass |\n| planning / execution agents | `claude` / `claude, codex, opencode` | the tools we just configured |\n| active_phase | `null` | no phase defined yet |\n\n**`constraints.md`** — I did **not** use the template's defaults. Those are TypeScript-oriented (`no-console-log`, `no-any-type`, `grep src/`) and would be inert in a Rust workspace with no `src/` at root. Instead I derived constraints from AGENTS.md: 16 blocking (unsafe/unwrap/expect/panic lints, product boundary vs. Graphify, local-first preservation, determinism, boundedness, immutable realizations, viewer-asset generation) and 17 warning (ownership boundary, extractor/resolver separation, compatibility documentation, the CompassQL and code-graph gates).\n\n**One thing needs your attention before any KBD phase runs a command:**\n\n`/Volumes/Workspace` **is not currently mounted** — only `Macintosh HD`, `my-passport`, and `Open Design` are. Every build/test/lint command in `project.json` sets `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main`, per the AGENTS.md mandate. As written, they'll fail until that volume is attached — which is the correct behavior, since AGENTS.md says to stop and report rather than fall back to a local `target/` on the 100 GB-capped main disk. I encoded the rule faithfully rather than silently substituting a working-but-wrong path.\n\nAlso worth noting: `openspec/specs/` is empty, so `spec_paths` currently resolves to nothing. That's expected for a fresh init — specs appear once you run `/opsx:new`.\n\nThese two files are untracked and uncommitted, separate from the two commits already on `docs/claude-md`. Next step is `/kbd-status` to confirm, then `/kbd-new-phase <name>` to start the first phase.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:55:59.021325Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T10:58:30.244136Z",
+      "updated_at": "2026-08-09T10:58:30.244136Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-b5d49ca1d46e60a2",
+      "title": "Karpathy session b5d49ca1d46e",
+      "content": "## Delta\n\nBoth commits are on `docs/claude-md`:\n\n| Commit | Contents |\n|---|---|\n| `dd7679fb` | `docs: add CLAUDE.md agent guide` — 1 file |\n| `c349fdf6` | `chore: track Prometheus wiki and initialize OpenSpec` — 73 files, 12,227 insertions |\n\n**What landed:**\n- **`.prometheus/knowledge/wiki/`** — all 12 files tracked as-is, per your call.\n- **OpenSpec** initialized with `schema: spec-driven`, generating `.claude/`, `.codex/`, `.kimi/`, `.opencode/` plus `openspec/config.yaml`.\n\n**Three things to know:**\n\n1. **Zed got nothing.** It isn't a supported `openspec init` target, so there's no generated config for it. If you use Zed here, that gap is still open — I can hand-write a rules file, but it'd be unofficial and liable to drift from openspec's format.\n\n2. **Kimi has skills but no commands.** OpenSpec reported \"Commands skipped for: kimi (no adapter)\" — it got 10 skill files, no `/opsx:*` slash commands. Claude, Codex, and OpenCode got both.\n\n3. **`.claude/settings.local.json` stayed untracked.** It's your personal permission allowlist with machine-specific paths, and your global gitignore already excludes it — so it was never at risk of being committed.\n\n`openspec/config.yaml` is currently all commented-out scaffolding. Its `context:` field feeds project background to AI tools when creating artifacts, and this repo has strong conventions worth putting there (local-first Rust, no-unwrap/expect/panic lints, determinism requirements, the `CARGO_TARGET_DIR` rule). Want me to fill it in?\n\nNothing is pushed yet. Say the word and I'll push and open a PR.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:52:28.835309Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- No changed paths detected.\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T10:56:00.254334Z",
+      "updated_at": "2026-08-09T10:56:00.254334Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-b6f086fb31ed31c5",
+      "title": "Karpathy session b6f086fb31ed",
+      "content": "## Delta\n\nBoth commits are on `docs/claude-md`:\n\n| Commit | Contents |\n|---|---|\n| `dd7679fb` | `docs: add CLAUDE.md agent guide` — 1 file |\n| `c349fdf6` | `chore: track Prometheus wiki and initialize OpenSpec` — 73 files, 12,227 insertions |\n\n**What landed:**\n- **`.prometheus/knowledge/wiki/`** — all 12 files tracked as-is, per your call.\n- **OpenSpec** initialized with `schema: spec-driven`, generating `.claude/`, `.codex/`, `.kimi/`, `.opencode/` plus `openspec/config.yaml`.\n\n**Three things to know:**\n\n1. **Zed got nothing.** It isn't a supported `openspec init` target, so there's no generated config for it. If you use Zed here, that gap is still open — I can hand-write a rules file, but it'd be unofficial and liable to drift from openspec's format.\n\n2. **Kimi has skills but no commands.** OpenSpec reported \"Commands skipped for: kimi (no adapter)\" — it got 10 skill files, no `/opsx:*` slash commands. Claude, Codex, and OpenCode got both.\n\n3. **`.claude/settings.local.json` stayed untracked.** It's your personal permission allowlist with machine-specific paths, and your global gitignore already excludes it — so it was never at risk of being committed.\n\n`openspec/config.yaml` is currently all commented-out scaffolding. Its `context:` field feeds project background to AI tools when creating artifacts, and this repo has strong conventions worth putting there (local-first Rust, no-unwrap/expect/panic lints, determinism requirements, the `CARGO_TARGET_DIR` rule). Want me to fill it in?\n\nNothing is pushed yet. Say the word and I'll push and open a PR.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:55:56.151200Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T10:56:01.152228Z",
+      "updated_at": "2026-08-09T10:56:01.152228Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-bb64c62e88af6029",
+      "title": "Karpathy session bb64c62e88af",
+      "content": "## Delta\n\nCreated `CLAUDE.md` at the repo root.\n\nSince `AGENTS.md` is already a thorough agent guide, I wrote CLAUDE.md to defer to it rather than duplicate it, and concentrated on what it leaves implicit:\n\n**What's in it:**\n- **`CARGO_TARGET_DIR` requirement** — surfaced up top, since it must be set on every compiling invocation and is the easiest thing to get wrong. I also flagged the conflict where some Makefile targets (`install`, `dist`, `release-check`) resolve binaries through a literal `target/` path, which AGENTS.md mentions but doesn't tie to specific targets.\n- **Commands** — narrow-loop test/clippy per crate and per integration file, the workspace baseline, the surface-specific gates (product boundary, CompassQL TCK, code-graph qualification), and the npm workspace commands. Noted that `make test` is `--lib --bins` only while `make test-all` needs Python oracle setup.\n- **Architecture** — the piece that genuinely requires reading multiple files: the one-directional flow `compass-files → compass-languages → compass-resolve → compass-graph → compass-model`, orchestrated by `compass-core`. I emphasized the boundary that's easiest to violate — per-file extractors emit evidence and never resolve targets needing project-wide facts. Also the `compass-cypher` (syntax) vs `compass-query` (execution) split, immutable history realizations, and the generated viewer assets round-trip.\n- **Enforced constraints** — the lint set, determinism as correctness, boundedness (limit error ≠ empty result), and reuse of existing safe primitives.\n\nTwo notes on judgment calls: I skipped enumerating individual crates beyond the pipeline ones, since `docs/implementation/workspace-tour.md` already does that well and I pointed at it instead. I also didn't import anything from a Codex or Gemini config — I didn't check for those, as the instruction is to offer rather than read them. If you have an OpenAI Codex or Gemini CLI config you'd like folded in, reply `/import` and it'll scan and list what's importable.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:37:15.181272Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n- CLAUDE.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T10:37:28.812655Z",
+      "updated_at": "2026-08-09T10:37:28.812655Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-c13ff840014cf2b3",
+      "title": "Karpathy session c13ff840014c",
+      "content": "## Delta\n\n`cargo config` needs nightly. Let me verify with a functional test instead — the stronger check anyway, since it proves the var reaches a real build process.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 34d4343f-8edd-46e9-bb53-90b588e5d3ed\n- Captured: 2026-08-09T05:20:58.608418Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- No changed paths detected.\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:34d4343f-8edd-46e9-bb53-90b588e5d3ed"
+      ],
+      "created_at": "2026-08-09T05:26:55.781482Z",
+      "updated_at": "2026-08-09T05:26:55.781482Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-f8eff00b52d5f657",
+      "title": "Karpathy session f8eff00b52d5",
+      "content": "## Delta\n\nCreated `CLAUDE.md` at the repo root.\n\nSince `AGENTS.md` is already a thorough agent guide, I wrote CLAUDE.md to defer to it rather than duplicate it, and concentrated on what it leaves implicit:\n\n**What's in it:**\n- **`CARGO_TARGET_DIR` requirement** — surfaced up top, since it must be set on every compiling invocation and is the easiest thing to get wrong. I also flagged the conflict where some Makefile targets (`install`, `dist`, `release-check`) resolve binaries through a literal `target/` path, which AGENTS.md mentions but doesn't tie to specific targets.\n- **Commands** — narrow-loop test/clippy per crate and per integration file, the workspace baseline, the surface-specific gates (product boundary, CompassQL TCK, code-graph qualification), and the npm workspace commands. Noted that `make test` is `--lib --bins` only while `make test-all` needs Python oracle setup.\n- **Architecture** — the piece that genuinely requires reading multiple files: the one-directional flow `compass-files → compass-languages → compass-resolve → compass-graph → compass-model`, orchestrated by `compass-core`. I emphasized the boundary that's easiest to violate — per-file extractors emit evidence and never resolve targets needing project-wide facts. Also the `compass-cypher` (syntax) vs `compass-query` (execution) split, immutable history realizations, and the generated viewer assets round-trip.\n- **Enforced constraints** — the lint set, determinism as correctness, boundedness (limit error ≠ empty result), and reuse of existing safe primitives.\n\nTwo notes on judgment calls: I skipped enumerating individual crates beyond the pipeline ones, since `docs/implementation/workspace-tour.md` already does that well and I pointed at it instead. I also didn't import anything from a Codex or Gemini config — I didn't check for those, as the instruction is to offer rather than read them. If you have an OpenAI Codex or Gemini CLI config you'd like folded in, reply `/import` and it'll scan and list what's importable.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:34:10.259136Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n- CLAUDE.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T10:34:18.362064Z",
+      "updated_at": "2026-08-09T10:34:18.362064Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-f90cdbd5fafd1d1d",
+      "title": "Karpathy session f90cdbd5fafd",
+      "content": "## Delta\n\nCompleted kbd-init — Compass\n\nTwo files written to `.kbd-orchestrator/`:\n\n**`project.json`** — discovery results:\n\n| Field | Value | Source |\n|---|---|---|\n| name / description | Compass — \"Native local-first knowledge graph engine…\" | `Cargo.toml` `[workspace.package]` |\n| stack | Rust (Edition 2024, pinned 1.97.1) | `Cargo.toml` + `rust-toolchain.toml` |\n| spec_paths | `openspec/specs/*.md` | `openspec/` exists (just initialized, currently empty) |\n| openspec_available | `true` | — |\n| workspace | single-project (`workspace_file: null`) | no `.code-workspace` references compass |\n| planning / execution agents | `claude` / `claude, codex, opencode` | the tools we just configured |\n| active_phase | `null` | no phase defined yet |\n\n**`constraints.md`** — I did **not** use the template's defaults. Those are TypeScript-oriented (`no-console-log`, `no-any-type`, `grep src/`) and would be inert in a Rust workspace with no `src/` at root. Instead I derived constraints from AGENTS.md: 16 blocking (unsafe/unwrap/expect/panic lints, product boundary vs. Graphify, local-first preservation, determinism, boundedness, immutable realizations, viewer-asset generation) and 17 warning (ownership boundary, extractor/resolver separation, compatibility documentation, the CompassQL and code-graph gates).\n\n**One thing needs your attention before any KBD phase runs a command:**\n\n`/Volumes/Workspace` **is not currently mounted** — only `Macintosh HD`, `my-passport`, and `Open Design` are. Every build/test/lint command in `project.json` sets `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main`, per the AGENTS.md mandate. As written, they'll fail until that volume is attached — which is the correct behavior, since AGENTS.md says to stop and report rather than fall back to a local `target/` on the 100 GB-capped main disk. I encoded the rule faithfully rather than silently substituting a working-but-wrong path.\n\nAlso worth noting: `openspec/specs/` is empty, so `spec_paths` currently resolves to nothing. That's expected for a fresh init — specs appear once you run `/opsx:new`.\n\nThese two files are untracked and uncommitted, separate from the two commits already on `docs/claude-md`. Next step is `/kbd-status` to confirm, then `/kbd-new-phase <name>` to start the first phase.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:58:29.463044Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T10:58:32.854406Z",
+      "updated_at": "2026-08-09T10:58:32.854406Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    }
+  ]
+}
diff --git a/.prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-session.md b/.prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-session.md
new file mode 100644
index 000000000..102510dd3
--- /dev/null
+++ b/.prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-session.md
@@ -0,0 +1,40 @@
+---
+type: Reference
+id: compass-scoping-and-bounds-executor-session
+title: Compass scoping and bounds executor session
+tags:
+- compass
+- executor-session
+- scoping
+- session-record
+sources:
+- stdin
+timestamp: 2026-08-09T12:09:38.087376+00:00
+created_at: 2026-08-09T12:09:38.086902+00:00
+updated_at: 2026-08-09T12:09:38.087376+00:00
+revision: 1
+---
+
+## Summary
+
+- Executor session completed for phase `compass-scoping-and-bounds`.
+- Reported change status: `unknown`.
+- No delta, root cause, changed paths, or corrective actions were captured in the raw record.
+
+## Session Record
+
+| Field | Value |
+|---|---|
+| Phase | `compass-scoping-and-bounds` |
+| Change | `unknown` |
+| Status | complete |
+
+## Handling Notes
+
+- Preserve as a minimal execution record.
+- Do not infer implementation changes, changed paths, or root cause from this capture alone.
+- Promote reusable findings only if a fuller session artifact becomes available.
+
+# Citations
+
+1. stdin
\ No newline at end of file
diff --git a/.prometheus/knowledge/wiki/index.md b/.prometheus/knowledge/wiki/index.md
index b1bf2e2e6..b2339db56 100644
--- a/.prometheus/knowledge/wiki/index.md
+++ b/.prometheus/knowledge/wiki/index.md
@@ -1,14 +1,41 @@
 # Wiki Index
 
+## Reference
+
+* [Compass scoping and bounds executor session](/compass-scoping-and-bounds-executor-session.md)
+
 ## SessionRecord
 
 * [Karpathy session 04f1f5622348](/karpathy-session-04f1f5622348cff2.md)
+* [Karpathy session 06cdf26d86b0](/karpathy-session-06cdf26d86b0c087.md)
+* [Karpathy session 0c2a62b22721](/karpathy-session-0c2a62b22721a70c.md)
 * [Karpathy session 0cf2eabc28e0](/karpathy-session-0cf2eabc28e07ef7.md)
+* [Karpathy session 1371f1270820](/karpathy-session-1371f12708207b52.md)
+* [Karpathy session 15a46a623cf0](/karpathy-session-15a46a623cf0e420.md)
+* [Karpathy session 178be089fef7](/karpathy-session-178be089fef7012d.md)
+* [Karpathy session 19802b94100a](/karpathy-session-19802b94100a3ab3.md)
 * [Karpathy session 199d5165acd7](/karpathy-session-199d5165acd78a00.md)
+* [Karpathy session 309fba26769d](/karpathy-session-309fba26769d26dc.md)
+* [Karpathy session 3383d6fb52bb](/karpathy-session-3383d6fb52bb5dce.md)
+* [Karpathy session 4301f5fbc8d2](/karpathy-session-4301f5fbc8d2baa8.md)
+* [Karpathy session 6aacc8d765a1](/karpathy-session-6aacc8d765a1b28f.md)
 * [Karpathy session 7521e456ead1](/karpathy-session-7521e456ead1ce12.md)
+* [Karpathy session 762f04f1710f](/karpathy-session-762f04f1710fc991.md)
+* [Karpathy session 7c287ce9b219](/karpathy-session-7c287ce9b2192bd7.md)
 * [Karpathy session 85be47bbe3d4](/karpathy-session-85be47bbe3d4faec.md)
+* [Karpathy session 8b2e071dd73e](/karpathy-session-8b2e071dd73e1374.md)
+* [Karpathy session 8f202396ae56](/karpathy-session-8f202396ae5617a5.md)
+* [Karpathy session 9354b74ff258](/karpathy-session-9354b74ff25823d0.md)
 * [Karpathy session 95e26dce31a6](/karpathy-session-95e26dce31a612a2.md)
 * [Karpathy session a0b489beb0d3](/karpathy-session-a0b489beb0d312d9.md)
+* [Karpathy session b0a4e7ceb012](/karpathy-session-b0a4e7ceb012e58d.md)
+* [Karpathy session b5d49ca1d46e](/karpathy-session-b5d49ca1d46e60a2.md)
+* [Karpathy session b6f086fb31ed](/karpathy-session-b6f086fb31ed31c5.md)
 * [Karpathy session bb64c62e88af](/karpathy-session-bb64c62e88af6029.md)
 * [Karpathy session c13ff840014c](/karpathy-session-c13ff840014cf2b3.md)
+* [Karpathy session ca329344b0f1](/karpathy-session-ca329344b0f175d8.md)
+* [Karpathy session cd330c925600](/karpathy-session-cd330c925600f45f.md)
+* [Karpathy session e2c00470b2ce](/karpathy-session-e2c00470b2ce9770.md)
 * [Karpathy session f8eff00b52d5](/karpathy-session-f8eff00b52d5f657.md)
+* [Karpathy session f8f9c9926623](/karpathy-session-f8f9c99266231745.md)
+* [Karpathy session f90cdbd5fafd](/karpathy-session-f90cdbd5fafd1d1d.md)
diff --git a/.prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md b/.prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md
new file mode 100644
index 000000000..16374eca3
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md
@@ -0,0 +1,85 @@
+---
+type: SessionRecord
+id: karpathy-session-06cdf26d86b0c087
+title: Karpathy session 06cdf26d86b0
+tags:
+- karpathy
+- session-learning
+sources:
+- session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+timestamp: 2026-08-09T11:14:53.644969+00:00
+created_at: 2026-08-09T11:14:53.644969+00:00
+updated_at: 2026-08-09T11:14:53.644969+00:00
+revision: 0
+---
+
+## Delta
+
+I've traced it. Here's what's actually going on — and part of it contradicts the premise.
+
+## Why 1.6.2 is resolving
+
+**1.7.0 was never installed.** The cache holds only `1.6.0`, `1.6.1`, `1.6.2`. Your source repo at `/Users/gqadonis/Projects/prometheus/prometheus-skill-pack` is tagged `v1.7.0` (12 commits past it, working tree clean), but that was never published into the plugin cache. The newest cache dir is dated Aug 3; the `.prometheus` generation is Aug 5. The tag exists locally and nowhere else.
+
+There's also a **second, unrelated breakage**: `~/.claude/skills/kbd-init` symlinks to `~/.prometheus/plugins/prometheus-skill-pack/current/skills/process/kbd-process-orchestrator/skills/kbd-init` — a path that doesn't resolve. That's why I fell back to the cache at the start of this session. Two different install roots (`.claude/plugins/cache` and `.prometheus/plugins/generations`), and the symlink points into the one that's broken.
+
+## But the premise doesn't hold for this work
+
+I diffed the source tree against 1.6.2 directly. **The entire `kbd-process-orchestrator` differs in exactly three files:**
+
+| File | Status |
+|---|---|
+| `references/integrations/adversarial-review.md` | differs |
+| `skills/kbd-execute/SKILL.md` | differs |
+| `skills/kbd-spec/SKILL.md` | differs |
+
+Everything else is byte-identical. Specifically:
+
+- **`kbd-analyze` exists in 1.6.2 and its `SKILL.md` is identical to 1.7.0.** My earlier "no analyze.md" observation was about the `prompts/` directory — and `prompts/` has no `analyze.md` in **1.7.0 either**. `kbd-analyze` is driven by its `SKILL.md`, not a prompt file. That's not a version gap; I misread it.
+- `kbd-assess/SKILL.md`, `kbd-init/SKILL.md`, `kbd-new-phase/SKILL.md`, `prompts/assess.md`, `project.template.json`, and the adversarial-review preflight script are all **identical** between source and 1.6.2.
+
+So the `/kbd-init` and `/kbd-assess` runs already completed used the same bytes 1.7.0 would have. No rework needed there.
+
+The three drifted files matter for `/kbd-execute` and `/kbd-spec` — stages we haven't reached.
+
+## Your call
+
+I can't publish 1.7.0 into the plugin cache myself — that's your packaging pipeline, and I don't know its publish command. Options:
+
+1. **Publish 1.7.0 properly** — you run the pack's install/publish step; I re-verify and continue. Cleanest, and fixes the broken `~/.claude/skills` symlink if the installer rewrites it.
+2. **Continue on 1.6.2 for analyze** — legitimate here, since `kbd-analyze` is byte-identical. Then upgrade before `/kbd-spec` or `/kbd-execute`, where the drift is real.
+3. **Point the KBD skills at the source tree directly** for this session.
+
+I'd suggest **1**, since the symlink is broken regardless and will keep biting. But **2** is defensible if you want to keep moving on the partitioning question now — the risk is genuinely zero for the analyze stage.
+
+Which way?
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+- Captured: 2026-08-09T11:11:33.611768Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .prometheus/knowledge/wiki/index.md
+- .prometheus/knowledge/wiki/log.md
+- .kbd-orchestrator/
+- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md
+- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md
+- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md
+- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md
+- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md
+- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md
+- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md
+- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md
+- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md
diff --git a/.prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md b/.prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md
new file mode 100644
index 000000000..f9dbf9c8f
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md
@@ -0,0 +1,95 @@
+---
+type: SessionRecord
+id: karpathy-session-0c2a62b22721a70c
+title: Karpathy session 0c2a62b22721
+tags:
+- karpathy
+- session-learning
+sources:
+- session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+timestamp: 2026-08-09T11:05:44.269089+00:00
+created_at: 2026-08-09T11:05:44.269089+00:00
+updated_at: 2026-08-09T11:05:44.269089+00:00
+revision: 0
+---
+
+## Delta
+
+That confirms the root cause. Here's what's happening.
+
+## Diagnosis
+
+This is **not a bug** — it's a bounded-work invariant firing correctly, but with a bad user experience. Three separate problems:
+
+**1. The scope was never actually narrowed.** Your run reported `Scope: 0 include rule(s), 0 exclude rule(s)` and matched **19,666 files**. The repo is 6.8 GB, and the walk swept in directories that have no business in a code graph:
+
+| Directory | Size |
+|---|---|
+| `node_modules/` | 1.6 GB |
+| `target/` | 821 MB |
+| `compass-out/` | 302 MB ← Compass's *own* prior output |
+| `vendor/` | 126 MB |
+
+Note the 9,679 "documents" and 508 images — that's overwhelmingly dependency and build-artifact content, not your source.
+
+**2. The 2 GiB cap has no escape hatch on this path.** `MAX_GRAPH_BYTES` (`crates/compass-store/src/lib.rs:51`) is a hard `const`. Elsewhere in the codebase — `compass-model`, `compass-output`, `compass-global`, `compass-core` — the same limit is overridable via `COMPASS_MAX_GRAPH_BYTES`, and the error messages there *tell you so*. But `compass-graph/src/snapshot.rs:3138` and `compass-store` never read that variable. So the message you got is a dead end: no override, no suggested remedy.
+
+**3. It failed after 331 seconds**, at final publication — after all extraction work was done. The limit is checked at serialization time (`digest_json`), not estimated up front.
+
+## Your immediate unblock
+
+`compass init` does support scoping — you just pressed through the prompts. Exclusions are available non-interactively:
+
+```bash
+cd /Users/gqadonis/Projects/prometheus/universal-agent-runtime
+rm -rf compass-out .compass
+compass init --exclude='node_modules/**' --exclude='target/**' \
+             --exclude='compass-out/**' --exclude='vendor/**' \
+             --exclude='website/**' --exclude='static/**' --exclude='models.dev/**'
+```
+
+That should cut the graph by well over an order of magnitude. I haven't run it, so I can't promise it lands under the cap — but the excluded directories are ~3.2 GB of the 6.8 GB, and they're the ones generating the bulk of those 9,679 documents.
+
+## The real fixes for this repo
+
+Three defects worth addressing here, in priority order:
+
+1. **Default ignore policy misses `compass-out/`, `node_modules/`, `target/`, `vendor/`.** Compass ingesting its own output directory is clearly wrong. This belongs in `compass-files::detect`.
+2. **The limit error is unactionable.** It should name the override (if one is granted on this path) and point at scoping — matching how `compass-model` and `compass-core` already word theirs.
+3. **Failing at 331 s is avoidable.** A pre-publication size estimate could fail fast, or warn during extraction.
+
+Per AGENTS.md, #1 and #3 are `compass-files`/`compass-core` work and #2 spans `compass-graph`/`compass-store`; the CLI message stays thin.
+
+Two things I want your call on before doing anything:
+
+- **Scope:** should I fix all three, or just the ignore-policy default (#1), which alone would have prevented your failure?
+- **Whether to raise the cap:** I'd advise against it. It's a deliberate bounded-work invariant, and AGENTS.md is explicit that a limit error is a distinct outcome from an empty result. Better to make the default scope sane than to let a 2 GiB graph through.
+
+Also worth noting: the two commits on `docs/claude-md` and the `.kbd-orchestrator/` files are all still uncommitted/unpushed. This fix is unrelated work — I'd put it on its own branch rather than folding it in.
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+- Captured: 2026-08-09T11:05:43.579156Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .prometheus/knowledge/wiki/index.md
+- .prometheus/knowledge/wiki/log.md
+- .kbd-orchestrator/
+- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md
+- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md
+- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md
+- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md
+- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md
+- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md
diff --git a/.prometheus/knowledge/wiki/karpathy-session-1371f12708207b52.md b/.prometheus/knowledge/wiki/karpathy-session-1371f12708207b52.md
new file mode 100644
index 000000000..c9f9e2b11
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-1371f12708207b52.md
@@ -0,0 +1,63 @@
+---
+type: SessionRecord
+id: karpathy-session-1371f12708207b52
+title: Karpathy session 1371f1270820
+tags:
+- karpathy
+- session-learning
+sources:
+- session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+timestamp: 2026-08-09T12:27:10.263975+00:00
+created_at: 2026-08-09T12:27:10.263975+00:00
+updated_at: 2026-08-09T12:27:10.263975+00:00
+revision: 0
+---
+
+## Delta
+
+Plan vetted. Now the waypoint refresh and handoff — I'll hold off emitting OpenSpec change structures pending a scope question.
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+- Captured: 2026-08-09T12:21:59.257230Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .prometheus/knowledge/wiki/index.md
+- .prometheus/knowledge/wiki/log.md
+- AGENTS.md
+- .kbd-orchestrator/
+- .prometheus/events.jsonl
+- .prometheus/knowledge/.prompt-snapshots/
+- .prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-session.md
+- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md
+- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md
+- .prometheus/knowledge/wiki/karpathy-session-15a46a623cf0e420.md
+- .prometheus/knowledge/wiki/karpathy-session-178be089fef7012d.md
+- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md
+- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md
+- .prometheus/knowledge/wiki/karpathy-session-3383d6fb52bb5dce.md
+- .prometheus/knowledge/wiki/karpathy-session-4301f5fbc8d2baa8.md
+- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md
+- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md
+- .prometheus/knowledge/wiki/karpathy-session-7c287ce9b2192bd7.md
+- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md
+- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md
+- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md
+- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md
+- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md
+- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md
+- .prometheus/knowledge/wiki/karpathy-session-cd330c925600f45f.md
+- .prometheus/knowledge/wiki/karpathy-session-f8f9c99266231745.md
+- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md
diff --git a/.prometheus/knowledge/wiki/karpathy-session-15a46a623cf0e420.md b/.prometheus/knowledge/wiki/karpathy-session-15a46a623cf0e420.md
new file mode 100644
index 000000000..8662718d1
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-15a46a623cf0e420.md
@@ -0,0 +1,67 @@
+---
+type: SessionRecord
+id: karpathy-session-15a46a623cf0e420
+title: Karpathy session 15a46a623cf0
+tags:
+- karpathy
+- session-learning
+sources:
+- session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+timestamp: 2026-08-09T11:24:40.030753+00:00
+created_at: 2026-08-09T11:24:40.030753+00:00
+updated_at: 2026-08-09T11:24:40.030753+00:00
+revision: 0
+---
+
+## Delta
+
+Written to `/Users/gqadonis/Projects/prometheus/prometheus-skill-pack/docs/UPDATE_CONSIDERATIONS.md`.
+
+It's structured as a handoff brief rather than the bare prompt — the same content, but organized so someone landing cold can act on it:
+
+- **Symptom + consequence** — the error, and the concrete drift it causes (`kbd-execute`, `kbd-spec`, `adversarial-review.md`), with the install-ref vs HEAD mismatch.
+- **Established by direct verification** — the three things I actually proved, with the hash evidence showing the manifest was wrong and the file was right.
+- **Open hypothesis** — `payloadRoot`, with four ranked candidates and an explicit instruction not to guess-and-patch. The likeliest answer (payload stages from HEAD → manifest must be committed) is called out as *structurally* meaning regeneration alone can't work.
+- **Constraints** — the concurrency guardrails, including that the two tree snapshots I took minutes apart already differed, so the listed file set is indicative only.
+- **Definition of done** — six checkable conditions, the last being that in-flight work survives untouched.
+- **Secondary defect** — the broken `.claude/skills` symlink, framed as arguably higher impact since it's the mechanism that let the staleness go unnoticed.
+- **Preventive follow-up** — proposal only, pointing at `check-harness-adapters.js` as the likely existing-but-unenforced check.
+
+I only created that one new file; nothing else in the repo was touched. Note the working tree there has kept growing — `kbd-init` workflow files across five harness surfaces are now modified — so that document is deliberately written to assume its own file list is stale.
+
+Two loose ends still open here in Compass: the phase creation and `/kbd-analyze` on the partitioning question, plus the two unpushed commits on `docs/claude-md` and the untracked `.kbd-orchestrator/`. Since `kbd-analyze`'s `SKILL.md` is byte-identical between 1.6.2 and 1.7.0, running it now carries no version risk if you want to keep moving.
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+- Captured: 2026-08-09T11:22:19.272736Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .prometheus/knowledge/wiki/index.md
+- .prometheus/knowledge/wiki/log.md
+- AGENTS.md
+- .kbd-orchestrator/
+- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md
+- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md
+- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md
+- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md
+- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md
+- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md
+- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md
+- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md
+- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md
+- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md
+- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md
+- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md
+- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md
diff --git a/.prometheus/knowledge/wiki/karpathy-session-178be089fef7012d.md b/.prometheus/knowledge/wiki/karpathy-session-178be089fef7012d.md
new file mode 100644
index 000000000..986de3511
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-178be089fef7012d.md
@@ -0,0 +1,100 @@
+---
+type: SessionRecord
+id: karpathy-session-178be089fef7012d
+title: Karpathy session 178be089fef7
+tags:
+- karpathy
+- session-learning
+sources:
+- session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+timestamp: 2026-08-09T12:09:34.902228+00:00
+created_at: 2026-08-09T12:09:34.902228+00:00
+updated_at: 2026-08-09T12:09:34.902228+00:00
+revision: 0
+---
+
+## Delta
+
+I have what I need to give you a straight answer — and it includes a correction to my own recommendation.
+
+## The doc comment tells you what this type is for
+
+```rust
+/// Deterministic typed records used to construct the five Prolly trees.
+pub struct PartitionedGraph { ... }
+```
+
+`PartitionedGraph` isn't a general-purpose partitioning abstraction. It's **the input format for Prolly tree construction** — history's immutable-storage engine. The struct body is plain `Vec<(Vec<u8>, Vec<u8>)>` and looks portable, but the meaning is history-specific.
+
+The producing logic confirms it. `into_partition` (`artifacts.rs:349-400+`) is entangled with concerns that don't exist on the current-graph path:
+
+| Dependency | Belongs to |
+|---|---|
+| `CompletionEvidence` | history realization completion |
+| `authoritative_sidecars` / `TRUSTED_GRAPH_CONTENT` | history provenance |
+| `AnalysisBundle`, `compass_ir::ProgramBundle` | `compass-analysis` / `compass-ir` |
+| `HistoryError` | history error taxonomy |
+| `prolly::{KeyBuilder, VersionedValue}` | Prolly storage |
+
+And the crate dependency sets diverge sharply. `compass-history` pulls `prolly-map`, `prolly-store-sqlite`, `compass-ir`, `compass-analysis`. `compass-graph` pulls none of those. A shared crate has to either carry that weight — forcing Prolly and IR onto the current-graph path, which contradicts the local-first minimal-dependency posture — or be gutted down to the struct alone.
+
+**If it's gutted to the struct alone, you've shared 9 lines of field declarations and left all 2,300 lines of actual logic behind.** That's not reuse.
+
+## What I'd do instead
+
+I over-indexed on "the mechanism exists" in the analysis. On closer reading, what exists is *history's* mechanism, and the shared-crate framing inherits a coupling that doesn't serve the current-graph path.
+
+The sequencing finding still stands and is the load-bearing one: **stream `load_active_snapshot` first**. That removes the actual constraint. Whether current-graph publication later adopts a record-partitioned format is a separate question that gets much easier to answer *after* the read path stops materializing 2 GiB — and it may not need `PartitionedGraph`'s shape at all, since it has no Prolly trees to feed.
+
+So I'd put the shared crate behind the streaming fix rather than in front of it.
+
+That said — you've made a call, and you may be seeing a longer arc than I am (a future where current-graph and history publication genuinely converge, which would justify the shared crate now). If that's the intent, say so and I'll spec it properly. Three questions I'd need answered either way:
+
+1. **Crate name and scope** — `compass-partition`? Does it carry just the type, or the record-encoding helpers (`node_key`, `edge_key`, `hyperedge_key`, `canonical_json_bytes`) too?
+2. **Does it take the Prolly dependency?** If yes, `compass-graph` inherits it. If no, the encoding logic stays in history and the shared crate is nearly empty.
+3. **Identity semantics** — history fingerprints are meaning-affecting and realizations are immutable. If current-graph reuses the same record keys, do the two paths risk producing colliding or conflatable identities? AGENTS.md is strict here.
+
+Want me to spec the shared crate as you've directed, or run `/kbd-spec` on the streaming fix first and revisit this once the read path is honest?
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+- Captured: 2026-08-09T12:09:31.964016Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .prometheus/knowledge/wiki/index.md
+- .prometheus/knowledge/wiki/log.md
+- AGENTS.md
+- .kbd-orchestrator/
+- .prometheus/events.jsonl
+- .prometheus/knowledge/.prompt-snapshots/
+- .prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-session.md
+- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md
+- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md
+- .prometheus/knowledge/wiki/karpathy-session-15a46a623cf0e420.md
+- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md
+- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md
+- .prometheus/knowledge/wiki/karpathy-session-3383d6fb52bb5dce.md
+- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md
+- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md
+- .prometheus/knowledge/wiki/karpathy-session-7c287ce9b2192bd7.md
+- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md
+- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md
+- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md
+- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md
+- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md
+- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md
+- .prometheus/knowledge/wiki/karpathy-session-cd330c925600f45f.md
+- .prometheus/knowledge/wiki/karpathy-session-f8f9c99266231745.md
+- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md
diff --git a/.prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md b/.prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md
new file mode 100644
index 000000000..da874e37c
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md
@@ -0,0 +1,80 @@
+---
+type: SessionRecord
+id: karpathy-session-19802b94100a3ab3
+title: Karpathy session 19802b94100a
+tags:
+- karpathy
+- session-learning
+sources:
+- session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+timestamp: 2026-08-09T11:11:30.692085+00:00
+created_at: 2026-08-09T11:11:30.692085+00:00
+updated_at: 2026-08-09T11:11:30.692085+00:00
+revision: 0
+---
+
+## Delta
+
+Completed kbd-assess — compass-scoping-and-bounds (step 0 of 0)
+
+## Answer: no, don't add scoping — it already exists and works
+
+**I need to correct my previous turn.** I told you the default ignore policy was missing `node_modules/`, `target/`, and `compass-out/`. That was wrong, and it was the premise of my whole recommendation. Reading the source disproves it:
+
+- All three are in `SKIP_DIRS` — ~40 entries at `crates/compass-files/src/detect.rs:61-102`
+- Gitignore respect defaults to `true` (`detect.rs:163`)
+- `.compassignore` is supported (`detect.rs:390`)
+- `--include`/`--exclude` already exist (`init_commands.rs:438-462`)
+
+Building scoping would have duplicated shipped functionality. That's the finding that changes the recommendation, and it came from checking the code rather than trusting my own earlier hypothesis.
+
+**What actually happened:** the exclusions fired correctly. That repo just has **9,320 in-scope markdown files — 4,827 under `crates/` alone**. The 19,666 matched files are real content, not leaked junk. This is a genuine capacity limit.
+
+**Research corroborates that Compass is already at or above baseline.** Firecrawl across `ck`, `codegraphcontext`, `.cursorignore`, ripgrep, and a formatter comparative study: respect `.gitignore` by default ("the single highest-value default"), ship hardcoded defaults, offer a tool-specific ignore file. Compass does all three, with a *larger* default list than the tools surveyed.
+
+**The real defects, in order:**
+
+| Pri | Defect |
+|---|---|
+| 1 | `COMPASS_MAX_GRAPH_BYTES` is honored in `compass-model`, `-output`, `-global`, `-core` — and their errors advertise it — but **not** on the snapshot path that actually failed. You hit a limit the rest of the product treats as adjustable, with no override. |
+| 2 | The error names a fact and stops — no override, no `--exclude` hint, no indication of what dominated the graph. |
+| 3 | Fails at 331 s after all work completes, then discards it. |
+| 4 | `vendor/` isn't skipped — but that needs a decision, not a reflex; Go monorepos and Compass's own tree legitimately use it. |
+
+**Two things I won't paper over:**
+
+- **My suggested `--exclude` workaround is untested and may not work.** With 4,827 markdown files under `crates/` — which you can't exclude without gutting the graph — it may still blow the cap.
+- **I'd resist raising the 2 GiB limit.** AGENTS.md is explicit that bounded work is an invariant and a limit error is distinct from an empty result. Grant an explicit opt-in override instead — which matches ripgrep's maintainer position that a paired explicit flag beats changing defaults.
+
+**Open architecture question for `/kbd-analyze`:** if a repo this size can't publish under 2 GiB even with sane exclusions, the answer may be graph partitioning rather than a bigger number. That should be settled before any code is written.
+
+Assessment written to `.kbd-orchestrator/phases/compass-scoping-and-bounds/assessment.md`. Note the phase is provisional — I didn't run `/kbd-new-phase`, so `active_phase` is still `null` and there's no `progress.json` (hence "step 0 of 0"). Say the word and I'll create it properly, or rename it.
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+- Captured: 2026-08-09T11:11:29.936317Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .prometheus/knowledge/wiki/index.md
+- .prometheus/knowledge/wiki/log.md
+- .kbd-orchestrator/
+- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md
+- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md
+- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md
+- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md
+- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md
+- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md
+- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md
+- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md
diff --git a/.prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md b/.prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md
new file mode 100644
index 000000000..0021ac18a
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md
@@ -0,0 +1,137 @@
+---
+type: SessionRecord
+id: karpathy-session-309fba26769d26dc
+title: Karpathy session 309fba26769d
+tags:
+- karpathy
+- session-learning
+sources:
+- session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+timestamp: 2026-08-09T11:22:20.607957+00:00
+created_at: 2026-08-09T11:22:20.607957+00:00
+updated_at: 2026-08-09T11:22:20.607957+00:00
+revision: 0
+---
+
+## Delta
+
+Here's a self-contained prompt for a session in the skill-pack repo. It's written to be safe alongside concurrent work — it assumes nothing about the working tree and stops rather than overwriting.
+
+````markdown
+# Fix: `update-skill-pack.sh` fails release payload verification, blocking 1.7.0 install
+
+## Context
+
+Repo: `/Users/gqadonis/Projects/prometheus/prometheus-skill-pack`
+(remote `git@github.com:Prometheus-AGS/prometheus-skill-system.git`)
+
+`bash scripts/update-skill-pack.sh` fails at step 2 and no new generation is
+installed:
+
+```
+Step 2: Building and verifying immutable generation...
+install-plugin-generation: release payload verification failed for shared/scripts/detect-toolchain.sh
+```
+
+Consequence: `~/.prometheus/plugins/prometheus-skill-pack/current` is pinned to
+an older generation. `~/.prometheus/skill-pack-install-ref` records `dfdd8be`
+while `main` is at `6e46758` (`v1.7.0-12-g6e46758`). Consumers of the pack are
+running stale skills; `kbd-execute/SKILL.md`, `kbd-spec/SKILL.md`, and
+`references/integrations/adversarial-review.md` are known to differ between
+source and the last-installed generation.
+
+## What has already been established (verify, don't assume)
+
+1. `shared/harnesses/generated/release-manifest.json` was stale. Commit
+   `3c31581` ("fix: stop reporting and restarting healthy forge-mcp and
+   sovereign-sync") modified `shared/scripts/detect-toolchain.sh` and
+   `shared/scripts/service-probe.sh` **without regenerating the manifest**.
+   The manifest recorded pre-fix sha256 values for both. File modes were
+   correct (`0755`); only content hashes were wrong. 2 of 61 `runtimeFiles`
+   entries affected.
+
+2. Running `node scripts/generate-harness-adapters.js` rebuilt the manifest and
+   brought it to 0/61 stale (verified by re-hashing every entry against disk).
+
+3. **The install still fails with the identical error after that fix.** This is
+   the open problem.
+
+## Root-cause hypothesis to confirm or refute
+
+`verifyReleaseManifest(payloadRoot, ...)` in `scripts/install-plugin-generation.js`
+(~line 642) reads the manifest from `payloadRoot`, **not** from the source
+checkout:
+
+```js
+const manifestPath = path.join(payloadRoot, 'shared/harnesses/generated/release-manifest.json');
+```
+
+So a corrected manifest in the working tree may not be what is verified. Trace
+how `payloadRoot` is derived and where the staged payload originates. Candidate
+explanations, in the order worth testing:
+
+- the payload is staged from `git archive`/HEAD rather than the working tree, so
+  the regenerated (uncommitted) manifest never reaches `payloadRoot`;
+- the payload is copied to a temp/staging dir that is cached or reused between
+  runs and was not invalidated;
+- `bundleId` is recomputed over `identity` and must also match `expectedBundle`
+  threaded in from elsewhere (note `generate-harness-adapters.js` printed
+  `Generated bundle 75cdf7e0df7f31a5ef319dd5580e7c852371546b6b8f0bbcad9b8c787b9586f3`);
+- two manifests exist and a different one wins at verification time.
+
+Confirm which by instrumenting or reading the code — do not guess and patch.
+
+If the payload is staged from HEAD, the corrected manifest **must be committed**
+before the install can succeed. That is likely the actual fix, and it means the
+regeneration alone is insufficient.
+
+## Constraints — read before touching anything
+
+- **Concurrent work is in progress in this repo. Do not overwrite, revert, stash,
+  reset, checkout over, or clean anyone else's changes.**
+- At the time of investigation the working tree had these **pre-existing
+  uncommitted** changes, unrelated to this fix (mtimes predate the regeneration
+  run — `kbd-init/SKILL.md` was modified 06:19 today). Treat any of these you
+  find as someone else's in-flight work:
+
+  ```
+   M hooks/codex-hooks.json
+   M hooks/hooks.json
+   M scripts/test-skills.js
+   M shared/harnesses/generated/claude-hooks.json
+   M shared/harnesses/generated/release-manifest.json
+   M skills/process/kbd-process-orchestrator/references/co
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+- Captured: 2026-08-09T11:22:15.521460Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .prometheus/knowledge/wiki/index.md
+- .prometheus/knowledge/wiki/log.md
+- AGENTS.md
+- .kbd-orchestrator/
+- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md
+- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md
+- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md
+- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md
+- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md
+- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md
+- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md
+- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md
+- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md
+- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md
+- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md
+- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md
diff --git a/.prometheus/knowledge/wiki/karpathy-session-3383d6fb52bb5dce.md b/.prometheus/knowledge/wiki/karpathy-session-3383d6fb52bb5dce.md
new file mode 100644
index 000000000..289ddc286
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-3383d6fb52bb5dce.md
@@ -0,0 +1,86 @@
+---
+type: SessionRecord
+id: karpathy-session-3383d6fb52bb5dce
+title: Karpathy session 3383d6fb52bb
+tags:
+- karpathy
+- session-learning
+sources:
+- session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+timestamp: 2026-08-09T12:05:01.652519+00:00
+created_at: 2026-08-09T12:05:01.652519+00:00
+updated_at: 2026-08-09T12:05:01.652519+00:00
+revision: 0
+---
+
+## Delta
+
+Completed kbd-analyze — compass-scoping-and-bounds (step 0 of 0)
+
+## Answer: don't shard — and don't build partitioning either, because it already exists
+
+Two findings changed the picture, both from reading the code rather than reasoning about it.
+
+**1. `PartitionedGraph` already exists.** `compass-history/src/artifacts.rs:76-84` has full record-class partitioning — nodes, edges, hyperedges, analysis, metadata, program facts/summaries — with `partition()`, `into_partition()`, and `reconstruct()`. A grep for it outside `compass-history` returns nothing. The current-graph path doesn't use it. So the real question isn't "should we build partitioning" but "why does `compass init` serialize one monolithic document when the mechanism sits in the next crate over?"
+
+**2. The 2 GiB cap protects against a problem the docs deny exists.** `compass-store/src/lib.rs:44-51` justifies the limit by saying the store serves records "through indexed scans instead of materializing the whole document." But `load_active_snapshot` at lines 838-853 does this:
+
+```rust
+let capacity = usize::try_from(manifest.payload_bytes).unwrap_or(MAX_GRAPH_BYTES);
+let mut bytes = Vec::with_capacity(capacity);
+for index in 0..manifest.chunk_count {
+    bytes.extend_from_slice(&chunk.value);
+```
+
+It pre-allocates the full payload and concatenates every chunk. Chunking bounds each *stored value*, not the reconstruction. Meanwhile the **write** path genuinely streams via `DigestWriter`. The asymmetry matters: the cap isn't protecting the writer, it's protecting the reader — the opposite of what the comment claims.
+
+**This produces a hard sequencing constraint.** Honoring `COMPASS_MAX_GRAPH_BYTES` on the publication path (G1, the obvious fix) **must not land first**. Raising the cap today raises a real allocation — an override would let someone request a multi-gigabyte contiguous `Vec`, which is a worse failure than today's clean error. Stream the read path first.
+
+**Research backed the direction unanimously.** Sharding targets multi-machine scaling; Compass is local-first single-process. Citus notes graph sharding brings eventual consistency, which the determinism invariant forbids outright. Azure's criteria (data exceeds single-instance capacity, vertical scaling exhausted) don't apply. Notably, the existing `PartitionedGraph` partitions by *record class, not topology* — sidestepping the edge-cut problem the literature flags as graph partitioning's hardest part.
+
+**Recommended order:** stream `load_active_snapshot` → actionable error (G2) → pre-flight estimate (G3) → *then* the override (G1) → `vendor/` policy (G4). Items 2, 3, 5 are independent and can run in parallel.
+
+**Where I'd temper confidence:** direction is well-supported, but three of four open questions are unmeasured — no consumer audit of `load_active_snapshot`, no measurement of what dominates the 2 GiB, and my `--exclude` workaround from earlier is *still untested* and may not fit under the cap given 4,827 markdown files under `crates/`. Sizing this work would be guesswork right now.
+
+**One architecture decision blocks the partitioning route:** `PartitionedGraph` lives in `compass-history`, but AGENTS.md routes current-graph publication to `compass-graph`. Shared crate, duplicate with distinct identity semantics, or new dependency? That needs your call before anyone touches item 6.
+
+Phase is now live — `active_phase` set, waypoint at `analysis_ready`, next command `/kbd-spec`. Files written: `goals.md`, `analysis.md`, `library-candidates.json`, `decision-log.md`, `handoffs/analyze.md`.
+
+Still unpushed: the two commits on `docs/claude-md` plus all of `.kbd-orchestrator/` untracked.
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+- Captured: 2026-08-09T12:05:00.281326Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .prometheus/knowledge/wiki/index.md
+- .prometheus/knowledge/wiki/log.md
+- AGENTS.md
+- .kbd-orchestrator/
+- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md
+- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md
+- .prometheus/knowledge/wiki/karpathy-session-15a46a623cf0e420.md
+- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md
+- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md
+- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md
+- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md
+- .prometheus/knowledge/wiki/karpathy-session-7c287ce9b2192bd7.md
+- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md
+- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md
+- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md
+- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md
+- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md
+- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md
+- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md
diff --git a/.prometheus/knowledge/wiki/karpathy-session-4301f5fbc8d2baa8.md b/.prometheus/knowledge/wiki/karpathy-session-4301f5fbc8d2baa8.md
new file mode 100644
index 000000000..6a8fad6d3
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-4301f5fbc8d2baa8.md
@@ -0,0 +1,103 @@
+---
+type: SessionRecord
+id: karpathy-session-4301f5fbc8d2baa8
+title: Karpathy session 4301f5fbc8d2
+tags:
+- karpathy
+- session-learning
+sources:
+- session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+timestamp: 2026-08-09T12:22:00.073281+00:00
+created_at: 2026-08-09T12:22:00.073281+00:00
+updated_at: 2026-08-09T12:22:00.073281+00:00
+revision: 0
+---
+
+## Delta
+
+Completed kbd-spec — compass-scoping-and-bounds (step 0 of 6)
+
+## The audit changed the shape of the main change
+
+I ran the consumer audit that analyze had flagged as blocking. `read_snapshot` (`compass-store/src/lib.rs:829`) returns `(SnapshotManifest, Vec<u8>)` — the materialized payload is right in the signature. Eight call sites:
+
+- **`validate_snapshot`** (`:935`) — discards it: `.map(|(manifest, _)| manifest)`
+- **`snapshot_reference`** (`:1184`) — discards it: `let (manifest, _)`
+- Five tests, plus `compass-query` which calls `begin_read_snapshot` and then reads through **`GraphSnapshotReader::open_selector`** — an indexed reader that never materializes anything.
+
+**No production consumer uses those bytes.** The 2 GiB contiguous allocation happens for a value everything in production throws away. So C-001 is an API split — add a manifest-only read, reimplement the two callers on it — not the streaming refactor analyze assumed.
+
+## Six changes, three hard gates
+
+| ID | Change | Owner | Depends |
+|---|---|---|---|
+| C-001 | Stop materializing payload in `read_snapshot` | `compass-store` | — |
+| C-002 | Actionable limit error | `compass-graph`/`cli` | — |
+| C-003 | Pre-flight size estimate | `compass-core` | — |
+| C-004 | Honor `COMPASS_MAX_GRAPH_BYTES` | `compass-graph`/`store` | **C-001** |
+| C-005 | Extract `compass-partition` | new crate | **C-001** |
+| C-006 | `vendor/` skip policy | `compass-files` | — |
+
+The gates: C-004 can't precede C-001 (an override before streaming lets someone request a multi-gigabyte `Vec`); C-002 must not advertise an override that doesn't exist yet; and C-005 must not pull `prolly-map`, `prolly-store-sqlite`, `compass-ir`, or `compass-analysis` onto the current-graph path — if that can't be satisfied, stop and report, because it means the shared-crate framing doesn't hold.
+
+## On the shared crate — scope stated plainly
+
+I specced it as you directed. What moves is dependency-light: `PartitionedGraph` (9 lines of fields), `node_key`/`edge_key`/`hyperedge_key`, and `canonical_json_bytes`. What stays is `into_partition` and everything coupled to `CompletionEvidence`, sidecars, `AnalysisBundle`, `ProgramBundle`, and Prolly.
+
+So this extracts a struct and four functions from a 2,317-line module. It **positions for** current-graph partitioned publication without delivering it — that's a further change gated on the identity question. I've written that into the spec rather than letting the delivered scope be mistaken for the larger capability.
+
+## Two things blocking execution
+
+**`/Volumes/Workspace` is not mounted.** Every compiling command needs `CARGO_TARGET_DIR` pointed there. Nothing can be verified until that volume is back.
+
+**Identity/namespacing is unresolved** — history fingerprints are meaning-affecting and realizations immutable. Before any current-graph consumer adopts the shared keys, either namespace them per path or prove non-collision with a test. This blocks C-005 *adoption*, not the extraction itself.
+
+Also still unverified since assessment: whether `--exclude` actually gets that repo under 2 GiB. With 4,827 markdown files under `crates/`, it may not.
+
+Files written: `spec.md`, `tasks.json`, `handoffs/spec.md`, appended `decision-log.md`. Waypoint at `spec_ready`, 6 changes registered, next `/kbd-plan`.
+
+Everything in `.kbd-orchestrator/` is still untracked, and the two commits on `docs/claude-md` are unpushed.
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+- Captured: 2026-08-09T12:21:54.806670Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .prometheus/knowledge/wiki/index.md
+- .prometheus/knowledge/wiki/log.md
+- AGENTS.md
+- .kbd-orchestrator/
+- .prometheus/events.jsonl
+- .prometheus/knowledge/.prompt-snapshots/
+- .prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-session.md
+- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md
+- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md
+- .prometheus/knowledge/wiki/karpathy-session-15a46a623cf0e420.md
+- .prometheus/knowledge/wiki/karpathy-session-178be089fef7012d.md
+- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md
+- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md
+- .prometheus/knowledge/wiki/karpathy-session-3383d6fb52bb5dce.md
+- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md
+- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md
+- .prometheus/knowledge/wiki/karpathy-session-7c287ce9b2192bd7.md
+- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md
+- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md
+- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md
+- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md
+- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md
+- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md
+- .prometheus/knowledge/wiki/karpathy-session-cd330c925600f45f.md
+- .prometheus/knowledge/wiki/karpathy-session-f8f9c99266231745.md
+- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md
diff --git a/.prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md b/.prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md
new file mode 100644
index 000000000..35aaed29c
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md
@@ -0,0 +1,67 @@
+---
+type: SessionRecord
+id: karpathy-session-6aacc8d765a1b28f
+title: Karpathy session 6aacc8d765a1
+tags:
+- karpathy
+- session-learning
+sources:
+- session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+timestamp: 2026-08-09T11:01:48.963380+00:00
+created_at: 2026-08-09T11:01:48.963380+00:00
+updated_at: 2026-08-09T11:01:48.963380+00:00
+revision: 0
+---
+
+## Delta
+
+Completed kbd-init — Compass
+
+Two files written to `.kbd-orchestrator/`:
+
+**`project.json`** — discovery results:
+
+| Field | Value | Source |
+|---|---|---|
+| name / description | Compass — "Native local-first knowledge graph engine…" | `Cargo.toml` `[workspace.package]` |
+| stack | Rust (Edition 2024, pinned 1.97.1) | `Cargo.toml` + `rust-toolchain.toml` |
+| spec_paths | `openspec/specs/*.md` | `openspec/` exists (just initialized, currently empty) |
+| openspec_available | `true` | — |
+| workspace | single-project (`workspace_file: null`) | no `.code-workspace` references compass |
+| planning / execution agents | `claude` / `claude, codex, opencode` | the tools we just configured |
+| active_phase | `null` | no phase defined yet |
+
+**`constraints.md`** — I did **not** use the template's defaults. Those are TypeScript-oriented (`no-console-log`, `no-any-type`, `grep src/`) and would be inert in a Rust workspace with no `src/` at root. Instead I derived constraints from AGENTS.md: 16 blocking (unsafe/unwrap/expect/panic lints, product boundary vs. Graphify, local-first preservation, determinism, boundedness, immutable realizations, viewer-asset generation) and 17 warning (ownership boundary, extractor/resolver separation, compatibility documentation, the CompassQL and code-graph gates).
+
+**One thing needs your attention before any KBD phase runs a command:**
+
+`/Volumes/Workspace` **is not currently mounted** — only `Macintosh HD`, `my-passport`, and `Open Design` are. Every build/test/lint command in `project.json` sets `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main`, per the AGENTS.md mandate. As written, they'll fail until that volume is attached — which is the correct behavior, since AGENTS.md says to stop and report rather than fall back to a local `target/` on the 100 GB-capped main disk. I encoded the rule faithfully rather than silently substituting a working-but-wrong path.
+
+Also worth noting: `openspec/specs/` is empty, so `spec_paths` currently resolves to nothing. That's expected for a fresh init — specs appear once you run `/opsx:new`.
+
+These two files are untracked and uncommitted, separate from the two commits already on `docs/claude-md`. Next step is `/kbd-status` to confirm, then `/kbd-new-phase <name>` to start the first phase.
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+- Captured: 2026-08-09T10:58:32.187142Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .prometheus/knowledge/wiki/index.md
+- .prometheus/knowledge/wiki/log.md
+- .kbd-orchestrator/
+- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md
+- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md
+- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md
+- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md
diff --git a/.prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md b/.prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md
new file mode 100644
index 000000000..db20b9034
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md
@@ -0,0 +1,68 @@
+---
+type: SessionRecord
+id: karpathy-session-762f04f1710fc991
+title: Karpathy session 762f04f1710f
+tags:
+- karpathy
+- session-learning
+sources:
+- session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+timestamp: 2026-08-09T11:01:52.216303+00:00
+created_at: 2026-08-09T11:01:52.216303+00:00
+updated_at: 2026-08-09T11:01:52.216303+00:00
+revision: 0
+---
+
+## Delta
+
+Completed kbd-init — Compass
+
+Two files written to `.kbd-orchestrator/`:
+
+**`project.json`** — discovery results:
+
+| Field | Value | Source |
+|---|---|---|
+| name / description | Compass — "Native local-first knowledge graph engine…" | `Cargo.toml` `[workspace.package]` |
+| stack | Rust (Edition 2024, pinned 1.97.1) | `Cargo.toml` + `rust-toolchain.toml` |
+| spec_paths | `openspec/specs/*.md` | `openspec/` exists (just initialized, currently empty) |
+| openspec_available | `true` | — |
+| workspace | single-project (`workspace_file: null`) | no `.code-workspace` references compass |
+| planning / execution agents | `claude` / `claude, codex, opencode` | the tools we just configured |
+| active_phase | `null` | no phase defined yet |
+
+**`constraints.md`** — I did **not** use the template's defaults. Those are TypeScript-oriented (`no-console-log`, `no-any-type`, `grep src/`) and would be inert in a Rust workspace with no `src/` at root. Instead I derived constraints from AGENTS.md: 16 blocking (unsafe/unwrap/expect/panic lints, product boundary vs. Graphify, local-first preservation, determinism, boundedness, immutable realizations, viewer-asset generation) and 17 warning (ownership boundary, extractor/resolver separation, compatibility documentation, the CompassQL and code-graph gates).
+
+**One thing needs your attention before any KBD phase runs a command:**
+
+`/Volumes/Workspace` **is not currently mounted** — only `Macintosh HD`, `my-passport`, and `Open Design` are. Every build/test/lint command in `project.json` sets `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main`, per the AGENTS.md mandate. As written, they'll fail until that volume is attached — which is the correct behavior, since AGENTS.md says to stop and report rather than fall back to a local `target/` on the 100 GB-capped main disk. I encoded the rule faithfully rather than silently substituting a working-but-wrong path.
+
+Also worth noting: `openspec/specs/` is empty, so `spec_paths` currently resolves to nothing. That's expected for a fresh init — specs appear once you run `/opsx:new`.
+
+These two files are untracked and uncommitted, separate from the two commits already on `docs/claude-md`. Next step is `/kbd-status` to confirm, then `/kbd-new-phase <name>` to start the first phase.
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+- Captured: 2026-08-09T11:01:46.520733Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .prometheus/knowledge/wiki/index.md
+- .prometheus/knowledge/wiki/log.md
+- .kbd-orchestrator/
+- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md
+- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md
+- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md
+- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md
+- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md
diff --git a/.prometheus/knowledge/wiki/karpathy-session-7c287ce9b2192bd7.md b/.prometheus/knowledge/wiki/karpathy-session-7c287ce9b2192bd7.md
new file mode 100644
index 000000000..fd705f902
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-7c287ce9b2192bd7.md
@@ -0,0 +1,68 @@
+---
+type: SessionRecord
+id: karpathy-session-7c287ce9b2192bd7
+title: Karpathy session 7c287ce9b219
+tags:
+- karpathy
+- session-learning
+sources:
+- session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+timestamp: 2026-08-09T11:24:40.732045+00:00
+created_at: 2026-08-09T11:24:40.732045+00:00
+updated_at: 2026-08-09T11:24:40.732045+00:00
+revision: 0
+---
+
+## Delta
+
+Written to `/Users/gqadonis/Projects/prometheus/prometheus-skill-pack/docs/UPDATE_CONSIDERATIONS.md`.
+
+It's structured as a handoff brief rather than the bare prompt — the same content, but organized so someone landing cold can act on it:
+
+- **Symptom + consequence** — the error, and the concrete drift it causes (`kbd-execute`, `kbd-spec`, `adversarial-review.md`), with the install-ref vs HEAD mismatch.
+- **Established by direct verification** — the three things I actually proved, with the hash evidence showing the manifest was wrong and the file was right.
+- **Open hypothesis** — `payloadRoot`, with four ranked candidates and an explicit instruction not to guess-and-patch. The likeliest answer (payload stages from HEAD → manifest must be committed) is called out as *structurally* meaning regeneration alone can't work.
+- **Constraints** — the concurrency guardrails, including that the two tree snapshots I took minutes apart already differed, so the listed file set is indicative only.
+- **Definition of done** — six checkable conditions, the last being that in-flight work survives untouched.
+- **Secondary defect** — the broken `.claude/skills` symlink, framed as arguably higher impact since it's the mechanism that let the staleness go unnoticed.
+- **Preventive follow-up** — proposal only, pointing at `check-harness-adapters.js` as the likely existing-but-unenforced check.
+
+I only created that one new file; nothing else in the repo was touched. Note the working tree there has kept growing — `kbd-init` workflow files across five harness surfaces are now modified — so that document is deliberately written to assume its own file list is stale.
+
+Two loose ends still open here in Compass: the phase creation and `/kbd-analyze` on the partitioning question, plus the two unpushed commits on `docs/claude-md` and the untracked `.kbd-orchestrator/`. Since `kbd-analyze`'s `SKILL.md` is byte-identical between 1.6.2 and 1.7.0, running it now carries no version risk if you want to keep moving.
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+- Captured: 2026-08-09T11:24:38.852780Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .prometheus/knowledge/wiki/index.md
+- .prometheus/knowledge/wiki/log.md
+- AGENTS.md
+- .kbd-orchestrator/
+- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md
+- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md
+- .prometheus/knowledge/wiki/karpathy-session-15a46a623cf0e420.md
+- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md
+- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md
+- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md
+- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md
+- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md
+- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md
+- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md
+- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md
+- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md
+- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md
+- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md
diff --git a/.prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md b/.prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md
new file mode 100644
index 000000000..088cb2709
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md
@@ -0,0 +1,86 @@
+---
+type: SessionRecord
+id: karpathy-session-8b2e071dd73e1374
+title: Karpathy session 8b2e071dd73e
+tags:
+- karpathy
+- session-learning
+sources:
+- session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+timestamp: 2026-08-09T11:14:53.968282+00:00
+created_at: 2026-08-09T11:14:53.968282+00:00
+updated_at: 2026-08-09T11:14:53.968282+00:00
+revision: 0
+---
+
+## Delta
+
+I've traced it. Here's what's actually going on — and part of it contradicts the premise.
+
+## Why 1.6.2 is resolving
+
+**1.7.0 was never installed.** The cache holds only `1.6.0`, `1.6.1`, `1.6.2`. Your source repo at `/Users/gqadonis/Projects/prometheus/prometheus-skill-pack` is tagged `v1.7.0` (12 commits past it, working tree clean), but that was never published into the plugin cache. The newest cache dir is dated Aug 3; the `.prometheus` generation is Aug 5. The tag exists locally and nowhere else.
+
+There's also a **second, unrelated breakage**: `~/.claude/skills/kbd-init` symlinks to `~/.prometheus/plugins/prometheus-skill-pack/current/skills/process/kbd-process-orchestrator/skills/kbd-init` — a path that doesn't resolve. That's why I fell back to the cache at the start of this session. Two different install roots (`.claude/plugins/cache` and `.prometheus/plugins/generations`), and the symlink points into the one that's broken.
+
+## But the premise doesn't hold for this work
+
+I diffed the source tree against 1.6.2 directly. **The entire `kbd-process-orchestrator` differs in exactly three files:**
+
+| File | Status |
+|---|---|
+| `references/integrations/adversarial-review.md` | differs |
+| `skills/kbd-execute/SKILL.md` | differs |
+| `skills/kbd-spec/SKILL.md` | differs |
+
+Everything else is byte-identical. Specifically:
+
+- **`kbd-analyze` exists in 1.6.2 and its `SKILL.md` is identical to 1.7.0.** My earlier "no analyze.md" observation was about the `prompts/` directory — and `prompts/` has no `analyze.md` in **1.7.0 either**. `kbd-analyze` is driven by its `SKILL.md`, not a prompt file. That's not a version gap; I misread it.
+- `kbd-assess/SKILL.md`, `kbd-init/SKILL.md`, `kbd-new-phase/SKILL.md`, `prompts/assess.md`, `project.template.json`, and the adversarial-review preflight script are all **identical** between source and 1.6.2.
+
+So the `/kbd-init` and `/kbd-assess` runs already completed used the same bytes 1.7.0 would have. No rework needed there.
+
+The three drifted files matter for `/kbd-execute` and `/kbd-spec` — stages we haven't reached.
+
+## Your call
+
+I can't publish 1.7.0 into the plugin cache myself — that's your packaging pipeline, and I don't know its publish command. Options:
+
+1. **Publish 1.7.0 properly** — you run the pack's install/publish step; I re-verify and continue. Cleanest, and fixes the broken `~/.claude/skills` symlink if the installer rewrites it.
+2. **Continue on 1.6.2 for analyze** — legitimate here, since `kbd-analyze` is byte-identical. Then upgrade before `/kbd-spec` or `/kbd-execute`, where the drift is real.
+3. **Point the KBD skills at the source tree directly** for this session.
+
+I'd suggest **1**, since the symlink is broken regardless and will keep biting. But **2** is defensible if you want to keep moving on the partitioning question now — the risk is genuinely zero for the analyze stage.
+
+Which way?
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+- Captured: 2026-08-09T11:14:51.722543Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .prometheus/knowledge/wiki/index.md
+- .prometheus/knowledge/wiki/log.md
+- .kbd-orchestrator/
+- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md
+- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md
+- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md
+- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md
+- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md
+- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md
+- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md
+- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md
+- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md
+- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md
diff --git a/.prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md b/.prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md
new file mode 100644
index 000000000..9b7c69199
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md
@@ -0,0 +1,50 @@
+---
+type: SessionRecord
+id: karpathy-session-8f202396ae5617a5
+title: Karpathy session 8f202396ae56
+tags:
+- karpathy
+- session-learning
+sources:
+- session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+timestamp: 2026-08-09T11:20:15.494977+00:00
+created_at: 2026-08-09T11:20:15.494977+00:00
+updated_at: 2026-08-09T11:20:15.494977+00:00
+revision: 0
+---
+
+## Delta
+
+The `kbd-init` mtime is 06:19 today — well before this session's regeneration. Those were already-pending working-tree changes, not collateral from my run. Retrying the install:
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+- Captured: 2026-08-09T11:14:56.866886Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .prometheus/knowledge/wiki/index.md
+- .prometheus/knowledge/wiki/log.md
+- .kbd-orchestrator/
+- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md
+- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md
+- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md
+- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md
+- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md
+- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md
+- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md
+- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md
+- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md
+- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md
+- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md
diff --git a/.prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md b/.prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md
new file mode 100644
index 000000000..671c644d6
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md
@@ -0,0 +1,46 @@
+---
+type: SessionRecord
+id: karpathy-session-9354b74ff25823d0
+title: Karpathy session 9354b74ff258
+tags:
+- karpathy
+- session-learning
+sources:
+- session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+timestamp: 2026-08-09T11:10:48.901378+00:00
+created_at: 2026-08-09T11:10:48.901378+00:00
+updated_at: 2026-08-09T11:10:48.901378+00:00
+revision: 0
+---
+
+## Delta
+
+That's the real cause: 9,320 in-scope markdown files, with **4,827 in `crates/`** alone. This is genuine content at genuine scale, not junk. Let me write the assessment.
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+- Captured: 2026-08-09T11:05:46.513453Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .prometheus/knowledge/wiki/index.md
+- .prometheus/knowledge/wiki/log.md
+- .kbd-orchestrator/
+- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md
+- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md
+- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md
+- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md
+- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md
+- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md
+- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md
diff --git a/.prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md b/.prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md
new file mode 100644
index 000000000..2bc3225c4
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md
@@ -0,0 +1,65 @@
+---
+type: SessionRecord
+id: karpathy-session-b0a4e7ceb012e58d
+title: Karpathy session b0a4e7ceb012
+tags:
+- karpathy
+- session-learning
+sources:
+- session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+timestamp: 2026-08-09T10:58:30.244136+00:00
+created_at: 2026-08-09T10:58:30.244136+00:00
+updated_at: 2026-08-09T10:58:30.244136+00:00
+revision: 0
+---
+
+## Delta
+
+Completed kbd-init — Compass
+
+Two files written to `.kbd-orchestrator/`:
+
+**`project.json`** — discovery results:
+
+| Field | Value | Source |
+|---|---|---|
+| name / description | Compass — "Native local-first knowledge graph engine…" | `Cargo.toml` `[workspace.package]` |
+| stack | Rust (Edition 2024, pinned 1.97.1) | `Cargo.toml` + `rust-toolchain.toml` |
+| spec_paths | `openspec/specs/*.md` | `openspec/` exists (just initialized, currently empty) |
+| openspec_available | `true` | — |
+| workspace | single-project (`workspace_file: null`) | no `.code-workspace` references compass |
+| planning / execution agents | `claude` / `claude, codex, opencode` | the tools we just configured |
+| active_phase | `null` | no phase defined yet |
+
+**`constraints.md`** — I did **not** use the template's defaults. Those are TypeScript-oriented (`no-console-log`, `no-any-type`, `grep src/`) and would be inert in a Rust workspace with no `src/` at root. Instead I derived constraints from AGENTS.md: 16 blocking (unsafe/unwrap/expect/panic lints, product boundary vs. Graphify, local-first preservation, determinism, boundedness, immutable realizations, viewer-asset generation) and 17 warning (ownership boundary, extractor/resolver separation, compatibility documentation, the CompassQL and code-graph gates).
+
+**One thing needs your attention before any KBD phase runs a command:**
+
+`/Volumes/Workspace` **is not currently mounted** — only `Macintosh HD`, `my-passport`, and `Open Design` are. Every build/test/lint command in `project.json` sets `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main`, per the AGENTS.md mandate. As written, they'll fail until that volume is attached — which is the correct behavior, since AGENTS.md says to stop and report rather than fall back to a local `target/` on the 100 GB-capped main disk. I encoded the rule faithfully rather than silently substituting a working-but-wrong path.
+
+Also worth noting: `openspec/specs/` is empty, so `spec_paths` currently resolves to nothing. That's expected for a fresh init — specs appear once you run `/opsx:new`.
+
+These two files are untracked and uncommitted, separate from the two commits already on `docs/claude-md`. Next step is `/kbd-status` to confirm, then `/kbd-new-phase <name>` to start the first phase.
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+- Captured: 2026-08-09T10:55:59.021325Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .prometheus/knowledge/wiki/index.md
+- .prometheus/knowledge/wiki/log.md
+- .kbd-orchestrator/
+- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md
+- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md
diff --git a/.prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md b/.prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md
new file mode 100644
index 000000000..d023a5a52
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md
@@ -0,0 +1,58 @@
+---
+type: SessionRecord
+id: karpathy-session-b5d49ca1d46e60a2
+title: Karpathy session b5d49ca1d46e
+tags:
+- karpathy
+- session-learning
+sources:
+- session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+timestamp: 2026-08-09T10:56:00.254334+00:00
+created_at: 2026-08-09T10:56:00.254334+00:00
+updated_at: 2026-08-09T10:56:00.254334+00:00
+revision: 0
+---
+
+## Delta
+
+Both commits are on `docs/claude-md`:
+
+| Commit | Contents |
+|---|---|
+| `dd7679fb` | `docs: add CLAUDE.md agent guide` — 1 file |
+| `c349fdf6` | `chore: track Prometheus wiki and initialize OpenSpec` — 73 files, 12,227 insertions |
+
+**What landed:**
+- **`.prometheus/knowledge/wiki/`** — all 12 files tracked as-is, per your call.
+- **OpenSpec** initialized with `schema: spec-driven`, generating `.claude/`, `.codex/`, `.kimi/`, `.opencode/` plus `openspec/config.yaml`.
+
+**Three things to know:**
+
+1. **Zed got nothing.** It isn't a supported `openspec init` target, so there's no generated config for it. If you use Zed here, that gap is still open — I can hand-write a rules file, but it'd be unofficial and liable to drift from openspec's format.
+
+2. **Kimi has skills but no commands.** OpenSpec reported "Commands skipped for: kimi (no adapter)" — it got 10 skill files, no `/opsx:*` slash commands. Claude, Codex, and OpenCode got both.
+
+3. **`.claude/settings.local.json` stayed untracked.** It's your personal permission allowlist with machine-specific paths, and your global gitignore already excludes it — so it was never at risk of being committed.
+
+`openspec/config.yaml` is currently all commented-out scaffolding. Its `context:` field feeds project background to AI tools when creating artifacts, and this repo has strong conventions worth putting there (local-first Rust, no-unwrap/expect/panic lints, determinism requirements, the `CARGO_TARGET_DIR` rule). Want me to fill it in?
+
+Nothing is pushed yet. Say the word and I'll push and open a PR.
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+- Captured: 2026-08-09T10:52:28.835309Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- No changed paths detected.
diff --git a/.prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md b/.prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md
new file mode 100644
index 000000000..6630e59d3
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md
@@ -0,0 +1,60 @@
+---
+type: SessionRecord
+id: karpathy-session-b6f086fb31ed31c5
+title: Karpathy session b6f086fb31ed
+tags:
+- karpathy
+- session-learning
+sources:
+- session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+timestamp: 2026-08-09T10:56:01.152228+00:00
+created_at: 2026-08-09T10:56:01.152228+00:00
+updated_at: 2026-08-09T10:56:01.152228+00:00
+revision: 0
+---
+
+## Delta
+
+Both commits are on `docs/claude-md`:
+
+| Commit | Contents |
+|---|---|
+| `dd7679fb` | `docs: add CLAUDE.md agent guide` — 1 file |
+| `c349fdf6` | `chore: track Prometheus wiki and initialize OpenSpec` — 73 files, 12,227 insertions |
+
+**What landed:**
+- **`.prometheus/knowledge/wiki/`** — all 12 files tracked as-is, per your call.
+- **OpenSpec** initialized with `schema: spec-driven`, generating `.claude/`, `.codex/`, `.kimi/`, `.opencode/` plus `openspec/config.yaml`.
+
+**Three things to know:**
+
+1. **Zed got nothing.** It isn't a supported `openspec init` target, so there's no generated config for it. If you use Zed here, that gap is still open — I can hand-write a rules file, but it'd be unofficial and liable to drift from openspec's format.
+
+2. **Kimi has skills but no commands.** OpenSpec reported "Commands skipped for: kimi (no adapter)" — it got 10 skill files, no `/opsx:*` slash commands. Claude, Codex, and OpenCode got both.
+
+3. **`.claude/settings.local.json` stayed untracked.** It's your personal permission allowlist with machine-specific paths, and your global gitignore already excludes it — so it was never at risk of being committed.
+
+`openspec/config.yaml` is currently all commented-out scaffolding. Its `context:` field feeds project background to AI tools when creating artifacts, and this repo has strong conventions worth putting there (local-first Rust, no-unwrap/expect/panic lints, determinism requirements, the `CARGO_TARGET_DIR` rule). Want me to fill it in?
+
+Nothing is pushed yet. Say the word and I'll push and open a PR.
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+- Captured: 2026-08-09T10:55:56.151200Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .prometheus/knowledge/wiki/index.md
+- .prometheus/knowledge/wiki/log.md
+- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md
diff --git a/.prometheus/knowledge/wiki/karpathy-session-ca329344b0f175d8.md b/.prometheus/knowledge/wiki/karpathy-session-ca329344b0f175d8.md
new file mode 100644
index 000000000..6b1b6b061
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-ca329344b0f175d8.md
@@ -0,0 +1,98 @@
+---
+type: SessionRecord
+id: karpathy-session-ca329344b0f175d8
+title: Karpathy session ca329344b0f1
+tags:
+- karpathy
+- session-learning
+sources:
+- session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+timestamp: 2026-08-09T12:28:29.645888+00:00
+created_at: 2026-08-09T12:28:29.645888+00:00
+updated_at: 2026-08-09T12:28:29.645888+00:00
+revision: 0
+---
+
+## Delta
+
+Completed kbd-plan — compass-scoping-and-bounds (step 0 of 6)
+
+## Plan written — 6 changes, 2 waves
+
+```
+Wave 1 (parallel)          Wave 2 (after C-001)
+├── C-001  read_snapshot   ├── C-004  env override   [HARD GATE]
+├── C-002  error message   └── C-005  compass-partition
+├── C-003  size estimate
+└── C-006  vendor/ policy
+```
+
+Backend is **OpenSpec** (`openspec/` present, `openspec_available: true`). No evolver cycle.
+
+**Apply C-001 first** — it's the only Wave 1 item that unblocks others, and the spec-stage audit shrank it from a streaming refactor to an API split.
+
+The adversarial pass found no surviving CRITICAL: the ordering error this stage exists to catch (C-004 before C-001) was already caught at spec, and is now enforced twice — by wave structure and by an inline gate on the change itself.
+
+**Two coupling risks worth watching:**
+
+- **C-002 ↔ C-004 share the error text.** C-002 must *omit* the `COMPASS_MAX_GRAPH_BYTES` mention (advertising a nonexistent override is the exact defect being fixed), then C-004 adds it. If C-004 slips, C-002's message stays permanently incomplete. Tracked rather than assumed.
+- **C-003 has testable criteria but no calibration data.** Measuring what actually dominates the 2 GiB is its *first task*, not an afterthought — otherwise it ships an invented heuristic.
+
+## One blocker stops execution outright
+
+**`/Volumes/Workspace` is still not mounted** — I re-checked at plan time. Every compiling command needs `CARGO_TARGET_DIR` beneath it, and AGENTS.md explicitly forbids falling back to a local `target/`. **Every acceptance checkbox in this plan is unverifiable until that volume is back.** The plan is complete and correct; it just isn't runnable yet.
+
+## I stopped short of one step
+
+Step 10 of the skill emits OpenSpec change structures — six `/opsx:new` invocations creating `openspec/changes/<id>/` directories with proposals. I've written the exact commands into `plan.md` but haven't run them, for two reasons: it's six new tracked directories in your repo, and creating scaffolding for changes that can't be verified yet may be premature. Say the word and I'll emit all six, or just C-001.
+
+Files written: `plan.md`, `current-waypoint.md`, `handoffs/plan.md`; waypoint at `plan_ready`, `progress.json` marked `plan_complete`.
+
+Still outstanding from earlier: two unpushed commits on `docs/claude-md`, and all of `.kbd-orchestrator/` untracked.
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+- Captured: 2026-08-09T12:27:40.809364Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .prometheus/knowledge/wiki/index.md
+- .prometheus/knowledge/wiki/log.md
+- AGENTS.md
+- .kbd-orchestrator/
+- .prometheus/events.jsonl
+- .prometheus/knowledge/.prompt-snapshots/
+- .prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-session.md
+- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md
+- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md
+- .prometheus/knowledge/wiki/karpathy-session-1371f12708207b52.md
+- .prometheus/knowledge/wiki/karpathy-session-15a46a623cf0e420.md
+- .prometheus/knowledge/wiki/karpathy-session-178be089fef7012d.md
+- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md
+- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md
+- .prometheus/knowledge/wiki/karpathy-session-3383d6fb52bb5dce.md
+- .prometheus/knowledge/wiki/karpathy-session-4301f5fbc8d2baa8.md
+- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md
+- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md
+- .prometheus/knowledge/wiki/karpathy-session-7c287ce9b2192bd7.md
+- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md
+- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md
+- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md
+- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md
+- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md
+- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md
+- .prometheus/knowledge/wiki/karpathy-session-cd330c925600f45f.md
+- .prometheus/knowledge/wiki/karpathy-session-e2c00470b2ce9770.md
+- .prometheus/knowledge/wiki/karpathy-session-f8f9c99266231745.md
+- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md
diff --git a/.prometheus/knowledge/wiki/karpathy-session-cd330c925600f45f.md b/.prometheus/knowledge/wiki/karpathy-session-cd330c925600f45f.md
new file mode 100644
index 000000000..60cf62fcb
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-cd330c925600f45f.md
@@ -0,0 +1,98 @@
+---
+type: SessionRecord
+id: karpathy-session-cd330c925600f45f
+title: Karpathy session cd330c925600
+tags:
+- karpathy
+- session-learning
+sources:
+- session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+timestamp: 2026-08-09T12:06:26.089450+00:00
+created_at: 2026-08-09T12:06:26.089450+00:00
+updated_at: 2026-08-09T12:06:26.089450+00:00
+revision: 0
+---
+
+## Delta
+
+I have what I need to give you a straight answer — and it includes a correction to my own recommendation.
+
+## The doc comment tells you what this type is for
+
+```rust
+/// Deterministic typed records used to construct the five Prolly trees.
+pub struct PartitionedGraph { ... }
+```
+
+`PartitionedGraph` isn't a general-purpose partitioning abstraction. It's **the input format for Prolly tree construction** — history's immutable-storage engine. The struct body is plain `Vec<(Vec<u8>, Vec<u8>)>` and looks portable, but the meaning is history-specific.
+
+The producing logic confirms it. `into_partition` (`artifacts.rs:349-400+`) is entangled with concerns that don't exist on the current-graph path:
+
+| Dependency | Belongs to |
+|---|---|
+| `CompletionEvidence` | history realization completion |
+| `authoritative_sidecars` / `TRUSTED_GRAPH_CONTENT` | history provenance |
+| `AnalysisBundle`, `compass_ir::ProgramBundle` | `compass-analysis` / `compass-ir` |
+| `HistoryError` | history error taxonomy |
+| `prolly::{KeyBuilder, VersionedValue}` | Prolly storage |
+
+And the crate dependency sets diverge sharply. `compass-history` pulls `prolly-map`, `prolly-store-sqlite`, `compass-ir`, `compass-analysis`. `compass-graph` pulls none of those. A shared crate has to either carry that weight — forcing Prolly and IR onto the current-graph path, which contradicts the local-first minimal-dependency posture — or be gutted down to the struct alone.
+
+**If it's gutted to the struct alone, you've shared 9 lines of field declarations and left all 2,300 lines of actual logic behind.** That's not reuse.
+
+## What I'd do instead
+
+I over-indexed on "the mechanism exists" in the analysis. On closer reading, what exists is *history's* mechanism, and the shared-crate framing inherits a coupling that doesn't serve the current-graph path.
+
+The sequencing finding still stands and is the load-bearing one: **stream `load_active_snapshot` first**. That removes the actual constraint. Whether current-graph publication later adopts a record-partitioned format is a separate question that gets much easier to answer *after* the read path stops materializing 2 GiB — and it may not need `PartitionedGraph`'s shape at all, since it has no Prolly trees to feed.
+
+So I'd put the shared crate behind the streaming fix rather than in front of it.
+
+That said — you've made a call, and you may be seeing a longer arc than I am (a future where current-graph and history publication genuinely converge, which would justify the shared crate now). If that's the intent, say so and I'll spec it properly. Three questions I'd need answered either way:
+
+1. **Crate name and scope** — `compass-partition`? Does it carry just the type, or the record-encoding helpers (`node_key`, `edge_key`, `hyperedge_key`, `canonical_json_bytes`) too?
+2. **Does it take the Prolly dependency?** If yes, `compass-graph` inherits it. If no, the encoding logic stays in history and the shared crate is nearly empty.
+3. **Identity semantics** — history fingerprints are meaning-affecting and realizations are immutable. If current-graph reuses the same record keys, do the two paths risk producing colliding or conflatable identities? AGENTS.md is strict here.
+
+Want me to spec the shared crate as you've directed, or run `/kbd-spec` on the streaming fix first and revisit this once the read path is honest?
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+- Captured: 2026-08-09T12:06:25.091241Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .prometheus/knowledge/wiki/index.md
+- .prometheus/knowledge/wiki/log.md
+- AGENTS.md
+- .kbd-orchestrator/
+- .prometheus/events.jsonl
+- .prometheus/knowledge/.prompt-snapshots/
+- .prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-session.md
+- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md
+- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md
+- .prometheus/knowledge/wiki/karpathy-session-15a46a623cf0e420.md
+- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md
+- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md
+- .prometheus/knowledge/wiki/karpathy-session-3383d6fb52bb5dce.md
+- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md
+- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md
+- .prometheus/knowledge/wiki/karpathy-session-7c287ce9b2192bd7.md
+- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md
+- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md
+- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md
+- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md
+- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md
+- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md
+- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md
diff --git a/.prometheus/knowledge/wiki/karpathy-session-e2c00470b2ce9770.md b/.prometheus/knowledge/wiki/karpathy-session-e2c00470b2ce9770.md
new file mode 100644
index 000000000..a602eb80c
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-e2c00470b2ce9770.md
@@ -0,0 +1,97 @@
+---
+type: SessionRecord
+id: karpathy-session-e2c00470b2ce9770
+title: Karpathy session e2c00470b2ce
+tags:
+- karpathy
+- session-learning
+sources:
+- session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+timestamp: 2026-08-09T12:27:38.259256+00:00
+created_at: 2026-08-09T12:27:38.259256+00:00
+updated_at: 2026-08-09T12:27:38.259256+00:00
+revision: 0
+---
+
+## Delta
+
+Completed kbd-plan — compass-scoping-and-bounds (step 0 of 6)
+
+## Plan written — 6 changes, 2 waves
+
+```
+Wave 1 (parallel)          Wave 2 (after C-001)
+├── C-001  read_snapshot   ├── C-004  env override   [HARD GATE]
+├── C-002  error message   └── C-005  compass-partition
+├── C-003  size estimate
+└── C-006  vendor/ policy
+```
+
+Backend is **OpenSpec** (`openspec/` present, `openspec_available: true`). No evolver cycle.
+
+**Apply C-001 first** — it's the only Wave 1 item that unblocks others, and the spec-stage audit shrank it from a streaming refactor to an API split.
+
+The adversarial pass found no surviving CRITICAL: the ordering error this stage exists to catch (C-004 before C-001) was already caught at spec, and is now enforced twice — by wave structure and by an inline gate on the change itself.
+
+**Two coupling risks worth watching:**
+
+- **C-002 ↔ C-004 share the error text.** C-002 must *omit* the `COMPASS_MAX_GRAPH_BYTES` mention (advertising a nonexistent override is the exact defect being fixed), then C-004 adds it. If C-004 slips, C-002's message stays permanently incomplete. Tracked rather than assumed.
+- **C-003 has testable criteria but no calibration data.** Measuring what actually dominates the 2 GiB is its *first task*, not an afterthought — otherwise it ships an invented heuristic.
+
+## One blocker stops execution outright
+
+**`/Volumes/Workspace` is still not mounted** — I re-checked at plan time. Every compiling command needs `CARGO_TARGET_DIR` beneath it, and AGENTS.md explicitly forbids falling back to a local `target/`. **Every acceptance checkbox in this plan is unverifiable until that volume is back.** The plan is complete and correct; it just isn't runnable yet.
+
+## I stopped short of one step
+
+Step 10 of the skill emits OpenSpec change structures — six `/opsx:new` invocations creating `openspec/changes/<id>/` directories with proposals. I've written the exact commands into `plan.md` but haven't run them, for two reasons: it's six new tracked directories in your repo, and creating scaffolding for changes that can't be verified yet may be premature. Say the word and I'll emit all six, or just C-001.
+
+Files written: `plan.md`, `current-waypoint.md`, `handoffs/plan.md`; waypoint at `plan_ready`, `progress.json` marked `plan_complete`.
+
+Still outstanding from earlier: two unpushed commits on `docs/claude-md`, and all of `.kbd-orchestrator/` untracked.
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+- Captured: 2026-08-09T12:27:37.267036Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .prometheus/knowledge/wiki/index.md
+- .prometheus/knowledge/wiki/log.md
+- AGENTS.md
+- .kbd-orchestrator/
+- .prometheus/events.jsonl
+- .prometheus/knowledge/.prompt-snapshots/
+- .prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-session.md
+- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md
+- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md
+- .prometheus/knowledge/wiki/karpathy-session-1371f12708207b52.md
+- .prometheus/knowledge/wiki/karpathy-session-15a46a623cf0e420.md
+- .prometheus/knowledge/wiki/karpathy-session-178be089fef7012d.md
+- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md
+- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md
+- .prometheus/knowledge/wiki/karpathy-session-3383d6fb52bb5dce.md
+- .prometheus/knowledge/wiki/karpathy-session-4301f5fbc8d2baa8.md
+- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md
+- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md
+- .prometheus/knowledge/wiki/karpathy-session-7c287ce9b2192bd7.md
+- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md
+- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md
+- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md
+- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md
+- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md
+- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md
+- .prometheus/knowledge/wiki/karpathy-session-cd330c925600f45f.md
+- .prometheus/knowledge/wiki/karpathy-session-f8f9c99266231745.md
+- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md
diff --git a/.prometheus/knowledge/wiki/karpathy-session-f8f9c99266231745.md b/.prometheus/knowledge/wiki/karpathy-session-f8f9c99266231745.md
new file mode 100644
index 000000000..201656b23
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-f8f9c99266231745.md
@@ -0,0 +1,99 @@
+---
+type: SessionRecord
+id: karpathy-session-f8f9c99266231745
+title: Karpathy session f8f9c9926623
+tags:
+- karpathy
+- session-learning
+sources:
+- session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+timestamp: 2026-08-09T12:06:26.689357+00:00
+created_at: 2026-08-09T12:06:26.689357+00:00
+updated_at: 2026-08-09T12:06:26.689357+00:00
+revision: 0
+---
+
+## Delta
+
+I have what I need to give you a straight answer — and it includes a correction to my own recommendation.
+
+## The doc comment tells you what this type is for
+
+```rust
+/// Deterministic typed records used to construct the five Prolly trees.
+pub struct PartitionedGraph { ... }
+```
+
+`PartitionedGraph` isn't a general-purpose partitioning abstraction. It's **the input format for Prolly tree construction** — history's immutable-storage engine. The struct body is plain `Vec<(Vec<u8>, Vec<u8>)>` and looks portable, but the meaning is history-specific.
+
+The producing logic confirms it. `into_partition` (`artifacts.rs:349-400+`) is entangled with concerns that don't exist on the current-graph path:
+
+| Dependency | Belongs to |
+|---|---|
+| `CompletionEvidence` | history realization completion |
+| `authoritative_sidecars` / `TRUSTED_GRAPH_CONTENT` | history provenance |
+| `AnalysisBundle`, `compass_ir::ProgramBundle` | `compass-analysis` / `compass-ir` |
+| `HistoryError` | history error taxonomy |
+| `prolly::{KeyBuilder, VersionedValue}` | Prolly storage |
+
+And the crate dependency sets diverge sharply. `compass-history` pulls `prolly-map`, `prolly-store-sqlite`, `compass-ir`, `compass-analysis`. `compass-graph` pulls none of those. A shared crate has to either carry that weight — forcing Prolly and IR onto the current-graph path, which contradicts the local-first minimal-dependency posture — or be gutted down to the struct alone.
+
+**If it's gutted to the struct alone, you've shared 9 lines of field declarations and left all 2,300 lines of actual logic behind.** That's not reuse.
+
+## What I'd do instead
+
+I over-indexed on "the mechanism exists" in the analysis. On closer reading, what exists is *history's* mechanism, and the shared-crate framing inherits a coupling that doesn't serve the current-graph path.
+
+The sequencing finding still stands and is the load-bearing one: **stream `load_active_snapshot` first**. That removes the actual constraint. Whether current-graph publication later adopts a record-partitioned format is a separate question that gets much easier to answer *after* the read path stops materializing 2 GiB — and it may not need `PartitionedGraph`'s shape at all, since it has no Prolly trees to feed.
+
+So I'd put the shared crate behind the streaming fix rather than in front of it.
+
+That said — you've made a call, and you may be seeing a longer arc than I am (a future where current-graph and history publication genuinely converge, which would justify the shared crate now). If that's the intent, say so and I'll spec it properly. Three questions I'd need answered either way:
+
+1. **Crate name and scope** — `compass-partition`? Does it carry just the type, or the record-encoding helpers (`node_key`, `edge_key`, `hyperedge_key`, `canonical_json_bytes`) too?
+2. **Does it take the Prolly dependency?** If yes, `compass-graph` inherits it. If no, the encoding logic stays in history and the shared crate is nearly empty.
+3. **Identity semantics** — history fingerprints are meaning-affecting and realizations are immutable. If current-graph reuses the same record keys, do the two paths risk producing colliding or conflatable identities? AGENTS.md is strict here.
+
+Want me to spec the shared crate as you've directed, or run `/kbd-spec` on the streaming fix first and revisit this once the read path is honest?
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+- Captured: 2026-08-09T12:05:04.010581Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .prometheus/knowledge/wiki/index.md
+- .prometheus/knowledge/wiki/log.md
+- AGENTS.md
+- .kbd-orchestrator/
+- .prometheus/events.jsonl
+- .prometheus/knowledge/.prompt-snapshots/
+- .prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-session.md
+- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md
+- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md
+- .prometheus/knowledge/wiki/karpathy-session-15a46a623cf0e420.md
+- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md
+- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md
+- .prometheus/knowledge/wiki/karpathy-session-3383d6fb52bb5dce.md
+- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md
+- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md
+- .prometheus/knowledge/wiki/karpathy-session-7c287ce9b2192bd7.md
+- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md
+- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md
+- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md
+- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md
+- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md
+- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md
+- .prometheus/knowledge/wiki/karpathy-session-cd330c925600f45f.md
+- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md
diff --git a/.prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md b/.prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md
new file mode 100644
index 000000000..b6460264c
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md
@@ -0,0 +1,66 @@
+---
+type: SessionRecord
+id: karpathy-session-f90cdbd5fafd1d1d
+title: Karpathy session f90cdbd5fafd
+tags:
+- karpathy
+- session-learning
+sources:
+- session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+timestamp: 2026-08-09T10:58:32.854406+00:00
+created_at: 2026-08-09T10:58:32.854406+00:00
+updated_at: 2026-08-09T10:58:32.854406+00:00
+revision: 0
+---
+
+## Delta
+
+Completed kbd-init — Compass
+
+Two files written to `.kbd-orchestrator/`:
+
+**`project.json`** — discovery results:
+
+| Field | Value | Source |
+|---|---|---|
+| name / description | Compass — "Native local-first knowledge graph engine…" | `Cargo.toml` `[workspace.package]` |
+| stack | Rust (Edition 2024, pinned 1.97.1) | `Cargo.toml` + `rust-toolchain.toml` |
+| spec_paths | `openspec/specs/*.md` | `openspec/` exists (just initialized, currently empty) |
+| openspec_available | `true` | — |
+| workspace | single-project (`workspace_file: null`) | no `.code-workspace` references compass |
+| planning / execution agents | `claude` / `claude, codex, opencode` | the tools we just configured |
+| active_phase | `null` | no phase defined yet |
+
+**`constraints.md`** — I did **not** use the template's defaults. Those are TypeScript-oriented (`no-console-log`, `no-any-type`, `grep src/`) and would be inert in a Rust workspace with no `src/` at root. Instead I derived constraints from AGENTS.md: 16 blocking (unsafe/unwrap/expect/panic lints, product boundary vs. Graphify, local-first preservation, determinism, boundedness, immutable realizations, viewer-asset generation) and 17 warning (ownership boundary, extractor/resolver separation, compatibility documentation, the CompassQL and code-graph gates).
+
+**One thing needs your attention before any KBD phase runs a command:**
+
+`/Volumes/Workspace` **is not currently mounted** — only `Macintosh HD`, `my-passport`, and `Open Design` are. Every build/test/lint command in `project.json` sets `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main`, per the AGENTS.md mandate. As written, they'll fail until that volume is attached — which is the correct behavior, since AGENTS.md says to stop and report rather than fall back to a local `target/` on the 100 GB-capped main disk. I encoded the rule faithfully rather than silently substituting a working-but-wrong path.
+
+Also worth noting: `openspec/specs/` is empty, so `spec_paths` currently resolves to nothing. That's expected for a fresh init — specs appear once you run `/opsx:new`.
+
+These two files are untracked and uncommitted, separate from the two commits already on `docs/claude-md`. Next step is `/kbd-status` to confirm, then `/kbd-new-phase <name>` to start the first phase.
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+- Captured: 2026-08-09T10:58:29.463044Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .prometheus/knowledge/wiki/index.md
+- .prometheus/knowledge/wiki/log.md
+- .kbd-orchestrator/
+- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md
+- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md
+- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md
diff --git a/.prometheus/knowledge/wiki/log.md b/.prometheus/knowledge/wiki/log.md
index 65ffc6d8e..2cc1e268a 100644
--- a/.prometheus/knowledge/wiki/log.md
+++ b/.prometheus/knowledge/wiki/log.md
@@ -1,6 +1,31 @@
 # Update Log
 
 ## 2026-08-09
+* **Ingest**: [Karpathy session ca329344b0f1](/karpathy-session-ca329344b0f175d8.md)
+* **Ingest**: [Karpathy session e2c00470b2ce](/karpathy-session-e2c00470b2ce9770.md)
+* **Ingest**: [Karpathy session 1371f1270820](/karpathy-session-1371f12708207b52.md)
+* **Ingest**: [Karpathy session 4301f5fbc8d2](/karpathy-session-4301f5fbc8d2baa8.md)
+* **Creation**: [Compass scoping and bounds executor session](/compass-scoping-and-bounds-executor-session.md)
+* **Ingest**: [Karpathy session 178be089fef7](/karpathy-session-178be089fef7012d.md)
+* **Ingest**: [Karpathy session f8f9c9926623](/karpathy-session-f8f9c99266231745.md)
+* **Ingest**: [Karpathy session cd330c925600](/karpathy-session-cd330c925600f45f.md)
+* **Creation**: [Compass scoping and bounds executor session](/compass-scoping-and-bounds-executor-session.md)
+* **Ingest**: [Karpathy session 3383d6fb52bb](/karpathy-session-3383d6fb52bb5dce.md)
+* **Ingest**: [Karpathy session 7c287ce9b219](/karpathy-session-7c287ce9b2192bd7.md)
+* **Ingest**: [Karpathy session 15a46a623cf0](/karpathy-session-15a46a623cf0e420.md)
+* **Ingest**: [Karpathy session 309fba26769d](/karpathy-session-309fba26769d26dc.md)
+* **Ingest**: [Karpathy session 8f202396ae56](/karpathy-session-8f202396ae5617a5.md)
+* **Ingest**: [Karpathy session 8b2e071dd73e](/karpathy-session-8b2e071dd73e1374.md)
+* **Ingest**: [Karpathy session 06cdf26d86b0](/karpathy-session-06cdf26d86b0c087.md)
+* **Ingest**: [Karpathy session 19802b94100a](/karpathy-session-19802b94100a3ab3.md)
+* **Ingest**: [Karpathy session 9354b74ff258](/karpathy-session-9354b74ff25823d0.md)
+* **Ingest**: [Karpathy session 0c2a62b22721](/karpathy-session-0c2a62b22721a70c.md)
+* **Ingest**: [Karpathy session 762f04f1710f](/karpathy-session-762f04f1710fc991.md)
+* **Ingest**: [Karpathy session 6aacc8d765a1](/karpathy-session-6aacc8d765a1b28f.md)
+* **Ingest**: [Karpathy session f90cdbd5fafd](/karpathy-session-f90cdbd5fafd1d1d.md)
+* **Ingest**: [Karpathy session b0a4e7ceb012](/karpathy-session-b0a4e7ceb012e58d.md)
+* **Ingest**: [Karpathy session b6f086fb31ed](/karpathy-session-b6f086fb31ed31c5.md)
+* **Ingest**: [Karpathy session b5d49ca1d46e](/karpathy-session-b5d49ca1d46e60a2.md)
 * **Ingest**: [Karpathy session a0b489beb0d3](/karpathy-session-a0b489beb0d312d9.md)
 * **Ingest**: [Karpathy session bb64c62e88af](/karpathy-session-bb64c62e88af6029.md)
 * **Ingest**: [Karpathy session 199d5165acd7](/karpathy-session-199d5165acd78a00.md)
diff --git a/AGENTS.md b/AGENTS.md
index 3fb278548..38375e587 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -70,6 +70,15 @@ normal verification. Before using packaging, install, or release targets,
 inspect the target and ensure its artifact lookup also points at the selected
 external directory; never allow it to trigger a second local build silently.
 
+## Prometheus state ownership
+
+`.prometheus/knowledge/wiki/**` is repository-owned project knowledge and must
+remain tracked, including generated session transcripts and their embedded
+machine-specific project paths. Treat every other `.prometheus/**` path as local
+runtime or tooling state unless a repository rule or explicit user instruction
+classifies that path as tracked content. Never discard or exclude the wiki merely
+because it lives beneath a hidden tooling directory.
+
 ## Product invariants
 
 - Compass is a native, local-first Rust product. Structural extraction and

From 5bd14cd4cc4faca0bc3fe59b8b607c557d151f40 Mon Sep 17 00:00:00 2001
From: Travis James <travis@tribehealthsolutions.com>
Date: Sun, 9 Aug 2026 07:41:27 -0500
Subject: [PATCH 4/6] fix: remove hardcoded /Volumes/Workspace build-volume
 requirement
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

AGENTS.md mandated that every compiling Cargo command set CARGO_TARGET_DIR
beneath /Volumes/Workspace/crabbuild-target, and stop rather than fall back to
a local target/ when that volume was absent. The path describes one
contributor's machine; it is not a property of the project. On any checkout
without that volume the rule blocks all verification.

Introduced in dd14b3ce ("docs: add AI contributor guidance"). Still present
upstream on crabbuild/compass at merge time.

Two of the references were executable, not advisory:

- scripts/qualify_compass_store_release.sh hard-failed with exit 1 unless
  /Volumes/Workspace was mounted and writable, making the store qualification
  gate unrunnable elsewhere;
- both qualification scripts defaulted CARGO_TARGET_DIR to that path, silently
  writing outside the checkout.

Replace the mandate with environment-neutral guidance that keeps the useful
parts — per-checkout target directories, CARGO_TARGET_DIR not persisting
between invocations, external qualification repositories treated as read-only.
Scripts now honor CARGO_TARGET_DIR when set and fall back to the checkout's own
target directory. Documentation uses <cargo-target-dir> and
<qualification-corpus-root> placeholders.

Regenerates the KBD orchestrator commands and clears the phase artifacts'
environment blocker, which derived from the removed rule.

Historical .prometheus session transcripts are left unmodified; they record
what was true when written.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .kbd-orchestrator/constraints.md              |  9 +--
 .kbd-orchestrator/current-waypoint.md         |  3 -
 .../handoffs/plan.md                          |  4 +-
 .../handoffs/spec.md                          |  5 --
 .../phases/compass-scoping-and-bounds/plan.md | 12 +---
 .../phases/compass-scoping-and-bounds/spec.md |  2 -
 .kbd-orchestrator/project.json                |  7 +-
 .prometheus/knowledge/wiki/index.md           |  5 ++
 .../wiki/karpathy-session-6ee868a466335f1d.md | 55 ++++++++++++++
 .../wiki/karpathy-session-7da9adb3b7b11504.md | 56 +++++++++++++++
 .../wiki/karpathy-session-8cd321cc802fed9d.md | 53 ++++++++++++++
 .../wiki/karpathy-session-b1a29789942105c1.md | 57 +++++++++++++++
 .../wiki/karpathy-session-badb024212b1a395.md | 58 +++++++++++++++
 .prometheus/knowledge/wiki/log.md             |  5 ++
 AGENTS.md                                     | 71 +++++++------------
 CLAUDE.md                                     | 31 ++++----
 PERFORMANCE.md                                | 12 ++--
 advisor-plans/006-harden-media-ingestion.md   | 12 ++--
 .../007-versioned-document-artifact.md        | 10 +--
 advisor-plans/008-lossless-document-fusion.md | 12 ++--
 advisor-plans/009-structural-markdown-html.md | 14 ++--
 advisor-plans/010-native-ooxml-documents.md   | 10 +--
 advisor-plans/011-bounded-native-rtf.md       | 12 ++--
 .../012-document-qualification-gate.md        | 12 ++--
 ...013-typescript-javascript-graph-quality.md | 20 +++---
 benchmarks/performance/README.md              |  8 +--
 benchmarks/performance/oracles/README.md      | 19 +++--
 docs/design/code-graph-v1-qualification.md    |  2 +-
 docs/implementation/compass-store-plan.md     | 24 +++----
 ...olution-framework-phased-execution-plan.md | 17 ++---
 ...accuracy-recall-phased-technical-design.md |  2 +-
 .../2026-07-23-extraction-superset-parity.md  |  6 +-
 ...2026-07-24-actionable-semantic-diff-mvp.md |  6 +-
 .../2026-07-24-semantic-delta-phase-0-1.md    |  2 +-
 ...-07-25-versioned-history-sub-two-second.md |  2 +-
 ...7-30-best-effort-code-graph-publication.md | 32 ++++-----
 ...st-effort-heavy-framework-qualification.md |  4 +-
 .../2026-07-23-history-build-all-design.md    |  2 +-
 scripts/qualify_code_graph_v1.sh              |  7 +-
 scripts/qualify_compass_store_release.sh      |  6 +-
 skills/compass-release/SKILL.md               |  9 ++-
 41 files changed, 454 insertions(+), 241 deletions(-)
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-6ee868a466335f1d.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-7da9adb3b7b11504.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-8cd321cc802fed9d.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-b1a29789942105c1.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-badb024212b1a395.md

diff --git a/.kbd-orchestrator/constraints.md b/.kbd-orchestrator/constraints.md
index ead5b1705..357cd015f 100644
--- a/.kbd-orchestrator/constraints.md
+++ b/.kbd-orchestrator/constraints.md
@@ -6,11 +6,6 @@ invariants, Rust conventions, tests and fixtures) and `docs/design/principles.md
 `AGENTS.md` remains authoritative. This file encodes the machine-checkable
 subset for automated verification; it does not replace the completion checklist.
 
-> **Every command below that can compile must run with `CARGO_TARGET_DIR` set**
-> to `/Volumes/Workspace/crabbuild-target/compass-main` (or the per-worktree
-> equivalent). The main disk is capped at 100 GB. If `/Volumes/Workspace` is not
-> mounted, stop and report — never fall back to a local `target/`.
-
 ---
 
 ## Blocking Constraints (prevent archiving until resolved)
@@ -120,7 +115,7 @@ constraints:
 - id: compassql-gates
   severity: warning
   description: 'CompassQL grammar, execution, or support claims run their gates'
-  command: 'CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo test -p compass-cypher --test tck --locked && CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo test -p compass-query --test opencypher_tck --locked && python3 scripts/check_compassql_support.py'
+  command: 'cargo test -p compass-cypher --test tck --locked && cargo test -p compass-query --test opencypher_tck --locked && python3 scripts/check_compassql_support.py'
 
 - id: code-graph-qualification
   severity: warning
@@ -135,7 +130,7 @@ constraints:
 - id: cli-product-contract
   severity: warning
   description: 'Public CLI or product identity changes run the product contract test'
-  command: 'CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo test -p compass-cli --test compass_product --locked'
+  command: 'cargo test -p compass-cli --test compass_product --locked'
 
 - id: ambiguity-and-negative-cases
   severity: warning
diff --git a/.kbd-orchestrator/current-waypoint.md b/.kbd-orchestrator/current-waypoint.md
index 0c991a3de..bd94fea14 100644
--- a/.kbd-orchestrator/current-waypoint.md
+++ b/.kbd-orchestrator/current-waypoint.md
@@ -12,9 +12,6 @@ Owner: `compass-store`. Wave 1. Unblocks C-004 and C-005.
 
 ## Blockers
 
-- **/Volumes/Workspace is NOT mounted.** Every compiling command requires
-  CARGO_TARGET_DIR beneath it; AGENTS.md forbids falling back to a local target/.
-  No change can be verified until this is resolved.
 - Identity/namespacing decision blocks C-005 *adoption* (not extraction).
 
 ## Waves
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/handoffs/plan.md b/.kbd-orchestrator/phases/compass-scoping-and-bounds/handoffs/plan.md
index 46f82773d..924dfcd85 100644
--- a/.kbd-orchestrator/phases/compass-scoping-and-bounds/handoffs/plan.md
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/handoffs/plan.md
@@ -25,12 +25,10 @@ sequenced after C-001 so the extraction happens against an honest read path.
   it. If C-004 slips, C-002's message stays permanently incomplete — track explicitly.
 - C-005's dependency rule (no prolly-map / prolly-store-sqlite / compass-ir /
   compass-analysis) is a stop-and-report gate, not a preference.
-- Every acceptance box is unverifiable while /Volumes/Workspace is unmounted.
 
 ## Blockers
 
-1. **/Volumes/Workspace NOT mounted** — blocks all verification. Re-checked at plan time.
-2. Identity/namespacing for shared record keys — blocks C-005 adoption, not extraction.
+1. Identity/namespacing for shared record keys — blocks C-005 adoption, not extraction.
 
 ## Unmeasured
 
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/handoffs/spec.md b/.kbd-orchestrator/phases/compass-scoping-and-bounds/handoffs/spec.md
index 163947bd8..9d352c60f 100644
--- a/.kbd-orchestrator/phases/compass-scoping-and-bounds/handoffs/spec.md
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/handoffs/spec.md
@@ -37,8 +37,3 @@ decision below.
 2. Payload composition unmeasured — blocks C-003 calibration.
 3. Untested: whether --exclude on universal-agent-runtime lands under 2 GiB.
 
-## Environment blocker
-
-/Volumes/Workspace is NOT mounted. Every compiling command requires
-CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main. Execution cannot
-verify anything until that volume is available.
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/plan.md b/.kbd-orchestrator/phases/compass-scoping-and-bounds/plan.md
index 7242cf65c..f56398e82 100644
--- a/.kbd-orchestrator/phases/compass-scoping-and-bounds/plan.md
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/plan.md
@@ -153,13 +153,6 @@ deliver it. That is a further change requiring the identity decision below.
 
 ## Blocked before execution
 
-### Environment — blocks all verification
-
-`/Volumes/Workspace` is **not mounted** (re-checked at plan time). Every compiling command
-requires `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main`. Per AGENTS.md,
-falling back to a local `target/` is forbidden — stop and report instead. **No change can be
-verified until that volume is available.**
-
 ### Decision — blocks C-005 adoption (not extraction)
 
 Identity/namespacing for shared record keys. History fingerprints are meaning-affecting and
@@ -191,5 +184,6 @@ change itself.
   C-004 must add it. If C-004 slips, C-002's message stays permanently incomplete — track
   it rather than assuming the follow-up happens.
 - C-005's dependency rule is a stop-and-report gate, not a preference.
-- Every "done when" box is unverifiable while `/Volumes/Workspace` is unmounted. This plan
-  is executable only after that is resolved.
+- The earlier "environment blocker" in this plan was withdrawn: it derived from an
+  AGENTS.md rule hardcoding one contributor's mount path, which has since been removed.
+  Builds run with ordinary Cargo defaults.
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/spec.md b/.kbd-orchestrator/phases/compass-scoping-and-bounds/spec.md
index fe8ae0833..e6770ae85 100644
--- a/.kbd-orchestrator/phases/compass-scoping-and-bounds/spec.md
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/spec.md
@@ -219,8 +219,6 @@ C-002, C-003, C-006  — independent, parallel with C-001
 
 Per `.kbd-orchestrator/constraints.md` and AGENTS.md:
 
-- `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main` on every compiling
-  command. **`/Volumes/Workspace` is not currently mounted** — verify before execution.
 - No `unsafe`; no `unwrap_used` / `expect_used` / `panic`.
 - Determinism: `BTreeMap`/`BTreeSet` or explicit sorting at contract boundaries.
 - Bounded work: a limit error stays distinct from an empty result.
diff --git a/.kbd-orchestrator/project.json b/.kbd-orchestrator/project.json
index 7baa109c0..c9117da62 100644
--- a/.kbd-orchestrator/project.json
+++ b/.kbd-orchestrator/project.json
@@ -11,10 +11,9 @@
   ],
   "openspec_available": true,
   "constraint_file": ".kbd-orchestrator/constraints.md",
-  "__command_note": "AGENTS.md requires CARGO_TARGET_DIR on EVERY invocation that can compile; the main disk is capped at 100 GB and each checkout/worktree needs its own target directory. Never share one across repositories or concurrent worktrees. If /Volumes/Workspace is unmounted, stop and report rather than falling back to a local target/.",
-  "build_health_command": "CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo check --workspace --locked",
-  "test_command": "CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo test --workspace --lib --bins --locked",
-  "lint_command": "CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo clippy --workspace --lib --bins --locked -- -D warnings",
+  "build_health_command": "cargo check --workspace --locked",
+  "test_command": "cargo test --workspace --lib --bins --locked",
+  "lint_command": "cargo clippy --workspace --lib --bins --locked -- -D warnings",
   "dev_command": null,
   "preferred_planning_agent": "claude",
   "preferred_execution_agents": [
diff --git a/.prometheus/knowledge/wiki/index.md b/.prometheus/knowledge/wiki/index.md
index b2339db56..a2f433c29 100644
--- a/.prometheus/knowledge/wiki/index.md
+++ b/.prometheus/knowledge/wiki/index.md
@@ -19,18 +19,23 @@
 * [Karpathy session 3383d6fb52bb](/karpathy-session-3383d6fb52bb5dce.md)
 * [Karpathy session 4301f5fbc8d2](/karpathy-session-4301f5fbc8d2baa8.md)
 * [Karpathy session 6aacc8d765a1](/karpathy-session-6aacc8d765a1b28f.md)
+* [Karpathy session 6ee868a46633](/karpathy-session-6ee868a466335f1d.md)
 * [Karpathy session 7521e456ead1](/karpathy-session-7521e456ead1ce12.md)
 * [Karpathy session 762f04f1710f](/karpathy-session-762f04f1710fc991.md)
 * [Karpathy session 7c287ce9b219](/karpathy-session-7c287ce9b2192bd7.md)
+* [Karpathy session 7da9adb3b7b1](/karpathy-session-7da9adb3b7b11504.md)
 * [Karpathy session 85be47bbe3d4](/karpathy-session-85be47bbe3d4faec.md)
 * [Karpathy session 8b2e071dd73e](/karpathy-session-8b2e071dd73e1374.md)
+* [Karpathy session 8cd321cc802f](/karpathy-session-8cd321cc802fed9d.md)
 * [Karpathy session 8f202396ae56](/karpathy-session-8f202396ae5617a5.md)
 * [Karpathy session 9354b74ff258](/karpathy-session-9354b74ff25823d0.md)
 * [Karpathy session 95e26dce31a6](/karpathy-session-95e26dce31a612a2.md)
 * [Karpathy session a0b489beb0d3](/karpathy-session-a0b489beb0d312d9.md)
 * [Karpathy session b0a4e7ceb012](/karpathy-session-b0a4e7ceb012e58d.md)
+* [Karpathy session b1a297899421](/karpathy-session-b1a29789942105c1.md)
 * [Karpathy session b5d49ca1d46e](/karpathy-session-b5d49ca1d46e60a2.md)
 * [Karpathy session b6f086fb31ed](/karpathy-session-b6f086fb31ed31c5.md)
+* [Karpathy session badb024212b1](/karpathy-session-badb024212b1a395.md)
 * [Karpathy session bb64c62e88af](/karpathy-session-bb64c62e88af6029.md)
 * [Karpathy session c13ff840014c](/karpathy-session-c13ff840014cf2b3.md)
 * [Karpathy session ca329344b0f1](/karpathy-session-ca329344b0f175d8.md)
diff --git a/.prometheus/knowledge/wiki/karpathy-session-6ee868a466335f1d.md b/.prometheus/knowledge/wiki/karpathy-session-6ee868a466335f1d.md
new file mode 100644
index 000000000..f25d3d726
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-6ee868a466335f1d.md
@@ -0,0 +1,55 @@
+---
+type: SessionRecord
+id: karpathy-session-6ee868a466335f1d
+title: Karpathy session 6ee868a46633
+tags:
+- karpathy
+- session-learning
+sources:
+- session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+timestamp: 2026-08-09T12:31:50.167151+00:00
+created_at: 2026-08-09T12:31:50.167151+00:00
+updated_at: 2026-08-09T12:31:50.167151+00:00
+revision: 0
+---
+
+## Delta
+
+It's from `AGENTS.md` lines 24–56, committed in your repo — "Disk and external-checkout policy." It's not something I invented.
+
+The rule says the main disk is capped at 100 GB, so Cargo artifacts must go on a mounted workspace volume, with the literal example path `/Volumes/Workspace/crabbuild-target/compass-main`. And explicitly: *"If `/Volumes/Workspace` is unavailable, stop and report it rather than falling back to a local `target/` directory."*
+
+That's why I kept checking it and kept flagging it as a blocker — the policy tells me to stop rather than build locally.
+
+Currently mounted: `Macintosh HD`, `my-passport`, `Open Design`. No `Workspace`.
+
+So one of these is true, and only you know which:
+
+- **The volume is just detached** — plug it in and the rule works as written.
+- **It got renamed** (`my-passport`? something else?) — then `AGENTS.md` has a stale path and should be corrected.
+- **The whole policy is obsolete** — maybe disk pressure was resolved and this rule outlived its purpose. Note the wiki transcripts from earlier today mention reclaiming ~10.1 GB and fixing sccache config, so something in this area did change recently.
+
+If it's stale or obsolete, `AGENTS.md` is the fix — and I'd want that corrected before execution, because I baked those paths into `.kbd-orchestrator/project.json` and `constraints.md`, which are now committed. Every build/test/lint command there points at `/Volumes/Workspace`.
+
+Which is it? If you tell me the volume is gone for good, I'll update `AGENTS.md`, `project.json`, and `constraints.md` together so they stop referencing a path that doesn't exist.
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+- Captured: 2026-08-09T12:31:22.016671Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .prometheus/knowledge/wiki/index.md
+- .prometheus/knowledge/wiki/log.md
+- .prometheus/knowledge/wiki/karpathy-session-badb024212b1a395.md
diff --git a/.prometheus/knowledge/wiki/karpathy-session-7da9adb3b7b11504.md b/.prometheus/knowledge/wiki/karpathy-session-7da9adb3b7b11504.md
new file mode 100644
index 000000000..2155c45b5
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-7da9adb3b7b11504.md
@@ -0,0 +1,56 @@
+---
+type: SessionRecord
+id: karpathy-session-7da9adb3b7b11504
+title: Karpathy session 7da9adb3b7b1
+tags:
+- karpathy
+- session-learning
+sources:
+- session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+timestamp: 2026-08-09T12:31:50.620113+00:00
+created_at: 2026-08-09T12:31:50.620113+00:00
+updated_at: 2026-08-09T12:31:50.620113+00:00
+revision: 0
+---
+
+## Delta
+
+It's from `AGENTS.md` lines 24–56, committed in your repo — "Disk and external-checkout policy." It's not something I invented.
+
+The rule says the main disk is capped at 100 GB, so Cargo artifacts must go on a mounted workspace volume, with the literal example path `/Volumes/Workspace/crabbuild-target/compass-main`. And explicitly: *"If `/Volumes/Workspace` is unavailable, stop and report it rather than falling back to a local `target/` directory."*
+
+That's why I kept checking it and kept flagging it as a blocker — the policy tells me to stop rather than build locally.
+
+Currently mounted: `Macintosh HD`, `my-passport`, `Open Design`. No `Workspace`.
+
+So one of these is true, and only you know which:
+
+- **The volume is just detached** — plug it in and the rule works as written.
+- **It got renamed** (`my-passport`? something else?) — then `AGENTS.md` has a stale path and should be corrected.
+- **The whole policy is obsolete** — maybe disk pressure was resolved and this rule outlived its purpose. Note the wiki transcripts from earlier today mention reclaiming ~10.1 GB and fixing sccache config, so something in this area did change recently.
+
+If it's stale or obsolete, `AGENTS.md` is the fix — and I'd want that corrected before execution, because I baked those paths into `.kbd-orchestrator/project.json` and `constraints.md`, which are now committed. Every build/test/lint command there points at `/Volumes/Workspace`.
+
+Which is it? If you tell me the volume is gone for good, I'll update `AGENTS.md`, `project.json`, and `constraints.md` together so they stop referencing a path that doesn't exist.
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+- Captured: 2026-08-09T12:31:25.361399Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .prometheus/knowledge/wiki/index.md
+- .prometheus/knowledge/wiki/log.md
+- .prometheus/knowledge/wiki/karpathy-session-6ee868a466335f1d.md
+- .prometheus/knowledge/wiki/karpathy-session-badb024212b1a395.md
diff --git a/.prometheus/knowledge/wiki/karpathy-session-8cd321cc802fed9d.md b/.prometheus/knowledge/wiki/karpathy-session-8cd321cc802fed9d.md
new file mode 100644
index 000000000..971cec610
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-8cd321cc802fed9d.md
@@ -0,0 +1,53 @@
+---
+type: SessionRecord
+id: karpathy-session-8cd321cc802fed9d
+title: Karpathy session 8cd321cc802f
+tags:
+- karpathy
+- session-learning
+sources:
+- session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+timestamp: 2026-08-09T12:32:13.511112+00:00
+created_at: 2026-08-09T12:32:13.511112+00:00
+updated_at: 2026-08-09T12:32:13.511112+00:00
+revision: 0
+---
+
+## Delta
+
+**It was in the original `AGENTS.md`.** Not the skill pack, not me.
+
+- Introduced in commit `dd14b3ce`, *"docs: add AI contributor guidance"*, on **2026-08-01** by **forhappy** — eight days before this session.
+- Present at `57b9fe28`, the commit this session started from, with 7 occurrences of `/Volumes/Workspace`.
+
+The only `AGENTS.md` change during this session was the Prometheus state-ownership section — 9 lines, added by you, entirely about `.prometheus/` paths. The disk policy was untouched.
+
+So the chain is: `AGENTS.md` mandated it → I applied it when generating `.kbd-orchestrator/project.json` and `constraints.md` during `/kbd-init` → the KBD `kbd-init` skill's own guidance reinforces it ("Read `AGENTS.md`… for mandatory command wrappers, environment variables, toolchain selectors, and storage paths… Treat a command policy as transitive"). But the *source* of the path is your repo's committed contributor guidance from a week ago.
+
+Which raises the real question: **does that volume actually exist on your machine, or is `dd14b3ce` describing someone else's setup?** `forhappy` isn't the git user configured here (that's Travis James). If this guidance came from a different contributor's environment, the path may never have been valid for you — which would make it a stale rule in `AGENTS.md`, not a missing drive.
+
+If that's the case, the fix is to correct `AGENTS.md` first, then regenerate `project.json` and `constraints.md` from it. Want me to look at what that section should say for your actual setup?
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+- Captured: 2026-08-09T12:32:12.077290Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .prometheus/knowledge/wiki/index.md
+- .prometheus/knowledge/wiki/log.md
+- .prometheus/knowledge/wiki/karpathy-session-6ee868a466335f1d.md
+- .prometheus/knowledge/wiki/karpathy-session-7da9adb3b7b11504.md
+- .prometheus/knowledge/wiki/karpathy-session-b1a29789942105c1.md
+- .prometheus/knowledge/wiki/karpathy-session-badb024212b1a395.md
diff --git a/.prometheus/knowledge/wiki/karpathy-session-b1a29789942105c1.md b/.prometheus/knowledge/wiki/karpathy-session-b1a29789942105c1.md
new file mode 100644
index 000000000..ffeedfd43
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-b1a29789942105c1.md
@@ -0,0 +1,57 @@
+---
+type: SessionRecord
+id: karpathy-session-b1a29789942105c1
+title: Karpathy session b1a297899421
+tags:
+- karpathy
+- session-learning
+sources:
+- session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+timestamp: 2026-08-09T12:31:51.013497+00:00
+created_at: 2026-08-09T12:31:51.013497+00:00
+updated_at: 2026-08-09T12:31:51.013497+00:00
+revision: 0
+---
+
+## Delta
+
+It's from `AGENTS.md` lines 24–56, committed in your repo — "Disk and external-checkout policy." It's not something I invented.
+
+The rule says the main disk is capped at 100 GB, so Cargo artifacts must go on a mounted workspace volume, with the literal example path `/Volumes/Workspace/crabbuild-target/compass-main`. And explicitly: *"If `/Volumes/Workspace` is unavailable, stop and report it rather than falling back to a local `target/` directory."*
+
+That's why I kept checking it and kept flagging it as a blocker — the policy tells me to stop rather than build locally.
+
+Currently mounted: `Macintosh HD`, `my-passport`, `Open Design`. No `Workspace`.
+
+So one of these is true, and only you know which:
+
+- **The volume is just detached** — plug it in and the rule works as written.
+- **It got renamed** (`my-passport`? something else?) — then `AGENTS.md` has a stale path and should be corrected.
+- **The whole policy is obsolete** — maybe disk pressure was resolved and this rule outlived its purpose. Note the wiki transcripts from earlier today mention reclaiming ~10.1 GB and fixing sccache config, so something in this area did change recently.
+
+If it's stale or obsolete, `AGENTS.md` is the fix — and I'd want that corrected before execution, because I baked those paths into `.kbd-orchestrator/project.json` and `constraints.md`, which are now committed. Every build/test/lint command there points at `/Volumes/Workspace`.
+
+Which is it? If you tell me the volume is gone for good, I'll update `AGENTS.md`, `project.json`, and `constraints.md` together so they stop referencing a path that doesn't exist.
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+- Captured: 2026-08-09T12:30:02.796796Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .prometheus/knowledge/wiki/index.md
+- .prometheus/knowledge/wiki/log.md
+- .prometheus/knowledge/wiki/karpathy-session-6ee868a466335f1d.md
+- .prometheus/knowledge/wiki/karpathy-session-7da9adb3b7b11504.md
+- .prometheus/knowledge/wiki/karpathy-session-badb024212b1a395.md
diff --git a/.prometheus/knowledge/wiki/karpathy-session-badb024212b1a395.md b/.prometheus/knowledge/wiki/karpathy-session-badb024212b1a395.md
new file mode 100644
index 000000000..4f391c8fb
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-badb024212b1a395.md
@@ -0,0 +1,58 @@
+---
+type: SessionRecord
+id: karpathy-session-badb024212b1a395
+title: Karpathy session badb024212b1
+tags:
+- karpathy
+- session-learning
+sources:
+- session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+timestamp: 2026-08-09T12:30:00.586013+00:00
+created_at: 2026-08-09T12:30:00.586013+00:00
+updated_at: 2026-08-09T12:30:00.586013+00:00
+revision: 0
+---
+
+## Delta
+
+Committed as `eced6dec` — 48 files, 4,679 insertions. Working tree is clean.
+
+Three commits now on `docs/claude-md`:
+
+| Commit | Contents |
+|---|---|
+| `dd7679fb` | `docs: add CLAUDE.md agent guide` — 1 file |
+| `c349fdf6` | `chore: track Prometheus wiki and initialize OpenSpec` — 73 files |
+| `eced6dec` | `chore(kbd): track orchestrator state and Prometheus knowledge` — 48 files |
+
+**What landed in this one:**
+- **`.kbd-orchestrator/`** — all 17 files: `project.json`, `constraints.md`, the six phase artifacts for `compass-scoping-and-bounds`, three stage handoffs, both machine contracts, and the waypoint at `plan_ready`.
+- **`.prometheus/`** — 24 new wiki transcripts (grown from 10 during this session), `events.jsonl`, and the prompt snapshots.
+- **`AGENTS.md`** — the Prometheus state ownership rule.
+
+Two things worth noting:
+
+**Your `AGENTS.md` edit settled the question I raised earlier.** It now explicitly classifies `.prometheus/knowledge/wiki/**` as repository-owned tracked content "including generated session transcripts and their embedded machine-specific project paths." That's a repository rule authorizing exactly what I'd flagged as a concern, so the earlier objection is resolved on the record rather than just overridden.
+
+**I scanned before staging** — ran a pattern check for API keys, tokens, and private key headers across both new directories. Nothing matched. `.claude/settings.local.json` stayed untracked, protected by your global gitignore.
+
+Nothing is pushed. The branch is three commits ahead of `main`, and `/Volumes/Workspace` is still unmounted, so C-001 can't be verified yet. Say the word and I'll push and open a PR.
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+- Captured: 2026-08-09T12:29:59.534218Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- No changed paths detected.
diff --git a/.prometheus/knowledge/wiki/log.md b/.prometheus/knowledge/wiki/log.md
index 2cc1e268a..164f96f3f 100644
--- a/.prometheus/knowledge/wiki/log.md
+++ b/.prometheus/knowledge/wiki/log.md
@@ -1,6 +1,11 @@
 # Update Log
 
 ## 2026-08-09
+* **Ingest**: [Karpathy session 8cd321cc802f](/karpathy-session-8cd321cc802fed9d.md)
+* **Ingest**: [Karpathy session b1a297899421](/karpathy-session-b1a29789942105c1.md)
+* **Ingest**: [Karpathy session 7da9adb3b7b1](/karpathy-session-7da9adb3b7b11504.md)
+* **Ingest**: [Karpathy session 6ee868a46633](/karpathy-session-6ee868a466335f1d.md)
+* **Ingest**: [Karpathy session badb024212b1](/karpathy-session-badb024212b1a395.md)
 * **Ingest**: [Karpathy session ca329344b0f1](/karpathy-session-ca329344b0f175d8.md)
 * **Ingest**: [Karpathy session e2c00470b2ce](/karpathy-session-e2c00470b2ce9770.md)
 * **Ingest**: [Karpathy session 1371f1270820](/karpathy-session-1371f12708207b52.md)
diff --git a/AGENTS.md b/AGENTS.md
index 38375e587..f099466ad 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -21,54 +21,33 @@ Before editing:
 `CONTRIBUTING.md` is the canonical human contribution guide. The design rules
 behind this file live in `docs/design/principles.md`.
 
-## Disk and external-checkout policy
-
-The main disk is limited to 100 GB. Rust build artifacts and repositories used
-for real-repository code-graph qualification belong on the mounted workspace
-volume, not in this checkout or the main disk.
-
-- Before any Cargo command that can compile (`build`, `check`, `test`,
-  `clippy`, `bench`, `doc`, `install`, `package`, or a Make target that invokes
-  one), set `CARGO_TARGET_DIR` beneath `/Volumes/Workspace/crabbuild-target`.
-- Every repository checkout and worktree must have its own target directory.
-  Never share one Cargo target directory between different repositories or
-  concurrent worktrees: feature sets, build scripts, and locks can collide.
-- Use a stable, descriptive directory such as
-  `/Volumes/Workspace/crabbuild-target/compass-main` for this checkout and
-  `/Volumes/Workspace/crabbuild-target/compass-<worktree-name>` for another
-  Compass worktree. For another repository, include that repository and
-  checkout/worktree name.
-- Set the variable on every new shell/tool invocation; do not assume an export
-  from an earlier command persists. For example:
-
-  ```bash
-  CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main \
-    cargo test -p compass-model --locked
-  ```
-
-- Verify the volume is mounted and the chosen directory is writable before a
-  long build. Create only the specific per-checkout directory needed. If
-  `/Volumes/Workspace` is unavailable, stop and report it rather than falling
-  back to a local `target/` directory.
-- Do not delete, clean, or reuse another repository's target directory. Run
-  `cargo clean` only with the intended `CARGO_TARGET_DIR` explicitly set and
-  only when the task actually requires reclaiming or invalidating those
-  artifacts.
-- Find repositories used to qualify Compass code graphs under
-  `/Volumes/Workspace/Github` first. When a task genuinely requires a missing
-  public repository, clone it under
-  `/Volumes/Workspace/Github/<owner>/<repository>`; do not clone qualification
-  repositories into the Compass tree, `/tmp`, or the main-disk GitHub folder.
-- Treat external qualification repositories as read-only inputs. Do not modify,
-  update, reset, or clean an existing checkout unless the task explicitly
-  requires it. Keep generated Compass artifacts outside their tracked source
-  or remove only artifacts created by the current task.
+## Build artifacts and external checkouts
+
+Compass build artifacts are large. Where they live is a per-contributor
+environment choice, not a repository rule — this guide does not mandate any
+specific path or volume.
+
+- If you redirect Cargo output with `CARGO_TARGET_DIR`, give every repository
+  checkout and worktree its own directory. Never share one target directory
+  between different repositories or concurrent worktrees: feature sets, build
+  scripts, and locks can collide.
+- `CARGO_TARGET_DIR` does not persist between shell or tool invocations. Set it
+  on each command that can compile (`build`, `check`, `test`, `clippy`, `bench`,
+  `doc`, `install`, `package`, or a Make target that invokes one).
+- Verify the chosen directory exists and is writable before a long build.
+- Run `cargo clean` only with the intended `CARGO_TARGET_DIR` explicitly set,
+  and only when the task actually requires reclaiming or invalidating those
+  artifacts. Never clean another repository's target directory.
+- Treat external repositories used to qualify Compass code graphs as read-only
+  inputs. Do not modify, update, reset, or clean an existing checkout unless the
+  task explicitly requires it. Keep generated Compass artifacts outside their
+  tracked source, or remove only artifacts created by the current task. Do not
+  clone qualification repositories into the Compass tree.
 
 Some Makefile targets consume binaries through a literal local `target/` path
-after Cargo finishes. Prefer direct Cargo commands with `CARGO_TARGET_DIR` for
-normal verification. Before using packaging, install, or release targets,
-inspect the target and ensure its artifact lookup also points at the selected
-external directory; never allow it to trigger a second local build silently.
+after Cargo finishes. If you have redirected `CARGO_TARGET_DIR`, prefer direct
+Cargo commands for normal verification, and inspect packaging, install, or
+release targets before use so they do not silently trigger a second build.
 
 ## Prometheus state ownership
 
diff --git a/CLAUDE.md b/CLAUDE.md
index e43b0788e..f1c70e2c5 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -10,28 +10,21 @@ conventions, test/fixture policy, public-contract rules, and the completion
 checklist. Read it before editing. This file only adds the mechanics AGENTS.md
 does not spell out.
 
-## Build target directory (mandatory)
+## Build artifacts
 
-The main disk is capped at 100 GB, so Cargo artifacts live on a mounted volume.
-**Set `CARGO_TARGET_DIR` on every invocation that can compile** — `build`,
-`check`, `test`, `clippy`, `bench`, `doc`, `install`, `package`, and any Make
-target wrapping them. The variable does not persist between tool calls.
+Compass build artifacts are large. Where they live is a per-contributor
+environment choice — this repository mandates no specific path or volume.
 
-```bash
-CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main \
-  cargo test -p compass-model --locked
-```
-
-Each checkout and worktree needs its own directory
-(`compass-<worktree-name>` for other worktrees). Never share one across
-repositories or concurrent worktrees. If `/Volumes/Workspace` is not mounted,
-stop and report it rather than falling back to local `target/`.
+If you redirect Cargo output with `CARGO_TARGET_DIR`, set it on every invocation
+that can compile (it does not persist between tool calls), and give each
+checkout and worktree its own directory — never share one across repositories or
+concurrent worktrees, since feature sets, build scripts, and locks can collide.
 
-Note the conflict this creates with the Makefile: several targets (`install`,
-`dist`, `release-check`) look up binaries through a literal `target/` path after
-Cargo finishes. Prefer direct `cargo` commands for verification, and inspect any
-packaging/install target before running it so it does not silently trigger a
-second local build.
+Note a related Makefile wrinkle: several targets (`install`, `dist`,
+`release-check`) look up binaries through a literal `target/` path after Cargo
+finishes. If you have redirected `CARGO_TARGET_DIR`, prefer direct `cargo`
+commands for verification, and inspect any packaging/install target before
+running it so it does not silently trigger a second build.
 
 ## Commands
 
diff --git a/PERFORMANCE.md b/PERFORMANCE.md
index 1bec8c01b..c8608cdf1 100644
--- a/PERFORMANCE.md
+++ b/PERFORMANCE.md
@@ -41,11 +41,11 @@ and requires matching ordered observations from JSON, store, and a repeated
 store execution. Timing is measured but removed before the deterministic
 response-baseline comparison.
 
-Run the gate with this checkout's external Cargo target:
+Run the gate. If you redirect Cargo output, use a target directory dedicated to
+this checkout:
 
 ```bash
-CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-<checkout> \
-  python3 scripts/qualify_query_relevance.py
+python3 scripts/qualify_query_relevance.py
 ```
 
 The gate fails on generated-artifact, corpus/schema/digest drift,
@@ -95,11 +95,11 @@ amplification, immutable-object reuse, GC state, and JSON/typed-query/
 CompassQL differential results. It also measures a small real CLI workflow:
 clean build, unchanged update, one-file update, and cold JSON/store search.
 The store workflow passes `--store sqlite`; ordinary builds remain JSON-only.
-Run it from a checkout with the required external target directory:
+Run it from a checkout. If you redirect Cargo output, use a target directory
+dedicated to this checkout:
 
 ```bash
-CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-store-<checkout> \
-  scripts/qualify_compass_store_release.sh
+scripts/qualify_compass_store_release.sh
 ```
 
 The default graph sizes are 32, 128, and 512 generated nodes. Raw JSON and
diff --git a/advisor-plans/006-harden-media-ingestion.md b/advisor-plans/006-harden-media-ingestion.md
index b44655419..17c6ecbd6 100644
--- a/advisor-plans/006-harden-media-ingestion.md
+++ b/advisor-plans/006-harden-media-ingestion.md
@@ -53,18 +53,16 @@ document IR planned in 007. It is intentionally safe to land first.
 
 ## Commands you will need
 
-Set the external target on every Cargo invocation:
-
 | Purpose | Command | Expected on success |
 |---|---|---|
-| Media tests | `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo test -p compass-media --locked` | exit 0 |
-| Semantic tests | `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo test -p compass-semantic --locked` | exit 0 |
-| Lint | `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo clippy -p compass-media -p compass-semantic --all-targets --all-features --locked -- -D warnings` | exit 0 |
+| Media tests | `cargo test -p compass-media --locked` | exit 0 |
+| Semantic tests | `cargo test -p compass-semantic --locked` | exit 0 |
+| Lint | `cargo clippy -p compass-media -p compass-semantic --all-targets --all-features --locked -- -D warnings` | exit 0 |
 | Format | `cargo fmt --all -- --check` | exit 0 |
 | Boundary | `sh scripts/check_product_boundary.sh` | exit 0 |
 
-If `/Volumes/Workspace` is unavailable or unwritable, stop. Do not fall back to
-a target directory inside the checkout.
+If you redirect Cargo output with `CARGO_TARGET_DIR`, set it on every
+invocation above and use a directory dedicated to this checkout.
 
 ## Scope
 
diff --git a/advisor-plans/007-versioned-document-artifact.md b/advisor-plans/007-versioned-document-artifact.md
index a28c47c89..a5197105d 100644
--- a/advisor-plans/007-versioned-document-artifact.md
+++ b/advisor-plans/007-versioned-document-artifact.md
@@ -111,14 +111,14 @@ Set the external target on every Cargo invocation:
 
 | Purpose | Command | Expected on success |
 |---|---|---|
-| Media | `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo test -p compass-media --locked` | exit 0 |
-| Semantic | `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo test -p compass-semantic --locked` | exit 0 |
-| Files | `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo test -p compass-files --locked` | exit 0 |
-| Lint | `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo clippy -p compass-media -p compass-semantic -p compass-files --all-targets --all-features --locked -- -D warnings` | exit 0 |
+| Media | `cargo test -p compass-media --locked` | exit 0 |
+| Semantic | `cargo test -p compass-semantic --locked` | exit 0 |
+| Files | `cargo test -p compass-files --locked` | exit 0 |
+| Lint | `cargo clippy -p compass-media -p compass-semantic -p compass-files --all-targets --all-features --locked -- -D warnings` | exit 0 |
 | Format | `cargo fmt --all -- --check` | exit 0 |
 | Boundary | `sh scripts/check_product_boundary.sh` | exit 0 |
 
-If `/Volumes/Workspace` is unavailable or unwritable, stop rather than using a
+If the chosen Cargo target directory is unwritable, stop rather than using a
 local `target/` directory.
 
 ## Scope
diff --git a/advisor-plans/008-lossless-document-fusion.md b/advisor-plans/008-lossless-document-fusion.md
index 4203d2840..2125cbd49 100644
--- a/advisor-plans/008-lossless-document-fusion.md
+++ b/advisor-plans/008-lossless-document-fusion.md
@@ -67,12 +67,12 @@ boundaries.
 
 | Purpose | Command | Expected on success |
 |---|---|---|
-| Semantic | `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo test -p compass-semantic --locked` | exit 0 |
-| Core | `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo test -p compass-core --locked` | exit 0 |
-| Graph | `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo test -p compass-graph --locked` | exit 0 |
-| CLI contract | `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo test -p compass-cli --test compass_product --locked` | exit 0 |
-| Qualification | `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main ./scripts/qualify_code_graph_v1.sh --fixtures-only` | exit 0 |
-| Lint | `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo clippy -p compass-semantic -p compass-core -p compass-graph --all-targets --all-features --locked -- -D warnings` | exit 0 |
+| Semantic | `cargo test -p compass-semantic --locked` | exit 0 |
+| Core | `cargo test -p compass-core --locked` | exit 0 |
+| Graph | `cargo test -p compass-graph --locked` | exit 0 |
+| CLI contract | `cargo test -p compass-cli --test compass_product --locked` | exit 0 |
+| Qualification | `./scripts/qualify_code_graph_v1.sh --fixtures-only` | exit 0 |
+| Lint | `cargo clippy -p compass-semantic -p compass-core -p compass-graph --all-targets --all-features --locked -- -D warnings` | exit 0 |
 | Format | `cargo fmt --all -- --check` | exit 0 |
 
 Stop if the external target volume is unavailable; never build into the repo.
diff --git a/advisor-plans/009-structural-markdown-html.md b/advisor-plans/009-structural-markdown-html.md
index 36d243e34..f7be73180 100644
--- a/advisor-plans/009-structural-markdown-html.md
+++ b/advisor-plans/009-structural-markdown-html.md
@@ -70,13 +70,13 @@ local graphs without runtime downloads or model dependence.
 
 | Purpose | Command | Expected on success |
 |---|---|---|
-| Languages | `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo test -p compass-languages --locked` | exit 0 |
-| Markdown coverage | `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo test -p compass-languages --test markdown_coverage --locked` | exit 0 |
-| Media | `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo test -p compass-media --locked` | exit 0 |
-| Ingest | `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo test -p compass-ingest --locked` | exit 0 |
-| Core | `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo test -p compass-core --locked` | exit 0 |
-| Qualification | `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main ./scripts/qualify_code_graph_v1.sh --fixtures-only` | exit 0 |
-| Lint | `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo clippy -p compass-languages -p compass-media -p compass-ingest -p compass-core --all-targets --all-features --locked -- -D warnings` | exit 0 |
+| Languages | `cargo test -p compass-languages --locked` | exit 0 |
+| Markdown coverage | `cargo test -p compass-languages --test markdown_coverage --locked` | exit 0 |
+| Media | `cargo test -p compass-media --locked` | exit 0 |
+| Ingest | `cargo test -p compass-ingest --locked` | exit 0 |
+| Core | `cargo test -p compass-core --locked` | exit 0 |
+| Qualification | `./scripts/qualify_code_graph_v1.sh --fixtures-only` | exit 0 |
+| Lint | `cargo clippy -p compass-languages -p compass-media -p compass-ingest -p compass-core --all-targets --all-features --locked -- -D warnings` | exit 0 |
 | Format | `cargo fmt --all -- --check` | exit 0 |
 
 ## Scope
diff --git a/advisor-plans/010-native-ooxml-documents.md b/advisor-plans/010-native-ooxml-documents.md
index 7dced4bec..5c4760808 100644
--- a/advisor-plans/010-native-ooxml-documents.md
+++ b/advisor-plans/010-native-ooxml-documents.md
@@ -46,11 +46,11 @@ without LibreOffice, Python, credentials, or a model.
 
 | Purpose | Command | Expected on success |
 |---|---|---|
-| Media | `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo test -p compass-media --locked` | exit 0 |
-| Files | `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo test -p compass-files --locked` | exit 0 |
-| Semantic | `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo test -p compass-semantic --locked` | exit 0 |
-| Core | `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo test -p compass-core --locked` | exit 0 |
-| Lint | `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo clippy -p compass-media -p compass-files -p compass-semantic -p compass-core --all-targets --all-features --locked -- -D warnings` | exit 0 |
+| Media | `cargo test -p compass-media --locked` | exit 0 |
+| Files | `cargo test -p compass-files --locked` | exit 0 |
+| Semantic | `cargo test -p compass-semantic --locked` | exit 0 |
+| Core | `cargo test -p compass-core --locked` | exit 0 |
+| Lint | `cargo clippy -p compass-media -p compass-files -p compass-semantic -p compass-core --all-targets --all-features --locked -- -D warnings` | exit 0 |
 | Format | `cargo fmt --all -- --check` | exit 0 |
 | Boundary | `sh scripts/check_product_boundary.sh` | exit 0 |
 
diff --git a/advisor-plans/011-bounded-native-rtf.md b/advisor-plans/011-bounded-native-rtf.md
index f8de15242..c8b465275 100644
--- a/advisor-plans/011-bounded-native-rtf.md
+++ b/advisor-plans/011-bounded-native-rtf.md
@@ -63,12 +63,12 @@ destinations. Never execute, decompress, open, or emit embedded payload bytes.
 
 | Purpose | Command | Expected on success |
 |---|---|---|
-| Media | `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo test -p compass-media --locked` | exit 0 |
-| Files | `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo test -p compass-files --locked` | exit 0 |
-| Semantic | `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo test -p compass-semantic --locked` | exit 0 |
-| Core | `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo test -p compass-core --locked` | exit 0 |
-| Dependency policy | `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo tree -p compass-media --locked` | exit 0; review only intended dependency changes |
-| Lint | `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo clippy -p compass-media -p compass-files -p compass-semantic -p compass-core --all-targets --all-features --locked -- -D warnings` | exit 0 |
+| Media | `cargo test -p compass-media --locked` | exit 0 |
+| Files | `cargo test -p compass-files --locked` | exit 0 |
+| Semantic | `cargo test -p compass-semantic --locked` | exit 0 |
+| Core | `cargo test -p compass-core --locked` | exit 0 |
+| Dependency policy | `cargo tree -p compass-media --locked` | exit 0; review only intended dependency changes |
+| Lint | `cargo clippy -p compass-media -p compass-files -p compass-semantic -p compass-core --all-targets --all-features --locked -- -D warnings` | exit 0 |
 | Format | `cargo fmt --all -- --check` | exit 0 |
 | Boundary | `sh scripts/check_product_boundary.sh` | exit 0 |
 
diff --git a/advisor-plans/012-document-qualification-gate.md b/advisor-plans/012-document-qualification-gate.md
index b3cdbd613..e86690f7c 100644
--- a/advisor-plans/012-document-qualification-gate.md
+++ b/advisor-plans/012-document-qualification-gate.md
@@ -62,11 +62,11 @@ For every shipped format, qualification must assert:
 
 | Purpose | Command | Expected on success |
 |---|---|---|
-| Document qualification | `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main ./scripts/qualify_document_graph_v1.sh --fixtures-only` | exit 0; all format cases pass |
-| Code qualification | `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main ./scripts/qualify_code_graph_v1.sh --fixtures-only` | exit 0 |
-| Product contract | `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo test -p compass-cli --test compass_product --locked` | exit 0 |
-| Workspace tests | `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo test --workspace --lib --bins --locked` | exit 0 |
-| Workspace lint | `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main cargo clippy --workspace --lib --bins --locked -- -D warnings` | exit 0 |
+| Document qualification | `./scripts/qualify_document_graph_v1.sh --fixtures-only` | exit 0; all format cases pass |
+| Code qualification | `./scripts/qualify_code_graph_v1.sh --fixtures-only` | exit 0 |
+| Product contract | `cargo test -p compass-cli --test compass_product --locked` | exit 0 |
+| Workspace tests | `cargo test --workspace --lib --bins --locked` | exit 0 |
+| Workspace lint | `cargo clippy --workspace --lib --bins --locked -- -D warnings` | exit 0 |
 | Format | `cargo fmt --all -- --check` | exit 0 |
 | Boundary | `sh scripts/check_product_boundary.sh` | exit 0 |
 
@@ -169,7 +169,7 @@ It must:
 - accept `--fixtures-only` and reject unknown flags;
 - require `CARGO_TARGET_DIR` to be an absolute path outside the Compass checkout
   rather than silently choosing a local target; local executions under this
-  repository must use `/Volumes/Workspace/crabbuild-target/compass-main`, while
+  repository must use its own dedicated Cargo target directory, while
   CI may use a checkout-specific directory under its runner temp volume;
 - run manifest validation and the typed cross-format test;
 - run product-boundary checks relevant to documents;
diff --git a/advisor-plans/013-typescript-javascript-graph-quality.md b/advisor-plans/013-typescript-javascript-graph-quality.md
index 60accb66d..2bcfa8b53 100644
--- a/advisor-plans/013-typescript-javascript-graph-quality.md
+++ b/advisor-plans/013-typescript-javascript-graph-quality.md
@@ -2334,23 +2334,23 @@ syntax behavior changes over time.
 
 All Cargo commands that compile must use this worktree's unique external target:
 
-`CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-6923`
+`CARGO_TARGET_DIR=<qualification-corpus-root>/crabbuild-target/compass-6923`
 
-Verify `/Volumes/Workspace` is mounted and the directory is writable before the
+Verify the qualification corpus root and Cargo target directory are writable before the
 first build. Stop rather than falling back to `target/`.
 
 | Purpose | Command | Expected result |
 |---|---|---|
-| language tests | `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-6923 cargo test -p compass-languages --locked` | exit 0 |
-| resolver tests | `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-6923 cargo test -p compass-resolve --locked` | exit 0 |
-| program/core tests | `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-6923 cargo test -p compass-program -p compass-core --locked` | exit 0 |
+| language tests | `cargo test -p compass-languages --locked` | exit 0 |
+| resolver tests | `cargo test -p compass-resolve --locked` | exit 0 |
+| program/core tests | `cargo test -p compass-program -p compass-core --locked` | exit 0 |
 | qualification unit tests | `python3 -m unittest benchmarks.performance.tests.test_audit benchmarks.performance.tests.test_correctness benchmarks.performance.tests.test_language_fixture_compare` | exit 0 |
-| fixture qualification | `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-6923 ./scripts/qualify_code_graph_v1.sh --fixtures-only` | all cases pass |
+| fixture qualification | `./scripts/qualify_code_graph_v1.sh --fixtures-only` | all cases pass |
 | JavaScript package checks | `npm ci && npm run typecheck:js && npm run test:js` | exit 0 |
 | product boundary | `sh scripts/check_product_boundary.sh` | no Graphify/runtime boundary violation |
 | format | `cargo fmt --all -- --check` | exit 0 |
-| workspace lint | `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-6923 cargo clippy --workspace --lib --bins --locked -- -D warnings` | exit 0 |
-| workspace tests | `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-6923 cargo test --workspace --lib --bins --locked` | exit 0 |
+| workspace lint | `cargo clippy --workspace --lib --bins --locked -- -D warnings` | exit 0 |
+| workspace tests | `cargo test --workspace --lib --bins --locked` | exit 0 |
 
 Each phase below adds a narrower verification command. Keep those commands in
 the final PR description with the exact commit, tool versions, and corpus pins.
@@ -2878,7 +2878,7 @@ the exact release candidate, not an earlier feature commit or a working tree.
 
 1. Promote the four audited corpora to pinned release gates after license and
    disk policy review. Store external read-only repositories beneath
-   `/Volumes/Workspace/Github/<owner>/<repository>`; keep generated graphs and
+   `<qualification-corpus-root>/<owner>/<repository>`; keep generated graphs and
    audit artifacts outside tracked sources.
 2. Add extended regression corpora for a large monorepo, current TypeScript
    compiler syntax, React/Next, Angular, Vue/Nuxt, Svelte/SvelteKit, and Astro.
@@ -3012,7 +3012,7 @@ Stop and report rather than weakening the design if:
 - competitor inputs cannot be configured equivalently enough for a defensible
   comparison;
 - performance results are too noisy or incomplete for a public claim;
-- `/Volumes/Workspace` is unavailable for a Cargo build or real-corpus checkout;
+- `<qualification-corpus-root>` is unavailable for a Cargo build or real-corpus checkout;
 - pre-existing user changes cannot be preserved.
 
 ## Maintenance notes
diff --git a/benchmarks/performance/README.md b/benchmarks/performance/README.md
index 1dd884ec4..90465c0f2 100644
--- a/benchmarks/performance/README.md
+++ b/benchmarks/performance/README.md
@@ -169,8 +169,7 @@ The Rust-side candidate seam has one opt-in compiler differential fixture. Run
 it from a checkout with the pinned Node dependencies installed:
 
 ```bash
-CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-6923 \
-  cargo test -p compass-languages --test typescript_oracle_differential \
+cargo test -p compass-languages --test typescript_oracle_differential \
   --locked -- --ignored
 ```
 
@@ -182,9 +181,8 @@ the separate checker oracle and keep the candidate adapter out of production:
 
 ```bash
 RUST_MIN_STACK=33554432 \
-COMPASS_TS_QUALIFICATION_ROOT=/Volumes/Workspace/Github/<owner>/<pinned-corpus> \
-CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-<checkout> \
-  cargo test -p compass-languages --test typescript_target_differential \
+COMPASS_TS_QUALIFICATION_ROOT=<qualification-corpus-root>/<owner>/<pinned-corpus> \
+cargo test -p compass-languages --test typescript_target_differential \
   checker_oracle_adjudicates_local_candidate_targets --locked -- --ignored --nocapture
 ```
 
diff --git a/benchmarks/performance/oracles/README.md b/benchmarks/performance/oracles/README.md
index 1e719bb3b..669951b6d 100644
--- a/benchmarks/performance/oracles/README.md
+++ b/benchmarks/performance/oracles/README.md
@@ -51,17 +51,16 @@ Run them against an external, read-only corpus after `npm ci`:
 
 ```bash
 node benchmarks/performance/oracles/typescript-source-oracle.mjs \
-  --root /Volumes/Workspace/Github/<owner>/<repository> --jsonl
+  --root <qualification-corpus-root>/<owner>/<repository> --jsonl
 node benchmarks/performance/oracles/typescript-resolution-oracle.mjs \
-  --root /Volumes/Workspace/Github/<owner>/<repository>
+  --root <qualification-corpus-root>/<owner>/<repository>
 ```
 
 The ignored Rust differential harness compares the source oracle's accepted
 construct ranges with the test-only Compass candidate emitter:
 
 ```bash
-COMPASS_TS_QUALIFICATION_ROOT=/Volumes/Workspace/Github/<owner>/<repository> \
-CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-6923 \
+COMPASS_TS_QUALIFICATION_ROOT=<qualification-corpus-root>/<owner>/<repository> \
 cargo test -p compass-languages --test typescript_corpus_differential \
   --locked -- --ignored --nocapture
 ```
@@ -75,8 +74,7 @@ Run target adjudication explicitly (it is ignored so normal native tests remain
 Node-free):
 
 ```bash
-COMPASS_TS_QUALIFICATION_ROOT=/Volumes/Workspace/Github/<owner>/<repository> \
-CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-6923 \
+COMPASS_TS_QUALIFICATION_ROOT=<qualification-corpus-root>/<owner>/<repository> \
 cargo test -p compass-languages --test typescript_target_differential \
   --locked -- --ignored --nocapture
 ```
@@ -91,9 +89,8 @@ explicit report path. The report is atomically written only when this ignored
 qualification test is run; it is never produced by normal Compass builds:
 
 ```bash
-COMPASS_TS_QUALIFICATION_ROOT=/Volumes/Workspace/Github/<owner>/<repository> \
-COMPASS_TS_TARGET_REPORT=/Volumes/Workspace/<run>/typescript-target-report.json \
-CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-6923 \
+COMPASS_TS_QUALIFICATION_ROOT=<qualification-corpus-root>/<owner>/<repository> \
+COMPASS_TS_TARGET_REPORT=<qualification-corpus-root>/<run>/typescript-target-report.json \
 cargo test -p compass-languages --test typescript_target_differential \
   --locked -- --ignored --nocapture
 ```
@@ -108,8 +105,8 @@ reason for every non-correct label under
 
 ```bash
 python3 benchmarks/performance/harness.py typescript-scorecard \
-  --scorecard /Volumes/Workspace/<run>/typescript-scorecard.json \
-  --output /Volumes/Workspace/<run>/typescript-scorecard-result.json
+  --scorecard <qualification-corpus-root>/<run>/typescript-scorecard.json \
+  --output <qualification-corpus-root>/<run>/typescript-scorecard-result.json
 ```
 
 The evaluator computes precision, 95% Wilson bounds, recall, target-cluster
diff --git a/docs/design/code-graph-v1-qualification.md b/docs/design/code-graph-v1-qualification.md
index 32dc4b930..82c004be9 100644
--- a/docs/design/code-graph-v1-qualification.md
+++ b/docs/design/code-graph-v1-qualification.md
@@ -48,7 +48,7 @@ For a clean local checkout at the pinned commit, avoid a second clone with:
 ```bash
 ./scripts/qualify_code_graph_v1.sh \
   --repositories tests/qualification/code-graph-v1-repositories.toml \
-  --local-repository /Volumes/Workspace/Github/Entire
+  --local-repository <qualification-corpus-root>/Entire
 ```
 
 The release-corpus mode verifies the manifest pin, requires a clean source
diff --git a/docs/implementation/compass-store-plan.md b/docs/implementation/compass-store-plan.md
index e948f8896..50963b4db 100644
--- a/docs/implementation/compass-store-plan.md
+++ b/docs/implementation/compass-store-plan.md
@@ -131,7 +131,7 @@ Every phase follows these rules independently:
    `compass-files`, query behavior in `compass-query`, and public command
    effects in `compass-cli`.
 8. **Use one target directory per checkout.** Every compiling Cargo command
-   sets `CARGO_TARGET_DIR` under `/Volumes/Workspace/crabbuild-target` as
+   sets `CARGO_TARGET_DIR` under `<qualification-corpus-root>/crabbuild-target` as
    required by `AGENTS.md`.
 
 ## Phase dependency map
@@ -193,15 +193,12 @@ A phase is complete only when:
 The normal final Rust baseline is:
 
 ```bash
-CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-<checkout> \
-  cargo fmt --all -- --check
-CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-<checkout> \
-  cargo clippy --workspace --lib --bins --locked -- -D warnings
-CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-<checkout> \
-  cargo test --workspace --lib --bins --locked
+cargo fmt --all -- --check
+cargo clippy --workspace --lib --bins --locked -- -D warnings
+cargo test --workspace --lib --bins --locked
 ```
 
-Use the actual unique checkout name. Verify `/Volumes/Workspace` is mounted and
+Use the actual unique checkout name. Verify `<qualification-corpus-root>` is mounted and
 writable before running Cargo; do not fall back to a local `target/`.
 
 ## Phase 0: Freeze the contract and build the reference store
@@ -1077,21 +1074,18 @@ release metadata have settled.
 In addition to targeted crate tests, run:
 
 ```bash
-CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-<checkout> \
-  cargo test -p compass-cli --test compass_product --locked
+cargo test -p compass-cli --test compass_product --locked
 sh scripts/check_product_boundary.sh
 
-CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-<checkout> \
-  cargo test -p compass-cypher --test tck --locked
-CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-<checkout> \
-  cargo test -p compass-query --test opencypher_tck --locked
+cargo test -p compass-cypher --test tck --locked
+cargo test -p compass-query --test opencypher_tck --locked
 python3 scripts/check_compassql_support.py
 
 ./scripts/qualify_code_graph_v1.sh --fixtures-only
 ```
 
 Run repository qualification on external repositories only under
-`/Volumes/Workspace/Github` and treat them as read-only, following
+`<qualification-corpus-root>/Github` and treat them as read-only, following
 `AGENTS.md`.
 
 ### Exit and rollback
diff --git a/docs/implementation/evidence-resolution-framework-phased-execution-plan.md b/docs/implementation/evidence-resolution-framework-phased-execution-plan.md
index 386fcf70f..8d1e337d7 100644
--- a/docs/implementation/evidence-resolution-framework-phased-execution-plan.md
+++ b/docs/implementation/evidence-resolution-framework-phased-execution-plan.md
@@ -883,23 +883,18 @@ Every Cargo command must use a per-worktree target directory on the mounted
 workspace volume:
 
 ```bash
-CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main \
-  cargo test -p compass-resolve --test universal_evidence --locked
+cargo test -p compass-resolve --test universal_evidence --locked
 
-CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main \
-  cargo test -p compass-resolve --test universal_resolution --locked
+cargo test -p compass-resolve --test universal_resolution --locked
 
-CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main \
-  cargo clippy -p compass-resolve --all-targets --all-features --locked -- -D warnings
+cargo clippy -p compass-resolve --all-targets --all-features --locked -- -D warnings
 
-CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main \
-  cargo test -p compass-resolve --locked
+cargo test -p compass-resolve --locked
 
-CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main \
-  ./scripts/qualify_code_graph_v1.sh --fixtures-only
+./scripts/qualify_code_graph_v1.sh --fixtures-only
 ```
 
-Before a long build, confirm `/Volumes/Workspace` is mounted and the selected
+Before a long build, confirm `<qualification-corpus-root>` is mounted and the selected
 target directory belongs only to this checkout.
 
 ## Phase dependencies
diff --git a/docs/implementation/query-performance-accuracy-recall-phased-technical-design.md b/docs/implementation/query-performance-accuracy-recall-phased-technical-design.md
index ba1b3897a..098ebae93 100644
--- a/docs/implementation/query-performance-accuracy-recall-phased-technical-design.md
+++ b/docs/implementation/query-performance-accuracy-recall-phased-technical-design.md
@@ -428,7 +428,7 @@ Tune weights via relevance corpus; keep profile IDs for quick A/B.
 
 For each phase, run at least:
 
-- `CARGO_TARGET_DIR=/Volumes/Workspace/crubuild-target/compass-main cargo test -p compass-query --test relevance_qualification --locked`
+- `CARGO_TARGET_DIR=<qualification-corpus-root>/crubuild-target/compass-main cargo test -p compass-query --test relevance_qualification --locked`
 - `python3 scripts/qualify_query_relevance.py`
 - phase-specific targeted tests:
   - intent parser unit tests,
diff --git a/docs/superpowers/plans/2026-07-23-extraction-superset-parity.md b/docs/superpowers/plans/2026-07-23-extraction-superset-parity.md
index 843ae4d11..f13cb496a 100644
--- a/docs/superpowers/plans/2026-07-23-extraction-superset-parity.md
+++ b/docs/superpowers/plans/2026-07-23-extraction-superset-parity.md
@@ -463,7 +463,7 @@ git commit -m "feat: add graph superset parity checker"
 **Interfaces:**
 
 - Environment:
-  - `PODMAN_ROOT`, default `/Volumes/Workspace/Github/podman`
+  - `PODMAN_ROOT`, default `<qualification-corpus-root>/podman`
   - `COMPASS_BIN`, default `target/release/compass` resolved from the Compass repository root
   - `GRAPHIFY_PYTHON`, default `/Users/haipingfu/graphify/.venv/bin/python`
   - `PARITY_SAMPLES`, default `3`
@@ -524,7 +524,7 @@ Capture query output outside the timed result. Before reporting latency, normali
 Add a `Graphify superset qualification` subsection to `docs/implementation/extraction-pipeline.md` with:
 
 ```bash
-PODMAN_ROOT=/Volumes/Workspace/Github/podman \
+PODMAN_ROOT=<qualification-corpus-root>/podman \
   bash scripts/qualify_graphify_superset.sh
 ```
 
@@ -590,7 +590,7 @@ Expected: the graph update exits successfully. Do not stage generated `graphify-
 Run:
 
 ```bash
-PODMAN_ROOT=/Volumes/Workspace/Github/podman \
+PODMAN_ROOT=<qualification-corpus-root>/podman \
   COMPASS_BIN=/Users/haipingfu/graphify/compass/target/release/compass \
   GRAPHIFY_PYTHON=/Users/haipingfu/graphify/.venv/bin/python \
   bash scripts/qualify_graphify_superset.sh
diff --git a/docs/superpowers/plans/2026-07-24-actionable-semantic-diff-mvp.md b/docs/superpowers/plans/2026-07-24-actionable-semantic-diff-mvp.md
index d11bc6feb..a265cbad3 100644
--- a/docs/superpowers/plans/2026-07-24-actionable-semantic-diff-mvp.md
+++ b/docs/superpowers/plans/2026-07-24-actionable-semantic-diff-mvp.md
@@ -1373,10 +1373,10 @@ Expected: every command exits `0`; no warnings; graph report regenerates success
 
 - [ ] **Step 4: Rebuild and inspect the real cocoindex comparison**
 
-First replay the established LevelDB cases from `/Volumes/Workspace/Github/leveldb`:
+First replay the established LevelDB cases from `<qualification-corpus-root>/leveldb`:
 
 ```bash
-cd /Volumes/Workspace/Github/leveldb
+cd <qualification-corpus-root>/leveldb
 /Users/haipingfu/graphify/compass/target/debug/compass history build 78a352f
 /Users/haipingfu/graphify/compass/target/debug/compass history build 4a0c572 --profile-from 78a352f
 /Users/haipingfu/graphify/compass/target/debug/compass diff 78a352f 4a0c572
@@ -1388,7 +1388,7 @@ git status --short
 
 Expected: the deadlock body edit is either explained from supported summaries or explicitly indeterminate, never reduced to location churn; the Zstd addition reports retained symbols/call/dependency evidence; the original checkout remains clean.
 
-From `/Volumes/Workspace/Github/cocoindex`, using the newly built Compass binary:
+From `<qualification-corpus-root>/cocoindex`, using the newly built Compass binary:
 
 ```bash
 /Users/haipingfu/graphify/compass/target/debug/compass history build 90571539 --profile-from 71f9cc9
diff --git a/docs/superpowers/plans/2026-07-24-semantic-delta-phase-0-1.md b/docs/superpowers/plans/2026-07-24-semantic-delta-phase-0-1.md
index e07515e8e..4284ca1bf 100644
--- a/docs/superpowers/plans/2026-07-24-semantic-delta-phase-0-1.md
+++ b/docs/superpowers/plans/2026-07-24-semantic-delta-phase-0-1.md
@@ -1750,7 +1750,7 @@ git log --stat --oneline HEAD~10..HEAD
 
 - [ ] **Step 5: Run a real-repository smoke test**
 
-From `/Volumes/Workspace/Github/cocoindex`, using the newly built binary:
+From `<qualification-corpus-root>/cocoindex`, using the newly built binary:
 
 ```bash
 /Users/haipingfu/graphify/compass/target/debug/compass history build HEAD~1 --code-only
diff --git a/docs/superpowers/plans/2026-07-25-versioned-history-sub-two-second.md b/docs/superpowers/plans/2026-07-25-versioned-history-sub-two-second.md
index a3fca5f00..faf50d686 100644
--- a/docs/superpowers/plans/2026-07-25-versioned-history-sub-two-second.md
+++ b/docs/superpowers/plans/2026-07-25-versioned-history-sub-two-second.md
@@ -145,7 +145,7 @@ Keep the strict wall-clock assertion ignored in ordinary debug test runs and exe
 
 - [ ] **Step 2: Verify the pre-fix release gate fails**
 
-Run the release CLI against `/Volumes/Workspace/Github/fjall` in a fresh shared clone.
+Run the release CLI against `<qualification-corpus-root>/fjall` in a fresh shared clone.
 
 Expected baseline: approximately 3.94 seconds, exceeding the 2.0-second limit.
 
diff --git a/docs/superpowers/plans/2026-07-30-best-effort-code-graph-publication.md b/docs/superpowers/plans/2026-07-30-best-effort-code-graph-publication.md
index b3dca89d8..d2d3bf5c9 100644
--- a/docs/superpowers/plans/2026-07-30-best-effort-code-graph-publication.md
+++ b/docs/superpowers/plans/2026-07-30-best-effort-code-graph-publication.md
@@ -103,7 +103,7 @@ Run:
 
 ```bash
 cargo fmt --all
-CARGO_TARGET_DIR=/Volumes/Workspace/compass-v1-remediation-target cargo check -p compass-model --locked
+CARGO_TARGET_DIR=<qualification-corpus-root>/compass-v1-remediation-target cargo check -p compass-model --locked
 ```
 
 Expected: both commands exit 0.
@@ -123,7 +123,7 @@ Add tests proving:
 Run:
 
 ```bash
-CARGO_TARGET_DIR=/Volumes/Workspace/compass-v1-remediation-target cargo test -p compass-model --test code_graph_validation --locked
+CARGO_TARGET_DIR=<qualification-corpus-root>/compass-v1-remediation-target cargo test -p compass-model --test code_graph_validation --locked
 ```
 
 Expected: all tests pass.
@@ -239,7 +239,7 @@ Run:
 
 ```bash
 cargo fmt --all
-CARGO_TARGET_DIR=/Volumes/Workspace/compass-v1-remediation-target cargo check -p compass-graph --locked
+CARGO_TARGET_DIR=<qualification-corpus-root>/compass-v1-remediation-target cargo check -p compass-graph --locked
 ```
 
 Expected: both commands exit 0.
@@ -262,7 +262,7 @@ Add tests for:
 Run:
 
 ```bash
-CARGO_TARGET_DIR=/Volumes/Workspace/compass-v1-remediation-target cargo test -p compass-graph --test graph_v1_normalization --locked
+CARGO_TARGET_DIR=<qualification-corpus-root>/compass-v1-remediation-target cargo test -p compass-graph --test graph_v1_normalization --locked
 ```
 
 Expected: all tests pass.
@@ -332,8 +332,8 @@ Add tests proving:
 Run:
 
 ```bash
-CARGO_TARGET_DIR=/Volumes/Workspace/compass-v1-remediation-target cargo test -p compass-graph --locked
-CARGO_TARGET_DIR=/Volumes/Workspace/compass-v1-remediation-target cargo clippy -p compass-graph --all-targets --locked -- -D warnings
+CARGO_TARGET_DIR=<qualification-corpus-root>/compass-v1-remediation-target cargo test -p compass-graph --locked
+CARGO_TARGET_DIR=<qualification-corpus-root>/compass-v1-remediation-target cargo clippy -p compass-graph --all-targets --locked -- -D warnings
 ```
 
 Expected: both commands exit 0.
@@ -412,8 +412,8 @@ Add coverage for:
 Run:
 
 ```bash
-CARGO_TARGET_DIR=/Volumes/Workspace/compass-v1-remediation-target cargo test -p compass-core --test loading_coverage --locked
-CARGO_TARGET_DIR=/Volumes/Workspace/compass-v1-remediation-target cargo test -p compass-cli --lib --locked
+CARGO_TARGET_DIR=<qualification-corpus-root>/compass-v1-remediation-target cargo test -p compass-core --test loading_coverage --locked
+CARGO_TARGET_DIR=<qualification-corpus-root>/compass-v1-remediation-target cargo test -p compass-cli --lib --locked
 ```
 
 Expected: both commands exit 0.
@@ -472,8 +472,8 @@ Test complete and partial graphs across search, callers, callees, impact, explor
 Run:
 
 ```bash
-CARGO_TARGET_DIR=/Volumes/Workspace/compass-v1-remediation-target cargo test -p compass-query --locked
-CARGO_TARGET_DIR=/Volumes/Workspace/compass-v1-remediation-target cargo clippy -p compass-query --all-targets --locked -- -D warnings
+CARGO_TARGET_DIR=<qualification-corpus-root>/compass-v1-remediation-target cargo test -p compass-query --locked
+CARGO_TARGET_DIR=<qualification-corpus-root>/compass-v1-remediation-target cargo clippy -p compass-query --all-targets --locked -- -D warnings
 ```
 
 Expected: both commands exit 0.
@@ -554,7 +554,7 @@ Run:
 
 ```bash
 cargo fmt --all --check
-CARGO_TARGET_DIR=/Volumes/Workspace/compass-v1-remediation-target cargo test --workspace --lib --bins --tests --locked
+CARGO_TARGET_DIR=<qualification-corpus-root>/compass-v1-remediation-target cargo test --workspace --lib --bins --tests --locked
 ```
 
 Expected: formatting passes and all non-ignored tests pass.
@@ -564,7 +564,7 @@ Expected: formatting passes and all non-ignored tests pass.
 Run:
 
 ```bash
-CARGO_TARGET_DIR=/Volumes/Workspace/compass-v1-remediation-target cargo clippy -p compass-model -p compass-graph -p compass-core -p compass-query -p compass-cli --all-targets --locked -- -D warnings
+CARGO_TARGET_DIR=<qualification-corpus-root>/compass-v1-remediation-target cargo clippy -p compass-model -p compass-graph -p compass-core -p compass-query -p compass-cli --all-targets --locked -- -D warnings
 ```
 
 Expected: exit 0 with no warnings.
@@ -574,7 +574,7 @@ Expected: exit 0 with no warnings.
 Run:
 
 ```bash
-CARGO_TARGET_DIR=/Volumes/Workspace/compass-v1-remediation-target bash scripts/qualify_code_graph_v1.sh --fixtures-only
+CARGO_TARGET_DIR=<qualification-corpus-root>/compass-v1-remediation-target bash scripts/qualify_code_graph_v1.sh --fixtures-only
 ```
 
 Expected: the production binary builds and every fixture, invariant, framework flow, and deterministic comparison passes. Record the complete qualification summary in the handoff.
@@ -600,7 +600,7 @@ Expected: no whitespace errors, only intended files, and scoped commits.
 **Files:**
 
 - No repository source modifications
-- Write benchmark logs under `/Volumes/Workspace/compass-heavy-framework-best-effort-20260730/`
+- Write benchmark logs under `<qualification-corpus-root>/compass-heavy-framework-best-effort-20260730/`
 
 **Interfaces:**
 
@@ -613,8 +613,8 @@ Expected: no whitespace errors, only intended files, and scoped commits.
 Run:
 
 ```bash
-CARGO_TARGET_DIR=/Volumes/Workspace/compass-v1-remediation-target cargo build --release --locked -p compass-cli --bin compass
-shasum -a 256 /Volumes/Workspace/compass-v1-remediation-target/release/compass
+CARGO_TARGET_DIR=<qualification-corpus-root>/compass-v1-remediation-target cargo build --release --locked -p compass-cli --bin compass
+shasum -a 256 <qualification-corpus-root>/compass-v1-remediation-target/release/compass
 ```
 
 Record the commit and binary hash.
diff --git a/docs/superpowers/reviews/2026-07-30-best-effort-heavy-framework-qualification.md b/docs/superpowers/reviews/2026-07-30-best-effort-heavy-framework-qualification.md
index 7fe432a52..dfd51eb02 100644
--- a/docs/superpowers/reviews/2026-07-30-best-effort-heavy-framework-qualification.md
+++ b/docs/superpowers/reviews/2026-07-30-best-effort-heavy-framework-qualification.md
@@ -47,8 +47,8 @@ Host:
 The source checkouts and generated evidence are retained under:
 
 ```text
-/Volumes/Workspace/compass-heavy-framework-perf-20260729/repos
-/Volumes/Workspace/compass-heavy-framework-best-effort-20260730
+<qualification-corpus-root>/compass-heavy-framework-perf-20260729/repos
+<qualification-corpus-root>/compass-heavy-framework-best-effort-20260730
 ```
 
 ## Build Results
diff --git a/docs/superpowers/specs/2026-07-23-history-build-all-design.md b/docs/superpowers/specs/2026-07-23-history-build-all-design.md
index 51d4e1bd8..2c1aa0af4 100644
--- a/docs/superpowers/specs/2026-07-23-history-build-all-design.md
+++ b/docs/superpowers/specs/2026-07-23-history-build-all-design.md
@@ -371,7 +371,7 @@ compass history build main --all --code-only
 ### Real-repository qualification
 
 Create a shallow disposable clone of
-`/Volumes/Workspace/Github/cocoindex` containing a small number of commits.
+`<qualification-corpus-root>/cocoindex` containing a small number of commits.
 Run:
 
 ```bash
diff --git a/scripts/qualify_code_graph_v1.sh b/scripts/qualify_code_graph_v1.sh
index dd0a2cc6f..1c651e8ce 100755
--- a/scripts/qualify_code_graph_v1.sh
+++ b/scripts/qualify_code_graph_v1.sh
@@ -5,10 +5,9 @@ QUALIFY_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 QUALIFY_TMP="$(mktemp -d "${TMPDIR:-/tmp}/compass-code-graph-v1.XXXXXX")"
 trap 'chmod -R u+w "$QUALIFY_TMP" 2>/dev/null || true; rm -rf -- "$QUALIFY_TMP"' EXIT
 
-# Keep Rust build artifacts on the mounted workspace volume. Qualification
-# intentionally exercises large repositories and must not fill the checkout's
-# disk with a second target tree.
-export CARGO_TARGET_DIR="${CARGO_TARGET_DIR:-/Volumes/Workspace/crabbuild-target/compass-main}"
+# Qualification intentionally exercises large repositories. Set CARGO_TARGET_DIR
+# before running if you want those build artifacts somewhere other than the
+# checkout's own target directory.
 
 usage() {
   cat >&2 <<EOF
diff --git a/scripts/qualify_compass_store_release.sh b/scripts/qualify_compass_store_release.sh
index baa925754..9c981f027 100755
--- a/scripts/qualify_compass_store_release.sh
+++ b/scripts/qualify_compass_store_release.sh
@@ -3,7 +3,7 @@ set -euo pipefail
 
 script_dir=$(cd "$(dirname "$0")" && pwd)
 compass_root=$(cd "$script_dir/.." && pwd)
-target_dir=${CARGO_TARGET_DIR:-/Volumes/Workspace/crabbuild-target/compass-store-phase9}
+target_dir=${CARGO_TARGET_DIR:-$compass_root/target}
 output_dir=${COMPASS_STORE_QUALIFICATION_OUTPUT:-$target_dir/compass-store-release-qualification-$(date -u +%Y%m%dT%H%M%SZ)}
 sizes=${COMPASS_STORE_QUALIFICATION_SIZES:-"32 128 512"}
 measure="$script_dir/measure_process.py"
@@ -31,10 +31,6 @@ while [[ $# -gt 0 ]]; do
   esac
 done
 
-if [[ ! -d /Volumes/Workspace || ! -w /Volumes/Workspace ]]; then
-  echo "error: /Volumes/Workspace must be mounted and writable" >&2
-  exit 1
-fi
 mkdir -p "$target_dir"
 if [[ ! -w "$target_dir" ]]; then
   echo "error: target directory is not writable: $target_dir" >&2
diff --git a/skills/compass-release/SKILL.md b/skills/compass-release/SKILL.md
index 6e70a0367..c7daf30a2 100644
--- a/skills/compass-release/SKILL.md
+++ b/skills/compass-release/SKILL.md
@@ -1,7 +1,7 @@
 ---
 name: compass-release
 description: Release Compass from the latest origin/main. Use this skill whenever a user asks to sync Compass, bump a Compass version, create or merge a release PR, build or publish macOS/Linux/Windows artifacts, write release notes, verify release downloads, or build the matching VS Code VSIX. Follow the complete gated workflow rather than treating a release as a local version edit.
-compatibility: Requires git, GitHub CLI (gh) with push/release permission, jq, Rust 1.97.1, Cargo, Node/npm, tar, shasum (or sha256sum), and a writable /Volumes/Workspace/crabbuild-target volume for Cargo builds.
+compatibility: Requires git, GitHub CLI (gh) with push/release permission, jq, Rust 1.97.1, Cargo, Node/npm, tar, and shasum (or sha256sum).
 ---
 
 # Compass release
@@ -23,7 +23,7 @@ Use these shell variables after the version is confirmed:
 version="<requested-version>"
 tag="compass-v${version}"
 branch="codex/release-${version}"
-target_dir="/Volumes/Workspace/crabbuild-target/compass-release-${version}"
+target_dir="${CARGO_TARGET_DIR:-$(git rev-parse --show-toplevel)/target}"
 ```
 
 ## Safety gates
@@ -31,7 +31,7 @@ target_dir="/Volumes/Workspace/crabbuild-target/compass-release-${version}"
 Stop and report the blocker instead of improvising when:
 
 1. The worktree has user changes (`git status --short` is non-empty). Preserve them; never use `git reset --hard`, `git clean`, force-push, or overwrite unrelated files.
-2. `/Volumes/Workspace` is missing or `$target_dir` cannot be created and written. Cargo must not fall back to a local `target/` directory.
+2. `$target_dir` cannot be created and written.
 3. The requested tag already exists, points at a different commit, or the GitHub release already exists. Published realizations are immutable.
 4. `gh auth status` or repository permissions do not allow fetching, pushing, PR operations, or release inspection.
 5. Metadata, validation, PR checks, tag validation, a release job, an archive checksum, or an archive smoke check fails. Do not publish a partial artifact set.
@@ -80,10 +80,9 @@ Build release notes from the meaningful commits between the previous `compass-v*
 
 ## 3. Validate before publishing the PR
 
-Verify the build volume and create only this checkout's target directory:
+Create and verify this checkout's target directory:
 
 ```sh
-test -d /Volumes/Workspace
 mkdir -p "$target_dir"
 test -w "$target_dir"
 ```

From 5ca57f2441b90a516eb2a4e78e1fb4e2d2d8269a Mon Sep 17 00:00:00 2001
From: Travis James <travis@tribehealthsolutions.com>
Date: Sun, 9 Aug 2026 07:43:06 -0500
Subject: [PATCH 5/6] chore(knowledge): session wiki updates

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .prometheus/events.jsonl                      |   1 +
 .../.prompt-snapshots/project/current         |   2 +-
 ...dbf7c749eb3ee292740ad01d9cc572cd6d064.json | 794 ++++++++++++++++++
 ...s-scoping-and-bounds-completion-capture.md |  34 +
 .prometheus/knowledge/wiki/index.md           |   2 +
 .../wiki/karpathy-session-495b53196088c2c2.md |  73 ++
 .../wiki/karpathy-session-87bd3daa965ea4d0.md |  71 ++
 .prometheus/knowledge/wiki/log.md             |   3 +
 8 files changed, 979 insertions(+), 1 deletion(-)
 create mode 100644 .prometheus/knowledge/.prompt-snapshots/project/generations/af7fabc39868c850a9cc065ff05dbf7c749eb3ee292740ad01d9cc572cd6d064.json
 create mode 100644 .prometheus/knowledge/wiki/compass-scoping-and-bounds-completion-capture.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-495b53196088c2c2.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-87bd3daa965ea4d0.md

diff --git a/.prometheus/events.jsonl b/.prometheus/events.jsonl
index 4a92ef8fa..7e1dbab8d 100644
--- a/.prometheus/events.jsonl
+++ b/.prometheus/events.jsonl
@@ -1,2 +1,3 @@
 {"id":"3667e85c-0e70-46ef-b48d-cff044021f05","kind":"compiled","session_id":"ae160b21-3016-48b6-8571-96c5be7bcb03","project_root":"/Users/gqadonis/Projects/references/compass","scope":"project","timestamp":"2026-08-09T12:05:10.452765Z","payload":{"entry_id":"compass-scoping-and-bounds-executor-session","tags":["compass","executor-session","scoping","session-record"],"title":"Compass scoping and bounds executor session","ts":"2026-08-09T12:05:10.452765Z","type":"compiled"},"affects":["compass-scoping-and-bounds-executor-session"]}
 {"id":"9b414d93-118a-4481-9c85-483c72fa8f6a","kind":"compiled","session_id":"ff30da84-fe84-46a4-a46c-79ee160255bb","project_root":"/Users/gqadonis/Projects/references/compass","scope":"project","timestamp":"2026-08-09T12:09:38.090263Z","payload":{"entry_id":"compass-scoping-and-bounds-executor-session","tags":["compass","executor-session","scoping","session-record"],"title":"Compass scoping and bounds executor session","ts":"2026-08-09T12:09:38.090263Z","type":"compiled"},"affects":["compass-scoping-and-bounds-executor-session"]}
+{"id":"66ce8d3f-eab4-4abc-bf78-c885684cd493","kind":"compiled","session_id":"481df31a-0055-44c0-9e30-5fd3b37be2aa","project_root":"/Users/gqadonis/Projects/references/compass","scope":"project","timestamp":"2026-08-09T12:42:25.788864Z","payload":{"entry_id":"compass-scoping-and-bounds-completion-capture","tags":["compass","executor-session","scoping","session-record"],"title":"Compass scoping and bounds completion capture","ts":"2026-08-09T12:42:25.788864Z","type":"compiled"},"affects":["compass-scoping-and-bounds-completion-capture"]}
diff --git a/.prometheus/knowledge/.prompt-snapshots/project/current b/.prometheus/knowledge/.prompt-snapshots/project/current
index 9e6df6620..8bb932e91 100644
--- a/.prometheus/knowledge/.prompt-snapshots/project/current
+++ b/.prometheus/knowledge/.prompt-snapshots/project/current
@@ -1,2 +1,2 @@
-7f6275773422ff840f0a69fc2353d60a46450faef250b226e9717215ad2fea75
+af7fabc39868c850a9cc065ff05dbf7c749eb3ee292740ad01d9cc572cd6d064
 
diff --git a/.prometheus/knowledge/.prompt-snapshots/project/generations/af7fabc39868c850a9cc065ff05dbf7c749eb3ee292740ad01d9cc572cd6d064.json b/.prometheus/knowledge/.prompt-snapshots/project/generations/af7fabc39868c850a9cc065ff05dbf7c749eb3ee292740ad01d9cc572cd6d064.json
new file mode 100644
index 000000000..49dbf700a
--- /dev/null
+++ b/.prometheus/knowledge/.prompt-snapshots/project/generations/af7fabc39868c850a9cc065ff05dbf7c749eb3ee292740ad01d9cc572cd6d064.json
@@ -0,0 +1,794 @@
+{
+  "schemaVersion": 1,
+  "scope": "project",
+  "generation": "af7fabc39868c850a9cc065ff05dbf7c749eb3ee292740ad01d9cc572cd6d064",
+  "candidateCount": 41,
+  "byteCount": 134195,
+  "entries": [
+    {
+      "id": "compass-scoping-and-bounds-completion-capture",
+      "title": "Compass scoping and bounds completion capture",
+      "content": "## Session Record\n\n- Executor session completed for phase `compass-scoping-and-bounds`.\n- Reported change status: `unknown`.\n- No implementation delta, root cause, changed paths, or corrective actions were present in the capture.\n\n## Handling Notes\n\n- Preserve as a minimal execution record.\n- Do not infer code changes or operational impact from this record alone.\n- Related minimal record: [Compass scoping and bounds executor session](/compass-scoping-and-bounds-executor-session.md).\n\n# Citations\n\n1. stdin",
+      "tags": [
+        "compass",
+        "executor-session",
+        "scoping",
+        "session-record"
+      ],
+      "links": [
+        "compass-scoping-and-bounds-executor-session"
+      ],
+      "sources": [
+        "stdin"
+      ],
+      "created_at": "2026-08-09T12:42:25.785210Z",
+      "updated_at": "2026-08-09T12:42:25.785210Z",
+      "revision": 0,
+      "entry_type": "Reference",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "compass-scoping-and-bounds-executor-session",
+      "title": "Compass scoping and bounds executor session",
+      "content": "## Summary\n\n- Executor session completed for phase `compass-scoping-and-bounds`.\n- Reported change status: `unknown`.\n- No delta, root cause, changed paths, or corrective actions were captured in the raw record.\n\n## Session Record\n\n| Field | Value |\n|---|---|\n| Phase | `compass-scoping-and-bounds` |\n| Change | `unknown` |\n| Status | complete |\n\n## Handling Notes\n\n- Preserve as a minimal execution record.\n- Do not infer implementation changes, changed paths, or root cause from this capture alone.\n- Promote reusable findings only if a fuller session artifact becomes available.\n\n# Citations\n\n1. stdin",
+      "tags": [
+        "compass",
+        "executor-session",
+        "scoping",
+        "session-record"
+      ],
+      "links": [],
+      "sources": [
+        "stdin"
+      ],
+      "created_at": "2026-08-09T12:09:38.086902Z",
+      "updated_at": "2026-08-09T12:09:38.087376Z",
+      "revision": 1,
+      "entry_type": "Reference",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-04f1f5622348cff2",
+      "title": "Karpathy session 04f1f5622348",
+      "content": "## Delta\n\nDone — built, installed, and the target directory cleaned.\n\n**Results:**\n- `make install` → release build succeeded in **24m 13s**\n- Installed `compass 0.3.6` → `~/.cargo/bin/compass` (146 MB), verified working after cleanup, resolving on PATH\n- Local `./target` reclaimed: **139 MB → 4 KB**\n\n**One thing worth knowing:** cleaning `target/` reclaimed far less than you'd expect, because your global `~/.cargo/config.toml` offloads Rust builds to the external drive. Intermediates go to `/Volumes/my-passport/cargo-build/...` (3.3 GB for this workspace) and sccache to `/Volumes/my-passport/sccache` (29 of 40 GiB). Only the final binary lands locally — so `target/` was never the disk hog here.\n\nI deliberately did **not** run `cargo clean`. It would have deleted the 3.3 GB external build cache too, costing you another 24-minute cold rebuild while reclaiming nothing extra from your internal disk. I removed `target/release` instead.\n\n**The actual local space, if you want it — needs your call:**\n\n`~/Library/Caches/Mozilla.sccache` holds **10 GB on your internal disk**. This is sccache's *default* path, not your configured WDD one. It gets written whenever sccache starts in a shell that didn't export `SCCACHE_DIR` — your `.zshrc` only sets it behind a `[[ -d \"$WDD/cargo\" ]]` guard, so non-login shells and any unmounted-drive moment bypass it. Newest entries are from Aug 8 20:14, so it's recent, not ancient.\n\nDeleting it is safe — sccache is purely a cache, worst case is slower recompiles — and nothing currently holds it open. I'd also suggest setting `SCCACHE_DIR` in `~/.cargo/config.toml`'s `[env]` rather than `.zshrc`, so it applies to every shell and stops re-accumulating. Say the word and I'll do either or both.\n\nI should flag one correction: mid-investigation I said the build had \"stopped\" and separately called this cache \"orphaned.\" Both were wrong — the first was a bad read of a momentary process gap, the second I revised once I checked the timestamps.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 34d4343f-8edd-46e9-bb53-90b588e5d3ed\n- Captured: 2026-08-09T05:20:55.484287Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- No changed paths detected.\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:34d4343f-8edd-46e9-bb53-90b588e5d3ed"
+      ],
+      "created_at": "2026-08-09T05:21:00.817633Z",
+      "updated_at": "2026-08-09T05:21:00.817633Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-06cdf26d86b0c087",
+      "title": "Karpathy session 06cdf26d86b0",
+      "content": "## Delta\n\nI've traced it. Here's what's actually going on — and part of it contradicts the premise.\n\n## Why 1.6.2 is resolving\n\n**1.7.0 was never installed.** The cache holds only `1.6.0`, `1.6.1`, `1.6.2`. Your source repo at `/Users/gqadonis/Projects/prometheus/prometheus-skill-pack` is tagged `v1.7.0` (12 commits past it, working tree clean), but that was never published into the plugin cache. The newest cache dir is dated Aug 3; the `.prometheus` generation is Aug 5. The tag exists locally and nowhere else.\n\nThere's also a **second, unrelated breakage**: `~/.claude/skills/kbd-init` symlinks to `~/.prometheus/plugins/prometheus-skill-pack/current/skills/process/kbd-process-orchestrator/skills/kbd-init` — a path that doesn't resolve. That's why I fell back to the cache at the start of this session. Two different install roots (`.claude/plugins/cache` and `.prometheus/plugins/generations`), and the symlink points into the one that's broken.\n\n## But the premise doesn't hold for this work\n\nI diffed the source tree against 1.6.2 directly. **The entire `kbd-process-orchestrator` differs in exactly three files:**\n\n| File | Status |\n|---|---|\n| `references/integrations/adversarial-review.md` | differs |\n| `skills/kbd-execute/SKILL.md` | differs |\n| `skills/kbd-spec/SKILL.md` | differs |\n\nEverything else is byte-identical. Specifically:\n\n- **`kbd-analyze` exists in 1.6.2 and its `SKILL.md` is identical to 1.7.0.** My earlier \"no analyze.md\" observation was about the `prompts/` directory — and `prompts/` has no `analyze.md` in **1.7.0 either**. `kbd-analyze` is driven by its `SKILL.md`, not a prompt file. That's not a version gap; I misread it.\n- `kbd-assess/SKILL.md`, `kbd-init/SKILL.md`, `kbd-new-phase/SKILL.md`, `prompts/assess.md`, `project.template.json`, and the adversarial-review preflight script are all **identical** between source and 1.6.2.\n\nSo the `/kbd-init` and `/kbd-assess` runs already completed used the same bytes 1.7.0 would have. No rework needed there.\n\nThe three drifted files matter for `/kbd-execute` and `/kbd-spec` — stages we haven't reached.\n\n## Your call\n\nI can't publish 1.7.0 into the plugin cache myself — that's your packaging pipeline, and I don't know its publish command. Options:\n\n1. **Publish 1.7.0 properly** — you run the pack's install/publish step; I re-verify and continue. Cleanest, and fixes the broken `~/.claude/skills` symlink if the installer rewrites it.\n2. **Continue on 1.6.2 for analyze** — legitimate here, since `kbd-analyze` is byte-identical. Then upgrade before `/kbd-spec` or `/kbd-execute`, where the drift is real.\n3. **Point the KBD skills at the source tree directly** for this session.\n\nI'd suggest **1**, since the symlink is broken regardless and will keep biting. But **2** is defensible if you want to keep moving on the partitioning question now — the risk is genuinely zero for the analyze stage.\n\nWhich way?\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:11:33.611768Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T11:14:53.644969Z",
+      "updated_at": "2026-08-09T11:14:53.644969Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-0c2a62b22721a70c",
+      "title": "Karpathy session 0c2a62b22721",
+      "content": "## Delta\n\nThat confirms the root cause. Here's what's happening.\n\n## Diagnosis\n\nThis is **not a bug** — it's a bounded-work invariant firing correctly, but with a bad user experience. Three separate problems:\n\n**1. The scope was never actually narrowed.** Your run reported `Scope: 0 include rule(s), 0 exclude rule(s)` and matched **19,666 files**. The repo is 6.8 GB, and the walk swept in directories that have no business in a code graph:\n\n| Directory | Size |\n|---|---|\n| `node_modules/` | 1.6 GB |\n| `target/` | 821 MB |\n| `compass-out/` | 302 MB ← Compass's *own* prior output |\n| `vendor/` | 126 MB |\n\nNote the 9,679 \"documents\" and 508 images — that's overwhelmingly dependency and build-artifact content, not your source.\n\n**2. The 2 GiB cap has no escape hatch on this path.** `MAX_GRAPH_BYTES` (`crates/compass-store/src/lib.rs:51`) is a hard `const`. Elsewhere in the codebase — `compass-model`, `compass-output`, `compass-global`, `compass-core` — the same limit is overridable via `COMPASS_MAX_GRAPH_BYTES`, and the error messages there *tell you so*. But `compass-graph/src/snapshot.rs:3138` and `compass-store` never read that variable. So the message you got is a dead end: no override, no suggested remedy.\n\n**3. It failed after 331 seconds**, at final publication — after all extraction work was done. The limit is checked at serialization time (`digest_json`), not estimated up front.\n\n## Your immediate unblock\n\n`compass init` does support scoping — you just pressed through the prompts. Exclusions are available non-interactively:\n\n```bash\ncd /Users/gqadonis/Projects/prometheus/universal-agent-runtime\nrm -rf compass-out .compass\ncompass init --exclude='node_modules/**' --exclude='target/**' \\\n             --exclude='compass-out/**' --exclude='vendor/**' \\\n             --exclude='website/**' --exclude='static/**' --exclude='models.dev/**'\n```\n\nThat should cut the graph by well over an order of magnitude. I haven't run it, so I can't promise it lands under the cap — but the excluded directories are ~3.2 GB of the 6.8 GB, and they're the ones generating the bulk of those 9,679 documents.\n\n## The real fixes for this repo\n\nThree defects worth addressing here, in priority order:\n\n1. **Default ignore policy misses `compass-out/`, `node_modules/`, `target/`, `vendor/`.** Compass ingesting its own output directory is clearly wrong. This belongs in `compass-files::detect`.\n2. **The limit error is unactionable.** It should name the override (if one is granted on this path) and point at scoping — matching how `compass-model` and `compass-core` already word theirs.\n3. **Failing at 331 s is avoidable.** A pre-publication size estimate could fail fast, or warn during extraction.\n\nPer AGENTS.md, #1 and #3 are `compass-files`/`compass-core` work and #2 spans `compass-graph`/`compass-store`; the CLI message stays thin.\n\nTwo things I want your call on before doing anything:\n\n- **Scope:** should I fix all three, or just the ignore-policy default (#1), which alone would have prevented your failure?\n- **Whether to raise the cap:** I'd advise against it. It's a deliberate bounded-work invariant, and AGENTS.md is explicit that a limit error is a distinct outcome from an empty result. Better to make the default scope sane than to let a 2 GiB graph through.\n\nAlso worth noting: the two commits on `docs/claude-md` and the `.kbd-orchestrator/` files are all still uncommitted/unpushed. This fix is unrelated work — I'd put it on its own branch rather than folding it in.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:05:43.579156Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T11:05:44.269089Z",
+      "updated_at": "2026-08-09T11:05:44.269089Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-0cf2eabc28e07ef7",
+      "title": "Karpathy session 0cf2eabc28e0",
+      "content": "## Delta\n\nFixed. The only remaining \"12 GB\" match is inside my new comment, where it's describing the past drift rather than claiming a current value.\n\nThe comment now points to `SCCACHE_CACHE_SIZE` in `[env]` instead of restating the number — a single source of truth, so it can't go stale again the way it just did. Config parses cleanly, and the declared `40G` matches what the live server actually reports (40 GiB max, on the WDD).\n\nThat closes out all three items: release build installed as `compass 0.3.6`, ~10.1 GB reclaimed locally, and the sccache config corrected so the internal disk stops accumulating cache.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 34d4343f-8edd-46e9-bb53-90b588e5d3ed\n- Captured: 2026-08-09T05:41:42.970513Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:34d4343f-8edd-46e9-bb53-90b588e5d3ed"
+      ],
+      "created_at": "2026-08-09T05:41:45.675152Z",
+      "updated_at": "2026-08-09T05:41:45.675152Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-1371f12708207b52",
+      "title": "Karpathy session 1371f1270820",
+      "content": "## Delta\n\nPlan vetted. Now the waypoint refresh and handoff — I'll hold off emitting OpenSpec change structures pending a scope question.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T12:21:59.257230Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- AGENTS.md\n- .kbd-orchestrator/\n- .prometheus/events.jsonl\n- .prometheus/knowledge/.prompt-snapshots/\n- .prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-session.md\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-15a46a623cf0e420.md\n- .prometheus/knowledge/wiki/karpathy-session-178be089fef7012d.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md\n- .prometheus/knowledge/wiki/karpathy-session-3383d6fb52bb5dce.md\n- .prometheus/knowledge/wiki/karpathy-session-4301f5fbc8d2baa8.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-7c287ce9b2192bd7.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-cd330c925600f45f.md\n- .prometheus/knowledge/wiki/karpathy-session-f8f9c99266231745.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T12:27:10.263975Z",
+      "updated_at": "2026-08-09T12:27:10.263975Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-15a46a623cf0e420",
+      "title": "Karpathy session 15a46a623cf0",
+      "content": "## Delta\n\nWritten to `/Users/gqadonis/Projects/prometheus/prometheus-skill-pack/docs/UPDATE_CONSIDERATIONS.md`.\n\nIt's structured as a handoff brief rather than the bare prompt — the same content, but organized so someone landing cold can act on it:\n\n- **Symptom + consequence** — the error, and the concrete drift it causes (`kbd-execute`, `kbd-spec`, `adversarial-review.md`), with the install-ref vs HEAD mismatch.\n- **Established by direct verification** — the three things I actually proved, with the hash evidence showing the manifest was wrong and the file was right.\n- **Open hypothesis** — `payloadRoot`, with four ranked candidates and an explicit instruction not to guess-and-patch. The likeliest answer (payload stages from HEAD → manifest must be committed) is called out as *structurally* meaning regeneration alone can't work.\n- **Constraints** — the concurrency guardrails, including that the two tree snapshots I took minutes apart already differed, so the listed file set is indicative only.\n- **Definition of done** — six checkable conditions, the last being that in-flight work survives untouched.\n- **Secondary defect** — the broken `.claude/skills` symlink, framed as arguably higher impact since it's the mechanism that let the staleness go unnoticed.\n- **Preventive follow-up** — proposal only, pointing at `check-harness-adapters.js` as the likely existing-but-unenforced check.\n\nI only created that one new file; nothing else in the repo was touched. Note the working tree there has kept growing — `kbd-init` workflow files across five harness surfaces are now modified — so that document is deliberately written to assume its own file list is stale.\n\nTwo loose ends still open here in Compass: the phase creation and `/kbd-analyze` on the partitioning question, plus the two unpushed commits on `docs/claude-md` and the untracked `.kbd-orchestrator/`. Since `kbd-analyze`'s `SKILL.md` is byte-identical between 1.6.2 and 1.7.0, running it now carries no version risk if you want to keep moving.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:22:19.272736Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- AGENTS.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T11:24:40.030753Z",
+      "updated_at": "2026-08-09T11:24:40.030753Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-178be089fef7012d",
+      "title": "Karpathy session 178be089fef7",
+      "content": "## Delta\n\nI have what I need to give you a straight answer — and it includes a correction to my own recommendation.\n\n## The doc comment tells you what this type is for\n\n```rust\n/// Deterministic typed records used to construct the five Prolly trees.\npub struct PartitionedGraph { ... }\n```\n\n`PartitionedGraph` isn't a general-purpose partitioning abstraction. It's **the input format for Prolly tree construction** — history's immutable-storage engine. The struct body is plain `Vec<(Vec<u8>, Vec<u8>)>` and looks portable, but the meaning is history-specific.\n\nThe producing logic confirms it. `into_partition` (`artifacts.rs:349-400+`) is entangled with concerns that don't exist on the current-graph path:\n\n| Dependency | Belongs to |\n|---|---|\n| `CompletionEvidence` | history realization completion |\n| `authoritative_sidecars` / `TRUSTED_GRAPH_CONTENT` | history provenance |\n| `AnalysisBundle`, `compass_ir::ProgramBundle` | `compass-analysis` / `compass-ir` |\n| `HistoryError` | history error taxonomy |\n| `prolly::{KeyBuilder, VersionedValue}` | Prolly storage |\n\nAnd the crate dependency sets diverge sharply. `compass-history` pulls `prolly-map`, `prolly-store-sqlite`, `compass-ir`, `compass-analysis`. `compass-graph` pulls none of those. A shared crate has to either carry that weight — forcing Prolly and IR onto the current-graph path, which contradicts the local-first minimal-dependency posture — or be gutted down to the struct alone.\n\n**If it's gutted to the struct alone, you've shared 9 lines of field declarations and left all 2,300 lines of actual logic behind.** That's not reuse.\n\n## What I'd do instead\n\nI over-indexed on \"the mechanism exists\" in the analysis. On closer reading, what exists is *history's* mechanism, and the shared-crate framing inherits a coupling that doesn't serve the current-graph path.\n\nThe sequencing finding still stands and is the load-bearing one: **stream `load_active_snapshot` first**. That removes the actual constraint. Whether current-graph publication later adopts a record-partitioned format is a separate question that gets much easier to answer *after* the read path stops materializing 2 GiB — and it may not need `PartitionedGraph`'s shape at all, since it has no Prolly trees to feed.\n\nSo I'd put the shared crate behind the streaming fix rather than in front of it.\n\nThat said — you've made a call, and you may be seeing a longer arc than I am (a future where current-graph and history publication genuinely converge, which would justify the shared crate now). If that's the intent, say so and I'll spec it properly. Three questions I'd need answered either way:\n\n1. **Crate name and scope** — `compass-partition`? Does it carry just the type, or the record-encoding helpers (`node_key`, `edge_key`, `hyperedge_key`, `canonical_json_bytes`) too?\n2. **Does it take the Prolly dependency?** If yes, `compass-graph` inherits it. If no, the encoding logic stays in history and the shared crate is nearly empty.\n3. **Identity semantics** — history fingerprints are meaning-affecting and realizations are immutable. If current-graph reuses the same record keys, do the two paths risk producing colliding or conflatable identities? AGENTS.md is strict here.\n\nWant me to spec the shared crate as you've directed, or run `/kbd-spec` on the streaming fix first and revisit this once the read path is honest?\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T12:09:31.964016Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- AGENTS.md\n- .kbd-orchestrator/\n- .prometheus/events.jsonl\n- .prometheus/knowledge/.prompt-snapshots/\n- .prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-session.md\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-15a46a623cf0e420.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md\n- .prometheus/knowledge/wiki/karpathy-session-3383d6fb52bb5dce.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-7c287ce9b2192bd7.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-cd330c925600f45f.md\n- .prometheus/knowledge/wiki/karpathy-session-f8f9c99266231745.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T12:09:34.902228Z",
+      "updated_at": "2026-08-09T12:09:34.902228Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-19802b94100a3ab3",
+      "title": "Karpathy session 19802b94100a",
+      "content": "## Delta\n\nCompleted kbd-assess — compass-scoping-and-bounds (step 0 of 0)\n\n## Answer: no, don't add scoping — it already exists and works\n\n**I need to correct my previous turn.** I told you the default ignore policy was missing `node_modules/`, `target/`, and `compass-out/`. That was wrong, and it was the premise of my whole recommendation. Reading the source disproves it:\n\n- All three are in `SKIP_DIRS` — ~40 entries at `crates/compass-files/src/detect.rs:61-102`\n- Gitignore respect defaults to `true` (`detect.rs:163`)\n- `.compassignore` is supported (`detect.rs:390`)\n- `--include`/`--exclude` already exist (`init_commands.rs:438-462`)\n\nBuilding scoping would have duplicated shipped functionality. That's the finding that changes the recommendation, and it came from checking the code rather than trusting my own earlier hypothesis.\n\n**What actually happened:** the exclusions fired correctly. That repo just has **9,320 in-scope markdown files — 4,827 under `crates/` alone**. The 19,666 matched files are real content, not leaked junk. This is a genuine capacity limit.\n\n**Research corroborates that Compass is already at or above baseline.** Firecrawl across `ck`, `codegraphcontext`, `.cursorignore`, ripgrep, and a formatter comparative study: respect `.gitignore` by default (\"the single highest-value default\"), ship hardcoded defaults, offer a tool-specific ignore file. Compass does all three, with a *larger* default list than the tools surveyed.\n\n**The real defects, in order:**\n\n| Pri | Defect |\n|---|---|\n| 1 | `COMPASS_MAX_GRAPH_BYTES` is honored in `compass-model`, `-output`, `-global`, `-core` — and their errors advertise it — but **not** on the snapshot path that actually failed. You hit a limit the rest of the product treats as adjustable, with no override. |\n| 2 | The error names a fact and stops — no override, no `--exclude` hint, no indication of what dominated the graph. |\n| 3 | Fails at 331 s after all work completes, then discards it. |\n| 4 | `vendor/` isn't skipped — but that needs a decision, not a reflex; Go monorepos and Compass's own tree legitimately use it. |\n\n**Two things I won't paper over:**\n\n- **My suggested `--exclude` workaround is untested and may not work.** With 4,827 markdown files under `crates/` — which you can't exclude without gutting the graph — it may still blow the cap.\n- **I'd resist raising the 2 GiB limit.** AGENTS.md is explicit that bounded work is an invariant and a limit error is distinct from an empty result. Grant an explicit opt-in override instead — which matches ripgrep's maintainer position that a paired explicit flag beats changing defaults.\n\n**Open architecture question for `/kbd-analyze`:** if a repo this size can't publish under 2 GiB even with sane exclusions, the answer may be graph partitioning rather than a bigger number. That should be settled before any code is written.\n\nAssessment written to `.kbd-orchestrator/phases/compass-scoping-and-bounds/assessment.md`. Note the phase is provisional — I didn't run `/kbd-new-phase`, so `active_phase` is still `null` and there's no `progress.json` (hence \"step 0 of 0\"). Say the word and I'll create it properly, or rename it.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:11:29.936317Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T11:11:30.692085Z",
+      "updated_at": "2026-08-09T11:11:30.692085Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-199d5165acd78a00",
+      "title": "Karpathy session 199d5165acd7",
+      "content": "## Delta\n\nCreated `CLAUDE.md` at the repo root.\n\nSince `AGENTS.md` is already a thorough agent guide, I wrote CLAUDE.md to defer to it rather than duplicate it, and concentrated on what it leaves implicit:\n\n**What's in it:**\n- **`CARGO_TARGET_DIR` requirement** — surfaced up top, since it must be set on every compiling invocation and is the easiest thing to get wrong. I also flagged the conflict where some Makefile targets (`install`, `dist`, `release-check`) resolve binaries through a literal `target/` path, which AGENTS.md mentions but doesn't tie to specific targets.\n- **Commands** — narrow-loop test/clippy per crate and per integration file, the workspace baseline, the surface-specific gates (product boundary, CompassQL TCK, code-graph qualification), and the npm workspace commands. Noted that `make test` is `--lib --bins` only while `make test-all` needs Python oracle setup.\n- **Architecture** — the piece that genuinely requires reading multiple files: the one-directional flow `compass-files → compass-languages → compass-resolve → compass-graph → compass-model`, orchestrated by `compass-core`. I emphasized the boundary that's easiest to violate — per-file extractors emit evidence and never resolve targets needing project-wide facts. Also the `compass-cypher` (syntax) vs `compass-query` (execution) split, immutable history realizations, and the generated viewer assets round-trip.\n- **Enforced constraints** — the lint set, determinism as correctness, boundedness (limit error ≠ empty result), and reuse of existing safe primitives.\n\nTwo notes on judgment calls: I skipped enumerating individual crates beyond the pipeline ones, since `docs/implementation/workspace-tour.md` already does that well and I pointed at it instead. I also didn't import anything from a Codex or Gemini config — I didn't check for those, as the instruction is to offer rather than read them. If you have an OpenAI Codex or Gemini CLI config you'd like folded in, reply `/import` and it'll scan and list what's importable.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:34:13.627630Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n- CLAUDE.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T10:34:32.153219Z",
+      "updated_at": "2026-08-09T10:34:32.153219Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-309fba26769d26dc",
+      "title": "Karpathy session 309fba26769d",
+      "content": "## Delta\n\nHere's a self-contained prompt for a session in the skill-pack repo. It's written to be safe alongside concurrent work — it assumes nothing about the working tree and stops rather than overwriting.\n\n````markdown\n# Fix: `update-skill-pack.sh` fails release payload verification, blocking 1.7.0 install\n\n## Context\n\nRepo: `/Users/gqadonis/Projects/prometheus/prometheus-skill-pack`\n(remote `git@github.com:Prometheus-AGS/prometheus-skill-system.git`)\n\n`bash scripts/update-skill-pack.sh` fails at step 2 and no new generation is\ninstalled:\n\n```\nStep 2: Building and verifying immutable generation...\ninstall-plugin-generation: release payload verification failed for shared/scripts/detect-toolchain.sh\n```\n\nConsequence: `~/.prometheus/plugins/prometheus-skill-pack/current` is pinned to\nan older generation. `~/.prometheus/skill-pack-install-ref` records `dfdd8be`\nwhile `main` is at `6e46758` (`v1.7.0-12-g6e46758`). Consumers of the pack are\nrunning stale skills; `kbd-execute/SKILL.md`, `kbd-spec/SKILL.md`, and\n`references/integrations/adversarial-review.md` are known to differ between\nsource and the last-installed generation.\n\n## What has already been established (verify, don't assume)\n\n1. `shared/harnesses/generated/release-manifest.json` was stale. Commit\n   `3c31581` (\"fix: stop reporting and restarting healthy forge-mcp and\n   sovereign-sync\") modified `shared/scripts/detect-toolchain.sh` and\n   `shared/scripts/service-probe.sh` **without regenerating the manifest**.\n   The manifest recorded pre-fix sha256 values for both. File modes were\n   correct (`0755`); only content hashes were wrong. 2 of 61 `runtimeFiles`\n   entries affected.\n\n2. Running `node scripts/generate-harness-adapters.js` rebuilt the manifest and\n   brought it to 0/61 stale (verified by re-hashing every entry against disk).\n\n3. **The install still fails with the identical error after that fix.** This is\n   the open problem.\n\n## Root-cause hypothesis to confirm or refute\n\n`verifyReleaseManifest(payloadRoot, ...)` in `scripts/install-plugin-generation.js`\n(~line 642) reads the manifest from `payloadRoot`, **not** from the source\ncheckout:\n\n```js\nconst manifestPath = path.join(payloadRoot, 'shared/harnesses/generated/release-manifest.json');\n```\n\nSo a corrected manifest in the working tree may not be what is verified. Trace\nhow `payloadRoot` is derived and where the staged payload originates. Candidate\nexplanations, in the order worth testing:\n\n- the payload is staged from `git archive`/HEAD rather than the working tree, so\n  the regenerated (uncommitted) manifest never reaches `payloadRoot`;\n- the payload is copied to a temp/staging dir that is cached or reused between\n  runs and was not invalidated;\n- `bundleId` is recomputed over `identity` and must also match `expectedBundle`\n  threaded in from elsewhere (note `generate-harness-adapters.js` printed\n  `Generated bundle 75cdf7e0df7f31a5ef319dd5580e7c852371546b6b8f0bbcad9b8c787b9586f3`);\n- two manifests exist and a different one wins at verification time.\n\nConfirm which by instrumenting or reading the code — do not guess and patch.\n\nIf the payload is staged from HEAD, the corrected manifest **must be committed**\nbefore the install can succeed. That is likely the actual fix, and it means the\nregeneration alone is insufficient.\n\n## Constraints — read before touching anything\n\n- **Concurrent work is in progress in this repo. Do not overwrite, revert, stash,\n  reset, checkout over, or clean anyone else's changes.**\n- At the time of investigation the working tree had these **pre-existing\n  uncommitted** changes, unrelated to this fix (mtimes predate the regeneration\n  run — `kbd-init/SKILL.md` was modified 06:19 today). Treat any of these you\n  find as someone else's in-flight work:\n\n  ```\n   M hooks/codex-hooks.json\n   M hooks/hooks.json\n   M scripts/test-skills.js\n   M shared/harnesses/generated/claude-hooks.json\n   M shared/harnesses/generated/release-manifest.json\n   M skills/process/kbd-process-orchestrator/references/co\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:22:15.521460Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- AGENTS.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T11:22:20.607957Z",
+      "updated_at": "2026-08-09T11:22:20.607957Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-3383d6fb52bb5dce",
+      "title": "Karpathy session 3383d6fb52bb",
+      "content": "## Delta\n\nCompleted kbd-analyze — compass-scoping-and-bounds (step 0 of 0)\n\n## Answer: don't shard — and don't build partitioning either, because it already exists\n\nTwo findings changed the picture, both from reading the code rather than reasoning about it.\n\n**1. `PartitionedGraph` already exists.** `compass-history/src/artifacts.rs:76-84` has full record-class partitioning — nodes, edges, hyperedges, analysis, metadata, program facts/summaries — with `partition()`, `into_partition()`, and `reconstruct()`. A grep for it outside `compass-history` returns nothing. The current-graph path doesn't use it. So the real question isn't \"should we build partitioning\" but \"why does `compass init` serialize one monolithic document when the mechanism sits in the next crate over?\"\n\n**2. The 2 GiB cap protects against a problem the docs deny exists.** `compass-store/src/lib.rs:44-51` justifies the limit by saying the store serves records \"through indexed scans instead of materializing the whole document.\" But `load_active_snapshot` at lines 838-853 does this:\n\n```rust\nlet capacity = usize::try_from(manifest.payload_bytes).unwrap_or(MAX_GRAPH_BYTES);\nlet mut bytes = Vec::with_capacity(capacity);\nfor index in 0..manifest.chunk_count {\n    bytes.extend_from_slice(&chunk.value);\n```\n\nIt pre-allocates the full payload and concatenates every chunk. Chunking bounds each *stored value*, not the reconstruction. Meanwhile the **write** path genuinely streams via `DigestWriter`. The asymmetry matters: the cap isn't protecting the writer, it's protecting the reader — the opposite of what the comment claims.\n\n**This produces a hard sequencing constraint.** Honoring `COMPASS_MAX_GRAPH_BYTES` on the publication path (G1, the obvious fix) **must not land first**. Raising the cap today raises a real allocation — an override would let someone request a multi-gigabyte contiguous `Vec`, which is a worse failure than today's clean error. Stream the read path first.\n\n**Research backed the direction unanimously.** Sharding targets multi-machine scaling; Compass is local-first single-process. Citus notes graph sharding brings eventual consistency, which the determinism invariant forbids outright. Azure's criteria (data exceeds single-instance capacity, vertical scaling exhausted) don't apply. Notably, the existing `PartitionedGraph` partitions by *record class, not topology* — sidestepping the edge-cut problem the literature flags as graph partitioning's hardest part.\n\n**Recommended order:** stream `load_active_snapshot` → actionable error (G2) → pre-flight estimate (G3) → *then* the override (G1) → `vendor/` policy (G4). Items 2, 3, 5 are independent and can run in parallel.\n\n**Where I'd temper confidence:** direction is well-supported, but three of four open questions are unmeasured — no consumer audit of `load_active_snapshot`, no measurement of what dominates the 2 GiB, and my `--exclude` workaround from earlier is *still untested* and may not fit under the cap given 4,827 markdown files under `crates/`. Sizing this work would be guesswork right now.\n\n**One architecture decision blocks the partitioning route:** `PartitionedGraph` lives in `compass-history`, but AGENTS.md routes current-graph publication to `compass-graph`. Shared crate, duplicate with distinct identity semantics, or new dependency? That needs your call before anyone touches item 6.\n\nPhase is now live — `active_phase` set, waypoint at `analysis_ready`, next command `/kbd-spec`. Files written: `goals.md`, `analysis.md`, `library-candidates.json`, `decision-log.md`, `handoffs/analyze.md`.\n\nStill unpushed: the two commits on `docs/claude-md` plus all of `.kbd-orchestrator/` untracked.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T12:05:00.281326Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- AGENTS.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-15a46a623cf0e420.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-7c287ce9b2192bd7.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T12:05:01.652519Z",
+      "updated_at": "2026-08-09T12:05:01.652519Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-4301f5fbc8d2baa8",
+      "title": "Karpathy session 4301f5fbc8d2",
+      "content": "## Delta\n\nCompleted kbd-spec — compass-scoping-and-bounds (step 0 of 6)\n\n## The audit changed the shape of the main change\n\nI ran the consumer audit that analyze had flagged as blocking. `read_snapshot` (`compass-store/src/lib.rs:829`) returns `(SnapshotManifest, Vec<u8>)` — the materialized payload is right in the signature. Eight call sites:\n\n- **`validate_snapshot`** (`:935`) — discards it: `.map(|(manifest, _)| manifest)`\n- **`snapshot_reference`** (`:1184`) — discards it: `let (manifest, _)`\n- Five tests, plus `compass-query` which calls `begin_read_snapshot` and then reads through **`GraphSnapshotReader::open_selector`** — an indexed reader that never materializes anything.\n\n**No production consumer uses those bytes.** The 2 GiB contiguous allocation happens for a value everything in production throws away. So C-001 is an API split — add a manifest-only read, reimplement the two callers on it — not the streaming refactor analyze assumed.\n\n## Six changes, three hard gates\n\n| ID | Change | Owner | Depends |\n|---|---|---|---|\n| C-001 | Stop materializing payload in `read_snapshot` | `compass-store` | — |\n| C-002 | Actionable limit error | `compass-graph`/`cli` | — |\n| C-003 | Pre-flight size estimate | `compass-core` | — |\n| C-004 | Honor `COMPASS_MAX_GRAPH_BYTES` | `compass-graph`/`store` | **C-001** |\n| C-005 | Extract `compass-partition` | new crate | **C-001** |\n| C-006 | `vendor/` skip policy | `compass-files` | — |\n\nThe gates: C-004 can't precede C-001 (an override before streaming lets someone request a multi-gigabyte `Vec`); C-002 must not advertise an override that doesn't exist yet; and C-005 must not pull `prolly-map`, `prolly-store-sqlite`, `compass-ir`, or `compass-analysis` onto the current-graph path — if that can't be satisfied, stop and report, because it means the shared-crate framing doesn't hold.\n\n## On the shared crate — scope stated plainly\n\nI specced it as you directed. What moves is dependency-light: `PartitionedGraph` (9 lines of fields), `node_key`/`edge_key`/`hyperedge_key`, and `canonical_json_bytes`. What stays is `into_partition` and everything coupled to `CompletionEvidence`, sidecars, `AnalysisBundle`, `ProgramBundle`, and Prolly.\n\nSo this extracts a struct and four functions from a 2,317-line module. It **positions for** current-graph partitioned publication without delivering it — that's a further change gated on the identity question. I've written that into the spec rather than letting the delivered scope be mistaken for the larger capability.\n\n## Two things blocking execution\n\n**`/Volumes/Workspace` is not mounted.** Every compiling command needs `CARGO_TARGET_DIR` pointed there. Nothing can be verified until that volume is back.\n\n**Identity/namespacing is unresolved** — history fingerprints are meaning-affecting and realizations immutable. Before any current-graph consumer adopts the shared keys, either namespace them per path or prove non-collision with a test. This blocks C-005 *adoption*, not the extraction itself.\n\nAlso still unverified since assessment: whether `--exclude` actually gets that repo under 2 GiB. With 4,827 markdown files under `crates/`, it may not.\n\nFiles written: `spec.md`, `tasks.json`, `handoffs/spec.md`, appended `decision-log.md`. Waypoint at `spec_ready`, 6 changes registered, next `/kbd-plan`.\n\nEverything in `.kbd-orchestrator/` is still untracked, and the two commits on `docs/claude-md` are unpushed.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T12:21:54.806670Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- AGENTS.md\n- .kbd-orchestrator/\n- .prometheus/events.jsonl\n- .prometheus/knowledge/.prompt-snapshots/\n- .prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-session.md\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-15a46a623cf0e420.md\n- .prometheus/knowledge/wiki/karpathy-session-178be089fef7012d.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md\n- .prometheus/knowledge/wiki/karpathy-session-3383d6fb52bb5dce.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-7c287ce9b2192bd7.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-cd330c925600f45f.md\n- .prometheus/knowledge/wiki/karpathy-session-f8f9c99266231745.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T12:22:00.073281Z",
+      "updated_at": "2026-08-09T12:22:00.073281Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-6aacc8d765a1b28f",
+      "title": "Karpathy session 6aacc8d765a1",
+      "content": "## Delta\n\nCompleted kbd-init — Compass\n\nTwo files written to `.kbd-orchestrator/`:\n\n**`project.json`** — discovery results:\n\n| Field | Value | Source |\n|---|---|---|\n| name / description | Compass — \"Native local-first knowledge graph engine…\" | `Cargo.toml` `[workspace.package]` |\n| stack | Rust (Edition 2024, pinned 1.97.1) | `Cargo.toml` + `rust-toolchain.toml` |\n| spec_paths | `openspec/specs/*.md` | `openspec/` exists (just initialized, currently empty) |\n| openspec_available | `true` | — |\n| workspace | single-project (`workspace_file: null`) | no `.code-workspace` references compass |\n| planning / execution agents | `claude` / `claude, codex, opencode` | the tools we just configured |\n| active_phase | `null` | no phase defined yet |\n\n**`constraints.md`** — I did **not** use the template's defaults. Those are TypeScript-oriented (`no-console-log`, `no-any-type`, `grep src/`) and would be inert in a Rust workspace with no `src/` at root. Instead I derived constraints from AGENTS.md: 16 blocking (unsafe/unwrap/expect/panic lints, product boundary vs. Graphify, local-first preservation, determinism, boundedness, immutable realizations, viewer-asset generation) and 17 warning (ownership boundary, extractor/resolver separation, compatibility documentation, the CompassQL and code-graph gates).\n\n**One thing needs your attention before any KBD phase runs a command:**\n\n`/Volumes/Workspace` **is not currently mounted** — only `Macintosh HD`, `my-passport`, and `Open Design` are. Every build/test/lint command in `project.json` sets `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main`, per the AGENTS.md mandate. As written, they'll fail until that volume is attached — which is the correct behavior, since AGENTS.md says to stop and report rather than fall back to a local `target/` on the 100 GB-capped main disk. I encoded the rule faithfully rather than silently substituting a working-but-wrong path.\n\nAlso worth noting: `openspec/specs/` is empty, so `spec_paths` currently resolves to nothing. That's expected for a fresh init — specs appear once you run `/opsx:new`.\n\nThese two files are untracked and uncommitted, separate from the two commits already on `docs/claude-md`. Next step is `/kbd-status` to confirm, then `/kbd-new-phase <name>` to start the first phase.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:58:32.187142Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T11:01:48.963380Z",
+      "updated_at": "2026-08-09T11:01:48.963380Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-6ee868a466335f1d",
+      "title": "Karpathy session 6ee868a46633",
+      "content": "## Delta\n\nIt's from `AGENTS.md` lines 24–56, committed in your repo — \"Disk and external-checkout policy.\" It's not something I invented.\n\nThe rule says the main disk is capped at 100 GB, so Cargo artifacts must go on a mounted workspace volume, with the literal example path `/Volumes/Workspace/crabbuild-target/compass-main`. And explicitly: *\"If `/Volumes/Workspace` is unavailable, stop and report it rather than falling back to a local `target/` directory.\"*\n\nThat's why I kept checking it and kept flagging it as a blocker — the policy tells me to stop rather than build locally.\n\nCurrently mounted: `Macintosh HD`, `my-passport`, `Open Design`. No `Workspace`.\n\nSo one of these is true, and only you know which:\n\n- **The volume is just detached** — plug it in and the rule works as written.\n- **It got renamed** (`my-passport`? something else?) — then `AGENTS.md` has a stale path and should be corrected.\n- **The whole policy is obsolete** — maybe disk pressure was resolved and this rule outlived its purpose. Note the wiki transcripts from earlier today mention reclaiming ~10.1 GB and fixing sccache config, so something in this area did change recently.\n\nIf it's stale or obsolete, `AGENTS.md` is the fix — and I'd want that corrected before execution, because I baked those paths into `.kbd-orchestrator/project.json` and `constraints.md`, which are now committed. Every build/test/lint command there points at `/Volumes/Workspace`.\n\nWhich is it? If you tell me the volume is gone for good, I'll update `AGENTS.md`, `project.json`, and `constraints.md` together so they stop referencing a path that doesn't exist.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T12:31:22.016671Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .prometheus/knowledge/wiki/karpathy-session-badb024212b1a395.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T12:31:50.167151Z",
+      "updated_at": "2026-08-09T12:31:50.167151Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-7521e456ead1ce12",
+      "title": "Karpathy session 7521e456ead1",
+      "content": "## Delta\n\nBoth done.\n\n**Deleted the local sccache** — `~/Library/Caches/Mozilla.sccache` (10 GB) is gone and has not been recreated. Verified safe first: the live sccache server was serving `/Volumes/my-passport/sccache`, and the local dir had zero writes in the preceding 5 minutes even with an active build running.\n\n**Set `SCCACHE_DIR` in `~/.cargo/config.toml`** — added an `[env]` block pinning `SCCACHE_DIR = \"/Volumes/my-passport/sccache\"` and `SCCACHE_CACHE_SIZE = \"40G\"`, with a comment explaining the failure mode so it isn't re-litigated later. Config parses cleanly.\n\nI deliberately left off `force = true`: your `.zshrc` exports the identical value so there's no conflict, and staying unforced keeps one-off `SCCACHE_DIR=... cargo build` overrides working. Cargo's `[env]` applies to every invocation, so the non-login shells that previously bypassed the `.zshrc` guard now get the WDD path.\n\nFree space went 367 → 373 GiB. It reads lower than the raw 10 GB because an unrelated Rust build is running concurrently and consuming space as it compiles.\n\nTwo caveats worth stating plainly:\n\n- **My verification of the config was static, not functional.** I tried a real build to prove `SCCACHE_DIR` reaches a compiler process, but it hung — it inherited your `rustc-wrapper` and queued behind that concurrent surrealdb build saturating all 10 job slots. I killed and cleaned it up. So I confirmed the file parses with the right values, not that a build observes them end-to-end. Cargo `[env]` semantics are well-defined here, but if you want proof, run any build once the current one finishes and check `sccache --show-stats` still reports the WDD location.\n- **`[env]` doesn't cover non-cargo callers.** Anything invoking `sccache` directly — some CMake/C++ paths, for instance — still relies on the shell export. Your `.zshrc` handles login shells; a stray non-login shell could in principle recreate the default dir. Worth a periodic `du -sh ~/Library/Caches/Mozilla.sccache` to catch it early.\n\nThere's also a **stale comment** at line 12 of the config saying \"warm 12 GB cache on the WDD\" — the actual max is 40 GB. I left it alone since it's outside what you asked for, but I can fix it if you want.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 34d4343f-8edd-46e9-bb53-90b588e5d3ed\n- Captured: 2026-08-09T05:36:52.482414Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:34d4343f-8edd-46e9-bb53-90b588e5d3ed"
+      ],
+      "created_at": "2026-08-09T05:36:58.206699Z",
+      "updated_at": "2026-08-09T05:36:58.206699Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-762f04f1710fc991",
+      "title": "Karpathy session 762f04f1710f",
+      "content": "## Delta\n\nCompleted kbd-init — Compass\n\nTwo files written to `.kbd-orchestrator/`:\n\n**`project.json`** — discovery results:\n\n| Field | Value | Source |\n|---|---|---|\n| name / description | Compass — \"Native local-first knowledge graph engine…\" | `Cargo.toml` `[workspace.package]` |\n| stack | Rust (Edition 2024, pinned 1.97.1) | `Cargo.toml` + `rust-toolchain.toml` |\n| spec_paths | `openspec/specs/*.md` | `openspec/` exists (just initialized, currently empty) |\n| openspec_available | `true` | — |\n| workspace | single-project (`workspace_file: null`) | no `.code-workspace` references compass |\n| planning / execution agents | `claude` / `claude, codex, opencode` | the tools we just configured |\n| active_phase | `null` | no phase defined yet |\n\n**`constraints.md`** — I did **not** use the template's defaults. Those are TypeScript-oriented (`no-console-log`, `no-any-type`, `grep src/`) and would be inert in a Rust workspace with no `src/` at root. Instead I derived constraints from AGENTS.md: 16 blocking (unsafe/unwrap/expect/panic lints, product boundary vs. Graphify, local-first preservation, determinism, boundedness, immutable realizations, viewer-asset generation) and 17 warning (ownership boundary, extractor/resolver separation, compatibility documentation, the CompassQL and code-graph gates).\n\n**One thing needs your attention before any KBD phase runs a command:**\n\n`/Volumes/Workspace` **is not currently mounted** — only `Macintosh HD`, `my-passport`, and `Open Design` are. Every build/test/lint command in `project.json` sets `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main`, per the AGENTS.md mandate. As written, they'll fail until that volume is attached — which is the correct behavior, since AGENTS.md says to stop and report rather than fall back to a local `target/` on the 100 GB-capped main disk. I encoded the rule faithfully rather than silently substituting a working-but-wrong path.\n\nAlso worth noting: `openspec/specs/` is empty, so `spec_paths` currently resolves to nothing. That's expected for a fresh init — specs appear once you run `/opsx:new`.\n\nThese two files are untracked and uncommitted, separate from the two commits already on `docs/claude-md`. Next step is `/kbd-status` to confirm, then `/kbd-new-phase <name>` to start the first phase.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:01:46.520733Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T11:01:52.216303Z",
+      "updated_at": "2026-08-09T11:01:52.216303Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-7c287ce9b2192bd7",
+      "title": "Karpathy session 7c287ce9b219",
+      "content": "## Delta\n\nWritten to `/Users/gqadonis/Projects/prometheus/prometheus-skill-pack/docs/UPDATE_CONSIDERATIONS.md`.\n\nIt's structured as a handoff brief rather than the bare prompt — the same content, but organized so someone landing cold can act on it:\n\n- **Symptom + consequence** — the error, and the concrete drift it causes (`kbd-execute`, `kbd-spec`, `adversarial-review.md`), with the install-ref vs HEAD mismatch.\n- **Established by direct verification** — the three things I actually proved, with the hash evidence showing the manifest was wrong and the file was right.\n- **Open hypothesis** — `payloadRoot`, with four ranked candidates and an explicit instruction not to guess-and-patch. The likeliest answer (payload stages from HEAD → manifest must be committed) is called out as *structurally* meaning regeneration alone can't work.\n- **Constraints** — the concurrency guardrails, including that the two tree snapshots I took minutes apart already differed, so the listed file set is indicative only.\n- **Definition of done** — six checkable conditions, the last being that in-flight work survives untouched.\n- **Secondary defect** — the broken `.claude/skills` symlink, framed as arguably higher impact since it's the mechanism that let the staleness go unnoticed.\n- **Preventive follow-up** — proposal only, pointing at `check-harness-adapters.js` as the likely existing-but-unenforced check.\n\nI only created that one new file; nothing else in the repo was touched. Note the working tree there has kept growing — `kbd-init` workflow files across five harness surfaces are now modified — so that document is deliberately written to assume its own file list is stale.\n\nTwo loose ends still open here in Compass: the phase creation and `/kbd-analyze` on the partitioning question, plus the two unpushed commits on `docs/claude-md` and the untracked `.kbd-orchestrator/`. Since `kbd-analyze`'s `SKILL.md` is byte-identical between 1.6.2 and 1.7.0, running it now carries no version risk if you want to keep moving.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:24:38.852780Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- AGENTS.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-15a46a623cf0e420.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T11:24:40.732045Z",
+      "updated_at": "2026-08-09T11:24:40.732045Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-7da9adb3b7b11504",
+      "title": "Karpathy session 7da9adb3b7b1",
+      "content": "## Delta\n\nIt's from `AGENTS.md` lines 24–56, committed in your repo — \"Disk and external-checkout policy.\" It's not something I invented.\n\nThe rule says the main disk is capped at 100 GB, so Cargo artifacts must go on a mounted workspace volume, with the literal example path `/Volumes/Workspace/crabbuild-target/compass-main`. And explicitly: *\"If `/Volumes/Workspace` is unavailable, stop and report it rather than falling back to a local `target/` directory.\"*\n\nThat's why I kept checking it and kept flagging it as a blocker — the policy tells me to stop rather than build locally.\n\nCurrently mounted: `Macintosh HD`, `my-passport`, `Open Design`. No `Workspace`.\n\nSo one of these is true, and only you know which:\n\n- **The volume is just detached** — plug it in and the rule works as written.\n- **It got renamed** (`my-passport`? something else?) — then `AGENTS.md` has a stale path and should be corrected.\n- **The whole policy is obsolete** — maybe disk pressure was resolved and this rule outlived its purpose. Note the wiki transcripts from earlier today mention reclaiming ~10.1 GB and fixing sccache config, so something in this area did change recently.\n\nIf it's stale or obsolete, `AGENTS.md` is the fix — and I'd want that corrected before execution, because I baked those paths into `.kbd-orchestrator/project.json` and `constraints.md`, which are now committed. Every build/test/lint command there points at `/Volumes/Workspace`.\n\nWhich is it? If you tell me the volume is gone for good, I'll update `AGENTS.md`, `project.json`, and `constraints.md` together so they stop referencing a path that doesn't exist.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T12:31:25.361399Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .prometheus/knowledge/wiki/karpathy-session-6ee868a466335f1d.md\n- .prometheus/knowledge/wiki/karpathy-session-badb024212b1a395.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T12:31:50.620113Z",
+      "updated_at": "2026-08-09T12:31:50.620113Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-85be47bbe3d4faec",
+      "title": "Karpathy session 85be47bbe3d4",
+      "content": "## Delta\n\nFixed. The only remaining \"12 GB\" match is inside my new comment, where it's describing the past drift rather than claiming a current value.\n\nThe comment now points to `SCCACHE_CACHE_SIZE` in `[env]` instead of restating the number — a single source of truth, so it can't go stale again the way it just did. Config parses cleanly, and the declared `40G` matches what the live server actually reports (40 GiB max, on the WDD).\n\nThat closes out all three items: release build installed as `compass 0.3.6`, ~10.1 GB reclaimed locally, and the sccache config corrected so the internal disk stops accumulating cache.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 34d4343f-8edd-46e9-bb53-90b588e5d3ed\n- Captured: 2026-08-09T05:36:56.574046Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:34d4343f-8edd-46e9-bb53-90b588e5d3ed"
+      ],
+      "created_at": "2026-08-09T05:39:57.963184Z",
+      "updated_at": "2026-08-09T05:39:57.963184Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-87bd3daa965ea4d0",
+      "title": "Karpathy session 87bd3daa965e",
+      "content": "## Delta\n\nAll four steps done.\n\n## 1. Upstream remote added and fetched\n\n`upstream` → `https://github.com/crabbuild/compass.git`. Confirmed your repo is a fork of `crabbuild/compass` (`Cargo.toml` already pointed there).\n\n## 2. Not already fixed\n\n`upstream/main` still has **7 occurrences** in `AGENTS.md`. No existing issue mentioned `Volumes` or `CARGO_TARGET_DIR`.\n\n## 3. Merged\n\n`upstream/main` merged cleanly — 38 files, including the 0.3.7 release and query-recall work.\n\n## 4. Removed, and it was worse than documentation\n\nThe blast radius was ~60 occurrences across 25 tracked files, and **two were executable, not advisory**:\n\n- **`scripts/qualify_compass_store_release.sh` hard-failed with `exit 1`** unless the volume was mounted — the store qualification gate was unrunnable for anyone else.\n- **Both qualification scripts** used `${CARGO_TARGET_DIR:-/Volumes/Workspace/...}`, silently writing to an absolute path outside the checkout when the var was unset.\n- `skills/compass-release/SKILL.md` gated the release procedure on `test -d /Volumes/Workspace`.\n\nCommitted as `5bd14cd4` (41 files). Both scripts pass `bash -n`. I kept the guidance that's actually project-relevant — per-checkout target dirs, the non-persistence of `CARGO_TARGET_DIR`, read-only qualification repos — and dropped only the machine-specific mandate. Docs now use `<cargo-target-dir>` / `<qualification-corpus-root>` placeholders.\n\nI also regenerated `.kbd-orchestrator/project.json` and `constraints.md`, and cleared the \"environment blocker\" from the phase artifacts. **The plan is now executable** — that blocker was an artifact of the bad rule, not a real constraint.\n\nHistorical `.prometheus` transcripts were left untouched; they record what was true when written.\n\n## 5. Issue filed\n\n**https://github.com/crabbuild/compass/issues/211**\n\nIt leads with the agent-workflow impact (an agent following `AGENTS.md` faithfully refuses to verify anything), documents the executable failures with code, and offers a PR.\n\nYour branch is now 4 commits ahead plus the merge. Two things worth deciding: whether to push and open that upstream PR, and whether to run `/kbd-execute` on C-001 now that nothing blocks it.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T12:42:07.361443Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- No changed paths detected.\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T12:42:07.953294Z",
+      "updated_at": "2026-08-09T12:42:07.953294Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-8b2e071dd73e1374",
+      "title": "Karpathy session 8b2e071dd73e",
+      "content": "## Delta\n\nI've traced it. Here's what's actually going on — and part of it contradicts the premise.\n\n## Why 1.6.2 is resolving\n\n**1.7.0 was never installed.** The cache holds only `1.6.0`, `1.6.1`, `1.6.2`. Your source repo at `/Users/gqadonis/Projects/prometheus/prometheus-skill-pack` is tagged `v1.7.0` (12 commits past it, working tree clean), but that was never published into the plugin cache. The newest cache dir is dated Aug 3; the `.prometheus` generation is Aug 5. The tag exists locally and nowhere else.\n\nThere's also a **second, unrelated breakage**: `~/.claude/skills/kbd-init` symlinks to `~/.prometheus/plugins/prometheus-skill-pack/current/skills/process/kbd-process-orchestrator/skills/kbd-init` — a path that doesn't resolve. That's why I fell back to the cache at the start of this session. Two different install roots (`.claude/plugins/cache` and `.prometheus/plugins/generations`), and the symlink points into the one that's broken.\n\n## But the premise doesn't hold for this work\n\nI diffed the source tree against 1.6.2 directly. **The entire `kbd-process-orchestrator` differs in exactly three files:**\n\n| File | Status |\n|---|---|\n| `references/integrations/adversarial-review.md` | differs |\n| `skills/kbd-execute/SKILL.md` | differs |\n| `skills/kbd-spec/SKILL.md` | differs |\n\nEverything else is byte-identical. Specifically:\n\n- **`kbd-analyze` exists in 1.6.2 and its `SKILL.md` is identical to 1.7.0.** My earlier \"no analyze.md\" observation was about the `prompts/` directory — and `prompts/` has no `analyze.md` in **1.7.0 either**. `kbd-analyze` is driven by its `SKILL.md`, not a prompt file. That's not a version gap; I misread it.\n- `kbd-assess/SKILL.md`, `kbd-init/SKILL.md`, `kbd-new-phase/SKILL.md`, `prompts/assess.md`, `project.template.json`, and the adversarial-review preflight script are all **identical** between source and 1.6.2.\n\nSo the `/kbd-init` and `/kbd-assess` runs already completed used the same bytes 1.7.0 would have. No rework needed there.\n\nThe three drifted files matter for `/kbd-execute` and `/kbd-spec` — stages we haven't reached.\n\n## Your call\n\nI can't publish 1.7.0 into the plugin cache myself — that's your packaging pipeline, and I don't know its publish command. Options:\n\n1. **Publish 1.7.0 properly** — you run the pack's install/publish step; I re-verify and continue. Cleanest, and fixes the broken `~/.claude/skills` symlink if the installer rewrites it.\n2. **Continue on 1.6.2 for analyze** — legitimate here, since `kbd-analyze` is byte-identical. Then upgrade before `/kbd-spec` or `/kbd-execute`, where the drift is real.\n3. **Point the KBD skills at the source tree directly** for this session.\n\nI'd suggest **1**, since the symlink is broken regardless and will keep biting. But **2** is defensible if you want to keep moving on the partitioning question now — the risk is genuinely zero for the analyze stage.\n\nWhich way?\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:14:51.722543Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T11:14:53.968282Z",
+      "updated_at": "2026-08-09T11:14:53.968282Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-8cd321cc802fed9d",
+      "title": "Karpathy session 8cd321cc802f",
+      "content": "## Delta\n\n**It was in the original `AGENTS.md`.** Not the skill pack, not me.\n\n- Introduced in commit `dd14b3ce`, *\"docs: add AI contributor guidance\"*, on **2026-08-01** by **forhappy** — eight days before this session.\n- Present at `57b9fe28`, the commit this session started from, with 7 occurrences of `/Volumes/Workspace`.\n\nThe only `AGENTS.md` change during this session was the Prometheus state-ownership section — 9 lines, added by you, entirely about `.prometheus/` paths. The disk policy was untouched.\n\nSo the chain is: `AGENTS.md` mandated it → I applied it when generating `.kbd-orchestrator/project.json` and `constraints.md` during `/kbd-init` → the KBD `kbd-init` skill's own guidance reinforces it (\"Read `AGENTS.md`… for mandatory command wrappers, environment variables, toolchain selectors, and storage paths… Treat a command policy as transitive\"). But the *source* of the path is your repo's committed contributor guidance from a week ago.\n\nWhich raises the real question: **does that volume actually exist on your machine, or is `dd14b3ce` describing someone else's setup?** `forhappy` isn't the git user configured here (that's Travis James). If this guidance came from a different contributor's environment, the path may never have been valid for you — which would make it a stale rule in `AGENTS.md`, not a missing drive.\n\nIf that's the case, the fix is to correct `AGENTS.md` first, then regenerate `project.json` and `constraints.md` from it. Want me to look at what that section should say for your actual setup?\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T12:32:12.077290Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .prometheus/knowledge/wiki/karpathy-session-6ee868a466335f1d.md\n- .prometheus/knowledge/wiki/karpathy-session-7da9adb3b7b11504.md\n- .prometheus/knowledge/wiki/karpathy-session-b1a29789942105c1.md\n- .prometheus/knowledge/wiki/karpathy-session-badb024212b1a395.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T12:32:13.511112Z",
+      "updated_at": "2026-08-09T12:32:13.511112Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-8f202396ae5617a5",
+      "title": "Karpathy session 8f202396ae56",
+      "content": "## Delta\n\nThe `kbd-init` mtime is 06:19 today — well before this session's regeneration. Those were already-pending working-tree changes, not collateral from my run. Retrying the install:\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:14:56.866886Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T11:20:15.494977Z",
+      "updated_at": "2026-08-09T11:20:15.494977Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-9354b74ff25823d0",
+      "title": "Karpathy session 9354b74ff258",
+      "content": "## Delta\n\nThat's the real cause: 9,320 in-scope markdown files, with **4,827 in `crates/`** alone. This is genuine content at genuine scale, not junk. Let me write the assessment.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:05:46.513453Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T11:10:48.901378Z",
+      "updated_at": "2026-08-09T11:10:48.901378Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-95e26dce31a612a2",
+      "title": "Karpathy session 95e26dce31a6",
+      "content": "## Delta\n\nFixed. The only remaining \"12 GB\" match is inside my new comment, where it's describing the past drift rather than claiming a current value.\n\nThe comment now points to `SCCACHE_CACHE_SIZE` in `[env]` instead of restating the number — a single source of truth, so it can't go stale again the way it just did. Config parses cleanly, and the declared `40G` matches what the live server actually reports (40 GiB max, on the WDD).\n\nThat closes out all three items: release build installed as `compass 0.3.6`, ~10.1 GB reclaimed locally, and the sccache config corrected so the internal disk stops accumulating cache.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 34d4343f-8edd-46e9-bb53-90b588e5d3ed\n- Captured: 2026-08-09T05:38:38.245900Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:34d4343f-8edd-46e9-bb53-90b588e5d3ed"
+      ],
+      "created_at": "2026-08-09T05:41:46.141746Z",
+      "updated_at": "2026-08-09T05:41:46.141746Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-a0b489beb0d312d9",
+      "title": "Karpathy session a0b489beb0d3",
+      "content": "## Delta\n\nCommitted as `dd7679fb` on a new branch `docs/claude-md` (1 file, 212 insertions).\n\nTwo things worth flagging:\n\n- **I branched off `main` rather than committing directly to it**, per the repo's git conventions. Say the word if you'd rather this land on `main` directly.\n- **`.prometheus/` was left untracked** — it looked like local tooling state, not part of this change, and AGENTS.md explicitly says not to commit local state directories. Let me know if it's actually meant to be tracked.\n\nNothing is pushed yet. I can push and open a PR if you want.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:52:26.193194Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T10:52:30.420142Z",
+      "updated_at": "2026-08-09T10:52:30.420142Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-b0a4e7ceb012e58d",
+      "title": "Karpathy session b0a4e7ceb012",
+      "content": "## Delta\n\nCompleted kbd-init — Compass\n\nTwo files written to `.kbd-orchestrator/`:\n\n**`project.json`** — discovery results:\n\n| Field | Value | Source |\n|---|---|---|\n| name / description | Compass — \"Native local-first knowledge graph engine…\" | `Cargo.toml` `[workspace.package]` |\n| stack | Rust (Edition 2024, pinned 1.97.1) | `Cargo.toml` + `rust-toolchain.toml` |\n| spec_paths | `openspec/specs/*.md` | `openspec/` exists (just initialized, currently empty) |\n| openspec_available | `true` | — |\n| workspace | single-project (`workspace_file: null`) | no `.code-workspace` references compass |\n| planning / execution agents | `claude` / `claude, codex, opencode` | the tools we just configured |\n| active_phase | `null` | no phase defined yet |\n\n**`constraints.md`** — I did **not** use the template's defaults. Those are TypeScript-oriented (`no-console-log`, `no-any-type`, `grep src/`) and would be inert in a Rust workspace with no `src/` at root. Instead I derived constraints from AGENTS.md: 16 blocking (unsafe/unwrap/expect/panic lints, product boundary vs. Graphify, local-first preservation, determinism, boundedness, immutable realizations, viewer-asset generation) and 17 warning (ownership boundary, extractor/resolver separation, compatibility documentation, the CompassQL and code-graph gates).\n\n**One thing needs your attention before any KBD phase runs a command:**\n\n`/Volumes/Workspace` **is not currently mounted** — only `Macintosh HD`, `my-passport`, and `Open Design` are. Every build/test/lint command in `project.json` sets `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main`, per the AGENTS.md mandate. As written, they'll fail until that volume is attached — which is the correct behavior, since AGENTS.md says to stop and report rather than fall back to a local `target/` on the 100 GB-capped main disk. I encoded the rule faithfully rather than silently substituting a working-but-wrong path.\n\nAlso worth noting: `openspec/specs/` is empty, so `spec_paths` currently resolves to nothing. That's expected for a fresh init — specs appear once you run `/opsx:new`.\n\nThese two files are untracked and uncommitted, separate from the two commits already on `docs/claude-md`. Next step is `/kbd-status` to confirm, then `/kbd-new-phase <name>` to start the first phase.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:55:59.021325Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T10:58:30.244136Z",
+      "updated_at": "2026-08-09T10:58:30.244136Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-b1a29789942105c1",
+      "title": "Karpathy session b1a297899421",
+      "content": "## Delta\n\nIt's from `AGENTS.md` lines 24–56, committed in your repo — \"Disk and external-checkout policy.\" It's not something I invented.\n\nThe rule says the main disk is capped at 100 GB, so Cargo artifacts must go on a mounted workspace volume, with the literal example path `/Volumes/Workspace/crabbuild-target/compass-main`. And explicitly: *\"If `/Volumes/Workspace` is unavailable, stop and report it rather than falling back to a local `target/` directory.\"*\n\nThat's why I kept checking it and kept flagging it as a blocker — the policy tells me to stop rather than build locally.\n\nCurrently mounted: `Macintosh HD`, `my-passport`, `Open Design`. No `Workspace`.\n\nSo one of these is true, and only you know which:\n\n- **The volume is just detached** — plug it in and the rule works as written.\n- **It got renamed** (`my-passport`? something else?) — then `AGENTS.md` has a stale path and should be corrected.\n- **The whole policy is obsolete** — maybe disk pressure was resolved and this rule outlived its purpose. Note the wiki transcripts from earlier today mention reclaiming ~10.1 GB and fixing sccache config, so something in this area did change recently.\n\nIf it's stale or obsolete, `AGENTS.md` is the fix — and I'd want that corrected before execution, because I baked those paths into `.kbd-orchestrator/project.json` and `constraints.md`, which are now committed. Every build/test/lint command there points at `/Volumes/Workspace`.\n\nWhich is it? If you tell me the volume is gone for good, I'll update `AGENTS.md`, `project.json`, and `constraints.md` together so they stop referencing a path that doesn't exist.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T12:30:02.796796Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .prometheus/knowledge/wiki/karpathy-session-6ee868a466335f1d.md\n- .prometheus/knowledge/wiki/karpathy-session-7da9adb3b7b11504.md\n- .prometheus/knowledge/wiki/karpathy-session-badb024212b1a395.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T12:31:51.013497Z",
+      "updated_at": "2026-08-09T12:31:51.013497Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-b5d49ca1d46e60a2",
+      "title": "Karpathy session b5d49ca1d46e",
+      "content": "## Delta\n\nBoth commits are on `docs/claude-md`:\n\n| Commit | Contents |\n|---|---|\n| `dd7679fb` | `docs: add CLAUDE.md agent guide` — 1 file |\n| `c349fdf6` | `chore: track Prometheus wiki and initialize OpenSpec` — 73 files, 12,227 insertions |\n\n**What landed:**\n- **`.prometheus/knowledge/wiki/`** — all 12 files tracked as-is, per your call.\n- **OpenSpec** initialized with `schema: spec-driven`, generating `.claude/`, `.codex/`, `.kimi/`, `.opencode/` plus `openspec/config.yaml`.\n\n**Three things to know:**\n\n1. **Zed got nothing.** It isn't a supported `openspec init` target, so there's no generated config for it. If you use Zed here, that gap is still open — I can hand-write a rules file, but it'd be unofficial and liable to drift from openspec's format.\n\n2. **Kimi has skills but no commands.** OpenSpec reported \"Commands skipped for: kimi (no adapter)\" — it got 10 skill files, no `/opsx:*` slash commands. Claude, Codex, and OpenCode got both.\n\n3. **`.claude/settings.local.json` stayed untracked.** It's your personal permission allowlist with machine-specific paths, and your global gitignore already excludes it — so it was never at risk of being committed.\n\n`openspec/config.yaml` is currently all commented-out scaffolding. Its `context:` field feeds project background to AI tools when creating artifacts, and this repo has strong conventions worth putting there (local-first Rust, no-unwrap/expect/panic lints, determinism requirements, the `CARGO_TARGET_DIR` rule). Want me to fill it in?\n\nNothing is pushed yet. Say the word and I'll push and open a PR.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:52:28.835309Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- No changed paths detected.\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T10:56:00.254334Z",
+      "updated_at": "2026-08-09T10:56:00.254334Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-b6f086fb31ed31c5",
+      "title": "Karpathy session b6f086fb31ed",
+      "content": "## Delta\n\nBoth commits are on `docs/claude-md`:\n\n| Commit | Contents |\n|---|---|\n| `dd7679fb` | `docs: add CLAUDE.md agent guide` — 1 file |\n| `c349fdf6` | `chore: track Prometheus wiki and initialize OpenSpec` — 73 files, 12,227 insertions |\n\n**What landed:**\n- **`.prometheus/knowledge/wiki/`** — all 12 files tracked as-is, per your call.\n- **OpenSpec** initialized with `schema: spec-driven`, generating `.claude/`, `.codex/`, `.kimi/`, `.opencode/` plus `openspec/config.yaml`.\n\n**Three things to know:**\n\n1. **Zed got nothing.** It isn't a supported `openspec init` target, so there's no generated config for it. If you use Zed here, that gap is still open — I can hand-write a rules file, but it'd be unofficial and liable to drift from openspec's format.\n\n2. **Kimi has skills but no commands.** OpenSpec reported \"Commands skipped for: kimi (no adapter)\" — it got 10 skill files, no `/opsx:*` slash commands. Claude, Codex, and OpenCode got both.\n\n3. **`.claude/settings.local.json` stayed untracked.** It's your personal permission allowlist with machine-specific paths, and your global gitignore already excludes it — so it was never at risk of being committed.\n\n`openspec/config.yaml` is currently all commented-out scaffolding. Its `context:` field feeds project background to AI tools when creating artifacts, and this repo has strong conventions worth putting there (local-first Rust, no-unwrap/expect/panic lints, determinism requirements, the `CARGO_TARGET_DIR` rule). Want me to fill it in?\n\nNothing is pushed yet. Say the word and I'll push and open a PR.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:55:56.151200Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T10:56:01.152228Z",
+      "updated_at": "2026-08-09T10:56:01.152228Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-badb024212b1a395",
+      "title": "Karpathy session badb024212b1",
+      "content": "## Delta\n\nCommitted as `eced6dec` — 48 files, 4,679 insertions. Working tree is clean.\n\nThree commits now on `docs/claude-md`:\n\n| Commit | Contents |\n|---|---|\n| `dd7679fb` | `docs: add CLAUDE.md agent guide` — 1 file |\n| `c349fdf6` | `chore: track Prometheus wiki and initialize OpenSpec` — 73 files |\n| `eced6dec` | `chore(kbd): track orchestrator state and Prometheus knowledge` — 48 files |\n\n**What landed in this one:**\n- **`.kbd-orchestrator/`** — all 17 files: `project.json`, `constraints.md`, the six phase artifacts for `compass-scoping-and-bounds`, three stage handoffs, both machine contracts, and the waypoint at `plan_ready`.\n- **`.prometheus/`** — 24 new wiki transcripts (grown from 10 during this session), `events.jsonl`, and the prompt snapshots.\n- **`AGENTS.md`** — the Prometheus state ownership rule.\n\nTwo things worth noting:\n\n**Your `AGENTS.md` edit settled the question I raised earlier.** It now explicitly classifies `.prometheus/knowledge/wiki/**` as repository-owned tracked content \"including generated session transcripts and their embedded machine-specific project paths.\" That's a repository rule authorizing exactly what I'd flagged as a concern, so the earlier objection is resolved on the record rather than just overridden.\n\n**I scanned before staging** — ran a pattern check for API keys, tokens, and private key headers across both new directories. Nothing matched. `.claude/settings.local.json` stayed untracked, protected by your global gitignore.\n\nNothing is pushed. The branch is three commits ahead of `main`, and `/Volumes/Workspace` is still unmounted, so C-001 can't be verified yet. Say the word and I'll push and open a PR.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T12:29:59.534218Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- No changed paths detected.\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T12:30:00.586013Z",
+      "updated_at": "2026-08-09T12:30:00.586013Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-bb64c62e88af6029",
+      "title": "Karpathy session bb64c62e88af",
+      "content": "## Delta\n\nCreated `CLAUDE.md` at the repo root.\n\nSince `AGENTS.md` is already a thorough agent guide, I wrote CLAUDE.md to defer to it rather than duplicate it, and concentrated on what it leaves implicit:\n\n**What's in it:**\n- **`CARGO_TARGET_DIR` requirement** — surfaced up top, since it must be set on every compiling invocation and is the easiest thing to get wrong. I also flagged the conflict where some Makefile targets (`install`, `dist`, `release-check`) resolve binaries through a literal `target/` path, which AGENTS.md mentions but doesn't tie to specific targets.\n- **Commands** — narrow-loop test/clippy per crate and per integration file, the workspace baseline, the surface-specific gates (product boundary, CompassQL TCK, code-graph qualification), and the npm workspace commands. Noted that `make test` is `--lib --bins` only while `make test-all` needs Python oracle setup.\n- **Architecture** — the piece that genuinely requires reading multiple files: the one-directional flow `compass-files → compass-languages → compass-resolve → compass-graph → compass-model`, orchestrated by `compass-core`. I emphasized the boundary that's easiest to violate — per-file extractors emit evidence and never resolve targets needing project-wide facts. Also the `compass-cypher` (syntax) vs `compass-query` (execution) split, immutable history realizations, and the generated viewer assets round-trip.\n- **Enforced constraints** — the lint set, determinism as correctness, boundedness (limit error ≠ empty result), and reuse of existing safe primitives.\n\nTwo notes on judgment calls: I skipped enumerating individual crates beyond the pipeline ones, since `docs/implementation/workspace-tour.md` already does that well and I pointed at it instead. I also didn't import anything from a Codex or Gemini config — I didn't check for those, as the instruction is to offer rather than read them. If you have an OpenAI Codex or Gemini CLI config you'd like folded in, reply `/import` and it'll scan and list what's importable.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:37:15.181272Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n- CLAUDE.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T10:37:28.812655Z",
+      "updated_at": "2026-08-09T10:37:28.812655Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-c13ff840014cf2b3",
+      "title": "Karpathy session c13ff840014c",
+      "content": "## Delta\n\n`cargo config` needs nightly. Let me verify with a functional test instead — the stronger check anyway, since it proves the var reaches a real build process.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 34d4343f-8edd-46e9-bb53-90b588e5d3ed\n- Captured: 2026-08-09T05:20:58.608418Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- No changed paths detected.\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:34d4343f-8edd-46e9-bb53-90b588e5d3ed"
+      ],
+      "created_at": "2026-08-09T05:26:55.781482Z",
+      "updated_at": "2026-08-09T05:26:55.781482Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-ca329344b0f175d8",
+      "title": "Karpathy session ca329344b0f1",
+      "content": "## Delta\n\nCompleted kbd-plan — compass-scoping-and-bounds (step 0 of 6)\n\n## Plan written — 6 changes, 2 waves\n\n```\nWave 1 (parallel)          Wave 2 (after C-001)\n├── C-001  read_snapshot   ├── C-004  env override   [HARD GATE]\n├── C-002  error message   └── C-005  compass-partition\n├── C-003  size estimate\n└── C-006  vendor/ policy\n```\n\nBackend is **OpenSpec** (`openspec/` present, `openspec_available: true`). No evolver cycle.\n\n**Apply C-001 first** — it's the only Wave 1 item that unblocks others, and the spec-stage audit shrank it from a streaming refactor to an API split.\n\nThe adversarial pass found no surviving CRITICAL: the ordering error this stage exists to catch (C-004 before C-001) was already caught at spec, and is now enforced twice — by wave structure and by an inline gate on the change itself.\n\n**Two coupling risks worth watching:**\n\n- **C-002 ↔ C-004 share the error text.** C-002 must *omit* the `COMPASS_MAX_GRAPH_BYTES` mention (advertising a nonexistent override is the exact defect being fixed), then C-004 adds it. If C-004 slips, C-002's message stays permanently incomplete. Tracked rather than assumed.\n- **C-003 has testable criteria but no calibration data.** Measuring what actually dominates the 2 GiB is its *first task*, not an afterthought — otherwise it ships an invented heuristic.\n\n## One blocker stops execution outright\n\n**`/Volumes/Workspace` is still not mounted** — I re-checked at plan time. Every compiling command needs `CARGO_TARGET_DIR` beneath it, and AGENTS.md explicitly forbids falling back to a local `target/`. **Every acceptance checkbox in this plan is unverifiable until that volume is back.** The plan is complete and correct; it just isn't runnable yet.\n\n## I stopped short of one step\n\nStep 10 of the skill emits OpenSpec change structures — six `/opsx:new` invocations creating `openspec/changes/<id>/` directories with proposals. I've written the exact commands into `plan.md` but haven't run them, for two reasons: it's six new tracked directories in your repo, and creating scaffolding for changes that can't be verified yet may be premature. Say the word and I'll emit all six, or just C-001.\n\nFiles written: `plan.md`, `current-waypoint.md`, `handoffs/plan.md`; waypoint at `plan_ready`, `progress.json` marked `plan_complete`.\n\nStill outstanding from earlier: two unpushed commits on `docs/claude-md`, and all of `.kbd-orchestrator/` untracked.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T12:27:40.809364Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- AGENTS.md\n- .kbd-orchestrator/\n- .prometheus/events.jsonl\n- .prometheus/knowledge/.prompt-snapshots/\n- .prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-session.md\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-1371f12708207b52.md\n- .prometheus/knowledge/wiki/karpathy-session-15a46a623cf0e420.md\n- .prometheus/knowledge/wiki/karpathy-session-178be089fef7012d.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md\n- .prometheus/knowledge/wiki/karpathy-session-3383d6fb52bb5dce.md\n- .prometheus/knowledge/wiki/karpathy-session-4301f5fbc8d2baa8.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-7c287ce9b2192bd7.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-cd330c925600f45f.md\n- .prometheus/knowledge/wiki/karpathy-session-e2c00470b2ce9770.md\n- .prometheus/knowledge/wiki/karpathy-session-f8f9c99266231745.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T12:28:29.645888Z",
+      "updated_at": "2026-08-09T12:28:29.645888Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-cd330c925600f45f",
+      "title": "Karpathy session cd330c925600",
+      "content": "## Delta\n\nI have what I need to give you a straight answer — and it includes a correction to my own recommendation.\n\n## The doc comment tells you what this type is for\n\n```rust\n/// Deterministic typed records used to construct the five Prolly trees.\npub struct PartitionedGraph { ... }\n```\n\n`PartitionedGraph` isn't a general-purpose partitioning abstraction. It's **the input format for Prolly tree construction** — history's immutable-storage engine. The struct body is plain `Vec<(Vec<u8>, Vec<u8>)>` and looks portable, but the meaning is history-specific.\n\nThe producing logic confirms it. `into_partition` (`artifacts.rs:349-400+`) is entangled with concerns that don't exist on the current-graph path:\n\n| Dependency | Belongs to |\n|---|---|\n| `CompletionEvidence` | history realization completion |\n| `authoritative_sidecars` / `TRUSTED_GRAPH_CONTENT` | history provenance |\n| `AnalysisBundle`, `compass_ir::ProgramBundle` | `compass-analysis` / `compass-ir` |\n| `HistoryError` | history error taxonomy |\n| `prolly::{KeyBuilder, VersionedValue}` | Prolly storage |\n\nAnd the crate dependency sets diverge sharply. `compass-history` pulls `prolly-map`, `prolly-store-sqlite`, `compass-ir`, `compass-analysis`. `compass-graph` pulls none of those. A shared crate has to either carry that weight — forcing Prolly and IR onto the current-graph path, which contradicts the local-first minimal-dependency posture — or be gutted down to the struct alone.\n\n**If it's gutted to the struct alone, you've shared 9 lines of field declarations and left all 2,300 lines of actual logic behind.** That's not reuse.\n\n## What I'd do instead\n\nI over-indexed on \"the mechanism exists\" in the analysis. On closer reading, what exists is *history's* mechanism, and the shared-crate framing inherits a coupling that doesn't serve the current-graph path.\n\nThe sequencing finding still stands and is the load-bearing one: **stream `load_active_snapshot` first**. That removes the actual constraint. Whether current-graph publication later adopts a record-partitioned format is a separate question that gets much easier to answer *after* the read path stops materializing 2 GiB — and it may not need `PartitionedGraph`'s shape at all, since it has no Prolly trees to feed.\n\nSo I'd put the shared crate behind the streaming fix rather than in front of it.\n\nThat said — you've made a call, and you may be seeing a longer arc than I am (a future where current-graph and history publication genuinely converge, which would justify the shared crate now). If that's the intent, say so and I'll spec it properly. Three questions I'd need answered either way:\n\n1. **Crate name and scope** — `compass-partition`? Does it carry just the type, or the record-encoding helpers (`node_key`, `edge_key`, `hyperedge_key`, `canonical_json_bytes`) too?\n2. **Does it take the Prolly dependency?** If yes, `compass-graph` inherits it. If no, the encoding logic stays in history and the shared crate is nearly empty.\n3. **Identity semantics** — history fingerprints are meaning-affecting and realizations are immutable. If current-graph reuses the same record keys, do the two paths risk producing colliding or conflatable identities? AGENTS.md is strict here.\n\nWant me to spec the shared crate as you've directed, or run `/kbd-spec` on the streaming fix first and revisit this once the read path is honest?\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T12:06:25.091241Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- AGENTS.md\n- .kbd-orchestrator/\n- .prometheus/events.jsonl\n- .prometheus/knowledge/.prompt-snapshots/\n- .prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-session.md\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-15a46a623cf0e420.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md\n- .prometheus/knowledge/wiki/karpathy-session-3383d6fb52bb5dce.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-7c287ce9b2192bd7.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T12:06:26.089450Z",
+      "updated_at": "2026-08-09T12:06:26.089450Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-e2c00470b2ce9770",
+      "title": "Karpathy session e2c00470b2ce",
+      "content": "## Delta\n\nCompleted kbd-plan — compass-scoping-and-bounds (step 0 of 6)\n\n## Plan written — 6 changes, 2 waves\n\n```\nWave 1 (parallel)          Wave 2 (after C-001)\n├── C-001  read_snapshot   ├── C-004  env override   [HARD GATE]\n├── C-002  error message   └── C-005  compass-partition\n├── C-003  size estimate\n└── C-006  vendor/ policy\n```\n\nBackend is **OpenSpec** (`openspec/` present, `openspec_available: true`). No evolver cycle.\n\n**Apply C-001 first** — it's the only Wave 1 item that unblocks others, and the spec-stage audit shrank it from a streaming refactor to an API split.\n\nThe adversarial pass found no surviving CRITICAL: the ordering error this stage exists to catch (C-004 before C-001) was already caught at spec, and is now enforced twice — by wave structure and by an inline gate on the change itself.\n\n**Two coupling risks worth watching:**\n\n- **C-002 ↔ C-004 share the error text.** C-002 must *omit* the `COMPASS_MAX_GRAPH_BYTES` mention (advertising a nonexistent override is the exact defect being fixed), then C-004 adds it. If C-004 slips, C-002's message stays permanently incomplete. Tracked rather than assumed.\n- **C-003 has testable criteria but no calibration data.** Measuring what actually dominates the 2 GiB is its *first task*, not an afterthought — otherwise it ships an invented heuristic.\n\n## One blocker stops execution outright\n\n**`/Volumes/Workspace` is still not mounted** — I re-checked at plan time. Every compiling command needs `CARGO_TARGET_DIR` beneath it, and AGENTS.md explicitly forbids falling back to a local `target/`. **Every acceptance checkbox in this plan is unverifiable until that volume is back.** The plan is complete and correct; it just isn't runnable yet.\n\n## I stopped short of one step\n\nStep 10 of the skill emits OpenSpec change structures — six `/opsx:new` invocations creating `openspec/changes/<id>/` directories with proposals. I've written the exact commands into `plan.md` but haven't run them, for two reasons: it's six new tracked directories in your repo, and creating scaffolding for changes that can't be verified yet may be premature. Say the word and I'll emit all six, or just C-001.\n\nFiles written: `plan.md`, `current-waypoint.md`, `handoffs/plan.md`; waypoint at `plan_ready`, `progress.json` marked `plan_complete`.\n\nStill outstanding from earlier: two unpushed commits on `docs/claude-md`, and all of `.kbd-orchestrator/` untracked.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T12:27:37.267036Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- AGENTS.md\n- .kbd-orchestrator/\n- .prometheus/events.jsonl\n- .prometheus/knowledge/.prompt-snapshots/\n- .prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-session.md\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-1371f12708207b52.md\n- .prometheus/knowledge/wiki/karpathy-session-15a46a623cf0e420.md\n- .prometheus/knowledge/wiki/karpathy-session-178be089fef7012d.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md\n- .prometheus/knowledge/wiki/karpathy-session-3383d6fb52bb5dce.md\n- .prometheus/knowledge/wiki/karpathy-session-4301f5fbc8d2baa8.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-7c287ce9b2192bd7.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-cd330c925600f45f.md\n- .prometheus/knowledge/wiki/karpathy-session-f8f9c99266231745.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T12:27:38.259256Z",
+      "updated_at": "2026-08-09T12:27:38.259256Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-f8eff00b52d5f657",
+      "title": "Karpathy session f8eff00b52d5",
+      "content": "## Delta\n\nCreated `CLAUDE.md` at the repo root.\n\nSince `AGENTS.md` is already a thorough agent guide, I wrote CLAUDE.md to defer to it rather than duplicate it, and concentrated on what it leaves implicit:\n\n**What's in it:**\n- **`CARGO_TARGET_DIR` requirement** — surfaced up top, since it must be set on every compiling invocation and is the easiest thing to get wrong. I also flagged the conflict where some Makefile targets (`install`, `dist`, `release-check`) resolve binaries through a literal `target/` path, which AGENTS.md mentions but doesn't tie to specific targets.\n- **Commands** — narrow-loop test/clippy per crate and per integration file, the workspace baseline, the surface-specific gates (product boundary, CompassQL TCK, code-graph qualification), and the npm workspace commands. Noted that `make test` is `--lib --bins` only while `make test-all` needs Python oracle setup.\n- **Architecture** — the piece that genuinely requires reading multiple files: the one-directional flow `compass-files → compass-languages → compass-resolve → compass-graph → compass-model`, orchestrated by `compass-core`. I emphasized the boundary that's easiest to violate — per-file extractors emit evidence and never resolve targets needing project-wide facts. Also the `compass-cypher` (syntax) vs `compass-query` (execution) split, immutable history realizations, and the generated viewer assets round-trip.\n- **Enforced constraints** — the lint set, determinism as correctness, boundedness (limit error ≠ empty result), and reuse of existing safe primitives.\n\nTwo notes on judgment calls: I skipped enumerating individual crates beyond the pipeline ones, since `docs/implementation/workspace-tour.md` already does that well and I pointed at it instead. I also didn't import anything from a Codex or Gemini config — I didn't check for those, as the instruction is to offer rather than read them. If you have an OpenAI Codex or Gemini CLI config you'd like folded in, reply `/import` and it'll scan and list what's importable.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:34:10.259136Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n- CLAUDE.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T10:34:18.362064Z",
+      "updated_at": "2026-08-09T10:34:18.362064Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-f8f9c99266231745",
+      "title": "Karpathy session f8f9c9926623",
+      "content": "## Delta\n\nI have what I need to give you a straight answer — and it includes a correction to my own recommendation.\n\n## The doc comment tells you what this type is for\n\n```rust\n/// Deterministic typed records used to construct the five Prolly trees.\npub struct PartitionedGraph { ... }\n```\n\n`PartitionedGraph` isn't a general-purpose partitioning abstraction. It's **the input format for Prolly tree construction** — history's immutable-storage engine. The struct body is plain `Vec<(Vec<u8>, Vec<u8>)>` and looks portable, but the meaning is history-specific.\n\nThe producing logic confirms it. `into_partition` (`artifacts.rs:349-400+`) is entangled with concerns that don't exist on the current-graph path:\n\n| Dependency | Belongs to |\n|---|---|\n| `CompletionEvidence` | history realization completion |\n| `authoritative_sidecars` / `TRUSTED_GRAPH_CONTENT` | history provenance |\n| `AnalysisBundle`, `compass_ir::ProgramBundle` | `compass-analysis` / `compass-ir` |\n| `HistoryError` | history error taxonomy |\n| `prolly::{KeyBuilder, VersionedValue}` | Prolly storage |\n\nAnd the crate dependency sets diverge sharply. `compass-history` pulls `prolly-map`, `prolly-store-sqlite`, `compass-ir`, `compass-analysis`. `compass-graph` pulls none of those. A shared crate has to either carry that weight — forcing Prolly and IR onto the current-graph path, which contradicts the local-first minimal-dependency posture — or be gutted down to the struct alone.\n\n**If it's gutted to the struct alone, you've shared 9 lines of field declarations and left all 2,300 lines of actual logic behind.** That's not reuse.\n\n## What I'd do instead\n\nI over-indexed on \"the mechanism exists\" in the analysis. On closer reading, what exists is *history's* mechanism, and the shared-crate framing inherits a coupling that doesn't serve the current-graph path.\n\nThe sequencing finding still stands and is the load-bearing one: **stream `load_active_snapshot` first**. That removes the actual constraint. Whether current-graph publication later adopts a record-partitioned format is a separate question that gets much easier to answer *after* the read path stops materializing 2 GiB — and it may not need `PartitionedGraph`'s shape at all, since it has no Prolly trees to feed.\n\nSo I'd put the shared crate behind the streaming fix rather than in front of it.\n\nThat said — you've made a call, and you may be seeing a longer arc than I am (a future where current-graph and history publication genuinely converge, which would justify the shared crate now). If that's the intent, say so and I'll spec it properly. Three questions I'd need answered either way:\n\n1. **Crate name and scope** — `compass-partition`? Does it carry just the type, or the record-encoding helpers (`node_key`, `edge_key`, `hyperedge_key`, `canonical_json_bytes`) too?\n2. **Does it take the Prolly dependency?** If yes, `compass-graph` inherits it. If no, the encoding logic stays in history and the shared crate is nearly empty.\n3. **Identity semantics** — history fingerprints are meaning-affecting and realizations are immutable. If current-graph reuses the same record keys, do the two paths risk producing colliding or conflatable identities? AGENTS.md is strict here.\n\nWant me to spec the shared crate as you've directed, or run `/kbd-spec` on the streaming fix first and revisit this once the read path is honest?\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T12:05:04.010581Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- AGENTS.md\n- .kbd-orchestrator/\n- .prometheus/events.jsonl\n- .prometheus/knowledge/.prompt-snapshots/\n- .prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-session.md\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-15a46a623cf0e420.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md\n- .prometheus/knowledge/wiki/karpathy-session-3383d6fb52bb5dce.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-7c287ce9b2192bd7.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-cd330c925600f45f.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T12:06:26.689357Z",
+      "updated_at": "2026-08-09T12:06:26.689357Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    },
+    {
+      "id": "karpathy-session-f90cdbd5fafd1d1d",
+      "title": "Karpathy session f90cdbd5fafd",
+      "content": "## Delta\n\nCompleted kbd-init — Compass\n\nTwo files written to `.kbd-orchestrator/`:\n\n**`project.json`** — discovery results:\n\n| Field | Value | Source |\n|---|---|---|\n| name / description | Compass — \"Native local-first knowledge graph engine…\" | `Cargo.toml` `[workspace.package]` |\n| stack | Rust (Edition 2024, pinned 1.97.1) | `Cargo.toml` + `rust-toolchain.toml` |\n| spec_paths | `openspec/specs/*.md` | `openspec/` exists (just initialized, currently empty) |\n| openspec_available | `true` | — |\n| workspace | single-project (`workspace_file: null`) | no `.code-workspace` references compass |\n| planning / execution agents | `claude` / `claude, codex, opencode` | the tools we just configured |\n| active_phase | `null` | no phase defined yet |\n\n**`constraints.md`** — I did **not** use the template's defaults. Those are TypeScript-oriented (`no-console-log`, `no-any-type`, `grep src/`) and would be inert in a Rust workspace with no `src/` at root. Instead I derived constraints from AGENTS.md: 16 blocking (unsafe/unwrap/expect/panic lints, product boundary vs. Graphify, local-first preservation, determinism, boundedness, immutable realizations, viewer-asset generation) and 17 warning (ownership boundary, extractor/resolver separation, compatibility documentation, the CompassQL and code-graph gates).\n\n**One thing needs your attention before any KBD phase runs a command:**\n\n`/Volumes/Workspace` **is not currently mounted** — only `Macintosh HD`, `my-passport`, and `Open Design` are. Every build/test/lint command in `project.json` sets `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main`, per the AGENTS.md mandate. As written, they'll fail until that volume is attached — which is the correct behavior, since AGENTS.md says to stop and report rather than fall back to a local `target/` on the 100 GB-capped main disk. I encoded the rule faithfully rather than silently substituting a working-but-wrong path.\n\nAlso worth noting: `openspec/specs/` is empty, so `spec_paths` currently resolves to nothing. That's expected for a fresh init — specs appear once you run `/opsx:new`.\n\nThese two files are untracked and uncommitted, separate from the two commits already on `docs/claude-md`. Next step is `/kbd-status` to confirm, then `/kbd-new-phase <name>` to start the first phase.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:58:29.463044Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n",
+      "tags": [
+        "karpathy",
+        "session-learning"
+      ],
+      "links": [],
+      "sources": [
+        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
+      ],
+      "created_at": "2026-08-09T10:58:32.854406Z",
+      "updated_at": "2026-08-09T10:58:32.854406Z",
+      "revision": 0,
+      "entry_type": "SessionRecord",
+      "description": null,
+      "extra": {}
+    }
+  ]
+}
diff --git a/.prometheus/knowledge/wiki/compass-scoping-and-bounds-completion-capture.md b/.prometheus/knowledge/wiki/compass-scoping-and-bounds-completion-capture.md
new file mode 100644
index 000000000..a792abbbd
--- /dev/null
+++ b/.prometheus/knowledge/wiki/compass-scoping-and-bounds-completion-capture.md
@@ -0,0 +1,34 @@
+---
+type: Reference
+id: compass-scoping-and-bounds-completion-capture
+title: Compass scoping and bounds completion capture
+tags:
+- compass
+- executor-session
+- scoping
+- session-record
+links:
+- compass-scoping-and-bounds-executor-session
+sources:
+- stdin
+timestamp: 2026-08-09T12:42:25.785210+00:00
+created_at: 2026-08-09T12:42:25.785210+00:00
+updated_at: 2026-08-09T12:42:25.785210+00:00
+revision: 0
+---
+
+## Session Record
+
+- Executor session completed for phase `compass-scoping-and-bounds`.
+- Reported change status: `unknown`.
+- No implementation delta, root cause, changed paths, or corrective actions were present in the capture.
+
+## Handling Notes
+
+- Preserve as a minimal execution record.
+- Do not infer code changes or operational impact from this record alone.
+- Related minimal record: [Compass scoping and bounds executor session](/compass-scoping-and-bounds-executor-session.md).
+
+# Citations
+
+1. stdin
\ No newline at end of file
diff --git a/.prometheus/knowledge/wiki/index.md b/.prometheus/knowledge/wiki/index.md
index a2f433c29..396110d13 100644
--- a/.prometheus/knowledge/wiki/index.md
+++ b/.prometheus/knowledge/wiki/index.md
@@ -2,6 +2,7 @@
 
 ## Reference
 
+* [Compass scoping and bounds completion capture](/compass-scoping-and-bounds-completion-capture.md)
 * [Compass scoping and bounds executor session](/compass-scoping-and-bounds-executor-session.md)
 
 ## SessionRecord
@@ -25,6 +26,7 @@
 * [Karpathy session 7c287ce9b219](/karpathy-session-7c287ce9b2192bd7.md)
 * [Karpathy session 7da9adb3b7b1](/karpathy-session-7da9adb3b7b11504.md)
 * [Karpathy session 85be47bbe3d4](/karpathy-session-85be47bbe3d4faec.md)
+* [Karpathy session 87bd3daa965e](/karpathy-session-87bd3daa965ea4d0.md)
 * [Karpathy session 8b2e071dd73e](/karpathy-session-8b2e071dd73e1374.md)
 * [Karpathy session 8cd321cc802f](/karpathy-session-8cd321cc802fed9d.md)
 * [Karpathy session 8f202396ae56](/karpathy-session-8f202396ae5617a5.md)
diff --git a/.prometheus/knowledge/wiki/karpathy-session-495b53196088c2c2.md b/.prometheus/knowledge/wiki/karpathy-session-495b53196088c2c2.md
new file mode 100644
index 000000000..2c444b4c4
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-495b53196088c2c2.md
@@ -0,0 +1,73 @@
+---
+type: SessionRecord
+id: karpathy-session-495b53196088c2c2
+title: Karpathy session 495b53196088
+tags:
+- karpathy
+- session-learning
+sources:
+- session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+timestamp: 2026-08-09T12:42:18.774839+00:00
+created_at: 2026-08-09T12:42:18.774839+00:00
+updated_at: 2026-08-09T12:42:18.774839+00:00
+revision: 0
+---
+
+## Delta
+
+All four steps done.
+
+## 1. Upstream remote added and fetched
+
+`upstream` → `https://github.com/crabbuild/compass.git`. Confirmed your repo is a fork of `crabbuild/compass` (`Cargo.toml` already pointed there).
+
+## 2. Not already fixed
+
+`upstream/main` still has **7 occurrences** in `AGENTS.md`. No existing issue mentioned `Volumes` or `CARGO_TARGET_DIR`.
+
+## 3. Merged
+
+`upstream/main` merged cleanly — 38 files, including the 0.3.7 release and query-recall work.
+
+## 4. Removed, and it was worse than documentation
+
+The blast radius was ~60 occurrences across 25 tracked files, and **two were executable, not advisory**:
+
+- **`scripts/qualify_compass_store_release.sh` hard-failed with `exit 1`** unless the volume was mounted — the store qualification gate was unrunnable for anyone else.
+- **Both qualification scripts** used `${CARGO_TARGET_DIR:-/Volumes/Workspace/...}`, silently writing to an absolute path outside the checkout when the var was unset.
+- `skills/compass-release/SKILL.md` gated the release procedure on `test -d /Volumes/Workspace`.
+
+Committed as `5bd14cd4` (41 files). Both scripts pass `bash -n`. I kept the guidance that's actually project-relevant — per-checkout target dirs, the non-persistence of `CARGO_TARGET_DIR`, read-only qualification repos — and dropped only the machine-specific mandate. Docs now use `<cargo-target-dir>` / `<qualification-corpus-root>` placeholders.
+
+I also regenerated `.kbd-orchestrator/project.json` and `constraints.md`, and cleared the "environment blocker" from the phase artifacts. **The plan is now executable** — that blocker was an artifact of the bad rule, not a real constraint.
+
+Historical `.prometheus` transcripts were left untouched; they record what was true when written.
+
+## 5. Issue filed
+
+**https://github.com/crabbuild/compass/issues/211**
+
+It leads with the agent-workflow impact (an agent following `AGENTS.md` faithfully refuses to verify anything), documents the executable failures with code, and offers a PR.
+
+Your branch is now 4 commits ahead plus the merge. Two things worth deciding: whether to push and open that upstream PR, and whether to run `/kbd-execute` on C-001 now that nothing blocks it.
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+- Captured: 2026-08-09T12:42:10.951859Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .prometheus/knowledge/wiki/index.md
+- .prometheus/knowledge/wiki/log.md
+- .prometheus/knowledge/wiki/karpathy-session-87bd3daa965ea4d0.md
diff --git a/.prometheus/knowledge/wiki/karpathy-session-87bd3daa965ea4d0.md b/.prometheus/knowledge/wiki/karpathy-session-87bd3daa965ea4d0.md
new file mode 100644
index 000000000..9dacb709a
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-87bd3daa965ea4d0.md
@@ -0,0 +1,71 @@
+---
+type: SessionRecord
+id: karpathy-session-87bd3daa965ea4d0
+title: Karpathy session 87bd3daa965e
+tags:
+- karpathy
+- session-learning
+sources:
+- session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+timestamp: 2026-08-09T12:42:07.953294+00:00
+created_at: 2026-08-09T12:42:07.953294+00:00
+updated_at: 2026-08-09T12:42:07.953294+00:00
+revision: 0
+---
+
+## Delta
+
+All four steps done.
+
+## 1. Upstream remote added and fetched
+
+`upstream` → `https://github.com/crabbuild/compass.git`. Confirmed your repo is a fork of `crabbuild/compass` (`Cargo.toml` already pointed there).
+
+## 2. Not already fixed
+
+`upstream/main` still has **7 occurrences** in `AGENTS.md`. No existing issue mentioned `Volumes` or `CARGO_TARGET_DIR`.
+
+## 3. Merged
+
+`upstream/main` merged cleanly — 38 files, including the 0.3.7 release and query-recall work.
+
+## 4. Removed, and it was worse than documentation
+
+The blast radius was ~60 occurrences across 25 tracked files, and **two were executable, not advisory**:
+
+- **`scripts/qualify_compass_store_release.sh` hard-failed with `exit 1`** unless the volume was mounted — the store qualification gate was unrunnable for anyone else.
+- **Both qualification scripts** used `${CARGO_TARGET_DIR:-/Volumes/Workspace/...}`, silently writing to an absolute path outside the checkout when the var was unset.
+- `skills/compass-release/SKILL.md` gated the release procedure on `test -d /Volumes/Workspace`.
+
+Committed as `5bd14cd4` (41 files). Both scripts pass `bash -n`. I kept the guidance that's actually project-relevant — per-checkout target dirs, the non-persistence of `CARGO_TARGET_DIR`, read-only qualification repos — and dropped only the machine-specific mandate. Docs now use `<cargo-target-dir>` / `<qualification-corpus-root>` placeholders.
+
+I also regenerated `.kbd-orchestrator/project.json` and `constraints.md`, and cleared the "environment blocker" from the phase artifacts. **The plan is now executable** — that blocker was an artifact of the bad rule, not a real constraint.
+
+Historical `.prometheus` transcripts were left untouched; they record what was true when written.
+
+## 5. Issue filed
+
+**https://github.com/crabbuild/compass/issues/211**
+
+It leads with the agent-workflow impact (an agent following `AGENTS.md` faithfully refuses to verify anything), documents the executable failures with code, and offers a PR.
+
+Your branch is now 4 commits ahead plus the merge. Two things worth deciding: whether to push and open that upstream PR, and whether to run `/kbd-execute` on C-001 now that nothing blocks it.
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+- Captured: 2026-08-09T12:42:07.361443Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- No changed paths detected.
diff --git a/.prometheus/knowledge/wiki/log.md b/.prometheus/knowledge/wiki/log.md
index 164f96f3f..b37f47715 100644
--- a/.prometheus/knowledge/wiki/log.md
+++ b/.prometheus/knowledge/wiki/log.md
@@ -1,6 +1,9 @@
 # Update Log
 
 ## 2026-08-09
+* **Creation**: [Compass scoping and bounds completion capture](/compass-scoping-and-bounds-completion-capture.md)
+* **Ingest**: [Karpathy session 495b53196088](/karpathy-session-495b53196088c2c2.md)
+* **Ingest**: [Karpathy session 87bd3daa965e](/karpathy-session-87bd3daa965ea4d0.md)
 * **Ingest**: [Karpathy session 8cd321cc802f](/karpathy-session-8cd321cc802fed9d.md)
 * **Ingest**: [Karpathy session b1a297899421](/karpathy-session-b1a29789942105c1.md)
 * **Ingest**: [Karpathy session 7da9adb3b7b1](/karpathy-session-7da9adb3b7b11504.md)

From 5a2525be3556f5291f571fc585fffaea21756e3f Mon Sep 17 00:00:00 2001
From: Travis James <travis@tribehealthsolutions.com>
Date: Sat, 29 Aug 2026 14:36:27 -0500
Subject: [PATCH 6/6] feat: complete compass scoping and bounds phase

Implement the full phase across bounded graph storage and query contracts, latest MCP conformance, native agent distribution, installed harness qualification, and phase-first build policy.

Co-Authored-By: Warp <agent@warp.dev>
---
 .agents/skills/.openspec-target               |    1 +
 .../skills/openspec-apply-change/SKILL.md     |   42 +-
 .../skills/openspec-archive-change/SKILL.md   |  182 +
 .../openspec-bulk-archive-change/SKILL.md     |  339 ++
 .../skills/openspec-continue-change/SKILL.md  |   46 +-
 .../skills/openspec-explore/SKILL.md          |   42 +-
 .agents/skills/openspec-ff-change/SKILL.md    |  113 +
 .../skills/openspec-new-change/SKILL.md       |    6 +-
 .../skills/openspec-onboard/SKILL.md          |   74 +-
 .agents/skills/openspec-sync-specs/SKILL.md   |  262 ++
 .../skills/openspec-verify-change/SKILL.md    |   17 +-
 .cargo/config.toml                            |   16 +
 .claude/commands/opsx/apply.md                |   42 +-
 .claude/commands/opsx/archive.md              |  114 +-
 .claude/commands/opsx/bulk-archive.md         |  171 +-
 .claude/commands/opsx/continue.md             |   50 +-
 .claude/commands/opsx/explore.md              |   42 +-
 .claude/commands/opsx/ff.md                   |   46 +-
 .claude/commands/opsx/new.md                  |   10 +-
 .claude/commands/opsx/onboard.md              |   36 +-
 .claude/commands/opsx/sync.md                 |  152 +-
 .claude/commands/opsx/verify.md               |   21 +-
 .claude/skills/openspec-apply-change/SKILL.md |   40 +-
 .../skills/openspec-archive-change/SKILL.md   |  106 +-
 .../openspec-bulk-archive-change/SKILL.md     |  168 +-
 .../skills/openspec-continue-change/SKILL.md  |   46 +-
 .claude/skills/openspec-explore/SKILL.md      |   40 +-
 .claude/skills/openspec-ff-change/SKILL.md    |   42 +-
 .claude/skills/openspec-new-change/SKILL.md   |    6 +-
 .claude/skills/openspec-onboard/SKILL.md      |   32 +-
 .claude/skills/openspec-sync-specs/SKILL.md   |  148 +-
 .../skills/openspec-verify-change/SKILL.md    |   17 +-
 .../skills/openspec-archive-change/SKILL.md   |  118 -
 .../openspec-bulk-archive-change/SKILL.md     |  249 --
 .../skills/openspec-continue-change/SKILL.md  |  122 -
 .codex/skills/openspec-ff-change/SKILL.md     |  105 -
 .codex/skills/openspec-new-change/SKILL.md    |   77 -
 .codex/skills/openspec-sync-specs/SKILL.md    |  148 -
 .codex/skills/openspec-verify-change/SKILL.md |  172 -
 .github/workflows/compass-ci.yml              |   61 +-
 .kbd-orchestrator/constraints.md              |   16 +-
 .kbd-orchestrator/current-waypoint.json       |   41 +-
 .kbd-orchestrator/current-waypoint.md         |   36 +-
 .kbd-orchestrator/model-preflight.json        |   10 +-
 .../compass-scoping-and-bounds/assessment.md  |  405 +-
 .../decision-log.md                           |   78 +
 .../compass-scoping-and-bounds/execution.md   |  131 +
 .../compass-scoping-and-bounds/goals.md       |   31 +
 .../handoffs/EXECUTION-HANDOFF.md             |  242 ++
 .../handoffs/assess.handoff.json              |   11 +
 .../handoffs/execute.handoff.json             |   12 +
 .../handoffs/plan.handoff.json                |   11 +
 .../hooks-status.json                         |    1 +
 .../hooks.log.jsonl                           |   47 +
 .../phases/compass-scoping-and-bounds/plan.md |  440 ++-
 .../prior-context.md                          |    1 +
 .../compass-scoping-and-bounds/progress.json  |  256 +-
 .../review/C-001/findings.json                |   23 +
 .../review/C-001/rejection.md                 |    0
 .../review/C-002/findings-2.json              |   39 +
 .../review/C-002/findings-3.json              |   39 +
 .../review/C-002/findings.json                |   55 +
 .../review/C-002/rejection-2.md               |    0
 .../review/C-002/rejection-3.md               |    0
 .../review/C-002/rejection.md                 |    0
 .../review/C-005/findings.json                |   33 +
 .../review/C-005/findings.round1.json         |   26 +
 .../review/C-006/findings.json                |   16 +
 .../review/C-006/findings.round1.json         |   26 +
 .../review/C-007/findings.json                |   16 +
 .../review/C-007/findings.round1.json         |   13 +
 .../review/C-008/findings.json                |   28 +
 .../review/C-008/findings.round1.json         |   28 +
 .../review/C-008/findings.round2.json         |   42 +
 .../review/C-008/findings.round3.json         |   50 +
 .../review/C-009/findings.json                |   27 +
 .../review/C-009/findings.round1.json         |   42 +
 .../review/C-009/findings.round2.json         |   24 +
 .../review/C-009/findings.round3.json         |   18 +
 .../review/C-009/findings.round4.json         |   18 +
 .../review/C-009/findings.round5.json         |   12 +
 .../review/C-010/findings-round1.json         |   47 +
 .../review/C-010/findings-round2.json         |   62 +
 .../review/C-010/findings-round3.json         |   79 +
 .../review/C-010/findings-round4.json         |   46 +
 .../review/C-010/findings-round5.json         |   63 +
 .../review/C-010/findings-round7.json         |   39 +
 .../review/C-010/findings-round8.json         |   39 +
 .../review/C-010/findings.json                |   55 +
 .../review/C-012/findings.json                |   50 +
 .../review/C-013/findings-round1.json         |   71 +
 .../review/C-013/findings-round2.json         |   61 +
 .../review/C-013/findings-round3.json         |   50 +
 .../review/C-013/findings-round4.json         |   47 +
 .../review/C-013/findings-round5.json         |   43 +
 .../review/C-013/findings-round6.json         |   36 +
 .../review/C-013/findings-round7.json         |   63 +
 .../review/C-013/findings-round8.json         |   47 +
 .../review/C-013/findings-round9.json         |   43 +
 .../review/C-013/findings.json                |   47 +
 .../review/C-013/round5-schema-feedback.md    |    5 +
 .../review/C-014/findings-round1.json         |   64 +
 .../review/C-014/findings-round2.json         |   47 +
 .../review/C-014/findings.json                |   63 +
 .../review/C-016/findings.json                |   91 +
 .../review/C-016/findings.round2.json         |   55 +
 .../review/C-016/findings.round3.json         |   39 +
 .../review/C-017/findings.json                |   50 +
 .../review/C-018/findings.json                |   63 +
 .../review/C-018/findings.round1.json         |  112 +
 .../review/C-019/findings.json                |   71 +
 .../review/C-019/findings.round1.json         |  111 +
 .../review/C-019/findings.round2.json         |   78 +
 .../review/assess/findings-r2.json            |   42 +
 .../review/assess/findings.json               |   50 +
 .../review/plan/findings-r2.json              |   31 +
 .../review/plan/findings.json                 |   38 +
 .../compass-scoping-and-bounds/tasks.md       |  143 +
 .kbd-orchestrator/position-reminder.txt       |   16 +
 .kbd-orchestrator/position.json               |  220 ++
 .kbd-orchestrator/project.json                |   19 +-
 .kimi/skills/openspec-apply-change/SKILL.md   |  160 -
 .kimi/skills/openspec-archive-change/SKILL.md |  118 -
 .../openspec-bulk-archive-change/SKILL.md     |  249 --
 .kimi/skills/openspec-explore/SKILL.md        |  290 --
 .kimi/skills/openspec-ff-change/SKILL.md      |  105 -
 .kimi/skills/openspec-onboard/SKILL.md        |  555 ---
 .kimi/skills/openspec-sync-specs/SKILL.md     |  148 -
 .opencode/commands/opsx-apply.md              |   39 +-
 .opencode/commands/opsx-archive.md            |  111 +-
 .opencode/commands/opsx-bulk-archive.md       |  167 +-
 .opencode/commands/opsx-continue.md           |   47 +-
 .opencode/commands/opsx-explore.md            |   41 +-
 .opencode/commands/opsx-ff.md                 |   43 +-
 .opencode/commands/opsx-new.md                |    7 +-
 .opencode/commands/opsx-onboard.md            |   32 +-
 .opencode/commands/opsx-sync.md               |  149 +-
 .opencode/commands/opsx-verify.md             |   18 +-
 .../skills/openspec-apply-change/SKILL.md     |   40 +-
 .../skills/openspec-archive-change/SKILL.md   |  106 +-
 .../openspec-bulk-archive-change/SKILL.md     |  168 +-
 .../skills/openspec-continue-change/SKILL.md  |   46 +-
 .opencode/skills/openspec-explore/SKILL.md    |   40 +-
 .opencode/skills/openspec-ff-change/SKILL.md  |   42 +-
 .opencode/skills/openspec-new-change/SKILL.md |    6 +-
 .opencode/skills/openspec-onboard/SKILL.md    |   32 +-
 .opencode/skills/openspec-sync-specs/SKILL.md |  148 +-
 .../skills/openspec-verify-change/SKILL.md    |   17 +-
 .prometheus/events.jsonl                      |    3 -
 .../.prompt-snapshots/project/current         |    2 -
 ...3d60a46450faef250b226e9717215ad2fea75.json |  562 ---
 ...dbf7c749eb3ee292740ad01d9cc572cd6d064.json |  794 ----
 ...3c57e74845d1f48f3ff5a37b929885585f87e.json |  524 ---
 ...g-and-bounds-executor-completion-record.md |   38 +
 ...g-and-bounds-executor-completion-status.md |   42 +
 ...-scoping-and-bounds-executor-completion.md |   39 +
 .prometheus/knowledge/wiki/index.md           |   16 +
 .../wiki/karpathy-session-0c9f8df23506c16a.md |  118 +
 .../wiki/karpathy-session-1ecfe43654c6f90b.md |   73 +
 .../wiki/karpathy-session-2143b246d1cf0ba5.md |  101 +
 .../wiki/karpathy-session-361f6082f855b168.md |   98 +
 .../wiki/karpathy-session-6c67c5011b34fce2.md |  101 +
 .../wiki/karpathy-session-6f294af7050aa95f.md |   70 +
 .../wiki/karpathy-session-a217668de21b25d6.md |  135 +
 .../wiki/karpathy-session-d968e02c779c42b0.md |   97 +
 .../wiki/karpathy-session-e0ee5520d0620fb6.md |   37 +
 .../wiki/karpathy-session-e9325c7eec4c9735.md |   74 +
 .../wiki/karpathy-session-ef9837e583f69b53.md |   70 +
 .../wiki/karpathy-session-f437ebdbcc6811b9.md |   73 +
 .prometheus/knowledge/wiki/log.md             |   21 +
 .../artifacts/C-001/artifact_manifest.json    |   19 +
 .refiner/artifacts/C-001/constraints.json     |   23 +
 .refiner/artifacts/C-001/decisions.md         |   23 +
 .refiner/artifacts/C-001/dist/qa-receipt.md   |   14 +
 .refiner/artifacts/C-001/refinement_log.md    |  125 +
 .../artifacts/C-002/artifact_manifest.json    |   23 +
 .refiner/artifacts/C-002/constraints.json     |   22 +
 .refiner/artifacts/C-002/decisions.md         |   25 +
 .refiner/artifacts/C-002/dist/qa-receipt.md   |   18 +
 .refiner/artifacts/C-002/refinement_log.md    |  104 +
 .../artifacts/C-003/artifact_manifest.json    |   17 +
 .refiner/artifacts/C-003/constraints.json     |   15 +
 .refiner/artifacts/C-003/decisions.md         |   11 +
 .refiner/artifacts/C-003/dist/qa-receipt.md   |   14 +
 .refiner/artifacts/C-003/refinement_log.md    |   31 +
 .../artifacts/C-004/artifact_manifest.json    |   18 +
 .refiner/artifacts/C-004/constraints.json     |   15 +
 .refiner/artifacts/C-004/dist/qa-receipt.md   |    9 +
 .refiner/artifacts/C-004/refinement_log.md    |   19 +
 .../artifacts/C-005/artifact_manifest.json    |   17 +
 .refiner/artifacts/C-005/constraints.json     |   16 +
 .refiner/artifacts/C-005/dist/qa-receipt.md   |    9 +
 .refiner/artifacts/C-005/refinement_log.md    |   28 +
 .../artifacts/C-006/artifact_manifest.json    |   15 +
 .refiner/artifacts/C-006/constraints.json     |   16 +
 .refiner/artifacts/C-006/dist/qa-receipt.md   |    9 +
 .refiner/artifacts/C-006/refinement_log.md    |   37 +
 .../artifacts/C-007/artifact_manifest.json    |   16 +
 .refiner/artifacts/C-007/constraints.json     |   15 +
 .refiner/artifacts/C-007/dist/qa-receipt.md   |   10 +
 .refiner/artifacts/C-007/refinement_log.md    |   21 +
 .../artifacts/C-008/artifact_manifest.json    |   19 +
 .refiner/artifacts/C-008/constraints.json     |   18 +
 .refiner/artifacts/C-008/dist/qa-receipt.md   |   15 +
 .refiner/artifacts/C-008/refinement_log.md    |   77 +
 .refiner/artifacts/C-009/final-verdict.md     |   11 +
 .../artifacts/C-009/iteration-1-contract.md   |   17 +
 .../C-009/iteration-2-implementation.md       |   25 +
 .../C-009/iteration-3-regressions.md          |   32 +
 .../C-009/iteration-4-verification.md         |   20 +
 .../artifacts/C-010/artifact_manifest.json    |   22 +
 .refiner/artifacts/C-010/constraints.json     |   36 +
 .refiner/artifacts/C-010/decisions.md         |   13 +
 .../C-010/dist/refinement-receipt.md          |   14 +
 .refiner/artifacts/C-010/refinement_log.md    |  133 +
 .../artifacts/C-011/artifact_manifest.json    |   26 +
 .refiner/artifacts/C-011/constraints.json     |   46 +
 .refiner/artifacts/C-011/decisions.md         |   20 +
 .../C-011/dist/refinement-receipt.md          |   23 +
 .refiner/artifacts/C-011/refinement_log.md    |  109 +
 .../artifacts/C-012/artifact_manifest.json    |   16 +
 .refiner/artifacts/C-012/constraints.json     |   41 +
 .refiner/artifacts/C-012/decisions.md         |   13 +
 .../C-012/dist/refinement-receipt.md          |   14 +
 .refiner/artifacts/C-012/refinement_log.md    |   54 +
 .../artifacts/C-013/artifact_manifest.json    |   16 +
 .refiner/artifacts/C-013/constraints.json     |   46 +
 .refiner/artifacts/C-013/decisions.md         |   17 +
 .../C-013/dist/refinement-receipt.md          |   19 +
 .refiner/artifacts/C-013/refinement_log.md    |  181 +
 .../artifacts/C-014/artifact_manifest.json    |   24 +
 .refiner/artifacts/C-014/constraints.json     |   41 +
 .refiner/artifacts/C-014/decisions.md         |   20 +
 .../C-014/dist/refinement-receipt.md          |   20 +
 .refiner/artifacts/C-014/refinement_log.md    |   96 +
 .../artifacts/C-015/artifact_manifest.json    |   20 +
 .refiner/artifacts/C-015/constraints.json     |   36 +
 .refiner/artifacts/C-015/decisions.md         |   15 +
 .../C-015/dist/refinement-receipt.md          |   14 +
 .refiner/artifacts/C-015/refinement_log.md    |   38 +
 .../artifacts/C-017/artifact_manifest.json    |   19 +
 .refiner/artifacts/C-017/constraints.json     |   51 +
 .refiner/artifacts/C-017/decisions.md         |   15 +
 .../C-017/dist/refinement-receipt.md          |   11 +
 .refiner/artifacts/C-017/refinement_log.md    |   46 +
 .../artifacts/C-018/artifact_manifest.json    |   22 +
 .refiner/artifacts/C-018/constraints.json     |   36 +
 .refiner/artifacts/C-018/decisions.md         |   12 +
 .../C-018/dist/refinement-receipt.md          |   14 +
 .refiner/artifacts/C-018/refinement_log.md    |   22 +
 .../artifacts/C-019/artifact_manifest.json    |   20 +
 .refiner/artifacts/C-019/constraints.json     |   36 +
 .refiner/artifacts/C-019/decisions.md         |   12 +
 .../C-019/dist/refinement-receipt.md          |   14 +
 .refiner/artifacts/C-019/refinement_log.md    |   23 +
 AGENTS.md                                     |  157 +-
 CHANGELOG.md                                  |   92 +
 CLAUDE.md                                     |   92 +-
 COMPATIBILITY.md                              |   62 +
 Cargo.lock                                    | 3417 +++++++++++++++--
 Cargo.toml                                    |   31 +-
 MIGRATION.md                                  |   63 +
 Makefile                                      |   26 +-
 README.md                                     |   40 +-
 SECURITY.md                                   |   11 +-
 THIRD_PARTY_NOTICES.md                        |   16 +
 benchmarks/qualification/README.md            |  113 +
 benchmarks/qualification/agent-tasks-v1.json  |   47 +
 .../current-engine-baseline-v1.json           |  481 +++
 benchmarks/qualification/generate_graph.py    |  319 ++
 benchmarks/qualification/io.py                |   45 +
 benchmarks/qualification/manifest-v1.json     |   92 +
 benchmarks/qualification/profiles-v1.json     |   17 +
 .../raw-traversal-oracle-v1.json              |  605 +++
 benchmarks/qualification/raw_traversal.py     |  443 +++
 .../qualification/run_current_baseline.py     |  707 ++++
 .../scale-profile-digests-v1.json             |   20 +
 .../qualification/semantic-corpus-v1.json     |   33 +
 .../qualification/skill-corpora-v1.json       |   38 +
 .../surreal-dual-engine-decision-v1.json      |  146 +
 crates/compass-cli/Cargo.toml                 |    3 +
 .../compass-architecture/SKILL.md             |   44 +
 .../compass-change-impact/SKILL.md            |   44 +
 .../compass-debug/SKILL.md                    |   45 +
 .../compass-index-maintenance/SKILL.md        |   43 +
 .../compass-mcp-setup/SKILL.md                |   45 +
 .../compass-navigate/SKILL.md                 |   48 +
 .../trigger-corpus.json                       |   75 +
 .../references/command-reference.md           |    2 +
 .../assets/compass-skill/references/hooks.md  |    6 +-
 crates/compass-cli/build.rs                   |    6 +-
 crates/compass-cli/src/agent_commands.rs      | 1629 ++++++++
 crates/compass-cli/src/distribution.rs        |  316 ++
 crates/compass-cli/src/help.rs                |   45 +-
 crates/compass-cli/src/install_commands.rs    |  467 ++-
 crates/compass-cli/src/lib.rs                 |   25 +-
 crates/compass-cli/tests/agent_cli.rs         |  464 +++
 crates/compass-cli/tests/history_cli.rs       |   14 +-
 crates/compass-cli/tests/install_cli.rs       |  200 +-
 crates/compass-cli/tests/mcp_http_cli.rs      |   30 +
 .../compass-cli/tests/snapshot_limit_cli.rs   |   94 +
 crates/compass-core/src/lib.rs                |    2 +-
 crates/compass-core/src/pipeline.rs           |   73 +-
 .../code_graph_v1_publication_resilience.rs   |   24 +-
 crates/compass-core/tests/loading_coverage.rs |   22 +
 crates/compass-core/tests/pipeline_scale.rs   |   44 +-
 crates/compass-core/tests/vendor_policy.rs    |  108 +
 crates/compass-files/tests/contracts.rs       |   73 +-
 crates/compass-graph/Cargo.toml               |    1 +
 crates/compass-graph/src/lib.rs               |   30 +-
 crates/compass-graph/src/snapshot.rs          |   63 +-
 crates/compass-graph/src/v1.rs                |   28 +-
 .../tests/rust_method_identity.rs             |   18 +-
 crates/compass-graphdb-surreal/Cargo.toml     |   41 +
 crates/compass-graphdb-surreal/README.md      |   39 +
 crates/compass-graphdb-surreal/src/engine.rs  |  911 +++++
 .../src/engine/query.rs                       | 1161 ++++++
 crates/compass-graphdb-surreal/src/lib.rs     |   28 +
 .../compass-graphdb-surreal/src/projection.rs |  534 +++
 .../tests/mem_projection.rs                   |  214 ++
 .../tests/native_query.rs                     |  313 ++
 .../tests/projection.rs                       |  195 +
 .../tests/scale_qualification.rs              |  579 +++
 crates/compass-history/Cargo.toml             |    1 +
 crates/compass-history/src/artifacts.rs       |   62 +-
 crates/compass-history/src/canonical.rs       |   49 +-
 crates/compass-history/src/error.rs           |    4 +
 crates/compass-history/src/keys.rs            |   51 +-
 crates/compass-languages/src/engine.rs        |   11 +-
 .../src/evidence/typescript.rs                |   80 +-
 .../src/frameworks/typescript.rs              |   95 +-
 crates/compass-languages/src/markdown.rs      |   11 +-
 crates/compass-mcp/Cargo.toml                 |    3 +
 crates/compass-mcp/src/code_query.rs          |  468 ++-
 crates/compass-mcp/src/lib.rs                 |  226 +-
 crates/compass-mcp/src/transport.rs           |  271 +-
 crates/compass-mcp/tests/code_query_tools.rs  |  773 +++-
 crates/compass-mcp/tests/coverage_paths.rs    |   21 +-
 crates/compass-mcp/tests/discovery_compat.rs  |  101 +
 .../tests/fixtures/get_callees-query-v1.json  |    1 +
 .../tests/fixtures/get_callees-result.json    |    1 +
 .../get_callers-parallel-query-v1.json        |    1 +
 .../tests/fixtures/get_callers-query-v1.json  |    1 +
 .../tests/fixtures/get_callers-result.json    |    1 +
 .../tests/fixtures/get_impact-query-v1.json   |    1 +
 .../tests/fixtures/get_impact-result.json     |    1 +
 .../fixtures/rmcp-2.2-server-discover.json    |  123 +
 .../fixtures/search_symbols-query-v1.json     |    1 +
 .../tests/fixtures/search_symbols-result.json |    1 +
 .../compass-mcp/tests/protocol_conformance.rs |  157 +
 crates/compass-model/src/code_graph.rs        |  117 +
 crates/compass-model/src/lib.rs               |    4 +-
 crates/compass-model/src/query_contract.rs    |  158 +-
 crates/compass-model/src/validation.rs        |   34 +-
 crates/compass-partition/Cargo.toml           |   19 +
 crates/compass-partition/src/lib.rs           |  149 +
 crates/compass-query/src/code_query.rs        |  131 +-
 crates/compass-query/tests/query_contract.rs  |   14 +-
 crates/compass-store/src/lib.rs               |  221 +-
 deny.toml                                     |   10 +
 distribution.toml                             |   30 +
 docs/README.md                                |    3 +
 docs/future/SURREAL_DB.md                     |  138 +
 .../compass-surrealdb-mcp-skills-research.md  |  780 ++++
 .../future/qualification-corpora-baselines.md |   88 +
 .../surreal-persistent-probe-results.md       |  102 +
 docs/future/surrealdb-license-decision.md     |   99 +
 docs/future/upstream-contribution-plan.md     |  381 ++
 docs/guides/integrating-compass.md            |   32 +
 docs/implementation/agent-distribution.md     |   53 +
 .../mcp-conformance-and-interop.md            |   92 +
 .../surreal-graph-projection.md               |  128 +
 docs/implementation/workspace-tour.md         |    7 +
 docs/reference/commands.md                    |   79 +-
 docs/reference/compatibility.md               |   13 +
 docs/reference/configuration.md               |   19 +-
 .../.openspec.yaml                            |    2 +
 .../design.md                                 |   52 +
 .../files.txt                                 |    4 +
 .../proposal.md                               |   21 +
 .../specs/snapshot-publication-errors/spec.md |   31 +
 .../tasks.md                                  |   15 +
 .../verification.md                           |   47 +
 .../.openspec.yaml                            |    2 +
 .../2026-08-28-compass-agent-cli/design.md    |   77 +
 .../2026-08-28-compass-agent-cli/files.txt    |    6 +
 .../2026-08-28-compass-agent-cli/proposal.md  |   26 +
 .../specs/agent-cli/spec.md                   |   95 +
 .../2026-08-28-compass-agent-cli/tasks.md     |   22 +
 .../verification.md                           |   59 +
 .../.openspec.yaml                            |    2 +
 .../design.md                                 |   10 +
 .../files.txt                                 |   16 +
 .../proposal.md                               |   18 +
 .../specs/partition-contract/spec.md          |   33 +
 .../tasks.md                                  |   15 +
 .../verification.md                           |   37 +
 .../.openspec.yaml                            |    2 +
 .../2026-08-28-focused-agent-skills/design.md |   53 +
 .../proposal.md                               |   25 +
 .../specs/focused-agent-skills/spec.md        |   57 +
 .../2026-08-28-focused-agent-skills/tasks.md  |   16 +
 .../verification.md                           |   35 +
 .../.openspec.yaml                            |    1 +
 .../design.md                                 |   11 +
 .../files.txt                                 |    7 +
 .../proposal.md                               |   19 +
 .../specs/snapshot-publication-limit/spec.md  |   19 +
 .../tasks.md                                  |   15 +
 .../verification.md                           |   13 +
 .../2026-08-28-mcp-result-envelope/design.md  |   82 +
 .../proposal.md                               |   26 +
 .../specs/mcp-result-envelope/spec.md         |   79 +
 .../2026-08-28-mcp-result-envelope/tasks.md   |   17 +
 .../verification.md                           |   55 +
 .../2026-08-28-mcp-stateless-http/files.txt   |   16 +
 .../2026-08-28-mcp-stateless-http/proposal.md |   27 +
 .../specs/mcp-http/spec.md                    |   63 +
 .../2026-08-28-mcp-stateless-http/tasks.md    |   15 +
 .../verification.md                           |   43 +
 .../.openspec.yaml                            |    1 +
 .../design.md                                 |   35 +
 .../evidence/baseline.md                      |   26 +
 .../files.txt                                 |   11 +
 .../proposal.md                               |   22 +
 .../preflight-graph-size-estimate/spec.md     |   34 +
 .../tasks.md                                  |   15 +
 .../verification.md                           |   26 +
 .../.openspec.yaml                            |    2 +
 .../2026-08-28-rmcp-3-migration/design.md     |   51 +
 .../2026-08-28-rmcp-3-migration/files.txt     |    7 +
 .../2026-08-28-rmcp-3-migration/proposal.md   |   22 +
 .../specs/rmcp-migration/spec.md              |   46 +
 .../2026-08-28-rmcp-3-migration/tasks.md      |   15 +
 .../verification.md                           |   34 +
 .../.openspec.yaml                            |    2 +
 .../2026-08-28-stream-snapshot-read/design.md |   55 +
 .../2026-08-28-stream-snapshot-read/files.txt |    2 +
 .../proposal.md                               |   26 +
 .../specs/snapshot-streaming/spec.md          |   72 +
 .../2026-08-28-stream-snapshot-read/tasks.md  |   16 +
 .../verification.md                           |   38 +
 .../.openspec.yaml                            |    3 +
 .../design.md                                 |   77 +
 .../files.txt                                 |   13 +
 .../proposal.md                               |   36 +
 .../tasks.md                                  |   14 +
 .../verification.md                           |   68 +
 .../.openspec.yaml                            |    2 +
 .../2026-08-28-vendor-skip-policy/design.md   |   19 +
 .../2026-08-28-vendor-skip-policy/files.txt   |    9 +
 .../2026-08-28-vendor-skip-policy/proposal.md |   18 +
 .../specs/vendor-discovery-policy/spec.md     |   34 +
 .../2026-08-28-vendor-skip-policy/tasks.md    |   11 +
 .../verification.md                           |   33 +
 .../design.md                                 |   13 +
 .../files.txt                                 |   10 +
 .../proposal.md                               |    9 +
 .../specs/agent-distribution/spec.md          |   45 +
 .../tasks.md                                  |   15 +
 .../design.md                                 |   12 +
 .../files.txt                                 |    5 +
 .../proposal.md                               |    6 +
 .../specs/harness-lifecycle/spec.md           |   32 +
 .../tasks.md                                  |   11 +
 .../.openspec.yaml                            |    2 +
 .../design.md                                 |   77 +
 .../files.txt                                 |   29 +
 .../proposal.md                               |   30 +
 .../specs/mcp-conformance/spec.md             |   67 +
 .../tasks.md                                  |   17 +
 .../verification.md                           |   66 +
 .../.openspec.yaml                            |    3 +
 .../design.md                                 |   68 +
 .../files.txt                                 |   23 +
 .../proposal.md                               |   35 +
 .../tasks.md                                  |   15 +
 .../verification.md                           |  138 +
 .../.openspec.yaml                            |    2 +
 .../design.md                                 |   60 +
 .../files.txt                                 |   25 +
 .../proposal.md                               |   26 +
 .../shared-file-evidence.md                   |   61 +
 .../specs/surreal-graph-projection/spec.md    |   60 +
 .../tasks.md                                  |   15 +
 .../verification.md                           |  113 +
 .../.openspec.yaml                            |    3 +
 .../design.md                                 |  102 +
 .../files.txt                                 |   35 +
 .../proposal.md                               |   35 +
 .../tasks.md                                  |    9 +
 .../verification.md                           |   79 +
 .../.openspec.yaml                            |    2 +
 .../surreal-dual-engine-equivalence/design.md |  115 +
 .../proposal.md                               |   41 +
 .../specs/surreal-native-query/spec.md        |   75 +
 .../surreal-dual-engine-equivalence/tasks.md  |   16 +
 openspec/specs/agent-cli/spec.md              |   98 +
 openspec/specs/agent-distribution/spec.md     |   45 +
 openspec/specs/focused-agent-skills/spec.md   |   59 +
 openspec/specs/harness-lifecycle/spec.md      |   32 +
 openspec/specs/mcp-conformance/spec.md        |   67 +
 openspec/specs/mcp-http/spec.md               |   66 +
 openspec/specs/mcp-result-envelope/spec.md    |   82 +
 openspec/specs/partition-contract/spec.md     |   36 +
 .../preflight-graph-size-estimate/spec.md     |   37 +
 openspec/specs/rmcp-migration/spec.md         |   49 +
 .../specs/snapshot-publication-errors/spec.md |   32 +
 .../specs/snapshot-publication-limit/spec.md  |   22 +
 openspec/specs/snapshot-streaming/spec.md     |   73 +
 .../specs/surreal-graph-projection/spec.md    |   62 +
 .../specs/vendor-discovery-policy/spec.md     |   37 +
 package-lock.json                             |  314 +-
 packages/compass-opencode/package.json        |   24 +
 .../compass-opencode/scripts/generate.mjs     |   39 +
 packages/compass-opencode/src/index.js        |   25 +
 packages/compass-opencode/src/index.ts        |   28 +
 .../tests/plugin.integration.test.ts          |   40 +
 packages/compass-opencode/tsconfig.json       |   11 +
 scripts/bounded_redacted_log.mjs              |   72 +
 scripts/check_surreal_feature_isolation.sh    |   44 +
 .../mcp-conformance-expected-failures.yaml    |   12 +
 .../mcp-conformance-project/src/lib.rs        |    7 +
 .../SURREALDB-3.2.4-LICENSE.txt               |  105 +
 .../expected-v1.json                          |   30 +
 .../surreal-persistent-probes/input-v1.json   |   79 +
 .../manifest-v1.json                          |   25 +
 .../rocksdb-result-v1.json                    |   90 +
 .../surrealkv-result-v1.json                  |   90 +
 scripts/qualify_code_graph_v1.sh              |   15 +-
 scripts/qualify_codex_mcp_client.py           |  367 ++
 scripts/qualify_harness_packages.sh           |  316 ++
 scripts/qualify_mcp_conformance.sh            |  156 +
 tools/skillgen/mod.rs                         |  188 +
 534 files changed, 37568 insertions(+), 6562 deletions(-)
 create mode 100644 .agents/skills/.openspec-target
 rename {.codex => .agents}/skills/openspec-apply-change/SKILL.md (58%)
 create mode 100644 .agents/skills/openspec-archive-change/SKILL.md
 create mode 100644 .agents/skills/openspec-bulk-archive-change/SKILL.md
 rename {.kimi => .agents}/skills/openspec-continue-change/SKILL.md (58%)
 rename {.codex => .agents}/skills/openspec-explore/SKILL.md (67%)
 create mode 100644 .agents/skills/openspec-ff-change/SKILL.md
 rename {.kimi => .agents}/skills/openspec-new-change/SKILL.md (85%)
 rename {.codex => .agents}/skills/openspec-onboard/SKILL.md (73%)
 create mode 100644 .agents/skills/openspec-sync-specs/SKILL.md
 rename {.kimi => .agents}/skills/openspec-verify-change/SKILL.md (86%)
 delete mode 100644 .codex/skills/openspec-archive-change/SKILL.md
 delete mode 100644 .codex/skills/openspec-bulk-archive-change/SKILL.md
 delete mode 100644 .codex/skills/openspec-continue-change/SKILL.md
 delete mode 100644 .codex/skills/openspec-ff-change/SKILL.md
 delete mode 100644 .codex/skills/openspec-new-change/SKILL.md
 delete mode 100644 .codex/skills/openspec-sync-specs/SKILL.md
 delete mode 100644 .codex/skills/openspec-verify-change/SKILL.md
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/execution.md
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/handoffs/EXECUTION-HANDOFF.md
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/handoffs/assess.handoff.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/handoffs/execute.handoff.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/handoffs/plan.handoff.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/hooks-status.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/prior-context.md
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-001/findings.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-001/rejection.md
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-002/findings-2.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-002/findings-3.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-002/findings.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-002/rejection-2.md
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-002/rejection-3.md
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-002/rejection.md
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-005/findings.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-005/findings.round1.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-006/findings.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-006/findings.round1.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-007/findings.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-007/findings.round1.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-008/findings.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-008/findings.round1.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-008/findings.round2.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-008/findings.round3.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-009/findings.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-009/findings.round1.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-009/findings.round2.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-009/findings.round3.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-009/findings.round4.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-009/findings.round5.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-010/findings-round1.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-010/findings-round2.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-010/findings-round3.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-010/findings-round4.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-010/findings-round5.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-010/findings-round7.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-010/findings-round8.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-010/findings.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-012/findings.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/findings-round1.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/findings-round2.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/findings-round3.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/findings-round4.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/findings-round5.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/findings-round6.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/findings-round7.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/findings-round8.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/findings-round9.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/findings.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/round5-schema-feedback.md
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-014/findings-round1.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-014/findings-round2.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-014/findings.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-016/findings.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-016/findings.round2.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-016/findings.round3.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-017/findings.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-018/findings.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-018/findings.round1.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-019/findings.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-019/findings.round1.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-019/findings.round2.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/assess/findings-r2.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/assess/findings.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/plan/findings-r2.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/review/plan/findings.json
 create mode 100644 .kbd-orchestrator/phases/compass-scoping-and-bounds/tasks.md
 create mode 100644 .kbd-orchestrator/position-reminder.txt
 create mode 100644 .kbd-orchestrator/position.json
 delete mode 100644 .kimi/skills/openspec-apply-change/SKILL.md
 delete mode 100644 .kimi/skills/openspec-archive-change/SKILL.md
 delete mode 100644 .kimi/skills/openspec-bulk-archive-change/SKILL.md
 delete mode 100644 .kimi/skills/openspec-explore/SKILL.md
 delete mode 100644 .kimi/skills/openspec-ff-change/SKILL.md
 delete mode 100644 .kimi/skills/openspec-onboard/SKILL.md
 delete mode 100644 .kimi/skills/openspec-sync-specs/SKILL.md
 delete mode 100644 .prometheus/events.jsonl
 delete mode 100644 .prometheus/knowledge/.prompt-snapshots/project/current
 delete mode 100644 .prometheus/knowledge/.prompt-snapshots/project/generations/7f6275773422ff840f0a69fc2353d60a46450faef250b226e9717215ad2fea75.json
 delete mode 100644 .prometheus/knowledge/.prompt-snapshots/project/generations/af7fabc39868c850a9cc065ff05dbf7c749eb3ee292740ad01d9cc572cd6d064.json
 delete mode 100644 .prometheus/knowledge/.prompt-snapshots/project/generations/d8234ef2341584c455b4c9ce94b3c57e74845d1f48f3ff5a37b929885585f87e.json
 create mode 100644 .prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-completion-record.md
 create mode 100644 .prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-completion-status.md
 create mode 100644 .prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-completion.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-0c9f8df23506c16a.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-1ecfe43654c6f90b.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-2143b246d1cf0ba5.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-361f6082f855b168.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-6c67c5011b34fce2.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-6f294af7050aa95f.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-a217668de21b25d6.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-d968e02c779c42b0.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-e0ee5520d0620fb6.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-e9325c7eec4c9735.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-ef9837e583f69b53.md
 create mode 100644 .prometheus/knowledge/wiki/karpathy-session-f437ebdbcc6811b9.md
 create mode 100644 .refiner/artifacts/C-001/artifact_manifest.json
 create mode 100644 .refiner/artifacts/C-001/constraints.json
 create mode 100644 .refiner/artifacts/C-001/decisions.md
 create mode 100644 .refiner/artifacts/C-001/dist/qa-receipt.md
 create mode 100644 .refiner/artifacts/C-001/refinement_log.md
 create mode 100644 .refiner/artifacts/C-002/artifact_manifest.json
 create mode 100644 .refiner/artifacts/C-002/constraints.json
 create mode 100644 .refiner/artifacts/C-002/decisions.md
 create mode 100644 .refiner/artifacts/C-002/dist/qa-receipt.md
 create mode 100644 .refiner/artifacts/C-002/refinement_log.md
 create mode 100644 .refiner/artifacts/C-003/artifact_manifest.json
 create mode 100644 .refiner/artifacts/C-003/constraints.json
 create mode 100644 .refiner/artifacts/C-003/decisions.md
 create mode 100644 .refiner/artifacts/C-003/dist/qa-receipt.md
 create mode 100644 .refiner/artifacts/C-003/refinement_log.md
 create mode 100644 .refiner/artifacts/C-004/artifact_manifest.json
 create mode 100644 .refiner/artifacts/C-004/constraints.json
 create mode 100644 .refiner/artifacts/C-004/dist/qa-receipt.md
 create mode 100644 .refiner/artifacts/C-004/refinement_log.md
 create mode 100644 .refiner/artifacts/C-005/artifact_manifest.json
 create mode 100644 .refiner/artifacts/C-005/constraints.json
 create mode 100644 .refiner/artifacts/C-005/dist/qa-receipt.md
 create mode 100644 .refiner/artifacts/C-005/refinement_log.md
 create mode 100644 .refiner/artifacts/C-006/artifact_manifest.json
 create mode 100644 .refiner/artifacts/C-006/constraints.json
 create mode 100644 .refiner/artifacts/C-006/dist/qa-receipt.md
 create mode 100644 .refiner/artifacts/C-006/refinement_log.md
 create mode 100644 .refiner/artifacts/C-007/artifact_manifest.json
 create mode 100644 .refiner/artifacts/C-007/constraints.json
 create mode 100644 .refiner/artifacts/C-007/dist/qa-receipt.md
 create mode 100644 .refiner/artifacts/C-007/refinement_log.md
 create mode 100644 .refiner/artifacts/C-008/artifact_manifest.json
 create mode 100644 .refiner/artifacts/C-008/constraints.json
 create mode 100644 .refiner/artifacts/C-008/dist/qa-receipt.md
 create mode 100644 .refiner/artifacts/C-008/refinement_log.md
 create mode 100644 .refiner/artifacts/C-009/final-verdict.md
 create mode 100644 .refiner/artifacts/C-009/iteration-1-contract.md
 create mode 100644 .refiner/artifacts/C-009/iteration-2-implementation.md
 create mode 100644 .refiner/artifacts/C-009/iteration-3-regressions.md
 create mode 100644 .refiner/artifacts/C-009/iteration-4-verification.md
 create mode 100644 .refiner/artifacts/C-010/artifact_manifest.json
 create mode 100644 .refiner/artifacts/C-010/constraints.json
 create mode 100644 .refiner/artifacts/C-010/decisions.md
 create mode 100644 .refiner/artifacts/C-010/dist/refinement-receipt.md
 create mode 100644 .refiner/artifacts/C-010/refinement_log.md
 create mode 100644 .refiner/artifacts/C-011/artifact_manifest.json
 create mode 100644 .refiner/artifacts/C-011/constraints.json
 create mode 100644 .refiner/artifacts/C-011/decisions.md
 create mode 100644 .refiner/artifacts/C-011/dist/refinement-receipt.md
 create mode 100644 .refiner/artifacts/C-011/refinement_log.md
 create mode 100644 .refiner/artifacts/C-012/artifact_manifest.json
 create mode 100644 .refiner/artifacts/C-012/constraints.json
 create mode 100644 .refiner/artifacts/C-012/decisions.md
 create mode 100644 .refiner/artifacts/C-012/dist/refinement-receipt.md
 create mode 100644 .refiner/artifacts/C-012/refinement_log.md
 create mode 100644 .refiner/artifacts/C-013/artifact_manifest.json
 create mode 100644 .refiner/artifacts/C-013/constraints.json
 create mode 100644 .refiner/artifacts/C-013/decisions.md
 create mode 100644 .refiner/artifacts/C-013/dist/refinement-receipt.md
 create mode 100644 .refiner/artifacts/C-013/refinement_log.md
 create mode 100644 .refiner/artifacts/C-014/artifact_manifest.json
 create mode 100644 .refiner/artifacts/C-014/constraints.json
 create mode 100644 .refiner/artifacts/C-014/decisions.md
 create mode 100644 .refiner/artifacts/C-014/dist/refinement-receipt.md
 create mode 100644 .refiner/artifacts/C-014/refinement_log.md
 create mode 100644 .refiner/artifacts/C-015/artifact_manifest.json
 create mode 100644 .refiner/artifacts/C-015/constraints.json
 create mode 100644 .refiner/artifacts/C-015/decisions.md
 create mode 100644 .refiner/artifacts/C-015/dist/refinement-receipt.md
 create mode 100644 .refiner/artifacts/C-015/refinement_log.md
 create mode 100644 .refiner/artifacts/C-017/artifact_manifest.json
 create mode 100644 .refiner/artifacts/C-017/constraints.json
 create mode 100644 .refiner/artifacts/C-017/decisions.md
 create mode 100644 .refiner/artifacts/C-017/dist/refinement-receipt.md
 create mode 100644 .refiner/artifacts/C-017/refinement_log.md
 create mode 100644 .refiner/artifacts/C-018/artifact_manifest.json
 create mode 100644 .refiner/artifacts/C-018/constraints.json
 create mode 100644 .refiner/artifacts/C-018/decisions.md
 create mode 100644 .refiner/artifacts/C-018/dist/refinement-receipt.md
 create mode 100644 .refiner/artifacts/C-018/refinement_log.md
 create mode 100644 .refiner/artifacts/C-019/artifact_manifest.json
 create mode 100644 .refiner/artifacts/C-019/constraints.json
 create mode 100644 .refiner/artifacts/C-019/decisions.md
 create mode 100644 .refiner/artifacts/C-019/dist/refinement-receipt.md
 create mode 100644 .refiner/artifacts/C-019/refinement_log.md
 create mode 100644 benchmarks/qualification/README.md
 create mode 100644 benchmarks/qualification/agent-tasks-v1.json
 create mode 100644 benchmarks/qualification/current-engine-baseline-v1.json
 create mode 100644 benchmarks/qualification/generate_graph.py
 create mode 100644 benchmarks/qualification/io.py
 create mode 100644 benchmarks/qualification/manifest-v1.json
 create mode 100644 benchmarks/qualification/profiles-v1.json
 create mode 100644 benchmarks/qualification/raw-traversal-oracle-v1.json
 create mode 100644 benchmarks/qualification/raw_traversal.py
 create mode 100644 benchmarks/qualification/run_current_baseline.py
 create mode 100644 benchmarks/qualification/scale-profile-digests-v1.json
 create mode 100644 benchmarks/qualification/semantic-corpus-v1.json
 create mode 100644 benchmarks/qualification/skill-corpora-v1.json
 create mode 100644 benchmarks/qualification/surreal-dual-engine-decision-v1.json
 create mode 100644 crates/compass-cli/assets/compass-focused-skills/compass-architecture/SKILL.md
 create mode 100644 crates/compass-cli/assets/compass-focused-skills/compass-change-impact/SKILL.md
 create mode 100644 crates/compass-cli/assets/compass-focused-skills/compass-debug/SKILL.md
 create mode 100644 crates/compass-cli/assets/compass-focused-skills/compass-index-maintenance/SKILL.md
 create mode 100644 crates/compass-cli/assets/compass-focused-skills/compass-mcp-setup/SKILL.md
 create mode 100644 crates/compass-cli/assets/compass-focused-skills/compass-navigate/SKILL.md
 create mode 100644 crates/compass-cli/assets/compass-focused-skills/trigger-corpus.json
 create mode 100644 crates/compass-cli/src/agent_commands.rs
 create mode 100644 crates/compass-cli/src/distribution.rs
 create mode 100644 crates/compass-cli/tests/agent_cli.rs
 create mode 100644 crates/compass-cli/tests/mcp_http_cli.rs
 create mode 100644 crates/compass-cli/tests/snapshot_limit_cli.rs
 create mode 100644 crates/compass-core/tests/vendor_policy.rs
 create mode 100644 crates/compass-graphdb-surreal/Cargo.toml
 create mode 100644 crates/compass-graphdb-surreal/README.md
 create mode 100644 crates/compass-graphdb-surreal/src/engine.rs
 create mode 100644 crates/compass-graphdb-surreal/src/engine/query.rs
 create mode 100644 crates/compass-graphdb-surreal/src/lib.rs
 create mode 100644 crates/compass-graphdb-surreal/src/projection.rs
 create mode 100644 crates/compass-graphdb-surreal/tests/mem_projection.rs
 create mode 100644 crates/compass-graphdb-surreal/tests/native_query.rs
 create mode 100644 crates/compass-graphdb-surreal/tests/projection.rs
 create mode 100644 crates/compass-graphdb-surreal/tests/scale_qualification.rs
 create mode 100644 crates/compass-mcp/tests/discovery_compat.rs
 create mode 100644 crates/compass-mcp/tests/fixtures/get_callees-query-v1.json
 create mode 100644 crates/compass-mcp/tests/fixtures/get_callees-result.json
 create mode 100644 crates/compass-mcp/tests/fixtures/get_callers-parallel-query-v1.json
 create mode 100644 crates/compass-mcp/tests/fixtures/get_callers-query-v1.json
 create mode 100644 crates/compass-mcp/tests/fixtures/get_callers-result.json
 create mode 100644 crates/compass-mcp/tests/fixtures/get_impact-query-v1.json
 create mode 100644 crates/compass-mcp/tests/fixtures/get_impact-result.json
 create mode 100644 crates/compass-mcp/tests/fixtures/rmcp-2.2-server-discover.json
 create mode 100644 crates/compass-mcp/tests/fixtures/search_symbols-query-v1.json
 create mode 100644 crates/compass-mcp/tests/fixtures/search_symbols-result.json
 create mode 100644 crates/compass-mcp/tests/protocol_conformance.rs
 create mode 100644 crates/compass-partition/Cargo.toml
 create mode 100644 crates/compass-partition/src/lib.rs
 create mode 100644 distribution.toml
 create mode 100644 docs/future/SURREAL_DB.md
 create mode 100644 docs/future/compass-surrealdb-mcp-skills-research.md
 create mode 100644 docs/future/qualification-corpora-baselines.md
 create mode 100644 docs/future/surreal-persistent-probe-results.md
 create mode 100644 docs/future/surrealdb-license-decision.md
 create mode 100644 docs/future/upstream-contribution-plan.md
 create mode 100644 docs/implementation/agent-distribution.md
 create mode 100644 docs/implementation/mcp-conformance-and-interop.md
 create mode 100644 docs/implementation/surreal-graph-projection.md
 create mode 100644 openspec/changes/archive/2026-08-28-actionable-snapshot-limit-error/.openspec.yaml
 create mode 100644 openspec/changes/archive/2026-08-28-actionable-snapshot-limit-error/design.md
 create mode 100644 openspec/changes/archive/2026-08-28-actionable-snapshot-limit-error/files.txt
 create mode 100644 openspec/changes/archive/2026-08-28-actionable-snapshot-limit-error/proposal.md
 create mode 100644 openspec/changes/archive/2026-08-28-actionable-snapshot-limit-error/specs/snapshot-publication-errors/spec.md
 create mode 100644 openspec/changes/archive/2026-08-28-actionable-snapshot-limit-error/tasks.md
 create mode 100644 openspec/changes/archive/2026-08-28-actionable-snapshot-limit-error/verification.md
 create mode 100644 openspec/changes/archive/2026-08-28-compass-agent-cli/.openspec.yaml
 create mode 100644 openspec/changes/archive/2026-08-28-compass-agent-cli/design.md
 create mode 100644 openspec/changes/archive/2026-08-28-compass-agent-cli/files.txt
 create mode 100644 openspec/changes/archive/2026-08-28-compass-agent-cli/proposal.md
 create mode 100644 openspec/changes/archive/2026-08-28-compass-agent-cli/specs/agent-cli/spec.md
 create mode 100644 openspec/changes/archive/2026-08-28-compass-agent-cli/tasks.md
 create mode 100644 openspec/changes/archive/2026-08-28-compass-agent-cli/verification.md
 create mode 100644 openspec/changes/archive/2026-08-28-extract-compass-partition/.openspec.yaml
 create mode 100644 openspec/changes/archive/2026-08-28-extract-compass-partition/design.md
 create mode 100644 openspec/changes/archive/2026-08-28-extract-compass-partition/files.txt
 create mode 100644 openspec/changes/archive/2026-08-28-extract-compass-partition/proposal.md
 create mode 100644 openspec/changes/archive/2026-08-28-extract-compass-partition/specs/partition-contract/spec.md
 create mode 100644 openspec/changes/archive/2026-08-28-extract-compass-partition/tasks.md
 create mode 100644 openspec/changes/archive/2026-08-28-extract-compass-partition/verification.md
 create mode 100644 openspec/changes/archive/2026-08-28-focused-agent-skills/.openspec.yaml
 create mode 100644 openspec/changes/archive/2026-08-28-focused-agent-skills/design.md
 create mode 100644 openspec/changes/archive/2026-08-28-focused-agent-skills/proposal.md
 create mode 100644 openspec/changes/archive/2026-08-28-focused-agent-skills/specs/focused-agent-skills/spec.md
 create mode 100644 openspec/changes/archive/2026-08-28-focused-agent-skills/tasks.md
 create mode 100644 openspec/changes/archive/2026-08-28-focused-agent-skills/verification.md
 create mode 100644 openspec/changes/archive/2026-08-28-honor-max-graph-bytes-on-publication/.openspec.yaml
 create mode 100644 openspec/changes/archive/2026-08-28-honor-max-graph-bytes-on-publication/design.md
 create mode 100644 openspec/changes/archive/2026-08-28-honor-max-graph-bytes-on-publication/files.txt
 create mode 100644 openspec/changes/archive/2026-08-28-honor-max-graph-bytes-on-publication/proposal.md
 create mode 100644 openspec/changes/archive/2026-08-28-honor-max-graph-bytes-on-publication/specs/snapshot-publication-limit/spec.md
 create mode 100644 openspec/changes/archive/2026-08-28-honor-max-graph-bytes-on-publication/tasks.md
 create mode 100644 openspec/changes/archive/2026-08-28-honor-max-graph-bytes-on-publication/verification.md
 create mode 100644 openspec/changes/archive/2026-08-28-mcp-result-envelope/design.md
 create mode 100644 openspec/changes/archive/2026-08-28-mcp-result-envelope/proposal.md
 create mode 100644 openspec/changes/archive/2026-08-28-mcp-result-envelope/specs/mcp-result-envelope/spec.md
 create mode 100644 openspec/changes/archive/2026-08-28-mcp-result-envelope/tasks.md
 create mode 100644 openspec/changes/archive/2026-08-28-mcp-result-envelope/verification.md
 create mode 100644 openspec/changes/archive/2026-08-28-mcp-stateless-http/files.txt
 create mode 100644 openspec/changes/archive/2026-08-28-mcp-stateless-http/proposal.md
 create mode 100644 openspec/changes/archive/2026-08-28-mcp-stateless-http/specs/mcp-http/spec.md
 create mode 100644 openspec/changes/archive/2026-08-28-mcp-stateless-http/tasks.md
 create mode 100644 openspec/changes/archive/2026-08-28-mcp-stateless-http/verification.md
 create mode 100644 openspec/changes/archive/2026-08-28-preflight-graph-size-estimate/.openspec.yaml
 create mode 100644 openspec/changes/archive/2026-08-28-preflight-graph-size-estimate/design.md
 create mode 100644 openspec/changes/archive/2026-08-28-preflight-graph-size-estimate/evidence/baseline.md
 create mode 100644 openspec/changes/archive/2026-08-28-preflight-graph-size-estimate/files.txt
 create mode 100644 openspec/changes/archive/2026-08-28-preflight-graph-size-estimate/proposal.md
 create mode 100644 openspec/changes/archive/2026-08-28-preflight-graph-size-estimate/specs/preflight-graph-size-estimate/spec.md
 create mode 100644 openspec/changes/archive/2026-08-28-preflight-graph-size-estimate/tasks.md
 create mode 100644 openspec/changes/archive/2026-08-28-preflight-graph-size-estimate/verification.md
 create mode 100644 openspec/changes/archive/2026-08-28-rmcp-3-migration/.openspec.yaml
 create mode 100644 openspec/changes/archive/2026-08-28-rmcp-3-migration/design.md
 create mode 100644 openspec/changes/archive/2026-08-28-rmcp-3-migration/files.txt
 create mode 100644 openspec/changes/archive/2026-08-28-rmcp-3-migration/proposal.md
 create mode 100644 openspec/changes/archive/2026-08-28-rmcp-3-migration/specs/rmcp-migration/spec.md
 create mode 100644 openspec/changes/archive/2026-08-28-rmcp-3-migration/tasks.md
 create mode 100644 openspec/changes/archive/2026-08-28-rmcp-3-migration/verification.md
 create mode 100644 openspec/changes/archive/2026-08-28-stream-snapshot-read/.openspec.yaml
 create mode 100644 openspec/changes/archive/2026-08-28-stream-snapshot-read/design.md
 create mode 100644 openspec/changes/archive/2026-08-28-stream-snapshot-read/files.txt
 create mode 100644 openspec/changes/archive/2026-08-28-stream-snapshot-read/proposal.md
 create mode 100644 openspec/changes/archive/2026-08-28-stream-snapshot-read/specs/snapshot-streaming/spec.md
 create mode 100644 openspec/changes/archive/2026-08-28-stream-snapshot-read/tasks.md
 create mode 100644 openspec/changes/archive/2026-08-28-stream-snapshot-read/verification.md
 create mode 100644 openspec/changes/archive/2026-08-28-surreal-persistent-probes/.openspec.yaml
 create mode 100644 openspec/changes/archive/2026-08-28-surreal-persistent-probes/design.md
 create mode 100644 openspec/changes/archive/2026-08-28-surreal-persistent-probes/files.txt
 create mode 100644 openspec/changes/archive/2026-08-28-surreal-persistent-probes/proposal.md
 create mode 100644 openspec/changes/archive/2026-08-28-surreal-persistent-probes/tasks.md
 create mode 100644 openspec/changes/archive/2026-08-28-surreal-persistent-probes/verification.md
 create mode 100644 openspec/changes/archive/2026-08-28-vendor-skip-policy/.openspec.yaml
 create mode 100644 openspec/changes/archive/2026-08-28-vendor-skip-policy/design.md
 create mode 100644 openspec/changes/archive/2026-08-28-vendor-skip-policy/files.txt
 create mode 100644 openspec/changes/archive/2026-08-28-vendor-skip-policy/proposal.md
 create mode 100644 openspec/changes/archive/2026-08-28-vendor-skip-policy/specs/vendor-discovery-policy/spec.md
 create mode 100644 openspec/changes/archive/2026-08-28-vendor-skip-policy/tasks.md
 create mode 100644 openspec/changes/archive/2026-08-28-vendor-skip-policy/verification.md
 create mode 100644 openspec/changes/archive/2026-08-29-distribution-inventory-generators/design.md
 create mode 100644 openspec/changes/archive/2026-08-29-distribution-inventory-generators/files.txt
 create mode 100644 openspec/changes/archive/2026-08-29-distribution-inventory-generators/proposal.md
 create mode 100644 openspec/changes/archive/2026-08-29-distribution-inventory-generators/specs/agent-distribution/spec.md
 create mode 100644 openspec/changes/archive/2026-08-29-distribution-inventory-generators/tasks.md
 create mode 100644 openspec/changes/archive/2026-08-29-harness-install-validation/design.md
 create mode 100644 openspec/changes/archive/2026-08-29-harness-install-validation/files.txt
 create mode 100644 openspec/changes/archive/2026-08-29-harness-install-validation/proposal.md
 create mode 100644 openspec/changes/archive/2026-08-29-harness-install-validation/specs/harness-lifecycle/spec.md
 create mode 100644 openspec/changes/archive/2026-08-29-harness-install-validation/tasks.md
 create mode 100644 openspec/changes/archive/2026-08-29-mcp-conformance-interop/.openspec.yaml
 create mode 100644 openspec/changes/archive/2026-08-29-mcp-conformance-interop/design.md
 create mode 100644 openspec/changes/archive/2026-08-29-mcp-conformance-interop/files.txt
 create mode 100644 openspec/changes/archive/2026-08-29-mcp-conformance-interop/proposal.md
 create mode 100644 openspec/changes/archive/2026-08-29-mcp-conformance-interop/specs/mcp-conformance/spec.md
 create mode 100644 openspec/changes/archive/2026-08-29-mcp-conformance-interop/tasks.md
 create mode 100644 openspec/changes/archive/2026-08-29-mcp-conformance-interop/verification.md
 create mode 100644 openspec/changes/archive/2026-08-29-qualification-corpora-baselines/.openspec.yaml
 create mode 100644 openspec/changes/archive/2026-08-29-qualification-corpora-baselines/design.md
 create mode 100644 openspec/changes/archive/2026-08-29-qualification-corpora-baselines/files.txt
 create mode 100644 openspec/changes/archive/2026-08-29-qualification-corpora-baselines/proposal.md
 create mode 100644 openspec/changes/archive/2026-08-29-qualification-corpora-baselines/tasks.md
 create mode 100644 openspec/changes/archive/2026-08-29-qualification-corpora-baselines/verification.md
 create mode 100644 openspec/changes/archive/2026-08-29-surreal-graph-projection/.openspec.yaml
 create mode 100644 openspec/changes/archive/2026-08-29-surreal-graph-projection/design.md
 create mode 100644 openspec/changes/archive/2026-08-29-surreal-graph-projection/files.txt
 create mode 100644 openspec/changes/archive/2026-08-29-surreal-graph-projection/proposal.md
 create mode 100644 openspec/changes/archive/2026-08-29-surreal-graph-projection/shared-file-evidence.md
 create mode 100644 openspec/changes/archive/2026-08-29-surreal-graph-projection/specs/surreal-graph-projection/spec.md
 create mode 100644 openspec/changes/archive/2026-08-29-surreal-graph-projection/tasks.md
 create mode 100644 openspec/changes/archive/2026-08-29-surreal-graph-projection/verification.md
 create mode 100644 openspec/changes/archive/2026-08-29-surrealdb-license-decision/.openspec.yaml
 create mode 100644 openspec/changes/archive/2026-08-29-surrealdb-license-decision/design.md
 create mode 100644 openspec/changes/archive/2026-08-29-surrealdb-license-decision/files.txt
 create mode 100644 openspec/changes/archive/2026-08-29-surrealdb-license-decision/proposal.md
 create mode 100644 openspec/changes/archive/2026-08-29-surrealdb-license-decision/tasks.md
 create mode 100644 openspec/changes/archive/2026-08-29-surrealdb-license-decision/verification.md
 create mode 100644 openspec/changes/surreal-dual-engine-equivalence/.openspec.yaml
 create mode 100644 openspec/changes/surreal-dual-engine-equivalence/design.md
 create mode 100644 openspec/changes/surreal-dual-engine-equivalence/proposal.md
 create mode 100644 openspec/changes/surreal-dual-engine-equivalence/specs/surreal-native-query/spec.md
 create mode 100644 openspec/changes/surreal-dual-engine-equivalence/tasks.md
 create mode 100644 openspec/specs/agent-cli/spec.md
 create mode 100644 openspec/specs/agent-distribution/spec.md
 create mode 100644 openspec/specs/focused-agent-skills/spec.md
 create mode 100644 openspec/specs/harness-lifecycle/spec.md
 create mode 100644 openspec/specs/mcp-conformance/spec.md
 create mode 100644 openspec/specs/mcp-http/spec.md
 create mode 100644 openspec/specs/mcp-result-envelope/spec.md
 create mode 100644 openspec/specs/partition-contract/spec.md
 create mode 100644 openspec/specs/preflight-graph-size-estimate/spec.md
 create mode 100644 openspec/specs/rmcp-migration/spec.md
 create mode 100644 openspec/specs/snapshot-publication-errors/spec.md
 create mode 100644 openspec/specs/snapshot-publication-limit/spec.md
 create mode 100644 openspec/specs/snapshot-streaming/spec.md
 create mode 100644 openspec/specs/surreal-graph-projection/spec.md
 create mode 100644 openspec/specs/vendor-discovery-policy/spec.md
 create mode 100644 packages/compass-opencode/package.json
 create mode 100644 packages/compass-opencode/scripts/generate.mjs
 create mode 100644 packages/compass-opencode/src/index.js
 create mode 100644 packages/compass-opencode/src/index.ts
 create mode 100644 packages/compass-opencode/tests/plugin.integration.test.ts
 create mode 100644 packages/compass-opencode/tsconfig.json
 create mode 100644 scripts/bounded_redacted_log.mjs
 create mode 100755 scripts/check_surreal_feature_isolation.sh
 create mode 100644 scripts/fixtures/mcp-conformance-expected-failures.yaml
 create mode 100644 scripts/fixtures/mcp-conformance-project/src/lib.rs
 create mode 100644 scripts/fixtures/surreal-persistent-probes/SURREALDB-3.2.4-LICENSE.txt
 create mode 100644 scripts/fixtures/surreal-persistent-probes/expected-v1.json
 create mode 100644 scripts/fixtures/surreal-persistent-probes/input-v1.json
 create mode 100644 scripts/fixtures/surreal-persistent-probes/manifest-v1.json
 create mode 100644 scripts/fixtures/surreal-persistent-probes/rocksdb-result-v1.json
 create mode 100644 scripts/fixtures/surreal-persistent-probes/surrealkv-result-v1.json
 create mode 100755 scripts/qualify_codex_mcp_client.py
 create mode 100755 scripts/qualify_harness_packages.sh
 create mode 100755 scripts/qualify_mcp_conformance.sh

diff --git a/.agents/skills/.openspec-target b/.agents/skills/.openspec-target
new file mode 100644
index 000000000..2695308ab
--- /dev/null
+++ b/.agents/skills/.openspec-target
@@ -0,0 +1 @@
+codex
diff --git a/.codex/skills/openspec-apply-change/SKILL.md b/.agents/skills/openspec-apply-change/SKILL.md
similarity index 58%
rename from .codex/skills/openspec-apply-change/SKILL.md
rename to .agents/skills/openspec-apply-change/SKILL.md
index 1375861c3..e547f5d4b 100644
--- a/.codex/skills/openspec-apply-change/SKILL.md
+++ b/.agents/skills/openspec-apply-change/SKILL.md
@@ -7,14 +7,14 @@ compatibility: Requires openspec CLI.
 metadata:
   author: openspec
   version: "1.0"
-  generatedBy: "1.6.0"
+  generatedBy: "1.10.0"
 ---
 
 Implement tasks from an OpenSpec change.
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
 
-**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+**Input**: Optionally specify a change name (e.g., `$openspec-apply-change (Codex) or /openspec-apply-change (other agents) add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
 
 **Steps**
 
@@ -23,9 +23,9 @@ Implement tasks from an OpenSpec change.
    If a name is provided, use it. Otherwise:
    - Infer from conversation context if the user mentioned a change
    - Auto-select if only one active change exists
-   - If ambiguous, run `openspec list --json` to get available changes and use the **AskUserQuestion tool** to let the user select
+   - If ambiguous, run `openspec list --json` to get available changes and ask the user to select one
 
-   Always announce: "Using change: <name>" and how to override (e.g., `/opsx:apply <other>`).
+   Always announce: "Using change: <name>" and how to override (e.g., `$openspec-apply-change (Codex) or /openspec-apply-change (other agents) <other>`).
 
 2. **Check status to understand the schema**
    ```bash
@@ -47,12 +47,29 @@ Implement tasks from an OpenSpec change.
    - Progress (total, complete, remaining)
    - Task list with status
    - Dynamic instruction based on current state
+   - Optional `context`: current required project instruction input from the selected root
+   - Optional `operationGuidance`: current advisory guidance for apply
 
    **Handle states:**
-   - If `state: "blocked"` (missing artifacts): show message, suggest using openspec-continue-change
+   - If `state: "blocked"` (missing artifacts): show message, suggest using `$openspec-continue-change (Codex) or /openspec-continue-change (other agents)` (if it is not installed, run `openspec status --change "<name>" --json` to see the next artifact and `openspec instructions <artifact-id> --change "<name>" --json` for how to create it)
    - If `state: "all_done"`: congratulate, suggest archive
    - Otherwise: proceed to implementation
 
+   Treat `context` as a required prompt-level input. Read and consider it, and
+   apply relevant project facts, conventions, and constraints while implementing.
+   Treat `operationGuidance` as optional additive advice. Read and consider every
+   entry, and follow entries that are applicable and compatible with the built-in
+   workflow.
+
+   Keep both fields separate from CLI-returned state, missing artifacts, tasks,
+   progress, `contextFiles`, and the built-in `instruction`. They are not
+   evidence of task completion, do not replace the built-in instruction, and do
+   not permit bypassing a blocked state. If context conflicts with the built-in
+   instruction, an explicit user choice, or a CLI-controlled value, report the
+   conflict and preserve the controlling value. If guidance is inapplicable or
+   conflicts with those controlling inputs, do not follow it and explain why.
+   These are prompt-level behavior contracts, not enforceable checks.
+
 4. **Read context files**
 
    Read every file path listed under `contextFiles` from the apply instructions output.
@@ -60,6 +77,9 @@ Implement tasks from an OpenSpec change.
    - **spec-driven**: proposal, specs, design, tasks
    - Other schemas: follow the contextFiles from CLI output
 
+   Do not copy `context` or `operationGuidance` verbatim into implementation
+   files or planning artifacts unless the user separately asks for that content.
+
 5. **Show current progress**
 
    Display:
@@ -80,6 +100,7 @@ Implement tasks from an OpenSpec change.
    **Pause if:**
    - Task is unclear → ask for clarification
    - Implementation reveals a design issue → suggest updating artifacts
+   - A task needs work beyond what the spec and tasks describe, or you are tempted to drop, narrow, defer, or accept exceptions to specified behavior to make it fit → surface the added scope and ask; do not absorb it silently
    - Error or blocker encountered → report and wait for guidance
    - User interrupts
 
@@ -119,7 +140,7 @@ Working on task 4/7: <task description>
 - [x] Task 2
 ...
 
-All tasks complete! Ready to archive this change.
+All tasks complete! You can archive this change with `$openspec-archive-change (Codex) or /openspec-archive-change (other agents)`.
 ```
 
 **Output On Pause (Issue Encountered)**
@@ -150,7 +171,14 @@ What would you like to do?
 - Keep code changes minimal and scoped to each task
 - Update task checkbox immediately after completing each task
 - Pause on errors, blockers, or unclear requirements - don't guess
+- When a task needs work beyond what the spec describes, surface the added scope and pause - never silently narrow, defer, or simplify away specified behavior
+- Only mark a task `- [x]` when its specified behavior is fully implemented, not when it is partially done or deferred
 - Use contextFiles from CLI output, don't assume specific file names
+- Do not use context or operation guidance as proof that a task is complete
+- Apply relevant project context; report conflicts with controlling workflow inputs
+- Consider every guidance entry; explain any inapplicable or conflicting advice
+- Do not copy runtime context or operation guidance into implementation files or planning artifacts
+- Preserve CLI-controlled blocked/ready/all-done behavior and completion criteria
 
 **Fluid Workflow Integration**
 
diff --git a/.agents/skills/openspec-archive-change/SKILL.md b/.agents/skills/openspec-archive-change/SKILL.md
new file mode 100644
index 000000000..91f52c5e8
--- /dev/null
+++ b/.agents/skills/openspec-archive-change/SKILL.md
@@ -0,0 +1,182 @@
+---
+name: openspec-archive-change
+description: Archive a completed change in the experimental workflow. Use when the user wants to finalize and archive a change after implementation is complete.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.10.0"
+---
+
+Archive a completed change in the experimental workflow.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+`<capability-path>` is the spec directory relative to `specs/` (for example, `user-auth` or `identity/user-auth`). Preserve the full path from each delta spec when resolving its main spec.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **Select the change**
+
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes and ask the user to select one
+
+   When prompting, show only active changes (not already archived).
+   Include the schema used for each change if available.
+
+   Always announce: "Using change: <name>" and how to override (e.g., `$openspec-archive-change (Codex) or /openspec-archive-change (other agents) <other>`).
+
+   **Load current archive inputs before the existing archive checks:**
+
+   After resolving the selected change and planning root, run:
+   ```bash
+   openspec instructions archive --change "<name>" --json
+   ```
+   Keep the same selected-root flags on this command. This lookup is advisory and
+   optional: it only supplies extra prompt inputs, so it must never block archiving.
+   If it exits non-zero or returns invalid JSON — for example on an older CLI that
+   does not support this command yet — continue the archive workflow with no
+   context and no operation guidance. Do not report an error and do not stop.
+
+   A successful response may omit both optional fields. Treat `context` as a
+   required prompt-level input: read and consider it, and apply relevant project
+   facts, conventions, and constraints. Treat `operationGuidance` as optional
+   additive advice: read and consider every entry, and follow entries that are
+   applicable and compatible with the built-in archive workflow.
+
+   Keep both fields separate from built-in steps, explicit user choices, resolved
+   paths, CLI checks, and command contracts. If context conflicts with one of those
+   controlling inputs, report the conflict and preserve the controlling value. If
+   guidance is inapplicable or conflicts with a controlling input, do not follow it
+   and explain why. Do not infer replacement paths, skipped prompts, or flags from
+   either field, and do not copy their text verbatim into specs, change artifacts,
+   or archive summaries unless the user separately asks for it. These are
+   prompt-level behavior contracts, not enforceable checks.
+
+2. **Check artifact completion status**
+
+   Run `openspec status --change "<name>" --json` to check artifact completion.
+
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context
+   - `artifacts`: List of artifacts with their status (`done`, `skipped`, or other)
+
+   **If any artifacts are neither `done` nor `skipped`** (skipped artifacts satisfy the requirement - the change declares skip_specs):
+   - Display warning listing incomplete artifacts
+   - Ask the user to confirm they want to proceed
+   - Proceed if user confirms
+
+3. **Check task completion status**
+
+   Read the tasks file (typically `tasks.md`) to check for incomplete tasks.
+
+   Count tasks marked with `- [ ]` (incomplete) vs `- [x]` (complete).
+
+   **If incomplete tasks found:**
+   - Display warning showing count of incomplete tasks
+   - Ask the user to confirm they want to proceed
+   - Proceed if user confirms
+
+   **If no tasks file exists:** Proceed without task-related warning.
+
+4. **Assess delta spec sync state**
+
+   Use `artifactPaths.specs.existingOutputPaths` from status JSON as the only
+   delta-spec source. If the `specs` entry is missing or
+   `existingOutputPaths` is empty, proceed without a sync prompt and do not infer
+   delta specs from other artifacts.
+
+   **If delta specs exist:**
+   - Compare each delta spec with its corresponding main spec at `<planningHome.root>/openspec/specs/<capability-path>/spec.md` (use the store-aware `planningHome.root` from step 2, not a hardcoded repo path)
+   - Determine what changes would be applied (adds, modifications, removals, renames)
+   - Show a combined summary before prompting
+
+   **Prompt options:**
+   - If changes needed: "Sync now (recommended)", "Archive without syncing"
+   - If already synced: "Archive now", "Sync anyway", "Cancel"
+
+   Route on the answer:
+   - "Cancel" — stop, do not archive
+   - "Archive without syncing" or "Archive now" — proceed to archive
+   - "Sync now" or "Sync anyway" — sync, then verify (below)
+   - Anything else — ask again rather than archiving
+
+   Before a selected sync writes any main spec, run
+   `openspec instructions specs --change "<name>" --json` once with the same
+   selected-root flags. Require a zero exit status and valid artifact-instruction
+   JSON. If the lookup fails or returns invalid JSON, report the error and stop
+   before writing any main spec or moving the change. A valid response with omitted
+   `rules` is the no-rules case. Apply returned `rules` only to the content and
+   form of main specs produced by this merge; do not use them as archive guidance,
+   change CLI behavior, or copy the rule text into any output file.
+
+   Then run the `openspec-sync-specs` workflow inline (agent-driven intelligent merge) for change '<name>', passing the delta spec analysis and the fetched specs-rule snapshot from above, and wait for it to finish. The inline sync must reuse that snapshot without fetching `specs` instructions again. Do not delegate it to a background task — step 5 would move `changeRoot` out from under a sync that is still reading it, leaving the change archived and the main specs never updated. If your agent can only run it by delegation, delegate synchronously and wait for the result.
+
+   Then re-run the comparison from the top of this step against every capability that has a delta spec in `artifactPaths.specs.existingOutputPaths` — not only the ones the sync reports it touched. A successful sync leaves nothing left to apply, so each capability must now read as already synced:
+   - ADDED requirements present
+   - MODIFIED requirements carrying the scenario and description changes named in the delta, with their other scenarios intact
+   - REMOVED requirements gone — and where this sync retired a capability (removed its last requirement, leaving `## Requirements` empty), its main spec deleted rather than left empty; a spec the sync deliberately kept and reported is also a match
+   - RENAMED requirements present under the new name and absent under the old one
+
+   If the sync failed, or any capability does not match, report what differs and stop — do not archive. Nothing has moved and `changeRoot` is intact, so the user can fix the mismatch or re-run the sync and start the archive again.
+
+5. **Perform the archive**
+
+   Create an `archive` directory under `planningHome.changesDir` if it doesn't exist:
+   ```bash
+   mkdir -p "<planningHome.changesDir>/archive"
+   ```
+
+   Generate the target name: use the change name as-is when it already starts with a `YYYY-MM-DD-` prefix; otherwise prepend the current date as `YYYY-MM-DD-<change-name>`. Never stack a second date (same rule as `openspec archive`).
+
+   **Check if target already exists:**
+   - If yes: Fail with error, suggest renaming existing archive or using different date
+   - If no: Move `changeRoot` to the archive directory
+
+   ```bash
+   mv "<changeRoot>" "<planningHome.changesDir>/archive/<target-name>"
+   ```
+
+6. **Display summary**
+
+   Show archive completion summary including:
+   - Change name
+   - Schema that was used
+   - Archive location
+   - Whether specs were synced (if applicable)
+   - Note about any warnings (incomplete artifacts/tasks)
+
+**Output On Success**
+
+```markdown
+## Archive Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Archived to:** the archive path derived from `planningHome.changesDir`/<target-name>/
+**Specs:** <"✓ Synced to main specs" only if the step 4 verification passed; otherwise "No delta specs" or "Sync skipped">
+
+<"All artifacts complete. All tasks complete." — or, if archived with warnings, list them instead (e.g. "Archived with 2 incomplete tasks")>
+```
+
+**Guardrails**
+- Announce the selected change; prompt for selection when it is ambiguous
+- Use artifact graph (openspec status --json) for completion checking
+- Don't block archive on warnings - just inform and confirm
+- Preserve .openspec.yaml when moving to archive (it moves with the directory)
+- Show clear summary of what happened
+- If sync is requested, run the `openspec-sync-specs` workflow inline (agent-driven)
+- Never archive while a spec sync is still in flight — run the sync inline and verify the main specs before moving `changeRoot`
+- If delta specs exist, always run the sync assessment and show the combined summary before prompting
+- Apply relevant runtime context and report conflicts; operation guidance remains advisory
+- Consider every guidance entry and explain any inapplicable or conflicting advice
+- Existing CLI checks, resolved paths, prompts, and command contracts are unchanged
+- Artifact rules constrain only the specs being written and are never operation guidance
+- Never copy runtime context, operation guidance, or artifact-rule text verbatim into output files
diff --git a/.agents/skills/openspec-bulk-archive-change/SKILL.md b/.agents/skills/openspec-bulk-archive-change/SKILL.md
new file mode 100644
index 000000000..0faa60c60
--- /dev/null
+++ b/.agents/skills/openspec-bulk-archive-change/SKILL.md
@@ -0,0 +1,339 @@
+---
+name: openspec-bulk-archive-change
+description: Archive multiple completed changes at once. Use when archiving several parallel changes.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.10.0"
+---
+
+Archive multiple completed changes in a single operation.
+
+This skill allows you to batch-archive changes, handling spec conflicts intelligently by checking the codebase to determine what's actually implemented.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+`<capability-path>` is the spec directory relative to `specs/` (for example, `user-auth` or `identity/user-auth`). Preserve the full path from each delta spec when resolving its main spec.
+
+**Input**: None required (prompts for selection)
+
+**Steps**
+
+1. **Get active changes**
+
+   Run `openspec list --json` to get all active changes.
+
+   If no active changes exist, inform user and stop.
+
+2. **Prompt for change selection**
+
+   Ask the user to choose changes (multi-select):
+   - Show each change with its schema
+   - Include an option for "All changes"
+   - Allow any number of selections (1+ works, 2+ is the typical use case)
+
+   **IMPORTANT**: Do NOT auto-select. Always let the user choose.
+
+   **Load current archive inputs once for the selected root before batch validation:**
+
+   Choose one selected change from this root and run
+   `openspec instructions archive --change "<selected-change>" --json` with the
+   same selected-root flags. This lookup is advisory and optional: it only supplies
+   extra prompt inputs, so it must never block the batch. If it fails or returns
+   invalid JSON — for example on an older CLI that does not support this command
+   yet — continue the batch with no context and no operation guidance. Do not
+   report an error and do not stop.
+
+   A valid response may omit `context` and `operationGuidance`. Treat
+   `context` as a required prompt-level input across the batch: read and consider
+   it, and apply relevant project facts, conventions, and constraints. Treat
+   `operationGuidance` as optional additive advice: read and consider every
+   entry, and follow entries that are applicable and compatible with the built-in
+   batch workflow.
+
+   Keep both fields separate from conflict analysis, explicit user choices,
+   resolved paths, CLI checks, and command contracts. If context conflicts with one
+   of those controlling inputs, report the conflict and preserve the controlling
+   value. If guidance is inapplicable or conflicts with a controlling input, do not
+   follow it and explain why. Do not infer skipped prompts, replacement paths, or
+   flags from either field, and do not copy their text verbatim into specs, changes,
+   or summaries. These are prompt-level behavior contracts, not enforceable checks.
+
+3. **Batch validation - gather status for all selected changes**
+
+   For each selected change, collect:
+
+   a. **Artifact status** - Run `openspec status --change "<name>" --json`
+      - Parse `schemaName`, `artifacts`, `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`
+      - Note which artifacts are `done` vs other states
+
+   b. **Task completion** - Read `artifactPaths.tasks.existingOutputPaths` from status JSON
+      - Count `- [ ]` (incomplete) vs `- [x]` (complete)
+      - If no tasks file exists, note as "No tasks"
+
+   c. **Delta specs** - Check `artifactPaths.specs.existingOutputPaths` from status JSON
+      - List which capability specs exist
+      - For each, extract requirement names (lines matching `### Requirement: <name>`)
+      - Treat this list as the only delta-spec source. If the `specs` entry is
+        missing or the list is empty, perform no spec sync or specs-instruction
+        lookup for that change; do not infer deltas from unrelated artifacts.
+      - Evaluate this independently for every change, including mixed-schema
+        batches where some schemas have no `specs` artifact.
+4. **Detect spec conflicts**
+
+   Build a map keyed by `<capability-path>`, the exact path relative to `specs/`:
+
+   ```text
+   identity/user-auth -> [change-a, change-b]  <- CONFLICT (2+ changes)
+   billing/user-auth  -> [change-c]            <- OK (different full path)
+   ```
+
+   A conflict exists when 2+ selected changes have delta specs for the exact same `<capability-path>`.
+
+5. **Resolve conflicts agentically**
+
+   **For each conflict**, investigate the codebase:
+
+   a. **Read the delta specs** from each conflicting change to understand what each claims to add/modify
+
+   b. **Search the codebase** for implementation evidence:
+      - Look for code implementing requirements from each delta spec
+      - Check for related files, functions, or tests
+
+   c. **Determine resolution**:
+      - If only one change is actually implemented -> sync that one's specs
+      - If both implemented -> apply in chronological order (older first, newer overwrites)
+      - If neither implemented -> skip spec sync, warn user
+
+   d. **Record resolution** for each conflict:
+      - An inclusion or exclusion decision for every delta spec, keyed by change and `<capability-path>`
+      - Which included delta specs to apply and in what order
+      - Which delta specs to exclude from sync because their implementation is missing
+      - Rationale (what was found in codebase)
+
+6. **Show consolidated status table**
+
+   Display a table summarizing all changes:
+
+   ```markdown
+   | Change              | Artifacts | Tasks | Specs   | Conflicts | Status |
+   |---------------------|-----------|-------|---------|-----------|--------|
+   | schema-management   | Done      | 5/5   | 2 delta | None      | Ready  |
+   | project-config      | Done      | 3/3   | 1 delta | None      | Ready  |
+   | add-oauth           | Done      | 4/4   | 1 delta | identity/user-auth (!) | Ready* |
+   | add-verify-skill    | 1 left    | 2/5   | None    | None      | Warn   |
+   ```
+
+   For conflicts, show the resolution:
+   ```text
+   * Conflict resolution:
+     - identity/user-auth spec: Will apply add-oauth then add-jwt (both implemented, chronological order)
+   ```
+
+   For incomplete changes, show warnings:
+   ```text
+   Warnings:
+   - add-verify-skill: 1 incomplete artifact, 3 incomplete tasks
+   ```
+
+7. **Confirm batch operation**
+
+   Ask the user a single confirmation question:
+
+   - "Archive N changes?" with options based on status
+   - Options might include:
+     - "Archive all N changes"
+     - "Archive only N ready changes (skip incomplete)"
+     - "Cancel"
+
+   If there are incomplete changes, make clear they'll be archived with warnings.
+
+   Route on the answer by intent, not by exact label — you wrote these labels,
+   so match what the user picked rather than the wording above:
+   - "Cancel" — stop, do not archive. Report that nothing was archived and skip the remaining steps.
+   - The archive-everything option — proceed with every selected change
+   - The ready-only option — proceed with only the changes the step 6 table marks `Ready` or `Ready*`, and record the rest as Skipped in step 8d. If a `Ready*` change's conflict partner is skipped, re-derive that conflict's resolution using only the changes being archived.
+   - Anything else — ask again rather than archiving
+
+   Before step 8 writes the first main spec or moves any change, fetch every
+   required specs-rule snapshot for the confirmed batch. For each change that will
+   sync concrete `artifactPaths.specs.existingOutputPaths`, run
+   `openspec instructions specs --change "<name>" --json` exactly once with the
+   same selected-root flags. Obtain all snapshots before the first write or move.
+   If any lookup exits non-zero or returns invalid artifact-instruction JSON,
+   identify the affected change, report the error, and stop the whole batch before
+   any main-spec write or change move. Do not treat lookup failure as omitted
+   rules. A valid response without `rules` is the no-rules case.
+
+8. **Execute archive for each confirmed change**
+
+   Before processing, carry the recorded decisions from step 5 (after any step 7 re-derivation) into two per-delta sets:
+   - `includedDeltas`: all non-conflicting delta specs from confirmed changes plus conflict deltas selected for sync
+   - `excludedDeltas`: conflict deltas from confirmed changes excluded because their implementation is missing
+   - A single change can have both included and excluded delta specs. Keep the decision per delta; do not collapse it into a per-change sync flag.
+
+   Process changes in the determined order (respecting conflict resolution):
+
+   a. **Sync included delta specs**:
+      - Run the `openspec-sync-specs` workflow inline (agent-driven intelligent merge) only for changes with entries in `includedDeltas`, passing only the included delta paths and explicitly instructing it to ignore that change's `excludedDeltas`. Wait for it to finish.
+      - For conflicts, apply in resolved order.
+      - Pass that change's fetched specs-rule snapshot into inline sync; inline
+        sync must reuse it without fetching instructions again
+      - Apply artifact rules only to main specs produced by that change. They do
+        not change conflict resolution, archive behavior, or CLI contracts, and
+        their text is not copied into an output file
+      - Do not delegate to a background task — step 8c would move `changeRoot` out from under a sync that is still reading it.
+      - If a change has no included delta specs, do not run the sync workflow for it.
+
+   b. **Verify included delta specs before moving changeRoot**:
+      - Re-run the comparison only for delta specs in `includedDeltas` against main spec at `<planningHome.root>/openspec/specs/<capability-path>/spec.md` (use the store-aware `planningHome.root` from step 3 status JSON, not a hardcoded repo path).
+      - Verify that main specs are updated:
+        - ADDED requirements present
+        - MODIFIED requirements carrying scenario and description changes named in the delta, with their other scenarios intact
+        - REMOVED requirements gone — and where this sync retired a capability (removed its last requirement, leaving `## Requirements` empty), its main spec deleted rather than left empty; a spec the sync deliberately kept and reported is also a match
+        - RENAMED requirements present under the new name and absent under the old one
+      - Do not verify delta specs in `excludedDeltas`; they are intentionally left unsynced.
+      - If sync failed or any capability does not match verification, report what differs and fail/skip moving that change's `changeRoot` — do not archive that change. `changeRoot` remains intact.
+
+   c. **Perform the archive**:
+
+      Target name: use the change name as-is when it already starts with a `YYYY-MM-DD-` prefix; otherwise prepend the current date as `YYYY-MM-DD-<name>` (same rule as `openspec archive`).
+
+      ```bash
+      mkdir -p "<planningHome.changesDir>/archive"
+      mv "<changeRoot>" "<planningHome.changesDir>/archive/<target-name>"
+      ```
+
+   d. **Track outcome** for each change:
+      - Success: archived successfully
+      - Failed: error during archive or spec verification (record error)
+      - Skipped: user chose not to archive (if applicable)
+      - Sync skipped: for every delta in `excludedDeltas`, report `sync skipped` with the change, `<capability-path>`, and recorded reason. This is distinct from skipping the archive.
+
+9. **Display summary**
+
+   Show final results:
+
+   ```markdown
+   ## Bulk Archive Complete
+
+   Archived 3 changes:
+   - schema-management-cli -> archive/2026-01-19-schema-management-cli/
+   - project-config -> archive/2026-01-19-project-config/
+   - add-oauth -> archive/2026-01-19-add-oauth/
+
+   Skipped 1 change:
+   - add-verify-skill (user chose not to archive incomplete)
+
+   Spec sync summary:
+   - 4 delta specs synced to main specs
+   - 1 delta spec sync skipped (add-jwt, identity/user-auth: implementation not found)
+   - 1 conflict resolved (identity/user-auth: synced add-oauth, skipped add-jwt)
+   ```
+
+   If any failures:
+   ```text
+   Failed 1 change:
+   - some-change: Archive directory already exists
+   ```
+
+**Conflict Resolution Examples**
+
+Example 1: Only one implemented
+```text
+Conflict: <planningHome.root>/openspec/specs/auth/spec.md touched by [add-oauth, add-jwt]
+
+Checking add-oauth:
+- Delta adds "OAuth Provider Integration" requirement
+- Searching codebase... found src/auth/oauth.ts implementing OAuth flow
+
+Checking add-jwt:
+- Delta adds "JWT Token Handling" requirement
+- Searching codebase... no JWT implementation found
+
+Resolution: Only add-oauth is implemented. Will sync add-oauth specs only.
+```
+
+Example 2: Both implemented
+```text
+Conflict: <planningHome.root>/openspec/specs/api/spec.md touched by [add-rest-api, add-graphql]
+
+Checking add-rest-api (created 2026-01-10):
+- Delta adds "REST Endpoints" requirement
+- Searching codebase... found src/api/rest.ts
+
+Checking add-graphql (created 2026-01-15):
+- Delta adds "GraphQL Schema" requirement
+- Searching codebase... found src/api/graphql.ts
+
+Resolution: Both implemented. Will apply add-rest-api specs first,
+then add-graphql specs (chronological order, newer takes precedence).
+```
+
+**Output On Success**
+
+```markdown
+## Bulk Archive Complete
+
+Archived N changes:
+- <change-1> -> archive/<target-name-1>/
+- <change-2> -> archive/<target-name-2>/
+
+Spec sync summary:
+- N delta specs synced to main specs
+- No conflicts (or: M conflicts resolved)
+```
+
+**Output On Partial Success**
+
+```markdown
+## Bulk Archive Complete (partial)
+
+Archived N changes:
+- <change-1> -> archive/<target-name-1>/
+
+Skipped M changes:
+- <change-2> (user chose not to archive incomplete)
+
+Failed K changes:
+- <change-3>: Archive directory already exists
+```
+
+**Output When No Changes**
+
+```markdown
+## No Changes to Archive
+
+No active changes found. Create a new change to get started.
+```
+
+**Guardrails**
+- Allow any number of changes (1+ is fine, 2+ is the typical use case)
+- Always prompt for selection, never auto-select
+- Detect spec conflicts early and resolve by checking codebase
+- When both changes are implemented, apply specs in chronological order
+- Skip spec sync only when implementation is missing (warn user)
+- Show clear per-change status before confirming
+- Use single confirmation for entire batch
+- Never archive after the user cancels the confirmation — a cancelled batch archives nothing
+- Track and report all outcomes (success/skip/fail)
+- Preserve .openspec.yaml when moving to archive
+- Archive directory target uses current date: YYYY-MM-DD-<name>; a name that already starts with a `YYYY-MM-DD-` prefix is used as-is (never stack a second date)
+- If archive target exists, fail that change but continue with others
+- If sync is requested, run the `openspec-sync-specs` workflow inline (agent-driven) for each change with included delta specs
+- Carry the per-delta `includedDeltas` and `excludedDeltas` decisions into execution; sync and verify only included deltas
+- Report every excluded delta as `sync skipped` without treating the archive itself as skipped
+- Never archive a change while a spec sync is still in flight — run the sync inline and verify main specs at `<planningHome.root>/openspec/specs/<capability-path>/spec.md` before moving `changeRoot`
+- Fetch archive inputs once per selected root before spec inspection or moves
+- Fetch all required specs-rule snapshots before the batch's first main-spec write or move
+- A failed archive-inputs lookup never blocks the batch; it proceeds with no context or guidance
+- A failed specs instruction lookup stops the whole batch atomically
+- Changes without concrete `artifactPaths.specs.existingOutputPaths` continue without spec sync
+- Apply relevant runtime context across the batch and report conflicts
+- Operation guidance remains advisory; consider every entry and explain rejected advice
+- Keep runtime inputs, conflict analysis, CLI-derived values, and artifact rules separate
+- Artifact rules constrain only written specs
+- Never copy runtime input or artifact-rule text verbatim into output files
diff --git a/.kimi/skills/openspec-continue-change/SKILL.md b/.agents/skills/openspec-continue-change/SKILL.md
similarity index 58%
rename from .kimi/skills/openspec-continue-change/SKILL.md
rename to .agents/skills/openspec-continue-change/SKILL.md
index 31b476f24..75186c8ee 100644
--- a/.kimi/skills/openspec-continue-change/SKILL.md
+++ b/.agents/skills/openspec-continue-change/SKILL.md
@@ -7,22 +7,25 @@ compatibility: Requires openspec CLI.
 metadata:
   author: openspec
   version: "1.0"
-  generatedBy: "1.6.0"
+  generatedBy: "1.10.0"
 ---
 
 Continue working on a change by creating the next artifact.
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
 
 **Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
 
 **Steps**
 
-1. **If no change name provided, prompt for selection**
+1. **Select the change**
 
-   Run `openspec list --json` to get available changes sorted by most recently modified. Then use the **AskUserQuestion tool** to let the user select which change to work on.
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes sorted by most recently modified, and ask the user to select one
 
-   Present the top 3-4 most recently modified changes as options, showing:
+   When prompting, present the top 3-4 most recently modified changes as options, showing:
    - Change name
    - Schema (from `schema` field if present, otherwise "spec-driven")
    - Status (e.g., "0/5 tasks", "complete", "no tasks")
@@ -30,7 +33,7 @@ Continue working on a change by creating the next artifact.
 
    Mark the most recently modified change as "(Recommended)" since it's likely what the user wants to continue.
 
-   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+   Always announce: "Using change: <name>" and how to override (e.g., `$openspec-continue-change (Codex) or /openspec-continue-change (other agents) <other>`).
 
 2. **Check current status**
    ```bash
@@ -38,18 +41,18 @@ Continue working on a change by creating the next artifact.
    ```
    Parse the JSON to understand current state. The response includes:
    - `schemaName`: The workflow schema being used (e.g., "spec-driven")
-   - `artifacts`: Array of artifacts with their status ("done", "ready", "blocked")
-   - `isComplete`: Boolean indicating if all artifacts are complete
+   - `artifacts`: Array of artifacts with their status ("done", "skipped", "ready", "blocked")
+   - `isPlanningComplete`: Boolean indicating if all planning artifacts are complete. Older CLI versions expose the same value as `isComplete`.
    - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context. Use these instead of assuming repo-local paths.
 
 3. **Act based on status**:
 
    ---
 
-   **If all artifacts are complete (`isComplete: true`)**:
+   **If all planning artifacts are complete (`isPlanningComplete: true`, or legacy `isComplete: true`)**:
    - Congratulate the user
    - Show final status including the schema used
-   - Suggest: "All artifacts created! You can now implement this change or archive it."
+   - Suggest: "Planning is complete! You can now implement this change. Once implementation and any tracked work are complete, archive it."
    - STOP
 
    ---
@@ -66,10 +69,12 @@ Continue working on a change by creating the next artifact.
      - `template`: The structure to use for your output file
      - `instruction`: Schema-specific guidance
      - `resolvedOutputPath`: Resolved path or pattern to write the artifact
-     - `dependencies`: Completed artifacts to read for context
+     - `dependencies`: Completed artifacts to read for context (entries with `skipped: true` have no files - do not look for them)
+     - `skipped`/`warning`: present when the change declares skip_specs and this artifact must NOT be created - pick another artifact
    - **Create the artifact file**:
-     - Read any completed dependency files for context
-     - Use `template` as the structure - fill in its sections
+     - Read any completed dependency files for context - always re-read them from disk, even if you saw them earlier in the conversation (the user may have edited them)
+     - If the `instruction` field delegates creation to a specific skill or command, invoke it to produce the artifact instead of writing the file yourself, then verify the artifact file exists at `resolvedOutputPath`
+     - Otherwise use `template` as the structure - fill in its sections
      - Apply `context` and `rules` as constraints when writing - but do NOT copy them into the file
      - Write to the `resolvedOutputPath` specified in instructions. If it is a glob pattern, choose the concrete file path using the schema instruction and the change's context
    - Show what was created and what's now unlocked
@@ -97,22 +102,13 @@ After each invocation, show:
 
 **Artifact Creation Guidelines**
 
-The artifact types and their purpose depend on the schema. Use the `instruction` field from the instructions output to understand what to create.
+The artifact types and their purpose depend on the schema. The `instruction` field from the instructions output is the authoritative guidance for each artifact - follow it even when the artifact has a familiar name (proposal.md, tasks.md, etc.), since custom schemas may define different content or a different process for the same file names.
 
-Common artifact patterns:
-
-**spec-driven schema** (proposal → specs → design → tasks):
-- **proposal.md**: Ask user about the change if not clear. Fill in Why, What Changes, Capabilities, Impact.
-  - The Capabilities section is critical - each capability listed will need a spec file.
-- **specs/<capability>/spec.md**: Create one spec per capability listed in the proposal's Capabilities section (use the capability name, not the change name).
-- **design.md**: Document technical decisions, architecture, and implementation approach.
-- **tasks.md**: Break down implementation into checkboxed tasks.
-
-For other schemas, follow the `instruction` field from the CLI output.
+If the `instruction` field directs you to use a specific skill or command to create the artifact, invoke it instead of writing the artifact directly.
 
 **Guardrails**
 - Create ONE artifact per invocation
-- Always read dependency artifacts before creating a new one
+- Always read dependency artifacts before creating a new one - re-read from disk, not from conversation memory (files may have changed since you last saw them)
 - Never skip artifacts or create out of order
 - If context is unclear, ask the user before creating
 - Verify the artifact file exists after writing before marking progress
diff --git a/.codex/skills/openspec-explore/SKILL.md b/.agents/skills/openspec-explore/SKILL.md
similarity index 67%
rename from .codex/skills/openspec-explore/SKILL.md
rename to .agents/skills/openspec-explore/SKILL.md
index 771271a8f..b21b1867e 100644
--- a/.codex/skills/openspec-explore/SKILL.md
+++ b/.agents/skills/openspec-explore/SKILL.md
@@ -7,16 +7,16 @@ compatibility: Requires openspec CLI.
 metadata:
   author: openspec
   version: "1.0"
-  generatedBy: "1.6.0"
+  generatedBy: "1.10.0"
 ---
 
 Enter explore mode. Think deeply. Visualize freely. Follow the conversation wherever it goes.
 
-**IMPORTANT: Explore mode is for thinking, not implementing.** You may read files, search code, and investigate the codebase, but you must NEVER write code or implement features. If the user asks you to implement something, remind them to exit explore mode first and create a change proposal. You MAY create OpenSpec artifacts (proposals, designs, specs) if the user asks—that's capturing thinking, not implementing.
+**IMPORTANT: Explore mode is for thinking, not implementing.** You may read files, search code, and investigate the codebase, but you must NEVER write code or implement features. If the user asks you to implement something, remind them to exit explore mode first and create a change proposal. You MAY create OpenSpec artifacts (proposals, designs, specs) if the user asks—that's capturing thinking, not implementing. For a new change, scaffold it first as described below.
 
 **This is a stance, not a workflow.** There are no fixed steps, no required sequence, no mandatory outputs. You're a thinking partner helping the user explore.
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
 
 ---
 
@@ -94,6 +94,12 @@ This tells you:
 - Their names, schemas, and status
 - What the user might be working on
 
+Then read the project's own context from the resolved root - `<root.path>/openspec/config.yaml` (or `config.yml`). Use the `root.path` returned above, and skip this if neither file exists:
+- `context`: project background - tech stack, conventions, constraints
+- `rules`: keyed by artifact id - the entries for an artifact apply only when you write that artifact
+
+Ground your thinking in these. They are constraints for you to follow, not content to reproduce: do NOT copy them into the conversation or into any artifact you create.
+
 ### When no change exists
 
 Think freely. When insights crystallize, you might offer:
@@ -101,6 +107,15 @@ Think freely. When insights crystallize, you might offer:
 - "This feels solid enough to start a change. Want me to create a proposal?"
 - Or keep exploring - no pressure to formalize
 
+If the user asks you to capture the exploration as a new change, transition seamlessly into the requested capture:
+
+1. Run `openspec new change "<name>"` (with `--store <id>` when applicable) before creating any artifacts. Never create a new change directory under `openspec/changes/` by hand; the CLI scaffold creates required metadata such as `.openspec.yaml`. Keep the selected `--store <id>` on every applicable follow-up `status` and `instructions` command.
+2. Run `openspec status --change "<name>" --json` (append the confirmed `--store "<id>"` only for a registered standalone store), then process the requested artifacts in dependency order. For each requested artifact that is `ready`, run `openspec instructions "<artifact-id>" --change "<name>" --json` (append the confirmed `--store "<id>"` only for a registered standalone store). Before creating a requested artifact, evaluate any condition in its own `instruction` against the explored change; record a deliberate skip instead when the condition does not apply. If a requested artifact is blocked by a direct prerequisite the user did not request, run `openspec instructions "<prerequisite-id>" --change "<name>" --json` (append the confirmed `--store "<id>"` only for a registered standalone store) for that prerequisite whether it is `ready` or `blocked`. If its own `instruction` states a condition, evaluate that condition against the explored change and record a deliberate skip only when the condition does not apply. If the condition applies, or the prerequisite is not conditional, treat it as a normal prerequisite and ask before expanding the capture. Do not create an unrequested prerequisite unless the user approves.
+3. Follow the returned `template` and `instruction` fields. Read completed dependency files listed in `dependencies`, and apply `context` and `rules` as constraints without copying them into the artifact. If the instruction delegates creation to a specific skill or command, invoke it; otherwise write the artifact to `resolvedOutputPath`, using the instruction to choose a concrete path when it is a glob. Verify that the selected concrete output exists.
+4. After creating each artifact, re-run `openspec status --change "<name>" --json` (append the confirmed `--store "<id>"` only for a registered standalone store) and continue until every requested artifact is `done`, `skipped`, or was deliberately skipped because its own `instruction` stated a condition that did not apply. Tell the user about a deliberate conditional skip, remember it, and do not reconsider it. Dependencies are enablers, not gates: if a requested artifact is still `blocked` only because you deliberately skipped a conditional prerequisite, run `openspec instructions "<artifact-id>" --change "<name>" --json` (append the confirmed `--store "<id>"` only for a registered standalone store) despite the blocked status, then create it using step 3 only when those recorded conditional skips are its sole missing dependencies. If a requested artifact is blocked by a prerequisite the user did not ask to capture and cannot be conditionally skipped, explain that dependency and ask before expanding the capture.
+
+Capture the artifact(s) the user requested without asking them to invoke another workflow command. If they asked only to start a change, stop after scaffolding and show its status.
+
 ### When a change exists
 
 If the user mentions a change or you detect one is relevant:
@@ -116,14 +131,16 @@ If the user mentions a change or you detect one is relevant:
 
 3. **Offer to capture when decisions are made**
 
-    | Insight Type               | Where to Capture               |
-    |----------------------------|--------------------------------|
-    | New requirement discovered | `specs/<capability>/spec.md` |
-    | Requirement changed        | `specs/<capability>/spec.md` |
-    | Design decision made       | `design.md`                  |
-    | Scope changed              | `proposal.md`                |
-    | New work identified        | `tasks.md`                   |
-    | Assumption invalidated     | Relevant artifact              |
+   `<capability-path>` is the spec directory relative to `specs/` (for example, `user-auth` or `identity/user-auth`). Preserve an existing capability's full path and follow the project's established organization for new capabilities.
+
+    | Insight Type               | Where to Capture                    |
+    |----------------------------|-------------------------------------|
+    | New requirement discovered | `specs/<capability-path>/spec.md` |
+    | Requirement changed        | `specs/<capability-path>/spec.md` |
+    | Design decision made       | `design.md`                       |
+    | Scope changed              | `proposal.md`                     |
+    | New work identified        | `tasks.md`                        |
+    | Assumption invalidated     | Relevant artifact                   |
 
    Example offers:
    - "That's a design decision. Capture it in design.md?"
@@ -203,7 +220,7 @@ You: [reads codebase]
 
 **User is stuck mid-implementation:**
 ```
-User: /opsx:explore add-auth-system
+User: $openspec-explore (Codex) or /openspec-explore (other agents) add-auth-system
       The OAuth integration is more complex than expected
 
 You: [reads change artifacts]
@@ -285,6 +302,7 @@ But this summary is optional. Sometimes the thinking IS the value.
 - **Don't rush** - Discovery is thinking time, not task time
 - **Don't force structure** - Let patterns emerge naturally
 - **Don't auto-capture** - Offer to save insights, don't just do it
+- **Don't manually scaffold changes** - Never create a new change directory under `openspec/changes/` by hand. Always use `openspec new change "<name>"` (with `--store <id>` when applicable) so required metadata such as `.openspec.yaml` is created before writing artifacts.
 - **Do visualize** - A good diagram is worth many paragraphs
 - **Do explore the codebase** - Ground discussions in reality
 - **Do question assumptions** - Including the user's and your own
diff --git a/.agents/skills/openspec-ff-change/SKILL.md b/.agents/skills/openspec-ff-change/SKILL.md
new file mode 100644
index 000000000..fc88eff9e
--- /dev/null
+++ b/.agents/skills/openspec-ff-change/SKILL.md
@@ -0,0 +1,113 @@
+---
+name: openspec-ff-change
+description: Fast-forward through OpenSpec artifact creation. Use when the user wants to quickly create all artifacts needed for implementation without stepping through each one individually.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.10.0"
+---
+
+Fast-forward through artifact creation - generate everything needed to start implementation in one go.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: The user's request should include a change name (kebab-case) OR a description of what they want to build.
+
+**Steps**
+
+1. **If no clear input provided, ask what they want to build**
+
+   Ask the user (open-ended, no preset options):
+   > "What change do you want to work on? Describe what you want to build or fix."
+
+   From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
+
+   **IMPORTANT**: Do NOT proceed without understanding what the user wants to build.
+
+2. **Create the change directory**
+   ```bash
+   openspec new change "<name>"
+   ```
+   This creates a scaffolded change in the planning home resolved by the CLI.
+
+3. **Get the artifact build order**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to get:
+   - `applyRequires`: array of artifact IDs needed before implementation (e.g., `["tasks"]`)
+   - `artifacts`: list of all artifacts, each with its `status` and its `requires` edges (the artifact IDs it directly depends on)
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context. Use these instead of assuming repo-local paths.
+
+4. **Create every artifact in the required set**
+
+   Use a todo list to track progress through the artifacts.
+
+   Loop through artifacts in dependency order (artifacts with no pending dependencies first):
+
+   a. **For each artifact that is `ready` (dependencies satisfied)**:
+      - Get instructions:
+        ```bash
+        openspec instructions <artifact-id> --change "<name>" --json
+        ```
+      - The instructions JSON includes:
+        - `context`: Project background (constraints for you - do NOT include in output)
+        - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
+        - `template`: The structure to use for your output file
+        - `instruction`: Schema-specific guidance for this artifact type
+        - `skipped`/`warning`: present when the change declares skip_specs and this artifact must NOT be created - stop and pick another artifact
+        - `resolvedOutputPath`: Resolved path or pattern to write the artifact
+        - `dependencies`: Completed artifacts to read for context
+      - Read any completed dependency files for context - always re-read them from disk, even if you saw them earlier in the conversation (the user may have edited them)
+      - If the `instruction` field delegates creation to a specific skill or command, invoke it to produce the artifact instead of writing the file yourself, then verify the artifact file exists at `resolvedOutputPath`
+      - Otherwise create the artifact file using `template` as the structure and write it to `resolvedOutputPath`. If `resolvedOutputPath` is a glob, follow `instruction` to choose the concrete file path
+      - Apply `context` and `rules` as constraints - but do NOT copy them into the file
+      - Show brief progress: "✓ Created <artifact-id>"
+
+   b. **Continue until every artifact in the required set exists (not just `apply.requires`)**
+      - After creating each artifact, re-run `openspec status --change "<name>" --json`
+      - The required set is `applyRequires` plus every artifact reachable from those by following the `requires` edges in `status --json` - walk them transitively (spec-driven closes over proposal, specs, design, tasks). Leave artifacts outside that set alone
+      - `status` is file-existence only, so an `applyRequires` artifact reading `done` does NOT mean its dependencies exist - writing `tasks.md` early marks `tasks` done while `specs` was never written. Use each artifact's `requires` edges, not its `status`, to build the required set: a `done` artifact still lists what it depends on
+      - An artifact already reading `status: "skipped"` is satisfied: the change declares `skip_specs` in `.openspec.yaml`, so its files must NOT exist. Never try to create one
+      - Create every artifact in the required set that is missing, then re-check - creating one can unblock others
+      - Skip one only when `status` already reports it `skipped`, or when its own `instruction` says it is conditional: run `openspec instructions <artifact-id> --change "<name>" --json` and skip only if its `instruction` field marks it optional (e.g. "create only if..."). Spec-driven's `design.md` qualifies; `specs` qualifies only via the `skipped` status above, never by your own judgment. Tell the user, and do not reconsider it
+      - Dependencies are enablers, not gates: if a required artifact is still `blocked` only because you skipped a conditional dependency, write it anyway
+      - Stop when every artifact in the required set is `done`, `skipped`, or was deliberately skipped
+
+   c. **If an artifact requires user input** (unclear context):
+      - Ask the user to clarify
+      - Then continue with creation
+
+5. **Show final status**
+   ```bash
+   openspec status --change "<name>"
+   ```
+
+**Output**
+
+After completing all artifacts, summarize:
+- Change name and location
+- List of artifacts created with brief descriptions, plus any conditional artifact you skipped and why
+- What's ready: "All artifacts needed for implementation are ready."
+- Prompt: "Run `$openspec-apply-change (Codex) or /openspec-apply-change (other agents)` or ask me to implement to start working on the tasks."
+
+**Artifact Creation Guidelines**
+
+- Follow the `instruction` field from `openspec instructions` for each artifact type - it is the authoritative guidance, even for familiar artifact names
+- If the `instruction` field directs you to use a specific skill or command to create the artifact, invoke it instead of writing the artifact directly
+- The schema defines what each artifact should contain - follow it
+- Read dependency artifacts for context before creating new ones
+- Use `template` as the structure for your output file - fill in its sections
+- **IMPORTANT**: `context` and `rules` are constraints for YOU, not content for the file
+  - Do NOT copy `<context>`, `<rules>`, `<project_context>` blocks into the artifact
+  - These guide what you write, but should never appear in the output
+
+**Guardrails**
+- Create every artifact the apply phase transitively depends on, not just the ids listed in `apply.requires`
+- Always read dependency artifacts before creating a new one - re-read from disk, not from conversation memory (files may have changed since you last saw them)
+- If context is critically unclear, ask the user - but prefer making reasonable decisions to keep momentum
+- If a change with that name already exists, suggest continuing that change instead
+- Verify each artifact file exists after writing before proceeding to next
diff --git a/.kimi/skills/openspec-new-change/SKILL.md b/.agents/skills/openspec-new-change/SKILL.md
similarity index 85%
rename from .kimi/skills/openspec-new-change/SKILL.md
rename to .agents/skills/openspec-new-change/SKILL.md
index b4d8a9e70..88c6005da 100644
--- a/.kimi/skills/openspec-new-change/SKILL.md
+++ b/.agents/skills/openspec-new-change/SKILL.md
@@ -7,12 +7,12 @@ compatibility: Requires openspec CLI.
 metadata:
   author: openspec
   version: "1.0"
-  generatedBy: "1.6.0"
+  generatedBy: "1.10.0"
 ---
 
 Start a new change using the experimental artifact-driven approach.
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
 
 **Input**: The user's request should include a change name (kebab-case) OR a description of what they want to build.
 
@@ -20,7 +20,7 @@ Start a new change using the experimental artifact-driven approach.
 
 1. **If no clear input provided, ask what they want to build**
 
-   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
+   Ask the user (open-ended, no preset options):
    > "What change do you want to work on? Describe what you want to build or fix."
 
    From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
diff --git a/.codex/skills/openspec-onboard/SKILL.md b/.agents/skills/openspec-onboard/SKILL.md
similarity index 73%
rename from .codex/skills/openspec-onboard/SKILL.md
rename to .agents/skills/openspec-onboard/SKILL.md
index ac4ac6fee..3a693d26f 100644
--- a/.codex/skills/openspec-onboard/SKILL.md
+++ b/.agents/skills/openspec-onboard/SKILL.md
@@ -7,12 +7,12 @@ compatibility: Requires openspec CLI.
 metadata:
   author: openspec
   version: "1.0"
-  generatedBy: "1.6.0"
+  generatedBy: "1.10.0"
 ---
 
 Guide the user through their first complete OpenSpec workflow cycle. This is a teaching experience—you'll do real work in their codebase while explaining each step.
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
 
 ---
 
@@ -28,7 +28,7 @@ openspec --version 2>&1 || echo "CLI_NOT_INSTALLED"
 ```
 
 **If CLI not installed:**
-> OpenSpec CLI is not installed. Install it first, then come back to `/opsx:onboard`.
+> OpenSpec CLI is not installed. Install it first, then come back to `$openspec-onboard (Codex) or /openspec-onboard (other agents)`.
 
 Stop here if not installed.
 
@@ -155,7 +155,7 @@ Spend 1-2 minutes investigating the relevant code:
 │   [Optional: ASCII diagram if helpful]  │
 └─────────────────────────────────────────┘
 
-Explore mode (`/opsx:explore`) is for this kind of thinking—investigating before implementing. You can use it anytime you need to think through a problem.
+Explore mode (`$openspec-explore (Codex) or /openspec-explore (other agents)`) is for this kind of thinking—investigating before implementing. You can use it anytime you need to think through a problem.
 
 Now let's create a change to hold our work.
 ```
@@ -211,6 +211,11 @@ I'll draft one based on our task.
 
 **DO:** Draft the proposal content (don't save yet):
 
+`<capability-path>` is the spec directory relative to `specs/` (for example,
+`user-auth` or `identity/user-auth`). Use the exact existing path for modified
+capabilities. For new capabilities, follow the project's established spec
+organization.
+
 ```
 Here's a draft proposal:
 
@@ -227,10 +232,11 @@ Here's a draft proposal:
 ## Capabilities
 
 ### New Capabilities
-- `<capability-name>`: [brief description]
+- `<capability-path>`: [brief description]
 
 ### Modified Capabilities
 <!-- If modifying existing behavior -->
+- `<existing-capability-path>`: [brief description]
 
 ## Impact
 
@@ -368,12 +374,12 @@ Here are the implementation tasks:
 
 ## 1. [Category or file]
 
-- [ ] 1.1 [Specific task]
-- [ ] 1.2 [Specific task]
+- [ ] 1.1 [Specific task] — verify: [test, command, observable behavior, or delivered artifact]
+- [ ] 1.2 [Specific task] — verify: [test, command, observable behavior, or delivered artifact]
 
-## 2. Verify
+## 2. Integration Verification
 
-- [ ] 2.1 [Verification step]
+- [ ] 2.1 Verify [broader integration or system behavior] with [end-to-end test or observable result]
 
 ---
 
@@ -431,14 +437,14 @@ When a change is complete, we archive it. The archive path is derived from `plan
 Archived changes become your project's decision history—you can always find them later to understand why something was built a certain way.
 ```
 
-**DO:**
+**DO:** Archive the change (`--yes` answers the confirmation prompts, which you cannot answer from a tool call):
 ```bash
-openspec archive "<name>"
+openspec archive "<name>" --yes
 ```
 
 **SHOW:**
 ```
-Archived to: `<planningHome.changesDir>/archive/YYYY-MM-DD-<name>/`
+Archived to: `<planningHome.changesDir>/archive/<target-name>/` (the target name prepends today's date, unless the name already starts with a `YYYY-MM-DD-` prefix — then it is kept as-is, no second date)
 
 The change is now part of your project's history. The code is in your codebase, the decision record is preserved.
 ```
@@ -471,25 +477,25 @@ This same rhythm works for any size change—a small fix or a major feature.
 
  | Command           | What it does                               |
  |-------------------|--------------------------------------------|
- | `/opsx:propose` | Create a change and generate all artifacts |
- | `/opsx:explore` | Think through problems before/during work  |
- | `/opsx:apply`   | Implement tasks from a change              |
- | `/opsx:archive` | Archive a completed change                 |
+ | `$openspec-propose (Codex) or /openspec-propose (other agents)` | Create a change and generate all artifacts |
+ | `$openspec-explore (Codex) or /openspec-explore (other agents)` | Think through problems before/during work  |
+ | `$openspec-apply-change (Codex) or /openspec-apply-change (other agents)`   | Implement tasks from a change              |
+ | `$openspec-archive-change (Codex) or /openspec-archive-change (other agents)` | Archive a completed change                 |
 
-**Additional commands:**
+**Additional commands** (only if installed - availability depends on your profile):
 
  | Command            | What it does                                             |
  |--------------------|----------------------------------------------------------|
- | `/opsx:new`      | Start a new change, step through artifacts one at a time |
- | `/opsx:continue` | Continue working on an existing change                   |
- | `/opsx:ff`       | Fast-forward: create all artifacts at once               |
- | `/opsx:verify`   | Verify implementation matches artifacts                  |
+ | `$openspec-new-change (Codex) or /openspec-new-change (other agents)`      | Start a new change, step through artifacts one at a time |
+ | `$openspec-continue-change (Codex) or /openspec-continue-change (other agents)` | Continue working on an existing change                   |
+ | `$openspec-ff-change (Codex) or /openspec-ff-change (other agents)`       | Fast-forward: create all artifacts at once               |
+ | `$openspec-verify-change (Codex) or /openspec-verify-change (other agents)`   | Verify implementation matches artifacts                  |
 
 ---
 
 ## What's Next?
 
-Try `/opsx:propose` on something you actually want to build. You've got the rhythm now!
+Try `$openspec-propose (Codex) or /openspec-propose (other agents)` on something you actually want to build. You've got the rhythm now!
 ```
 
 ---
@@ -504,8 +510,8 @@ If the user says they need to stop, want to pause, or seem disengaged:
 No problem! Your change is saved at the `changeRoot` reported by `openspec status --change "<name>" --json`.
 
 To pick up where we left off later:
-- `/opsx:continue <name>` - Resume artifact creation
-- `/opsx:apply <name>` - Jump to implementation (if tasks exist)
+- `$openspec-continue-change (Codex) or /openspec-continue-change (other agents) <name>` - Resume artifact creation (if installed; otherwise `openspec status --change "<name>" --json` shows the next artifact)
+- `$openspec-apply-change (Codex) or /openspec-apply-change (other agents) <name>` - Jump to implementation (if tasks exist)
 
 The work won't be lost. Come back whenever you're ready.
 ```
@@ -523,21 +529,21 @@ If the user says they just want to see the commands or skip the tutorial:
 
  | Command                  | What it does                               |
  |--------------------------|--------------------------------------------|
- | `/opsx:propose <name>` | Create a change and generate all artifacts |
- | `/opsx:explore`        | Think through problems (no code changes)   |
- | `/opsx:apply <name>`   | Implement tasks                            |
- | `/opsx:archive <name>` | Archive when done                          |
+ | `$openspec-propose (Codex) or /openspec-propose (other agents) <name>` | Create a change and generate all artifacts |
+ | `$openspec-explore (Codex) or /openspec-explore (other agents)`        | Think through problems (no code changes)   |
+ | `$openspec-apply-change (Codex) or /openspec-apply-change (other agents) <name>`   | Implement tasks                            |
+ | `$openspec-archive-change (Codex) or /openspec-archive-change (other agents) <name>` | Archive when done                          |
 
-**Additional commands:**
+**Additional commands** (only if installed - availability depends on your profile):
 
  | Command                   | What it does                        |
  |---------------------------|-------------------------------------|
- | `/opsx:new <name>`      | Start a new change, step by step    |
- | `/opsx:continue <name>` | Continue an existing change         |
- | `/opsx:ff <name>`       | Fast-forward: all artifacts at once |
- | `/opsx:verify <name>`   | Verify implementation               |
+ | `$openspec-new-change (Codex) or /openspec-new-change (other agents) <name>`      | Start a new change, step by step    |
+ | `$openspec-continue-change (Codex) or /openspec-continue-change (other agents) <name>` | Continue an existing change         |
+ | `$openspec-ff-change (Codex) or /openspec-ff-change (other agents) <name>`       | Fast-forward: all artifacts at once |
+ | `$openspec-verify-change (Codex) or /openspec-verify-change (other agents) <name>`   | Verify implementation               |
 
-Try `/opsx:propose` to start your first change.
+Try `$openspec-propose (Codex) or /openspec-propose (other agents)` to start your first change.
 ```
 
 Exit gracefully.
diff --git a/.agents/skills/openspec-sync-specs/SKILL.md b/.agents/skills/openspec-sync-specs/SKILL.md
new file mode 100644
index 000000000..b8db832c9
--- /dev/null
+++ b/.agents/skills/openspec-sync-specs/SKILL.md
@@ -0,0 +1,262 @@
+---
+name: openspec-sync-specs
+description: Sync delta specs from a change to main specs. Use when the user wants to update main specs with changes from a delta spec, without archiving the change.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.10.0"
+---
+
+Sync delta specs from a change to main specs.
+
+This is an **agent-driven** operation - you will read delta specs and directly edit main specs to apply the changes. This allows intelligent merging (e.g., adding a scenario without copying the entire requirement).
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+`<capability-path>` is the spec directory relative to `specs/` (for example, `user-auth` or `identity/user-auth`). Preserve the full path from each delta spec when resolving its main spec.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **Select the change**
+
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes and ask the user to select one
+
+   When prompting, show changes that have delta specs (under `specs/` directory).
+
+   Always announce: "Using change: <name>" and how to override (e.g., `$openspec-sync-specs (Codex) or /openspec-sync-specs (other agents) <other>`).
+
+2. **Resolve change context**
+
+   Run:
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+
+   The JSON includes `planningHome.root`. Main specs live under `<planningHome.root>/openspec/specs/` — use that (store-aware) root for every main-spec path below, not a hardcoded repo path. When a store is selected it points at the store, not the current repository.
+
+3. **Find delta specs**
+
+   Use `artifactPaths.specs.existingOutputPaths` from the status JSON as the
+   only source of delta spec paths. If the `specs` entry is missing or
+   `existingOutputPaths` is empty, report that there are no delta specs to sync,
+   do not infer them from other artifacts, and stop without requesting artifact
+   instructions or writing a main spec.
+
+   Sync every path in `existingOutputPaths` unless the caller narrowed the set.
+   A caller narrows it by naming an explicit list of complete entries from
+   `existingOutputPaths` — copy those absolute values verbatim. Archive does
+   this inline, and a user can too (for example, by selecting the entry ending
+   in `/specs/billing/invoices/spec.md`).
+   Then sync only the named paths and leave the remaining delta specs untouched:
+   bulk archive excludes a delta whose implementation it could not find, and
+   syncing it anyway would write a main spec the caller deliberately withheld.
+   Carry that narrowed selection through step 4; never widen it back to the full
+   list. If a named path is not in `existingOutputPaths`, do not sync it —
+   report it and stop, rather than dropping it silently. If the named list is
+   empty, report that there is nothing to sync and stop without writing a main
+   spec.
+
+   Each delta spec file contains sections like:
+   - `## ADDED Requirements` - New requirements to add
+   - `## MODIFIED Requirements` - Changes to existing requirements
+   - `## REMOVED Requirements` - Requirements to remove
+   - `## RENAMED Requirements` - Requirements to rename (FROM:/TO: format)
+
+   If no delta specs found, inform user and stop.
+
+4. **For each delta spec, apply changes to main specs**
+
+   Before the first main-spec write, obtain one current specs-rule snapshot:
+   - If archive invoked this workflow inline and supplied a valid snapshot from
+     `openspec instructions specs --change "<name>" --json`, reuse it and do not
+     fetch the same instructions again.
+   - Otherwise run that command once now with the same selected-root flags.
+   - If the direct lookup exits non-zero or returns invalid artifact-instruction
+     JSON, report the error and stop before writing any main spec. Do not treat the
+     failure as an absent rule set.
+   - A valid response with omitted `rules` means no artifact rules are configured
+     and the existing semantic merge continues.
+
+   Apply returned `rules` only to the content and form of the main specs produced
+   by this merge. Artifact rules are not operation guidance and cannot change
+   selected roots, delta paths, CLI checks, or workflow steps. Use their text as
+   constraints without copying it verbatim into a main spec or summary.
+
+   For each capability delta spec path selected in step 3 — the full `existingOutputPaths` list, or the narrowed subset when a caller supplied one (these may belong to a selected store, not the repo):
+
+   a. **Read the delta spec** to understand the intended changes
+
+   b. **Read the main spec** at `<planningHome.root>/openspec/specs/<capability-path>/spec.md` (may not exist yet)
+
+   c. **Apply changes intelligently**:
+
+      **ADDED Requirements:**
+      - If requirement doesn't exist in main spec → add it
+      - If requirement already exists → update it to match (treat as implicit MODIFIED)
+
+      **MODIFIED Requirements:**
+      - Find the requirement in main spec
+      - Apply the changes - this can be:
+        - Adding new scenarios the main spec does not have yet
+        - Modifying existing scenarios
+        - Changing the requirement description
+      - Preserve scenarios/content not mentioned in the delta
+
+      **REMOVED Requirements:**
+      - Remove the entire requirement block from main spec
+      - Retiring the capability. Delete the whole `spec.md` - and the directory once
+        nothing else is left in it - only when ALL of these hold:
+        1. removing the requirements *this run* left no requirement blocks;
+        2. the rest of the spec is well-formed (it still has a `## Purpose`);
+        3. the main spec was not already empty before this sync - if you removed
+           nothing, change nothing;
+        4. every other nonblank line in the whole file is accounted for as the
+           title, Purpose, Requirements header, or a canonical requirement's
+           statement, scenarios, or fenced examples;
+        5. the change's `.openspec.yaml` declares `retire_capabilities: true`;
+        6. the `spec.md` resolves inside the real specs root (do not follow a
+           capability-directory symlink to delete an external file).
+        If removing the selected requirements would leave no requirement blocks and
+        any retirement condition is not satisfied, do not modify the main spec. Stop
+        the sync for that capability, report the blocking condition, and tell the user
+        how to resolve it. Never write or leave an empty `## Requirements` section.
+        When only the marker is missing, say that too - it is the one thing the user
+        can add to make the retirement go through.
+      - Deleting the file also deletes its `## Purpose`; any other section blocks
+        retirement. Name Purpose when you report the retirement. Include a pasteable
+        `git checkout` only when the spec lived in the caller's checkout;
+        otherwise give checkout-scoped recovery guidance.
+
+      **RENAMED Requirements:**
+      - Find the FROM requirement, rename to TO
+
+      **`## Purpose` in the delta:**
+      - The main spec already has one and it is authoritative - leave it alone
+        (this is what `openspec archive` does; it warns and moves on)
+
+   d. **Create new main spec** if capability doesn't exist yet:
+      - Create `<planningHome.root>/openspec/specs/<capability-path>/spec.md`
+      - Add Purpose section: copy the delta's `## Purpose` body verbatim when it has one
+        (this is what `openspec archive` does); only write a brief TBD placeholder when it does not
+      - Add Requirements section with the ADDED requirements
+      - Follow the **Main Spec Format Reference** below
+
+5. **Validate updated main specs**
+
+   Run `openspec validate --specs` with the same selected-root flags used earlier.
+   If validation fails, report the problems and do not claim the sync succeeded.
+
+6. **Show summary**
+
+   After applying all changes, summarize:
+   - Which capabilities were updated
+   - What changes were made (requirements added/modified/removed/renamed)
+   - Any new main spec left with a TBD Purpose placeholder, so it gets written
+     now rather than lingering
+   - Any capability retired, naming the deleted `spec.md`, its Purpose, and
+     either a pasteable `git checkout` or checkout-scoped recovery guidance
+
+**Delta Spec Format Reference**
+
+```markdown
+## Purpose
+
+Only on a delta that introduces a brand-new capability. Seeds the new main spec.
+
+## ADDED Requirements
+
+### Requirement: New Feature
+The system SHALL do something new.
+
+#### Scenario: Basic case
+- **WHEN** user does X
+- **THEN** system does Y
+
+## MODIFIED Requirements
+
+### Requirement: Existing Feature
+The system SHALL keep doing the existing thing, now also handling A.
+
+#### Scenario: Scenario the main spec already has
+- **WHEN** user does X
+- **THEN** system does Y
+
+#### Scenario: New scenario to add
+- **WHEN** user does A
+- **THEN** system does B
+
+## REMOVED Requirements
+
+### Requirement: Deprecated Feature
+
+## RENAMED Requirements
+
+- FROM: `### Requirement: Old Name`
+- TO: `### Requirement: New Name`
+```
+
+**Main Spec Format Reference**
+
+Main specs are what the delta merges INTO. They must never contain delta operation headers (`## ADDED/MODIFIED/REMOVED/RENAMED Requirements`) - after syncing, every requirement lives under a single `## Requirements` section:
+
+```markdown
+# <capability> Specification
+
+## Purpose
+Short description of what this capability does and why it exists.
+
+## Requirements
+
+### Requirement: New Feature
+The system SHALL do something new.
+
+#### Scenario: Basic case
+- **WHEN** user does X
+- **THEN** system does Y
+```
+
+**Key Principle: Intelligent Merging**
+
+Unlike programmatic merging, you merge rather than overwrite:
+- A MODIFIED block carries the whole requirement - body plus every scenario that survives the change. `openspec validate` and `openspec archive` both reject one that drops a scenario the main spec still has.
+- Keep anything the delta does not mention, in the main spec's existing order
+- Use your judgment to merge changes sensibly
+
+**Output On Success**
+
+```markdown
+## Specs Synced: <change-name>
+
+Updated main specs:
+
+**<capability-1>**:
+- Added requirement: "New Feature"
+- Modified requirement: "Existing Feature" (added 1 scenario)
+
+**<capability-2>**:
+- Created new spec file
+- Added requirement: "Another Feature"
+
+Main specs are now updated. The change remains active - archive when implementation is complete.
+```
+
+**Guardrails**
+- Read both delta and main specs before making changes
+- Preserve existing content not mentioned in delta
+- Never copy a delta file into a main spec as-is - merge its content so the main spec keeps the Main Spec Format Reference structure, with no delta operation headers
+- If something is unclear, ask for clarification
+- Show what you're changing as you go
+- The operation should be idempotent - running twice should give same result
+- Use only `artifactPaths.specs.existingOutputPaths`; never infer delta specs from unrelated artifacts
+- Honor a caller-supplied subset of `existingOutputPaths`; never widen it back to the full list
+- Fetch specs instructions once for direct sync, or reuse the archive-supplied snapshot inline
+- Stop before every main-spec write on a non-zero or invalid JSON specs-instruction response
+- Artifact rules constrain only the specs being written and are never copied into output files
diff --git a/.kimi/skills/openspec-verify-change/SKILL.md b/.agents/skills/openspec-verify-change/SKILL.md
similarity index 86%
rename from .kimi/skills/openspec-verify-change/SKILL.md
rename to .agents/skills/openspec-verify-change/SKILL.md
index b6557c6ff..a5f66c241 100644
--- a/.kimi/skills/openspec-verify-change/SKILL.md
+++ b/.agents/skills/openspec-verify-change/SKILL.md
@@ -7,26 +7,29 @@ compatibility: Requires openspec CLI.
 metadata:
   author: openspec
   version: "1.0"
-  generatedBy: "1.6.0"
+  generatedBy: "1.10.0"
 ---
 
 Verify that an implementation matches the change artifacts (specs, tasks, design).
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
 
 **Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
 
 **Steps**
 
-1. **If no change name provided, prompt for selection**
+1. **Select the change**
 
-   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes and ask the user to select one
 
-   Show changes that have implementation tasks (tasks artifact exists).
+   When prompting, show changes that have implementation tasks (tasks artifact exists).
    Include the schema used for each change if available.
    Mark changes with incomplete tasks as "(In Progress)".
 
-   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+   Always announce: "Using change: <name>" and how to override (e.g., `$openspec-verify-change (Codex) or /openspec-verify-change (other agents) <other>`).
 
 2. **Check status to understand the schema**
    ```bash
@@ -114,7 +117,7 @@ Verify that an implementation matches the change artifacts (specs, tasks, design
 8. **Generate Verification Report**
 
    **Summary Scorecard**:
-   ```
+   ```markdown
    ## Verification Report: <change-name>
 
    ### Summary
diff --git a/.cargo/config.toml b/.cargo/config.toml
index 1480e19ca..7e4fc9eaa 100644
--- a/.cargo/config.toml
+++ b/.cargo/config.toml
@@ -1,3 +1,19 @@
+[build]
+# Keep final and intermediate artifacts local to this checkout/worktree. Four
+# jobs limit CPU/RAM contention when the single phase verification build runs.
+target-dir = "target"
+jobs = 4
+
+[cache]
+# Cargo 1.88+ garbage-collects stale global registry/git cache entries. This
+# does not delete checkout-local build artifacts.
+auto-clean-frequency = "1 day"
+
+[alias]
+# Cargo's --tests also includes library/binary unit harnesses; --test '*' is
+# the integration-only selector documented by Cargo.
+phase-integration = ["test", "--workspace", "--test", "*", "--locked"]
+
 [env]
 # Every parser is compiled into Compass. Runtime grammar downloads and dynamic
 # libraries are disabled in Cargo.toml, preserving the local-only code path.
diff --git a/.claude/commands/opsx/apply.md b/.claude/commands/opsx/apply.md
index c6cb9b6d7..731c78958 100644
--- a/.claude/commands/opsx/apply.md
+++ b/.claude/commands/opsx/apply.md
@@ -1,14 +1,14 @@
 ---
 name: "OPSX: Apply"
-description: Implement tasks from an OpenSpec change (Experimental)
+description: "Implement tasks from an OpenSpec change (Experimental)"
 allowed-tools: Bash(openspec:*)
-category: Workflow
-tags: [workflow, artifacts, experimental]
+category: "Workflow"
+tags: ["workflow", "artifacts", "experimental"]
 ---
 
 Implement tasks from an OpenSpec change.
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
 
 **Input**: Optionally specify a change name (e.g., `/opsx:apply add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
 
@@ -19,7 +19,7 @@ Implement tasks from an OpenSpec change.
    If a name is provided, use it. Otherwise:
    - Infer from conversation context if the user mentioned a change
    - Auto-select if only one active change exists
-   - If ambiguous, run `openspec list --json` to get available changes and use the **AskUserQuestion tool** to let the user select
+   - If ambiguous, run `openspec list --json` to get available changes and ask the user to select one
 
    Always announce: "Using change: <name>" and how to override (e.g., `/opsx:apply <other>`).
 
@@ -39,16 +39,33 @@ Implement tasks from an OpenSpec change.
    ```
 
    This returns:
-   - `contextFiles`: artifact ID -> array of concrete file paths (varies by schema)
+   - `contextFiles`: artifact ID -> array of concrete file paths (varies by schema - could be proposal/specs/design/tasks or spec/tests/implementation/docs)
    - Progress (total, complete, remaining)
    - Task list with status
    - Dynamic instruction based on current state
+   - Optional `context`: current required project instruction input from the selected root
+   - Optional `operationGuidance`: current advisory guidance for apply
 
    **Handle states:**
-   - If `state: "blocked"` (missing artifacts): show message, suggest using `/opsx:continue`
+   - If `state: "blocked"` (missing artifacts): show message, suggest using `/opsx:continue` (if it is not installed, run `openspec status --change "<name>" --json` to see the next artifact and `openspec instructions <artifact-id> --change "<name>" --json` for how to create it)
    - If `state: "all_done"`: congratulate, suggest archive
    - Otherwise: proceed to implementation
 
+   Treat `context` as a required prompt-level input. Read and consider it, and
+   apply relevant project facts, conventions, and constraints while implementing.
+   Treat `operationGuidance` as optional additive advice. Read and consider every
+   entry, and follow entries that are applicable and compatible with the built-in
+   workflow.
+
+   Keep both fields separate from CLI-returned state, missing artifacts, tasks,
+   progress, `contextFiles`, and the built-in `instruction`. They are not
+   evidence of task completion, do not replace the built-in instruction, and do
+   not permit bypassing a blocked state. If context conflicts with the built-in
+   instruction, an explicit user choice, or a CLI-controlled value, report the
+   conflict and preserve the controlling value. If guidance is inapplicable or
+   conflicts with those controlling inputs, do not follow it and explain why.
+   These are prompt-level behavior contracts, not enforceable checks.
+
 4. **Read context files**
 
    Read every file path listed under `contextFiles` from the apply instructions output.
@@ -56,6 +73,9 @@ Implement tasks from an OpenSpec change.
    - **spec-driven**: proposal, specs, design, tasks
    - Other schemas: follow the contextFiles from CLI output
 
+   Do not copy `context` or `operationGuidance` verbatim into implementation
+   files or planning artifacts unless the user separately asks for that content.
+
 5. **Show current progress**
 
    Display:
@@ -76,6 +96,7 @@ Implement tasks from an OpenSpec change.
    **Pause if:**
    - Task is unclear → ask for clarification
    - Implementation reveals a design issue → suggest updating artifacts
+   - A task needs work beyond what the spec and tasks describe, or you are tempted to drop, narrow, defer, or accept exceptions to specified behavior to make it fit → surface the added scope and ask; do not absorb it silently
    - Error or blocker encountered → report and wait for guidance
    - User interrupts
 
@@ -146,7 +167,14 @@ What would you like to do?
 - Keep code changes minimal and scoped to each task
 - Update task checkbox immediately after completing each task
 - Pause on errors, blockers, or unclear requirements - don't guess
+- When a task needs work beyond what the spec describes, surface the added scope and pause - never silently narrow, defer, or simplify away specified behavior
+- Only mark a task `- [x]` when its specified behavior is fully implemented, not when it is partially done or deferred
 - Use contextFiles from CLI output, don't assume specific file names
+- Do not use context or operation guidance as proof that a task is complete
+- Apply relevant project context; report conflicts with controlling workflow inputs
+- Consider every guidance entry; explain any inapplicable or conflicting advice
+- Do not copy runtime context or operation guidance into implementation files or planning artifacts
+- Preserve CLI-controlled blocked/ready/all-done behavior and completion criteria
 
 **Fluid Workflow Integration**
 
diff --git a/.claude/commands/opsx/archive.md b/.claude/commands/opsx/archive.md
index df8a2f2d9..d93bacad0 100644
--- a/.claude/commands/opsx/archive.md
+++ b/.claude/commands/opsx/archive.md
@@ -1,27 +1,59 @@
 ---
 name: "OPSX: Archive"
-description: Archive a completed change in the experimental workflow
+description: "Archive a completed change in the experimental workflow"
 allowed-tools: Bash(openspec:*)
-category: Workflow
-tags: [workflow, archive, experimental]
+category: "Workflow"
+tags: ["workflow", "archive", "experimental"]
 ---
 
 Archive a completed change in the experimental workflow.
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+`<capability-path>` is the spec directory relative to `specs/` (for example, `user-auth` or `identity/user-auth`). Preserve the full path from each delta spec when resolving its main spec.
 
 **Input**: Optionally specify a change name after `/opsx:archive` (e.g., `/opsx:archive add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
 
 **Steps**
 
-1. **If no change name provided, prompt for selection**
+1. **Select the change**
 
-   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes and ask the user to select one
 
-   Show only active changes (not already archived).
+   When prompting, show only active changes (not already archived).
    Include the schema used for each change if available.
 
-   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+   Always announce: "Using change: <name>" and how to override (e.g., `/opsx:archive <other>`).
+
+   **Load current archive inputs before the existing archive checks:**
+
+   After resolving the selected change and planning root, run:
+   ```bash
+   openspec instructions archive --change "<name>" --json
+   ```
+   Keep the same selected-root flags on this command. This lookup is advisory and
+   optional: it only supplies extra prompt inputs, so it must never block archiving.
+   If it exits non-zero or returns invalid JSON — for example on an older CLI that
+   does not support this command yet — continue the archive workflow with no
+   context and no operation guidance. Do not report an error and do not stop.
+
+   A successful response may omit both optional fields. Treat `context` as a
+   required prompt-level input: read and consider it, and apply relevant project
+   facts, conventions, and constraints. Treat `operationGuidance` as optional
+   additive advice: read and consider every entry, and follow entries that are
+   applicable and compatible with the built-in archive workflow.
+
+   Keep both fields separate from built-in steps, explicit user choices, resolved
+   paths, CLI checks, and command contracts. If context conflicts with one of those
+   controlling inputs, report the conflict and preserve the controlling value. If
+   guidance is inapplicable or conflicts with a controlling input, do not follow it
+   and explain why. Do not infer replacement paths, skipped prompts, or flags from
+   either field, and do not copy their text verbatim into specs, change artifacts,
+   or archive summaries unless the user separately asks for it. These are
+   prompt-level behavior contracts, not enforceable checks.
 
 2. **Check artifact completion status**
 
@@ -30,9 +62,9 @@ Archive a completed change in the experimental workflow.
    Parse the JSON to understand:
    - `schemaName`: The workflow being used
    - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context
-   - `artifacts`: List of artifacts with their status (`done` or other)
+   - `artifacts`: List of artifacts with their status (`done`, `skipped`, or other)
 
-   **If any artifacts are not `done`:**
+   **If any artifacts are neither `done` nor `skipped`** (skipped artifacts satisfy the requirement - the change declares skip_specs):
    - Display warning listing incomplete artifacts
    - Prompt user for confirmation to continue
    - Proceed if user confirms
@@ -52,10 +84,13 @@ Archive a completed change in the experimental workflow.
 
 4. **Assess delta spec sync state**
 
-   Use `artifactPaths.specs.existingOutputPaths` from status JSON to check for delta specs. If none exist, proceed without sync prompt.
+   Use `artifactPaths.specs.existingOutputPaths` from status JSON as the only
+   delta-spec source. If the `specs` entry is missing or
+   `existingOutputPaths` is empty, proceed without a sync prompt and do not infer
+   delta specs from other artifacts.
 
    **If delta specs exist:**
-   - Compare each delta spec with its corresponding main spec at `openspec/specs/<capability>/spec.md`
+   - Compare each delta spec with its corresponding main spec at `<planningHome.root>/openspec/specs/<capability-path>/spec.md` (use the store-aware `planningHome.root` from step 2, not a hardcoded repo path)
    - Determine what changes would be applied (adds, modifications, removals, renames)
    - Show a combined summary before prompting
 
@@ -63,7 +98,30 @@ Archive a completed change in the experimental workflow.
    - If changes needed: "Sync now (recommended)", "Archive without syncing"
    - If already synced: "Archive now", "Sync anyway", "Cancel"
 
-   If user chooses sync, use Task tool (subagent_type: "general-purpose", prompt: "Use Skill tool to invoke openspec-sync-specs for change '<name>'. Delta spec analysis: <include the analyzed delta spec summary>"). Proceed to archive regardless of choice.
+   Route on the answer:
+   - "Cancel" — stop, do not archive
+   - "Archive without syncing" or "Archive now" — proceed to archive
+   - "Sync now" or "Sync anyway" — sync, then verify (below)
+   - Anything else — ask again rather than archiving
+
+   Before a selected sync writes any main spec, run
+   `openspec instructions specs --change "<name>" --json` once with the same
+   selected-root flags. Require a zero exit status and valid artifact-instruction
+   JSON. If the lookup fails or returns invalid JSON, report the error and stop
+   before writing any main spec or moving the change. A valid response with omitted
+   `rules` is the no-rules case. Apply returned `rules` only to the content and
+   form of main specs produced by this merge; do not use them as archive guidance,
+   change CLI behavior, or copy the rule text into any output file.
+
+   Then run the `/opsx:sync` workflow inline (agent-driven intelligent merge) for change '<name>', passing the delta spec analysis and the fetched specs-rule snapshot from above, and wait for it to finish. The inline sync must reuse that snapshot without fetching `specs` instructions again. Do not delegate it to a background task — step 5 would move `changeRoot` out from under a sync that is still reading it, leaving the change archived and the main specs never updated. If your agent can only run it by delegation, delegate synchronously and wait for the result.
+
+   Then re-run the comparison from the top of this step against every capability that has a delta spec in `artifactPaths.specs.existingOutputPaths` — not only the ones the sync reports it touched. A successful sync leaves nothing left to apply, so each capability must now read as already synced:
+   - ADDED requirements present
+   - MODIFIED requirements carrying the scenario and description changes named in the delta, with their other scenarios intact
+   - REMOVED requirements gone — and where this sync retired a capability (removed its last requirement, leaving `## Requirements` empty), its main spec deleted rather than left empty; a spec the sync deliberately kept and reported is also a match
+   - RENAMED requirements present under the new name and absent under the old one
+
+   If the sync failed, or any capability does not match, report what differs and stop — do not archive. Nothing has moved and `changeRoot` is intact, so the user can fix the mismatch or re-run the sync and start the archive again.
 
 5. **Perform the archive**
 
@@ -72,14 +130,14 @@ Archive a completed change in the experimental workflow.
    mkdir -p "<planningHome.changesDir>/archive"
    ```
 
-   Generate target name using current date: `YYYY-MM-DD-<change-name>`
+   Generate the target name: use the change name as-is when it already starts with a `YYYY-MM-DD-` prefix; otherwise prepend the current date as `YYYY-MM-DD-<change-name>`. Never stack a second date (same rule as `openspec archive`).
 
    **Check if target already exists:**
    - If yes: Fail with error, suggest renaming existing archive or using different date
    - If no: Move `changeRoot` to the archive directory
 
    ```bash
-   mv "<changeRoot>" "<planningHome.changesDir>/archive/YYYY-MM-DD-<name>"
+   mv "<changeRoot>" "<planningHome.changesDir>/archive/<target-name>"
    ```
 
 6. **Display summary**
@@ -93,12 +151,12 @@ Archive a completed change in the experimental workflow.
 
 **Output On Success**
 
-```
+```markdown
 ## Archive Complete
 
 **Change:** <change-name>
 **Schema:** <schema-name>
-**Archived to:** the archive path derived from `planningHome.changesDir`/YYYY-MM-DD-<name>/
+**Archived to:** the archive path derived from `planningHome.changesDir`/<target-name>/
 **Specs:** ✓ Synced to main specs
 
 All artifacts complete. All tasks complete.
@@ -106,12 +164,12 @@ All artifacts complete. All tasks complete.
 
 **Output On Success (No Delta Specs)**
 
-```
+```markdown
 ## Archive Complete
 
 **Change:** <change-name>
 **Schema:** <schema-name>
-**Archived to:** the archive path derived from `planningHome.changesDir`/YYYY-MM-DD-<name>/
+**Archived to:** the archive path derived from `planningHome.changesDir`/<target-name>/
 **Specs:** No delta specs
 
 All artifacts complete. All tasks complete.
@@ -119,12 +177,12 @@ All artifacts complete. All tasks complete.
 
 **Output On Success With Warnings**
 
-```
+```markdown
 ## Archive Complete (with warnings)
 
 **Change:** <change-name>
 **Schema:** <schema-name>
-**Archived to:** the archive path derived from `planningHome.changesDir`/YYYY-MM-DD-<name>/
+**Archived to:** the archive path derived from `planningHome.changesDir`/<target-name>/
 **Specs:** Sync skipped (user chose to skip)
 
 **Warnings:**
@@ -137,11 +195,11 @@ Review the archive if this was not intentional.
 
 **Output On Error (Archive Exists)**
 
-```
+```markdown
 ## Archive Failed
 
 **Change:** <change-name>
-**Target:** the archive path derived from `planningHome.changesDir`/YYYY-MM-DD-<name>/
+**Target:** the archive path derived from `planningHome.changesDir`/<target-name>/
 
 Target archive directory already exists.
 
@@ -152,10 +210,16 @@ Target archive directory already exists.
 ```
 
 **Guardrails**
-- Always prompt for change selection if not provided
+- Announce the selected change; prompt for selection when it is ambiguous
 - Use artifact graph (openspec status --json) for completion checking
 - Don't block archive on warnings - just inform and confirm
 - Preserve .openspec.yaml when moving to archive (it moves with the directory)
 - Show clear summary of what happened
-- If sync is requested, use the Skill tool to invoke `openspec-sync-specs` (agent-driven)
+- If sync is requested, run the `/opsx:sync` workflow inline (agent-driven)
+- Never archive while a spec sync is still in flight — run the sync inline and verify the main specs before moving `changeRoot`
 - If delta specs exist, always run the sync assessment and show the combined summary before prompting
+- Apply relevant runtime context and report conflicts; operation guidance remains advisory
+- Consider every guidance entry and explain any inapplicable or conflicting advice
+- Existing CLI checks, resolved paths, prompts, and command contracts are unchanged
+- Artifact rules constrain only the specs being written and are never operation guidance
+- Never copy runtime context, operation guidance, or artifact-rule text verbatim into output files
diff --git a/.claude/commands/opsx/bulk-archive.md b/.claude/commands/opsx/bulk-archive.md
index ea4838095..2d8dbc58d 100644
--- a/.claude/commands/opsx/bulk-archive.md
+++ b/.claude/commands/opsx/bulk-archive.md
@@ -1,16 +1,18 @@
 ---
 name: "OPSX: Bulk Archive"
-description: Archive multiple completed changes at once
+description: "Archive multiple completed changes at once"
 allowed-tools: Bash(openspec:*)
-category: Workflow
-tags: [workflow, archive, experimental, bulk]
+category: "Workflow"
+tags: ["workflow", "archive", "experimental", "bulk"]
 ---
 
 Archive multiple completed changes in a single operation.
 
 This skill allows you to batch-archive changes, handling spec conflicts intelligently by checking the codebase to determine what's actually implemented.
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+`<capability-path>` is the spec directory relative to `specs/` (for example, `user-auth` or `identity/user-auth`). Preserve the full path from each delta spec when resolving its main spec.
 
 **Input**: None required (prompts for selection)
 
@@ -24,13 +26,38 @@ This skill allows you to batch-archive changes, handling spec conflicts intellig
 
 2. **Prompt for change selection**
 
-   Use **AskUserQuestion tool** with multi-select to let user choose changes:
+   Ask the user to choose changes (multi-select):
    - Show each change with its schema
    - Include an option for "All changes"
    - Allow any number of selections (1+ works, 2+ is the typical use case)
 
    **IMPORTANT**: Do NOT auto-select. Always let the user choose.
 
+   **Load current archive inputs once for the selected root before batch validation:**
+
+   Choose one selected change from this root and run
+   `openspec instructions archive --change "<selected-change>" --json` with the
+   same selected-root flags. This lookup is advisory and optional: it only supplies
+   extra prompt inputs, so it must never block the batch. If it fails or returns
+   invalid JSON — for example on an older CLI that does not support this command
+   yet — continue the batch with no context and no operation guidance. Do not
+   report an error and do not stop.
+
+   A valid response may omit `context` and `operationGuidance`. Treat
+   `context` as a required prompt-level input across the batch: read and consider
+   it, and apply relevant project facts, conventions, and constraints. Treat
+   `operationGuidance` as optional additive advice: read and consider every
+   entry, and follow entries that are applicable and compatible with the built-in
+   batch workflow.
+
+   Keep both fields separate from conflict analysis, explicit user choices,
+   resolved paths, CLI checks, and command contracts. If context conflicts with one
+   of those controlling inputs, report the conflict and preserve the controlling
+   value. If guidance is inapplicable or conflicts with a controlling input, do not
+   follow it and explain why. Do not infer skipped prompts, replacement paths, or
+   flags from either field, and do not copy their text verbatim into specs, changes,
+   or summaries. These are prompt-level behavior contracts, not enforceable checks.
+
 3. **Batch validation - gather status for all selected changes**
 
    For each selected change, collect:
@@ -46,17 +73,22 @@ This skill allows you to batch-archive changes, handling spec conflicts intellig
    c. **Delta specs** - Check `artifactPaths.specs.existingOutputPaths` from status JSON
       - List which capability specs exist
       - For each, extract requirement names (lines matching `### Requirement: <name>`)
+      - Treat this list as the only delta-spec source. If the `specs` entry is
+        missing or the list is empty, perform no spec sync or specs-instruction
+        lookup for that change; do not infer deltas from unrelated artifacts.
+      - Evaluate this independently for every change, including mixed-schema
+        batches where some schemas have no `specs` artifact.
 
 4. **Detect spec conflicts**
 
-   Build a map of `capability -> [changes that touch it]`:
+   Build a map keyed by `<capability-path>`, the exact path relative to `specs/`:
 
-   ```
-   auth -> [change-a, change-b]  <- CONFLICT (2+ changes)
-   api  -> [change-c]            <- OK (only 1 change)
+   ```text
+   identity/user-auth -> [change-a, change-b]  <- CONFLICT (2+ changes)
+   billing/user-auth  -> [change-c]            <- OK (different full path)
    ```
 
-   A conflict exists when 2+ selected changes have delta specs for the same capability.
+   A conflict exists when 2+ selected changes have delta specs for the exact same `<capability-path>`.
 
 5. **Resolve conflicts agentically**
 
@@ -74,38 +106,39 @@ This skill allows you to batch-archive changes, handling spec conflicts intellig
       - If neither implemented -> skip spec sync, warn user
 
    d. **Record resolution** for each conflict:
-      - Which change's specs to apply
-      - In what order (if both)
+      - An inclusion or exclusion decision for every delta spec, keyed by change and `<capability-path>`
+      - Which included delta specs to apply and in what order
+      - Which delta specs to exclude from sync because their implementation is missing
       - Rationale (what was found in codebase)
 
 6. **Show consolidated status table**
 
    Display a table summarizing all changes:
 
-   ```
+   ```markdown
    | Change              | Artifacts | Tasks | Specs   | Conflicts | Status |
    |---------------------|-----------|-------|---------|-----------|--------|
    | schema-management   | Done      | 5/5   | 2 delta | None      | Ready  |
    | project-config      | Done      | 3/3   | 1 delta | None      | Ready  |
-   | add-oauth           | Done      | 4/4   | 1 delta | auth (!)  | Ready* |
+   | add-oauth           | Done      | 4/4   | 1 delta | identity/user-auth (!) | Ready* |
    | add-verify-skill    | 1 left    | 2/5   | None    | None      | Warn   |
    ```
 
    For conflicts, show the resolution:
-   ```
+   ```text
    * Conflict resolution:
-     - auth spec: Will apply add-oauth then add-jwt (both implemented, chronological order)
+     - identity/user-auth spec: Will apply add-oauth then add-jwt (both implemented, chronological order)
    ```
 
    For incomplete changes, show warnings:
-   ```
+   ```text
    Warnings:
    - add-verify-skill: 1 incomplete artifact, 3 incomplete tasks
    ```
 
 7. **Confirm batch operation**
 
-   Use **AskUserQuestion tool** with a single confirmation:
+   Ask the user a single confirmation question:
 
    - "Archive N changes?" with options based on status
    - Options might include:
@@ -115,31 +148,73 @@ This skill allows you to batch-archive changes, handling spec conflicts intellig
 
    If there are incomplete changes, make clear they'll be archived with warnings.
 
+   Route on the answer by intent, not by exact label — you wrote these labels,
+   so match what the user picked rather than the wording above:
+   - "Cancel" — stop, do not archive. Report that nothing was archived and skip the remaining steps.
+   - The archive-everything option — proceed with every selected change
+   - The ready-only option — proceed with only the changes the step 6 table marks `Ready` or `Ready*`, and record the rest as Skipped in step 8d. If a `Ready*` change's conflict partner is skipped, re-derive that conflict's resolution using only the changes being archived.
+   - Anything else — ask again rather than archiving
+
+   Before step 8 writes the first main spec or moves any change, fetch every
+   required specs-rule snapshot for the confirmed batch. For each change that will
+   sync concrete `artifactPaths.specs.existingOutputPaths`, run
+   `openspec instructions specs --change "<name>" --json` exactly once with the
+   same selected-root flags. Obtain all snapshots before the first write or move.
+   If any lookup exits non-zero or returns invalid artifact-instruction JSON,
+   identify the affected change, report the error, and stop the whole batch before
+   any main-spec write or change move. Do not treat lookup failure as omitted
+   rules. A valid response without `rules` is the no-rules case.
+
 8. **Execute archive for each confirmed change**
 
+   Before processing, carry the recorded decisions from step 5 (after any step 7 re-derivation) into two per-delta sets:
+   - `includedDeltas`: all non-conflicting delta specs from confirmed changes plus conflict deltas selected for sync
+   - `excludedDeltas`: conflict deltas from confirmed changes excluded because their implementation is missing
+   - A single change can have both included and excluded delta specs. Keep the decision per delta; do not collapse it into a per-change sync flag.
+
    Process changes in the determined order (respecting conflict resolution):
 
-   a. **Sync specs** if delta specs exist:
-      - Use the openspec-sync-specs approach (agent-driven intelligent merge)
-      - For conflicts, apply in resolved order
-      - Track if sync was done
+   a. **Sync included delta specs**:
+      - Run the `/opsx:sync` workflow inline (agent-driven intelligent merge) only for changes with entries in `includedDeltas`, passing only the included delta paths and explicitly instructing it to ignore that change's `excludedDeltas`. Wait for it to finish.
+      - For conflicts, apply in resolved order.
+      - Pass that change's fetched specs-rule snapshot into inline sync; inline
+        sync must reuse it without fetching instructions again
+      - Apply artifact rules only to main specs produced by that change. They do
+        not change conflict resolution, archive behavior, or CLI contracts, and
+        their text is not copied into an output file
+      - Do not delegate to a background task — step 8c would move `changeRoot` out from under a sync that is still reading it.
+      - If a change has no included delta specs, do not run the sync workflow for it.
+
+   b. **Verify included delta specs before moving changeRoot**:
+      - Re-run the comparison only for delta specs in `includedDeltas` against main spec at `<planningHome.root>/openspec/specs/<capability-path>/spec.md` (use the store-aware `planningHome.root` from step 3 status JSON, not a hardcoded repo path).
+      - Verify that main specs are updated:
+        - ADDED requirements present
+        - MODIFIED requirements carrying scenario and description changes named in the delta, with their other scenarios intact
+        - REMOVED requirements gone — and where this sync retired a capability (removed its last requirement, leaving `## Requirements` empty), its main spec deleted rather than left empty; a spec the sync deliberately kept and reported is also a match
+        - RENAMED requirements present under the new name and absent under the old one
+      - Do not verify delta specs in `excludedDeltas`; they are intentionally left unsynced.
+      - If sync failed or any capability does not match verification, report what differs and fail/skip moving that change's `changeRoot` — do not archive that change. `changeRoot` remains intact.
+
+   c. **Perform the archive**:
+
+      Target name: use the change name as-is when it already starts with a `YYYY-MM-DD-` prefix; otherwise prepend the current date as `YYYY-MM-DD-<name>` (same rule as `openspec archive`).
 
-   b. **Perform the archive**:
       ```bash
       mkdir -p "<planningHome.changesDir>/archive"
-      mv "<changeRoot>" "<planningHome.changesDir>/archive/YYYY-MM-DD-<name>"
+      mv "<changeRoot>" "<planningHome.changesDir>/archive/<target-name>"
       ```
 
-   c. **Track outcome** for each change:
+   d. **Track outcome** for each change:
       - Success: archived successfully
-      - Failed: error during archive (record error)
+      - Failed: error during archive or spec verification (record error)
       - Skipped: user chose not to archive (if applicable)
+      - Sync skipped: for every delta in `excludedDeltas`, report `sync skipped` with the change, `<capability-path>`, and recorded reason. This is distinct from skipping the archive.
 
 9. **Display summary**
 
    Show final results:
 
-   ```
+   ```markdown
    ## Bulk Archive Complete
 
    Archived 3 changes:
@@ -152,11 +227,12 @@ This skill allows you to batch-archive changes, handling spec conflicts intellig
 
    Spec sync summary:
    - 4 delta specs synced to main specs
-   - 1 conflict resolved (auth: applied both in chronological order)
+   - 1 delta spec sync skipped (add-jwt, identity/user-auth: implementation not found)
+   - 1 conflict resolved (identity/user-auth: synced add-oauth, skipped add-jwt)
    ```
 
    If any failures:
-   ```
+   ```text
    Failed 1 change:
    - some-change: Archive directory already exists
    ```
@@ -164,8 +240,8 @@ This skill allows you to batch-archive changes, handling spec conflicts intellig
 **Conflict Resolution Examples**
 
 Example 1: Only one implemented
-```
-Conflict: specs/auth/spec.md touched by [add-oauth, add-jwt]
+```text
+Conflict: <planningHome.root>/openspec/specs/auth/spec.md touched by [add-oauth, add-jwt]
 
 Checking add-oauth:
 - Delta adds "OAuth Provider Integration" requirement
@@ -179,8 +255,8 @@ Resolution: Only add-oauth is implemented. Will sync add-oauth specs only.
 ```
 
 Example 2: Both implemented
-```
-Conflict: specs/api/spec.md touched by [add-rest-api, add-graphql]
+```text
+Conflict: <planningHome.root>/openspec/specs/api/spec.md touched by [add-rest-api, add-graphql]
 
 Checking add-rest-api (created 2026-01-10):
 - Delta adds "REST Endpoints" requirement
@@ -196,12 +272,12 @@ then add-graphql specs (chronological order, newer takes precedence).
 
 **Output On Success**
 
-```
+```markdown
 ## Bulk Archive Complete
 
 Archived N changes:
-- <change-1> -> archive/YYYY-MM-DD-<change-1>/
-- <change-2> -> archive/YYYY-MM-DD-<change-2>/
+- <change-1> -> archive/<target-name-1>/
+- <change-2> -> archive/<target-name-2>/
 
 Spec sync summary:
 - N delta specs synced to main specs
@@ -210,11 +286,11 @@ Spec sync summary:
 
 **Output On Partial Success**
 
-```
+```markdown
 ## Bulk Archive Complete (partial)
 
 Archived N changes:
-- <change-1> -> archive/YYYY-MM-DD-<change-1>/
+- <change-1> -> archive/<target-name-1>/
 
 Skipped M changes:
 - <change-2> (user chose not to archive incomplete)
@@ -225,7 +301,7 @@ Failed K changes:
 
 **Output When No Changes**
 
-```
+```markdown
 ## No Changes to Archive
 
 No active changes found. Create a new change to get started.
@@ -239,7 +315,22 @@ No active changes found. Create a new change to get started.
 - Skip spec sync only when implementation is missing (warn user)
 - Show clear per-change status before confirming
 - Use single confirmation for entire batch
+- Never archive after the user cancels the confirmation — a cancelled batch archives nothing
 - Track and report all outcomes (success/skip/fail)
 - Preserve .openspec.yaml when moving to archive
-- Archive directory target uses current date: YYYY-MM-DD-<name>
+- Archive directory target uses current date: YYYY-MM-DD-<name>; a name that already starts with a `YYYY-MM-DD-` prefix is used as-is (never stack a second date)
 - If archive target exists, fail that change but continue with others
+- If sync is requested, run the `/opsx:sync` workflow inline (agent-driven) for each change with included delta specs
+- Carry the per-delta `includedDeltas` and `excludedDeltas` decisions into execution; sync and verify only included deltas
+- Report every excluded delta as `sync skipped` without treating the archive itself as skipped
+- Never archive a change while a spec sync is still in flight — run the sync inline and verify main specs at `<planningHome.root>/openspec/specs/<capability-path>/spec.md` before moving `changeRoot`
+- Fetch archive inputs once per selected root before spec inspection or moves
+- Fetch all required specs-rule snapshots before the batch's first main-spec write or move
+- A failed archive-inputs lookup never blocks the batch; it proceeds with no context or guidance
+- A failed specs instruction lookup stops the whole batch atomically
+- Changes without concrete `artifactPaths.specs.existingOutputPaths` continue without spec sync
+- Apply relevant runtime context across the batch and report conflicts
+- Operation guidance remains advisory; consider every entry and explain rejected advice
+- Keep runtime inputs, conflict analysis, CLI-derived values, and artifact rules separate
+- Artifact rules constrain only written specs
+- Never copy runtime input or artifact-rule text verbatim into output files
diff --git a/.claude/commands/opsx/continue.md b/.claude/commands/opsx/continue.md
index 614d74dac..814c5965a 100644
--- a/.claude/commands/opsx/continue.md
+++ b/.claude/commands/opsx/continue.md
@@ -1,24 +1,27 @@
 ---
 name: "OPSX: Continue"
-description: Continue working on a change - create the next artifact (Experimental)
+description: "Continue working on a change - create the next artifact (Experimental)"
 allowed-tools: Bash(openspec:*)
-category: Workflow
-tags: [workflow, artifacts, experimental]
+category: "Workflow"
+tags: ["workflow", "artifacts", "experimental"]
 ---
 
 Continue working on a change by creating the next artifact.
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
 
 **Input**: Optionally specify a change name after `/opsx:continue` (e.g., `/opsx:continue add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
 
 **Steps**
 
-1. **If no change name provided, prompt for selection**
+1. **Select the change**
 
-   Run `openspec list --json` to get available changes sorted by most recently modified. Then use the **AskUserQuestion tool** to let the user select which change to work on.
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes sorted by most recently modified, and ask the user to select one
 
-   Present the top 3-4 most recently modified changes as options, showing:
+   When prompting, present the top 3-4 most recently modified changes as options, showing:
    - Change name
    - Schema (from `schema` field if present, otherwise "spec-driven")
    - Status (e.g., "0/5 tasks", "complete", "no tasks")
@@ -26,7 +29,7 @@ Continue working on a change by creating the next artifact.
 
    Mark the most recently modified change as "(Recommended)" since it's likely what the user wants to continue.
 
-   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+   Always announce: "Using change: <name>" and how to override (e.g., `/opsx:continue <other>`).
 
 2. **Check current status**
    ```bash
@@ -34,18 +37,18 @@ Continue working on a change by creating the next artifact.
    ```
    Parse the JSON to understand current state. The response includes:
    - `schemaName`: The workflow schema being used (e.g., "spec-driven")
-   - `artifacts`: Array of artifacts with their status ("done", "ready", "blocked")
-   - `isComplete`: Boolean indicating if all artifacts are complete
+   - `artifacts`: Array of artifacts with their status ("done", "skipped", "ready", "blocked")
+   - `isPlanningComplete`: Boolean indicating if all planning artifacts are complete. Older CLI versions expose the same value as `isComplete`.
    - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context. Use these instead of assuming repo-local paths.
 
 3. **Act based on status**:
 
    ---
 
-   **If all artifacts are complete (`isComplete: true`)**:
+   **If all planning artifacts are complete (`isPlanningComplete: true`, or legacy `isComplete: true`)**:
    - Congratulate the user
    - Show final status including the schema used
-   - Suggest: "All artifacts created! You can now implement this change with `/opsx:apply` or archive it with `/opsx:archive`."
+   - Suggest: "Planning is complete! You can now implement this change with `/opsx:apply`. Once implementation and any tracked work are complete, archive it with `/opsx:archive`."
    - STOP
 
    ---
@@ -62,10 +65,12 @@ Continue working on a change by creating the next artifact.
      - `template`: The structure to use for your output file
      - `instruction`: Schema-specific guidance
      - `resolvedOutputPath`: Resolved path or pattern to write the artifact
-     - `dependencies`: Completed artifacts to read for context
+     - `dependencies`: Completed artifacts to read for context (entries with `skipped: true` have no files - do not look for them)
+     - `skipped`/`warning`: present when the change declares skip_specs and this artifact must NOT be created - pick another artifact
    - **Create the artifact file**:
-     - Read any completed dependency files for context
-     - Use `template` as the structure - fill in its sections
+     - Read any completed dependency files for context - always re-read them from disk, even if you saw them earlier in the conversation (the user may have edited them)
+     - If the `instruction` field delegates creation to a specific skill or command, invoke it to produce the artifact instead of writing the file yourself, then verify the artifact file exists at `resolvedOutputPath`
+     - Otherwise use `template` as the structure - fill in its sections
      - Apply `context` and `rules` as constraints when writing - but do NOT copy them into the file
      - Write to the `resolvedOutputPath` specified in instructions. If it is a glob pattern, choose the concrete file path using the schema instruction and the change's context
    - Show what was created and what's now unlocked
@@ -93,22 +98,13 @@ After each invocation, show:
 
 **Artifact Creation Guidelines**
 
-The artifact types and their purpose depend on the schema. Use the `instruction` field from the instructions output to understand what to create.
+The artifact types and their purpose depend on the schema. The `instruction` field from the instructions output is the authoritative guidance for each artifact - follow it even when the artifact has a familiar name (proposal.md, tasks.md, etc.), since custom schemas may define different content or a different process for the same file names.
 
-Common artifact patterns:
-
-**spec-driven schema** (proposal → specs → design → tasks):
-- **proposal.md**: Ask user about the change if not clear. Fill in Why, What Changes, Capabilities, Impact.
-  - The Capabilities section is critical - each capability listed will need a spec file.
-- **specs/<capability>/spec.md**: Create one spec per capability listed in the proposal's Capabilities section (use the capability name, not the change name).
-- **design.md**: Document technical decisions, architecture, and implementation approach.
-- **tasks.md**: Break down implementation into checkboxed tasks.
-
-For other schemas, follow the `instruction` field from the CLI output.
+If the `instruction` field directs you to use a specific skill or command to create the artifact, invoke it instead of writing the artifact directly.
 
 **Guardrails**
 - Create ONE artifact per invocation
-- Always read dependency artifacts before creating a new one
+- Always read dependency artifacts before creating a new one - re-read from disk, not from conversation memory (files may have changed since you last saw them)
 - Never skip artifacts or create out of order
 - If context is unclear, ask the user before creating
 - Verify the artifact file exists after writing before marking progress
diff --git a/.claude/commands/opsx/explore.md b/.claude/commands/opsx/explore.md
index 7558a6319..9fbafac77 100644
--- a/.claude/commands/opsx/explore.md
+++ b/.claude/commands/opsx/explore.md
@@ -2,17 +2,17 @@
 name: "OPSX: Explore"
 description: "Enter explore mode - think through ideas, investigate problems, clarify requirements"
 allowed-tools: Bash(openspec:*)
-category: Workflow
-tags: [workflow, explore, experimental, thinking]
+category: "Workflow"
+tags: ["workflow", "explore", "experimental", "thinking"]
 ---
 
 Enter explore mode. Think deeply. Visualize freely. Follow the conversation wherever it goes.
 
-**IMPORTANT: Explore mode is for thinking, not implementing.** You may read files, search code, and investigate the codebase, but you must NEVER write code or implement features. If the user asks you to implement something, remind them to exit explore mode first and create a change proposal. You MAY create OpenSpec artifacts (proposals, designs, specs) if the user asks—that's capturing thinking, not implementing.
+**IMPORTANT: Explore mode is for thinking, not implementing.** You may read files, search code, and investigate the codebase, but you must NEVER write code or implement features. If the user asks you to implement something, remind them to exit explore mode first and create a change proposal. You MAY create OpenSpec artifacts (proposals, designs, specs) if the user asks—that's capturing thinking, not implementing. For a new change, scaffold it first as described below.
 
 **This is a stance, not a workflow.** There are no fixed steps, no required sequence, no mandatory outputs. You're a thinking partner helping the user explore.
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
 
 **Input**: The argument after `/opsx:explore` is whatever the user wants to think about. Could be:
 - A vague idea: "real-time collaboration"
@@ -97,6 +97,12 @@ This tells you:
 - Their names, schemas, and status
 - What the user might be working on
 
+Then read the project's own context from the resolved root - `<root.path>/openspec/config.yaml` (or `config.yml`). Use the `root.path` returned above, and skip this if neither file exists:
+- `context`: project background - tech stack, conventions, constraints
+- `rules`: keyed by artifact id - the entries for an artifact apply only when you write that artifact
+
+Ground your thinking in these. They are constraints for you to follow, not content to reproduce: do NOT copy them into the conversation or into any artifact you create.
+
 If the user mentioned a specific change name, read its artifacts for context.
 
 ### When no change exists
@@ -106,6 +112,15 @@ Think freely. When insights crystallize, you might offer:
 - "This feels solid enough to start a change. Want me to create a proposal?"
 - Or keep exploring - no pressure to formalize
 
+If the user asks you to capture the exploration as a new change, transition seamlessly into the requested capture:
+
+1. Run `openspec new change "<name>"` (with `--store <id>` when applicable) before creating any artifacts. Never create a new change directory under `openspec/changes/` by hand; the CLI scaffold creates required metadata such as `.openspec.yaml`. Keep the selected `--store <id>` on every applicable follow-up `status` and `instructions` command.
+2. Run `openspec status --change "<name>" --json` (append the confirmed `--store "<id>"` only for a registered standalone store), then process the requested artifacts in dependency order. For each requested artifact that is `ready`, run `openspec instructions "<artifact-id>" --change "<name>" --json` (append the confirmed `--store "<id>"` only for a registered standalone store). Before creating a requested artifact, evaluate any condition in its own `instruction` against the explored change; record a deliberate skip instead when the condition does not apply. If a requested artifact is blocked by a direct prerequisite the user did not request, run `openspec instructions "<prerequisite-id>" --change "<name>" --json` (append the confirmed `--store "<id>"` only for a registered standalone store) for that prerequisite whether it is `ready` or `blocked`. If its own `instruction` states a condition, evaluate that condition against the explored change and record a deliberate skip only when the condition does not apply. If the condition applies, or the prerequisite is not conditional, treat it as a normal prerequisite and ask before expanding the capture. Do not create an unrequested prerequisite unless the user approves.
+3. Follow the returned `template` and `instruction` fields. Read completed dependency files listed in `dependencies`, and apply `context` and `rules` as constraints without copying them into the artifact. If the instruction delegates creation to a specific skill or command, invoke it; otherwise write the artifact to `resolvedOutputPath`, using the instruction to choose a concrete path when it is a glob. Verify that the selected concrete output exists.
+4. After creating each artifact, re-run `openspec status --change "<name>" --json` (append the confirmed `--store "<id>"` only for a registered standalone store) and continue until every requested artifact is `done`, `skipped`, or was deliberately skipped because its own `instruction` stated a condition that did not apply. Tell the user about a deliberate conditional skip, remember it, and do not reconsider it. Dependencies are enablers, not gates: if a requested artifact is still `blocked` only because you deliberately skipped a conditional prerequisite, run `openspec instructions "<artifact-id>" --change "<name>" --json` (append the confirmed `--store "<id>"` only for a registered standalone store) despite the blocked status, then create it using step 3 only when those recorded conditional skips are its sole missing dependencies. If a requested artifact is blocked by a prerequisite the user did not ask to capture and cannot be conditionally skipped, explain that dependency and ask before expanding the capture.
+
+Capture the artifact(s) the user requested without asking them to invoke another workflow command. If they asked only to start a change, stop after scaffolding and show its status.
+
 ### When a change exists
 
 If the user mentions a change or you detect one is relevant:
@@ -121,14 +136,16 @@ If the user mentions a change or you detect one is relevant:
 
 3. **Offer to capture when decisions are made**
 
-    | Insight Type               | Where to Capture               |
-    |----------------------------|--------------------------------|
-    | New requirement discovered | `specs/<capability>/spec.md` |
-    | Requirement changed        | `specs/<capability>/spec.md` |
-    | Design decision made       | `design.md`                  |
-    | Scope changed              | `proposal.md`                |
-    | New work identified        | `tasks.md`                   |
-    | Assumption invalidated     | Relevant artifact              |
+   `<capability-path>` is the spec directory relative to `specs/` (for example, `user-auth` or `identity/user-auth`). Preserve an existing capability's full path and follow the project's established organization for new capabilities.
+
+    | Insight Type               | Where to Capture                    |
+    |----------------------------|-------------------------------------|
+    | New requirement discovered | `specs/<capability-path>/spec.md` |
+    | Requirement changed        | `specs/<capability-path>/spec.md` |
+    | Design decision made       | `design.md`                       |
+    | Scope changed              | `proposal.md`                     |
+    | New work identified        | `tasks.md`                        |
+    | Assumption invalidated     | Relevant artifact                   |
 
    Example offers:
    - "That's a design decision. Capture it in design.md?"
@@ -170,6 +187,7 @@ When things crystallize, you might offer a summary - but it's optional. Sometime
 - **Don't rush** - Discovery is thinking time, not task time
 - **Don't force structure** - Let patterns emerge naturally
 - **Don't auto-capture** - Offer to save insights, don't just do it
+- **Don't manually scaffold changes** - Never create a new change directory under `openspec/changes/` by hand. Always use `openspec new change "<name>"` (with `--store <id>` when applicable) so required metadata such as `.openspec.yaml` is created before writing artifacts.
 - **Do visualize** - A good diagram is worth many paragraphs
 - **Do explore the codebase** - Ground discussions in reality
 - **Do question assumptions** - Including the user's and your own
diff --git a/.claude/commands/opsx/ff.md b/.claude/commands/opsx/ff.md
index c87de6b2f..75e78ab7b 100644
--- a/.claude/commands/opsx/ff.md
+++ b/.claude/commands/opsx/ff.md
@@ -1,14 +1,14 @@
 ---
 name: "OPSX: Fast Forward"
-description: Create a change and generate all artifacts needed for implementation in one go
+description: "Create a change and generate all artifacts needed for implementation in one go"
 allowed-tools: Bash(openspec:*)
-category: Workflow
-tags: [workflow, artifacts, experimental]
+category: "Workflow"
+tags: ["workflow", "artifacts", "experimental"]
 ---
 
 Fast-forward through artifact creation - generate everything needed to start implementation.
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
 
 **Input**: The argument after `/opsx:ff` is the change name (kebab-case), OR a description of what the user wants to build.
 
@@ -16,7 +16,7 @@ Fast-forward through artifact creation - generate everything needed to start imp
 
 1. **If no input provided, ask what they want to build**
 
-   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
+   Ask the user (open-ended, no preset options):
    > "What change do you want to work on? Describe what you want to build or fix."
 
    From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
@@ -35,12 +35,12 @@ Fast-forward through artifact creation - generate everything needed to start imp
    ```
    Parse the JSON to get:
    - `applyRequires`: array of artifact IDs needed before implementation (e.g., `["tasks"]`)
-   - `artifacts`: list of all artifacts with their status and dependencies
+   - `artifacts`: list of all artifacts, each with its `status` and its `requires` edges (the artifact IDs it directly depends on)
    - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context. Use these instead of assuming repo-local paths.
 
-4. **Create artifacts in sequence until apply-ready**
+4. **Create every artifact in the required set**
 
-   Use the **TodoWrite tool** to track progress through the artifacts.
+   Use a todo list to track progress through the artifacts.
 
    Loop through artifacts in dependency order (artifacts with no pending dependencies first):
 
@@ -54,20 +54,27 @@ Fast-forward through artifact creation - generate everything needed to start imp
         - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
         - `template`: The structure to use for your output file
         - `instruction`: Schema-specific guidance for this artifact type
+        - `skipped`/`warning`: present when the change declares skip_specs and this artifact must NOT be created - stop and pick another artifact
         - `resolvedOutputPath`: Resolved path or pattern to write the artifact
         - `dependencies`: Completed artifacts to read for context
-      - Read any completed dependency files for context
-      - Create the artifact file using `template` as the structure and write it to `resolvedOutputPath`
+      - Read any completed dependency files for context - always re-read them from disk, even if you saw them earlier in the conversation (the user may have edited them)
+      - If the `instruction` field delegates creation to a specific skill or command, invoke it to produce the artifact instead of writing the file yourself, then verify the artifact file exists at `resolvedOutputPath`
+      - Otherwise create the artifact file using `template` as the structure and write it to `resolvedOutputPath`. If `resolvedOutputPath` is a glob, follow `instruction` to choose the concrete file path
       - Apply `context` and `rules` as constraints - but do NOT copy them into the file
       - Show brief progress: "✓ Created <artifact-id>"
 
-   b. **Continue until all `applyRequires` artifacts are complete**
+   b. **Continue until every artifact in the required set exists (not just `apply.requires`)**
       - After creating each artifact, re-run `openspec status --change "<name>" --json`
-      - Check if every artifact ID in `applyRequires` has `status: "done"` in the artifacts array
-      - Stop when all `applyRequires` artifacts are done
+      - The required set is `applyRequires` plus every artifact reachable from those by following the `requires` edges in `status --json` - walk them transitively (spec-driven closes over proposal, specs, design, tasks). Leave artifacts outside that set alone
+      - `status` is file-existence only, so an `applyRequires` artifact reading `done` does NOT mean its dependencies exist - writing `tasks.md` early marks `tasks` done while `specs` was never written. Use each artifact's `requires` edges, not its `status`, to build the required set: a `done` artifact still lists what it depends on
+      - An artifact already reading `status: "skipped"` is satisfied: the change declares `skip_specs` in `.openspec.yaml`, so its files must NOT exist. Never try to create one
+      - Create every artifact in the required set that is missing, then re-check - creating one can unblock others
+      - Skip one only when `status` already reports it `skipped`, or when its own `instruction` says it is conditional: run `openspec instructions <artifact-id> --change "<name>" --json` and skip only if its `instruction` field marks it optional (e.g. "create only if..."). Spec-driven's `design.md` qualifies; `specs` qualifies only via the `skipped` status above, never by your own judgment. Tell the user, and do not reconsider it
+      - Dependencies are enablers, not gates: if a required artifact is still `blocked` only because you skipped a conditional dependency, write it anyway
+      - Stop when every artifact in the required set is `done`, `skipped`, or was deliberately skipped
 
    c. **If an artifact requires user input** (unclear context):
-      - Use **AskUserQuestion tool** to clarify
+      - Ask the user to clarify
       - Then continue with creation
 
 5. **Show final status**
@@ -79,13 +86,14 @@ Fast-forward through artifact creation - generate everything needed to start imp
 
 After completing all artifacts, summarize:
 - Change name and location
-- List of artifacts created with brief descriptions
-- What's ready: "All artifacts created! Ready for implementation."
+- List of artifacts created with brief descriptions, plus any conditional artifact you skipped and why
+- What's ready: "All artifacts needed for implementation are ready."
 - Prompt: "Run `/opsx:apply` to start implementing."
 
 **Artifact Creation Guidelines**
 
-- Follow the `instruction` field from `openspec instructions` for each artifact type
+- Follow the `instruction` field from `openspec instructions` for each artifact type - it is the authoritative guidance, even for familiar artifact names
+- If the `instruction` field directs you to use a specific skill or command to create the artifact, invoke it instead of writing the artifact directly
 - The schema defines what each artifact should contain - follow it
 - Read dependency artifacts for context before creating new ones
 - Use `template` as the structure for your output file - fill in its sections
@@ -94,8 +102,8 @@ After completing all artifacts, summarize:
   - These guide what you write, but should never appear in the output
 
 **Guardrails**
-- Create ALL artifacts needed for implementation (as defined by schema's `apply.requires`)
-- Always read dependency artifacts before creating a new one
+- Create every artifact the apply phase transitively depends on, not just the ids listed in `apply.requires`
+- Always read dependency artifacts before creating a new one - re-read from disk, not from conversation memory (files may have changed since you last saw them)
 - If context is critically unclear, ask the user - but prefer making reasonable decisions to keep momentum
 - If a change with that name already exists, ask if user wants to continue it or create a new one
 - Verify each artifact file exists after writing before proceeding to next
diff --git a/.claude/commands/opsx/new.md b/.claude/commands/opsx/new.md
index bd8c4e0b4..dd726bde0 100644
--- a/.claude/commands/opsx/new.md
+++ b/.claude/commands/opsx/new.md
@@ -1,14 +1,14 @@
 ---
 name: "OPSX: New"
-description: Start a new change using the experimental artifact workflow (OPSX)
+description: "Start a new change using the experimental artifact workflow (OPSX)"
 allowed-tools: Bash(openspec:*)
-category: Workflow
-tags: [workflow, artifacts, experimental]
+category: "Workflow"
+tags: ["workflow", "artifacts", "experimental"]
 ---
 
 Start a new change using the experimental artifact-driven approach.
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
 
 **Input**: The argument after `/opsx:new` is the change name (kebab-case), OR a description of what the user wants to build.
 
@@ -16,7 +16,7 @@ Start a new change using the experimental artifact-driven approach.
 
 1. **If no input provided, ask what they want to build**
 
-   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
+   Ask the user (open-ended, no preset options):
    > "What change do you want to work on? Describe what you want to build or fix."
 
    From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
diff --git a/.claude/commands/opsx/onboard.md b/.claude/commands/opsx/onboard.md
index 1b0adab88..21ecb8608 100644
--- a/.claude/commands/opsx/onboard.md
+++ b/.claude/commands/opsx/onboard.md
@@ -1,14 +1,14 @@
 ---
 name: "OPSX: Onboard"
-description: Guided onboarding - walk through a complete OpenSpec workflow cycle with narration
+description: "Guided onboarding - walk through a complete OpenSpec workflow cycle with narration"
 allowed-tools: Bash(openspec:*)
-category: Workflow
-tags: [workflow, onboarding, tutorial, learning]
+category: "Workflow"
+tags: ["workflow", "onboarding", "tutorial", "learning"]
 ---
 
 Guide the user through their first complete OpenSpec workflow cycle. This is a teaching experience—you'll do real work in their codebase while explaining each step.
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
 
 ---
 
@@ -207,6 +207,11 @@ I'll draft one based on our task.
 
 **DO:** Draft the proposal content (don't save yet):
 
+`<capability-path>` is the spec directory relative to `specs/` (for example,
+`user-auth` or `identity/user-auth`). Use the exact existing path for modified
+capabilities. For new capabilities, follow the project's established spec
+organization.
+
 ```
 Here's a draft proposal:
 
@@ -223,10 +228,11 @@ Here's a draft proposal:
 ## Capabilities
 
 ### New Capabilities
-- `<capability-name>`: [brief description]
+- `<capability-path>`: [brief description]
 
 ### Modified Capabilities
 <!-- If modifying existing behavior -->
+- `<existing-capability-path>`: [brief description]
 
 ## Impact
 
@@ -364,12 +370,12 @@ Here are the implementation tasks:
 
 ## 1. [Category or file]
 
-- [ ] 1.1 [Specific task]
-- [ ] 1.2 [Specific task]
+- [ ] 1.1 [Specific task] — verify: [test, command, observable behavior, or delivered artifact]
+- [ ] 1.2 [Specific task] — verify: [test, command, observable behavior, or delivered artifact]
 
-## 2. Verify
+## 2. Integration Verification
 
-- [ ] 2.1 [Verification step]
+- [ ] 2.1 Verify [broader integration or system behavior] with [end-to-end test or observable result]
 
 ---
 
@@ -427,14 +433,14 @@ When a change is complete, we archive it. The archive path is derived from `plan
 Archived changes become your project's decision history—you can always find them later to understand why something was built a certain way.
 ```
 
-**DO:**
+**DO:** Archive the change (`--yes` answers the confirmation prompts, which you cannot answer from a tool call):
 ```bash
-openspec archive "<name>"
+openspec archive "<name>" --yes
 ```
 
 **SHOW:**
 ```
-Archived to: `<planningHome.changesDir>/archive/YYYY-MM-DD-<name>/`
+Archived to: `<planningHome.changesDir>/archive/<target-name>/` (the target name prepends today's date, unless the name already starts with a `YYYY-MM-DD-` prefix — then it is kept as-is, no second date)
 
 The change is now part of your project's history. The code is in your codebase, the decision record is preserved.
 ```
@@ -472,7 +478,7 @@ This same rhythm works for any size change—a small fix or a major feature.
  | `/opsx:apply`   | Implement tasks from a change              |
  | `/opsx:archive` | Archive a completed change                 |
 
-**Additional commands:**
+**Additional commands** (only if installed - availability depends on your profile):
 
  | Command            | What it does                                             |
  |--------------------|----------------------------------------------------------|
@@ -500,7 +506,7 @@ If the user says they need to stop, want to pause, or seem disengaged:
 No problem! Your change is saved at the `changeRoot` reported by `openspec status --change "<name>" --json`.
 
 To pick up where we left off later:
-- `/opsx:continue <name>` - Resume artifact creation
+- `/opsx:continue <name>` - Resume artifact creation (if installed; otherwise `openspec status --change "<name>" --json` shows the next artifact)
 - `/opsx:apply <name>` - Jump to implementation (if tasks exist)
 
 The work won't be lost. Come back whenever you're ready.
@@ -524,7 +530,7 @@ If the user says they just want to see the commands or skip the tutorial:
  | `/opsx:apply <name>`   | Implement tasks                            |
  | `/opsx:archive <name>` | Archive when done                          |
 
-**Additional commands:**
+**Additional commands** (only if installed - availability depends on your profile):
 
  | Command                   | What it does                        |
  |---------------------------|-------------------------------------|
diff --git a/.claude/commands/opsx/sync.md b/.claude/commands/opsx/sync.md
index a3550cf48..2dd4cc3ba 100644
--- a/.claude/commands/opsx/sync.md
+++ b/.claude/commands/opsx/sync.md
@@ -1,28 +1,33 @@
 ---
 name: "OPSX: Sync"
-description: Sync delta specs from a change to main specs
+description: "Sync delta specs from a change to main specs"
 allowed-tools: Bash(openspec:*)
-category: Workflow
-tags: [workflow, specs, experimental]
+category: "Workflow"
+tags: ["workflow", "specs", "experimental"]
 ---
 
 Sync delta specs from a change to main specs.
 
 This is an **agent-driven** operation - you will read delta specs and directly edit main specs to apply the changes. This allows intelligent merging (e.g., adding a scenario without copying the entire requirement).
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+`<capability-path>` is the spec directory relative to `specs/` (for example, `user-auth` or `identity/user-auth`). Preserve the full path from each delta spec when resolving its main spec.
 
 **Input**: Optionally specify a change name after `/opsx:sync` (e.g., `/opsx:sync add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
 
 **Steps**
 
-1. **If no change name provided, prompt for selection**
+1. **Select the change**
 
-   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes and ask the user to select one
 
-   Show changes that have delta specs (under `specs/` directory).
+   When prompting, show changes that have delta specs (under `specs/` directory).
 
-   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+   Always announce: "Using change: <name>" and how to override (e.g., `/opsx:sync <other>`).
 
 2. **Resolve change context**
 
@@ -31,9 +36,29 @@ This is an **agent-driven** operation - you will read delta specs and directly e
    openspec status --change "<name>" --json
    ```
 
+   The JSON includes `planningHome.root`. Main specs live under `<planningHome.root>/openspec/specs/` — use that (store-aware) root for every main-spec path below, not a hardcoded repo path. When a store is selected it points at the store, not the current repository.
+
 3. **Find delta specs**
 
-   Use `artifactPaths.specs.existingOutputPaths` from the status JSON as the list of delta spec files.
+   Use `artifactPaths.specs.existingOutputPaths` from the status JSON as the
+   only source of delta spec paths. If the `specs` entry is missing or
+   `existingOutputPaths` is empty, report that there are no delta specs to sync,
+   do not infer them from other artifacts, and stop without requesting artifact
+   instructions or writing a main spec.
+
+   Sync every path in `existingOutputPaths` unless the caller narrowed the set.
+   A caller narrows it by naming an explicit list of complete entries from
+   `existingOutputPaths` — copy those absolute values verbatim. Archive does
+   this inline, and a user can too (for example, by selecting the entry ending
+   in `/specs/billing/invoices/spec.md`).
+   Then sync only the named paths and leave the remaining delta specs untouched:
+   bulk archive excludes a delta whose implementation it could not find, and
+   syncing it anyway would write a main spec the caller deliberately withheld.
+   Carry that narrowed selection through step 4; never widen it back to the full
+   list. If a named path is not in `existingOutputPaths`, do not sync it —
+   report it and stop, rather than dropping it silently. If the named list is
+   empty, report that there is nothing to sync and stop without writing a main
+   spec.
 
    Each delta spec file contains sections like:
    - `## ADDED Requirements` - New requirements to add
@@ -45,11 +70,27 @@ This is an **agent-driven** operation - you will read delta specs and directly e
 
 4. **For each delta spec, apply changes to main specs**
 
-   For each repo-local capability delta spec path returned by the CLI:
+   Before the first main-spec write, obtain one current specs-rule snapshot:
+   - If archive invoked this workflow inline and supplied a valid snapshot from
+     `openspec instructions specs --change "<name>" --json`, reuse it and do not
+     fetch the same instructions again.
+   - Otherwise run that command once now with the same selected-root flags.
+   - If the direct lookup exits non-zero or returns invalid artifact-instruction
+     JSON, report the error and stop before writing any main spec. Do not treat the
+     failure as an absent rule set.
+   - A valid response with omitted `rules` means no artifact rules are configured
+     and the existing semantic merge continues.
+
+   Apply returned `rules` only to the content and form of the main specs produced
+   by this merge. Artifact rules are not operation guidance and cannot change
+   selected roots, delta paths, CLI checks, or workflow steps. Use their text as
+   constraints without copying it verbatim into a main spec or summary.
+
+   For each capability delta spec path selected in step 3 — the full `existingOutputPaths` list, or the narrowed subset when a caller supplied one (these may belong to a selected store, not the repo):
 
    a. **Read the delta spec** to understand the intended changes
 
-   b. **Read the main spec** at `openspec/specs/<capability>/spec.md` (may not exist yet)
+   b. **Read the main spec** at `<planningHome.root>/openspec/specs/<capability-path>/spec.md` (may not exist yet)
 
    c. **Apply changes intelligently**:
 
@@ -60,31 +101,72 @@ This is an **agent-driven** operation - you will read delta specs and directly e
       **MODIFIED Requirements:**
       - Find the requirement in main spec
       - Apply the changes - this can be:
-        - Adding new scenarios (don't need to copy existing ones)
+        - Adding new scenarios the main spec does not have yet
         - Modifying existing scenarios
         - Changing the requirement description
       - Preserve scenarios/content not mentioned in the delta
 
       **REMOVED Requirements:**
       - Remove the entire requirement block from main spec
+      - Retiring the capability. Delete the whole `spec.md` - and the directory once
+        nothing else is left in it - only when ALL of these hold:
+        1. removing the requirements *this run* left no requirement blocks;
+        2. the rest of the spec is well-formed (it still has a `## Purpose`);
+        3. the main spec was not already empty before this sync - if you removed
+           nothing, change nothing;
+        4. every other nonblank line in the whole file is accounted for as the
+           title, Purpose, Requirements header, or a canonical requirement's
+           statement, scenarios, or fenced examples;
+        5. the change's `.openspec.yaml` declares `retire_capabilities: true`;
+        6. the `spec.md` resolves inside the real specs root (do not follow a
+           capability-directory symlink to delete an external file).
+        If removing the selected requirements would leave no requirement blocks and
+        any retirement condition is not satisfied, do not modify the main spec. Stop
+        the sync for that capability, report the blocking condition, and tell the user
+        how to resolve it. Never write or leave an empty `## Requirements` section.
+        When only the marker is missing, say that too - it is the one thing the user
+        can add to make the retirement go through.
+      - Deleting the file also deletes its `## Purpose`; any other section blocks
+        retirement. Name Purpose when you report the retirement. Include a pasteable
+        `git checkout` only when the spec lived in the caller's checkout;
+        otherwise give checkout-scoped recovery guidance.
 
       **RENAMED Requirements:**
       - Find the FROM requirement, rename to TO
 
+      **`## Purpose` in the delta:**
+      - The main spec already has one and it is authoritative - leave it alone
+        (this is what `openspec archive` does; it warns and moves on)
+
    d. **Create new main spec** if capability doesn't exist yet:
-      - Create `openspec/specs/<capability>/spec.md`
-      - Add Purpose section (can be brief, mark as TBD)
+      - Create `<planningHome.root>/openspec/specs/<capability-path>/spec.md`
+      - Add Purpose section: copy the delta's `## Purpose` body verbatim when it has one
+        (this is what `openspec archive` does); only write a brief TBD placeholder when it does not
       - Add Requirements section with the ADDED requirements
+      - Follow the **Main Spec Format Reference** below
+
+5. **Validate updated main specs**
 
-5. **Show summary**
+   Run `openspec validate --specs` with the same selected-root flags used earlier.
+   If validation fails, report the problems and do not claim the sync succeeded.
+
+6. **Show summary**
 
    After applying all changes, summarize:
    - Which capabilities were updated
    - What changes were made (requirements added/modified/removed/renamed)
+   - Any new main spec left with a TBD Purpose placeholder, so it gets written
+     now rather than lingering
+   - Any capability retired, naming the deleted `spec.md`, its Purpose, and
+     either a pasteable `git checkout` or checkout-scoped recovery guidance
 
 **Delta Spec Format Reference**
 
 ```markdown
+## Purpose
+
+Only on a delta that introduces a brand-new capability. Seeds the new main spec.
+
 ## ADDED Requirements
 
 ### Requirement: New Feature
@@ -97,6 +179,12 @@ The system SHALL do something new.
 ## MODIFIED Requirements
 
 ### Requirement: Existing Feature
+The system SHALL keep doing the existing thing, now also handling A.
+
+#### Scenario: Scenario the main spec already has
+- **WHEN** user does X
+- **THEN** system does Y
+
 #### Scenario: New scenario to add
 - **WHEN** user does A
 - **THEN** system does B
@@ -111,16 +199,36 @@ The system SHALL do something new.
 - TO: `### Requirement: New Name`
 ```
 
+**Main Spec Format Reference**
+
+Main specs are what the delta merges INTO. They must never contain delta operation headers (`## ADDED/MODIFIED/REMOVED/RENAMED Requirements`) - after syncing, every requirement lives under a single `## Requirements` section:
+
+```markdown
+# <capability> Specification
+
+## Purpose
+Short description of what this capability does and why it exists.
+
+## Requirements
+
+### Requirement: New Feature
+The system SHALL do something new.
+
+#### Scenario: Basic case
+- **WHEN** user does X
+- **THEN** system does Y
+```
+
 **Key Principle: Intelligent Merging**
 
-Unlike programmatic merging, you can apply **partial updates**:
-- To add a scenario, just include that scenario under MODIFIED - don't copy existing scenarios
-- The delta represents *intent*, not a wholesale replacement
+Unlike programmatic merging, you merge rather than overwrite:
+- A MODIFIED block carries the whole requirement - body plus every scenario that survives the change. `openspec validate` and `openspec archive` both reject one that drops a scenario the main spec still has.
+- Keep anything the delta does not mention, in the main spec's existing order
 - Use your judgment to merge changes sensibly
 
 **Output On Success**
 
-```
+```markdown
 ## Specs Synced: <change-name>
 
 Updated main specs:
@@ -139,6 +247,12 @@ Main specs are now updated. The change remains active - archive when implementat
 **Guardrails**
 - Read both delta and main specs before making changes
 - Preserve existing content not mentioned in delta
+- Never copy a delta file into a main spec as-is - merge its content so the main spec keeps the Main Spec Format Reference structure, with no delta operation headers
 - If something is unclear, ask for clarification
 - Show what you're changing as you go
 - The operation should be idempotent - running twice should give same result
+- Use only `artifactPaths.specs.existingOutputPaths`; never infer delta specs from unrelated artifacts
+- Honor a caller-supplied subset of `existingOutputPaths`; never widen it back to the full list
+- Fetch specs instructions once for direct sync, or reuse the archive-supplied snapshot inline
+- Stop before every main-spec write on a non-zero or invalid JSON specs-instruction response
+- Artifact rules constrain only the specs being written and are never copied into output files
diff --git a/.claude/commands/opsx/verify.md b/.claude/commands/opsx/verify.md
index 7f6cade12..ad48197d8 100644
--- a/.claude/commands/opsx/verify.md
+++ b/.claude/commands/opsx/verify.md
@@ -1,28 +1,31 @@
 ---
 name: "OPSX: Verify"
-description: Verify implementation matches change artifacts before archiving
+description: "Verify implementation matches change artifacts before archiving"
 allowed-tools: Bash(openspec:*)
-category: Workflow
-tags: [workflow, verify, experimental]
+category: "Workflow"
+tags: ["workflow", "verify", "experimental"]
 ---
 
 Verify that an implementation matches the change artifacts (specs, tasks, design).
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
 
 **Input**: Optionally specify a change name after `/opsx:verify` (e.g., `/opsx:verify add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
 
 **Steps**
 
-1. **If no change name provided, prompt for selection**
+1. **Select the change**
 
-   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes and ask the user to select one
 
-   Show changes that have implementation tasks (tasks artifact exists).
+   When prompting, show changes that have implementation tasks (tasks artifact exists).
    Include the schema used for each change if available.
    Mark changes with incomplete tasks as "(In Progress)".
 
-   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+   Always announce: "Using change: <name>" and how to override (e.g., `/opsx:verify <other>`).
 
 2. **Check status to understand the schema**
    ```bash
@@ -110,7 +113,7 @@ Verify that an implementation matches the change artifacts (specs, tasks, design
 8. **Generate Verification Report**
 
    **Summary Scorecard**:
-   ```
+   ```markdown
    ## Verification Report: <change-name>
 
    ### Summary
diff --git a/.claude/skills/openspec-apply-change/SKILL.md b/.claude/skills/openspec-apply-change/SKILL.md
index 1375861c3..c8ada3895 100644
--- a/.claude/skills/openspec-apply-change/SKILL.md
+++ b/.claude/skills/openspec-apply-change/SKILL.md
@@ -7,14 +7,14 @@ compatibility: Requires openspec CLI.
 metadata:
   author: openspec
   version: "1.0"
-  generatedBy: "1.6.0"
+  generatedBy: "1.10.0"
 ---
 
 Implement tasks from an OpenSpec change.
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
 
-**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+**Input**: Optionally specify a change name (e.g., `/opsx:apply add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
 
 **Steps**
 
@@ -23,7 +23,7 @@ Implement tasks from an OpenSpec change.
    If a name is provided, use it. Otherwise:
    - Infer from conversation context if the user mentioned a change
    - Auto-select if only one active change exists
-   - If ambiguous, run `openspec list --json` to get available changes and use the **AskUserQuestion tool** to let the user select
+   - If ambiguous, run `openspec list --json` to get available changes and ask the user to select one
 
    Always announce: "Using change: <name>" and how to override (e.g., `/opsx:apply <other>`).
 
@@ -47,12 +47,29 @@ Implement tasks from an OpenSpec change.
    - Progress (total, complete, remaining)
    - Task list with status
    - Dynamic instruction based on current state
+   - Optional `context`: current required project instruction input from the selected root
+   - Optional `operationGuidance`: current advisory guidance for apply
 
    **Handle states:**
-   - If `state: "blocked"` (missing artifacts): show message, suggest using openspec-continue-change
+   - If `state: "blocked"` (missing artifacts): show message, suggest using `/opsx:continue` (if it is not installed, run `openspec status --change "<name>" --json` to see the next artifact and `openspec instructions <artifact-id> --change "<name>" --json` for how to create it)
    - If `state: "all_done"`: congratulate, suggest archive
    - Otherwise: proceed to implementation
 
+   Treat `context` as a required prompt-level input. Read and consider it, and
+   apply relevant project facts, conventions, and constraints while implementing.
+   Treat `operationGuidance` as optional additive advice. Read and consider every
+   entry, and follow entries that are applicable and compatible with the built-in
+   workflow.
+
+   Keep both fields separate from CLI-returned state, missing artifacts, tasks,
+   progress, `contextFiles`, and the built-in `instruction`. They are not
+   evidence of task completion, do not replace the built-in instruction, and do
+   not permit bypassing a blocked state. If context conflicts with the built-in
+   instruction, an explicit user choice, or a CLI-controlled value, report the
+   conflict and preserve the controlling value. If guidance is inapplicable or
+   conflicts with those controlling inputs, do not follow it and explain why.
+   These are prompt-level behavior contracts, not enforceable checks.
+
 4. **Read context files**
 
    Read every file path listed under `contextFiles` from the apply instructions output.
@@ -60,6 +77,9 @@ Implement tasks from an OpenSpec change.
    - **spec-driven**: proposal, specs, design, tasks
    - Other schemas: follow the contextFiles from CLI output
 
+   Do not copy `context` or `operationGuidance` verbatim into implementation
+   files or planning artifacts unless the user separately asks for that content.
+
 5. **Show current progress**
 
    Display:
@@ -80,6 +100,7 @@ Implement tasks from an OpenSpec change.
    **Pause if:**
    - Task is unclear → ask for clarification
    - Implementation reveals a design issue → suggest updating artifacts
+   - A task needs work beyond what the spec and tasks describe, or you are tempted to drop, narrow, defer, or accept exceptions to specified behavior to make it fit → surface the added scope and ask; do not absorb it silently
    - Error or blocker encountered → report and wait for guidance
    - User interrupts
 
@@ -119,7 +140,7 @@ Working on task 4/7: <task description>
 - [x] Task 2
 ...
 
-All tasks complete! Ready to archive this change.
+All tasks complete! You can archive this change with `/opsx:archive`.
 ```
 
 **Output On Pause (Issue Encountered)**
@@ -150,7 +171,14 @@ What would you like to do?
 - Keep code changes minimal and scoped to each task
 - Update task checkbox immediately after completing each task
 - Pause on errors, blockers, or unclear requirements - don't guess
+- When a task needs work beyond what the spec describes, surface the added scope and pause - never silently narrow, defer, or simplify away specified behavior
+- Only mark a task `- [x]` when its specified behavior is fully implemented, not when it is partially done or deferred
 - Use contextFiles from CLI output, don't assume specific file names
+- Do not use context or operation guidance as proof that a task is complete
+- Apply relevant project context; report conflicts with controlling workflow inputs
+- Consider every guidance entry; explain any inapplicable or conflicting advice
+- Do not copy runtime context or operation guidance into implementation files or planning artifacts
+- Preserve CLI-controlled blocked/ready/all-done behavior and completion criteria
 
 **Fluid Workflow Integration**
 
diff --git a/.claude/skills/openspec-archive-change/SKILL.md b/.claude/skills/openspec-archive-change/SKILL.md
index c0c169d14..3d0f711db 100644
--- a/.claude/skills/openspec-archive-change/SKILL.md
+++ b/.claude/skills/openspec-archive-change/SKILL.md
@@ -7,25 +7,57 @@ compatibility: Requires openspec CLI.
 metadata:
   author: openspec
   version: "1.0"
-  generatedBy: "1.6.0"
+  generatedBy: "1.10.0"
 ---
 
 Archive a completed change in the experimental workflow.
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+`<capability-path>` is the spec directory relative to `specs/` (for example, `user-auth` or `identity/user-auth`). Preserve the full path from each delta spec when resolving its main spec.
 
 **Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
 
 **Steps**
 
-1. **If no change name provided, prompt for selection**
+1. **Select the change**
 
-   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes and ask the user to select one
 
-   Show only active changes (not already archived).
+   When prompting, show only active changes (not already archived).
    Include the schema used for each change if available.
 
-   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+   Always announce: "Using change: <name>" and how to override (e.g., `/opsx:archive <other>`).
+
+   **Load current archive inputs before the existing archive checks:**
+
+   After resolving the selected change and planning root, run:
+   ```bash
+   openspec instructions archive --change "<name>" --json
+   ```
+   Keep the same selected-root flags on this command. This lookup is advisory and
+   optional: it only supplies extra prompt inputs, so it must never block archiving.
+   If it exits non-zero or returns invalid JSON — for example on an older CLI that
+   does not support this command yet — continue the archive workflow with no
+   context and no operation guidance. Do not report an error and do not stop.
+
+   A successful response may omit both optional fields. Treat `context` as a
+   required prompt-level input: read and consider it, and apply relevant project
+   facts, conventions, and constraints. Treat `operationGuidance` as optional
+   additive advice: read and consider every entry, and follow entries that are
+   applicable and compatible with the built-in archive workflow.
+
+   Keep both fields separate from built-in steps, explicit user choices, resolved
+   paths, CLI checks, and command contracts. If context conflicts with one of those
+   controlling inputs, report the conflict and preserve the controlling value. If
+   guidance is inapplicable or conflicts with a controlling input, do not follow it
+   and explain why. Do not infer replacement paths, skipped prompts, or flags from
+   either field, and do not copy their text verbatim into specs, change artifacts,
+   or archive summaries unless the user separately asks for it. These are
+   prompt-level behavior contracts, not enforceable checks.
 
 2. **Check artifact completion status**
 
@@ -34,11 +66,11 @@ Archive a completed change in the experimental workflow.
    Parse the JSON to understand:
    - `schemaName`: The workflow being used
    - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context
-   - `artifacts`: List of artifacts with their status (`done` or other)
+   - `artifacts`: List of artifacts with their status (`done`, `skipped`, or other)
 
-   **If any artifacts are not `done`:**
+   **If any artifacts are neither `done` nor `skipped`** (skipped artifacts satisfy the requirement - the change declares skip_specs):
    - Display warning listing incomplete artifacts
-   - Use **AskUserQuestion tool** to confirm user wants to proceed
+   - Ask the user to confirm they want to proceed
    - Proceed if user confirms
 
 3. **Check task completion status**
@@ -49,17 +81,20 @@ Archive a completed change in the experimental workflow.
 
    **If incomplete tasks found:**
    - Display warning showing count of incomplete tasks
-   - Use **AskUserQuestion tool** to confirm user wants to proceed
+   - Ask the user to confirm they want to proceed
    - Proceed if user confirms
 
    **If no tasks file exists:** Proceed without task-related warning.
 
 4. **Assess delta spec sync state**
 
-   Use `artifactPaths.specs.existingOutputPaths` from status JSON to check for delta specs. If none exist, proceed without sync prompt.
+   Use `artifactPaths.specs.existingOutputPaths` from status JSON as the only
+   delta-spec source. If the `specs` entry is missing or
+   `existingOutputPaths` is empty, proceed without a sync prompt and do not infer
+   delta specs from other artifacts.
 
    **If delta specs exist:**
-   - Compare each delta spec with its corresponding main spec at `openspec/specs/<capability>/spec.md`
+   - Compare each delta spec with its corresponding main spec at `<planningHome.root>/openspec/specs/<capability-path>/spec.md` (use the store-aware `planningHome.root` from step 2, not a hardcoded repo path)
    - Determine what changes would be applied (adds, modifications, removals, renames)
    - Show a combined summary before prompting
 
@@ -67,7 +102,30 @@ Archive a completed change in the experimental workflow.
    - If changes needed: "Sync now (recommended)", "Archive without syncing"
    - If already synced: "Archive now", "Sync anyway", "Cancel"
 
-   If user chooses sync, use Task tool (subagent_type: "general-purpose", prompt: "Use Skill tool to invoke openspec-sync-specs for change '<name>'. Delta spec analysis: <include the analyzed delta spec summary>"). Proceed to archive regardless of choice.
+   Route on the answer:
+   - "Cancel" — stop, do not archive
+   - "Archive without syncing" or "Archive now" — proceed to archive
+   - "Sync now" or "Sync anyway" — sync, then verify (below)
+   - Anything else — ask again rather than archiving
+
+   Before a selected sync writes any main spec, run
+   `openspec instructions specs --change "<name>" --json` once with the same
+   selected-root flags. Require a zero exit status and valid artifact-instruction
+   JSON. If the lookup fails or returns invalid JSON, report the error and stop
+   before writing any main spec or moving the change. A valid response with omitted
+   `rules` is the no-rules case. Apply returned `rules` only to the content and
+   form of main specs produced by this merge; do not use them as archive guidance,
+   change CLI behavior, or copy the rule text into any output file.
+
+   Then run the `openspec-sync-specs` workflow inline (agent-driven intelligent merge) for change '<name>', passing the delta spec analysis and the fetched specs-rule snapshot from above, and wait for it to finish. The inline sync must reuse that snapshot without fetching `specs` instructions again. Do not delegate it to a background task — step 5 would move `changeRoot` out from under a sync that is still reading it, leaving the change archived and the main specs never updated. If your agent can only run it by delegation, delegate synchronously and wait for the result.
+
+   Then re-run the comparison from the top of this step against every capability that has a delta spec in `artifactPaths.specs.existingOutputPaths` — not only the ones the sync reports it touched. A successful sync leaves nothing left to apply, so each capability must now read as already synced:
+   - ADDED requirements present
+   - MODIFIED requirements carrying the scenario and description changes named in the delta, with their other scenarios intact
+   - REMOVED requirements gone — and where this sync retired a capability (removed its last requirement, leaving `## Requirements` empty), its main spec deleted rather than left empty; a spec the sync deliberately kept and reported is also a match
+   - RENAMED requirements present under the new name and absent under the old one
+
+   If the sync failed, or any capability does not match, report what differs and stop — do not archive. Nothing has moved and `changeRoot` is intact, so the user can fix the mismatch or re-run the sync and start the archive again.
 
 5. **Perform the archive**
 
@@ -76,14 +134,14 @@ Archive a completed change in the experimental workflow.
    mkdir -p "<planningHome.changesDir>/archive"
    ```
 
-   Generate target name using current date: `YYYY-MM-DD-<change-name>`
+   Generate the target name: use the change name as-is when it already starts with a `YYYY-MM-DD-` prefix; otherwise prepend the current date as `YYYY-MM-DD-<change-name>`. Never stack a second date (same rule as `openspec archive`).
 
    **Check if target already exists:**
    - If yes: Fail with error, suggest renaming existing archive or using different date
    - If no: Move `changeRoot` to the archive directory
 
    ```bash
-   mv "<changeRoot>" "<planningHome.changesDir>/archive/YYYY-MM-DD-<name>"
+   mv "<changeRoot>" "<planningHome.changesDir>/archive/<target-name>"
    ```
 
 6. **Display summary**
@@ -97,22 +155,28 @@ Archive a completed change in the experimental workflow.
 
 **Output On Success**
 
-```
+```markdown
 ## Archive Complete
 
 **Change:** <change-name>
 **Schema:** <schema-name>
-**Archived to:** the archive path derived from `planningHome.changesDir`/YYYY-MM-DD-<name>/
-**Specs:** ✓ Synced to main specs (or "No delta specs" or "Sync skipped")
+**Archived to:** the archive path derived from `planningHome.changesDir`/<target-name>/
+**Specs:** <"✓ Synced to main specs" only if the step 4 verification passed; otherwise "No delta specs" or "Sync skipped">
 
-All artifacts complete. All tasks complete.
+<"All artifacts complete. All tasks complete." — or, if archived with warnings, list them instead (e.g. "Archived with 2 incomplete tasks")>
 ```
 
 **Guardrails**
-- Always prompt for change selection if not provided
+- Announce the selected change; prompt for selection when it is ambiguous
 - Use artifact graph (openspec status --json) for completion checking
 - Don't block archive on warnings - just inform and confirm
 - Preserve .openspec.yaml when moving to archive (it moves with the directory)
 - Show clear summary of what happened
-- If sync is requested, use openspec-sync-specs approach (agent-driven)
+- If sync is requested, run the `openspec-sync-specs` workflow inline (agent-driven)
+- Never archive while a spec sync is still in flight — run the sync inline and verify the main specs before moving `changeRoot`
 - If delta specs exist, always run the sync assessment and show the combined summary before prompting
+- Apply relevant runtime context and report conflicts; operation guidance remains advisory
+- Consider every guidance entry and explain any inapplicable or conflicting advice
+- Existing CLI checks, resolved paths, prompts, and command contracts are unchanged
+- Artifact rules constrain only the specs being written and are never operation guidance
+- Never copy runtime context, operation guidance, or artifact-rule text verbatim into output files
diff --git a/.claude/skills/openspec-bulk-archive-change/SKILL.md b/.claude/skills/openspec-bulk-archive-change/SKILL.md
index 309152af7..0faa60c60 100644
--- a/.claude/skills/openspec-bulk-archive-change/SKILL.md
+++ b/.claude/skills/openspec-bulk-archive-change/SKILL.md
@@ -7,14 +7,16 @@ compatibility: Requires openspec CLI.
 metadata:
   author: openspec
   version: "1.0"
-  generatedBy: "1.6.0"
+  generatedBy: "1.10.0"
 ---
 
 Archive multiple completed changes in a single operation.
 
 This skill allows you to batch-archive changes, handling spec conflicts intelligently by checking the codebase to determine what's actually implemented.
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+`<capability-path>` is the spec directory relative to `specs/` (for example, `user-auth` or `identity/user-auth`). Preserve the full path from each delta spec when resolving its main spec.
 
 **Input**: None required (prompts for selection)
 
@@ -28,13 +30,38 @@ This skill allows you to batch-archive changes, handling spec conflicts intellig
 
 2. **Prompt for change selection**
 
-   Use **AskUserQuestion tool** with multi-select to let user choose changes:
+   Ask the user to choose changes (multi-select):
    - Show each change with its schema
    - Include an option for "All changes"
    - Allow any number of selections (1+ works, 2+ is the typical use case)
 
    **IMPORTANT**: Do NOT auto-select. Always let the user choose.
 
+   **Load current archive inputs once for the selected root before batch validation:**
+
+   Choose one selected change from this root and run
+   `openspec instructions archive --change "<selected-change>" --json` with the
+   same selected-root flags. This lookup is advisory and optional: it only supplies
+   extra prompt inputs, so it must never block the batch. If it fails or returns
+   invalid JSON — for example on an older CLI that does not support this command
+   yet — continue the batch with no context and no operation guidance. Do not
+   report an error and do not stop.
+
+   A valid response may omit `context` and `operationGuidance`. Treat
+   `context` as a required prompt-level input across the batch: read and consider
+   it, and apply relevant project facts, conventions, and constraints. Treat
+   `operationGuidance` as optional additive advice: read and consider every
+   entry, and follow entries that are applicable and compatible with the built-in
+   batch workflow.
+
+   Keep both fields separate from conflict analysis, explicit user choices,
+   resolved paths, CLI checks, and command contracts. If context conflicts with one
+   of those controlling inputs, report the conflict and preserve the controlling
+   value. If guidance is inapplicable or conflicts with a controlling input, do not
+   follow it and explain why. Do not infer skipped prompts, replacement paths, or
+   flags from either field, and do not copy their text verbatim into specs, changes,
+   or summaries. These are prompt-level behavior contracts, not enforceable checks.
+
 3. **Batch validation - gather status for all selected changes**
 
    For each selected change, collect:
@@ -50,17 +77,21 @@ This skill allows you to batch-archive changes, handling spec conflicts intellig
    c. **Delta specs** - Check `artifactPaths.specs.existingOutputPaths` from status JSON
       - List which capability specs exist
       - For each, extract requirement names (lines matching `### Requirement: <name>`)
-
+      - Treat this list as the only delta-spec source. If the `specs` entry is
+        missing or the list is empty, perform no spec sync or specs-instruction
+        lookup for that change; do not infer deltas from unrelated artifacts.
+      - Evaluate this independently for every change, including mixed-schema
+        batches where some schemas have no `specs` artifact.
 4. **Detect spec conflicts**
 
-   Build a map of `capability -> [changes that touch it]`:
+   Build a map keyed by `<capability-path>`, the exact path relative to `specs/`:
 
-   ```
-   auth -> [change-a, change-b]  <- CONFLICT (2+ changes)
-   api  -> [change-c]            <- OK (only 1 change)
+   ```text
+   identity/user-auth -> [change-a, change-b]  <- CONFLICT (2+ changes)
+   billing/user-auth  -> [change-c]            <- OK (different full path)
    ```
 
-   A conflict exists when 2+ selected changes have delta specs for the same capability.
+   A conflict exists when 2+ selected changes have delta specs for the exact same `<capability-path>`.
 
 5. **Resolve conflicts agentically**
 
@@ -78,38 +109,39 @@ This skill allows you to batch-archive changes, handling spec conflicts intellig
       - If neither implemented -> skip spec sync, warn user
 
    d. **Record resolution** for each conflict:
-      - Which change's specs to apply
-      - In what order (if both)
+      - An inclusion or exclusion decision for every delta spec, keyed by change and `<capability-path>`
+      - Which included delta specs to apply and in what order
+      - Which delta specs to exclude from sync because their implementation is missing
       - Rationale (what was found in codebase)
 
 6. **Show consolidated status table**
 
    Display a table summarizing all changes:
 
-   ```
+   ```markdown
    | Change              | Artifacts | Tasks | Specs   | Conflicts | Status |
    |---------------------|-----------|-------|---------|-----------|--------|
    | schema-management   | Done      | 5/5   | 2 delta | None      | Ready  |
    | project-config      | Done      | 3/3   | 1 delta | None      | Ready  |
-   | add-oauth           | Done      | 4/4   | 1 delta | auth (!)  | Ready* |
+   | add-oauth           | Done      | 4/4   | 1 delta | identity/user-auth (!) | Ready* |
    | add-verify-skill    | 1 left    | 2/5   | None    | None      | Warn   |
    ```
 
    For conflicts, show the resolution:
-   ```
+   ```text
    * Conflict resolution:
-     - auth spec: Will apply add-oauth then add-jwt (both implemented, chronological order)
+     - identity/user-auth spec: Will apply add-oauth then add-jwt (both implemented, chronological order)
    ```
 
    For incomplete changes, show warnings:
-   ```
+   ```text
    Warnings:
    - add-verify-skill: 1 incomplete artifact, 3 incomplete tasks
    ```
 
 7. **Confirm batch operation**
 
-   Use **AskUserQuestion tool** with a single confirmation:
+   Ask the user a single confirmation question:
 
    - "Archive N changes?" with options based on status
    - Options might include:
@@ -119,31 +151,73 @@ This skill allows you to batch-archive changes, handling spec conflicts intellig
 
    If there are incomplete changes, make clear they'll be archived with warnings.
 
+   Route on the answer by intent, not by exact label — you wrote these labels,
+   so match what the user picked rather than the wording above:
+   - "Cancel" — stop, do not archive. Report that nothing was archived and skip the remaining steps.
+   - The archive-everything option — proceed with every selected change
+   - The ready-only option — proceed with only the changes the step 6 table marks `Ready` or `Ready*`, and record the rest as Skipped in step 8d. If a `Ready*` change's conflict partner is skipped, re-derive that conflict's resolution using only the changes being archived.
+   - Anything else — ask again rather than archiving
+
+   Before step 8 writes the first main spec or moves any change, fetch every
+   required specs-rule snapshot for the confirmed batch. For each change that will
+   sync concrete `artifactPaths.specs.existingOutputPaths`, run
+   `openspec instructions specs --change "<name>" --json` exactly once with the
+   same selected-root flags. Obtain all snapshots before the first write or move.
+   If any lookup exits non-zero or returns invalid artifact-instruction JSON,
+   identify the affected change, report the error, and stop the whole batch before
+   any main-spec write or change move. Do not treat lookup failure as omitted
+   rules. A valid response without `rules` is the no-rules case.
+
 8. **Execute archive for each confirmed change**
 
+   Before processing, carry the recorded decisions from step 5 (after any step 7 re-derivation) into two per-delta sets:
+   - `includedDeltas`: all non-conflicting delta specs from confirmed changes plus conflict deltas selected for sync
+   - `excludedDeltas`: conflict deltas from confirmed changes excluded because their implementation is missing
+   - A single change can have both included and excluded delta specs. Keep the decision per delta; do not collapse it into a per-change sync flag.
+
    Process changes in the determined order (respecting conflict resolution):
 
-   a. **Sync specs** if delta specs exist:
-      - Use the openspec-sync-specs approach (agent-driven intelligent merge)
-      - For conflicts, apply in resolved order
-      - Track if sync was done
+   a. **Sync included delta specs**:
+      - Run the `openspec-sync-specs` workflow inline (agent-driven intelligent merge) only for changes with entries in `includedDeltas`, passing only the included delta paths and explicitly instructing it to ignore that change's `excludedDeltas`. Wait for it to finish.
+      - For conflicts, apply in resolved order.
+      - Pass that change's fetched specs-rule snapshot into inline sync; inline
+        sync must reuse it without fetching instructions again
+      - Apply artifact rules only to main specs produced by that change. They do
+        not change conflict resolution, archive behavior, or CLI contracts, and
+        their text is not copied into an output file
+      - Do not delegate to a background task — step 8c would move `changeRoot` out from under a sync that is still reading it.
+      - If a change has no included delta specs, do not run the sync workflow for it.
+
+   b. **Verify included delta specs before moving changeRoot**:
+      - Re-run the comparison only for delta specs in `includedDeltas` against main spec at `<planningHome.root>/openspec/specs/<capability-path>/spec.md` (use the store-aware `planningHome.root` from step 3 status JSON, not a hardcoded repo path).
+      - Verify that main specs are updated:
+        - ADDED requirements present
+        - MODIFIED requirements carrying scenario and description changes named in the delta, with their other scenarios intact
+        - REMOVED requirements gone — and where this sync retired a capability (removed its last requirement, leaving `## Requirements` empty), its main spec deleted rather than left empty; a spec the sync deliberately kept and reported is also a match
+        - RENAMED requirements present under the new name and absent under the old one
+      - Do not verify delta specs in `excludedDeltas`; they are intentionally left unsynced.
+      - If sync failed or any capability does not match verification, report what differs and fail/skip moving that change's `changeRoot` — do not archive that change. `changeRoot` remains intact.
+
+   c. **Perform the archive**:
+
+      Target name: use the change name as-is when it already starts with a `YYYY-MM-DD-` prefix; otherwise prepend the current date as `YYYY-MM-DD-<name>` (same rule as `openspec archive`).
 
-   b. **Perform the archive**:
       ```bash
       mkdir -p "<planningHome.changesDir>/archive"
-      mv "<changeRoot>" "<planningHome.changesDir>/archive/YYYY-MM-DD-<name>"
+      mv "<changeRoot>" "<planningHome.changesDir>/archive/<target-name>"
       ```
 
-   c. **Track outcome** for each change:
+   d. **Track outcome** for each change:
       - Success: archived successfully
-      - Failed: error during archive (record error)
+      - Failed: error during archive or spec verification (record error)
       - Skipped: user chose not to archive (if applicable)
+      - Sync skipped: for every delta in `excludedDeltas`, report `sync skipped` with the change, `<capability-path>`, and recorded reason. This is distinct from skipping the archive.
 
 9. **Display summary**
 
    Show final results:
 
-   ```
+   ```markdown
    ## Bulk Archive Complete
 
    Archived 3 changes:
@@ -156,11 +230,12 @@ This skill allows you to batch-archive changes, handling spec conflicts intellig
 
    Spec sync summary:
    - 4 delta specs synced to main specs
-   - 1 conflict resolved (auth: applied both in chronological order)
+   - 1 delta spec sync skipped (add-jwt, identity/user-auth: implementation not found)
+   - 1 conflict resolved (identity/user-auth: synced add-oauth, skipped add-jwt)
    ```
 
    If any failures:
-   ```
+   ```text
    Failed 1 change:
    - some-change: Archive directory already exists
    ```
@@ -168,8 +243,8 @@ This skill allows you to batch-archive changes, handling spec conflicts intellig
 **Conflict Resolution Examples**
 
 Example 1: Only one implemented
-```
-Conflict: specs/auth/spec.md touched by [add-oauth, add-jwt]
+```text
+Conflict: <planningHome.root>/openspec/specs/auth/spec.md touched by [add-oauth, add-jwt]
 
 Checking add-oauth:
 - Delta adds "OAuth Provider Integration" requirement
@@ -183,8 +258,8 @@ Resolution: Only add-oauth is implemented. Will sync add-oauth specs only.
 ```
 
 Example 2: Both implemented
-```
-Conflict: specs/api/spec.md touched by [add-rest-api, add-graphql]
+```text
+Conflict: <planningHome.root>/openspec/specs/api/spec.md touched by [add-rest-api, add-graphql]
 
 Checking add-rest-api (created 2026-01-10):
 - Delta adds "REST Endpoints" requirement
@@ -200,12 +275,12 @@ then add-graphql specs (chronological order, newer takes precedence).
 
 **Output On Success**
 
-```
+```markdown
 ## Bulk Archive Complete
 
 Archived N changes:
-- <change-1> -> archive/YYYY-MM-DD-<change-1>/
-- <change-2> -> archive/YYYY-MM-DD-<change-2>/
+- <change-1> -> archive/<target-name-1>/
+- <change-2> -> archive/<target-name-2>/
 
 Spec sync summary:
 - N delta specs synced to main specs
@@ -214,11 +289,11 @@ Spec sync summary:
 
 **Output On Partial Success**
 
-```
+```markdown
 ## Bulk Archive Complete (partial)
 
 Archived N changes:
-- <change-1> -> archive/YYYY-MM-DD-<change-1>/
+- <change-1> -> archive/<target-name-1>/
 
 Skipped M changes:
 - <change-2> (user chose not to archive incomplete)
@@ -229,7 +304,7 @@ Failed K changes:
 
 **Output When No Changes**
 
-```
+```markdown
 ## No Changes to Archive
 
 No active changes found. Create a new change to get started.
@@ -243,7 +318,22 @@ No active changes found. Create a new change to get started.
 - Skip spec sync only when implementation is missing (warn user)
 - Show clear per-change status before confirming
 - Use single confirmation for entire batch
+- Never archive after the user cancels the confirmation — a cancelled batch archives nothing
 - Track and report all outcomes (success/skip/fail)
 - Preserve .openspec.yaml when moving to archive
-- Archive directory target uses current date: YYYY-MM-DD-<name>
+- Archive directory target uses current date: YYYY-MM-DD-<name>; a name that already starts with a `YYYY-MM-DD-` prefix is used as-is (never stack a second date)
 - If archive target exists, fail that change but continue with others
+- If sync is requested, run the `openspec-sync-specs` workflow inline (agent-driven) for each change with included delta specs
+- Carry the per-delta `includedDeltas` and `excludedDeltas` decisions into execution; sync and verify only included deltas
+- Report every excluded delta as `sync skipped` without treating the archive itself as skipped
+- Never archive a change while a spec sync is still in flight — run the sync inline and verify main specs at `<planningHome.root>/openspec/specs/<capability-path>/spec.md` before moving `changeRoot`
+- Fetch archive inputs once per selected root before spec inspection or moves
+- Fetch all required specs-rule snapshots before the batch's first main-spec write or move
+- A failed archive-inputs lookup never blocks the batch; it proceeds with no context or guidance
+- A failed specs instruction lookup stops the whole batch atomically
+- Changes without concrete `artifactPaths.specs.existingOutputPaths` continue without spec sync
+- Apply relevant runtime context across the batch and report conflicts
+- Operation guidance remains advisory; consider every entry and explain rejected advice
+- Keep runtime inputs, conflict analysis, CLI-derived values, and artifact rules separate
+- Artifact rules constrain only written specs
+- Never copy runtime input or artifact-rule text verbatim into output files
diff --git a/.claude/skills/openspec-continue-change/SKILL.md b/.claude/skills/openspec-continue-change/SKILL.md
index 31b476f24..3a92585cd 100644
--- a/.claude/skills/openspec-continue-change/SKILL.md
+++ b/.claude/skills/openspec-continue-change/SKILL.md
@@ -7,22 +7,25 @@ compatibility: Requires openspec CLI.
 metadata:
   author: openspec
   version: "1.0"
-  generatedBy: "1.6.0"
+  generatedBy: "1.10.0"
 ---
 
 Continue working on a change by creating the next artifact.
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
 
 **Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
 
 **Steps**
 
-1. **If no change name provided, prompt for selection**
+1. **Select the change**
 
-   Run `openspec list --json` to get available changes sorted by most recently modified. Then use the **AskUserQuestion tool** to let the user select which change to work on.
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes sorted by most recently modified, and ask the user to select one
 
-   Present the top 3-4 most recently modified changes as options, showing:
+   When prompting, present the top 3-4 most recently modified changes as options, showing:
    - Change name
    - Schema (from `schema` field if present, otherwise "spec-driven")
    - Status (e.g., "0/5 tasks", "complete", "no tasks")
@@ -30,7 +33,7 @@ Continue working on a change by creating the next artifact.
 
    Mark the most recently modified change as "(Recommended)" since it's likely what the user wants to continue.
 
-   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+   Always announce: "Using change: <name>" and how to override (e.g., `/opsx:continue <other>`).
 
 2. **Check current status**
    ```bash
@@ -38,18 +41,18 @@ Continue working on a change by creating the next artifact.
    ```
    Parse the JSON to understand current state. The response includes:
    - `schemaName`: The workflow schema being used (e.g., "spec-driven")
-   - `artifacts`: Array of artifacts with their status ("done", "ready", "blocked")
-   - `isComplete`: Boolean indicating if all artifacts are complete
+   - `artifacts`: Array of artifacts with their status ("done", "skipped", "ready", "blocked")
+   - `isPlanningComplete`: Boolean indicating if all planning artifacts are complete. Older CLI versions expose the same value as `isComplete`.
    - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context. Use these instead of assuming repo-local paths.
 
 3. **Act based on status**:
 
    ---
 
-   **If all artifacts are complete (`isComplete: true`)**:
+   **If all planning artifacts are complete (`isPlanningComplete: true`, or legacy `isComplete: true`)**:
    - Congratulate the user
    - Show final status including the schema used
-   - Suggest: "All artifacts created! You can now implement this change or archive it."
+   - Suggest: "Planning is complete! You can now implement this change. Once implementation and any tracked work are complete, archive it."
    - STOP
 
    ---
@@ -66,10 +69,12 @@ Continue working on a change by creating the next artifact.
      - `template`: The structure to use for your output file
      - `instruction`: Schema-specific guidance
      - `resolvedOutputPath`: Resolved path or pattern to write the artifact
-     - `dependencies`: Completed artifacts to read for context
+     - `dependencies`: Completed artifacts to read for context (entries with `skipped: true` have no files - do not look for them)
+     - `skipped`/`warning`: present when the change declares skip_specs and this artifact must NOT be created - pick another artifact
    - **Create the artifact file**:
-     - Read any completed dependency files for context
-     - Use `template` as the structure - fill in its sections
+     - Read any completed dependency files for context - always re-read them from disk, even if you saw them earlier in the conversation (the user may have edited them)
+     - If the `instruction` field delegates creation to a specific skill or command, invoke it to produce the artifact instead of writing the file yourself, then verify the artifact file exists at `resolvedOutputPath`
+     - Otherwise use `template` as the structure - fill in its sections
      - Apply `context` and `rules` as constraints when writing - but do NOT copy them into the file
      - Write to the `resolvedOutputPath` specified in instructions. If it is a glob pattern, choose the concrete file path using the schema instruction and the change's context
    - Show what was created and what's now unlocked
@@ -97,22 +102,13 @@ After each invocation, show:
 
 **Artifact Creation Guidelines**
 
-The artifact types and their purpose depend on the schema. Use the `instruction` field from the instructions output to understand what to create.
+The artifact types and their purpose depend on the schema. The `instruction` field from the instructions output is the authoritative guidance for each artifact - follow it even when the artifact has a familiar name (proposal.md, tasks.md, etc.), since custom schemas may define different content or a different process for the same file names.
 
-Common artifact patterns:
-
-**spec-driven schema** (proposal → specs → design → tasks):
-- **proposal.md**: Ask user about the change if not clear. Fill in Why, What Changes, Capabilities, Impact.
-  - The Capabilities section is critical - each capability listed will need a spec file.
-- **specs/<capability>/spec.md**: Create one spec per capability listed in the proposal's Capabilities section (use the capability name, not the change name).
-- **design.md**: Document technical decisions, architecture, and implementation approach.
-- **tasks.md**: Break down implementation into checkboxed tasks.
-
-For other schemas, follow the `instruction` field from the CLI output.
+If the `instruction` field directs you to use a specific skill or command to create the artifact, invoke it instead of writing the artifact directly.
 
 **Guardrails**
 - Create ONE artifact per invocation
-- Always read dependency artifacts before creating a new one
+- Always read dependency artifacts before creating a new one - re-read from disk, not from conversation memory (files may have changed since you last saw them)
 - Never skip artifacts or create out of order
 - If context is unclear, ask the user before creating
 - Verify the artifact file exists after writing before marking progress
diff --git a/.claude/skills/openspec-explore/SKILL.md b/.claude/skills/openspec-explore/SKILL.md
index 771271a8f..2ff2f1d25 100644
--- a/.claude/skills/openspec-explore/SKILL.md
+++ b/.claude/skills/openspec-explore/SKILL.md
@@ -7,16 +7,16 @@ compatibility: Requires openspec CLI.
 metadata:
   author: openspec
   version: "1.0"
-  generatedBy: "1.6.0"
+  generatedBy: "1.10.0"
 ---
 
 Enter explore mode. Think deeply. Visualize freely. Follow the conversation wherever it goes.
 
-**IMPORTANT: Explore mode is for thinking, not implementing.** You may read files, search code, and investigate the codebase, but you must NEVER write code or implement features. If the user asks you to implement something, remind them to exit explore mode first and create a change proposal. You MAY create OpenSpec artifacts (proposals, designs, specs) if the user asks—that's capturing thinking, not implementing.
+**IMPORTANT: Explore mode is for thinking, not implementing.** You may read files, search code, and investigate the codebase, but you must NEVER write code or implement features. If the user asks you to implement something, remind them to exit explore mode first and create a change proposal. You MAY create OpenSpec artifacts (proposals, designs, specs) if the user asks—that's capturing thinking, not implementing. For a new change, scaffold it first as described below.
 
 **This is a stance, not a workflow.** There are no fixed steps, no required sequence, no mandatory outputs. You're a thinking partner helping the user explore.
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
 
 ---
 
@@ -94,6 +94,12 @@ This tells you:
 - Their names, schemas, and status
 - What the user might be working on
 
+Then read the project's own context from the resolved root - `<root.path>/openspec/config.yaml` (or `config.yml`). Use the `root.path` returned above, and skip this if neither file exists:
+- `context`: project background - tech stack, conventions, constraints
+- `rules`: keyed by artifact id - the entries for an artifact apply only when you write that artifact
+
+Ground your thinking in these. They are constraints for you to follow, not content to reproduce: do NOT copy them into the conversation or into any artifact you create.
+
 ### When no change exists
 
 Think freely. When insights crystallize, you might offer:
@@ -101,6 +107,15 @@ Think freely. When insights crystallize, you might offer:
 - "This feels solid enough to start a change. Want me to create a proposal?"
 - Or keep exploring - no pressure to formalize
 
+If the user asks you to capture the exploration as a new change, transition seamlessly into the requested capture:
+
+1. Run `openspec new change "<name>"` (with `--store <id>` when applicable) before creating any artifacts. Never create a new change directory under `openspec/changes/` by hand; the CLI scaffold creates required metadata such as `.openspec.yaml`. Keep the selected `--store <id>` on every applicable follow-up `status` and `instructions` command.
+2. Run `openspec status --change "<name>" --json` (append the confirmed `--store "<id>"` only for a registered standalone store), then process the requested artifacts in dependency order. For each requested artifact that is `ready`, run `openspec instructions "<artifact-id>" --change "<name>" --json` (append the confirmed `--store "<id>"` only for a registered standalone store). Before creating a requested artifact, evaluate any condition in its own `instruction` against the explored change; record a deliberate skip instead when the condition does not apply. If a requested artifact is blocked by a direct prerequisite the user did not request, run `openspec instructions "<prerequisite-id>" --change "<name>" --json` (append the confirmed `--store "<id>"` only for a registered standalone store) for that prerequisite whether it is `ready` or `blocked`. If its own `instruction` states a condition, evaluate that condition against the explored change and record a deliberate skip only when the condition does not apply. If the condition applies, or the prerequisite is not conditional, treat it as a normal prerequisite and ask before expanding the capture. Do not create an unrequested prerequisite unless the user approves.
+3. Follow the returned `template` and `instruction` fields. Read completed dependency files listed in `dependencies`, and apply `context` and `rules` as constraints without copying them into the artifact. If the instruction delegates creation to a specific skill or command, invoke it; otherwise write the artifact to `resolvedOutputPath`, using the instruction to choose a concrete path when it is a glob. Verify that the selected concrete output exists.
+4. After creating each artifact, re-run `openspec status --change "<name>" --json` (append the confirmed `--store "<id>"` only for a registered standalone store) and continue until every requested artifact is `done`, `skipped`, or was deliberately skipped because its own `instruction` stated a condition that did not apply. Tell the user about a deliberate conditional skip, remember it, and do not reconsider it. Dependencies are enablers, not gates: if a requested artifact is still `blocked` only because you deliberately skipped a conditional prerequisite, run `openspec instructions "<artifact-id>" --change "<name>" --json` (append the confirmed `--store "<id>"` only for a registered standalone store) despite the blocked status, then create it using step 3 only when those recorded conditional skips are its sole missing dependencies. If a requested artifact is blocked by a prerequisite the user did not ask to capture and cannot be conditionally skipped, explain that dependency and ask before expanding the capture.
+
+Capture the artifact(s) the user requested without asking them to invoke another workflow command. If they asked only to start a change, stop after scaffolding and show its status.
+
 ### When a change exists
 
 If the user mentions a change or you detect one is relevant:
@@ -116,14 +131,16 @@ If the user mentions a change or you detect one is relevant:
 
 3. **Offer to capture when decisions are made**
 
-    | Insight Type               | Where to Capture               |
-    |----------------------------|--------------------------------|
-    | New requirement discovered | `specs/<capability>/spec.md` |
-    | Requirement changed        | `specs/<capability>/spec.md` |
-    | Design decision made       | `design.md`                  |
-    | Scope changed              | `proposal.md`                |
-    | New work identified        | `tasks.md`                   |
-    | Assumption invalidated     | Relevant artifact              |
+   `<capability-path>` is the spec directory relative to `specs/` (for example, `user-auth` or `identity/user-auth`). Preserve an existing capability's full path and follow the project's established organization for new capabilities.
+
+    | Insight Type               | Where to Capture                    |
+    |----------------------------|-------------------------------------|
+    | New requirement discovered | `specs/<capability-path>/spec.md` |
+    | Requirement changed        | `specs/<capability-path>/spec.md` |
+    | Design decision made       | `design.md`                       |
+    | Scope changed              | `proposal.md`                     |
+    | New work identified        | `tasks.md`                        |
+    | Assumption invalidated     | Relevant artifact                   |
 
    Example offers:
    - "That's a design decision. Capture it in design.md?"
@@ -285,6 +302,7 @@ But this summary is optional. Sometimes the thinking IS the value.
 - **Don't rush** - Discovery is thinking time, not task time
 - **Don't force structure** - Let patterns emerge naturally
 - **Don't auto-capture** - Offer to save insights, don't just do it
+- **Don't manually scaffold changes** - Never create a new change directory under `openspec/changes/` by hand. Always use `openspec new change "<name>"` (with `--store <id>` when applicable) so required metadata such as `.openspec.yaml` is created before writing artifacts.
 - **Do visualize** - A good diagram is worth many paragraphs
 - **Do explore the codebase** - Ground discussions in reality
 - **Do question assumptions** - Including the user's and your own
diff --git a/.claude/skills/openspec-ff-change/SKILL.md b/.claude/skills/openspec-ff-change/SKILL.md
index 61fab93de..d552d554a 100644
--- a/.claude/skills/openspec-ff-change/SKILL.md
+++ b/.claude/skills/openspec-ff-change/SKILL.md
@@ -7,12 +7,12 @@ compatibility: Requires openspec CLI.
 metadata:
   author: openspec
   version: "1.0"
-  generatedBy: "1.6.0"
+  generatedBy: "1.10.0"
 ---
 
 Fast-forward through artifact creation - generate everything needed to start implementation in one go.
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
 
 **Input**: The user's request should include a change name (kebab-case) OR a description of what they want to build.
 
@@ -20,7 +20,7 @@ Fast-forward through artifact creation - generate everything needed to start imp
 
 1. **If no clear input provided, ask what they want to build**
 
-   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
+   Ask the user (open-ended, no preset options):
    > "What change do you want to work on? Describe what you want to build or fix."
 
    From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
@@ -39,12 +39,12 @@ Fast-forward through artifact creation - generate everything needed to start imp
    ```
    Parse the JSON to get:
    - `applyRequires`: array of artifact IDs needed before implementation (e.g., `["tasks"]`)
-   - `artifacts`: list of all artifacts with their status and dependencies
+   - `artifacts`: list of all artifacts, each with its `status` and its `requires` edges (the artifact IDs it directly depends on)
    - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context. Use these instead of assuming repo-local paths.
 
-4. **Create artifacts in sequence until apply-ready**
+4. **Create every artifact in the required set**
 
-   Use the **TodoWrite tool** to track progress through the artifacts.
+   Use a todo list to track progress through the artifacts.
 
    Loop through artifacts in dependency order (artifacts with no pending dependencies first):
 
@@ -58,20 +58,27 @@ Fast-forward through artifact creation - generate everything needed to start imp
         - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
         - `template`: The structure to use for your output file
         - `instruction`: Schema-specific guidance for this artifact type
+        - `skipped`/`warning`: present when the change declares skip_specs and this artifact must NOT be created - stop and pick another artifact
         - `resolvedOutputPath`: Resolved path or pattern to write the artifact
         - `dependencies`: Completed artifacts to read for context
-      - Read any completed dependency files for context
-      - Create the artifact file using `template` as the structure and write it to `resolvedOutputPath`
+      - Read any completed dependency files for context - always re-read them from disk, even if you saw them earlier in the conversation (the user may have edited them)
+      - If the `instruction` field delegates creation to a specific skill or command, invoke it to produce the artifact instead of writing the file yourself, then verify the artifact file exists at `resolvedOutputPath`
+      - Otherwise create the artifact file using `template` as the structure and write it to `resolvedOutputPath`. If `resolvedOutputPath` is a glob, follow `instruction` to choose the concrete file path
       - Apply `context` and `rules` as constraints - but do NOT copy them into the file
       - Show brief progress: "✓ Created <artifact-id>"
 
-   b. **Continue until all `applyRequires` artifacts are complete**
+   b. **Continue until every artifact in the required set exists (not just `apply.requires`)**
       - After creating each artifact, re-run `openspec status --change "<name>" --json`
-      - Check if every artifact ID in `applyRequires` has `status: "done"` in the artifacts array
-      - Stop when all `applyRequires` artifacts are done
+      - The required set is `applyRequires` plus every artifact reachable from those by following the `requires` edges in `status --json` - walk them transitively (spec-driven closes over proposal, specs, design, tasks). Leave artifacts outside that set alone
+      - `status` is file-existence only, so an `applyRequires` artifact reading `done` does NOT mean its dependencies exist - writing `tasks.md` early marks `tasks` done while `specs` was never written. Use each artifact's `requires` edges, not its `status`, to build the required set: a `done` artifact still lists what it depends on
+      - An artifact already reading `status: "skipped"` is satisfied: the change declares `skip_specs` in `.openspec.yaml`, so its files must NOT exist. Never try to create one
+      - Create every artifact in the required set that is missing, then re-check - creating one can unblock others
+      - Skip one only when `status` already reports it `skipped`, or when its own `instruction` says it is conditional: run `openspec instructions <artifact-id> --change "<name>" --json` and skip only if its `instruction` field marks it optional (e.g. "create only if..."). Spec-driven's `design.md` qualifies; `specs` qualifies only via the `skipped` status above, never by your own judgment. Tell the user, and do not reconsider it
+      - Dependencies are enablers, not gates: if a required artifact is still `blocked` only because you skipped a conditional dependency, write it anyway
+      - Stop when every artifact in the required set is `done`, `skipped`, or was deliberately skipped
 
    c. **If an artifact requires user input** (unclear context):
-      - Use **AskUserQuestion tool** to clarify
+      - Ask the user to clarify
       - Then continue with creation
 
 5. **Show final status**
@@ -83,13 +90,14 @@ Fast-forward through artifact creation - generate everything needed to start imp
 
 After completing all artifacts, summarize:
 - Change name and location
-- List of artifacts created with brief descriptions
-- What's ready: "All artifacts created! Ready for implementation."
+- List of artifacts created with brief descriptions, plus any conditional artifact you skipped and why
+- What's ready: "All artifacts needed for implementation are ready."
 - Prompt: "Run `/opsx:apply` or ask me to implement to start working on the tasks."
 
 **Artifact Creation Guidelines**
 
-- Follow the `instruction` field from `openspec instructions` for each artifact type
+- Follow the `instruction` field from `openspec instructions` for each artifact type - it is the authoritative guidance, even for familiar artifact names
+- If the `instruction` field directs you to use a specific skill or command to create the artifact, invoke it instead of writing the artifact directly
 - The schema defines what each artifact should contain - follow it
 - Read dependency artifacts for context before creating new ones
 - Use `template` as the structure for your output file - fill in its sections
@@ -98,8 +106,8 @@ After completing all artifacts, summarize:
   - These guide what you write, but should never appear in the output
 
 **Guardrails**
-- Create ALL artifacts needed for implementation (as defined by schema's `apply.requires`)
-- Always read dependency artifacts before creating a new one
+- Create every artifact the apply phase transitively depends on, not just the ids listed in `apply.requires`
+- Always read dependency artifacts before creating a new one - re-read from disk, not from conversation memory (files may have changed since you last saw them)
 - If context is critically unclear, ask the user - but prefer making reasonable decisions to keep momentum
 - If a change with that name already exists, suggest continuing that change instead
 - Verify each artifact file exists after writing before proceeding to next
diff --git a/.claude/skills/openspec-new-change/SKILL.md b/.claude/skills/openspec-new-change/SKILL.md
index b4d8a9e70..88c6005da 100644
--- a/.claude/skills/openspec-new-change/SKILL.md
+++ b/.claude/skills/openspec-new-change/SKILL.md
@@ -7,12 +7,12 @@ compatibility: Requires openspec CLI.
 metadata:
   author: openspec
   version: "1.0"
-  generatedBy: "1.6.0"
+  generatedBy: "1.10.0"
 ---
 
 Start a new change using the experimental artifact-driven approach.
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
 
 **Input**: The user's request should include a change name (kebab-case) OR a description of what they want to build.
 
@@ -20,7 +20,7 @@ Start a new change using the experimental artifact-driven approach.
 
 1. **If no clear input provided, ask what they want to build**
 
-   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
+   Ask the user (open-ended, no preset options):
    > "What change do you want to work on? Describe what you want to build or fix."
 
    From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
diff --git a/.claude/skills/openspec-onboard/SKILL.md b/.claude/skills/openspec-onboard/SKILL.md
index ac4ac6fee..5b15e1b77 100644
--- a/.claude/skills/openspec-onboard/SKILL.md
+++ b/.claude/skills/openspec-onboard/SKILL.md
@@ -7,12 +7,12 @@ compatibility: Requires openspec CLI.
 metadata:
   author: openspec
   version: "1.0"
-  generatedBy: "1.6.0"
+  generatedBy: "1.10.0"
 ---
 
 Guide the user through their first complete OpenSpec workflow cycle. This is a teaching experience—you'll do real work in their codebase while explaining each step.
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
 
 ---
 
@@ -211,6 +211,11 @@ I'll draft one based on our task.
 
 **DO:** Draft the proposal content (don't save yet):
 
+`<capability-path>` is the spec directory relative to `specs/` (for example,
+`user-auth` or `identity/user-auth`). Use the exact existing path for modified
+capabilities. For new capabilities, follow the project's established spec
+organization.
+
 ```
 Here's a draft proposal:
 
@@ -227,10 +232,11 @@ Here's a draft proposal:
 ## Capabilities
 
 ### New Capabilities
-- `<capability-name>`: [brief description]
+- `<capability-path>`: [brief description]
 
 ### Modified Capabilities
 <!-- If modifying existing behavior -->
+- `<existing-capability-path>`: [brief description]
 
 ## Impact
 
@@ -368,12 +374,12 @@ Here are the implementation tasks:
 
 ## 1. [Category or file]
 
-- [ ] 1.1 [Specific task]
-- [ ] 1.2 [Specific task]
+- [ ] 1.1 [Specific task] — verify: [test, command, observable behavior, or delivered artifact]
+- [ ] 1.2 [Specific task] — verify: [test, command, observable behavior, or delivered artifact]
 
-## 2. Verify
+## 2. Integration Verification
 
-- [ ] 2.1 [Verification step]
+- [ ] 2.1 Verify [broader integration or system behavior] with [end-to-end test or observable result]
 
 ---
 
@@ -431,14 +437,14 @@ When a change is complete, we archive it. The archive path is derived from `plan
 Archived changes become your project's decision history—you can always find them later to understand why something was built a certain way.
 ```
 
-**DO:**
+**DO:** Archive the change (`--yes` answers the confirmation prompts, which you cannot answer from a tool call):
 ```bash
-openspec archive "<name>"
+openspec archive "<name>" --yes
 ```
 
 **SHOW:**
 ```
-Archived to: `<planningHome.changesDir>/archive/YYYY-MM-DD-<name>/`
+Archived to: `<planningHome.changesDir>/archive/<target-name>/` (the target name prepends today's date, unless the name already starts with a `YYYY-MM-DD-` prefix — then it is kept as-is, no second date)
 
 The change is now part of your project's history. The code is in your codebase, the decision record is preserved.
 ```
@@ -476,7 +482,7 @@ This same rhythm works for any size change—a small fix or a major feature.
  | `/opsx:apply`   | Implement tasks from a change              |
  | `/opsx:archive` | Archive a completed change                 |
 
-**Additional commands:**
+**Additional commands** (only if installed - availability depends on your profile):
 
  | Command            | What it does                                             |
  |--------------------|----------------------------------------------------------|
@@ -504,7 +510,7 @@ If the user says they need to stop, want to pause, or seem disengaged:
 No problem! Your change is saved at the `changeRoot` reported by `openspec status --change "<name>" --json`.
 
 To pick up where we left off later:
-- `/opsx:continue <name>` - Resume artifact creation
+- `/opsx:continue <name>` - Resume artifact creation (if installed; otherwise `openspec status --change "<name>" --json` shows the next artifact)
 - `/opsx:apply <name>` - Jump to implementation (if tasks exist)
 
 The work won't be lost. Come back whenever you're ready.
@@ -528,7 +534,7 @@ If the user says they just want to see the commands or skip the tutorial:
  | `/opsx:apply <name>`   | Implement tasks                            |
  | `/opsx:archive <name>` | Archive when done                          |
 
-**Additional commands:**
+**Additional commands** (only if installed - availability depends on your profile):
 
  | Command                   | What it does                        |
  |---------------------------|-------------------------------------|
diff --git a/.claude/skills/openspec-sync-specs/SKILL.md b/.claude/skills/openspec-sync-specs/SKILL.md
index b6aad67ab..90436fa88 100644
--- a/.claude/skills/openspec-sync-specs/SKILL.md
+++ b/.claude/skills/openspec-sync-specs/SKILL.md
@@ -7,26 +7,31 @@ compatibility: Requires openspec CLI.
 metadata:
   author: openspec
   version: "1.0"
-  generatedBy: "1.6.0"
+  generatedBy: "1.10.0"
 ---
 
 Sync delta specs from a change to main specs.
 
 This is an **agent-driven** operation - you will read delta specs and directly edit main specs to apply the changes. This allows intelligent merging (e.g., adding a scenario without copying the entire requirement).
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+`<capability-path>` is the spec directory relative to `specs/` (for example, `user-auth` or `identity/user-auth`). Preserve the full path from each delta spec when resolving its main spec.
 
 **Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
 
 **Steps**
 
-1. **If no change name provided, prompt for selection**
+1. **Select the change**
 
-   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes and ask the user to select one
 
-   Show changes that have delta specs (under `specs/` directory).
+   When prompting, show changes that have delta specs (under `specs/` directory).
 
-   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+   Always announce: "Using change: <name>" and how to override (e.g., `/opsx:sync <other>`).
 
 2. **Resolve change context**
 
@@ -35,9 +40,29 @@ This is an **agent-driven** operation - you will read delta specs and directly e
    openspec status --change "<name>" --json
    ```
 
+   The JSON includes `planningHome.root`. Main specs live under `<planningHome.root>/openspec/specs/` — use that (store-aware) root for every main-spec path below, not a hardcoded repo path. When a store is selected it points at the store, not the current repository.
+
 3. **Find delta specs**
 
-   Use `artifactPaths.specs.existingOutputPaths` from the status JSON as the list of delta spec files.
+   Use `artifactPaths.specs.existingOutputPaths` from the status JSON as the
+   only source of delta spec paths. If the `specs` entry is missing or
+   `existingOutputPaths` is empty, report that there are no delta specs to sync,
+   do not infer them from other artifacts, and stop without requesting artifact
+   instructions or writing a main spec.
+
+   Sync every path in `existingOutputPaths` unless the caller narrowed the set.
+   A caller narrows it by naming an explicit list of complete entries from
+   `existingOutputPaths` — copy those absolute values verbatim. Archive does
+   this inline, and a user can too (for example, by selecting the entry ending
+   in `/specs/billing/invoices/spec.md`).
+   Then sync only the named paths and leave the remaining delta specs untouched:
+   bulk archive excludes a delta whose implementation it could not find, and
+   syncing it anyway would write a main spec the caller deliberately withheld.
+   Carry that narrowed selection through step 4; never widen it back to the full
+   list. If a named path is not in `existingOutputPaths`, do not sync it —
+   report it and stop, rather than dropping it silently. If the named list is
+   empty, report that there is nothing to sync and stop without writing a main
+   spec.
 
    Each delta spec file contains sections like:
    - `## ADDED Requirements` - New requirements to add
@@ -49,11 +74,27 @@ This is an **agent-driven** operation - you will read delta specs and directly e
 
 4. **For each delta spec, apply changes to main specs**
 
-   For each repo-local capability delta spec path returned by the CLI:
+   Before the first main-spec write, obtain one current specs-rule snapshot:
+   - If archive invoked this workflow inline and supplied a valid snapshot from
+     `openspec instructions specs --change "<name>" --json`, reuse it and do not
+     fetch the same instructions again.
+   - Otherwise run that command once now with the same selected-root flags.
+   - If the direct lookup exits non-zero or returns invalid artifact-instruction
+     JSON, report the error and stop before writing any main spec. Do not treat the
+     failure as an absent rule set.
+   - A valid response with omitted `rules` means no artifact rules are configured
+     and the existing semantic merge continues.
+
+   Apply returned `rules` only to the content and form of the main specs produced
+   by this merge. Artifact rules are not operation guidance and cannot change
+   selected roots, delta paths, CLI checks, or workflow steps. Use their text as
+   constraints without copying it verbatim into a main spec or summary.
+
+   For each capability delta spec path selected in step 3 — the full `existingOutputPaths` list, or the narrowed subset when a caller supplied one (these may belong to a selected store, not the repo):
 
    a. **Read the delta spec** to understand the intended changes
 
-   b. **Read the main spec** at `openspec/specs/<capability>/spec.md` (may not exist yet)
+   b. **Read the main spec** at `<planningHome.root>/openspec/specs/<capability-path>/spec.md` (may not exist yet)
 
    c. **Apply changes intelligently**:
 
@@ -64,31 +105,72 @@ This is an **agent-driven** operation - you will read delta specs and directly e
       **MODIFIED Requirements:**
       - Find the requirement in main spec
       - Apply the changes - this can be:
-        - Adding new scenarios (don't need to copy existing ones)
+        - Adding new scenarios the main spec does not have yet
         - Modifying existing scenarios
         - Changing the requirement description
       - Preserve scenarios/content not mentioned in the delta
 
       **REMOVED Requirements:**
       - Remove the entire requirement block from main spec
+      - Retiring the capability. Delete the whole `spec.md` - and the directory once
+        nothing else is left in it - only when ALL of these hold:
+        1. removing the requirements *this run* left no requirement blocks;
+        2. the rest of the spec is well-formed (it still has a `## Purpose`);
+        3. the main spec was not already empty before this sync - if you removed
+           nothing, change nothing;
+        4. every other nonblank line in the whole file is accounted for as the
+           title, Purpose, Requirements header, or a canonical requirement's
+           statement, scenarios, or fenced examples;
+        5. the change's `.openspec.yaml` declares `retire_capabilities: true`;
+        6. the `spec.md` resolves inside the real specs root (do not follow a
+           capability-directory symlink to delete an external file).
+        If removing the selected requirements would leave no requirement blocks and
+        any retirement condition is not satisfied, do not modify the main spec. Stop
+        the sync for that capability, report the blocking condition, and tell the user
+        how to resolve it. Never write or leave an empty `## Requirements` section.
+        When only the marker is missing, say that too - it is the one thing the user
+        can add to make the retirement go through.
+      - Deleting the file also deletes its `## Purpose`; any other section blocks
+        retirement. Name Purpose when you report the retirement. Include a pasteable
+        `git checkout` only when the spec lived in the caller's checkout;
+        otherwise give checkout-scoped recovery guidance.
 
       **RENAMED Requirements:**
       - Find the FROM requirement, rename to TO
 
+      **`## Purpose` in the delta:**
+      - The main spec already has one and it is authoritative - leave it alone
+        (this is what `openspec archive` does; it warns and moves on)
+
    d. **Create new main spec** if capability doesn't exist yet:
-      - Create `openspec/specs/<capability>/spec.md`
-      - Add Purpose section (can be brief, mark as TBD)
+      - Create `<planningHome.root>/openspec/specs/<capability-path>/spec.md`
+      - Add Purpose section: copy the delta's `## Purpose` body verbatim when it has one
+        (this is what `openspec archive` does); only write a brief TBD placeholder when it does not
       - Add Requirements section with the ADDED requirements
+      - Follow the **Main Spec Format Reference** below
+
+5. **Validate updated main specs**
 
-5. **Show summary**
+   Run `openspec validate --specs` with the same selected-root flags used earlier.
+   If validation fails, report the problems and do not claim the sync succeeded.
+
+6. **Show summary**
 
    After applying all changes, summarize:
    - Which capabilities were updated
    - What changes were made (requirements added/modified/removed/renamed)
+   - Any new main spec left with a TBD Purpose placeholder, so it gets written
+     now rather than lingering
+   - Any capability retired, naming the deleted `spec.md`, its Purpose, and
+     either a pasteable `git checkout` or checkout-scoped recovery guidance
 
 **Delta Spec Format Reference**
 
 ```markdown
+## Purpose
+
+Only on a delta that introduces a brand-new capability. Seeds the new main spec.
+
 ## ADDED Requirements
 
 ### Requirement: New Feature
@@ -101,6 +183,12 @@ The system SHALL do something new.
 ## MODIFIED Requirements
 
 ### Requirement: Existing Feature
+The system SHALL keep doing the existing thing, now also handling A.
+
+#### Scenario: Scenario the main spec already has
+- **WHEN** user does X
+- **THEN** system does Y
+
 #### Scenario: New scenario to add
 - **WHEN** user does A
 - **THEN** system does B
@@ -115,16 +203,36 @@ The system SHALL do something new.
 - TO: `### Requirement: New Name`
 ```
 
+**Main Spec Format Reference**
+
+Main specs are what the delta merges INTO. They must never contain delta operation headers (`## ADDED/MODIFIED/REMOVED/RENAMED Requirements`) - after syncing, every requirement lives under a single `## Requirements` section:
+
+```markdown
+# <capability> Specification
+
+## Purpose
+Short description of what this capability does and why it exists.
+
+## Requirements
+
+### Requirement: New Feature
+The system SHALL do something new.
+
+#### Scenario: Basic case
+- **WHEN** user does X
+- **THEN** system does Y
+```
+
 **Key Principle: Intelligent Merging**
 
-Unlike programmatic merging, you can apply **partial updates**:
-- To add a scenario, just include that scenario under MODIFIED - don't copy existing scenarios
-- The delta represents *intent*, not a wholesale replacement
+Unlike programmatic merging, you merge rather than overwrite:
+- A MODIFIED block carries the whole requirement - body plus every scenario that survives the change. `openspec validate` and `openspec archive` both reject one that drops a scenario the main spec still has.
+- Keep anything the delta does not mention, in the main spec's existing order
 - Use your judgment to merge changes sensibly
 
 **Output On Success**
 
-```
+```markdown
 ## Specs Synced: <change-name>
 
 Updated main specs:
@@ -143,6 +251,12 @@ Main specs are now updated. The change remains active - archive when implementat
 **Guardrails**
 - Read both delta and main specs before making changes
 - Preserve existing content not mentioned in delta
+- Never copy a delta file into a main spec as-is - merge its content so the main spec keeps the Main Spec Format Reference structure, with no delta operation headers
 - If something is unclear, ask for clarification
 - Show what you're changing as you go
 - The operation should be idempotent - running twice should give same result
+- Use only `artifactPaths.specs.existingOutputPaths`; never infer delta specs from unrelated artifacts
+- Honor a caller-supplied subset of `existingOutputPaths`; never widen it back to the full list
+- Fetch specs instructions once for direct sync, or reuse the archive-supplied snapshot inline
+- Stop before every main-spec write on a non-zero or invalid JSON specs-instruction response
+- Artifact rules constrain only the specs being written and are never copied into output files
diff --git a/.claude/skills/openspec-verify-change/SKILL.md b/.claude/skills/openspec-verify-change/SKILL.md
index b6557c6ff..314b5dbeb 100644
--- a/.claude/skills/openspec-verify-change/SKILL.md
+++ b/.claude/skills/openspec-verify-change/SKILL.md
@@ -7,26 +7,29 @@ compatibility: Requires openspec CLI.
 metadata:
   author: openspec
   version: "1.0"
-  generatedBy: "1.6.0"
+  generatedBy: "1.10.0"
 ---
 
 Verify that an implementation matches the change artifacts (specs, tasks, design).
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
 
 **Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
 
 **Steps**
 
-1. **If no change name provided, prompt for selection**
+1. **Select the change**
 
-   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes and ask the user to select one
 
-   Show changes that have implementation tasks (tasks artifact exists).
+   When prompting, show changes that have implementation tasks (tasks artifact exists).
    Include the schema used for each change if available.
    Mark changes with incomplete tasks as "(In Progress)".
 
-   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+   Always announce: "Using change: <name>" and how to override (e.g., `/opsx:verify <other>`).
 
 2. **Check status to understand the schema**
    ```bash
@@ -114,7 +117,7 @@ Verify that an implementation matches the change artifacts (specs, tasks, design
 8. **Generate Verification Report**
 
    **Summary Scorecard**:
-   ```
+   ```markdown
    ## Verification Report: <change-name>
 
    ### Summary
diff --git a/.codex/skills/openspec-archive-change/SKILL.md b/.codex/skills/openspec-archive-change/SKILL.md
deleted file mode 100644
index c0c169d14..000000000
--- a/.codex/skills/openspec-archive-change/SKILL.md
+++ /dev/null
@@ -1,118 +0,0 @@
----
-name: openspec-archive-change
-description: Archive a completed change in the experimental workflow. Use when the user wants to finalize and archive a change after implementation is complete.
-allowed-tools: Bash(openspec:*)
-license: MIT
-compatibility: Requires openspec CLI.
-metadata:
-  author: openspec
-  version: "1.0"
-  generatedBy: "1.6.0"
----
-
-Archive a completed change in the experimental workflow.
-
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
-
-**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
-
-**Steps**
-
-1. **If no change name provided, prompt for selection**
-
-   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
-
-   Show only active changes (not already archived).
-   Include the schema used for each change if available.
-
-   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
-
-2. **Check artifact completion status**
-
-   Run `openspec status --change "<name>" --json` to check artifact completion.
-
-   Parse the JSON to understand:
-   - `schemaName`: The workflow being used
-   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context
-   - `artifacts`: List of artifacts with their status (`done` or other)
-
-   **If any artifacts are not `done`:**
-   - Display warning listing incomplete artifacts
-   - Use **AskUserQuestion tool** to confirm user wants to proceed
-   - Proceed if user confirms
-
-3. **Check task completion status**
-
-   Read the tasks file (typically `tasks.md`) to check for incomplete tasks.
-
-   Count tasks marked with `- [ ]` (incomplete) vs `- [x]` (complete).
-
-   **If incomplete tasks found:**
-   - Display warning showing count of incomplete tasks
-   - Use **AskUserQuestion tool** to confirm user wants to proceed
-   - Proceed if user confirms
-
-   **If no tasks file exists:** Proceed without task-related warning.
-
-4. **Assess delta spec sync state**
-
-   Use `artifactPaths.specs.existingOutputPaths` from status JSON to check for delta specs. If none exist, proceed without sync prompt.
-
-   **If delta specs exist:**
-   - Compare each delta spec with its corresponding main spec at `openspec/specs/<capability>/spec.md`
-   - Determine what changes would be applied (adds, modifications, removals, renames)
-   - Show a combined summary before prompting
-
-   **Prompt options:**
-   - If changes needed: "Sync now (recommended)", "Archive without syncing"
-   - If already synced: "Archive now", "Sync anyway", "Cancel"
-
-   If user chooses sync, use Task tool (subagent_type: "general-purpose", prompt: "Use Skill tool to invoke openspec-sync-specs for change '<name>'. Delta spec analysis: <include the analyzed delta spec summary>"). Proceed to archive regardless of choice.
-
-5. **Perform the archive**
-
-   Create an `archive` directory under `planningHome.changesDir` if it doesn't exist:
-   ```bash
-   mkdir -p "<planningHome.changesDir>/archive"
-   ```
-
-   Generate target name using current date: `YYYY-MM-DD-<change-name>`
-
-   **Check if target already exists:**
-   - If yes: Fail with error, suggest renaming existing archive or using different date
-   - If no: Move `changeRoot` to the archive directory
-
-   ```bash
-   mv "<changeRoot>" "<planningHome.changesDir>/archive/YYYY-MM-DD-<name>"
-   ```
-
-6. **Display summary**
-
-   Show archive completion summary including:
-   - Change name
-   - Schema that was used
-   - Archive location
-   - Whether specs were synced (if applicable)
-   - Note about any warnings (incomplete artifacts/tasks)
-
-**Output On Success**
-
-```
-## Archive Complete
-
-**Change:** <change-name>
-**Schema:** <schema-name>
-**Archived to:** the archive path derived from `planningHome.changesDir`/YYYY-MM-DD-<name>/
-**Specs:** ✓ Synced to main specs (or "No delta specs" or "Sync skipped")
-
-All artifacts complete. All tasks complete.
-```
-
-**Guardrails**
-- Always prompt for change selection if not provided
-- Use artifact graph (openspec status --json) for completion checking
-- Don't block archive on warnings - just inform and confirm
-- Preserve .openspec.yaml when moving to archive (it moves with the directory)
-- Show clear summary of what happened
-- If sync is requested, use openspec-sync-specs approach (agent-driven)
-- If delta specs exist, always run the sync assessment and show the combined summary before prompting
diff --git a/.codex/skills/openspec-bulk-archive-change/SKILL.md b/.codex/skills/openspec-bulk-archive-change/SKILL.md
deleted file mode 100644
index 309152af7..000000000
--- a/.codex/skills/openspec-bulk-archive-change/SKILL.md
+++ /dev/null
@@ -1,249 +0,0 @@
----
-name: openspec-bulk-archive-change
-description: Archive multiple completed changes at once. Use when archiving several parallel changes.
-allowed-tools: Bash(openspec:*)
-license: MIT
-compatibility: Requires openspec CLI.
-metadata:
-  author: openspec
-  version: "1.0"
-  generatedBy: "1.6.0"
----
-
-Archive multiple completed changes in a single operation.
-
-This skill allows you to batch-archive changes, handling spec conflicts intelligently by checking the codebase to determine what's actually implemented.
-
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
-
-**Input**: None required (prompts for selection)
-
-**Steps**
-
-1. **Get active changes**
-
-   Run `openspec list --json` to get all active changes.
-
-   If no active changes exist, inform user and stop.
-
-2. **Prompt for change selection**
-
-   Use **AskUserQuestion tool** with multi-select to let user choose changes:
-   - Show each change with its schema
-   - Include an option for "All changes"
-   - Allow any number of selections (1+ works, 2+ is the typical use case)
-
-   **IMPORTANT**: Do NOT auto-select. Always let the user choose.
-
-3. **Batch validation - gather status for all selected changes**
-
-   For each selected change, collect:
-
-   a. **Artifact status** - Run `openspec status --change "<name>" --json`
-      - Parse `schemaName`, `artifacts`, `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`
-      - Note which artifacts are `done` vs other states
-
-   b. **Task completion** - Read `artifactPaths.tasks.existingOutputPaths` from status JSON
-      - Count `- [ ]` (incomplete) vs `- [x]` (complete)
-      - If no tasks file exists, note as "No tasks"
-
-   c. **Delta specs** - Check `artifactPaths.specs.existingOutputPaths` from status JSON
-      - List which capability specs exist
-      - For each, extract requirement names (lines matching `### Requirement: <name>`)
-
-4. **Detect spec conflicts**
-
-   Build a map of `capability -> [changes that touch it]`:
-
-   ```
-   auth -> [change-a, change-b]  <- CONFLICT (2+ changes)
-   api  -> [change-c]            <- OK (only 1 change)
-   ```
-
-   A conflict exists when 2+ selected changes have delta specs for the same capability.
-
-5. **Resolve conflicts agentically**
-
-   **For each conflict**, investigate the codebase:
-
-   a. **Read the delta specs** from each conflicting change to understand what each claims to add/modify
-
-   b. **Search the codebase** for implementation evidence:
-      - Look for code implementing requirements from each delta spec
-      - Check for related files, functions, or tests
-
-   c. **Determine resolution**:
-      - If only one change is actually implemented -> sync that one's specs
-      - If both implemented -> apply in chronological order (older first, newer overwrites)
-      - If neither implemented -> skip spec sync, warn user
-
-   d. **Record resolution** for each conflict:
-      - Which change's specs to apply
-      - In what order (if both)
-      - Rationale (what was found in codebase)
-
-6. **Show consolidated status table**
-
-   Display a table summarizing all changes:
-
-   ```
-   | Change              | Artifacts | Tasks | Specs   | Conflicts | Status |
-   |---------------------|-----------|-------|---------|-----------|--------|
-   | schema-management   | Done      | 5/5   | 2 delta | None      | Ready  |
-   | project-config      | Done      | 3/3   | 1 delta | None      | Ready  |
-   | add-oauth           | Done      | 4/4   | 1 delta | auth (!)  | Ready* |
-   | add-verify-skill    | 1 left    | 2/5   | None    | None      | Warn   |
-   ```
-
-   For conflicts, show the resolution:
-   ```
-   * Conflict resolution:
-     - auth spec: Will apply add-oauth then add-jwt (both implemented, chronological order)
-   ```
-
-   For incomplete changes, show warnings:
-   ```
-   Warnings:
-   - add-verify-skill: 1 incomplete artifact, 3 incomplete tasks
-   ```
-
-7. **Confirm batch operation**
-
-   Use **AskUserQuestion tool** with a single confirmation:
-
-   - "Archive N changes?" with options based on status
-   - Options might include:
-     - "Archive all N changes"
-     - "Archive only N ready changes (skip incomplete)"
-     - "Cancel"
-
-   If there are incomplete changes, make clear they'll be archived with warnings.
-
-8. **Execute archive for each confirmed change**
-
-   Process changes in the determined order (respecting conflict resolution):
-
-   a. **Sync specs** if delta specs exist:
-      - Use the openspec-sync-specs approach (agent-driven intelligent merge)
-      - For conflicts, apply in resolved order
-      - Track if sync was done
-
-   b. **Perform the archive**:
-      ```bash
-      mkdir -p "<planningHome.changesDir>/archive"
-      mv "<changeRoot>" "<planningHome.changesDir>/archive/YYYY-MM-DD-<name>"
-      ```
-
-   c. **Track outcome** for each change:
-      - Success: archived successfully
-      - Failed: error during archive (record error)
-      - Skipped: user chose not to archive (if applicable)
-
-9. **Display summary**
-
-   Show final results:
-
-   ```
-   ## Bulk Archive Complete
-
-   Archived 3 changes:
-   - schema-management-cli -> archive/2026-01-19-schema-management-cli/
-   - project-config -> archive/2026-01-19-project-config/
-   - add-oauth -> archive/2026-01-19-add-oauth/
-
-   Skipped 1 change:
-   - add-verify-skill (user chose not to archive incomplete)
-
-   Spec sync summary:
-   - 4 delta specs synced to main specs
-   - 1 conflict resolved (auth: applied both in chronological order)
-   ```
-
-   If any failures:
-   ```
-   Failed 1 change:
-   - some-change: Archive directory already exists
-   ```
-
-**Conflict Resolution Examples**
-
-Example 1: Only one implemented
-```
-Conflict: specs/auth/spec.md touched by [add-oauth, add-jwt]
-
-Checking add-oauth:
-- Delta adds "OAuth Provider Integration" requirement
-- Searching codebase... found src/auth/oauth.ts implementing OAuth flow
-
-Checking add-jwt:
-- Delta adds "JWT Token Handling" requirement
-- Searching codebase... no JWT implementation found
-
-Resolution: Only add-oauth is implemented. Will sync add-oauth specs only.
-```
-
-Example 2: Both implemented
-```
-Conflict: specs/api/spec.md touched by [add-rest-api, add-graphql]
-
-Checking add-rest-api (created 2026-01-10):
-- Delta adds "REST Endpoints" requirement
-- Searching codebase... found src/api/rest.ts
-
-Checking add-graphql (created 2026-01-15):
-- Delta adds "GraphQL Schema" requirement
-- Searching codebase... found src/api/graphql.ts
-
-Resolution: Both implemented. Will apply add-rest-api specs first,
-then add-graphql specs (chronological order, newer takes precedence).
-```
-
-**Output On Success**
-
-```
-## Bulk Archive Complete
-
-Archived N changes:
-- <change-1> -> archive/YYYY-MM-DD-<change-1>/
-- <change-2> -> archive/YYYY-MM-DD-<change-2>/
-
-Spec sync summary:
-- N delta specs synced to main specs
-- No conflicts (or: M conflicts resolved)
-```
-
-**Output On Partial Success**
-
-```
-## Bulk Archive Complete (partial)
-
-Archived N changes:
-- <change-1> -> archive/YYYY-MM-DD-<change-1>/
-
-Skipped M changes:
-- <change-2> (user chose not to archive incomplete)
-
-Failed K changes:
-- <change-3>: Archive directory already exists
-```
-
-**Output When No Changes**
-
-```
-## No Changes to Archive
-
-No active changes found. Create a new change to get started.
-```
-
-**Guardrails**
-- Allow any number of changes (1+ is fine, 2+ is the typical use case)
-- Always prompt for selection, never auto-select
-- Detect spec conflicts early and resolve by checking codebase
-- When both changes are implemented, apply specs in chronological order
-- Skip spec sync only when implementation is missing (warn user)
-- Show clear per-change status before confirming
-- Use single confirmation for entire batch
-- Track and report all outcomes (success/skip/fail)
-- Preserve .openspec.yaml when moving to archive
-- Archive directory target uses current date: YYYY-MM-DD-<name>
-- If archive target exists, fail that change but continue with others
diff --git a/.codex/skills/openspec-continue-change/SKILL.md b/.codex/skills/openspec-continue-change/SKILL.md
deleted file mode 100644
index 31b476f24..000000000
--- a/.codex/skills/openspec-continue-change/SKILL.md
+++ /dev/null
@@ -1,122 +0,0 @@
----
-name: openspec-continue-change
-description: Continue working on an OpenSpec change by creating the next artifact. Use when the user wants to progress their change, create the next artifact, or continue their workflow.
-allowed-tools: Bash(openspec:*)
-license: MIT
-compatibility: Requires openspec CLI.
-metadata:
-  author: openspec
-  version: "1.0"
-  generatedBy: "1.6.0"
----
-
-Continue working on a change by creating the next artifact.
-
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
-
-**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
-
-**Steps**
-
-1. **If no change name provided, prompt for selection**
-
-   Run `openspec list --json` to get available changes sorted by most recently modified. Then use the **AskUserQuestion tool** to let the user select which change to work on.
-
-   Present the top 3-4 most recently modified changes as options, showing:
-   - Change name
-   - Schema (from `schema` field if present, otherwise "spec-driven")
-   - Status (e.g., "0/5 tasks", "complete", "no tasks")
-   - How recently it was modified (from `lastModified` field)
-
-   Mark the most recently modified change as "(Recommended)" since it's likely what the user wants to continue.
-
-   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
-
-2. **Check current status**
-   ```bash
-   openspec status --change "<name>" --json
-   ```
-   Parse the JSON to understand current state. The response includes:
-   - `schemaName`: The workflow schema being used (e.g., "spec-driven")
-   - `artifacts`: Array of artifacts with their status ("done", "ready", "blocked")
-   - `isComplete`: Boolean indicating if all artifacts are complete
-   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context. Use these instead of assuming repo-local paths.
-
-3. **Act based on status**:
-
-   ---
-
-   **If all artifacts are complete (`isComplete: true`)**:
-   - Congratulate the user
-   - Show final status including the schema used
-   - Suggest: "All artifacts created! You can now implement this change or archive it."
-   - STOP
-
-   ---
-
-   **If artifacts are ready to create** (status shows artifacts with `status: "ready"`):
-   - Pick the FIRST artifact with `status: "ready"` from the status output
-   - Get its instructions:
-     ```bash
-     openspec instructions <artifact-id> --change "<name>" --json
-     ```
-   - Parse the JSON. The key fields are:
-     - `context`: Project background (constraints for you - do NOT include in output)
-     - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
-     - `template`: The structure to use for your output file
-     - `instruction`: Schema-specific guidance
-     - `resolvedOutputPath`: Resolved path or pattern to write the artifact
-     - `dependencies`: Completed artifacts to read for context
-   - **Create the artifact file**:
-     - Read any completed dependency files for context
-     - Use `template` as the structure - fill in its sections
-     - Apply `context` and `rules` as constraints when writing - but do NOT copy them into the file
-     - Write to the `resolvedOutputPath` specified in instructions. If it is a glob pattern, choose the concrete file path using the schema instruction and the change's context
-   - Show what was created and what's now unlocked
-   - STOP after creating ONE artifact
-
-   ---
-
-   **If no artifacts are ready (all blocked)**:
-   - This shouldn't happen with a valid schema
-   - Show status and suggest checking for issues
-
-4. **After creating an artifact, show progress**
-   ```bash
-   openspec status --change "<name>"
-   ```
-
-**Output**
-
-After each invocation, show:
-- Which artifact was created
-- Schema workflow being used
-- Current progress (N/M complete)
-- What artifacts are now unlocked
-- Prompt: "Want to continue? Just ask me to continue or tell me what to do next."
-
-**Artifact Creation Guidelines**
-
-The artifact types and their purpose depend on the schema. Use the `instruction` field from the instructions output to understand what to create.
-
-Common artifact patterns:
-
-**spec-driven schema** (proposal → specs → design → tasks):
-- **proposal.md**: Ask user about the change if not clear. Fill in Why, What Changes, Capabilities, Impact.
-  - The Capabilities section is critical - each capability listed will need a spec file.
-- **specs/<capability>/spec.md**: Create one spec per capability listed in the proposal's Capabilities section (use the capability name, not the change name).
-- **design.md**: Document technical decisions, architecture, and implementation approach.
-- **tasks.md**: Break down implementation into checkboxed tasks.
-
-For other schemas, follow the `instruction` field from the CLI output.
-
-**Guardrails**
-- Create ONE artifact per invocation
-- Always read dependency artifacts before creating a new one
-- Never skip artifacts or create out of order
-- If context is unclear, ask the user before creating
-- Verify the artifact file exists after writing before marking progress
-- Use the schema's artifact sequence, don't assume specific artifact names
-- **IMPORTANT**: `context` and `rules` are constraints for YOU, not content for the file
-  - Do NOT copy `<context>`, `<rules>`, `<project_context>` blocks into the artifact
-  - These guide what you write, but should never appear in the output
diff --git a/.codex/skills/openspec-ff-change/SKILL.md b/.codex/skills/openspec-ff-change/SKILL.md
deleted file mode 100644
index 61fab93de..000000000
--- a/.codex/skills/openspec-ff-change/SKILL.md
+++ /dev/null
@@ -1,105 +0,0 @@
----
-name: openspec-ff-change
-description: Fast-forward through OpenSpec artifact creation. Use when the user wants to quickly create all artifacts needed for implementation without stepping through each one individually.
-allowed-tools: Bash(openspec:*)
-license: MIT
-compatibility: Requires openspec CLI.
-metadata:
-  author: openspec
-  version: "1.0"
-  generatedBy: "1.6.0"
----
-
-Fast-forward through artifact creation - generate everything needed to start implementation in one go.
-
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
-
-**Input**: The user's request should include a change name (kebab-case) OR a description of what they want to build.
-
-**Steps**
-
-1. **If no clear input provided, ask what they want to build**
-
-   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
-   > "What change do you want to work on? Describe what you want to build or fix."
-
-   From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
-
-   **IMPORTANT**: Do NOT proceed without understanding what the user wants to build.
-
-2. **Create the change directory**
-   ```bash
-   openspec new change "<name>"
-   ```
-   This creates a scaffolded change in the planning home resolved by the CLI.
-
-3. **Get the artifact build order**
-   ```bash
-   openspec status --change "<name>" --json
-   ```
-   Parse the JSON to get:
-   - `applyRequires`: array of artifact IDs needed before implementation (e.g., `["tasks"]`)
-   - `artifacts`: list of all artifacts with their status and dependencies
-   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context. Use these instead of assuming repo-local paths.
-
-4. **Create artifacts in sequence until apply-ready**
-
-   Use the **TodoWrite tool** to track progress through the artifacts.
-
-   Loop through artifacts in dependency order (artifacts with no pending dependencies first):
-
-   a. **For each artifact that is `ready` (dependencies satisfied)**:
-      - Get instructions:
-        ```bash
-        openspec instructions <artifact-id> --change "<name>" --json
-        ```
-      - The instructions JSON includes:
-        - `context`: Project background (constraints for you - do NOT include in output)
-        - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
-        - `template`: The structure to use for your output file
-        - `instruction`: Schema-specific guidance for this artifact type
-        - `resolvedOutputPath`: Resolved path or pattern to write the artifact
-        - `dependencies`: Completed artifacts to read for context
-      - Read any completed dependency files for context
-      - Create the artifact file using `template` as the structure and write it to `resolvedOutputPath`
-      - Apply `context` and `rules` as constraints - but do NOT copy them into the file
-      - Show brief progress: "✓ Created <artifact-id>"
-
-   b. **Continue until all `applyRequires` artifacts are complete**
-      - After creating each artifact, re-run `openspec status --change "<name>" --json`
-      - Check if every artifact ID in `applyRequires` has `status: "done"` in the artifacts array
-      - Stop when all `applyRequires` artifacts are done
-
-   c. **If an artifact requires user input** (unclear context):
-      - Use **AskUserQuestion tool** to clarify
-      - Then continue with creation
-
-5. **Show final status**
-   ```bash
-   openspec status --change "<name>"
-   ```
-
-**Output**
-
-After completing all artifacts, summarize:
-- Change name and location
-- List of artifacts created with brief descriptions
-- What's ready: "All artifacts created! Ready for implementation."
-- Prompt: "Run `/opsx:apply` or ask me to implement to start working on the tasks."
-
-**Artifact Creation Guidelines**
-
-- Follow the `instruction` field from `openspec instructions` for each artifact type
-- The schema defines what each artifact should contain - follow it
-- Read dependency artifacts for context before creating new ones
-- Use `template` as the structure for your output file - fill in its sections
-- **IMPORTANT**: `context` and `rules` are constraints for YOU, not content for the file
-  - Do NOT copy `<context>`, `<rules>`, `<project_context>` blocks into the artifact
-  - These guide what you write, but should never appear in the output
-
-**Guardrails**
-- Create ALL artifacts needed for implementation (as defined by schema's `apply.requires`)
-- Always read dependency artifacts before creating a new one
-- If context is critically unclear, ask the user - but prefer making reasonable decisions to keep momentum
-- If a change with that name already exists, suggest continuing that change instead
-- Verify each artifact file exists after writing before proceeding to next
diff --git a/.codex/skills/openspec-new-change/SKILL.md b/.codex/skills/openspec-new-change/SKILL.md
deleted file mode 100644
index b4d8a9e70..000000000
--- a/.codex/skills/openspec-new-change/SKILL.md
+++ /dev/null
@@ -1,77 +0,0 @@
----
-name: openspec-new-change
-description: Start a new OpenSpec change using the experimental artifact workflow. Use when the user wants to create a new feature, fix, or modification with a structured step-by-step approach.
-allowed-tools: Bash(openspec:*)
-license: MIT
-compatibility: Requires openspec CLI.
-metadata:
-  author: openspec
-  version: "1.0"
-  generatedBy: "1.6.0"
----
-
-Start a new change using the experimental artifact-driven approach.
-
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
-
-**Input**: The user's request should include a change name (kebab-case) OR a description of what they want to build.
-
-**Steps**
-
-1. **If no clear input provided, ask what they want to build**
-
-   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
-   > "What change do you want to work on? Describe what you want to build or fix."
-
-   From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
-
-   **IMPORTANT**: Do NOT proceed without understanding what the user wants to build.
-
-2. **Determine the workflow schema**
-
-   Use the default schema (omit `--schema`) unless the user explicitly requests a different workflow.
-
-   **Use a different schema only if the user mentions:**
-   - A specific schema name → use `--schema <name>`
-   - "show workflows" or "what workflows" → run `openspec schemas --json` and let them choose
-
-   **Otherwise**: Omit `--schema` to use the default.
-
-3. **Create the change directory**
-   ```bash
-   openspec new change "<name>"
-   ```
-   Add `--schema <name>` only if the user requested a specific workflow.
-   This creates a scaffolded change in the planning home resolved by the CLI.
-
-4. **Show the artifact status**
-   ```bash
-   openspec status --change "<name>" --json
-   ```
-   Use the returned `planningHome`, `changeRoot`, `artifactPaths`, and `nextSteps` instead of assuming repo-local paths.
-
-5. **Get instructions for the first artifact**
-   The first artifact depends on the schema (e.g., `proposal` for spec-driven).
-   Check the status output to find the first artifact with status "ready".
-   ```bash
-   openspec instructions <first-artifact-id> --change "<name>"
-   ```
-   This outputs the template and context for creating the first artifact.
-
-6. **STOP and wait for user direction**
-
-**Output**
-
-After completing the steps, summarize:
-- Change name and location
-- Schema/workflow being used and its artifact sequence
-- Current status (0/N artifacts complete)
-- The template for the first artifact
-- Prompt: "Ready to create the first artifact? Just describe what this change is about and I'll draft it, or ask me to continue."
-
-**Guardrails**
-- Do NOT create any artifacts yet - just show the instructions
-- Do NOT advance beyond showing the first artifact template
-- If the name is invalid (not kebab-case), ask for a valid name
-- If a change with that name already exists, suggest continuing that change instead
-- Pass --schema if using a non-default workflow
diff --git a/.codex/skills/openspec-sync-specs/SKILL.md b/.codex/skills/openspec-sync-specs/SKILL.md
deleted file mode 100644
index b6aad67ab..000000000
--- a/.codex/skills/openspec-sync-specs/SKILL.md
+++ /dev/null
@@ -1,148 +0,0 @@
----
-name: openspec-sync-specs
-description: Sync delta specs from a change to main specs. Use when the user wants to update main specs with changes from a delta spec, without archiving the change.
-allowed-tools: Bash(openspec:*)
-license: MIT
-compatibility: Requires openspec CLI.
-metadata:
-  author: openspec
-  version: "1.0"
-  generatedBy: "1.6.0"
----
-
-Sync delta specs from a change to main specs.
-
-This is an **agent-driven** operation - you will read delta specs and directly edit main specs to apply the changes. This allows intelligent merging (e.g., adding a scenario without copying the entire requirement).
-
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
-
-**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
-
-**Steps**
-
-1. **If no change name provided, prompt for selection**
-
-   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
-
-   Show changes that have delta specs (under `specs/` directory).
-
-   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
-
-2. **Resolve change context**
-
-   Run:
-   ```bash
-   openspec status --change "<name>" --json
-   ```
-
-3. **Find delta specs**
-
-   Use `artifactPaths.specs.existingOutputPaths` from the status JSON as the list of delta spec files.
-
-   Each delta spec file contains sections like:
-   - `## ADDED Requirements` - New requirements to add
-   - `## MODIFIED Requirements` - Changes to existing requirements
-   - `## REMOVED Requirements` - Requirements to remove
-   - `## RENAMED Requirements` - Requirements to rename (FROM:/TO: format)
-
-   If no delta specs found, inform user and stop.
-
-4. **For each delta spec, apply changes to main specs**
-
-   For each repo-local capability delta spec path returned by the CLI:
-
-   a. **Read the delta spec** to understand the intended changes
-
-   b. **Read the main spec** at `openspec/specs/<capability>/spec.md` (may not exist yet)
-
-   c. **Apply changes intelligently**:
-
-      **ADDED Requirements:**
-      - If requirement doesn't exist in main spec → add it
-      - If requirement already exists → update it to match (treat as implicit MODIFIED)
-
-      **MODIFIED Requirements:**
-      - Find the requirement in main spec
-      - Apply the changes - this can be:
-        - Adding new scenarios (don't need to copy existing ones)
-        - Modifying existing scenarios
-        - Changing the requirement description
-      - Preserve scenarios/content not mentioned in the delta
-
-      **REMOVED Requirements:**
-      - Remove the entire requirement block from main spec
-
-      **RENAMED Requirements:**
-      - Find the FROM requirement, rename to TO
-
-   d. **Create new main spec** if capability doesn't exist yet:
-      - Create `openspec/specs/<capability>/spec.md`
-      - Add Purpose section (can be brief, mark as TBD)
-      - Add Requirements section with the ADDED requirements
-
-5. **Show summary**
-
-   After applying all changes, summarize:
-   - Which capabilities were updated
-   - What changes were made (requirements added/modified/removed/renamed)
-
-**Delta Spec Format Reference**
-
-```markdown
-## ADDED Requirements
-
-### Requirement: New Feature
-The system SHALL do something new.
-
-#### Scenario: Basic case
-- **WHEN** user does X
-- **THEN** system does Y
-
-## MODIFIED Requirements
-
-### Requirement: Existing Feature
-#### Scenario: New scenario to add
-- **WHEN** user does A
-- **THEN** system does B
-
-## REMOVED Requirements
-
-### Requirement: Deprecated Feature
-
-## RENAMED Requirements
-
-- FROM: `### Requirement: Old Name`
-- TO: `### Requirement: New Name`
-```
-
-**Key Principle: Intelligent Merging**
-
-Unlike programmatic merging, you can apply **partial updates**:
-- To add a scenario, just include that scenario under MODIFIED - don't copy existing scenarios
-- The delta represents *intent*, not a wholesale replacement
-- Use your judgment to merge changes sensibly
-
-**Output On Success**
-
-```
-## Specs Synced: <change-name>
-
-Updated main specs:
-
-**<capability-1>**:
-- Added requirement: "New Feature"
-- Modified requirement: "Existing Feature" (added 1 scenario)
-
-**<capability-2>**:
-- Created new spec file
-- Added requirement: "Another Feature"
-
-Main specs are now updated. The change remains active - archive when implementation is complete.
-```
-
-**Guardrails**
-- Read both delta and main specs before making changes
-- Preserve existing content not mentioned in delta
-- If something is unclear, ask for clarification
-- Show what you're changing as you go
-- The operation should be idempotent - running twice should give same result
diff --git a/.codex/skills/openspec-verify-change/SKILL.md b/.codex/skills/openspec-verify-change/SKILL.md
deleted file mode 100644
index b6557c6ff..000000000
--- a/.codex/skills/openspec-verify-change/SKILL.md
+++ /dev/null
@@ -1,172 +0,0 @@
----
-name: openspec-verify-change
-description: Verify implementation matches change artifacts. Use when the user wants to validate that implementation is complete, correct, and coherent before archiving.
-allowed-tools: Bash(openspec:*)
-license: MIT
-compatibility: Requires openspec CLI.
-metadata:
-  author: openspec
-  version: "1.0"
-  generatedBy: "1.6.0"
----
-
-Verify that an implementation matches the change artifacts (specs, tasks, design).
-
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
-
-**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
-
-**Steps**
-
-1. **If no change name provided, prompt for selection**
-
-   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
-
-   Show changes that have implementation tasks (tasks artifact exists).
-   Include the schema used for each change if available.
-   Mark changes with incomplete tasks as "(In Progress)".
-
-   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
-
-2. **Check status to understand the schema**
-   ```bash
-   openspec status --change "<name>" --json
-   ```
-   Parse the JSON to understand:
-   - `schemaName`: The workflow being used (e.g., "spec-driven")
-   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context
-   - Which artifacts exist for this change
-
-3. **Get planning context and load artifacts**
-
-   ```bash
-   openspec instructions apply --change "<name>" --json
-   ```
-
-   This returns the change directory and `contextFiles` (artifact ID -> array of concrete file paths). Read all available artifacts from `contextFiles`.
-
-4. **Initialize verification report structure**
-
-   Create a report structure with three dimensions:
-   - **Completeness**: Track tasks and spec coverage
-   - **Correctness**: Track requirement implementation and scenario coverage
-   - **Coherence**: Track design adherence and pattern consistency
-
-   Each dimension can have CRITICAL, WARNING, or SUGGESTION issues.
-
-5. **Verify Completeness**
-
-   **Task Completion**:
-   - If `contextFiles.tasks` exists, read every file path in it
-   - Parse checkboxes: `- [ ]` (incomplete) vs `- [x]` (complete)
-   - Count complete vs total tasks
-   - If incomplete tasks exist:
-     - Add CRITICAL issue for each incomplete task
-     - Recommendation: "Complete task: <description>" or "Mark as done if already implemented"
-
-   **Spec Coverage**:
-   - If delta specs exist in `contextFiles.specs`:
-     - Extract all requirements (marked with "### Requirement:")
-     - For each requirement:
-       - Search codebase for keywords related to the requirement
-       - Assess if implementation likely exists
-     - If requirements appear unimplemented:
-       - Add CRITICAL issue: "Requirement not found: <requirement name>"
-       - Recommendation: "Implement requirement X: <description>"
-
-6. **Verify Correctness**
-
-   **Requirement Implementation Mapping**:
-   - For each requirement from delta specs:
-     - Search codebase for implementation evidence
-     - If found, note file paths and line ranges
-     - Assess if implementation matches requirement intent
-     - If divergence detected:
-       - Add WARNING: "Implementation may diverge from spec: <details>"
-       - Recommendation: "Review <file>:<lines> against requirement X"
-
-   **Scenario Coverage**:
-   - For each scenario in delta specs (marked with "#### Scenario:"):
-     - Check if conditions are handled in code
-     - Check if tests exist covering the scenario
-     - If scenario appears uncovered:
-       - Add WARNING: "Scenario not covered: <scenario name>"
-       - Recommendation: "Add test or implementation for scenario: <description>"
-
-7. **Verify Coherence**
-
-   **Design Adherence**:
-   - If `contextFiles.design` exists:
-     - Extract key decisions (look for sections like "Decision:", "Approach:", "Architecture:")
-     - Verify implementation follows those decisions
-     - If contradiction detected:
-       - Add WARNING: "Design decision not followed: <decision>"
-       - Recommendation: "Update implementation or revise design.md to match reality"
-   - If no design.md: Skip design adherence check, note "No design.md to verify against"
-
-   **Code Pattern Consistency**:
-   - Review new code for consistency with project patterns
-   - Check file naming, directory structure, coding style
-   - If significant deviations found:
-     - Add SUGGESTION: "Code pattern deviation: <details>"
-     - Recommendation: "Consider following project pattern: <example>"
-
-8. **Generate Verification Report**
-
-   **Summary Scorecard**:
-   ```
-   ## Verification Report: <change-name>
-
-   ### Summary
-   | Dimension    | Status           |
-   |--------------|------------------|
-   | Completeness | X/Y tasks, N reqs|
-   | Correctness  | M/N reqs covered |
-   | Coherence    | Followed/Issues  |
-   ```
-
-   **Issues by Priority**:
-
-   1. **CRITICAL** (Must fix before archive):
-      - Incomplete tasks
-      - Missing requirement implementations
-      - Each with specific, actionable recommendation
-
-   2. **WARNING** (Should fix):
-      - Spec/design divergences
-      - Missing scenario coverage
-      - Each with specific recommendation
-
-   3. **SUGGESTION** (Nice to fix):
-      - Pattern inconsistencies
-      - Minor improvements
-      - Each with specific recommendation
-
-   **Final Assessment**:
-   - If CRITICAL issues: "X critical issue(s) found. Fix before archiving."
-   - If only warnings: "No critical issues. Y warning(s) to consider. Ready for archive (with noted improvements)."
-   - If all clear: "All checks passed. Ready for archive."
-
-**Verification Heuristics**
-
-- **Completeness**: Focus on objective checklist items (checkboxes, requirements list)
-- **Correctness**: Use keyword search, file path analysis, reasonable inference - don't require perfect certainty
-- **Coherence**: Look for glaring inconsistencies, don't nitpick style
-- **False Positives**: When uncertain, prefer SUGGESTION over WARNING, WARNING over CRITICAL
-- **Actionability**: Every issue must have a specific recommendation with file/line references where applicable
-
-**Graceful Degradation**
-
-- If only tasks.md exists: verify task completion only, skip spec/design checks
-- If tasks + specs exist: verify completeness and correctness, skip design
-- If full artifacts: verify all three dimensions
-- Always note which checks were skipped and why
-
-**Output Format**
-
-Use clear markdown with:
-- Table for summary scorecard
-- Grouped lists for issues (CRITICAL/WARNING/SUGGESTION)
-- Code references in format: `file.ts:123`
-- Specific, actionable recommendations
-- No vague suggestions like "consider reviewing"
diff --git a/.github/workflows/compass-ci.yml b/.github/workflows/compass-ci.yml
index a6f0d8e3b..e01dc8016 100644
--- a/.github/workflows/compass-ci.yml
+++ b/.github/workflows/compass-ci.yml
@@ -60,11 +60,46 @@ jobs:
       - run: npm run package -w editors/vscode
       - run: npm run smoke:vsix -w editors/vscode
 
+  installed-agent-packages:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: "24.13.1"
+          cache: npm
+      - name: Install pinned agent harnesses
+        run: |
+          npm install --global \
+            @openai/codex@0.146.0 \
+            @anthropic-ai/claude-code@2.1.251 \
+            opencode-ai@1.18.23
+      - name: Install pinned Rust toolchain
+        uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # master
+        with:
+          toolchain: 1.97.1
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+        with:
+          workspaces: .
+      - run: npm ci
+      - name: Verify generated OpenCode plugin
+        run: |
+          npm run typecheck -w @compass/opencode-plugin
+          npm run test -w @compass/opencode-plugin
+      - name: Build the completed phase once
+        run: cargo build -p compass-cli --bin compass --locked
+      - name: Qualify installed native packages
+        run: scripts/qualify_harness_packages.sh --compass target/debug/compass
+
   quality:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: "24.13.1"
+
       - name: Enforce Compass product boundary
         run: sh scripts/check_product_boundary.sh
 
@@ -78,21 +113,24 @@ jobs:
         with:
           workspaces: .
 
-      - name: Install pinned nextest runner
-        uses: taiki-e/install-action@07b4745e0c39a41822af610387492e3e53aa222b # v2
-        with:
-          tool: nextest@0.9.124
-
       - name: Formatting
         run: cargo fmt --all -- --check
 
       - name: Lints
         run: cargo clippy --workspace --lib --bins --locked -- -D warnings
 
-      - name: Native tests
+      - name: Full integration tests
+        run: cargo test --workspace --test '*' --locked
+
+      - name: Build MCP conformance binary
+        run: cargo build -p compass-cli --bin compass --locked
+
+      - name: MCP stdio conformance
+        run: cargo test -p compass-mcp --test protocol_conformance --locked
+
+      - name: MCP HTTP conformance
         run: |
-          cargo test --workspace --lib --bins --locked
-          cargo test -p compass-cli --test compass_product --locked
+          bash scripts/qualify_mcp_conformance.sh
 
       - name: Qualify natural-language query relevance
         env:
@@ -105,9 +143,6 @@ jobs:
           cargo test -p compass-query --test opencypher_tck --locked
           python3 scripts/check_compassql_support.py
 
-      - name: Isolated native tests
-        run: cargo nextest run --workspace --lib --bins --locked
-
       - name: Verify publishable crate archives
         run: |
           cargo package --workspace --locked --no-verify \
@@ -169,8 +204,8 @@ jobs:
           workspaces: .
           key: ${{ matrix.target }}
 
-      - name: Native tests
-        run: cargo test --workspace --lib --bins --locked --target ${{ matrix.target }}
+      - name: Full integration tests
+        run: cargo test --workspace --test '*' --locked --target ${{ matrix.target }}
 
       - name: Code graph deterministic publication and SQLite recovery
         run: |
diff --git a/.kbd-orchestrator/constraints.md b/.kbd-orchestrator/constraints.md
index 357cd015f..dd348139c 100644
--- a/.kbd-orchestrator/constraints.md
+++ b/.kbd-orchestrator/constraints.md
@@ -14,12 +14,12 @@ subset for automated verification; it does not replace the completion checklist.
 constraints:
   - id: build-passes
     severity: blocking
-    description: 'Workspace compile check must pass'
+    description: 'After the complete phase implementation, the workspace integration targets must compile without running unit harnesses'
     command: '<see .kbd-orchestrator/project.json build_health_command>'
 
   - id: tests-pass
     severity: blocking
-    description: 'Native workspace tests must pass'
+    description: 'After the complete phase implementation, the full workspace integration suite must pass; unit tests are not valid evidence'
     command: '<see .kbd-orchestrator/project.json test_command>'
 
   - id: clippy-clean
@@ -62,13 +62,18 @@ constraints:
     description: 'No credentials, machine-specific paths, generated graphs, local .compass/ state, compass-out/, or private repository content committed outside the repository-owned .prometheus/knowledge/wiki transcript exception'
     check: "rg -n 'sk-|api_key|API_KEY|BEGIN [A-Z ]*PRIVATE KEY' crates/ scripts/ --glob '!*.lock'"
 
+  - id: refiner-qa-evidence
+    severity: blocking
+    description: 'Per-change .refiner/artifacts/<change-id>/ manifests, constraints, decisions, logs, and receipts are repository-owned KBD certification evidence and remain tracked; they must be deterministic, portable, secret-free, and contain no generated product data or machine-specific paths'
+    note: 'This classification is required by the kbd-execute per-change QA gate and does not extend to arbitrary .refiner runtime state.'
+
   - id: locked-dependencies
     severity: blocking
     description: 'Build and test commands use --locked; Cargo.lock is updated when dependency resolution changes'
 
   - id: regression-test-present
     severity: blocking
-    description: 'Behavior changes require a regression test at the lowest useful layer, plus an interface/contract test when user-visible behavior changes'
+    description: 'Behavior changes require full integration coverage at the lowest public boundary; inline and library unit tests are prohibited as new evidence'
 
   - id: determinism-preserved
     severity: blocking
@@ -173,8 +178,9 @@ constraints:
   proof a behavior exists.
 - Unknown graph attributes are preserved unless the relevant contract explicitly
   rejects them.
-- `make test` is workspace `--lib --bins` only. `make test-all` adds
-  `--all-targets --all-features` and requires the documented Python oracle setup.
+- `make test`, `make test-all`, and `make test-release` select integration-test
+  targets only. They are phase-end commands and must not run during production
+  implementation. The incremental Cargo watch target is deliberately disabled.
 - Some Makefile targets (`install`, `dist`, `release-check`) resolve binaries
   through a literal `target/` path after Cargo finishes. Inspect them before use
   so they do not silently trigger a second local build.
diff --git a/.kbd-orchestrator/current-waypoint.json b/.kbd-orchestrator/current-waypoint.json
index 61b8d23d4..39ed04539 100644
--- a/.kbd-orchestrator/current-waypoint.json
+++ b/.kbd-orchestrator/current-waypoint.json
@@ -1,26 +1,31 @@
 {
   "schemaVersion": "5",
+  "generatedBy": "kbd-runtime",
+  "sourceRevision": 300,
+  "derivedRevision": 300,
+  "frontier": {
+    "dcb2293c-3722-4507-af1a-1786476c3817": 300
+  },
+  "conflictCount": 0,
+  "projectId": "a5ced554-588e-4e12-a6f7-6580bba975b3",
+  "runId": "compass-scoping-and-bounds-20260828T123758Z",
   "path": [
     "compass-scoping-and-bounds"
   ],
+  "phaseIds": [
+    "compass-scoping-and-bounds"
+  ],
+  "activePhaseId": "compass-scoping-and-bounds",
   "phase": "compass-scoping-and-bounds",
-  "previousPhase": null,
-  "change": null,
-  "status": "plan_ready",
-  "currentTask": "Apply C-001 \u2014 read_snapshot API split",
-  "nextPendingChange": "C-001",
-  "sourceTool": "claude",
-  "exactNextCommand": "/opsx:new stream-snapshot-read",
-  "parentPhase": null,
-  "childPhases": [],
   "childPointer": null,
-  "backend": "openspec",
-  "wave": 1,
-  "lastCompletedChange": null,
+  "change": null,
+  "currentTask": null,
+  "status": "ready",
   "completionMetric": "implementation",
-  "implementationCompleted": 0,
-  "implementationTotal": 6,
-  "certificationStatus": "NOT_TRACKED",
-  "publicationStatus": "NOT_TRACKED",
-  "updatedAt": "2026-08-09T12:27:19Z"
-}
\ No newline at end of file
+  "implementationCompleted": 18,
+  "implementationTotal": 20,
+  "planRevision": 1,
+  "revision": 300,
+  "exactNextCommand": "/opsx:new stream-snapshot-read",
+  "updatedAt": "2026-08-29T19:17:43.033786Z"
+}
diff --git a/.kbd-orchestrator/current-waypoint.md b/.kbd-orchestrator/current-waypoint.md
index bd94fea14..38bdc79f5 100644
--- a/.kbd-orchestrator/current-waypoint.md
+++ b/.kbd-orchestrator/current-waypoint.md
@@ -1,22 +1,14 @@
-# Current waypoint
-
-**Phase:** compass-scoping-and-bounds
-**Status:** plan_ready
-**Progress:** 0 of 6 changes complete
-**Next command:** `/opsx:new stream-snapshot-read` (then `/kbd-execute`)
-
-## First change to apply
-
-**C-001 — Stop materializing the snapshot payload in `read_snapshot`**
-Owner: `compass-store`. Wave 1. Unblocks C-004 and C-005.
-
-## Blockers
-
-- Identity/namespacing decision blocks C-005 *adoption* (not extraction).
-
-## Waves
-
-Wave 1 (parallel): C-001, C-002, C-003, C-006
-Wave 2 (gated on C-001): C-004 [HARD GATE], C-005
-
-_Updated: 
+# Current waypoint — Compass
+
+- **Phase:** compass-scoping-and-bounds (expanded scope 2026-08-28, user decision — see goals.md)
+- **Status:** plan_ready — **execution handed off to Codex / gpt-5.6-sol**
+- **Handoff document:** `.kbd-orchestrator/phases/compass-scoping-and-bounds/handoffs/EXECUTION-HANDOFF.md`
+- **Implementation:** 0/20
+- **Wave:** 1 (C-001, C-002, C-003, C-006)
+- **Next pending change:** C-001 — `stream-snapshot-read`
+  (verify-first check PASSED 2026-08-28: draft compiles; absorb it, then finish
+  `validate_snapshot`/`snapshot_reference` call sites, tests, CHANGELOG)
+- **Codex entry:** `$openspec-new-change "stream-snapshot-read"`
+- **Hard gates ahead:** C-004/C-005 on C-001 · Wave 5 on C-011+C-012+C-013 ·
+  C-018 on C-010 · C-020 conditional on a recorded user problem
+- **Updated:** 2026-08-28T12:45:00Z by claude (kbd-plan → handoff)
diff --git a/.kbd-orchestrator/model-preflight.json b/.kbd-orchestrator/model-preflight.json
index 47d5706f7..00dc03e7e 100644
--- a/.kbd-orchestrator/model-preflight.json
+++ b/.kbd-orchestrator/model-preflight.json
@@ -4,15 +4,15 @@
   "roles": {
     "judge": {
       "model": "k3",
-      "source": "/Users/gqadonis/.prometheus/kbd/models.toml"
+      "source": "~/.prometheus/kbd/models.toml"
     },
     "critic": {
       "model": "MiniMax-M3",
-      "source": "/Users/gqadonis/.prometheus/kbd/models.toml"
+      "source": "~/.prometheus/kbd/models.toml"
     },
     "generator": {
       "model": "kbd-frontier",
-      "source": "/Users/gqadonis/.prometheus/kbd/models.toml"
+      "source": "~/.prometheus/kbd/models.toml"
     }
   },
   "providers_detected": [
@@ -28,8 +28,8 @@
     "frontier"
   ],
   "distinct_models": 2,
-  "config_path": "/Users/gqadonis/.config/liter-llm/liter-llm-proxy.toml",
+  "config_path": "~/.config/liter-llm/liter-llm-proxy.toml",
   "config_exists": true,
   "config_defects": [],
-  "checked_at": "2026-08-09T11:08:23Z"
+  "checked_at": "2026-08-29T03:47:53Z"
 }
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/assessment.md b/.kbd-orchestrator/phases/compass-scoping-and-bounds/assessment.md
index 30eebe271..7233f1458 100644
--- a/.kbd-orchestrator/phases/compass-scoping-and-bounds/assessment.md
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/assessment.md
@@ -1,192 +1,273 @@
-# Assessment — compass-scoping-and-bounds
-
-**Phase:** compass-scoping-and-bounds (provisional — not yet created via `/kbd-new-phase`)
-**Date:** 2026-08-09
-**Question:** Should scoping be added as a feature right now?
-**Verdict:** **No — scoping already exists and already works. The real defects are elsewhere.**
+# Assessment — compass-scoping-and-bounds (re-run, expanded scope)
+
+**Phase:** compass-scoping-and-bounds
+**Date:** 2026-08-28 (supersedes 2026-08-09 assessment; original findings incorporated by reference below)
+**Trigger:** user directive to absorb implementation of the `docs/future/` program
+(SurrealDB, MCP 2026, Agent Skills, harness distribution) into this phase so all of
+it completes here. The expanded scope is recorded in `goals.md` §"Expanded scope
+(2026-08-28, user decision)" — this assessment assesses against that updated
+goals artifact.
+**Research:** external facts validated 2026-08-28 via Firecrawl search; codebase
+facts verified by direct source inspection at the current working tree.
 
 ---
 
-## Correction to the initial diagnosis
-
-An earlier hypothesis in this session claimed the default ignore policy was missing
-`node_modules/`, `target/`, and `compass-out/`. **That was wrong.** Direct source
-inspection disproves it:
-
-| Claim | Reality | Evidence |
+## 1. Verdict
+
+**The expanded phase is implementable. Nothing in the codebase blocks it. Two
+blockers are non-code and cannot be closed by this phase's own work: the SurrealDB
+BSL license/release decision, and upstream maintainer agreement if the goal is
+landing these changes upstream rather than on this fork.**
+
+The 2026-08-09 verdict stands unchanged for the original scope: scoping already
+exists and works; the real defects are the read-path allocation, the error message,
+the missing fail-fast estimate, and the override inconsistency (C-001…C-006).
+
+### The phase's architecture question — settled verdict
+
+`goals.md` requires settling: *"is the right answer graph partitioning/sharding
+rather than a larger number?"* **Verdict: neither. The answer is eliminating the
+monolithic read-path allocation; partitioning already exists; sharding and a
+larger limit are both rejected.** Basis (2026-08-09 analyze stage, decision log
+D-entries, re-confirmed by source inspection this session):
+
+1. **Sharding rejected** — a multi-machine technique; Compass is local-first
+   single-process, and eventual consistency violates the determinism invariant
+   (AGENTS.md).
+2. **A larger number rejected** — explicit phase non-goal; AGENTS.md requires
+   bounded work and a limit error as a distinct outcome.
+3. **Record-class partitioning already ships** —
+   `compass-history::PartitionedGraph` (`crates/compass-history/src/artifacts.rs`)
+   implements partition()/into_partition()/reconstruct(); the gap is that the
+   current-graph path doesn't use it, which C-005 (extraction into
+   `compass-partition`) addresses.
+4. **The true constraint is the read path** — the 2 GiB failure originates in
+   `compass-graph/src/snapshot.rs` (`digest_json` over one monolithic
+   `CanonicalGraphDocument`) compounded by `read_snapshot` reconstructing the
+   whole payload in memory; C-001 splits that API so production callers never
+   materialize it.
+
+What remains for implementation is exactly C-001…C-006 — no new architecture
+decision is open in the original scope.
+
+### Change inventory referenced throughout (from plan.md, statuses from progress.json)
+
+| ID | Title | Status |
 | --- | --- | --- |
-| Defaults miss `node_modules`/`target`/`compass-out` | All three are present | `crates/compass-files/src/detect.rs:61-102` (`SKIP_DIRS`) |
-| Gitignore not respected | Respected by default | `detect.rs:163` (`gitignore: true`) |
-| Scoping absent | `--include`/`--exclude` + interactive prompts exist | `crates/compass-cli/src/init_commands.rs:438-462` |
-
-`SKIP_DIRS` holds ~40 entries and additionally skips dot-directories, `*_venv`,
-`*_env`, and `*.egg-info` (`detect.rs:252-268`, `484-500`). `.compassignore` is
-supported alongside `.gitignore` (`detect.rs:390-392`).
-
-**Scoping is not the gap. Building the feature would be duplicated work.**
+| C-001 | Stop materializing snapshot payload in `read_snapshot` (API split: manifest-only + chunk-streaming reads) | pending (code drafted, uncommitted) |
+| C-002 | Make snapshot limit error actionable (name the remedy; omit override until C-004) | pending |
+| C-003 | Pre-flight graph size estimate (fail fast before 331 s builds) | pending |
+| C-004 | Honor `COMPASS_MAX_GRAPH_BYTES` on the publication path | pending — HARD gate on C-001 |
+| C-005 | Extract `compass-partition` shared crate from `compass-history::PartitionedGraph` | pending — gated on C-001 |
+| C-006 | Decide `vendor/` default-skip policy | pending |
 
 ---
 
-## What actually happened
-
-The target repository is a genuinely large, document-dense monorepo. Measured
-directly:
-
-```text
-9,320  markdown files in scope AFTER all default exclusions
-4,827    └── under crates/ alone
-1,092    └── openspec/
-  780    └── frontend/
-```
-
-The reported `Matched: 19666 files (9470 code, 9679 documents, ...)` is therefore
-**correct behavior over real content**, not a discovery leak. The exclusions fired;
-there is simply that much in-scope material.
-
-The failure is a true capacity limit:
-
-```text
-error: snapshot limit exceeded: canonical graph exceeds the 2147483648-byte limit
-Compass init failed after 331.90s wall time.
-```
-
-Origin: `crates/compass-graph/src/snapshot.rs:3138` (`digest_json`), enforcing
-`MAX_GRAPH_BYTES` = 2 GiB from `crates/compass-store/src/lib.rs:51`.
-
----
-
-## Confirmed gaps
-
-### G1 — The 2 GiB cap has no override on the publication path (blocking UX defect)
-
-`COMPASS_MAX_GRAPH_BYTES` is honored in `compass-model` (`graph.rs:370`),
-`compass-output` (`json.rs:414`), `compass-global` (`lib.rs:370`), and
-`compass-core` (`diagnostics.rs:713`). Those crates' errors *advertise* the
-override:
-
-> `(set COMPASS_MAX_GRAPH_BYTES=<bytes> or COMPASS_MAX_GRAPH_BYTES=<N>GB to raise the limit)`
+## 2. Scope directive and its recorded conflict
 
-Neither `compass-graph/src/snapshot.rs` nor `compass-store/src/lib.rs` reads that
-variable (verified by grep — zero occurrences in either file). The user hits a
-limit that the rest of the product treats as adjustable, with **no override and no
-remedy in the message**.
+Both `docs/future/` planning notes explicitly advise **against** doing this:
 
-This is an internal inconsistency, not merely a missing feature.
+> "Do not append the ecosystem work to that phase merely because `read_snapshot`
+> may later help a remote adapter. Finish, pause, or formally supersede the
+> current phase first." — `upstream-contribution-plan.md`
 
-### G2 — The error is unactionable (blocking UX defect)
+> "Run `/kbd-new-phase` scoped to Proposal A only." — `SURREAL_DB.md`
 
-The message states a fact and stops. It does not name the override, suggest
-`--exclude`, mention `.compassignore`, or report which content dominated the graph.
-Compare `compass-core/src/diagnostics.rs:453`, which does guide the user.
+The user directive of 2026-08-28 overrides this and is recorded here as a **user
+decision** (same category as the 2026-08-09 PartitionedGraph-extraction decision).
+Consequences accepted by that decision:
 
-### G3 — Failure occurs after 331 s, at the end (efficiency defect)
+- The phase grows from 6 changes / 4 goals to an estimated **20+ changes / 10
+  goals** spanning storage, query, transport, security, licensing, CLI, and
+  packaging contracts.
+- The research doc's own staging estimates total **14–27 weeks** (Phases −1
+  through 5) on top of the ~1–2 weeks remaining in the original scope.
+- The phase name no longer describes its content; the waypoint's wave counter
+  becomes the real unit of progress and verify/reflect must run **per wave**, not
+  per phase, or drift will accumulate unchecked.
 
-The cap is enforced at serialization time. All extraction, resolution, and analysis
-completes first, then publication fails and the work is discarded. No pre-flight
-estimate, no progressive warning.
-
-### G4 — `vendor/` is absent from `SKIP_DIRS` (minor, genuine)
-
-`vendor/` (126 MB in the target repo; 441 markdown files) is not skipped. Note this
-is deliberate for some ecosystems — Go's `vendor/` holds real dependency source —
-so this needs a decision, not a reflex addition. Compass's own tree has a
-`vendor/` it legitimately reads.
+**Ambiguity the plan stage must resolve:** "get all of it done in this phase"
+can mean (a) implement locally on this fork, or (b) land upstream via the PR
+sequence in `upstream-contribution-plan.md`. These differ by months and by
+dependencies outside our control (maintainer response). This assessment assumes
+**(a) local implementation on the fork**, with upstream submission tracked as
+separate exit work following the contribution plan. If (b) is intended, PR-0
+(maintainer decision record) becomes the phase's first hard gate and the
+schedule is not ours to control.
 
 ---
 
-## Research: current practice (firecrawl, 2026-08-09)
-
-Convergent evidence across indexers and formatters:
-
-1. **Respect `.gitignore` by default** — described in a comparative formatter study
-   as "the single most important default" and "the single highest-value default"
-   (Ruff ✅, Prettier v3+ ✅, dprint ✅, Black ✅; Biome opt-in).
-   → **Compass already does this.**
-
-2. **Ship hardcoded defaults beyond VCS ignore** — `ck` (`.ckignore`),
-   `codegraphcontext` (`.cgcignore`), `understand-anything` (`.understandignore`)
-   all bundle `node_modules/`, `target/`, `dist/`, `build/`.
-   → **Compass already does this, with a larger list than the examples surveyed.**
-
-3. **Provide a tool-specific ignore file layered over `.gitignore`** — universal
-   across the sample (`.ckignore`, `.cursorignore`, `.rgignore`, `.ignore`).
-   → **Compass already does this (`.compassignore`).**
+## 3. State drift since 2026-08-09
 
-4. **Explicit paths override ignore rules.** From the MemSearch discussion
-   (zilliztech/memsearch#612, Jul 2026): "If the user explicitly specifies a file
-   path to index, that file should still be indexed... since that represents an
-   explicit user choice."
-   → Worth verifying Compass's behavior; not assessed here.
+| Item | 2026-08-09 | Now (2026-08-28) |
+| --- | --- | --- |
+| C-001 | pending, no code | **substantially implemented but uncommitted**: `crates/compass-store/src/lib.rs` (+152/−17) adds `read_snapshot_manifest()` + streaming `read_snapshot_chunks()`, exactly the API split the spec-stage decision describes. No OpenSpec change exists; ledger still says `pending`; work sits on branch `docs/claude-md`. Evidence (this session): `git diff --stat crates/compass-store/src/lib.rs` → `169 ++++…----, 152 insertions(+), 17 deletions(-)`; `git branch` → `docs/claude-md`; diff hunks show the two new methods and the revised `MAX_GRAPH_BYTES` doc comment. |
+| C-002…C-006 | pending | pending, unchanged |
+| Ledger | 0/6, `plan_ready` | 0/6, `plan_ready` (accurate for formalized work; stale w.r.t. the uncommitted C-001 code) |
+| Binary vs source | — | installed `compass` 0.3.6, source manifest 0.3.7 |
+| docs/future | did not exist | 3 notes (1,294 lines): research report, SurrealDB proposal, upstream contribution plan |
 
-5. **ripgrep's `--no-ignore-vcs` precedent** (BurntSushi, ripgrep#645): the
-   maintainer holds that an explicit paired flag is "the 'right' answer" over
-   changing defaults.
-   → Supports G1's remedy shape: an *explicit override*, not a raised default.
+Binary/source evidence (this session): `compass --version` → `compass 0.3.6`;
+`Cargo.toml [workspace.package] version = "0.3.7"`. MCP tool list evidence: the
+15 tool names in §5 are the `mcp__compass__*` tools exposed by the live server
+connected to this session.
 
-**Nothing in the research supports building a scoping feature. It supports the
-opposite — Compass is already at or above the surveyed baseline on scoping.**
+**First required action regardless of plan shape:** reconcile C-001 — create its
+OpenSpec change, absorb the existing diff, add tests, commit on an appropriately
+named branch. Until then every ledger read is misleading.
 
 ---
 
-## Adversarial review
-
-Applied per `/adversarial-review --mode artifact assess`. Preflight `status: ok`,
-judge `k3` ≠ generator `kbd-frontier`, so judge ≠ producer.
-
-**CRITICAL — raised and resolved:** the original framing ("add scoping") would have
-shipped a duplicate of `SKIP_DIRS` + `--exclude` + `.compassignore`. Refuted by
-source inspection; assessment rewritten. This is the finding that changes the
-recommendation, and it came from checking the code rather than trusting the
-initial hypothesis.
-
-**WARNING — carried forward:**
-
-- **Do not raise the 2 GiB cap.** `AGENTS.md` requires bounded work and states a
-  limit error is a distinct outcome from an empty result. Raising the default
-  weakens an intentional invariant. Grant an *explicit, opt-in* override instead.
-- **G4 needs a decision, not a reflex.** Skipping `vendor/` breaks Go monorepos and
-  conflicts with Compass's own vendored tree.
-- **Sycophancy check:** the prior turn's confident "not a bug — three defects"
-  framing was partly wrong (the ignore-policy claim). Recorded rather than quietly
-  dropped.
+## 4. External facts (validated 2026-08-28, Firecrawl)
 
-**Unverified / open:**
-
-- Whether the suggested `--exclude` workaround actually lands under 2 GiB is
-  **untested**. With 4,827 markdown files under `crates/` — a directory that cannot
-  be excluded without gutting the graph — it may well still exceed the cap.
-- No measurement of which node/edge classes dominate the 2 GiB payload.
-
----
-
-## Recommendation
+| Claim in research doc | Verified status | Source |
+| --- | --- | --- |
+| `rmcp` 3.1.4 is current | **Confirmed** — released 2026-08-20; implements stable MCP `2026-07-28`; a "Migrating to 3.x?" guide exists in the SDK README | <https://docs.rs/rmcp/latest/rmcp/> ("rmcp-3.1.4 … 20 August 2026"); <https://github.com/modelcontextprotocol/rust-sdk> ("This SDK implements the stable MCP `2026-07-28` specification") |
+| MCP `2026-07-28` is the latest spec | **Confirmed** — spec site marks it "(latest)"; `initialize`/`initialized` and `Mcp-Session-Id` retired (SEP-2575, SEP-2567); stateless `Mcp-Method`/`Mcp-Name` headers replace the handshake | <https://modelcontextprotocol.io/specification/2026-07-28> ("Version 2026-07-28 (latest)"); <https://blog.modelcontextprotocol.io/posts/2026-07-28/> ("officially retired the `initialize`/`initialized` exchange along with the `Mcp-Session-Id` header") |
+| SurrealDB 3.2.4 is latest stable | **Confirmed** — "LATEST STABLE 3.2 · Latest patch 3.2.4 · Aug 2, 2026"; 3.3.0-beta.1 exists (2026-08-13, pre-release — do not target) | <https://surrealdb.com/releases> |
+| SurrealDB BSL 1.1 licensing | FAQ page current; the research doc's reading (embed/redistribute allowed, DBaaS restricted, Apache-2.0 after change window) was not re-litigated here — the **formal license decision remains open** and is a phase gate | <https://surrealdb.com/license> |
+
+Implication of the session-model removal: `compass-mcp`'s HTTP transport tests
+`Mcp-Session-Id` and `--session-timeout` semantics that the current spec has
+deleted. The migration is not optional modernization; the shipped contract is now
+a legacy protocol.
+
+## 5. Codebase verification (direct inspection)
+
+- `Cargo.toml:86` pins `rmcp = "2.2.0"` (server, transport-io,
+  transport-streamable-http-server). No `surreal*` dependency anywhere in the
+  workspace — the default-footprint gate starts from a clean baseline.
+- `compass-graphdb` exists (bounded Neo4j Bolt / FalkorDB RESP export) — the
+  architectural precedent the research doc names for a derived-projection
+  boundary is real.
+- `compass-store-redb` (~869 lines) and `compass-store-qualification` exist —
+  second-backend precedent and qualification gates are real, so
+  `compass-store-surreal` follows an established pattern rather than new
+  architecture.
+- `compass-mcp` serves 15 tools + 6 resources (tool list spot-verified against
+  the live MCP server this session: `search_symbols`, `get_callers`,
+  `get_callees`, `get_impact`, `explore_code`, `get_node`, `query_graph`,
+  `get_neighbors`, `get_community`, `god_nodes`, `graph_stats`, `shortest_path`,
+  `list_prs`, `get_pr_impact`, `triage_prs`).
+- Embedded agent skill + atomic multi-harness installer exist under
+  `compass-cli` assets; Rust toolchain 1.97.1 satisfies rmcp 3.x's 1.88 MSRV.
+
+## 6. Gap report against expanded goals
+
+### Original goals (all open, unchanged)
+
+| Goal | Gap | Change |
+| --- | --- | --- |
+| G1 override inconsistency | open | C-004 (HARD-gated on C-001) |
+| G2 actionable limit error | open | C-002 (couples to C-004 error text) |
+| G3 fail fast | open | C-003 (needs calibration data) |
+| G4 vendor/ policy | open | C-006 |
+| — read-path allocation | **code exists, unformalized** | C-001 |
+| — partition crate extraction | open | C-005 (gated on C-001) |
 
-**Do not build scoping.** Sequence instead:
+### Expanded goals (new, from docs/future)
 
-| Pri | Gap | Change | Owner crate |
-| --- | --- | --- | --- |
-| 1 | G1 | Honor `COMPASS_MAX_GRAPH_BYTES` on the snapshot/publication path, or explicitly document why it must not be honored | `compass-graph`, `compass-store` |
-| 2 | G2 | Make the limit error actionable — name the override, `--exclude`, `.compassignore`, and the dominant content class | `compass-graph` (message), `compass-cli` (thin) |
-| 3 | G3 | Pre-flight size estimate so a doomed build fails early rather than after 331 s | `compass-core` |
-| 4 | G4 | Decide `vendor/` policy deliberately | `compass-files` |
+| Goal | Current state | Gap |
+| --- | --- | --- |
+| E1 MCP 2026 migration (`rmcp` 3.1.4, stateless discovery, typed results, deterministic tool ordering, session-flag removal) | `rmcp 2.2.0`, session-based HTTP, several text-only legacy tools | entire migration; no technical blocker found; MSRV/toolchain compatible |
+| E2 Phase-−1 gates: BSL license decision; persistent SurrealKV + RocksDB probes (parallel edges, provenance, generation reads, kill-during-write) | nothing | probes are code; **license decision is not** — external gate |
+| E3 Surreal graph projection (`compass-graphdb-surreal`: schemafull nodes/relations, generation activation, bounded native reads, dual-engine equivalence) | nothing; precedent `compass-graphdb` | entire crate + equivalence corpus |
+| E4 Surreal Store adapter (`compass-store-surreal`) | nothing; precedent `compass-store-redb` + qualification | entire crate; sync/async bounded boundary; **optional, last** — research doc rejects Store-first explicitly |
+| E5 Skills split + `compass agent` CLI namespace | umbrella skill + installer exist | 6 focused skills, list/install/doctor/export/validate/mcp-config, umbrella preserved as alias |
+| E6 Native harness packages (Codex `.codex-plugin`, Claude `.claude-plugin` + marketplace, OpenCode npm/TS plugin) from one `distribution.toml` inventory | installer places skills/adapters; no native packages | inventory + generators + installed-artifact validation |
+| E7 Measurement prerequisites (Phase-0 corpora: golden answers, scale fixtures, 30-task suite, baselines) | nothing | must precede E3 acceptance; the research doc's numeric budgets are unratified and must be ratified **before** measurements are visible |
+
+## 7. Blockers code cannot clear
+
+1. **SurrealDB BSL 1.1 legal/release acceptance** for the exact artifact profile
+   (E2). Until decided, E3/E4 can be built behind non-default features but cannot
+   ship in a release artifact.
+2. **Upstream maintainer agreement**, only if reading (b) of the directive holds.
+   The contribution plan's checklist (clean worktrees, one problem per PR, no KBD
+   state in feature PRs) governs the exit path either way.
+3. **Unratified numeric budgets** (E7): the qualification thresholds in the
+   research doc are stated as "ratify before measuring." Ratification is a
+   decision, not code; the plan stage should schedule it as an explicit gate.
+
+## 8. Risks specific to the merged phase
+
+- **Coupling growth:** C-002/C-004 already couple through error text; the MCP
+  migration (E1) touches the same error/result surfaces. Sequencing must keep the
+  original six changes ahead of E1's envelope work or the error contract will be
+  rewritten twice.
+- **Ledger integrity:** 20+ changes in one phase with an already-drifted ledger
+  (C-001) is exactly the condition the upstream plan warns about. Per-wave
+  verify + reflect is the mitigation; skipping it forfeits the phase's audit value.
+- **Branch hygiene:** current work sits on `docs/claude-md` with unrelated tracked
+  modifications. Each wave needs its own branch/worktree from a clean base, per
+  the contribution plan, or the eventual upstream slicing becomes archaeology.
+- **BSL gate late-failure:** if the license decision fails after E3 is built, the
+  projection work strands. Mitigation: E2 (license + probes) must complete before
+  any E3 code merges — same "cheap disqualifiers first" order the research doc
+  already mandates.
+
+## 9. Recommendation to the plan stage
+
+Re-plan the phase as **waves with per-wave verify/reflect**, preserving the
+existing Wave-1/Wave-2 structure as Waves 1–2 and appending:
 
-G1 and G2 together resolve the reported failure. G3 is the quality-of-life fix.
+```text
+Wave 1  (existing) C-001 formalization first, then C-002, C-003, C-006
+Wave 2  (existing) C-004, C-005                         [HARD GATE: C-001]
+Wave 3  E1  MCP 2026 migration (rmcp 3.1.4 branch, conformance, interop)
+Wave 4  E2  license decision + persistent probes + E7 corpora/budget ratification
+Wave 5  E3  Surreal graph projection + dual-engine equivalence
+Wave 6  E5  skills split + compass agent CLI
+Wave 7  E6  harness packages (generated from one inventory)
+Wave 8  E4  Surreal Store adapter (optional; only if an independent user problem
+            justifies it — research doc's own condition)
+```
 
-**Open question for the next stage:** if a repo of this size genuinely cannot
-publish under 2 GiB even with sane exclusions, is the correct answer a graph
-partitioning/sharding strategy rather than a bigger number? That is an
-architecture question, not a scoping one, and it should be settled in `/kbd-analyze`
-before any code is written.
+Wave 3 before Wave 4 because MCP migration is self-contained, urgent (shipped
+contract is legacy), and independent of the license gate; Waves 5+ are gated on
+Wave 4's decisions. One OpenSpec change per PR-shaped unit throughout, per the
+contribution plan.
 
 ---
 
-## Evidence index
-
-- `crates/compass-files/src/detect.rs:61-102` — `SKIP_DIRS`
-- `crates/compass-files/src/detect.rs:163` — `gitignore: true`
-- `crates/compass-files/src/detect.rs:252-268`, `484-500` — skip enforcement
-- `crates/compass-files/src/detect.rs:390-392` — `.compassignore`
-- `crates/compass-cli/src/init_commands.rs:365-377`, `438-462` — scoping surface
-- `crates/compass-store/src/lib.rs:51` — `MAX_GRAPH_BYTES`
-- `crates/compass-graph/src/snapshot.rs:3138` — failure site
-- `crates/compass-core/src/diagnostics.rs:453` — actionable-message precedent
+## 10. Adversarial review record (2 rounds, isolated cross-model)
+
+Judge: `kbd-judge` via rest-gateway `http://localhost:8181/v1`; producer
+`claude-fable-5`; `cross_model_check: verified-distinct` both rounds. Raw
+findings: `review/assess/findings.json` (r1), `review/assess/findings-r2.json`.
+
+**Round 1 (BLOCK — 2 CRITICAL, 3 WARNING): both criticals fixed.**
+- CRITICAL "expanded scope not in goals" → `goals.md` updated with the
+  2026-08-28 user-decision scope section; assessment now assesses against it.
+- CRITICAL "architecture question not settled" → §1 now carries the explicit
+  verdict (neither sharding nor a larger number; eliminate the read-path
+  allocation; partitioning already ships).
+- WARNINGs (undefined change IDs, missing evidence, missing source URLs) →
+  change inventory table, session evidence quotes, and source URLs added.
+
+**Round 2 (BLOCK — 1 CRITICAL, 3 WARNING): accepted unresolved per the
+two-round cap.** The next stage must read these:
+
+1. **CRITICAL (unresolved, disputed):** "C-001 substantially implemented" is
+   unverified *from the packet*. Disposition: the claim was verified live this
+   session (`git diff --stat` → +152/−17; hunks show `read_snapshot_manifest`
+   and `read_snapshot_chunks`), but artifact-mode packets carry no git state, so
+   the judge structurally cannot confirm it. Treat as **verify-first**: the
+   C-001 formalization change must begin by re-running `git diff` and compiling
+   (`cargo check -p compass-store --locked`) before absorbing the diff. If the
+   diff is absent or broken, C-001 reverts to plain pending and nothing
+   downstream changes.
+2. WARNING: codebase assertions beyond packet evidence (branch name, binary
+   version, MCP tool list) — same disposition: re-verify at execution time.
+3. WARNING: docs/future contents not in packet — the three notes are in-repo at
+   `docs/future/`; analyze/plan must read them directly rather than trusting
+   this summary.
+4. WARNING: expanded-goal gap rows too coarse to plan from (E1/E3/E5/E6 are
+   multi-part) — accepted; decomposition into per-change acceptance criteria is
+   exactly the plan stage's job and must happen there.
+
+Tooling note for the orchestrator: `check-findings-sycophancy.sh` degraded both
+rounds (`sycophancy.sh lib not found — gate skipped`); the sycophancy screen was
+run instead via the sycophancy-correction MCP tool (result recorded in the
+stage handoff). Artifact-mode packets omitting git state is a
+`build-review-packet.sh` gap worth an upstream skill-pack issue.
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/decision-log.md b/.kbd-orchestrator/phases/compass-scoping-and-bounds/decision-log.md
index a14e5c49c..82c066c38 100644
--- a/.kbd-orchestrator/phases/compass-scoping-and-bounds/decision-log.md
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/decision-log.md
@@ -40,3 +40,81 @@ Decision: spec C-001 as an API split, not a streaming refactor. Provenance: sour
 read_snapshot has 8 call sites; both production callers discard the payload with `_`,
 and compass-query already uses GraphSnapshotReader::open_selector. The 2 GiB allocation
 is incurred for a value nothing in production reads.
+
+### 2026-08-28T12:45:00Z — Execution handed off to Codex / gpt-5.6-sol (user decision)
+Decision: planning stages (assess, plan) completed in Claude Code; execution delegated
+to gpt-5.6-sol via Codex CLI 0.146.0. Provenance: user directive.
+Handoff document: `handoffs/EXECUTION-HANDOFF.md` — self-contained, assumes no chat
+history. Backend remains OpenSpec (skills in `.agents/skills/`, Codex uses skills not
+slash commands). Compass MCP wired via `.codex/config.toml`.
+
+### 2026-08-28T12:45:00Z — C-001 verify-first check PASSED (closes adversarial r2 CRITICAL)
+Decision: the uncommitted `compass-store/src/lib.rs` diff is a valid starting draft.
+Provenance: direct verification at handoff.
+Evidence: `git diff --stat` → +152/−17; `read_snapshot_manifest` at lib.rs:837,
+`read_snapshot_chunks` at lib.rs:856, `read_snapshot` retained at lib.rs:901;
+`cargo check -p compass-store --locked` clean in 27.95s.
+This closes the round-2 CRITICAL finding on `assessment.md`, which was unverifiable
+only because artifact-mode review packets carry no git state. Remaining C-001 work is
+unchanged: reimplement validate_snapshot/snapshot_reference on the manifest reader,
+add round-trip/reopen/corruption/atomicity tests, update CHANGELOG.
+
+### 2026-08-28T13:05:00Z — Preserve canonical/OpenSpec identifiers without ledger inflation
+Decision: use `C-001` for typed KBD change/task transitions and
+`stream-snapshot-read` for the OpenSpec backend, pairing the transitions with the
+same task hooks and `kbd-apply mark-done` operation. Provenance: execution-time
+wrapper audit. The installed `kbd-apply` passes its backend change argument through
+as the canonical change ID and has no ID-mapping option; invoking
+`begin-task stream-snapshot-read` would create a spurious twenty-first canonical
+change. The mapping is kept explicit until the wrapper grows first-class aliases.
+
+### 2026-08-29 — Latest MCP revision governs C-010 (user decision)
+Decision: retain the latest published MCP revision as Compass's normative HTTP
+contract and do not restore an obsolete lifecycle solely for a lagging named
+client. Provenance: the user's active Codex task message, “C-010: Use the latest
+version of MCP.” Context7's official `modelcontextprotocol/modelcontextprotocol`
+documentation identifies 2026-07-28 as the latest published revision and confirms
+that revision removed sessions, resumable SSE, and GET/DELETE on the MCP endpoint.
+The exact OpenCode 1.18.25 HTTP outcome remains recorded as incompatible; both
+independent current-protocol conformance legs remain mandatory merge gates.
+
+### 2026-08-29 — C-011 SurrealDB 3.2.4 artifact profiles accepted (user decision)
+Decision: `ACCEPT`, which approves every artifact profile named in
+`docs/future/surrealdb-license-decision.md` under its stated release conditions.
+Provenance: the user's active Codex task message, “C-011: ACCEPT.” Decision
+authority: project user; authority role: user. This applies only to the pinned
+SurrealDB 3.2.4 license digest. Covered artifacts and redistributions must retain
+the exact BSL license, notices, version, Change Date, Change License, and Database
+Service restriction; every version upgrade requires a fresh license/profile
+review. C-011 passed mandatory pre-archive review and is published in the dated
+OpenSpec archive; C-012 and C-013 are already certified complete. The
+C-014/C-015 entry gate is therefore satisfied and those changes are unblocked.
+This decision does not satisfy
+C-020's separate independent-user-problem condition.
+
+### 2026-08-29 — C-020 Surreal Store adapter cancelled by condition precedent
+Decision: drop C-020 and close the phase at nineteen implemented changes.
+Provenance: the pre-ratified Wave 8 condition in `plan.md` and
+`EXECUTION-HANDOFF.md`. By the end of Wave 7, no independently stated user
+problem had been recorded that required replacing the unchanged synchronous
+`compass-store` contract with a Surreal-backed adapter. The accepted C-011
+license decision and the existence of the C-014 projection explicitly do not
+satisfy that product-need condition. No `compass-store-surreal` crate, executor
+boundary, or speculative dependency is added.
+
+### 2026-08-29 — C-015 native Surreal adoption rejected by pre-ratified falsifier
+Decision: retain the bounded, feature-isolated projection/query implementation
+as experimental evidence, but reject routing Compass workloads to it and do not
+claim C-015 budget qualification success. Provenance: the exact pre-ratified
+`qualification-medium` run recorded in
+`benchmarks/qualification/surreal-dual-engine-decision-v1.json`.
+The implementation produced zero semantic mismatches, but warm in-process
+Surreal p95 was 8,132x–38,904x the current engine across the measured structural
+workloads and canonical response-byte reduction was 0%. This fails the
+pre-ratified <=1.10x query-regression gate and both native-value conjuncts.
+Thresholds were not changed after results were visible. An initial single-
+transaction activation also reached 87.6 GB peak physical footprint; bounded
+idempotent 512-record staging corrected that defect, and the exact rerun passed
+with 3,646,308,352 bytes maximum RSS, 100,000 nodes, and 250,000 edges. The
+falsifier stops further adoption-oriented artifact/recovery measurement because
+those measurements cannot reverse the decisive query/native-value failures.
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/execution.md b/.kbd-orchestrator/phases/compass-scoping-and-bounds/execution.md
new file mode 100644
index 000000000..cf67035e7
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/execution.md
@@ -0,0 +1,131 @@
+EXECUTION: compass-scoping-and-bounds
+Project: Compass
+Date: 2026-08-28
+Last updated: 2026-08-29
+Selected backend: openspec
+Dispatched to: SELF (Codex, through kbd-apply)
+Backend rationale: The repository already uses OpenSpec, the phase requires traceable compatibility and decision records, and the KBD-owned apply wrapper preserves canonical task/change progress and hooks.
+Backend entrypoint: the installed `kbd-apply` skill resolved through the active
+Codex skill root; create and complete each named OpenSpec change, but drive every
+implementation task through `kbd-apply begin-task/end-task`.
+OpenSpec available: YES (CLI 1.10.0)
+Source plan: .kbd-orchestrator/phases/compass-scoping-and-bounds/plan.md
+
+EXECUTION SCOPE
+
+- C-001 / stream-snapshot-read: Stream current snapshot reads and remove payload-sized production allocations.
+- C-002 / actionable-snapshot-limit-error: Render a recoverable publication-limit failure.
+- C-003 / preflight-graph-size-estimate: Detect predictable oversized graphs before full extraction.
+- C-004 / honor-max-graph-bytes-on-publication: Apply the opt-in graph-byte override consistently after streaming is safe.
+- C-005 / extract-compass-partition: Extract history-independent partition records and canonical helpers.
+- C-006 / vendor-skip-policy: Record and test the default vendor discovery policy.
+- C-007 / rmcp-3-migration: Pin and migrate to rmcp 3.1.4 with stdio parity.
+- C-008 / mcp-stateless-http: Implement the MCP 2026-07-28 stateless HTTP contract.
+- C-009 / mcp-result-envelope: Add versioned typed result envelopes to core navigation tools.
+- C-010 / mcp-conformance-interop: Gate MCP migration on conformance and named-client interoperability.
+- C-011 / surrealdb-license-decision: Prepare the artifact-profile decision and record user/legal sign-off.
+- C-012 / surreal-persistent-probes: Run disposable persistent SurrealKV/RocksDB qualification probes.
+- C-013 / qualification-corpora-baselines: Version deterministic corpora, baselines, and pre-ratified budgets.
+- C-014 / surreal-graph-projection: Add an optional, generation-atomic Surreal graph projection.
+- C-015 / surreal-dual-engine-equivalence: Prove bounded semantic equivalence across native and Surreal engines.
+- C-016 / focused-agent-skills: Add six focused skills without changing the umbrella contract.
+- C-017 / compass-agent-cli: Add the compatibility-safe compass agent namespace.
+- C-018 / distribution-inventory-generators: Generate deterministic Codex, Claude, and OpenCode packages.
+- C-019 / harness-install-validation: Test installed package lifecycle and ownership boundaries.
+- C-020 / surreal-store-adapter: Conditionally implement a Surreal Store adapter only for a separately recorded user problem.
+
+DISPATCH CONTRACTS
+
+Every automated change uses this common contract: SELF executes the exact OpenSpec task surface through kbd-apply; `.kbd-orchestrator/phases/compass-scoping-and-bounds/progress.json` is the canonical projection; implementation completion is marked independently of evidence/certification/publication; QA, adversarial diff review, OpenSpec verification, spec sync, and archive follow in that order.
+
+- C-001 -> SELF/OpenSpec. Entry: stream-snapshot-read. Model class: medium. Concrete model: current Codex gpt-5.6-sol session (the configured medium.local route is null, so this session supplies the required frontier fallback). Model rationale: public API compatibility plus corruption and publication-atomicity coverage in one crate.
+- C-002 -> SELF/OpenSpec. Entry: actionable-snapshot-limit-error. Model class: medium. Concrete model: current Codex gpt-5.6-sol session. Model rationale: one domain/presentation boundary and a public CLI contract.
+- C-003 -> SELF/OpenSpec. Entry: preflight-graph-size-estimate. Model class: frontier. Concrete model: current Codex gpt-5.6-sol session. Model rationale: calibrated performance design spanning discovery and publication with boundedness constraints.
+- C-004 -> SELF/OpenSpec. Entry: honor-max-graph-bytes-on-publication. Model class: medium. Concrete model: current Codex gpt-5.6-sol session. Model rationale: coordinated environment-limit behavior across graph and store boundaries.
+- C-005 -> SELF/OpenSpec. Entry: extract-compass-partition. Model class: frontier. Concrete model: current Codex gpt-5.6-sol session. Model rationale: a new public crate, canonical encoding, immutable history, and transitive dependency constraints.
+- C-006 -> SELF/OpenSpec. Entry: vendor-skip-policy. Model class: small. Concrete model: Qwen3.5-9B-Q8_0 per project registry, executed in this Codex session. Model rationale: bounded discovery-policy decision with direct tests.
+- C-007 -> SELF/OpenSpec. Entry: rmcp-3-migration. Model class: frontier. Concrete model: current Codex gpt-5.6-sol session. Model rationale: high-risk SDK migration, dependency policy, and protocol compatibility.
+- C-008 -> SELF/OpenSpec. Entry: mcp-stateless-http. Model class: frontier. Concrete model: current Codex gpt-5.6-sol session. Model rationale: transport/security/CLI migration across multiple public boundaries.
+- C-009 -> SELF/OpenSpec. Entry: mcp-result-envelope. Model class: frontier. Concrete model: current Codex gpt-5.6-sol session. Model rationale: versioned machine contract spanning every core navigation result property.
+- C-010 -> SELF/OpenSpec. Entry: mcp-conformance-interop. Model class: medium. Concrete model: current Codex gpt-5.6-sol session. Model rationale: focused test/CI surface with external-client evidence.
+- C-011 -> SELF drafting plus MANUAL user/legal approval. Entry: surrealdb-license-decision. Model class: frontier for the artifact draft; decision authority: user/legal. Concrete model: current Codex gpt-5.6-sol session for research and drafting only. Model rationale: high-consequence licensing/release decision that implementation cannot make.
+- C-012 -> SELF/OpenSpec. Entry: surreal-persistent-probes. Model class: frontier. Concrete model: current Codex gpt-5.6-sol session. Model rationale: disposable multi-engine durability and resource qualification with kill/recovery evidence.
+- C-013 -> SELF/OpenSpec. Entry: qualification-corpora-baselines. Model class: frontier. Concrete model: current Codex gpt-5.6-sol session. Model rationale: cross-surface deterministic fixture design and anti-bias budget ratification.
+- C-014 -> SELF/OpenSpec. Entry: surreal-graph-projection. Model class: frontier. Concrete model: current Codex gpt-5.6-sol session. Model rationale: new optional persistence abstraction and transactionally published projection.
+- C-015 -> SELF/OpenSpec. Entry: surreal-dual-engine-equivalence. Model class: frontier. Concrete model: current Codex gpt-5.6-sol session. Model rationale: dual-engine routing and exact semantic equivalence at scale.
+- C-016 -> SELF/OpenSpec. Entry: focused-agent-skills. Model class: medium. Concrete model: current Codex gpt-5.6-sol session. Model rationale: additive installer artifacts and trigger-discrimination tests across one CLI asset boundary.
+- C-017 -> SELF/OpenSpec. Entry: compass-agent-cli. Model class: frontier. Concrete model: current Codex gpt-5.6-sol session. Model rationale: six public subcommands, compatibility aliasing, validation, and documentation.
+- C-018 -> SELF/OpenSpec. Entry: distribution-inventory-generators. Model class: frontier. Concrete model: current Codex gpt-5.6-sol session. Model rationale: deterministic cross-harness package generation spanning Rust and TypeScript.
+- C-019 -> SELF/OpenSpec. Entry: harness-install-validation. Model class: frontier. Concrete model: current Codex gpt-5.6-sol session. Model rationale: external harness lifecycle tests, ownership safety, and CI integration.
+- C-020 -> SELF/OpenSpec only if its condition precedent is recorded. Entry: surreal-store-adapter. Model class: frontier. Concrete model: current Codex gpt-5.6-sol session. Model rationale: optional async database adapter behind an unchanged synchronous contract.
+
+APPROVAL GATES
+
+- C-001 implementation complete before C-004 or C-005 begins.
+- C-005 stops if compass-partition would depend on prolly-map, prolly-store-sqlite, compass-ir, or compass-analysis.
+- C-010 must prove the latest published MCP revision through both conformance legs and record exact Codex CLI, Claude Code, and OpenCode outcomes; an older-client incompatibility does not require a legacy server fallback (user decision, 2026-08-29).
+- C-011 was accepted by the project user on 2026-08-29 for every named artifact profile under the pinned 3.2.4 BSL conditions, passed mandatory pre-archive review, and is published in the dated archive; with C-012 and C-013 complete, the Wave 5 gate is satisfied.
+- C-013 budget ratification must predate any Wave 5 Surreal measurement.
+- C-020 is cancelled unless a distinct user problem is recorded by the end of Wave 7.
+
+FALLBACK CONDITIONS
+
+- A missing or structurally incomplete OpenSpec change is completed through the OpenSpec artifact workflow before kbd-apply starts.
+- A backend/API mismatch that prevents inspectable task progress falls back to native KBD task storage without weakening the plan acceptance criteria.
+- Surreal license rejection or persistent-probe failure cancels Waves 5 and 8 and preserves the existing SQLite/redb/graph.json stack.
+- Any failed blocking constraint, OpenSpec verification, artifact-refiner check, or CRITICAL adversarial finding blocks certification until fixed and both reviews rerun.
+
+VERIFICATION REQUIREMENTS
+
+- Per owner crate: cargo test -p <crate> --locked and applicable integration/contract gates.
+- Every Rust change: cargo fmt --all -- --check; cargo clippy --workspace --lib --bins --locked -- -D warnings; cargo test --workspace --lib --bins --locked.
+- Public CLI/product changes: cargo test -p compass-cli --test compass_product --locked and sh scripts/check_product_boundary.sh.
+- Code-graph publication changes: ./scripts/qualify_code_graph_v1.sh --fixtures-only.
+- JavaScript/package changes: npm ci; npm run typecheck:js; npm run test:js; node scripts/check_viewer_assets.mjs.
+- Dependency changes: cargo deny check plus license and transitive dependency evidence.
+- Refresh the local Compass graph after code changes and report any failed refresh.
+
+INITIAL DISPATCH LEDGER (historical snapshot)
+
+The statuses below record the 2026-08-28 dispatch starting point. Canonical live
+status is `.kbd-orchestrator/phases/compass-scoping-and-bounds/progress.json`;
+this execution contract is not rewritten for every task transition.
+
+- [IN_PROGRESS] C-001 — SELF/OpenSpec (verified starting draft)
+- [PENDING] C-002 — SELF/OpenSpec
+- [PENDING] C-003 — SELF/OpenSpec
+- [PENDING] C-004 — SELF/OpenSpec, gated by C-001
+- [PENDING] C-005 — SELF/OpenSpec, gated by C-001 and dependency rule
+- [PENDING] C-006 — SELF/OpenSpec
+- [PENDING] C-007 — SELF/OpenSpec
+- [PENDING] C-008 — SELF/OpenSpec, gated by C-007
+- [PENDING] C-009 — SELF/OpenSpec, gated by C-007
+- [PENDING] C-010 — SELF/OpenSpec, gated by C-008 and C-009
+- [PENDING] C-011 — draft by SELF, approval MANUAL
+- [PENDING] C-012 — SELF/OpenSpec
+- [PENDING] C-013 — SELF/OpenSpec
+- [PENDING] C-014 — SELF/OpenSpec, gated by C-011/C-012/C-013
+- [PENDING] C-015 — SELF/OpenSpec, gated by C-014
+- [PENDING] C-016 — SELF/OpenSpec
+- [PENDING] C-017 — SELF/OpenSpec, gated by C-016
+- [PENDING] C-018 — SELF/OpenSpec, gated by C-010/C-016/C-017
+- [PENDING] C-019 — SELF/OpenSpec, gated by C-018
+- [PENDING] C-020 — CONDITIONAL, gated by C-011/C-014 and independent user problem
+
+OUTPUTS
+
+- OpenSpec proposal/design/spec/tasks and archived change for each completed change.
+- Per-change `.refiner/artifacts/<change-id>/refinement_log.md`.
+- Per-change `.kbd-orchestrator/phases/compass-scoping-and-bounds/review/<change-id>/findings.json`.
+- Exact build/test/conformance/measurement evidence called for by plan.md.
+- Updated Compass graph plus KBD reflection handoff.
+
+BLOCKERS
+
+- C-020 has no recorded independent user problem at execution start and is therefore conditional, not assumed.
+
+REFLECTION HANDOFF
+
+- Consume execution.md, progress.json, archived OpenSpec changes/specs, per-change refinement logs and adversarial findings, exact verification output, decision-log entries, measurement artifacts, and the refreshed Compass graph.
+
+EXECUTION READY
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/goals.md b/.kbd-orchestrator/phases/compass-scoping-and-bounds/goals.md
index 2ccf71370..bfbbdb151 100644
--- a/.kbd-orchestrator/phases/compass-scoping-and-bounds/goals.md
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/goals.md
@@ -39,3 +39,34 @@ than a larger number? Settle this before writing code.
 - Building a scoping feature (already exists).
 - Raising the 2 GiB default. AGENTS.md requires bounded work and states a limit
   error is a distinct outcome from an empty result.
+
+## Expanded scope (2026-08-28, user decision)
+
+The phase scope was expanded by user directive on 2026-08-28 to include
+implementing the `docs/future/` program in this phase. This supersedes the
+notes' own advice to run it as a separate phase; the conflict is recorded in
+`assessment.md` §2.
+
+- **E1** — Migrate `compass-mcp` to MCP 2026-07-28 on `rmcp` 3.1.4: stateless
+  discovery, typed result envelope, deterministic tool ordering, session-flag
+  deprecation, stdio+HTTP conformance, named-harness interop.
+- **E2** — Decision gates before any SurrealDB code merges: BSL 1.1
+  license/release acceptance for the exact artifact profile; persistent
+  SurrealKV + RocksDB throwaway probes (parallel directed relations, stable IDs,
+  provenance, generation-scoped reads, kill-during-write recovery).
+- **E3** — `compass-graphdb-surreal` graph projection adapter: schemafull
+  nodes/relations, generation activation, bounded native reads, dual-engine
+  semantic equivalence.
+- **E4** — `compass-store-surreal` Store adapter (optional, last; only if an
+  independent user problem justifies it).
+- **E5** — Skills split (6 focused skills, umbrella preserved) + `compass agent`
+  CLI namespace (list/install/doctor/export/validate/mcp-config).
+- **E6** — Native harness packages (Codex `.codex-plugin`, Claude
+  `.claude-plugin` + marketplace, OpenCode plugin/npm) generated from one
+  canonical inventory.
+- **E7** — Measurement prerequisites: golden answers, scale fixtures, 30-task
+  suite, baselines; numeric budgets ratified before measurements are visible.
+
+Original non-goals stand: no scoping feature, no raising the 2 GiB default.
+Additional non-goals from the notes: no Prometheus runtime dependency, no
+default-path SurrealDB, no raw write-capable SurrealQL tool by default.
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/handoffs/EXECUTION-HANDOFF.md b/.kbd-orchestrator/phases/compass-scoping-and-bounds/handoffs/EXECUTION-HANDOFF.md
new file mode 100644
index 000000000..14e132c97
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/handoffs/EXECUTION-HANDOFF.md
@@ -0,0 +1,242 @@
+# Execution handoff — compass-scoping-and-bounds
+
+**To:** gpt-5.6-sol via Codex CLI 0.146.0
+**From:** Claude Code (planning session, 2026-08-28)
+**Repo:** repository root
+**Stage reached:** plan complete, adversarial-vetted (PASS). Execute is yours.
+
+Read this file, then `plan.md` in this directory. Everything you need is in the
+repo — nothing depends on the planning session's chat history.
+
+---
+
+## 1. What this phase is
+
+Compass failed to publish a 6.8 GB monorepo: the canonical graph exceeded the
+2 GiB `MAX_GRAPH_BYTES` limit after burning 331.90 s. The phase makes that
+failure graceful and recoverable **without** weakening the bounded-work
+invariant. On 2026-08-28 the user expanded scope to also implement the
+`docs/future/` program (MCP 2026, SurrealDB evaluation, Agent Skills, harness
+distribution) in this same phase.
+
+**Settled architecture decision — do not relitigate.** The open question was
+"partitioning/sharding, or a larger limit?" The answer is **neither**:
+
+- Sharding is rejected — multi-machine technique; eventual consistency violates
+  Compass's determinism invariant (AGENTS.md).
+- A larger default is rejected — explicit non-goal; AGENTS.md requires bounded
+  work and a limit error distinct from an empty result.
+- Record-class partitioning **already ships** in `compass-history::PartitionedGraph`;
+  it is simply unused by the current-graph path.
+- The real constraint is the **monolithic read-path allocation**. That is C-001.
+
+Provenance: `assessment.md` §1, `decision-log.md` entries dated 2026-08-09,
+`library-candidates.json` (`cand-001` adopt, `cand-002` reject, `cand-003` adopt).
+
+## 2. Authoritative documents, in reading order
+
+| File | What it gives you |
+| --- | --- |
+| `plan.md` (this dir) | **The work.** 20 changes, 8 waves, per-change acceptance criteria, hard gates |
+| `goals.md` (this dir) | G1–G4 original + E1–E7 expanded scope (user decision, dated) |
+| `assessment.md` (this dir) | Gap report, verified external facts w/ source URLs, blockers |
+| `spec.md`, `analysis.md` (this dir) | C-001 consumer audit; sharding/partitioning analysis |
+| `decision-log.md` (this dir) | Every decision + provenance. Append to it; never rewrite |
+| `AGENTS.md` (repo root) | **Authoritative operating guide.** Product invariants, crate ownership, Rust conventions, completion checklist |
+| `CLAUDE.md` (repo root) | Build/test commands, architecture tour, compatibility surfaces |
+| `COMPATIBILITY.md` | What counts as an incompatible user-visible change and what it requires |
+| `docs/future/*.md` (3 files) | Source material for waves 3–8. **Read directly** — the assessment only summarizes them |
+
+## 3. State as of handoff (verified this session, not assumed)
+
+```
+branch:        docs/claude-md
+ledger:        0/20 implementation, status plan_ready, wave 1
+waypoint:      .kbd-orchestrator/current-waypoint.json
+typed runtime: legacy mode; stage entry committed locally (revision 3)
+               control plane at 127.0.0.1:7892 unreachable — expected, not an error
+working tree:  1 tracked modification (crates/compass-store/src/lib.rs) + 47 untracked
+               harness/generated paths (.claude/, .codex/, .agents/, .prometheus/, compass-out/)
+```
+
+### C-001 verify-first check: **PASSED — already done for you**
+
+`plan.md` tells you to verify the uncommitted C-001 diff before absorbing it.
+That check ran at handoff time. Results:
+
+```
+$ git diff --stat crates/compass-store/src/lib.rs
+ crates/compass-store/src/lib.rs | 169 ++++++++++++---------------
+ 1 file changed, 152 insertions(+), 17 deletions(-)
+
+$ grep -n "pub fn read_snapshot" crates/compass-store/src/lib.rs
+ 837:  pub fn read_snapshot_manifest(&self) -> Result<SnapshotManifest, StoreError>
+ 856:  pub fn read_snapshot_chunks<F>(&self, mut consume: F) -> Result<SnapshotManifest, StoreError>
+ 901:  pub fn read_snapshot(&self) -> Result<(SnapshotManifest, Vec<u8>), StoreError>
+
+$ cargo check -p compass-store --locked
+ Finished `dev` profile in 27.95s          # clean
+```
+
+**So: the diff exists, has the right shape, and compiles.** Treat it as a
+starting draft, not finished work. What it still needs (from C-001's criteria):
+
+- `validate_snapshot` (~`lib.rs:935`) and `snapshot_reference` (~`lib.rs:1184`)
+  reimplemented on `read_snapshot_manifest` so **no production path** allocates
+  proportional to `payload_bytes`. Verify by reading the call sites — the draft
+  may not have done this.
+- Tests: round-trip, reopen, corruption/interruption, publication-atomicity.
+- Equivalence: `validate_snapshot`/`snapshot_reference` must return identical
+  results for valid **and corrupt** snapshots.
+- `CHANGELOG.md`; `MIGRATION.md` only if the public signature changes.
+
+If any of that is missing, finish it inside the C-001 change. Do not commit the
+draft as-is.
+
+## 4. How to run the work
+
+Backend is **OpenSpec** (`openspec/` present, v1.10.0, skills in `.agents/skills/`).
+Codex uses skills rather than slash commands, so per change:
+
+```bash
+$openspec-new-change "<change-id>"     # e.g. stream-snapshot-read
+# implement tasks
+$openspec-verify-change "<change-id>"
+$openspec-archive-change "<change-id>"
+```
+
+`plan.md` names the exact change-id for each of C-001…C-020.
+
+**Start here:** C-001, change-id `stream-snapshot-read`.
+
+### Rust gates (from CLAUDE.md — run before calling any change done)
+
+```bash
+cargo fmt --all -- --check
+cargo clippy --workspace --lib --bins --locked -- -D warnings
+cargo test --workspace --lib --bins --locked
+```
+
+Narrower loop while iterating: `cargo test -p <crate> --locked`.
+Toolchain is pinned 1.97.1; always `--locked`.
+
+### JS gates (only for C-018/C-019, the OpenCode plugin)
+
+```bash
+npm ci && npm run typecheck:js && npm run test:js
+```
+
+## 5. Rules that will fail review if broken
+
+From `AGENTS.md` and the workspace lints — these are enforced, not advisory:
+
+- **No `unsafe`. No `unwrap()`, `expect()`, or `panic!`.** Return typed errors
+  with actionable context.
+- **Determinism is correctness.** `BTreeMap`/`BTreeSet` or explicit sorting at
+  contract boundaries. Never rely on hash iteration or filesystem order.
+- **Never resolve ambiguity by picking the first/most convenient candidate.**
+  An explicit unresolved/ambiguous result beats invented meaning.
+- **Every traversal bounded** — files, graphs, archives, network, queries,
+  subprocess output. A limit error is a distinct outcome from an empty result.
+- **Reuse existing helpers** — bounded readers, subprocess helpers, path
+  containment, atomic writes. Do not write weaker local variants.
+- **Subprocess args passed separately.** Never build shell strings.
+- **Workspace deps at root `Cargo.toml`**, referenced as `{name}.workspace = true`.
+- **Layer discipline:** per-file extractors emit evidence and never resolve
+  project-wide facts (that is `compass-resolve`); topology-dependent logic lives
+  in `compass-graph`; `compass-cli`/`compass-mcp` stay thin.
+- **Compatibility-sensitive changes** (CLI args/help/exit codes, env vars, graph
+  JSON, CompassQL, MCP schemas, output files, history formats, stable IDs) need
+  all four: native regression coverage, updated reference docs, a `MIGRATION.md`
+  note when users must act, a `CHANGELOG.md` entry when release-visible.
+- **Published history realizations are immutable.** Never rewrite in place.
+- **Never hand-edit** `progress.json`, `current-waypoint.json`, or event
+  counters. Use the typed surface (`prometheus kbd ...`) or the OpenSpec skills.
+
+## 6. Wave order and the gates that bind it
+
+```
+Wave 1  C-001 → then C-002, C-003, C-006          (C-001 first: it unblocks Wave 2)
+Wave 2  C-004, C-005                               HARD GATE: C-001 merged
+Wave 3  C-007, C-008, C-009, C-010                 (MCP 2026 — urgent, independent)
+Wave 4  C-011, C-012, C-013                        (decision gates + measurement)
+Wave 5  C-014, C-015                               HARD GATE: C-011+C-012+C-013
+Wave 6  C-016, C-017                               (parallelizable with 4–5)
+Wave 7  C-018, C-019                               HARD GATE: C-010
+Wave 8  C-020                                      CONDITIONAL — see below
+```
+
+**Gates you must not cross early:**
+
+1. **C-004 before C-001 is merged** — the specific error this plan exists to
+   prevent. An env override before the read path streams lets a user request a
+   multi-gigabyte contiguous `Vec`: strictly worse than today's clean error.
+2. **Any SurrealDB code (C-014, C-015, C-020) before Wave 4 completes.** C-011
+   is a **license decision the user/legal must make** — you cannot close it by
+   writing code. If it is rejected, Waves 5 and 8 are cancelled and the fallback
+   is the existing SQLite/redb/`graph.json` stack.
+3. **C-005's dependency rule is stop-and-report, not a preference.**
+   `compass-partition` must not depend on `prolly-map`, `prolly-store-sqlite`,
+   `compass-ir`, or `compass-analysis`. If that cannot hold, **stop and report** —
+   it means the shared-crate framing is wrong and the decision needs revisiting.
+4. **C-010 interop is a merge gate.** If Codex/Claude Code/OpenCode do not
+   interoperate, Wave 3 does not merge merely because the Rust compiles.
+5. **C-020 is conditional.** It ships only if a user problem it independently
+   solves is recorded. If none is by the time Wave 7 ends, drop it — the phase
+   closes at 19 changes.
+
+## 7. Branch hygiene
+
+Current work sits on `docs/claude-md` alongside unrelated tracked modifications
+and 47 untracked harness paths. Per `docs/future/upstream-contribution-plan.md`:
+**create a clean branch or worktree per change**, and keep orchestration state
+(`.kbd-orchestrator/**`, `.prometheus/**`) in separate commits from
+implementation, so the eventual upstream slicing is not archaeology. Do not run
+destructive cleanup on this checkout.
+
+## 8. Known-open items (do not treat as settled)
+
+1. **Payload composition is unmeasured** — which node/edge classes dominate the
+   2 GiB is unknown. C-003's first task is measurement; do not invent a heuristic.
+2. **Whether `--exclude` alone lands `universal-agent-runtime` under 2 GiB** is
+   unverified. With 4,827 markdown files under `crates/` it may not.
+3. **rmcp 2.2.0 → 3.1.4 transitive-dependency delta** is unmeasured; measuring it
+   gates C-007's merge.
+4. **The numeric qualification budgets** in the research doc are **unratified**.
+   C-013 must ratify (or amend) them by recorded decision **before** any Surreal
+   measurements are visible — ratifying after seeing results is motivated reasoning.
+5. **Mode assumption:** the plan assumes **fork-local** implementation. Upstream
+   PR submission is exit work following the contribution plan. If the user wants
+   upstream-first, PR-0 (maintainer decision record) becomes the first gate and
+   the schedule is not ours to control — confirm before proceeding on that reading.
+
+## 9. Adversarial review record
+
+Both `assessment.md` and `plan.md` were vetted by an isolated cross-model judge
+(`kbd-judge` ≠ producer, `cross_model_check: verified-distinct`). Raw findings:
+`review/assess/findings*.json`, `review/plan/findings*.json`.
+
+- **Plan:** round 1 BLOCK (1 CRITICAL — settled-architecture decision missing;
+  fixed) → round 2 **PASS**. All r2 WARNINGs fixed in-place.
+- **Assessment:** round 2 accepted with 1 CRITICAL unresolved — "C-001 is
+  implemented" was unverifiable *from the review packet* because artifact-mode
+  packets carry no git state. **That finding is now closed**: the check ran at
+  handoff (§3) and passed.
+- Sycophancy screen on the assessment: 0.0, clean.
+
+Tooling gap worth knowing: `check-findings-sycophancy.sh` degraded on every run
+(`sycophancy.sh lib not found`); the screen was run via the sycophancy-correction
+MCP tool instead. Artifact packets omitting git state is an upstream skill-pack
+gap, not a repo defect.
+
+## 10. Compass MCP is available to you
+
+`.codex/config.toml` wires the Compass MCP server (stdio, graph at
+`compass-out/graph.json`). Use it as the first navigation layer before broad
+source searches: `search_symbols`, `get_callers`, `get_callees`, `get_impact`,
+`explore_code`, `query_graph`, `shortest_path`. Run `compass update .` after code
+changes. Verify important graph conclusions in the cited source — treat missing
+paths and inferred edges as uncertain evidence, not proof.
+
+Note the graph may be stale for `crates/compass-store/src/lib.rs` (the C-001
+draft postdates the last build).
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/handoffs/assess.handoff.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/handoffs/assess.handoff.json
new file mode 100644
index 000000000..6b4c74be2
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/handoffs/assess.handoff.json
@@ -0,0 +1,11 @@
+{
+  "stage": "assess",
+  "completedAt": "2026-08-28T12:27:06Z",
+  "outputs": [
+    "assessment.md"
+  ],
+  "nextStage": "analyze",
+  "summaryForNext": "Re-assessment with user-directed scope expansion to the docs/future program (E1-E7 recorded in goals.md). Key gaps: C-001 code exists uncommitted and must be formalized first; MCP 2026 migration is urgent (shipped session-based contract is now legacy per 2026-07-28 spec); BSL license decision and numeric-budget ratification are non-code gates that must precede SurrealDB merges. Open question for plan: local-fork implementation vs upstream landing. Adversarial review r2 accepted-unresolved: verify C-001 diff exists and compiles before absorbing it; analyze/plan must read docs/future directly; expanded goals need per-change decomposition (WARNINGs carried). Sycophancy screen via MCP tool: 0.0 clean.",
+  "skipped": false,
+  "skipReason": null
+}
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/handoffs/execute.handoff.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/handoffs/execute.handoff.json
new file mode 100644
index 000000000..07ea0fdf6
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/handoffs/execute.handoff.json
@@ -0,0 +1,12 @@
+{
+  "stage": "execute",
+  "completedAt": "2026-08-28T12:49:45Z",
+  "outputs": [
+    "execution.md",
+    "progress.json"
+  ],
+  "nextStage": "reflect",
+  "summaryForNext": "OpenSpec selected and driven through kbd-apply; all 20 changes are assigned with hard approval gates; C-001 stream-snapshot-read is first pending.",
+  "skipped": false,
+  "skipReason": null
+}
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/handoffs/plan.handoff.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/handoffs/plan.handoff.json
new file mode 100644
index 000000000..83c8a88de
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/handoffs/plan.handoff.json
@@ -0,0 +1,11 @@
+{
+  "stage": "plan",
+  "completedAt": "2026-08-28T12:39:06Z",
+  "outputs": [
+    "plan.md"
+  ],
+  "nextStage": "execute",
+  "summaryForNext": "Re-plan: 20 changes across 8 waves (6 original preserved verbatim + 14 for the expanded docs/future scope). First change: C-001 stream-snapshot-read with verify-first protocol on the uncommitted diff. Adversarial review r1 BLOCK (settled-architecture section added, C-004 coupling made binding, rmcp pin corrected to =3.1.4, JS gates added) then r2 PASS; r2 WARNINGs fixed in-place (Claude marketplace required, C-003 baseline-first criterion, C-018 hard dep on C-010). Hard gates: Wave 5 blocked on C-011 license decision + C-012 probes + C-013 ratified budgets; C-020 conditional. Mode assumption: fork-local; upstream submission is exit work.",
+  "skipped": false,
+  "skipReason": null
+}
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/hooks-status.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/hooks-status.json
new file mode 100644
index 000000000..d38e8e536
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/hooks-status.json
@@ -0,0 +1 @@
+{"totalRuns":47,"failedRuns":0,"lastRun":{"ts":"2026-08-28T14:02:11Z","kind":"task","edge":"before","name":"C-002:3","hookId":"kbd-memory-log","layer":"builtin","mode":"augment","status":0},"lastFailure":null}
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl b/.kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl
new file mode 100644
index 000000000..349bf7d77
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl
@@ -0,0 +1,47 @@
+{"ts":"2026-08-28T12:27:05Z","kind":"assess","edge":"before","name":"compass-scoping-and-bounds","index":0,"total":6,"phasePath":"","sourceTool":"unknown","hookId":"report-progress","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T12:27:05Z","kind":"assess","edge":"before","name":"compass-scoping-and-bounds","index":0,"total":6,"phasePath":"","sourceTool":"unknown","hookId":"kbd-memory-log","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T12:27:06Z","kind":"assess","edge":"before","name":"compass-scoping-and-bounds","index":0,"total":6,"phasePath":"","sourceTool":"unknown","hookId":"auto-memory-recall","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T12:27:07Z","kind":"assess","edge":"after","name":"compass-scoping-and-bounds","index":0,"total":6,"phasePath":"","sourceTool":"unknown","hookId":"report-progress","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T12:27:07Z","kind":"assess","edge":"after","name":"compass-scoping-and-bounds","index":0,"total":6,"phasePath":"","sourceTool":"unknown","hookId":"kbd-memory-log","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T12:27:07Z","kind":"assess","edge":"after","name":"compass-scoping-and-bounds","index":0,"total":6,"phasePath":"","sourceTool":"unknown","hookId":"legacy-assessment-complete","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T12:28:30Z","kind":"plan","edge":"before","name":"compass-scoping-and-bounds","index":0,"total":6,"phasePath":"","sourceTool":"unknown","hookId":"report-progress","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T12:28:30Z","kind":"plan","edge":"before","name":"compass-scoping-and-bounds","index":0,"total":6,"phasePath":"","sourceTool":"unknown","hookId":"kbd-memory-log","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T12:39:07Z","kind":"plan","edge":"after","name":"compass-scoping-and-bounds","index":0,"total":20,"phasePath":"","sourceTool":"unknown","hookId":"report-progress","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T12:39:07Z","kind":"plan","edge":"after","name":"compass-scoping-and-bounds","index":0,"total":20,"phasePath":"","sourceTool":"unknown","hookId":"kbd-memory-log","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T12:39:08Z","kind":"plan","edge":"after","name":"compass-scoping-and-bounds","index":0,"total":20,"phasePath":"","sourceTool":"unknown","hookId":"legacy-plan-complete","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T12:48:03Z","kind":"execute","edge":"before","name":"compass-scoping-and-bounds","index":1,"total":1,"phasePath":"","sourceTool":"unknown","hookId":"report-progress","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T12:48:03Z","kind":"execute","edge":"before","name":"compass-scoping-and-bounds","index":1,"total":1,"phasePath":"","sourceTool":"unknown","hookId":"kbd-memory-log","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T12:48:03Z","kind":"execute","edge":"before","name":"compass-scoping-and-bounds","index":1,"total":1,"phasePath":"","sourceTool":"unknown","hookId":"memory-task-stream","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T12:49:43Z","kind":"execute","edge":"after","name":"compass-scoping-and-bounds","index":1,"total":1,"phasePath":"","sourceTool":"unknown","hookId":"report-progress","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T12:49:43Z","kind":"execute","edge":"after","name":"compass-scoping-and-bounds","index":1,"total":1,"phasePath":"","sourceTool":"unknown","hookId":"kbd-memory-log","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T12:53:39Z","kind":"task","edge":"before","name":"C-001:1","index":1,"total":5,"phasePath":"compass-scoping-and-bounds","sourceTool":"unknown","hookId":"report-progress","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T12:53:39Z","kind":"task","edge":"before","name":"C-001:1","index":1,"total":5,"phasePath":"compass-scoping-and-bounds","sourceTool":"unknown","hookId":"kbd-memory-log","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T12:54:44Z","kind":"task","edge":"after","name":"C-001:1","index":1,"total":5,"phasePath":"compass-scoping-and-bounds","sourceTool":"unknown","hookId":"report-progress","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T12:54:44Z","kind":"task","edge":"after","name":"C-001:1","index":1,"total":5,"phasePath":"compass-scoping-and-bounds","sourceTool":"unknown","hookId":"kbd-memory-log","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T12:55:08Z","kind":"task","edge":"before","name":"C-001:2","index":2,"total":5,"phasePath":"compass-scoping-and-bounds","sourceTool":"unknown","hookId":"report-progress","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T12:55:08Z","kind":"task","edge":"before","name":"C-001:2","index":2,"total":5,"phasePath":"compass-scoping-and-bounds","sourceTool":"unknown","hookId":"kbd-memory-log","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T12:55:52Z","kind":"task","edge":"after","name":"C-001:2","index":2,"total":5,"phasePath":"compass-scoping-and-bounds","sourceTool":"unknown","hookId":"report-progress","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T12:55:52Z","kind":"task","edge":"after","name":"C-001:2","index":2,"total":5,"phasePath":"compass-scoping-and-bounds","sourceTool":"unknown","hookId":"kbd-memory-log","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T12:56:03Z","kind":"task","edge":"before","name":"C-001:3","index":3,"total":5,"phasePath":"compass-scoping-and-bounds","sourceTool":"unknown","hookId":"report-progress","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T12:56:03Z","kind":"task","edge":"before","name":"C-001:3","index":3,"total":5,"phasePath":"compass-scoping-and-bounds","sourceTool":"unknown","hookId":"kbd-memory-log","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T12:56:21Z","kind":"task","edge":"after","name":"C-001:3","index":3,"total":5,"phasePath":"compass-scoping-and-bounds","sourceTool":"unknown","hookId":"report-progress","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T12:56:21Z","kind":"task","edge":"after","name":"C-001:3","index":3,"total":5,"phasePath":"compass-scoping-and-bounds","sourceTool":"unknown","hookId":"kbd-memory-log","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T12:56:31Z","kind":"task","edge":"before","name":"C-001:4","index":4,"total":5,"phasePath":"compass-scoping-and-bounds","sourceTool":"unknown","hookId":"report-progress","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T12:56:31Z","kind":"task","edge":"before","name":"C-001:4","index":4,"total":5,"phasePath":"compass-scoping-and-bounds","sourceTool":"unknown","hookId":"kbd-memory-log","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T12:57:03Z","kind":"task","edge":"after","name":"C-001:4","index":4,"total":5,"phasePath":"compass-scoping-and-bounds","sourceTool":"unknown","hookId":"report-progress","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T12:57:03Z","kind":"task","edge":"after","name":"C-001:4","index":4,"total":5,"phasePath":"compass-scoping-and-bounds","sourceTool":"unknown","hookId":"kbd-memory-log","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T12:57:13Z","kind":"task","edge":"before","name":"C-001:5","index":5,"total":5,"phasePath":"compass-scoping-and-bounds","sourceTool":"unknown","hookId":"report-progress","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T12:57:13Z","kind":"task","edge":"before","name":"C-001:5","index":5,"total":5,"phasePath":"compass-scoping-and-bounds","sourceTool":"unknown","hookId":"kbd-memory-log","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T13:07:30Z","kind":"task","edge":"after","name":"C-001:5","index":5,"total":5,"phasePath":"compass-scoping-and-bounds","sourceTool":"unknown","hookId":"report-progress","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T13:07:31Z","kind":"task","edge":"after","name":"C-001:5","index":5,"total":5,"phasePath":"compass-scoping-and-bounds","sourceTool":"unknown","hookId":"kbd-memory-log","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T13:07:31Z","kind":"task","edge":"after","name":"C-001:5","index":5,"total":5,"phasePath":"compass-scoping-and-bounds","sourceTool":"unknown","hookId":"legacy-change-complete","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T13:57:24Z","kind":"task","edge":"before","name":"C-002:1","index":1,"total":4,"phasePath":"compass-scoping-and-bounds","sourceTool":"unknown","hookId":"report-progress","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T13:57:24Z","kind":"task","edge":"before","name":"C-002:1","index":1,"total":4,"phasePath":"compass-scoping-and-bounds","sourceTool":"unknown","hookId":"kbd-memory-log","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T13:57:27Z","kind":"task","edge":"after","name":"C-002:1","index":1,"total":4,"phasePath":"compass-scoping-and-bounds","sourceTool":"unknown","hookId":"report-progress","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T13:57:27Z","kind":"task","edge":"after","name":"C-002:1","index":1,"total":4,"phasePath":"compass-scoping-and-bounds","sourceTool":"unknown","hookId":"kbd-memory-log","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T14:02:06Z","kind":"task","edge":"before","name":"C-002:2","index":2,"total":4,"phasePath":"compass-scoping-and-bounds","sourceTool":"unknown","hookId":"report-progress","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T14:02:06Z","kind":"task","edge":"before","name":"C-002:2","index":2,"total":4,"phasePath":"compass-scoping-and-bounds","sourceTool":"unknown","hookId":"kbd-memory-log","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T14:02:08Z","kind":"task","edge":"after","name":"C-002:2","index":2,"total":4,"phasePath":"compass-scoping-and-bounds","sourceTool":"unknown","hookId":"report-progress","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T14:02:08Z","kind":"task","edge":"after","name":"C-002:2","index":2,"total":4,"phasePath":"compass-scoping-and-bounds","sourceTool":"unknown","hookId":"kbd-memory-log","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T14:02:10Z","kind":"task","edge":"before","name":"C-002:3","index":3,"total":4,"phasePath":"compass-scoping-and-bounds","sourceTool":"unknown","hookId":"report-progress","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
+{"ts":"2026-08-28T14:02:11Z","kind":"task","edge":"before","name":"C-002:3","index":3,"total":4,"phasePath":"compass-scoping-and-bounds","sourceTool":"unknown","hookId":"kbd-memory-log","layer":"builtin","mode":"augment","status":0,"logPath":".kbd-orchestrator/phases/compass-scoping-and-bounds/hooks.log.jsonl"}
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/plan.md b/.kbd-orchestrator/phases/compass-scoping-and-bounds/plan.md
index f56398e82..d5feb6b19 100644
--- a/.kbd-orchestrator/phases/compass-scoping-and-bounds/plan.md
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/plan.md
@@ -1,31 +1,81 @@
 # Plan — compass-scoping-and-bounds
 
-**Stage:** Plan
-**Date:** 2026-08-09
+**Stage:** Plan (re-run 2026-08-28; supersedes 2026-08-09 plan — Waves 1–2 carried
+forward unchanged, Waves 3–8 added for the expanded scope in `goals.md`
+§"Expanded scope (2026-08-28, user decision)")
 **Backend:** OpenSpec (`openspec/` present, `openspec_available: true`)
 **Evolver cycle:** none
-**Changes:** 6 — 0 complete
+**Changes:** 20 — 0 complete (6 original + 14 expanded)
+**Mode assumption:** fork-local implementation (assessment §2 reading (a)).
+Upstream submission follows `docs/future/upstream-contribution-plan.md` as exit
+work after waves complete; it is not a numbered change because its schedule
+belongs to upstream maintainers.
 
-Reads `assessment.md`, `analysis.md`, `spec.md`, `library-candidates.json`,
-`handoffs/{analyze,spec}.md`.
+Reads `assessment.md` (2026-08-28 re-run), `analysis.md`, `spec.md`,
+`library-candidates.json`, `handoffs/{analyze,spec,assess}.md`,
+`docs/future/*.md`.
 
 ---
 
-## Ordering rationale
+## Settled architecture decision (precondition to all implementation)
+
+The phase's open architecture question — *partitioning/sharding vs a larger
+number* — is **settled** (assessment §1 "The phase's architecture question —
+settled verdict"; decision log 2026-08-09 entries "Sharding rejected",
+"Partitioning already exists", "Read-path allocation identified as the true
+constraint"): **neither.** Sharding is rejected (multi-machine technique;
+eventual consistency violates the determinism invariant). A larger default is
+rejected (explicit non-goal; AGENTS.md bounded work). Record-class partitioning
+already ships in `compass-history::PartitionedGraph` (`cand-001`); the fix is
+eliminating the monolithic read-path allocation (C-001, `cand-003`) and reusing
+the existing partitioning (C-005). No implementation work in any wave begins
+under an unsettled architecture question.
 
-Wave 1 is everything with no dependency. Wave 2 is gated on C-001, because until the read
-path stops materializing the payload, both dependents are unsafe or premature.
+## Ordering rationale
 
 ```
-Wave 1 (parallel)          Wave 2 (after C-001)
-├── C-001  read_snapshot   ├── C-004  env override   [HARD GATE]
-├── C-002  error message   └── C-005  compass-partition
-├── C-003  size estimate
-└── C-006  vendor/ policy
+Wave 1 (parallel)          Wave 2 (after C-001)      Wave 3 (MCP 2026)
+├── C-001  read_snapshot   ├── C-004  env override   ├── C-007  rmcp 3.1.4 upgrade
+├── C-002  error message   └── C-005  compass-       ├── C-008  stateless HTTP
+├── C-003  size estimate           partition         ├── C-009  result envelope
+└── C-006  vendor/ policy                            └── C-010  conformance+interop
+
+Wave 4 (decision gates)    Wave 5 (Surreal graph)    Wave 6 (skills+CLI)
+├── C-011  BSL decision    ├── C-014  projection     ├── C-016  skills split
+├── C-012  persistent          crate [HARD GATE:     └── C-017  compass agent CLI
+│          probes              C-011+C-012+C-013]
+└── C-013  corpora +       └── C-015  equivalence
+           budgets                 corpus
+
+Wave 7 (distribution)      Wave 8 (optional)
+├── C-018  inventory +     └── C-020  store adapter  [CONDITIONAL]
+│          generators
+└── C-019  install tests
 ```
 
-**Apply C-001 first.** It is the only Wave 1 item that unblocks others, and the audit
-showed it is smaller than originally scoped.
+- **Waves 1–2 first, unchanged.** The original defects are small, shippable, and
+  C-002/C-004 settle the error-text contract **before** Wave 3's result-envelope
+  work touches the same surfaces — otherwise that contract is rewritten twice
+  (assessment §8, carried WARNING).
+- **Wave 3 before Wave 4.** MCP migration is urgent (the shipped session-based
+  contract is legacy per spec 2026-07-28), self-contained, and independent of
+  the SurrealDB license gate.
+- **Wave 4 before any Surreal code merges.** Cheap disqualifiers first: if the
+  BSL decision or persistent probes fail, Waves 5 and 8 are cancelled with zero
+  stranded code (assessment §7, §8).
+- **Wave 6 has no dependency on Waves 4–5** and may run in parallel with them if
+  execution capacity allows; it is ordered after for ledger clarity only.
+- **Wave 7 after Waves 3 and 6:** packages distribute the migrated MCP contract
+  and the split skills; generating them earlier packages contracts that are
+  about to change.
+- **Wave 8 last and conditional** — the research doc's own rule: no Store
+  adapter unless an independent user problem justifies it.
+
+**Apply C-001 first** — with the verify-first protocol from adversarial review
+r2 (assessment §10): before absorbing the uncommitted diff, re-run
+`git diff crates/compass-store/src/lib.rs` and
+`cargo check -p compass-store --locked`; if absent or broken, C-001 reverts to
+plain pending and is implemented from spec.
 
 ---
 
@@ -37,6 +87,13 @@ showed it is smaller than originally scoped.
 - **Owner:** `compass-store` · **Agent:** claude · **Risk:** medium
 - **Library:** `cand-003` (build — no external library; verdict `adopt`)
 - **Compatibility-sensitive:** yes (`read_snapshot` is `pub`)
+- **Verify-first (r2 finding): ✅ PASSED 2026-08-28 at handoff.** Diff present
+  (+152/−17); `read_snapshot_manifest` (`lib.rs:837`) and `read_snapshot_chunks`
+  (`lib.rs:856`) exist alongside the retained `read_snapshot` (`lib.rs:901`);
+  `cargo check -p compass-store --locked` finished clean in 27.95 s. Treat the
+  diff as a **starting draft**: still to do is reimplementing `validate_snapshot`
+  and `snapshot_reference` on the manifest reader (verify at the call sites),
+  plus all tests and changelog work below.
 
 Add `read_snapshot_manifest()`; reimplement `validate_snapshot` (`lib.rs:935`) and
 `snapshot_reference` (`lib.rs:1184`) on it. Replace the
@@ -73,9 +130,17 @@ Follow the precedent at `compass-core/src/diagnostics.rs:453`. Name `--exclude`
 The reported failure burned 331.90 s then discarded everything. Estimate before publication.
 
 **Done when**
-- [ ] Oversized build reports before full extraction completes
+- [ ] First task records a baseline: full-failure wall time and payload
+      composition on an oversized fixture (the 331.90 s case or a synthetic
+      equivalent)
+- [ ] Regression test: on that fixture, the limit error is reported during
+      discovery/estimation — before per-file extraction of the corpus completes —
+      and time-to-error is asserted under a recorded fraction of the baseline
+      (target ≤ 20%; the exact number is fixed by the baseline task and pinned
+      in the test, not invented here)
 - [ ] Estimate deterministic for equivalent inputs
-- [ ] Limit outcome stays distinct from an empty result
+- [ ] Limit outcome stays distinct from an empty result, and the error carries
+      the C-002 remediation text (recoverability, G3)
 - [ ] Estimation itself bounded
 
 > **Measure first.** Payload composition is unmeasured — which node/edge classes dominate
@@ -117,7 +182,9 @@ not in `compass-graph/snapshot.rs` or `compass-store`.
 - [ ] Consistent with the four crates that honor it, or a documented exception
 - [ ] Default stays 2 GiB (no default increase — AGENTS.md bounded work)
 - [ ] Override explicit and opt-in
-- [ ] C-002's message updated to advertise it, in the same change or immediately after
+- [ ] C-002's message updated to advertise the override **within this change** —
+      C-004 is not done while the error text omits it (closes the coupling
+      WARNING carried since 2026-08-09; no separate follow-up change exists)
 
 ### C-005 — Extract `compass-partition` shared crate
 
@@ -151,6 +218,309 @@ deliver it. That is a further change requiring the identity decision below.
 
 ---
 
+## Wave 3 — MCP 2026 migration (E1)
+
+### C-007 — Upgrade `rmcp` 2.2.0 → 3.1.4 with stdio parity
+
+- **OpenSpec:** `/opsx:new rmcp-3-migration`
+- **Owner:** workspace `Cargo.toml`, `compass-mcp` · **Agent:** claude · **Risk:** high
+- **Compatibility-sensitive:** yes (MCP schemas, CLI flags)
+
+Dedicated dependency-migration change on its own branch. Document the 2.2.0→3.1.4
+API and transitive-dependency delta; confirm license, `deny.toml`, unsafe-code
+policy; port the server to the 3.x API with the **stdio** transport passing first.
+No SurrealDB work, no new tools, no envelope redesign in this change.
+
+**Done when**
+- [ ] Workspace pins `rmcp = "=3.1.4"` (the `=` operator — a bare `"3.1.4"` is a
+      caret requirement Cargo may float to 3.x.y; the pin must be exact) in root
+      `Cargo.toml`, members via `{name}.workspace = true`
+- [ ] API/transitive delta documented in the change's design doc
+- [ ] `cargo deny` and workspace lint gates pass
+- [ ] All existing stdio-transport tests pass (adapted to the 3.x API where the
+      old API is gone, with each adaptation noted)
+- [ ] Existing tool list, names, and input schemas unchanged (`server/discover`
+      parity test against the 2.2.0 golden output)
+
+### C-008 — Stateless HTTP transport per MCP 2026-07-28
+
+- **OpenSpec:** `/opsx:new mcp-stateless-http`
+- **Owner:** `compass-mcp`, `compass-cli` (flags) · **Agent:** claude · **Risk:** high
+- **Depends on:** C-007
+- **Compatibility-sensitive:** yes (CLI flags `--session-timeout`, HTTP contract)
+
+Replace the session model: `server/discover`, stateless request metadata,
+`Mcp-Protocol-Version`/`Mcp-Method` headers; retire `Mcp-Session-Id`. Deprecate
+`--session-timeout` per COMPATIBILITY.md process (flag accepted with warning for
+one minor release, documented removal date). Decide and record whether a legacy
+MCP-2025 mode ships; if yes, name its exact cost and removal date; if no, record
+that in MIGRATION.md.
+
+**Done when**
+- [ ] HTTP transport passes MCP 2026-07-28 conformance (stateless discovery, no
+      session handshake)
+- [ ] `--session-timeout` deprecation path implemented + tested (warning text,
+      exit codes unchanged)
+- [ ] Legacy-mode decision recorded either way; if kept, dual contract tests
+- [ ] Bearer-token auth, request/response limits, and multi-project selection
+      behavior preserved (existing security tests pass)
+- [ ] `COMPATIBILITY.md` + `MIGRATION.md` + `CHANGELOG.md` updated
+
+### C-009 — Common result envelope + typed results on core navigation tools
+
+- **OpenSpec:** `/opsx:new mcp-result-envelope`
+- **Owner:** `compass-mcp` · **Agent:** claude · **Risk:** medium
+- **Depends on:** C-007 (3.x `resultType`/output-schema support)
+- **Compatibility-sensitive:** yes (MCP result schemas)
+
+Introduce the versioned envelope (`resultType: "complete"`, separate
+`schema: compass.<x>.v1` field, repository/generation/freshness/evidence/
+confidence/truncation/warnings) on `search_symbols`, `get_callers`,
+`get_callees`, `get_impact` first. Deterministic tool ordering in discovery.
+Legacy text-only tools either adopt the envelope or are marked deprecated —
+recorded per tool. Do not rename tools in this change.
+
+**Done when**
+- [ ] Envelope schema documented and versioned; golden result fixtures for the
+      four tools
+- [ ] Evidence, direction, multiplicity, ambiguity, bounds, pagination, and
+      deterministic ordering preserved (regression tests against pre-envelope
+      golden outputs)
+- [ ] `resultType` is the MCP discriminator; Compass schema name carried in a
+      separate field (research-doc rule)
+- [ ] Every remaining tool's envelope/deprecation status recorded in the design doc
+
+### C-010 — Conformance + named-harness interop matrix
+
+- **OpenSpec:** `/opsx:new mcp-conformance-interop`
+- **Owner:** `compass-mcp` tests, CI · **Agent:** claude · **Risk:** medium
+- **Depends on:** C-008, C-009
+
+Reference conformance on stdio and HTTP; interop against named, pinned versions
+of Codex CLI, Claude Code, and OpenCode (record the exact versions tested).
+**Merge gate for the wave:** if the clients do not interoperate, Wave 3 does not
+merge merely because the Rust compiles (research-doc rule).
+
+**Done when**
+- [ ] Conformance suite in CI for both transports
+- [ ] Interop matrix recorded with exact client versions and outcomes
+- [ ] Failures either fixed or the wave is explicitly held — no partial merge
+
+---
+
+## Wave 4 — decision gates + measurement prerequisites (E2, E7)
+
+> **Purpose:** cheap disqualifiers before any SurrealDB code merges. C-011 and
+> C-013 are decision/artifact changes, not code changes; C-012 is throwaway code.
+
+### C-011 — SurrealDB BSL 1.1 license/release decision record
+
+- **OpenSpec:** `/opsx:new surrealdb-license-decision`
+- **Owner:** decision record (docs) · **Agent:** claude drafts; **user/legal decides**
+- **Risk:** low effort, high consequence · **BLOCKER for Waves 5 & 8**
+
+Draft the exact distributed-artifact profile for decision: BSL 1.1 core,
+Additional Use Grant (DBaaS restriction), change date/license, notices, package
+registries, plugin archives, downstream redistribution; remote-client-only
+fallback packaging if embedded core is rejected. The decision itself is made by
+the user (or their legal reviewer) — this change is complete when the decision
+is **recorded**, either way.
+
+**Done when**
+- [ ] Decision document states accept/reject/conditional per artifact profile
+- [ ] Signed off by the user (recorded in the decision log with provenance)
+- [ ] Rejection path documented (remote-client-only or cancel Waves 5/8)
+
+### C-012 — Persistent SurrealKV + RocksDB throwaway probes
+
+- **OpenSpec:** `/opsx:new surreal-persistent-probes`
+- **Owner:** disposable evaluation (not a workspace member) · **Agent:** claude
+- **Risk:** medium · **BLOCKER for Wave 5**
+
+Probe persistent engines (not Mem-only — the research doc's own r2 correction):
+parallel directed relations with stable IDs; provenance/confidence round-trip;
+generation-scoped reads + atomic activation; **kill-during-write recovery**;
+deterministic ordering/pagination at scale; dependency/build-time/binary-size/
+cold-start/peak-RSS measurements; exact license text capture.
+
+**Done when**
+- [ ] All probe dimensions have recorded pass/fail results + test vectors
+- [ ] Spike code deleted; results + vectors retained as evaluation artifacts
+- [ ] No production dependency left in the workspace (verify `Cargo.lock` clean)
+- [ ] Fail → Waves 5/8 cancelled with the fallback recorded (existing stack)
+
+### C-013 — Measurement corpora, baselines, budget ratification
+
+- **OpenSpec:** `/opsx:new qualification-corpora-baselines`
+- **Owner:** fixtures + benchmark harness · **Agent:** claude · **Risk:** medium
+- **BLOCKER for Wave 5 acceptance**
+
+Create and version: semantic corpus; `qualification-medium` (100k/250k) and
+`qualification-large` (1M/2.5M) fixture generators; bounded raw-traversal
+baseline; 30-task suite; umbrella-skill invocation corpus; focused-skill
+boundary prompts. Record current-engine baselines (binary size, cold start,
+query latency p95, peak RSS). **Ratify the numeric budgets** from the research
+doc (or amend them by recorded decision) **before** any Surreal measurements
+are visible.
+
+**Done when**
+- [ ] All corpora/fixtures/harnesses checked in, versioned, deterministic
+- [ ] Current-engine baselines recorded and reproducible
+- [ ] Budget table ratified by recorded decision, dated prior to Wave 5 runs
+
+---
+
+## Wave 5 — Surreal graph projection (E3) — HARD GATE: C-011 accept + C-012 pass + C-013 done
+
+### C-014 — `compass-graphdb-surreal` projection crate
+
+- **OpenSpec:** `/opsx:new surreal-graph-projection`
+- **Owner:** new optional crate `compass-graphdb-surreal` · **Agent:** claude · **Risk:** high
+- **Depends on:** C-011, C-012, C-013 — **HARD GATE**; precedent `compass-graphdb`
+
+Schemafull node/relation tables; closed mapping from Compass edge kinds to typed
+relation families with required `kind`; generation-keyed records
+(`repository_id`, `generation_id`, schema version, stable IDs, provenance,
+confidence); transactionally staged projection with `active_generation` pointer
+swap after validation. SurrealQL through typed builders only. Non-default Cargo
+feature; engines Mem (test) / SurrealKV / RocksDB per C-012 results.
+
+**Done when**
+- [ ] Projection derives from one immutable generation; no partial generation
+      ever visible (interrupted-write test)
+- [ ] Parallel edges, direction, self-loops, provenance, confidence survive
+      round-trip (property + corpus tests)
+- [ ] No SurrealDB dependency reaches default builds (footprint gate: zero
+      Surreal-attributable size delta with feature off)
+- [ ] No MCP/CLI presentation logic in the crate
+
+### C-015 — Bounded native reads + dual-engine equivalence
+
+- **OpenSpec:** `/opsx:new surreal-dual-engine-equivalence`
+- **Owner:** `compass-graphdb-surreal`, `compass-query` (engine route) · **Agent:** claude
+- **Risk:** high · **Depends on:** C-014
+
+Implement `symbol_context`/`impact`/`path`/`subgraph`-class reads through both
+engines; equivalence corpus from C-013 plus deterministic scale samples.
+
+**Done when**
+- [ ] **Zero semantic mismatches** — identity, direction, multiplicity,
+      provenance, bounds, ordering, pagination (a mismatch is a failure, not an
+      exception)
+- [ ] Budgets from C-013 evaluated and results recorded against the ratified
+      thresholds; failures trigger the falsifier protocol (revise or stop)
+- [ ] No raw model-authored SurrealQL execution path exposed
+
+---
+
+## Wave 6 — skills split + skill-aware CLI (E5) — parallelizable with Waves 4–5
+
+### C-016 — Focused Agent Skills, umbrella preserved
+
+- **OpenSpec:** `/opsx:new focused-agent-skills`
+- **Owner:** `compass-cli` assets · **Agent:** claude · **Risk:** low
+- **Compatibility-sensitive:** yes (installed skill files)
+
+Six focused skills (`compass-navigate`, `compass-debug`, `compass-change-impact`,
+`compass-architecture`, `compass-index-maintenance`, `compass-mcp-setup`) as
+additive artifacts; umbrella `compass` skill unchanged and canonical.
+
+**Done when**
+- [ ] Spec-conformant skills (lower-kebab names matching directories; complete
+      bundled trees; no absolute paths)
+- [ ] Trigger-discrimination tests: umbrella invocation corpus shows zero
+      regressions; boundary prompts select correctly (corpus from C-013 if built,
+      else created here)
+- [ ] Installer places complete trees idempotently (checksum tests)
+
+### C-017 — `compass agent` CLI namespace
+
+- **OpenSpec:** `/opsx:new compass-agent-cli`
+- **Owner:** `compass-cli` · **Agent:** claude · **Risk:** medium
+- **Depends on:** C-016 · **Compatibility-sensitive:** yes (CLI contract)
+
+`compass agent list|install|doctor|export|validate|mcp-config` with
+`compass install` preserved as compatibility alias. Command names pass normal
+CLI contract review; `doctor` checks binary/graph/protocol/skill-checksum/MCP
+config; `export` deterministic; `validate` rejects absolute paths/credentials.
+
+**Done when**
+- [ ] All six subcommands implemented with `--help`, exit codes, tests
+- [ ] `compass install` alias behavior byte-compatible (regression test)
+- [ ] `doctor`/`validate` negative tests (stale graph, bad checksum, absolute
+      path, credential string)
+- [ ] Reference docs + `CHANGELOG.md`
+
+---
+
+## Wave 7 — native harness distribution (E6) — after Waves 3 & 6
+
+### C-018 — Canonical distribution inventory + package generators
+
+- **OpenSpec:** `/opsx:new distribution-inventory-generators`
+- **Owner:** new distribution surface (crate or `compass-cli` module) · **Agent:** claude
+- **Risk:** medium · **Depends on:** C-010 (packages must carry the migrated MCP
+  contract — packaging the pre-2026 contract is rework by construction), C-016,
+  C-017
+
+One `distribution.toml` inventory → generated Codex package
+(`.codex-plugin/plugin.json`, skills, `.mcp.json`; repo marketplace manifest
+optional pending a maintainer/distribution decision), Claude package
+(`.claude-plugin/plugin.json`, `.mcp.json`, skills) **plus the Claude
+marketplace manifest — required, per goals.md E6**, and the OpenCode
+TypeScript/npm plugin (thin bridge; no graph logic in TS).
+
+**Done when**
+- [ ] Generation deterministic (same inventory → byte-identical packages)
+- [ ] No absolute paths, credentials, or machine-specific values (validator test)
+- [ ] Real skill directories copied, never symlinked
+- [ ] Platform validators pass where they exist (`claude plugin validate`, etc.)
+- [ ] OpenCode TS plugin passes the repo JS gates: `npm run typecheck:js` and
+      `npm run test:js` cover it (plugin unit tests for tool registration and
+      MCP config emission), and it builds under the workspace npm setup
+
+### C-019 — Installed-artifact validation + clean-install tests
+
+- **OpenSpec:** `/opsx:new harness-install-validation`
+- **Owner:** CI + tests · **Agent:** claude · **Risk:** medium · **Depends on:** C-018
+
+Clean-machine install/discovery/load/MCP-invocation/upgrade/uninstall per named
+harness version; installed-artifact parity (not source templates).
+
+**Done when**
+- [ ] Each generated package passes the full lifecycle on a named harness version
+      (versions recorded)
+- [ ] Upgrade preserves user-authored instructions; uninstall removes managed
+      files only (ownership tests)
+- [ ] CI runs validation against installed artifacts, not templates — including
+      the JS gates (`npm run typecheck:js`, `npm run test:js`) for the installed
+      OpenCode plugin artifact
+
+---
+
+## Wave 8 — optional Store adapter (E4) — CONDITIONAL
+
+### C-020 — `compass-store-surreal` Store adapter
+
+- **OpenSpec:** `/opsx:new surreal-store-adapter`
+- **Owner:** new optional crate `compass-store-surreal` · **Agent:** claude · **Risk:** high
+- **Depends on:** C-011 accept, C-014 shipped
+- **Condition precedent:** a recorded, independently stated user problem this
+  adapter solves (research-doc rule: do not add it merely because the projection
+  exists). **If none is recorded by the time Wave 7 completes, this change is
+  dropped and the phase closes at 19 changes.**
+
+Implements the unchanged `Store` contract; documented bounded sync/async runtime
+boundary (no executor in `compass-store`, no nested-runtime panics).
+
+**Done when**
+- [ ] Passes `compass-store-qualification` **unchanged** (ordered scans, cursors,
+      conditional writes, error taxonomy, interruption, reopen, bounded work)
+- [ ] Runtime boundary documented + cancellation/timeout tests
+- [ ] No executor or Surreal type leaks into `compass-store`
+
+---
+
 ## Blocked before execution
 
 ### Decision — blocks C-005 adoption (not extraction)
@@ -159,6 +529,11 @@ Identity/namespacing for shared record keys. History fingerprints are meaning-af
 published realizations immutable. Before any current-graph consumer adopts the shared keys,
 either namespace per path or prove non-collision with a test.
 
+### Decision — blocks Wave 5 (carried from assessment §7)
+
+C-011 (license) is a user/legal decision; C-013 budget ratification is a recorded
+decision. Neither can be closed by implementation work.
+
 ---
 
 ## Unmeasured, carried forward
@@ -166,11 +541,14 @@ either namespace per path or prove non-collision with a test.
 1. Payload composition — blocks C-003 calibration.
 2. Whether `--exclude` on `universal-agent-runtime` lands under 2 GiB. With 4,827 markdown
    files under `crates/` it may not. Flagged since assessment; still unverified.
+3. rmcp 3.1.4 transitive-dependency delta — measured inside C-007, gates its merge.
 
 ---
 
 ## Adversarial review
 
+### 2026-08-09 round (Waves 1–2) — carried forward
+
 Preflight `ok`; judge `k3` ≠ generator `kbd-frontier`.
 
 **CRITICAL — none surviving.** The ordering error this stage exists to catch (C-004 before
@@ -187,3 +565,29 @@ change itself.
 - The earlier "environment blocker" in this plan was withdrawn: it derived from an
   AGENTS.md rule hardcoding one contributor's mount path, which has since been removed.
   Builds run with ordinary Cargo defaults.
+
+### 2026-08-28 round (full re-plan) — isolated cross-model, judge `kbd-judge` ≠ producer `claude-fable-5`
+
+Raw findings: `review/plan/findings.json` (r1), `review/plan/findings-r2.json` (r2).
+
+**Round 1 (BLOCK — 1 CRITICAL, 3 WARNING): all four fixed.**
+- CRITICAL "no settled architecture decision point" → "Settled architecture
+  decision" section added at the top of this plan, restating the assessment §1
+  verdict with provenance.
+- WARNING C-004 follow-up ambiguity → the escape hatch removed; C-002's message
+  update is now **within** C-004, binding.
+- WARNING `"3.1.4"` caret semantics → pin corrected to `=3.1.4`.
+- WARNING missing JS verification → `npm run typecheck:js` / `test:js` criteria
+  added to C-018 and C-019.
+
+**Round 2 (PASS — 0 CRITICAL, 3 WARNING): all three addressed in-place rather
+than carried.**
+- C-018 marketplace optionality vs goals.md E6 → Claude marketplace manifest is
+  now a required deliverable; only the Codex repo-marketplace stays decision-gated.
+- C-003 vagueness → baseline-first protocol with a pinned time-to-error fraction
+  and the C-002 remediation-text requirement added to its criteria.
+- C-018 missing MCP-migration dependency → hard `Depends on: C-010` recorded.
+
+Residual for the execute stage (carried): sycophancy shell gate degraded both
+rounds (`sycophancy.sh lib not found`) — screen run via the MCP tool instead;
+artifact-mode packets still omit git state (upstream skill-pack gap).
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/prior-context.md b/.kbd-orchestrator/phases/compass-scoping-and-bounds/prior-context.md
new file mode 100644
index 000000000..86a77ab86
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/prior-context.md
@@ -0,0 +1 @@
+<!-- memory endpoint unreachable; no prior context retrieved -->
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/progress.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/progress.json
index d574b4d21..a8ad363f7 100644
--- a/.kbd-orchestrator/phases/compass-scoping-and-bounds/progress.json
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/progress.json
@@ -1,54 +1,266 @@
 {
-  "schemaVersion": "5",
-  "generatedBy": "claude",
+  "schemaVersion": "2",
+  "generatedBy": "kbd-runtime",
+  "sourceRevision": 300,
+  "derivedRevision": 300,
+  "frontier": {
+    "dcb2293c-3722-4507-af1a-1786476c3817": 300
+  },
+  "conflictCount": 0,
   "phase": "compass-scoping-and-bounds",
-  "last_updated": "2026-08-09T12:27:19Z",
-  "last_updated_by": "claude",
-  "assessment_complete": true,
-  "plan_complete": true,
-  "execution_dispatched": false,
-  "reflection_complete": false,
-  "changes_total": 6,
-  "changes_completed": 0,
-  "implementation_total": 6,
-  "implementation_completed": 0,
+  "phaseId": "compass-scoping-and-bounds",
+  "parentPhase": null,
+  "last_updated": "2026-08-29T19:17:43.033786Z",
+  "last_updated_by": "kbd-runtime",
+  "changes_total": 20,
+  "changes_completed": 18,
+  "implementation_total": 20,
+  "implementation_completed": 18,
   "completion": {
+    "primaryCounter": "implementation",
     "implementation": {
-      "completed": 0,
-      "total": 6
+      "completed": 18,
+      "total": 20,
+      "status": "IN_PROGRESS"
+    },
+    "evidence": {
+      "status": "COMPLETE",
+      "summary": "All accepted changes have integration evidence; C-015 has exact rejection evidence and C-020 has dependency-cancellation evidence.",
+      "blockers": []
+    },
+    "certification": {
+      "status": "COMPLETE",
+      "summary": "Accepted changes passed refinement and review; the two non-adopted changes are certified terminal by the ratified rejection decision.",
+      "blockers": []
+    },
+    "publication": {
+      "status": "COMPLETE",
+      "summary": "All eighteen accepted changes are reflected in source, specifications, archives, documentation, generated knowledge, and canonical KBD state.",
+      "blockers": []
     }
   },
   "changes": [
     {
       "id": "C-001",
       "title": "Stop materializing snapshot payload in read_snapshot",
-      "status": "pending"
+      "status": "DONE",
+      "implementation_status": "COMPLETE",
+      "tasks_total": 5,
+      "tasks_done": 5,
+      "last_task_completed": "Run repository baseline and refresh graph",
+      "next_task_pending": null,
+      "blockers": []
     },
     {
       "id": "C-002",
       "title": "Make snapshot limit error actionable",
-      "status": "pending"
+      "status": "DONE",
+      "implementation_status": "COMPLETE",
+      "tasks_total": 4,
+      "tasks_done": 4,
+      "last_task_completed": "Run verification, QA, review, and archive",
+      "next_task_pending": null,
+      "blockers": []
     },
     {
       "id": "C-003",
       "title": "Pre-flight graph size estimate",
-      "status": "pending"
+      "status": "DONE",
+      "implementation_status": "COMPLETE",
+      "tasks_total": 4,
+      "tasks_done": 4,
+      "last_task_completed": "Run verification QA review and archive",
+      "next_task_pending": null,
+      "blockers": []
     },
     {
       "id": "C-004",
       "title": "Honor COMPASS_MAX_GRAPH_BYTES on publication path",
-      "status": "pending"
+      "status": "DONE",
+      "implementation_status": "COMPLETE",
+      "tasks_total": 4,
+      "tasks_done": 4,
+      "last_task_completed": "Verify QA review and archive",
+      "next_task_pending": null,
+      "blockers": []
     },
     {
       "id": "C-005",
       "title": "Extract compass-partition shared crate",
-      "status": "pending"
+      "status": "DONE",
+      "implementation_status": "COMPLETE",
+      "tasks_total": 4,
+      "tasks_done": 4,
+      "last_task_completed": "Run verification QA review and archive",
+      "next_task_pending": null,
+      "blockers": []
     },
     {
       "id": "C-006",
       "title": "Decide vendor/ default-skip policy",
-      "status": "pending"
+      "status": "DONE",
+      "implementation_status": "COMPLETE",
+      "tasks_total": 3,
+      "tasks_done": 3,
+      "last_task_completed": "Run verification QA review and archive",
+      "next_task_pending": null,
+      "blockers": []
+    },
+    {
+      "id": "C-007",
+      "title": "Upgrade rmcp 2.2.0 to 3.1.4 with stdio parity",
+      "status": "DONE",
+      "implementation_status": "COMPLETE",
+      "tasks_total": 4,
+      "tasks_done": 4,
+      "last_task_completed": "Run verification QA review and archive",
+      "next_task_pending": null,
+      "blockers": []
+    },
+    {
+      "id": "C-008",
+      "title": "Stateless HTTP transport per MCP 2026-07-28",
+      "status": "DONE",
+      "implementation_status": "COMPLETE",
+      "tasks_total": 4,
+      "tasks_done": 4,
+      "last_task_completed": "Run verification QA review and archive",
+      "next_task_pending": null,
+      "blockers": []
+    },
+    {
+      "id": "C-009",
+      "title": "Common result envelope and typed navigation results",
+      "status": "DONE",
+      "implementation_status": "COMPLETE",
+      "tasks_total": 4,
+      "tasks_done": 4,
+      "last_task_completed": "Document verify review and archive",
+      "next_task_pending": null,
+      "blockers": []
+    },
+    {
+      "id": "C-010",
+      "title": "MCP conformance and named-harness interop matrix",
+      "status": "DONE",
+      "implementation_status": "COMPLETE",
+      "tasks_total": 4,
+      "tasks_done": 4,
+      "last_task_completed": "Document verify review and archive",
+      "next_task_pending": null,
+      "blockers": []
+    },
+    {
+      "id": "C-011",
+      "title": "SurrealDB BSL 1.1 license and release decision",
+      "status": "DONE",
+      "implementation_status": "COMPLETE",
+      "tasks_total": 4,
+      "tasks_done": 4,
+      "last_task_completed": "Apply outcome, verify, refine, review, and archive",
+      "next_task_pending": null,
+      "blockers": []
+    },
+    {
+      "id": "C-012",
+      "title": "Persistent SurrealKV and RocksDB throwaway probes",
+      "status": "DONE",
+      "implementation_status": "COMPLETE",
+      "tasks_total": 6,
+      "tasks_done": 6,
+      "last_task_completed": "Verify refine review and archive probe evidence",
+      "next_task_pending": null,
+      "blockers": []
+    },
+    {
+      "id": "C-013",
+      "title": "Measurement corpora baselines and budget ratification",
+      "status": "DONE",
+      "implementation_status": "COMPLETE",
+      "tasks_total": 7,
+      "tasks_done": 7,
+      "last_task_completed": "Verify refine review ratify and archive qualification evidence",
+      "next_task_pending": null,
+      "blockers": []
+    },
+    {
+      "id": "C-014",
+      "title": "compass-graphdb-surreal projection crate",
+      "status": "DONE",
+      "implementation_status": "COMPLETE",
+      "tasks_total": 4,
+      "tasks_done": 4,
+      "last_task_completed": "Documentation and qualification",
+      "next_task_pending": null,
+      "blockers": []
+    },
+    {
+      "id": "C-015",
+      "title": "Bounded native reads and dual-engine equivalence",
+      "status": "SKIPPED",
+      "implementation_status": "SKIPPED",
+      "tasks_total": 4,
+      "tasks_done": 3,
+      "last_task_completed": "Dual-engine equivalence and budget qualification",
+      "next_task_pending": "Documentation verification review and archive",
+      "blockers": []
+    },
+    {
+      "id": "C-016",
+      "title": "Focused Agent Skills with umbrella preserved",
+      "status": "DONE",
+      "implementation_status": "COMPLETE",
+      "tasks_total": 4,
+      "tasks_done": 4,
+      "last_task_completed": "Document verify review and archive",
+      "next_task_pending": null,
+      "blockers": []
+    },
+    {
+      "id": "C-017",
+      "title": "compass agent CLI namespace",
+      "status": "DONE",
+      "implementation_status": "COMPLETE",
+      "tasks_total": 4,
+      "tasks_done": 4,
+      "last_task_completed": "Qualification, refinement, review, and archive",
+      "next_task_pending": null,
+      "blockers": []
+    },
+    {
+      "id": "C-018",
+      "title": "Canonical distribution inventory and package generators",
+      "status": "DONE",
+      "implementation_status": "COMPLETE",
+      "tasks_total": 5,
+      "tasks_done": 5,
+      "last_task_completed": "Phase verification refinement review and archive",
+      "next_task_pending": null,
+      "blockers": []
+    },
+    {
+      "id": "C-019",
+      "title": "Installed-artifact validation and clean-install tests",
+      "status": "DONE",
+      "implementation_status": "COMPLETE",
+      "tasks_total": 4,
+      "tasks_done": 4,
+      "last_task_completed": "Verification refinement review and archive",
+      "next_task_pending": null,
+      "blockers": []
+    },
+    {
+      "id": "C-020",
+      "title": "Conditional compass-store-surreal Store adapter",
+      "status": "SKIPPED",
+      "implementation_status": "SKIPPED",
+      "tasks_total": 0,
+      "tasks_done": 0,
+      "last_task_completed": null,
+      "next_task_pending": null,
+      "blockers": []
     }
   ],
-  "children": []
-}
\ No newline at end of file
+  "children": {},
+  "migrationStatus": null
+}
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-001/findings.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-001/findings.json
new file mode 100644
index 000000000..af6290361
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-001/findings.json
@@ -0,0 +1,23 @@
+{
+  "mode": "diff",
+  "verdict": "PASS",
+  "judge_model": "k3",
+  "producer_model": "gpt-5.6-sol",
+  "isolation_mode": "rest-gateway:http://localhost:4000/v1",
+  "cross_model_check": "verified-distinct",
+  "findings": [
+    {
+      "severity": "SUGGESTION",
+      "file": "crates/compass-store/src/lib.rs",
+      "line": 988,
+      "claim": "The compatibility full-read path still pre-allocates from the unverified manifest: `Vec::with_capacity(capacity)` reserves up to MAX_GRAPH_BYTES (2 GiB) based solely on `manifest.payload_bytes` before any chunk or digest verification, so a corrupt-but-schema-valid manifest can force a bounded-but-large throwaway allocation \u2014 the very trust-based allocation pattern this change eliminates elsewhere.",
+      "evidence": "Hunk in `read_snapshot`: `let capacity = usize::try_from(manifest.payload_bytes)...; if capacity > MAX_GRAPH_BYTES { ... } let mut bytes = Vec::with_capacity(capacity);` \u2014 the allocation happens before `read_snapshot_chunks_for_manifest` verifies length/digest. Contrast with the change's stated goal ('Why': 'creates an avoidable payload-sized allocation') and the new doc on `read_snapshot_chunks` ('a corrupt manifest cannot drive unbounded work').",
+      "suggested_fix": "Start with an empty `Vec` and let `extend_from_slice` grow it per verified-bounded chunk (or `reserve` incrementally), so allocation tracks actually stored chunk bytes rather than the manifest's unverified claim; the per-loop `total > MAX_GRAPH_BYTES` check already bounds growth."
+    }
+  ],
+  "sycophancy_screen": {
+    "reject_cap": 2,
+    "cap_overridden": false,
+    "cap_default": 2
+  }
+}
\ No newline at end of file
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-001/rejection.md b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-001/rejection.md
new file mode 100644
index 000000000..e69de29bb
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-002/findings-2.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-002/findings-2.json
new file mode 100644
index 000000000..5b9506e8a
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-002/findings-2.json
@@ -0,0 +1,39 @@
+{
+  "mode": "diff",
+  "verdict": "PASS",
+  "judge_model": "k3",
+  "producer_model": "gpt-5.6-sol",
+  "isolation_mode": "rest-gateway:http://localhost:4000/v1",
+  "cross_model_check": "verified-distinct",
+  "findings": [
+    {
+      "severity": "WARNING",
+      "file": "crates/compass-cli/tests/snapshot_limit_cli.rs",
+      "line": 8,
+      "claim": "The new CLI regression imports sha2 (and uses tempfile), but the Cargo.toml hunk adds only rusqlite to compass-cli's dev-dependencies; if sha2/tempfile are not already declared for compass-cli, the workspace build/test constraint fails.",
+      "evidence": "Test header: `use sha2::{Digest, Sha256};` and `tempfile::tempdir()?`; the Cargo.toml diff shows only `+[dev-dependencies]\\n+rusqlite.workspace = true` for compass-cli, and the Cargo.lock hunk shows only the rusqlite edge added to compass-cli. Blocking constraints `build-passes` and `tests-pass` require the workspace to compile and test.",
+      "suggested_fix": "Verify compass-cli already declares sha2 and tempfile (dev-)dependencies; if not, add `sha2.workspace = true` / `tempfile.workspace = true` under [dev-dependencies] and refresh Cargo.lock."
+    },
+    {
+      "severity": "WARNING",
+      "file": "crates/compass-cli/tests/snapshot_limit_cli.rs",
+      "line": 10,
+      "claim": "The CLI test hard-codes compass-store's private SQLite layout (kv table schema, namespace `compass.current.graph.v1`, partitions `graph-snapshot/catalog`/`graph-snapshot/objects`, the `manifest/` key prefix, and the digest-column convention), coupling a compass-cli test to another crate's unversioned internal storage format.",
+      "evidence": "Lines 10-13 define GRAPH_NAMESPACE/CATALOG_PARTITION/OBJECT_PARTITION/ACTIVE_KEY constants duplicating compass-store internals, and the test issues raw `INSERT INTO kv(namespace, partition, key, value, digest, version)` / `UPDATE kv SET ...` statements. The warning constraint `correct-ownership-boundary` requires changes to live in the owning crate; this test reaches across that boundary and will break (or, worse, fabricate rows the store no longer reads) on any store schema change.",
+      "suggested_fix": "Move the manifest-forging helper into compass-store as a test-support API (or share the constants via a pub module), so the CLI regression asserts behavior while the store owns its layout."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "crates/compass-graph/src/snapshot.rs",
+      "line": 3322,
+      "claim": "The unit test asserts only two substrings of the remediation text, so the middle of the message (`retry or rebuild with a smaller scope using`) \u2014 which design.md designates as a stable, deliberate contract \u2014 can drift without any test failing.",
+      "evidence": "design.md: 'becomes SnapshotError::Limit with this stable actionable suffix: `retry or rebuild with a smaller scope using --exclude <pattern> or persistent patterns in .compassignore`'; the test only checks `message.contains(\"--exclude <pattern>\")` and `message.contains(\".compassignore\")`.",
+      "suggested_fix": "Assert the full rendered message (or the complete stable suffix) with assert_eq!/contains on the entire string so the documented contract is pinned verbatim."
+    }
+  ],
+  "sycophancy_screen": {
+    "reject_cap": 2,
+    "cap_overridden": false,
+    "cap_default": 2
+  }
+}
\ No newline at end of file
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-002/findings-3.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-002/findings-3.json
new file mode 100644
index 000000000..bf118f724
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-002/findings-3.json
@@ -0,0 +1,39 @@
+{
+  "mode": "diff",
+  "verdict": "PASS",
+  "judge_model": "k3",
+  "producer_model": "gpt-5.6-sol",
+  "isolation_mode": "rest-gateway:http://localhost:4000/v1",
+  "cross_model_check": "verified-distinct",
+  "findings": [
+    {
+      "severity": "WARNING",
+      "file": "crates/compass-graph/src/snapshot.rs",
+      "line": 172,
+      "claim": "Reclassifying an oversized manifest from SnapshotError::Corrupt to SnapshotError::Limit changes the variant observed by every existing caller of GraphSnapshotManifest::validate() (reader open, activation, GC paths across compass-store-redb/compass-graphdb/compass-cli), and the packet contains no call-site audit showing none of them branch on the Corrupt variant (e.g., for fallback, quarantine, or error-mapping behavior).",
+      "evidence": "Hunk in `GraphSnapshotManifest::validate` replacing the combined `graph_bytes == 0 || graph_bytes > MAX_GRAPH_BYTES` Corrupt arm with `SnapshotError::canonical_graph_too_large(...)` (a `Limit` variant) for the oversized case; the diff shows no grep or test evidence that `match` sites on `SnapshotError::Corrupt` were reviewed.",
+      "suggested_fix": "Audit all consumers of SnapshotError (rg 'SnapshotError::Corrupt' and 'SnapshotError::Limit' across crates/) and either confirm variant-agnostic handling or update any Corrupt-specific branching to also handle Limit; note the result in the design doc."
+    },
+    {
+      "severity": "WARNING",
+      "file": "crates/compass-graph/src/snapshot.rs",
+      "line": 3150,
+      "claim": "digest_json is generic over any serializable payload (`fn digest_json<T: Serialize>(value: &T, maximum: usize)`), but the failure it now returns unconditionally advises graph-scope remediation (`--exclude <pattern>`, `.compassignore`), so any current or future non-graph call site (e.g., selector or delta digest encoding in the same module) would emit a misleading recovery action tied to an unrelated limit.",
+      "evidence": "Hunk in `digest_json` replacing the plain limit message with `SnapshotError::canonical_graph_too_large(maximum as u64)`; the constructor hardcodes 'canonical graph exceeds ... retry or rebuild with a smaller scope using --exclude <pattern> or persistent patterns in .compassignore' regardless of what `value` was being encoded.",
+      "suggested_fix": "Either make digest_json graph-specific (rename to digest_canonical_graph_json) or have it return a neutral Limit and attach the scope-remediation suffix only at the canonical-graph publication call site."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "crates/compass-cli/tests/snapshot_limit_cli.rs",
+      "line": 76,
+      "claim": "The CLI regression passes the graph path to the binary via `graph_path.to_string_lossy()`, which silently mangles non-UTF-8 paths; on Windows temp directories with non-UTF-8 components the test would exercise a path that is not the real artifact path, weakening the platform-portable guarantee the constraint requires.",
+      "evidence": "`.args([\"search\", \"sample\", \"--graph\", graph_path.to_string_lossy().as_ref(), ...])`; constraint `platform-portable`: 'No assumption of UTF-8 paths ... without a guarded implementation and test.'",
+      "suggested_fix": "Pass the path as an OsStr argument (`graph_path.as_os_str()`) so the test exercises the exact artifact path on all platforms."
+    }
+  ],
+  "sycophancy_screen": {
+    "reject_cap": 2,
+    "cap_overridden": false,
+    "cap_default": 2
+  }
+}
\ No newline at end of file
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-002/findings.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-002/findings.json
new file mode 100644
index 000000000..c6bdad9e8
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-002/findings.json
@@ -0,0 +1,55 @@
+{
+  "mode": "diff",
+  "verdict": "BLOCK",
+  "judge_model": "k3",
+  "producer_model": "gpt-5.6-sol",
+  "isolation_mode": "rest-gateway:http://localhost:4000/v1",
+  "cross_model_check": "verified-distinct",
+  "findings": [
+    {
+      "severity": "CRITICAL",
+      "file": "crates/compass-cli/Cargo.toml",
+      "line": 66,
+      "claim": "Acceptance criterion 3.1 (binary-level CLI regression asserting rendered remediation text, absent COMPASS_MAX_GRAPH_BYTES, and exit code 1) is marked complete, but the diff contains no CLI test at all; the only test added is a compass-graph unit test.",
+      "evidence": "The diff adds `[dev-dependencies] rusqlite.workspace = true` to crates/compass-cli/Cargo.toml and a matching Cargo.lock entry, yet no file under crates/compass-cli/tests/ (or any other CLI test target) is added or modified. The only new test is `canonical_graph_limit_errors_name_shipped_scope_controls` in crates/compass-graph/src/snapshot.rs, which is a library unit test and cannot assert exit code 1 or rendered CLI stderr. Criterion 3.1 is checked [x] but unsatisfied.",
+      "suggested_fix": "Add the promised binary-level CLI regression test (e.g. under crates/compass-cli/tests/) that drives publication past the byte limit, asserts stderr contains '--exclude <pattern>' and '.compassignore', does not contain 'COMPASS_MAX_GRAPH_BYTES', and asserts exit status 1 \u2014 or uncheck criterion 3.1."
+    },
+    {
+      "severity": "WARNING",
+      "file": "crates/compass-cli/Cargo.toml",
+      "line": 66,
+      "claim": "rusqlite is added as a dev-dependency of compass-cli with no code in the diff that uses it, leaving a dead dependency and an unexplained Cargo.lock mutation.",
+      "evidence": "Cargo.toml hunk adds `rusqlite.workspace = true` under a new `[dev-dependencies]` section and Cargo.lock adds `\"rusqlite\"` to the compass-cli dependency list, but no test or source file in the diff references rusqlite. This also trips the `workspace-dependencies-reused` warning constraint ('new dependencies are justified') since nothing justifies it here.",
+      "suggested_fix": "Either land the test that consumes rusqlite in this diff, or drop the dev-dependency and the Cargo.lock change."
+    },
+    {
+      "severity": "WARNING",
+      "file": "CHANGELOG.md",
+      "line": 9,
+      "claim": "The CHANGELOG entry describes 'manifest-only and bounded chunk-streaming reads for SQLite graph snapshots' and production validation/reference-generation changes that are not present anywhere in this diff, bundling unrelated release notes into this change.",
+      "evidence": "The second added CHANGELOG bullet describes SQLite snapshot streaming behavior, but the diff touches only the error-message construction in crates/compass-graph/src/snapshot.rs plus the unused rusqlite dev-dependency. Constraint `no-unrelated-diff-noise` (warning): 'git diff ... contain no unrelated or generated noise.'",
+      "suggested_fix": "Remove the chunk-streaming CHANGELOG bullet (and the associated rusqlite dependency if it belongs to that work) from this change and ship it with the diff that actually implements it."
+    },
+    {
+      "severity": "WARNING",
+      "file": "crates/compass-graph/src/snapshot.rs",
+      "line": 69,
+      "claim": "The actionable remediation text is now also emitted from GraphSnapshotManifest::validate, which runs when reading/validating existing snapshots, where advising the user to 'reduce the build scope with --exclude' is misleading for a consumer of an already-published snapshot.",
+      "evidence": "The hunk changes `GraphSnapshotManifest::validate` to return `SnapshotError::canonical_graph_too_large(MAX_GRAPH_BYTES as u64)` for `graph_bytes > MAX_GRAPH_BYTES`; that constructor bakes in publication-time advice ('reduce the build scope with --exclude <pattern> or add persistent patterns to .compassignore'). validate() is a shared manifest-validation path, not publication-specific, so read-side callers will surface build-time remediation.",
+      "suggested_fix": "Keep the Corrupt/limit classification in validate() with a neutral message, and attach the --exclude/.compassignore remediation only at the publication call site (e.g. digest_json and the publish path), or split the constructor into publication-specific and validation-specific variants."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "CHANGELOG.md",
+      "line": 4,
+      "claim": "The user-visible error-category reclassification (oversized manifest from SnapshotError::Corrupt to SnapshotError::Limit) is documented in the proposal's Compatibility section but not in the CHANGELOG entry.",
+      "evidence": "The proposal states 'corrects the error category from corruption to a resource-limit failure', and the diff changes `manifest.validate()` from `SnapshotError::Corrupt` to `SnapshotError::Limit`, but the CHANGELOG bullet only mentions naming --exclude and .compassignore. The `compatibility-documented` warning constraint lists error/contract-visible changes as compatibility-sensitive.",
+      "suggested_fix": "Add a sentence to the CHANGELOG noting that oversized canonical-graph manifests now surface as a limit failure rather than a corruption failure."
+    }
+  ],
+  "sycophancy_screen": {
+    "reject_cap": 2,
+    "cap_overridden": false,
+    "cap_default": 2
+  }
+}
\ No newline at end of file
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-002/rejection-2.md b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-002/rejection-2.md
new file mode 100644
index 000000000..e69de29bb
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-002/rejection-3.md b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-002/rejection-3.md
new file mode 100644
index 000000000..e69de29bb
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-002/rejection.md b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-002/rejection.md
new file mode 100644
index 000000000..e69de29bb
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-005/findings.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-005/findings.json
new file mode 100644
index 000000000..4bca0b2f6
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-005/findings.json
@@ -0,0 +1,33 @@
+{
+  "mode": "diff",
+  "verdict": "PASS",
+  "judge_model": "gpt-5.6-sol-harness",
+  "isolation_mode": "harness-native",
+  "producer_model": "gpt-5.6-sol",
+  "cross_model_check": "same-family-fresh-context",
+  "findings": [
+    {
+      "severity": "WARNING",
+      "file": "crates/compass-history/Cargo.toml",
+      "line": 28,
+      "claim": "The new inter-crate dependency bypasses the required workspace dependency declaration.",
+      "evidence": "The initial extraction used a direct path dependency instead of the plan-required workspace dependency.",
+      "suggested_fix": "Declare compass-partition in root workspace dependencies and consume it with workspace = true.",
+      "resolution": "fixed before archive"
+    },
+    {
+      "severity": "WARNING",
+      "file": "CHANGELOG.md",
+      "line": 10,
+      "claim": "The cumulative review diff contains earlier completed changes' changelog entries.",
+      "evidence": "C-001 through C-004 remain uncommitted in the shared worktree and have independent QA/review receipts.",
+      "suggested_fix": "Retain target-specific review provenance until changes are sliced for upstream commits.",
+      "resolution": "acknowledged; valid prior change entries preserved"
+    }
+  ],
+  "sycophancy_screen": {
+    "reject_cap": 2,
+    "cap_overridden": false,
+    "cap_default": 2
+  }
+}
\ No newline at end of file
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-005/findings.round1.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-005/findings.round1.json
new file mode 100644
index 000000000..220839734
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-005/findings.round1.json
@@ -0,0 +1,26 @@
+{
+  "mode": "diff",
+  "verdict": "BLOCK",
+  "judge_model": "gpt-5.6-sol-harness",
+  "isolation_mode": "harness-native",
+  "producer_model": "gpt-5.6-sol",
+  "cross_model_check": "same-family-fresh-context",
+  "findings": [
+    {
+      "severity": "CRITICAL",
+      "file": "openspec/changes/extract-compass-partition/tasks.md",
+      "line": 15,
+      "claim": "The required verification work is explicitly incomplete, so acceptance criterion 4.1 and the blocking build, test, Clippy, and formatting constraints are not satisfied by this packet.",
+      "evidence": "Acceptance criterion 4.1 is unchecked and the packet contains no completed verification record.",
+      "suggested_fix": "Record the successful gates and mark verification complete before review."
+    },
+    {
+      "severity": "WARNING",
+      "file": "CHANGELOG.md",
+      "line": 7,
+      "claim": "The cumulative diff contains release claims from earlier changes outside the partition extraction target.",
+      "evidence": "The worktree retains the completed, independently reviewed C-001 through C-004 changelog entries alongside C-005.",
+      "suggested_fix": "Document cumulative-diff provenance so earlier accepted changes are not mistaken for C-005 scope."
+    }
+  ]
+}
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-006/findings.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-006/findings.json
new file mode 100644
index 000000000..6d7f04b23
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-006/findings.json
@@ -0,0 +1,16 @@
+{
+  "findings": [],
+  "checked_classes": [
+    "Spec violations \u2014 the diff records the deliberate default-include policy and adds discovery, publication, watcher, .compassignore, extra-exclude, and saved-scope regression coverage required by the acceptance criteria.",
+    "Correctness \u2014 the test fixtures exercise both a Rust workspace member and Go source beneath vendor/, and assertions check inventory, published source anchors, discovery results, and watcher filtering consistently.",
+    "Regressions \u2014 the packet explicitly defines this as preservation of existing behavior, and the added tests pin both default eligibility and all specified opt-out surfaces without changing production code.",
+    "Security \u2014 the diff adds only local temporary-fixture tests and documentation; it introduces no network, credential, deserialization, subprocess, or path-containment boundary.",
+    "Constraint breaches \u2014 the diff uses deterministic BTreeMap collection, typed Result propagation, temporary directories, locked verification commands, and includes the required lowest-layer plus build-level regression coverage.",
+    "Silent failure \u2014 test setup and graph building propagate errors, while policy outcomes are asserted directly rather than converted to defaults or empty-success states."
+  ],
+  "sycophancy_screen": {
+    "reject_cap": 2,
+    "cap_overridden": false,
+    "cap_default": 2
+  }
+}
\ No newline at end of file
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-006/findings.round1.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-006/findings.round1.json
new file mode 100644
index 000000000..be3367963
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-006/findings.round1.json
@@ -0,0 +1,26 @@
+{
+  "mode": "diff",
+  "verdict": "BLOCK",
+  "judge_model": "gpt-5.6-sol-harness",
+  "isolation_mode": "harness-native",
+  "producer_model": "gpt-5.6-sol",
+  "cross_model_check": "same-family-fresh-context",
+  "findings": [
+    {
+      "severity": "CRITICAL",
+      "file": "crates/compass-files/tests/contracts.rs",
+      "line": 164,
+      "claim": "The fixture did not create a valid Cargo manifest for its declared workspace member.",
+      "evidence": "Only the root members list and member source file were created.",
+      "suggested_fix": "Create a valid member Cargo.toml."
+    },
+    {
+      "severity": "CRITICAL",
+      "file": "crates/compass-files/tests/contracts.rs",
+      "line": 159,
+      "claim": "The regression pinned default eligibility but not the specified explicit exclusion surfaces.",
+      "evidence": "No vendor-specific .compassignore, extra exclusion, saved scope, or watcher rejection assertion existed.",
+      "suggested_fix": "Add vendor-specific assertions for every claimed exclusion surface."
+    }
+  ]
+}
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-007/findings.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-007/findings.json
new file mode 100644
index 000000000..9d66efdff
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-007/findings.json
@@ -0,0 +1,16 @@
+{
+  "findings": [],
+  "checked_classes": [
+    "spec violations",
+    "correctness",
+    "regressions",
+    "security",
+    "constraint breaches",
+    "silent failure"
+  ],
+  "sycophancy_screen": {
+    "reject_cap": 2,
+    "cap_overridden": false,
+    "cap_default": 2
+  }
+}
\ No newline at end of file
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-007/findings.round1.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-007/findings.round1.json
new file mode 100644
index 000000000..0ba38a4b5
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-007/findings.round1.json
@@ -0,0 +1,13 @@
+{
+  "findings": [
+    {
+      "severity": "CRITICAL",
+      "file": "Cargo.toml",
+      "line": 20,
+      "claim": "The C-007 patch is contaminated with unrelated partition/storage and graph-limit work, violating the stated dependency-and-API-migration-only scope.",
+      "evidence": "The proposal says this change is limited to pinning rmcp 3.1.4, porting its API, compatibility coverage, and dependency-policy review, while the diff also adds `crates/compass-partition` as a workspace member and workspace dependency, changes `compass-history` to depend on it in Cargo.lock, and adds five unrelated CHANGELOG entries for partition extraction, graph-size limits, preflight, oversized-manifest handling, and streaming snapshot reads; this also breaches the `no-unrelated-diff-noise` constraint.",
+      "suggested_fix": "Rebase or regenerate the C-007 packet against the correct baseline so it contains only the rmcp migration hunks and its own changelog/spec/test changes."
+    }
+  ],
+  "checked_classes": []
+}
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-008/findings.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-008/findings.json
new file mode 100644
index 000000000..afcd44bc2
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-008/findings.json
@@ -0,0 +1,28 @@
+{
+  "mode": "diff",
+  "verdict": "PASS",
+  "judge_model": "gpt-5.6-sol/fresh-context-subagent",
+  "isolation_mode": "harness-native",
+  "producer_model": "gpt-5.6-sol",
+  "cross_model_check": "same-model-collision",
+  "findings": [],
+  "checked_classes": [
+    "Correctness: the raw-wire test executes independent server/discover and tools/list requests and asserts the 2026-07-28 version plus the unchanged 15-tool inventory.",
+    "Authentication ordering: transport.rs checks API-key or bearer credentials before host and protocol parsing; a wrong bearer token combined with an attacker Host receives 401 rather than a host or protocol diagnostic.",
+    "Host validation: transport.rs mirrors rmcp explicit-Host precedence, normalized host comparison, and portless allowlist semantics; authenticated attacker, missing, malformed, old-protocol, and arbitrary-port cases pin the boundary before protocol dispatch.",
+    "Request bounds: rmcp configuration and RequestBodyLimitLayer both apply the unchanged 16 MiB request cap, leaving no unbounded stateless request path.",
+    "Known response bounds: enforce_response_limit rejects a lower size hint above 64 MiB with HTTP 500 and typed JSON-RPC error -32023 before body transmission.",
+    "Streaming response bounds: every other body is wrapped in http_body_util::Limited; the unknown-length two-chunk regression yields only the first in-bound chunk and then LengthLimitError instead of the overflow chunk.",
+    "Protocol negative matrix: raw-wire cases assert typed codes for missing protocol, missing method, missing and incomplete _meta, header/body method mismatch, and current-version initialize.",
+    "Session semantics: with_legacy_session_mode(false) prevents session creation; initialize is rejected, while an obsolete Mcp-Session-Id is ignored and no response session ID is issued, matching the acceptance scenario.",
+    "CLI compatibility: unit and executable tests pin the exact session-timeout warning while preserving usage exit 2 and runtime exit 1; both option spellings retain numeric validation.",
+    "Dependency scope: http-body-util is inherited for production Limited use, while channel is enabled only in compass-mcp dev-dependencies; C-007 sha2 and earlier partition work are baseline context rather than C-008 additions.",
+    "Documentation: COMPATIBILITY, MIGRATION, SECURITY, command/configuration references, CHANGELOG, and OpenSpec consistently state stateless 2026 HTTP, no legacy mode, ignored obsolete session headers, and the 0.5.0 option-removal schedule.",
+    "Diff contamination: files.txt limits the isolated packet to Cargo metadata, compass-mcp/CLI implementation and tests, public compatibility documents, and the C-008 OpenSpec artifact; no earlier graph-limit or storage implementation hunk is added."
+  ],
+  "sycophancy_screen": {
+    "reject_cap": 2,
+    "cap_overridden": false,
+    "cap_default": 2
+  }
+}
\ No newline at end of file
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-008/findings.round1.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-008/findings.round1.json
new file mode 100644
index 000000000..df7befa45
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-008/findings.round1.json
@@ -0,0 +1,28 @@
+{
+  "findings": [
+    {
+      "severity": "MAJOR",
+      "file": "crates/compass-mcp/src/transport.rs",
+      "line": null,
+      "claim": "The stateless cutover removes the only explicit 64 MiB HTTP response bound without adding a replacement, violating the stated requirement that response limits remain unchanged and the bounded-work constraint.",
+      "evidence": "The diff deletes MAX_HTTP_RESPONSE_BYTES and the to_bytes overflow path, while the new server configuration adds only a maximum request body size. No response-size limit or distinct response-limit error remains visible in the first-round packet.",
+      "suggested_fix": "Apply an explicit bounded response mechanism to stateless JSON/SSE responses, preserve a distinct limit-exceeded outcome, and add a regression test that forces an oversized response."
+    },
+    {
+      "severity": "MAJOR",
+      "file": "crates/compass-mcp/src/transport.rs",
+      "line": null,
+      "claim": "The contract's negative protocol scenarios are not covered by the new raw-wire regression, leaving required per-request metadata and the explicit initialize rejection branch unverified.",
+      "evidence": "The first-round positive requests include _meta, but no request omits or incompletely supplies _meta and none mismatches Mcp-Method. The legacy request is rejected by its old protocol version before reaching the initialize rejection branch.",
+      "suggested_fix": "Add raw-wire current-version cases for missing and incomplete _meta, a header/body method mismatch, initialize, and a valid request carrying an obsolete session ID; assert typed JSON-RPC errors and prove no session is created or restored."
+    }
+  ],
+  "checked_classes": [
+    "correctness",
+    "security",
+    "bounded-work",
+    "compatibility",
+    "test-coverage",
+    "documentation"
+  ]
+}
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-008/findings.round2.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-008/findings.round2.json
new file mode 100644
index 000000000..a33748b0e
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-008/findings.round2.json
@@ -0,0 +1,42 @@
+{
+  "findings": [
+    {
+      "severity": "MAJOR",
+      "file": "crates/compass-mcp/src/transport.rs",
+      "line": 223,
+      "claim": "Authenticated requests with an invalid Host can bypass the configured allowed-host validation when protocol headers are missing or invalid.",
+      "evidence": "The protocol gate returned before the inner rmcp service's host validation, and the host regression covered only otherwise-valid protocol headers.",
+      "suggested_fix": "Enforce the same allowed-host boundary in the outer gate before protocol handling and add combined authenticated invalid-host plus missing/invalid-protocol tests."
+    },
+    {
+      "severity": "MAJOR",
+      "file": "crates/compass-mcp/src/transport.rs",
+      "line": 396,
+      "claim": "The claimed streaming-response boundary is not regression-tested.",
+      "evidence": "The response test covered only bodies with exact size hints, never an unknown-length multi-chunk body crossing the limit.",
+      "suggested_fix": "Add an unknown-length chunked body that crosses the limit and assert bounded delivered bytes plus an explicit stream limit error."
+    },
+    {
+      "severity": "MINOR",
+      "file": "crates/compass-mcp/Cargo.toml",
+      "line": 30,
+      "claim": "The packet adds an apparently unrelated sha2 dev-dependency.",
+      "evidence": "The isolated C-008 packet baseline omitted C-007's discovery-golden dependency even though the live change uses it there.",
+      "suggested_fix": "Correct the synthetic review baseline so C-007's sha2 dependency does not appear as C-008 scope."
+    }
+  ],
+  "checked_classes": [
+    "correctness",
+    "security and authentication ordering",
+    "host validation",
+    "bounded request bodies",
+    "bounded known-size responses",
+    "bounded streaming responses",
+    "protocol compatibility",
+    "negative-case coverage",
+    "CLI compatibility",
+    "documentation",
+    "dependency hygiene",
+    "scope contamination"
+  ]
+}
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-008/findings.round3.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-008/findings.round3.json
new file mode 100644
index 000000000..0877a41d9
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-008/findings.round3.json
@@ -0,0 +1,50 @@
+{
+  "findings": [
+    {
+      "severity": "MAJOR",
+      "file": "crates/compass-mcp/src/transport.rs",
+      "line": 268,
+      "claim": "The outer host gate is not exactly equivalent to effective-authority validation.",
+      "disposition": "REJECTED",
+      "evidence": "rmcp 3.1.4 parse_host_header explicitly prefers Host over URI authority, and host_is_allowed explicitly lets a portless allowlist entry match every port. Compass mirrors both rules; focused regressions now document them."
+    },
+    {
+      "severity": "MAJOR",
+      "file": "crates/compass-mcp/src/transport.rs",
+      "line": 703,
+      "claim": "An obsolete Mcp-Session-Id must be rejected rather than ignored.",
+      "disposition": "REJECTED",
+      "evidence": "The accepted scenario requires no session creation or restoration, not rejection of an otherwise-current request. The spec now states explicitly that initialize is rejected while an obsolete header is ignored without state."
+    },
+    {
+      "severity": "MINOR",
+      "file": "crates/compass-mcp/src/transport.rs",
+      "line": 730,
+      "claim": "The host/security ordering matrix lacks malformed, missing, and invalid-auth combinations.",
+      "disposition": "FIXED"
+    },
+    {
+      "severity": "MINOR",
+      "file": "Cargo.toml",
+      "line": 122,
+      "claim": "The channel feature is enabled for production despite test-only use.",
+      "disposition": "FIXED"
+    },
+    {
+      "severity": "MINOR",
+      "file": "CHANGELOG.md",
+      "line": 9,
+      "claim": "The Unreleased changelog contains contradictory HTTP session claims.",
+      "disposition": "FIXED"
+    }
+  ],
+  "checked_classes": [
+    "authentication and host ordering",
+    "rmcp allowed-host equivalence",
+    "bounded HTTP bodies",
+    "stateless session semantics",
+    "raw-wire negative coverage",
+    "dependency hygiene",
+    "release documentation"
+  ]
+}
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-009/findings.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-009/findings.json
new file mode 100644
index 000000000..9ce3df659
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-009/findings.json
@@ -0,0 +1,27 @@
+{
+  "mode": "diff",
+  "verdict": "PASS",
+  "judge_model": "gpt-5.6-sol/fresh-context-subagent",
+  "isolation_mode": "harness-native",
+  "producer_model": "gpt-5.6-sol",
+  "cross_model_check": "same-model-collision",
+  "findings": [],
+  "checked_classes": [
+    "shared JSON/store build-identity validation",
+    "snapshot metadata rejection regression",
+    "closed exhaustive output schemas",
+    "four envelope and pre-envelope goldens",
+    "parallel-edge multiplicity golden",
+    "final response-byte bounds",
+    "MCP resultType wire metadata",
+    "deterministic discovery ordering",
+    "legacy text-result deprecations",
+    "compatibility and migration documentation",
+    "focused compass-graph and compass-mcp tests"
+  ],
+  "sycophancy_screen": {
+    "reject_cap": 2,
+    "cap_overridden": false,
+    "cap_default": 2
+  }
+}
\ No newline at end of file
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-009/findings.round1.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-009/findings.round1.json
new file mode 100644
index 000000000..5c956e547
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-009/findings.round1.json
@@ -0,0 +1,42 @@
+{
+  "findings": [
+    {
+      "severity": "MAJOR",
+      "claim": "Envelope identity could come from a different graph realization than query data.",
+      "resolution": "FIXED: CodeQueryEngine now returns BuildMetadata from its pinned materialized graph or immutable store selector; MCP uses that exact invocation metadata."
+    },
+    {
+      "severity": "MAJOR",
+      "claim": "Advertised outputSchema left nested query records unconstrained.",
+      "resolution": "FIXED: outputSchema now defines closed nested query records and every golden is recursively validated; malformed node payloads are rejected by the regression validator."
+    },
+    {
+      "severity": "MAJOR",
+      "claim": "Envelope overhead could cross maxResponseBytes after query-layer enforcement.",
+      "resolution": "FIXED: MCP measures final structured-content bytes and fails before publishing an oversized envelope; a regression exercises the inner-pass/outer-fail boundary."
+    },
+    {
+      "severity": "MAJOR",
+      "claim": "Legacy text tools were neither enveloped nor deprecated.",
+      "resolution": "FIXED: discovery descriptions and Compass metadata mark every remaining text-only result, plus query_graph text mode, deprecated from 0.4.0 without removal."
+    },
+    {
+      "severity": "MAJOR",
+      "claim": "No independent pre-envelope golden comparison existed.",
+      "resolution": "FIXED: four separate compass.query/1 fixtures are compared exactly with envelope.data in addition to four full-envelope goldens."
+    },
+    {
+      "severity": "MINOR",
+      "claim": "The design example used confidence fields absent from implementation.",
+      "resolution": "FIXED: the example now uses exact, inferred, and ambiguous."
+    }
+  ],
+  "checked_classes": [
+    "identity coherence",
+    "nested output schemas",
+    "response-byte bounds",
+    "legacy deprecation",
+    "pre-envelope compatibility",
+    "documentation parity"
+  ]
+}
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-009/findings.round2.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-009/findings.round2.json
new file mode 100644
index 000000000..17038bf94
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-009/findings.round2.json
@@ -0,0 +1,24 @@
+{
+  "findings": [
+    {
+      "severity": "MAJOR",
+      "claim": "Nested node/edge detail variants and graph enums were still under-specified.",
+      "resolution": "FIXED: output schemas now enumerate every NodeKind, NodeRole, and EdgeKind and define closed tagged schemas for all NodeDetails and EdgeDetails variants; regressions accept valid non-null variants and reject unknown tags, fields, and enum values."
+    },
+    {
+      "severity": "MAJOR",
+      "claim": "The rmcp wire-discovery golden discarded outputSchema and deprecation metadata.",
+      "resolution": "FIXED: normalized local and wire discovery now retain output-schema digests and exact metadata for all tools, and the checked-in golden pins those fields."
+    },
+    {
+      "severity": "MINOR",
+      "claim": "Final-envelope overflow lost the stable query_response_too_large diagnostic identifier.",
+      "resolution": "FIXED: the outer bound preserves query_response_too_large, and a protocol-level call_tool regression exercises the inner-pass/outer-fail case."
+    }
+  ],
+  "checked_classes": [
+    "closed tagged detail schemas and enums",
+    "wire discovery output-schema and metadata contract",
+    "protocol-level final-envelope bounds"
+  ]
+}
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-009/findings.round3.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-009/findings.round3.json
new file mode 100644
index 000000000..910a57d63
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-009/findings.round3.json
@@ -0,0 +1,18 @@
+{
+  "findings": [
+    {
+      "severity": "MAJOR",
+      "claim": "Standalone graphs with empty repository or generation identities could produce schema-invalid envelopes.",
+      "resolution": "FIXED: compass-model graph validation now rejects empty sourceTreeDigest and generationId values; an MCP regression proves malformed standalone input fails before structured content is published."
+    },
+    {
+      "severity": "MINOR",
+      "claim": "Malformed-schema regressions did not mutate edge details, edge kinds, or node roles.",
+      "resolution": "FIXED: the schema suite now rejects unknown edge detail tags, extra edge detail fields, unknown edge kinds, and unknown node roles."
+    }
+  ],
+  "checked_classes": [
+    "standalone graph identity validation",
+    "edge detail and enum negative coverage"
+  ]
+}
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-009/findings.round4.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-009/findings.round4.json
new file mode 100644
index 000000000..76bedfff3
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-009/findings.round4.json
@@ -0,0 +1,18 @@
+{
+  "findings": [
+    {
+      "severity": "MAJOR",
+      "claim": "Output-schema regressions did not exercise every legal model vocabulary and tagged detail variant.",
+      "resolution": "FIXED: schema enums are derived from model-owned ALL vocabularies, and table-driven tests serialize every NodeKind, NodeRole, EdgeKind, all 12 NodeDetails variants, and all 5 EdgeDetails variants with missing-data, unknown-field, and unknown-tag negatives."
+    },
+    {
+      "severity": "MAJOR",
+      "claim": "Pre-envelope goldens did not exercise relationship multiplicity.",
+      "resolution": "FIXED: a separate checked-in compass.query/1 golden contains two same-kind, same-endpoint call occurrences with distinct IDs, source sites, detail payloads, and evidence; envelope.data must match it exactly in deterministic order."
+    }
+  ],
+  "checked_classes": [
+    "complete graph enum and tagged-detail schema vocabulary",
+    "parallel relationship identity, source site, evidence, and ordering"
+  ]
+}
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-009/findings.round5.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-009/findings.round5.json
new file mode 100644
index 000000000..de298e8bf
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-009/findings.round5.json
@@ -0,0 +1,12 @@
+{
+  "findings": [
+    {
+      "severity": "MAJOR",
+      "claim": "Immutable store metadata could still bypass strict graph identity validation and yield schema-invalid envelopes.",
+      "resolution": "FIXED: one shared compass-model identity validator now guards strict graphs, GraphSnapshotReader metadata summaries, and CodeQueryEngine metadata for every backend. A low-level immutable-store regression constructs empty metadata identities and proves the store reader rejects them."
+    }
+  ],
+  "checked_classes": [
+    "shared JSON and immutable-store build identity validation"
+  ]
+}
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-010/findings-round1.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-010/findings-round1.json
new file mode 100644
index 000000000..6a9f055a5
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-010/findings-round1.json
@@ -0,0 +1,47 @@
+{
+  "mode": "diff",
+  "verdict": "BLOCK",
+  "judge_model": "k3",
+  "producer_model": "gpt-5.6-sol",
+  "isolation_mode": "rest-gateway:http://localhost:4000/v1",
+  "cross_model_check": "verified-distinct",
+  "findings": [
+    {
+      "severity": "CRITICAL",
+      "file": "crates/compass-mcp/src/transport.rs",
+      "line": 160,
+      "claim": "`--session-timeout` is now silently ignored: the diff deletes the only read of `HttpOptions::session_timeout` (the `manager.session_config.keep_alive` wiring) and adds no deprecation-warning code anywhere, while the same diff's COMPATIBILITY.md promises the flag 'emits a deprecation warning, and is ignored'.",
+      "evidence": "transport.rs hunk removes `manager.session_config.keep_alive = ... options.session_timeout.filter(...)` and the new `build_http_router` never references `options.session_timeout`; no compass-cli hunks exist in the diff; COMPATIBILITY.md hunk states '`--session-timeout` remains accepted in 0.4.x, validates its existing numeric grammar, emits a deprecation warning, and is ignored'; plan C-008 done-when requires '`--session-timeout` deprecation path implemented + tested (warning text, exit codes unchanged)'.",
+      "suggested_fix": "Emit the deprecation warning where compass-cli parses `--session-timeout` (with a regression test asserting warning text and unchanged exit codes), or remove the flag and correct COMPATIBILITY.md; do not ship a flag that is silently discarded while docs claim a warning."
+    },
+    {
+      "severity": "WARNING",
+      "file": "COMPATIBILITY.md",
+      "line": 0,
+      "claim": "The diff makes incompatible user-visible HTTP contract changes (session mode removed, `initialize` now returns 404, stateless becomes the only mode, legacy SSE conversion deleted) with no MIGRATION.md note and no CHANGELOG.md entry.",
+      "evidence": "Warning constraint `compatibility-documented`: 'Incompatible user-visible changes include regression coverage, updated reference docs, a MIGRATION.md note when users must act, and a CHANGELOG.md entry when release-visible'; COMPATIBILITY.md hunk: 'Compass does not ship a legacy MCP-2025 HTTP mode'; transport.rs hunk deletes `sse_response_to_json` and rejects `initialize` with 404/-32601; the diff contains no MIGRATION.md or CHANGELOG.md hunks. Plan C-008 done-when also lists 'COMPATIBILITY.md + MIGRATION.md + CHANGELOG.md updated'. Acceptance task 4.1 remains unchecked, so this must be closed before archive.",
+      "suggested_fix": "Add a MIGRATION.md entry covering removal of the session handshake and the stateless-only HTTP contract, and a CHANGELOG.md entry, before the wave is archived."
+    },
+    {
+      "severity": "WARNING",
+      "file": "crates/compass-mcp/src/transport.rs",
+      "line": 262,
+      "claim": "`host_rejection` re-implements rmcp's allowed-hosts / DNS-rebinding enforcement locally instead of reusing the library primitive, so the two copies can drift as rmcp evolves.",
+      "evidence": "transport.rs adds ~70 lines of `host_rejection`/`normalize_host` duplicating authority parsing and allowlist matching, with the comment 'Mirror rmcp's effective-authority policy... rmcp repeats the check inside the service as defense in depth'; warning constraint `safe-primitives-reused`: 'Existing bounded readers, subprocess helpers, path containment, endpoint checks ... are reused rather than reimplemented as weaker local variants.'",
+      "suggested_fix": "Rely on rmcp's `with_allowed_hosts` enforcement as the single implementation, or if a pre-gate rejection is required for layered error semantics, factor the comparison into one shared helper and add a drift-detection test against rmcp's behavior."
+    },
+    {
+      "severity": "WARNING",
+      "file": "crates/compass-mcp/src/transport.rs",
+      "line": 195,
+      "claim": "For streamed (SSE/chunked) bodies, `enforce_response_limit` truncates the body mid-stream via `http_body_util::Limited`, so an over-limit response reaches the client as a malformed partial JSON-RPC stream with a bare connection error rather than the distinct -32023 limit error that fixed-size bodies receive.",
+      "evidence": "`enforce_response_limit` only emits the structured -32023 JSON error when `response.body().size_hint().lower() > limit`; otherwise it wraps the body in `http_body_util::Limited::new(body, limit)`, which fails after status line and headers are already sent. The in-diff test `response_limit_rejects_known_oversized_bodies_and_wraps_other_bodies` codifies that chunked overflow surfaces only as a `LengthLimitError` on a body frame. Blocking constraint `bounded-work`: 'A limit error is a distinct outcome from an empty result' \u2014 a truncated stream is neither a clean limit error nor a valid response.",
+      "suggested_fix": "Since tool results are size-checked pre-encoding by `enforce_structured_response_size`, either document the streaming-truncation behavior as accepted, or buffer/terminate the SSE event stream with an explicit error event when the limit trips so clients can distinguish 'limit exceeded' from 'transport failure'."
+    }
+  ],
+  "sycophancy_screen": {
+    "reject_cap": 2,
+    "cap_overridden": false,
+    "cap_default": 2
+  }
+}
\ No newline at end of file
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-010/findings-round2.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-010/findings-round2.json
new file mode 100644
index 000000000..6b575d262
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-010/findings-round2.json
@@ -0,0 +1,62 @@
+{
+  "mode": "diff",
+  "verdict": "BLOCK",
+  "judge_model": "k3",
+  "producer_model": "gpt-5.6-sol",
+  "isolation_mode": "rest-gateway:http://localhost:4000/v1",
+  "cross_model_check": "verified-distinct",
+  "findings": [
+    {
+      "severity": "CRITICAL",
+      "file": ".github/workflows/compass-ci.yml",
+      "line": 101,
+      "claim": "The new CI step invokes `cargo test -p compass-mcp --test protocol_conformance` and `bash scripts/qualify_mcp_conformance.sh`, but neither file appears anywhere in the tracked diff, and the change's own verification receipt states the conformance test, fixtures, script, and interop doc are 'untracked-at-review' \u2014 if the change is archived without committing them, the workflow fails on a nonexistent test target and script.",
+      "evidence": "CI hunk adds `cargo test -p compass-mcp --test protocol_conformance --locked` and `bash scripts/qualify_mcp_conformance.sh`; the diff contains no `crates/compass-mcp/tests/protocol_conformance.rs` and no `scripts/qualify_mcp_conformance.sh` body; the verification document states: 'These untracked-at-review files are named explicitly because Git does not include new files in an unstaged `git diff`.' Acceptance criterion 2.1 ('Add stdio and HTTP conformance coverage and enforce both legs in CI') is therefore only enforceable, not evidenced, by this packet, and constraint `no-unrelated-diff-noise` requires git status to be clean at archive.",
+      "suggested_fix": "Stage and commit protocol_conformance.rs, its fixtures, qualify_mcp_conformance.sh, qualify_codex_mcp_client.py, and docs/implementation/mcp-conformance-and-interop.md as part of this change so the tracked diff satisfies 2.1/3.1 and CI cannot reference missing paths."
+    },
+    {
+      "severity": "CRITICAL",
+      "file": "scripts/qualify_mcp_conformance.sh",
+      "claim": "The proposal mandates CI that 'fails on a conformance regression rather than carrying an unreviewed expected-failure baseline,' yet the verification receipt admits the runner keeps a check-granular baseline of five entries, and the script implementing that baseline is absent from the packet, so the central acceptance claim (task 2.1's enforcement semantics and the 'no unreviewed baseline' requirement) cannot be verified at all.",
+      "evidence": "Proposal: 'Add CI coverage that fails on a conformance regression rather than carrying an unreviewed expected-failure baseline.' Verification: 'Its check-granular baseline contains only four fixture-tool diagnostics and one runner invocation whose real Compass tool receives intentionally invalid arguments.' The baseline's contents, pinning of the upstream runner commit, and network-fetch behavior live only in a file excluded from the diff.",
+      "suggested_fix": "Include qualify_mcp_conformance.sh in the tracked change with the baseline entries enumerated in-line (or in a committed fixture) so reviewers can confirm each baselined failure is one of the five claimed diagnostics and that the runner is fetched at an exact pinned commit."
+    },
+    {
+      "severity": "WARNING",
+      "file": "Cargo.lock",
+      "line": 1892,
+      "claim": "Five packages (errno, rustix, socket2, tempfile, and the windows-sys 0.60.2 consumer) are downgraded from windows-sys 0.61.2 to 0.52.0/0.60.2 in a change whose only dependency intent is rmcp 2.2.0\u21923.1.4; rmcp does not depend on windows-sys, so these downgrades are unrelated lockfile churn with potential Windows-build regression risk and no Windows CI leg to catch it.",
+      "evidence": "Cargo.lock hunks: `windows-sys 0.61.2` \u2192 `windows-sys 0.52.0` in four packages and \u2192 `0.60.2` in one, while the rmcp bump itself only adds base64 0.23.1 and indexmap; constraint `no-unrelated-diff-noise`: 'git diff and git status --short contain no unrelated or generated noise.'",
+      "suggested_fix": "Regenerate Cargo.lock with a minimal `cargo update -p rmcp --precise 3.1.4` (or explain the downgrade), and verify the windows-sys downgrade is intentional; otherwise restore 0.61.2 resolutions."
+    },
+    {
+      "severity": "WARNING",
+      "file": "crates/compass-mcp/src/transport.rs",
+      "line": 158,
+      "claim": "HttpOptions.stateless and HttpOptions.session_timeout are now dead fields: build_http_router hardcodes `.with_legacy_session_mode(false)` and never reads either option, so any caller (including compass-cli's McpOptions mapping) that sets them is silently ignored, and the struct presents configuration surface that does nothing.",
+      "evidence": "transport.rs hunk: `fn build_http_router` configures `StreamableHttpServerConfig::default().with_legacy_session_mode(false).with_stateless_protocol_metadata_required(true)` with no reference to `options.stateless` or `options.session_timeout`, while HttpOptions still declares `stateless: bool` and `session_timeout: Option<Duration>` (default `true`/`None`); the test at line ~807 still sets `options.stateless = true` as if it were meaningful.",
+      "suggested_fix": "Remove both fields from HttpOptions (and the McpOptions.session_timeout plumbing in compass-cli) or document them as inert; do not retain settable options that have no effect."
+    },
+    {
+      "severity": "WARNING",
+      "file": "crates/compass-mcp/src/lib.rs",
+      "line": 576,
+      "claim": "The shortest_path deprecation text directs users to `get_node` ('use get_node for typed directed evidence'), but no `get_node` tool exists \u2014 the tool list contains exactly 15 tools (search_symbols, get_callers, get_callees, get_impact, explore_code, one further typed tool, query_graph, and the eight deprecated text tools), none named get_node.",
+      "evidence": "lib.rs hunk: `tool(\"shortest_path\", \"DEPRECATED text result: find a shortest path; use get_node for typed directed evidence.\", ...)`; the transport test asserts `payload[\"result\"][\"tools\"].as_array().map(Vec::len) == Some(15)` with no get_node among the specs defined in tool_specs().",
+      "suggested_fix": "Point the deprecation message at an existing typed tool (e.g. get_impact/search_symbols) or omit the referral until the replacement ships."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "crates/compass-mcp/src/lib.rs",
+      "line": 447,
+      "claim": "enforce_structured_response_size bounds only the serialized envelope, but the same call_tool response also carries the full human-readable `result.text` in the content array, so the actual MCP response can exceed limits.max_response_bytes by the size of the duplicated text payload \u2014 the per-query bound is only half-enforced.",
+      "evidence": "lib.rs hunk: `enforce_structured_response_size(&envelope, response.limits.max_response_bytes)?` checks `serde_json::to_vec(value).len()` of the envelope only, while `call_tool` sets `response.content = vec![ContentBlock::text(result.text)]` alongside the structured content; blocking constraint `bounded-work` expects work over responses to remain bounded with a distinct limit outcome.",
+      "suggested_fix": "Include the text content length in the size accounting (or drop the text duplicate when the envelope is emitted) so max_response_bytes bounds the whole tool response."
+    }
+  ],
+  "sycophancy_screen": {
+    "reject_cap": 2,
+    "cap_overridden": false,
+    "cap_default": 2
+  }
+}
\ No newline at end of file
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-010/findings-round3.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-010/findings-round3.json
new file mode 100644
index 000000000..3ec66145c
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-010/findings-round3.json
@@ -0,0 +1,79 @@
+{
+  "mode": "diff",
+  "verdict": "BLOCK",
+  "judge_model": "k3",
+  "producer_model": "gpt-5.6-sol",
+  "isolation_mode": "rest-gateway:http://localhost:4000/v1",
+  "cross_model_check": "verified-distinct",
+  "findings": [
+    {
+      "severity": "CRITICAL",
+      "file": ".kbd-orchestrator/phases/compass-scoping-and-bounds/execution.md",
+      "line": 7,
+      "claim": "A machine-specific absolute path is committed to the repository, breaching the blocking no-secrets-or-machine-paths constraint.",
+      "evidence": "New-file hunk line contained an absolute user-home path to `.codex/skills/kbd-apply/kbd-apply.sh`. Constraint no-secrets-or-machine-paths (blocking): 'No credentials, machine-specific paths ... committed outside the repository-owned .prometheus/knowledge/wiki transcript exception.'",
+      "suggested_fix": "Replace the absolute path with a repository-relative or environment-derived reference (e.g. '$CODEX_HOME/skills/kbd-apply/kbd-apply.sh' or a documented install location)."
+    },
+    {
+      "severity": "WARNING",
+      "file": "openspec/changes/mcp-conformance-interop/verification.md",
+      "line": 46,
+      "claim": "The verification receipt claims header-handling checks are not baselined, but the committed expected-failures file baselines exactly one http-header-validation check, so the gate evidence contradicts the actual baseline.",
+      "evidence": "verification.md: 'transport, wire-schema, discovery, routing, version/header handling, resource errors, and DNS-rebinding checks are not baselined.' vs scripts/fixtures/mcp-conformance-expected-failures.yaml entry '- http-header-validation:sep-2243-server-accepts-whitespace-header-value'. docs/implementation/mcp-conformance-and-interop.md does acknowledge the baselined header check, confirming the verification.md claim is the inaccurate one.",
+      "suggested_fix": "Amend verification.md to state that one header check is baselined due to the runner invoking the first listed tool with invalid arguments, matching the interop doc and the yaml."
+    },
+    {
+      "severity": "WARNING",
+      "file": ".github/workflows/compass-ci.yml",
+      "line": 101,
+      "claim": "The design requires the stdio and HTTP conformance legs to be named separately in CI so neither can disappear behind the other, but the workflow runs both inside a single step, so a stdio failure prevents the HTTP leg from running and being reported.",
+      "evidence": "design.md: 'The two legs are named separately in CI so neither can disappear behind the other.' The workflow hunk adds one step 'MCP stdio and HTTP conformance' containing all three commands; with default step semantics, failure of 'cargo test -p compass-mcp --test protocol_conformance' aborts the step before 'bash scripts/qualify_mcp_conformance.sh' runs.",
+      "suggested_fix": "Split into two named steps (e.g. 'MCP stdio conformance' and 'MCP HTTP conformance'), keeping the binary build as its own step or folded into the first."
+    },
+    {
+      "severity": "WARNING",
+      "file": "openspec/changes/mcp-conformance-interop/verification.md",
+      "line": 18,
+      "claim": "verification.md declares crates/compass-mcp/tests/fixtures/mcp-discovery-golden.json as a new qualification artifact, but that file appears nowhere in the diff, files.txt, or the refiner artifact manifest, and the added test reads no golden fixture \u2014 while design.md's claimed 'ordered tool and resource listing' verification is not actually performed.",
+      "evidence": "verification.md 'New qualification artifacts' lists 'crates/compass-mcp/tests/fixtures/mcp-discovery-golden.json'; openspec/changes/mcp-conformance-interop/files.txt and .refiner/artifacts/C-010/artifact_manifest.json omit it; protocol_conformance.rs only asserts 'tools.tools.len() == 15' and 'resources.resources.len() == 6' plus presence of graph_stats \u2014 no ordering assertion exists despite design.md claiming the stdio leg 'verifies initialization/discovery, ordered tool and resource listing'.",
+      "suggested_fix": "Either add the golden fixture and ordering assertions to protocol_conformance.rs and declare the file in files.txt and the artifact manifest, or remove the golden-file reference from verification.md and the 'ordered' claim from design.md."
+    },
+    {
+      "severity": "WARNING",
+      "file": "scripts/qualify_mcp_conformance.sh",
+      "line": 56,
+      "claim": "The readiness probe can false-positive against a pre-existing listener on the fixed default port, causing the conformance suite to run against the wrong server and pass or fail on evidence Compass did not produce.",
+      "evidence": "'readonly PORT=\"${COMPASS_MCP_CONFORMANCE_PORT:-39091}\"' fixes the port; the loop 'curl --silent --output /dev/null --connect-timeout 1 \"http://127.0.0.1:$PORT/mcp\"' succeeds on any HTTP response (curl returns 0 even for 405/404 without --fail) and never checks that $server_pid is still alive or that the responding process is the Compass server just started.",
+      "suggested_fix": "Bind an ephemeral port (or verify a Compass-specific marker in the response), and add a 'kill -0 $server_pid' liveness check inside the readiness loop so a crashed server fails fast with its log."
+    },
+    {
+      "severity": "WARNING",
+      "file": "scripts/qualify_mcp_conformance.sh",
+      "line": 70,
+      "claim": "The npx conformance invocations have no duration bound, conflicting with the blocking bounded-work constraint's requirement that subprocess work remains bounded.",
+      "evidence": "Constraint bounded-work (blocking): 'All work over source files, graphs, archives, network responses, queries, and subprocess output remains bounded.' The script runs 'npx --yes \"github:modelcontextprotocol/conformance#$CONFORMANCE_REF\" server ...' seven times with no timeout wrapper; a hung runner or stalled package fetch blocks the CI job until the outer workflow timeout, with no distinction between a hang and a slow run. Contrast scripts/qualify_codex_mcp_client.py, which bounds every wait (30 s request deadline, 15 s server readiness, 30 s run_checked timeout).",
+      "suggested_fix": "Wrap each npx invocation in a bounded wait (e.g. 'timeout 300 npx ...') and treat expiry as a distinct failure outcome from a conformance failure."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "scripts/qualify_mcp_conformance.sh",
+      "line": 13,
+      "claim": "All conformance runner output is written under WORK_ROOT, which the EXIT trap deletes, so no persistent machine-checkable evidence of which checks passed or were baselined survives a CI run.",
+      "evidence": "'--output-dir \"$WORK_ROOT/results\"' combined with 'trap cleanup EXIT' where cleanup runs 'rm -rf \"$WORK_ROOT\"'; the only retained signal is the script's exit code and transient console output.",
+      "suggested_fix": "Preserve the results directory (e.g. copy it to a caller-specified path or upload it as a CI artifact) before cleanup, or gate deletion on success only."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": ".kbd-orchestrator/phases/compass-scoping-and-bounds/execution.md",
+      "line": 95,
+      "claim": "The progress ledger still records C-010 as [PENDING] while the same diff ships tasks.md with tasks 1.1\u20133.1 checked and a PASS refinement receipt, leaving the canonical projection inconsistent with the change's own evidence.",
+      "evidence": "execution.md PROGRESS LEDGER: '- [PENDING] C-010 \u2014 SELF/OpenSpec, gated by C-008 and C-009' vs openspec/changes/mcp-conformance-interop/tasks.md ([x] 1.1, [x] 2.1, [x] 3.1) and .refiner/artifacts/C-010/dist/refinement-receipt.md 'Status: PASS'. execution.md itself declares 'progress.json is the canonical projection; implementation completion is marked independently of evidence/certification/publication', but the ledger was not updated to that state.",
+      "suggested_fix": "Update the C-010 ledger entry (and progress.json) to the implementation-complete-but-uncertified state the dispatch contract defines, or note explicitly why it remains PENDING."
+    }
+  ],
+  "sycophancy_screen": {
+    "reject_cap": 2,
+    "cap_overridden": false,
+    "cap_default": 2
+  }
+}
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-010/findings-round4.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-010/findings-round4.json
new file mode 100644
index 000000000..3e581d598
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-010/findings-round4.json
@@ -0,0 +1,46 @@
+{
+  "mode": "diff",
+  "verdict": "PASS",
+  "judge_model": "k3",
+  "producer_model": "gpt-5.6-sol",
+  "isolation_mode": "rest-gateway:http://localhost:4000/v1",
+  "cross_model_check": "verified-distinct",
+  "findings": [
+    {
+      "severity": "WARNING",
+      "file": "scripts/fixtures/mcp-conformance-expected-failures.yaml",
+      "line": 12,
+      "claim": "Baselining the check `http-header-validation:sep-2243-server-accepts-whitespace-header-value` masks that check by ID, not by failure cause, so a future genuine header-validation regression (the behavior the check actually exists to verify) would be silently accepted by CI.",
+      "evidence": "The baseline entry is justified in the YAML comment and verification.md as 'the runner invokes the first listed tool with `{}`; Compass ... correctly requires `query`' \u2014 i.e., the observed failure cause is unrelated to whitespace header validation. verification.md asserts 'The one baselined header-runner check is the invalid-argument invocation described above, not a header mismatch failure,' but nothing in a check-granular expected-failure mechanism can enforce that distinction; any failure of that check ID, including the header-acceptance defect it names, matches the baseline. design.md simultaneously claims 'transport, wire-schema, routing, or advertised capability failure remains a blocking failure.'",
+      "suggested_fix": "Either remove this entry and make the first listed tool tolerant of `{}` invocation for the header scenario, or verify the runner supports cause/strict matching (fail on unexpected pass or mismatched failure reason) and document that enforcement; otherwise record the header-validation coverage gap explicitly in the spec/verification artifacts."
+    },
+    {
+      "severity": "WARNING",
+      "file": ".kbd-orchestrator/phases/compass-scoping-and-bounds/execution.md",
+      "claim": "The committed PROGRESS LEDGER lists C-010 as '[PENDING]' in the same diff that adds C-010 completion evidence (tasks 1.1\u20133.1 checked, refiner receipt 'Status: PASS'), leaving repository-owned KBD certification evidence internally contradictory.",
+      "evidence": "execution.md PROGRESS LEDGER: '- [PENDING] C-010 \u2014 SELF/OpenSpec, gated by C-008 and C-009' (also '[IN_PROGRESS] C-001'), while openspec/changes/mcp-conformance-interop/tasks.md shows '- [x] 2.1' and '- [x] 3.1', and .refiner/artifacts/C-010/dist/refinement-receipt.md states 'Status: **PASS**'. The constraint `refiner-qa-evidence` requires these tracked artifacts to be deterministic and consistent certification evidence.",
+      "suggested_fix": "Update the execution.md ledger (or annotate it as an execution-start snapshot with a pointer to progress.json as the live projection) before archiving C-010."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "docs/implementation/mcp-conformance-and-interop.md",
+      "line": 90,
+      "claim": "The reproduction section tells the reader to 'reproduce the held Codex HTTP cell,' but the recorded matrix shows the Codex CLI 0.150.1 HTTP cell as PASS \u2014 no Codex cell is held.",
+      "evidence": "The same document's matrix: '| Codex CLI | `0.150.1` | PASS \u2014 `Nodes: 120215` | PASS \u2014 `Nodes: 120215` |' and the text 'Codex 0.146.0 initially failed the HTTP cell, but the isolated official 0.150.1 release passed both cells'; the only incompatible cell is OpenCode 1.18.25 HTTP.",
+      "suggested_fix": "Reword the final line to reference reproducing the recorded Codex HTTP pass (or the OpenCode HTTP incompatibility, if that was the intent)."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "scripts/qualify_mcp_conformance.sh",
+      "line": 119,
+      "claim": "The final success message 'MCP conformance passed: stdio=native HTTP=reference@...' is printed by a script that exercises only HTTP, implying a stdio result it did not produce \u2014 misleading when the script is run standalone as the docs' reproduction section instructs.",
+      "evidence": "The script's loop runs only `--scenario server-stateless/tools-list/...` against `--url http://127.0.0.1:$PORT/mcp`; stdio coverage is the separate `cargo test -p compass-mcp --test protocol_conformance` CI leg. docs/implementation/mcp-conformance-and-interop.md lists `scripts/qualify_mcp_conformance.sh` alone as a reproduction command.",
+      "suggested_fix": "Change the echo to report only the HTTP leg (e.g., 'MCP HTTP conformance passed: reference@<ref> spec=2026-07-28; stdio leg = cargo test -p compass-mcp --test protocol_conformance')."
+    }
+  ],
+  "sycophancy_screen": {
+    "reject_cap": 2,
+    "cap_overridden": false,
+    "cap_default": 2
+  }
+}
\ No newline at end of file
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-010/findings-round5.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-010/findings-round5.json
new file mode 100644
index 000000000..89d1d4fd5
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-010/findings-round5.json
@@ -0,0 +1,63 @@
+{
+  "mode": "diff",
+  "verdict": "PASS",
+  "judge_model": "k3",
+  "producer_model": "gpt-5.6-sol",
+  "isolation_mode": "rest-gateway:http://localhost:4000/v1",
+  "cross_model_check": "verified-distinct",
+  "findings": [
+    {
+      "severity": "WARNING",
+      "file": "crates/compass-mcp/src/transport.rs",
+      "line": 282,
+      "claim": "normalize_header leaves whitespace-only or untrimmable header values in place, so a whitespace-only `Mcp-Method` header bypasses the missing-method gate and is forwarded to the rmcp service instead of receiving the documented -32020 rejection.",
+      "evidence": "In `normalize_header`, when the trimmed value is empty or unparseable, `normalized` is `None` and the original header is left untouched (`if let Some(value) = normalized { ... insert ... }` with no else-removal). Downstream, `let method = request.headers().get(\"mcp-method\")...map(str::to_owned); if method.is_none() { ... -32020 ... }` \u2014 a header of `\" \\t \"` yields `Some(\" \\t \")`, so `method.is_none()` is false and the gate passes a value its own contract treats as absent. The protocol-version gate does not have this hole only because `supports_protocol(\" \\t \")` happens to be false.",
+      "suggested_fix": "In normalize_header, remove the header when the trimmed value is empty (request.headers_mut().remove(name)), so whitespace-only values are treated identically to missing values by both gates."
+    },
+    {
+      "severity": "WARNING",
+      "file": "scripts/qualify_codex_mcp_client.py",
+      "line": 213,
+      "claim": "In HTTP mode the spawned Compass server process leaks if readiness probing fails, because `wait_for_server(server, port)` is called before the try/finally that terminates the server.",
+      "evidence": "`server = subprocess.Popen([... compass serve ... --transport http ...])` is immediately followed by `wait_for_server(server, port)` and only afterwards by `try: ... finally: if server is not None and server.poll() is None: server.terminate()...`. If wait_for_server raises AppServerError (\"did not become ready\") while the server is still alive (slow bind, blocked on stderr pipe), the exception propagates to main() and the interpreter exits with the Compass process orphaned and still holding the port.",
+      "suggested_fix": "Move the Popen/wait_for_server sequence inside the try block (or wrap wait_for_server so any exception terminates `server` before re-raising)."
+    },
+    {
+      "severity": "WARNING",
+      "file": "scripts/qualify_codex_mcp_client.py",
+      "line": 193,
+      "claim": "The spawned Compass HTTP server's stderr is piped but never drained, so the server deadlocks once it writes more than the OS pipe buffer (~64 KiB) of log output.",
+      "evidence": "The HTTP server is started with `stdout=subprocess.DEVNULL, stderr=subprocess.PIPE, text=True` and no thread or call ever reads `server.stderr` (unlike AppServerClient, which spawns `_read_stderr`). A blocked-on-write server stops serving requests, surfacing only as the 15s readiness timeout or a 30s request timeout, and then hits the leak in the prior finding.",
+      "suggested_fix": "Redirect server stderr to a file in the temp directory (as qualify_mcp_conformance.sh does with $SERVER_LOG) or drain it in a daemon thread and include the tail in failure diagnostics."
+    },
+    {
+      "severity": "WARNING",
+      "file": "scripts/fixtures/mcp-conformance-expected-failures.yaml",
+      "line": 6,
+      "claim": "The four fixture-diagnostic baselines are matched by check identifier only, so they cannot distinguish the benign fixture-tool-absence cause from a real protocol regression, contradicting the documented guarantee that advertised-capability failures remain blocking.",
+      "evidence": "verification.md and design.md disclose this exact limitation only for `http-header-validation:sep-2243-...` (\"Its identifier-only baseline could also accept a different failure cause\"), and add a native regression to cover that one gap. The same matching semantics apply to `server-stateless:sep-2575-server-rejects-undeclared-capability`, `sep-2575-missing-capability-http-400`, `sep-2575-http-server-no-independent-requests-on-stream`, and `sep-2575-server-no-log-without-loglevel`: if Compass regressed (e.g., stopped rejecting an undeclared capability), the runner check would still fail, still match the baseline identifier, and CI would stay green despite design.md's claim that \"any transport, wire-schema, routing, or advertised capability failure remains a blocking failure.\"",
+      "suggested_fix": "Add native Rust tests pinning the intended behavior for each of the four baselined checks (undeclared-capability rejection, HTTP 400 on missing capability, no independent server requests on the stream, no log without logLevel), mirroring what was done for header whitespace normalization."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "scripts/qualify_codex_mcp_client.py",
+      "line": 130,
+      "claim": "free_port() has a TOCTOU race: the probed port can be taken by another process between the probe and Compass binding it, producing a spurious interop failure.",
+      "evidence": "`def free_port(): ... listener.bind((\"127.0.0.1\", 0)); return int(listener.getsockname()[1])` closes the socket before the port is passed to `compass serve --port`.",
+      "suggested_fix": "Retry the serve/wait_for_server sequence on bind failure, or have the harness bind the listener itself and pass the fd/port atomically if the CLI supports it."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "scripts/qualify_codex_mcp_client.py",
+      "line": 41,
+      "claim": "Runtime invariants are enforced with `assert`, which is stripped under `python -O` and turns into a confusing AttributeError instead of a diagnostic.",
+      "evidence": "`assert self._process.stdout is not None`, `assert self._process.stderr is not None`, and `assert self._process.stdin is not None` in AppServerClient.",
+      "suggested_fix": "Replace with explicit `if ... is None: raise AppServerError(...)` checks."
+    }
+  ],
+  "sycophancy_screen": {
+    "reject_cap": 2,
+    "cap_overridden": false,
+    "cap_default": 2
+  }
+}
\ No newline at end of file
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-010/findings-round7.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-010/findings-round7.json
new file mode 100644
index 000000000..71f8afe92
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-010/findings-round7.json
@@ -0,0 +1,39 @@
+{
+  "mode": "diff",
+  "verdict": "BLOCK",
+  "judge_model": "gpt-5.6-sol",
+  "producer_model": "gpt-5.6-sol",
+  "isolation_mode": "harness-native",
+  "cross_model_check": "fresh-context-same-model-family",
+  "findings": [
+    {
+      "severity": "CRITICAL",
+      "file": "crates/compass-mcp/tests/protocol_conformance.rs",
+      "line": 34,
+      "claim": "The required stdio gate did not explicitly prove MCP 2026-07-28 negotiation.",
+      "evidence": "The client used the default lifecycle and asserted identity and inventory without asserting the negotiated peer protocol.",
+      "suggested_fix": "Request 2026-07-28 explicitly and assert the negotiated peer protocol before the remaining checks."
+    },
+    {
+      "severity": "CRITICAL",
+      "file": "scripts/qualify_codex_mcp_client.py",
+      "line": 319,
+      "claim": "The Codex harness did not validate or emit the exact client version required by the matrix contract.",
+      "evidence": "The receipt contained client, transport, tool, and evidence but no version, discovery outcome, invocation outcome, or explicit pass status.",
+      "suggested_fix": "Validate the binary version and include exact version plus discovery, invocation, and overall status fields."
+    },
+    {
+      "severity": "WARNING",
+      "file": "scripts/fixtures/mcp-conformance-expected-failures.yaml",
+      "line": 12,
+      "claim": "An identifier-only whitespace-header baseline could mask a future header regression.",
+      "evidence": "The upstream expected-failure format matches only the check identifier.",
+      "suggested_fix": "Cause-gate the expected failure or use valid tool arguments, and retain an end-to-end HTTP regression."
+    }
+  ],
+  "sycophancy_screen": {
+    "reject_cap": 2,
+    "cap_overridden": false,
+    "cap_default": 2
+  }
+}
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-010/findings-round8.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-010/findings-round8.json
new file mode 100644
index 000000000..29e29f9b9
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-010/findings-round8.json
@@ -0,0 +1,39 @@
+{
+  "mode": "diff",
+  "verdict": "BLOCK",
+  "judge_model": "gpt-5.6-sol",
+  "producer_model": "gpt-5.6-sol",
+  "isolation_mode": "harness-native",
+  "cross_model_check": "fresh-context-same-model-family",
+  "findings": [
+    {
+      "severity": "CRITICAL",
+      "file": "crates/compass-cli/src/lib.rs",
+      "line": 3,
+      "claim": "The cumulative packet omitted unrelated new CLI, partition, and skill files.",
+      "evidence": "Packet assembly failed to resolve C-010 to its OpenSpec directory and therefore reviewed the full dirty tree.",
+      "suggested_fix": "Rebuild with the OpenSpec change name so files.txt scopes the packet."
+    },
+    {
+      "severity": "CRITICAL",
+      "file": "crates/compass-mcp/src/lib.rs",
+      "line": 281,
+      "claim": "Production stdio still advertised legacy MCP versions.",
+      "evidence": "CompassMcp::new used a profile whose supported versions were ProtocolVersion::KNOWN_VERSIONS.",
+      "suggested_fix": "Advertise only 2026-07-28 on stdio and reject the removed initialize lifecycle."
+    },
+    {
+      "severity": "CRITICAL",
+      "file": ".prometheus/events.jsonl",
+      "line": 4,
+      "claim": "The cumulative packet included machine paths in unrelated local runtime state.",
+      "evidence": "The file is outside C-010's declared review surface and appeared only because packet scoping failed.",
+      "suggested_fix": "Use the declared C-010 files list when rebuilding the packet."
+    }
+  ],
+  "sycophancy_screen": {
+    "reject_cap": 2,
+    "cap_overridden": false,
+    "cap_default": 2
+  }
+}
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-010/findings.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-010/findings.json
new file mode 100644
index 000000000..039613745
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-010/findings.json
@@ -0,0 +1,55 @@
+{
+  "mode": "diff",
+  "verdict": "PASS",
+  "judge_model": "k3",
+  "producer_model": "gpt-5.6-sol",
+  "isolation_mode": "rest-gateway:http://localhost:4000/v1",
+  "cross_model_check": "verified-distinct",
+  "findings": [
+    {
+      "severity": "WARNING",
+      "file": "crates/compass-mcp/src/transport.rs",
+      "line": 160,
+      "claim": "HttpOptions.stateless and HttpOptions.session_timeout are now silently ignored by build_http_router, so any caller that constructs HttpOptions with stateless: false or a non-None session_timeout gets stateless 2026-only behavior with no error or warning.",
+      "evidence": "The hunk deletes `manager.session_config.keep_alive = if options.stateless { None } else { options.session_timeout.filter(...) }` and `.with_stateful_mode(!options.stateless)`, replacing them with hardcoded `.with_legacy_session_mode(false)`; meanwhile the struct still declares both fields and `HttpOptions::new` still sets them (`stateless: true, session_timeout: None`). No remaining read of either field appears anywhere in the shown code \u2014 a dead configuration surface that masks a behavior override (silent-failure class).",
+      "suggested_fix": "Remove the two fields from HttpOptions (or gate them behind a compile-time-visible deprecation) so programmatic misuse is impossible, or return an error/log when a caller sets stateful options that cannot be honored."
+    },
+    {
+      "severity": "WARNING",
+      "file": "crates/compass-mcp/src/transport.rs",
+      "line": 218,
+      "claim": "The diff introduces `http_body_util` as a direct dependency of compass-mcp (both src and test code) but the packet contains no Cargo.toml change adding it, so the build cannot be verified to satisfy build-passes from the packet alone.",
+      "evidence": "New code at `enforce_response_limit` uses `http_body_util::Limited::new(body, limit)` and the test module adds `use http_body_util::BodyExt;` plus `http_body_util::channel::Channel` and `http_body_util::LengthLimitError`. No `crates/compass-mcp/Cargo.toml` or root `Cargo.toml` hunk is present in the packet declaring this dependency; if it is not already a declared (non-transitive) dependency, `cargo build --locked` fails. Transitive availability does not permit direct use under Cargo.",
+      "suggested_fix": "Confirm `http-body-util` is declared in compass-mcp's Cargo.toml via `{ name }.workspace = true` per the workspace-dependencies-reused rule, and include that hunk in the review surface."
+    },
+    {
+      "severity": "WARNING",
+      "file": "scripts/qualify_codex_mcp_client.py",
+      "line": 168,
+      "claim": "run_checked buffers subprocess stdout and stderr unboundedly in memory, conflicting with the bounded-work constraint that subprocess output remains bounded.",
+      "evidence": "`subprocess.run(command, ..., capture_output=True, timeout=30)` \u2014 capture_output accumulates the entire child output in memory; the 30s timeout bounds duration, not bytes, and the `[-4000:]` truncation happens only after full capture. The blocking constraint `bounded-work` states: 'All work over source files, graphs, archives, network responses, queries, and subprocess output remains bounded.'",
+      "suggested_fix": "Stream output to a bounded ring buffer (as AppServerClient already does with `deque(maxlen=100)` for stderr) instead of capture_output=True."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "scripts/qualify_codex_mcp_client.py",
+      "line": 158,
+      "claim": "free_port() has a bind-then-release TOCTOU race: the chosen port can be claimed by another process between socket close and Compass binding it, producing a flaky interop failure.",
+      "evidence": "`with socket.socket() as listener: listener.bind((\"127.0.0.1\", 0)); return int(listener.getsockname()[1])` \u2014 the socket is closed on return, and Compass is only spawned afterwards in run(). wait_for_server then reports 'Compass HTTP server exited before becoming ready' on the collision, which is diagnosable but wasteful.",
+      "suggested_fix": "Keep the listener open and pass its fd, or retry the spawn on bind failure with a fresh port."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "scripts/qualify_mcp_conformance.sh",
+      "line": 10,
+      "claim": "The conformance leg defaults to fixed port 39091 on the CI host; any concurrent or leaked process on that port makes the leg fail even though an ephemeral port would eliminate the class.",
+      "evidence": "`readonly PORT=\"${COMPASS_MCP_CONFORMANCE_PORT:-39091}\"` \u2014 the spawned-server liveness check (`kill -0`) plus curl readiness mitigates squatters only because Compass would fail to bind and exit; the failure still costs a CI run and is indistinguishable from a product regression at first glance.",
+      "suggested_fix": "Default to an ephemeral port selected the same way qualify_codex_mcp_client.py does (bind :0, close, retry-on-failure), keeping the env override for debugging."
+    }
+  ],
+  "sycophancy_screen": {
+    "reject_cap": 2,
+    "cap_overridden": false,
+    "cap_default": 2
+  }
+}
\ No newline at end of file
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-012/findings.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-012/findings.json
new file mode 100644
index 000000000..9b8f8de30
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-012/findings.json
@@ -0,0 +1,50 @@
+{
+  "mode": "diff",
+  "verdict": "PASS",
+  "judge_model": "k3",
+  "producer_model": "gpt-5.6-sol",
+  "isolation_mode": "rest-gateway:http://localhost:4000/v1",
+  "cross_model_check": "verified-distinct",
+  "findings": [
+    {
+      "severity": "WARNING",
+      "file": "scripts/fixtures/surreal-persistent-probes/input-v1.json",
+      "claim": "The retained vector is not replayable: 2,048 of the 2,051 relations are specified only as `scaleEdgeCount: 2048`, with no retained definition of their endpoints, provenance, or confidence values, and the generator code was deleted, so the design goal of 'replayable, deterministic input and expected-output vectors' (design.md Goals) cannot be satisfied from the retained artifacts alone.",
+      "evidence": "input-v1.json contains only three literal relations plus `\"scaleEdgeCount\": 2048`; expected-v1.json pins only `scaleFirstId`/`scaleLastId` and counts, not the per-relation provenance/confidence of generated edges; refinement_log.md confirms the runner was deleted ('Built one disposable SurrealDB 3.2.4 runner...') and proposal.md requires 'Delete the spike'. Nothing retained defines how the 2,048 scale edges are constructed.",
+      "suggested_fix": "Add the deterministic generation rule for scale edges (ID pattern, endpoint assignment, provenance, confidence formula) to input-v1.json or a companion spec file so the full workload can be regenerated without the deleted runner."
+    },
+    {
+      "severity": "WARNING",
+      "file": "scripts/fixtures/surreal-persistent-probes/expected-v1.json",
+      "claim": "The expected-output vector contains no expected canonical digest or per-relation expected content, so acceptance criterion 1.1's 'verify vector schema and canonical bytes' is only checkable against engine-produced outputs, making the verification circular for everything except counts and boundary IDs.",
+      "evidence": "expected-v1.json has only counts, page parameters, three base relation IDs, and first/last scale IDs; the only canonical digest (`orderedIdsSha256`) appears solely inside rocksdb-result-v1.json and surrealkv-result-v1.json, i.e., produced by the engines under test. verification.md claims 'Independent ordered-ID SHA-256 derivation: matched both engine results' but the derivation source is the same underspecified generation procedure, and no expected semantic bytes are pinned for comparison.",
+      "suggested_fix": "Add the independently computed expected `orderedIdsSha256` (and ideally a canonical digest of the full expected semantic summary) to expected-v1.json so engine results are verified against a pinned expectation rather than against themselves."
+    },
+    {
+      "severity": "WARNING",
+      "file": "scripts/fixtures/surreal-persistent-probes/rocksdb-result-v1.json",
+      "claim": "The dirty-shutdown recovery claim 'Reopen preserved the complete active g-0001 result' (and the docs table row 'with all 2,051 records') is not substantiated by any retained post-crash evidence: the result JSON records only the string `activeAfterCrash: \"g-0001\"`, with no post-crash relation count or ordered-ID digest, so the design requirement that the parent 'verifies the previous generation exactly' is unverifiable from retained evidence.",
+      "evidence": "design.md: 'The parent terminates the child at that marker, reopens the same database, and verifies the previous generation exactly.' Both engine result files contain only `activeBeforeCrash`/`activeAfterCrash` strings; `relationCount: 2051` and `orderedIdsSha256` describe the final post-activation g-0002 read, not the post-crash g-0001 read. docs/future/surreal-persistent-probe-results.md asserts 'Active generation remains g-0001 with all 2,051 records' with no corresponding field.",
+      "suggested_fix": "Include in each engine result a post-crash section capturing the reopened active generation's relation count and ordered-ID digest so the 'exactly preserved' claim is auditable."
+    },
+    {
+      "severity": "WARNING",
+      "file": "openspec/changes/surreal-persistent-probes/verification.md",
+      "claim": "The dependency-cleanliness and disposal gate rests on unrecorded evidence: no pre/post SHA-256 digests of Compass manifests or `Cargo.lock` are retained anywhere, unlike the fixture files whose hashes are pinned in manifest-v1.json, so the 'stayed byte-identical' claim cannot be independently re-verified.",
+      "evidence": "verification.md: 'Pre/post Compass manifest and `Cargo.lock` digest comparison: identical' \u2014 but no digest values are recorded in verification.md, the results doc, constraints.json, or any retained file. By contrast, manifest-v1.json pins hashes for the five fixture files, showing the project knows how to retain such evidence.",
+      "suggested_fix": "Record the actual pre/post SHA-256 values for the root Cargo.toml files and Cargo.lock in verification.md or a retained evidence file."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "docs/future/surreal-persistent-probe-results.md",
+      "claim": "The relative link to `surrealdb-license-decision.md` targets a document not present in the change's file list, so the link may dangle.",
+      "evidence": "docs/future/surreal-persistent-probe-results.md links `[surrealdb-license-decision.md](surrealdb-license-decision.md)`, but files.txt and the packet file tree contain no such file under docs/future/.",
+      "suggested_fix": "Confirm the target exists in the repository; if not, create it or point the link at the actual C-011 decision record."
+    }
+  ],
+  "sycophancy_screen": {
+    "reject_cap": 2,
+    "cap_overridden": false,
+    "cap_default": 2
+  }
+}
\ No newline at end of file
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/findings-round1.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/findings-round1.json
new file mode 100644
index 000000000..dbd1352bc
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/findings-round1.json
@@ -0,0 +1,71 @@
+{
+  "mode": "diff",
+  "verdict": "BLOCK",
+  "judge_model": "k3",
+  "producer_model": "gpt-5.6-sol",
+  "isolation_mode": "rest-gateway:http://localhost:4000/v1",
+  "cross_model_check": "verified-distinct",
+  "findings": [
+    {
+      "severity": "CRITICAL",
+      "file": "benchmarks/qualification/run_current_baseline.py",
+      "line": 0,
+      "claim": "The checked-in generator script cannot reproduce the retained baseline artifact: it never emits the `rawTraversal` or `source` blocks present in `current-engine-baseline-v1.json`, and it resolves binary/graph to absolute paths (`args.binary.resolve(strict=True)`, payload uses `str(binary)`) while the retained file and the test suite require relative paths \u2014 so the retained evidence was necessarily hand-augmented and the README's 'Reproduce the current-engine baseline' command produces a different document.",
+      "evidence": "Criterion 3.1 requires the current engine be measured 'reproducibly'. `current-engine-baseline-v1.json` contains top-level `rawTraversal` and `source` (gitHead, workspacePatchSha256) objects, but `main()` in run_current_baseline.py builds `payload` with only schema/recordedAt/host/binary/graph/measurement. Meanwhile `binary = args.binary.resolve(strict=True)` and `graph = args.graph.resolve(strict=True)` guarantee absolute paths in output, which `test_current_baseline.py::test_retained_baseline_is_complete_and_portable` rejects (`assertFalse(Path(document['binary']['path']).is_absolute())`) and which would also risk committing machine-specific paths (constraint no-secrets-or-machine-paths) if the script output were checked in verbatim.",
+      "suggested_fix": "Make the script emit the full retained schema (add --git-head/--workspace-patch-sha256/--raw-traversal-input parameters or a merge step), write repository-relative paths, and add a test that regenerates the baseline document structure and diffs it (excluding recordedAt/timings) against the retained file."
+    },
+    {
+      "severity": "WARNING",
+      "file": "benchmarks/qualification/run_current_baseline.py",
+      "line": 0,
+      "claim": "The `path-depth-3` workload command passes no depth, node/edge, engine, format, or cache flags \u2014 unlike every other query workload \u2014 so the retained 'Depth-3 path' baseline was measured without an explicit bound and possibly not with the json engine the baseline is supposed to characterize.",
+      "evidence": "`query_commands` returns `\"path-depth-3\": (str(binary), \"path\", \"qualification::Node0000000\", \"qualification::Node0000003\", \"--graph\", str(graph))` \u2014 no `--max-depth 3`, `--max-nodes`, `--max-edges`, `--engine json`, `--format json`, or `--cache`, while callers/callees/impact all pass explicit bounds. The ratified gate in docs/future/qualification-corpora-baselines.md compares 'depth-3+ impact/path' p95 against this baseline, and the constraint bounded-work requires all query work to remain bounded. Notably this workload's peak RSS (1,990,377,472 B) is ~2.2x the other workloads.",
+      "suggested_fix": "Add `--max-depth 3 --max-nodes 512 --max-edges 1024 --engine json --format json --cache <cache>` to the path command, re-measure, and update the retained baseline and docs table."
+    },
+    {
+      "severity": "WARNING",
+      "file": "benchmarks/qualification/raw_traversal.py",
+      "line": 0,
+      "claim": "Malformed task input (missing `source`/`query`/`target` keys, non-dict entries) raises KeyError/TypeError, which is not caught by the main exception handler, producing an exit-1 traceback instead of the documented exit-2 input failure.",
+      "evidence": "README.md states 'Exit status 2 is a limit or input failure'. `main` is wrapped in `except (LimitExceeded, OSError, ValueError)`, but `execute_task` indexes `task[\"query\"]`, `task[\"source\"]`, and `task[\"target\"]` directly \u2014 a missing key raises KeyError (not a ValueError subclass), escaping the handler.",
+      "suggested_fix": "Validate each task's required keys per operation and raise ValueError with context, or add KeyError/TypeError to the caught exceptions mapped to exit 2."
+    },
+    {
+      "severity": "WARNING",
+      "file": "benchmarks/qualification/generate_graph.py",
+      "line": 0,
+      "claim": "Profile validation permits parameter combinations that crash the generator with an uncaught ZeroDivisionError instead of failing closed: `nodes=2` with `edges>=3` reaches `band % (nodes - 2)` with a zero divisor, and `sampleOrdinals` are never validated against the node/edge ranges.",
+      "evidence": "`_profile` only enforces `2 <= nodes <= MAX_NODES` and `nodes <= edges <= MAX_EDGES`. In `edge_endpoints`, `offset = 2 + (band % (nodes - 2))`; with nodes=2 and any ordinal beyond the parallel edge (chord >= 1) this divides by zero. The verification claim 'Oversized or invalid profiles fail closed' does not hold for this class of invalid profile, and generate_graph.py has no error-mapping wrapper so the failure is a traceback with exit 1.",
+      "suggested_fix": "Raise the nodes lower bound to 3 (or guard nodes-2 == 0), validate sampleOrdinals < nodes/edges, and map ValueError to a clean non-zero exit in main."
+    },
+    {
+      "severity": "WARNING",
+      "file": "benchmarks/qualification/tests/test_raw_traversal.py",
+      "line": 0,
+      "claim": "No regression test validates the versioned `expected` evidence of the 30 agent tasks against the raw-traversal oracle; the suite exercises only a 128-node toy graph with inline expectations, so the 'All pass the bounded raw oracle against the exact medium graph' claim is asserted once in the retained JSON but never continuously tested.",
+      "evidence": "Criterion 2.3 versions 'expected evidence and bounded tool/raw traversal routes', and the constraint regression-test-present requires regression tests at the lowest useful layer for behavior changes. `test_raw_traversal.py` builds a 128-node graph and never loads `agent-tasks-v1.json`; `test_corpora.py` only checks task count/balance/ids, not that raw-traversal results satisfy each task's `expected` block (containsNodeIds, minimumEdgeCount, first/lastNodeId).",
+      "suggested_fix": "Add a test that runs raw_traversal over the materialized medium graph (or a metadata-only deterministic equivalent) with agent-tasks-v1.json and asserts every `expected` block against the oracle output."
+    },
+    {
+      "severity": "WARNING",
+      "file": ".refiner/artifacts/C-013/artifact_manifest.json",
+      "line": 0,
+      "claim": "The diff commits a new `.refiner/` local tooling-state tree (logs, receipts, constraint records) that does not exist in the repository file tree, analogous to the local state directories the constraints prohibit committing, and constitutes generated record noise in the change surface.",
+      "evidence": "Constraint no-secrets-or-machine-paths forbids committing 'local .compass/ state, compass-out/' content, and no-unrelated-diff-noise requires 'git diff ... contain no unrelated or generated noise'. The `.refiner/artifacts/C-013/` files (refinement_log.md, dist/refinement-receipt.md, artifact_manifest.json) are adapter-generated records \u2014 the log itself states 'The repository's deterministic fallback record format was used' \u2014 and `.refiner/` appears nowhere in the existing file tree alongside other excluded tool-state dirs.",
+      "suggested_fix": "Confirm with the project whether `.refiner/` is intended to be versioned; if it is local tooling state, remove it from the change and add it to the ignore rules next to `.compass/` and `compass-out/`."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "benchmarks/qualification/raw_traversal.py",
+      "line": 0,
+      "claim": "The time limit is not enforced during full-graph scans in `search` and `_resolve`, which iterate all nodes inside comprehensions with no `_check_time` call, so the documented timeout bound can be exceeded on adversarially large inputs within a single scan.",
+      "evidence": "The bounded-work constraint and the file's own limit list include a time ceiling, but `_check_time(deadline)` is only called inside the load loops and the impact/path BFS loops; `matches = sorted(node_id for ... nodes.items() ...)` in both `search` and `_resolve` runs to completion unchecked.",
+      "suggested_fix": "Convert the comprehensions to loops that call `_check_time(deadline)` per chunk of scanned nodes."
+    }
+  ],
+  "sycophancy_screen": {
+    "reject_cap": 2,
+    "cap_overridden": false,
+    "cap_default": 2
+  }
+}
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/findings-round2.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/findings-round2.json
new file mode 100644
index 000000000..b5ae15efc
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/findings-round2.json
@@ -0,0 +1,61 @@
+{
+  "mode": "diff",
+  "verdict": "PASS",
+  "judge_model": "k3",
+  "producer_model": "gpt-5.6-sol",
+  "isolation_mode": "rest-gateway:http://localhost:4000/v1",
+  "cross_model_check": "verified-distinct",
+  "findings": [
+    {
+      "severity": "WARNING",
+      "file": "benchmarks/qualification/run_current_baseline.py",
+      "line": 104,
+      "claim": "On its own timeout path the workspace-patch capture raises RuntimeError, which is not in the except tuple, so the git child is never killed and its stdout pipe is never closed; additionally, if git stalls while producing no output, the blocking stdout.read(1MB) never returns and PATCH_TIMEOUT_SECONDS is never enforced at all.",
+      "evidence": "workspace_patch_metadata: `raise RuntimeError(\"workspace patch capture timed out\")` inside the try, but `except (OSError, subprocess.TimeoutExpired, ValueError)` excludes RuntimeError, skipping the `process.kill()`/`process.wait()` cleanup; the deadline is only checked after `process.stdout.read(1024 * 1024)` returns, which blocks indefinitely on a silent stalled child. Constraint `bounded-work`: 'All work over ... subprocess output remains bounded.'",
+      "suggested_fix": "Include RuntimeError in the cleanup except clause (or use try/finally with kill/close), and enforce the deadline via process.communicate(timeout=...) or select-based non-blocking reads rather than post-hoc checks around a blocking read."
+    },
+    {
+      "severity": "WARNING",
+      "file": "benchmarks/qualification/run_current_baseline.py",
+      "line": 232,
+      "claim": "Several subprocess invocations capture unbounded output with no timeout \u2014 `git rev-parse HEAD`, `binary --version`, `rustc --version`, and `cargo --version` all use subprocess.check_output without timeout=, unlike the measured workloads that go through the bounded ProcessSpec/run_measured helper.",
+      "evidence": "`version = subprocess.check_output([str(binary), \"--version\"], text=True).strip()`, `git_head = subprocess.check_output([\"git\", \"rev-parse\", \"HEAD\"], ...)`, and the host block's `subprocess.check_output([\"rustc\", \"--version\"], ...)` / `[\"cargo\", \"--version\"]` \u2014 none pass timeout or bound captured output. Constraint `bounded-work` covers 'subprocess output'; constraint `safe-primitives-reused` says existing bounded subprocess helpers are reused 'rather than reimplemented as weaker local variants'.",
+      "suggested_fix": "Pass an explicit timeout (e.g., reuse args.timeout_seconds or a small fixed bound) to every check_output call, or route them through the existing measured/bounded process helper."
+    },
+    {
+      "severity": "WARNING",
+      "file": "benchmarks/qualification/README.md",
+      "line": 48,
+      "claim": "The documented reproduction command cannot reproduce the retained baseline artifact: the README uses `--work-dir target/qualification-c013/run` and `--output target/qualification-c013/current-engine-baseline-v1.json`, but the retained baseline embeds cache paths under `target/qualification-c013/run-fixed/query-cache` and the artifact actually lives at `benchmarks/qualification/current-engine-baseline-v1.json`; the README never documents the real invocation or how to diff a fresh run against the retained file.",
+      "evidence": "README reproduction block: `--work-dir target/qualification-c013/run`; retained current-engine-baseline-v1.json workload commands contain `target/qualification-c013/run-fixed/query-cache`. Acceptance criterion 3.1 requires the baseline to be built and measured 'reproducibly'.",
+      "suggested_fix": "Document the exact invocation used to produce the retained artifact (including the run-fixed work dir and the copy step from target/ into benchmarks/qualification/), or regenerate the retained baseline using the documented command so the two match."
+    },
+    {
+      "severity": "WARNING",
+      "file": "benchmarks/qualification/scale-profile-digests-v1.json",
+      "claim": "No committed regression test regenerates the medium/large metadata-only node/edge digests and compares them to the pinned values, so the 'exact pinned digests' backing criterion 2.1 are enforced only by a one-time manual run recorded in verification.md and can silently drift if the generator or profiles change.",
+      "evidence": "tests/test_generate_graph.py asserts counts, plan determinism, small-profile byte determinism, and invalid-profile failures but never runs `--profile qualification-medium|qualification-large --metadata-only` against scale-profile-digests-v1.json; tests/test_corpora.py only verifies the manifest's checksum of the digest file itself. Verification evidence states: 'Full metadata-only generation for both profiles: exact pinned node/edge counts and SHA-256 digests matched' \u2014 a manual step, not a suite check. Constraint `regression-test-present`: 'Behavior changes require a regression test at the lowest useful layer.'",
+      "suggested_fix": "Add a test that runs generation_metadata(complete=True) for both pinned profiles (or the documented --metadata-only CLI) and asserts equality with scale-profile-digests-v1.json."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "benchmarks/qualification/generate_graph.py",
+      "line": 217,
+      "claim": "The emitted compass.graph/1 file record fabricates a constant contentDigest that is identical for every profile while byteSize varies, so the digest is not a digest of any actual content and misrepresents the file identity in the generated graph contract.",
+      "evidence": "In write_graph: `\"byteSize\": file_size` (max(nodes, edges) + 1, differing per profile) paired with `\"contentDigest\": _stable_id(\"qualification\", (\"generated-source\",))` \u2014 a fixed value independent of profile, nodes, or edges.",
+      "suggested_fix": "Derive contentDigest from the profile identity (e.g., include name/nodes/edges in the stable-ID inputs) or rename/annotate the field so consumers know it is a synthetic marker, not a content hash."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "benchmarks/qualification/semantic-corpus-v1.json",
+      "claim": "The descriptor's `counts` block (edgeProducers 28, flows 27, negativeCases 24, nodeProducers 45) is asserted by no test, so these claimed corpus dimensions are unverified metadata that can become stale without any failure.",
+      "evidence": "tests/test_corpora.py::test_semantic_sources_match_pinned_digests verifies only the two source SHA-256 values and the presence of 'parallel_multiplicity'/'pagination' in requiredDimensions; nothing checks `counts` against the pinned sources.",
+      "suggested_fix": "Either extend the semantic test to recount producers/flows/negative cases from the pinned sources and compare against `counts`, or drop the unverified counts from the descriptor."
+    }
+  ],
+  "sycophancy_screen": {
+    "reject_cap": 2,
+    "cap_overridden": false,
+    "cap_default": 2
+  }
+}
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/findings-round3.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/findings-round3.json
new file mode 100644
index 000000000..c27c65c44
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/findings-round3.json
@@ -0,0 +1,50 @@
+{
+  "mode": "diff",
+  "verdict": "BLOCK",
+  "judge_model": "k3",
+  "producer_model": "gpt-5.6-sol",
+  "isolation_mode": "rest-gateway:http://localhost:4000/v1",
+  "cross_model_check": "verified-distinct",
+  "findings": [
+    {
+      "severity": "CRITICAL",
+      "file": "benchmarks/qualification/README.md",
+      "claim": "The documented baseline-reproduction command writes its output directly over the pinned, manifest-checksummed artifact current-engine-baseline-v1.json, which changes bytes/SHA-256 on every run (recordedAt timestamp, fresh timings) and therefore breaks the closed manifest invariant that test_manifest_is_closed_and_all_digests_match enforces.",
+      "evidence": "README section 'Reproduce the current-engine baseline' passes `--output benchmarks/qualification/current-engine-baseline-v1.json`; run_current_baseline.py always emits a fresh `\"recordedAt\": datetime.now(timezone.utc).isoformat()`; manifest-v1.json pins that file at bytes 17891 / sha256 f0f3... and the test asserts exact byte size and digest for every listed path.",
+      "suggested_fix": "Point the documented reproduction command at a disposable path (e.g. target/qualification-c013/current-engine-baseline.json) and document that promoting a new baseline requires re-running the manifest update plus digest tests as an explicit, dated decision."
+    },
+    {
+      "severity": "CRITICAL",
+      "file": "openspec/changes/qualification-corpora-baselines/verification.md",
+      "claim": "The verification record claims 'Its synthetic file identity is profile-specific', but the generated file node ID is identical for every profile \u2014 only the contentDigest was made profile-specific \u2014 so the evidence statement is false and both scale graphs collide on the same file identity.",
+      "evidence": "generate_graph.py write_graph(): `file_id = _stable_id(\"file\", (SOURCE_PATH,))` depends only on the constant SOURCE_PATH ('qualification/generated.rs'), while profile name feeds only contentDigest/sourceTreeDigest/generationId. The refinement log iteration 3 confirms only contentDigest was changed ('Made the synthetic source file's contentDigest profile-specific').",
+      "suggested_fix": "Either include the profile name in the file stable ID (e.g. _stable_id(\"file\", (SOURCE_PATH, str(profile[\"name\"])))) and regenerate the pinned medium graph, oracle, and baseline digests, or correct the verification.md claim to state that only contentDigest is profile-specific."
+    },
+    {
+      "severity": "WARNING",
+      "file": "benchmarks/qualification/run_current_baseline.py",
+      "claim": "The workload measurement path _measure() applies no output-size bound at all, contradicting the recorded evidence that 'every ... subprocess ... uses the existing measured-process helper with explicit time and output limits', and bounded_capture only checks stdout/stderr sizes after the process has already written unbounded bytes to disk.",
+      "evidence": "_measure() passes stdout_path/stderr_path to run_measured and never checks resulting file sizes (compare bounded_capture, which at least enforces max_output_bytes post-hoc); constraints.json 'bounded-work' evidence asserts explicit output limits on every subprocess.",
+      "suggested_fix": "Add a post-hoc size check in _measure (as in bounded_capture) or thread a max_output_bytes limit through ProcessSpec/run_measured, and soften the constraints.json wording if the bound remains post-hoc."
+    },
+    {
+      "severity": "WARNING",
+      "file": "benchmarks/qualification/run_current_baseline.py",
+      "claim": "The retained baseline payload hardcodes graph profile, node count, and edge count (qualification-medium / 100000 / 250000) instead of deriving them from the --graph input, so invoking the runner with any other graph silently records false identity metadata in a schema meant to freeze measurement conditions.",
+      "evidence": "main() emits `\"graph\": {\"profile\": \"qualification-medium\", ..., \"nodes\": 100000, \"edges\": 250000}` as literals while only path/bytes/sha256 are measured from the actual file.",
+      "suggested_fix": "Validate the supplied graph against the pinned profile (e.g. require its sha256 to match scale-profile-digests-v1.json-derived materialization or a --expected-graph-sha256 argument) and fail closed on mismatch, or record measured/derived counts."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "benchmarks/qualification/tests/test_current_baseline.py",
+      "claim": "test_workspace_patch_identity_is_bounded_and_reproducible uses tempfile.TemporaryDirectory(dir=root / 'target'), which raises FileNotFoundError on a fresh checkout where target/ does not yet exist, making the qualification test suite order-dependent on a prior build.",
+      "evidence": "tempfile.TemporaryDirectory does not create the parent directory; nothing in the test suite creates root/'target' before this test runs.",
+      "suggested_fix": "Create the directory first ((root / 'target').mkdir(exist_ok=True)) or use the default system temp directory."
+    }
+  ],
+  "sycophancy_screen": {
+    "reject_cap": 2,
+    "cap_overridden": false,
+    "cap_default": 2
+  }
+}
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/findings-round4.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/findings-round4.json
new file mode 100644
index 000000000..313a43e68
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/findings-round4.json
@@ -0,0 +1,47 @@
+{
+  "mode": "diff",
+  "verdict": "PASS",
+  "judge_model": "k3",
+  "producer_model": "gpt-5.6-sol",
+  "isolation_mode": "rest-gateway:http://localhost:4000/v1",
+  "cross_model_check": "verified-distinct",
+  "findings": [
+    {
+      "severity": "WARNING",
+      "file": "benchmarks/qualification/generate_graph.py",
+      "line": 124,
+      "claim": "A profile missing the required 'name', 'nodes', or 'edges' keys crashes with an uncaught KeyError traceback instead of the documented fail-closed exit-2 behavior that the test suite asserts for other invalid profiles.",
+      "evidence": "_profile does `nodes = int(profile[\"nodes\"])`, `edges = int(profile[\"edges\"])`, and `profile[\"name\"]` is read in generation_metadata, but main only catches `(OSError, TypeError, ValueError, json.JSONDecodeError)` \u2014 KeyError is not a subclass of any of these. verification.md claims 'Oversized or invalid profiles fail closed' and test_invalid_or_oversized_profiles_fail_closed asserts `NotIn(\"Traceback\")` and returncode 2, but only for profiles that contain the keys with bad values.",
+      "suggested_fix": "Validate required keys explicitly (e.g., `if not isinstance(profile.get(\"nodes\"), int): raise ValueError(...)`) or add KeyError to the except clause in main."
+    },
+    {
+      "severity": "WARNING",
+      "file": "benchmarks/qualification/run_current_baseline.py",
+      "line": 137,
+      "claim": "The recorded source-state identity (`workspacePatchSha256`) is computed from `git diff --binary HEAD -- <paths>`, which silently excludes untracked files under the scoped paths, so the retained baseline's provenance can fail to represent the actual build inputs of the measured binary.",
+      "evidence": "workspace_patch_metadata runs `(\"git\", \"diff\", \"--binary\", \"HEAD\", \"--\", *paths)`; untracked files never appear in `git diff HEAD`. The scope includes `crates/compass-cli`, `crates/compass-mcp`, `crates/compass-query`, `crates/compass-model`, whose builds are filesystem-based and would incorporate untracked .rs files. Yet docs/future/qualification-corpora-baselines.md and verification.md claim the baseline retains 'computed source-state identity' / 'source provenance' so 'later comparisons cannot silently switch measurement conditions'. Notably this change's own artifacts were untracked at measure time, demonstrating the gap is live, not theoretical.",
+      "suggested_fix": "Complement the patch hash with a `git status --porcelain -- <paths>` (or `git ls-files --others --exclude-standard`) digest recorded alongside workspacePatchSha256, and fail closed when the scoped paths contain untracked or ignored build inputs."
+    },
+    {
+      "severity": "WARNING",
+      "file": ".refiner/artifacts/C-013/refinement_log.md",
+      "line": 0,
+      "claim": "The diff commits a new `.refiner/artifacts/C-013/` local QA-state directory whose justification cites a C-001\u2013C-012 receipt precedent that does not exist in the repository, and the blocking constraint on committed local state grants only the `.prometheus/knowledge/wiki` exception.",
+      "evidence": "Constraint no-secrets-or-machine-paths: 'No ... local .compass/ state, compass-out/, or private repository content committed outside the repository-owned .prometheus/knowledge/wiki transcript exception'. The packet file_tree contains no `.refiner/` entries at all, contradicting refinement_log.md's claim that the receipts are 'consistent with prior C-001\u2013C-012 receipts'. decisions.md 'dispositions' the concern rather than pointing to any constraint coverage for `.refiner/`.",
+      "suggested_fix": "Either add `.refiner/` to .gitignore and keep receipts uncommitted, or amend the constraint configuration to explicitly name `.refiner/artifacts/` as committed QA evidence before archiving."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "benchmarks/qualification/run_current_baseline.py",
+      "line": 158,
+      "claim": "raw_traversal_summary indexes `item[\"elapsedMicroseconds\"]`, `document[\"elapsedMicroseconds\"]`, and `document[\"schema\"]` directly, so a schema-conforming-but-incomplete raw traversal document (possible via the user-supplied --raw-traversal-script argument) raises an uncaught KeyError traceback instead of the runner's clean exit-2 failure.",
+      "evidence": "`elapsed = [int(item[\"elapsedMicroseconds\"]) for item in results]` and main's handler is `except (OSError, RuntimeError, ValueError, subprocess.SubprocessError)` \u2014 KeyError escapes. The sibling tools' tests explicitly assert no Traceback on bad input, establishing the intended contract.",
+      "suggested_fix": "Validate presence of required keys with .get and raise ValueError, or add KeyError to main's except tuple."
+    }
+  ],
+  "sycophancy_screen": {
+    "reject_cap": 2,
+    "cap_overridden": false,
+    "cap_default": 2
+  }
+}
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/findings-round5.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/findings-round5.json
new file mode 100644
index 000000000..4522108dc
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/findings-round5.json
@@ -0,0 +1,43 @@
+{
+  "mode": "diff",
+  "verdict": "PASS",
+  "judge_model": "k3",
+  "producer_model": "gpt-5.6-sol",
+  "isolation_mode": "rest-gateway:http://localhost:4000/v1",
+  "cross_model_check": "verified-distinct",
+  "findings": [
+    {
+      "severity": "WARNING",
+      "file": "benchmarks/qualification/run_current_baseline.py",
+      "claim": "workspaceTreeSha256 silently includes git-ignored files under the scoped paths (e.g. __pycache__ or editor files under crates/ and vendor/), while the separately recorded untracked subset uses git ls-files --others --exclude-standard and therefore excludes them \u2014 so the 'reproducible' source identity varies across machines with different local ignored files and the variance is invisible in the retained metadata.",
+      "evidence": "In workspace_source_metadata, scoped_files is built with `candidate.rglob(\"*\")` over every filesystem entry under DEFAULT_PATCH_PATHS (crates, vendor/...), but the untracked identity uses `(\"git\", \"ls-files\", \"--others\", \"--exclude-standard\", \"-z\", \"--\", *paths)`; anything git-ignored is hashed into workspaceTreeSha256 yet accounted nowhere, contradicting acceptance criterion 3.1 ('build and measure the current engine reproducibly') and the verification claim that source identity is fully explained by the tracked patch plus the 26-file untracked subset.",
+      "suggested_fix": "Build scoped_files from `git ls-files -z --cached --others` (tracked plus all untracked, without --exclude-standard) so the tree digest covers exactly the union of the tracked patch scope and the recorded untracked scope, and assert tree_files == tracked_count + untracked_files in the runner."
+    },
+    {
+      "severity": "WARNING",
+      "file": ".refiner/artifacts/C-013/artifact_manifest.json",
+      "claim": "The QA manifest certifies status \"refined\" with validatedAt \"2026-08-28\", but iteration-5 evidence (the re-measured baseline recordedAt 2026-08-29T05:16:37Z and the 22-test run described in refinement_log iteration 5) postdates that validation timestamp, so the receipt certifies a state older than the evidence it covers.",
+      "evidence": ".refiner/artifacts/C-013/artifact_manifest.json has `\"validatedAt\": \"2026-08-28\"` with `\"status\": \"refined\"`, while benchmarks/qualification/current-engine-baseline-v1.json has `\"recordedAt\": \"2026-08-29T05:16:37.416194+00:00\"` and .refiner/artifacts/C-013/refinement_log.md iteration 5 records expanding the provenance scope and re-running the complete baseline afterward.",
+      "suggested_fix": "Update validatedAt (and the receipt, if dated) to the date of the final iteration-5 baseline/test run, or add an explicit field tying the certification to the retained baseline's recordedAt."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "benchmarks/qualification/raw_traversal.py",
+      "claim": "verify_expected does not type-check expected members, and `int(minimum_edges)` silently coerces non-integer JSON values such as true (to 1) or numeric strings, weakening the evidence contract that every other input path validates strictly.",
+      "evidence": "validate_task only checks `expected` is a dict; in verify_expected, `minimum_edges = expected.get(\"minimumEdgeCount\")` is used via `len(edge_ids) < int(minimum_edges)` with no bool/int guard, while neighboring fields like maxDepth get explicit `isinstance(value, bool) or not isinstance(value, int)` rejection.",
+      "suggested_fix": "In validate_task, reject non-dict containsNodeIds entries and non-integer (or bool) minimumEdgeCount/status/firstNodeId/lastNodeId values so malformed expectations fail closed instead of being coerced."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "benchmarks/qualification/raw_traversal.py",
+      "claim": "load_graph validates node ID uniqueness but accepts duplicate edge IDs silently, so a malformed input graph with colliding edge identities would pass the 'strict' scan undetected.",
+      "evidence": "In load_graph, nodes raise on `node_id in nodes` ('invalid or duplicate node ID'), but the links loop only checks endpoint membership and non-empty edge_id, with no duplicate edge_id tracking.",
+      "suggested_fix": "Track seen edge IDs during the links scan and raise ValueError on duplicates, mirroring the node validation."
+    }
+  ],
+  "sycophancy_screen": {
+    "reject_cap": 2,
+    "cap_overridden": false,
+    "cap_default": 2
+  }
+}
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/findings-round6.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/findings-round6.json
new file mode 100644
index 000000000..20b8072e0
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/findings-round6.json
@@ -0,0 +1,36 @@
+{
+  "mode": "diff",
+  "verdict": "PASS",
+  "judge_model": "k3",
+  "producer_model": "gpt-5.6-sol",
+  "isolation_mode": "rest-gateway:http://localhost:4000/v1",
+  "cross_model_check": "verified-distinct",
+  "findings": [
+    {
+      "severity": "WARNING",
+      "file": "benchmarks/qualification/raw_traversal.py",
+      "claim": "A task with an explicit `\"expected\": null` (or no `expected` key) silently bypasses the entire evidence contract, and the run still reports oracleStatus PASS \u2014 a default that masks authoring failure in a harness whose stated purpose is enforcing expected evidence.",
+      "evidence": "In validate_task: `expected = task.get(\"expected\")` followed by `if expected is not None and not isinstance(expected, dict): raise` \u2014 an explicit JSON null passes validation. In verify_expected: `expected = task.get(\"expected\"); if not isinstance(expected, dict): return` \u2014 the check returns with no assertion. The README claims 'The runner also applies each task's expected evidence contract; the run fails instead of publishing an oracle mismatch,' and criterion 2.3 requires the 30 tasks carry expected evidence, but the harness itself accepts a null/absent contract without failing. The versioned corpus is protected by test_corpora.py, but the tool's silent-skip path contradicts the fail-closed posture applied everywhere else (duplicate edge IDs, malformed types, limit exhaustion all exit 2).",
+      "suggested_fix": "In validate_task, reject a present-but-null `expected` (and consider requiring `expected` outright for the versioned suite schema), so a missing evidence contract fails with exit 2 like every other malformed-task case."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "benchmarks/qualification/run_current_baseline.py",
+      "claim": "Final evidence artifacts are written with plain `Path.write_text`, a weaker local variant of the atomic-write practice named in the project's safe-primitives-reused constraint; an interrupted run leaves a truncated JSON artifact on disk.",
+      "evidence": "Constraint `safe-primitives-reused` (warning): 'Existing bounded readers, subprocess helpers, path containment, endpoint checks, and atomic writes are reused rather than reimplemented as weaker local variants.' run_current_baseline.py ends with `args.output.write_text(json.dumps(payload, ...) + \"\\n\", encoding=\"utf-8\")` and raw_traversal.py does the same for `--output`. The runner's output is the schema later promoted to the retained baseline per the README's promotion procedure. The failure mode is loud (JSON parse/checksum failure downstream), hence suggestion rather than warning.",
+      "suggested_fix": "Write to a sibling temporary file and atomically rename (os.replace) for both script outputs, matching the repository's atomic-write practice."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "openspec/changes/qualification-corpora-baselines/proposal.md",
+      "claim": "The proposal's Impact statement that raw run logs remain disposable under 'target/ or /tmp' overstates the baseline runner's actual behavior, which refuses any work directory outside the repository root.",
+      "evidence": "proposal.md: 'Generated medium/large graphs and raw run logs remain disposable under `target/` or `/tmp`.' But run_current_baseline.py enforces `cache_relative = repository_relative(cache, repository_root, label=\"cache\")` (and likewise for binary, graph, raw script, and task suite), so `--work-dir /tmp/...` raises 'cache must be inside repository root'. The README now correctly says 'Reproduction always writes to target/', leaving the proposal as the stale claim. Failure is closed and clearly messaged, so impact is documentation accuracy only.",
+      "suggested_fix": "Align the proposal wording with the runner contract (e.g., 'under target/ for the baseline runner; generator and standalone raw-traversal outputs may also use /tmp')."
+    }
+  ],
+  "sycophancy_screen": {
+    "reject_cap": 2,
+    "cap_overridden": false,
+    "cap_default": 2
+  }
+}
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/findings-round7.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/findings-round7.json
new file mode 100644
index 000000000..1f9a8ebbd
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/findings-round7.json
@@ -0,0 +1,63 @@
+{
+  "mode": "diff",
+  "verdict": "PASS",
+  "judge_model": "k3",
+  "producer_model": "gpt-5.6-sol",
+  "isolation_mode": "rest-gateway:http://localhost:4000/v1",
+  "cross_model_check": "verified-distinct",
+  "findings": [
+    {
+      "severity": "WARNING",
+      "file": "benchmarks/qualification/README.md",
+      "line": 74,
+      "claim": "The documented baseline-promotion procedure instructs replacing the retained, committed measurement artifact in place, conflicting with the blocking immutable-realizations constraint.",
+      "evidence": "README states: 'Promoting a new retained baseline is a separate dated evidence update: review the fresh samples, replace the retained JSON deliberately, regenerate manifest-v1.json'. The constraints file declares immutable-realizations blocking: 'Published historical realizations are immutable \u2014 never rewritten in place, never silently substituted with a different realization/profile'. current-engine-baseline-v1.json is a committed, manifest-pinned historical measurement; the guidance sanctions overwriting it rather than publishing a new versioned artifact.",
+      "suggested_fix": "Document promotion as adding a new dated, versioned artifact (e.g., current-engine-baseline-v2.json) and extending manifest-v1.json, preserving the prior retained baseline."
+    },
+    {
+      "severity": "WARNING",
+      "file": "benchmarks/qualification/run_current_baseline.py",
+      "line": 345,
+      "claim": "The search workload is the only query workload without explicit --max-nodes/--max-edges bounds in its retained command, so the frozen comparison surface relies on changeable shipped defaults for that class.",
+      "evidence": "In query_commands, callers/callees/impact-depth-3 all append '--max-nodes', '512', '--max-edges', '1024', while 'search' is only (binary, 'search', 'qualification::Node0099999', *common) with no result bound. Acceptance criterion 2.3 requires 'bounded tool/raw traversal routes', and the design promises bounded pagination is observable; the retained search command records no explicit bound, so a future default change would silently alter the measured condition the baseline is meant to pin.",
+      "suggested_fix": "Pass explicit --max-nodes/--max-edges (or the engine's documented search result limit flag) on the search workload so all retained workload commands state their bounds."
+    },
+    {
+      "severity": "WARNING",
+      "file": "benchmarks/qualification/generate_graph.py",
+      "line": 213,
+      "claim": "Graph materialization writes directly to the final destination path with no atomic publication, so an interrupted or crashed generation leaves a partial graph file visible at the canonical output location.",
+      "evidence": "write_graph does 'with path.open(\"wb\") as stream:' and streams nodes/edges straight into args.output, while the change itself added benchmarks/qualification/io.py atomic_write_text precisely to make evidence publication crash-safe, and the ratified gate table in docs/future/qualification-corpora-baselines.md requires 'No partial generation visible'. A truncated 220MB graph.json in target/ is only detected later if the baseline runner's hash check happens to run.",
+      "suggested_fix": "Stream to a temporary file in the destination directory and os.replace() it into place on success (and fsync the directory on POSIX), reusing the same publication discipline as io.py."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "benchmarks/qualification/run_current_baseline.py",
+      "line": 448,
+      "claim": "The per-query warmup loop bypasses the repository's measured-process helper with a raw subprocess.run, a weaker local variant of the bounded-subprocess primitive the rest of the runner uses.",
+      "evidence": "'for command in commands.values(): subprocess.run(command, cwd=repository_root, check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, timeout=args.timeout_seconds)' \u2014 every other subprocess in this file goes through run_measured/ProcessSpec per the safe-primitives-reused constraint; the warmup's timeout and DEVNULL keep it bounded in effect, but it has no output cap, no timeout-error context, and diverges from the single helper the verification claims for runner subprocesses.",
+      "suggested_fix": "Route the warmup through run_measured (or a shared bounded helper) with explicit stdout/stderr paths and caps, matching the metadata and measurement paths."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "benchmarks/qualification/run_current_baseline.py",
+      "line": 49,
+      "claim": "compressed_size buffers the entire release binary (up to the 512 MiB ceiling) plus its compressed form in memory instead of streaming.",
+      "evidence": "'compressor = gzip.compress(source.read(), compresslevel=9, mtime=0)' after checking size against MAX_BINARY_BYTES. It is technically bounded, but the change's own design decision emphasizes streaming/bounded memory ('holds only bounded record templates and digest state'), and a ~150 MiB binary becomes ~300+ MiB of transient allocations.",
+      "suggested_fix": "Stream through gzip.GzipFile(fileobj=..., mode='wb', compresslevel=9, mtime=0) over a length-counting sink in 1 MiB chunks."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "benchmarks/qualification/run_current_baseline.py",
+      "line": 50,
+      "claim": "The 'deterministic gzip-9' size evidence is only deterministic for a fixed CPython version, because gzip.compress(mtime=0) changed implementation across interpreter releases.",
+      "evidence": "gzip.compress(..., mtime=0) is used for the pinned gzip9Bytes value (25,945,073 in current-engine-baseline-v1.json); CPython 3.13 changed gzip.compress to delegate to zlib.compress when mtime=0, producing a different DEFLATE stream (and potentially different size) than 3.12's GzipFile path. The recorded host pins python 3.12.8, so same-runner reproduction holds, but the artifact reads as a version-independent figure.",
+      "suggested_fix": "Either note in the baseline schema/README that gzip9Bytes is interpreter-version-specific, or use an explicit GzipFile construction whose output is stable across supported Python versions."
+    }
+  ],
+  "sycophancy_screen": {
+    "reject_cap": 2,
+    "cap_overridden": false,
+    "cap_default": 2
+  }
+}
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/findings-round8.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/findings-round8.json
new file mode 100644
index 000000000..e3d0f7987
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/findings-round8.json
@@ -0,0 +1,47 @@
+{
+  "mode": "diff",
+  "verdict": "PASS",
+  "judge_model": "k3",
+  "producer_model": "gpt-5.6-sol",
+  "isolation_mode": "rest-gateway:http://localhost:4000/v1",
+  "cross_model_check": "verified-distinct",
+  "findings": [
+    {
+      "severity": "WARNING",
+      "file": "benchmarks/qualification/raw_traversal.py",
+      "line": 176,
+      "claim": "The versioned per-task status contract is only half-implemented: `verify_expected` defaults a missing result status to \"complete\", and only the `path` operation ever emits a status field, so `expected.status: \"empty\"` is unsatisfiable for search/callers/callees/impact while a genuinely empty search result silently verifies as \"complete\".",
+      "evidence": "`actual_status = result.get(\"status\", \"complete\")` in `verify_expected`; in `execute_task`, the search/callers/callees/impact branches return dicts with no \"status\" key, and only the path branch returns `{\"status\": \"empty\", ...}` or `{\"status\": \"complete\", ...}`. Meanwhile `validate_task` explicitly admits `status in {\"complete\", \"empty\"}` for every operation. verification.md claims the oracle output is \"continuously checked against every expected status\", but the frozen status semantics for 4 of 5 operations were never actually produced by the oracle and will mismatch any future engine that reports empty searches as \"empty\".",
+      "suggested_fix": "Either have all operations emit an explicit status (\"empty\" when nodeIds is empty) so the default in verify_expected can be removed, or restrict the admitted status domain per operation in validate_task and drop the unreachable \"empty\" value for non-path operations."
+    },
+    {
+      "severity": "WARNING",
+      "file": "benchmarks/qualification/raw_traversal.py",
+      "line": 258,
+      "claim": "The `limits` object versioned inside agent-tasks-v1.json is never consumed: the harness enforces only CLI-arg limits, and no test cross-checks the file's limits against the enforced ones, so the \"explicit limit behavior\" claimed for the versioned task suite is decorative metadata.",
+      "evidence": "agent-tasks-v1.json contains `\"limits\": {\"maxDepth\": 32, \"maxEdges\": 250000, \"maxNodes\": 100000, \"maxResultsPerTask\": 10000, \"timeoutSeconds\": 120}`, but `main()` in raw_traversal.py reads only `tasks_document[\"tasks\"]` and takes every limit from argparse; test_corpora.py and test_raw_traversal.py never reference the limits block. Acceptance criterion 2.2 (\"bounded raw-traversal baseline with explicit limit behavior\") and verification.md (\"has explicit byte/node/edge/depth/result/time limits\") describe the file as the limit contract, yet editing those pinned values changes no enforced behavior.",
+      "suggested_fix": "Validate in raw_traversal.main that the tasks-file limits (when present) equal the effective CLI limits and fail with exit 2 on mismatch, or remove the limits block from the task schema so the single source of truth is the command line."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "benchmarks/qualification/raw_traversal.py",
+      "line": 252,
+      "claim": "The tasks file is read with an unbounded `read_text` while every other input (graph bytes, node/edge counts, results, time) is explicitly capped, leaving one unbounded input in a harness whose stated purpose is bounded operation.",
+      "evidence": "`tasks_document = json.loads(args.tasks.read_text(encoding=\"utf-8\"))` with no size check; contrast with `load_graph`'s `max_graph_bytes` stat check and the bounded-work constraint (\"All work over source files, graphs ... remains bounded\"). The 120s deadline bounds execution time but not the up-front memory/size of an arbitrarily large --tasks input.",
+      "suggested_fix": "Add a small explicit byte ceiling for the tasks document (e.g., stat check before read, fail with exit 2) mirroring the graph-byte guard."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "benchmarks/qualification/run_current_baseline.py",
+      "line": 399,
+      "claim": "The raw-denominator invocation hardcodes qualification-medium ceilings (--max-nodes 100000, --max-edges 250000, --max-graph-bytes 268435456) regardless of the profile of the graph actually supplied via --graph, so the runner silently cannot be reused for the other pinned profile or a future profile without a code edit.",
+      "evidence": "In `main`, `raw_command` is constructed with literal \"100000\"/\"250000\"/\"268435456\" while `validated_graph_contract` accepts any profile present in scale-profile-digests-v1.json (which includes qualification-large at 1,000,000/2,500,000); running the documented runner against the large profile would fail closed in raw traversal for a reason unrelated to the graph's validity.",
+      "suggested_fix": "Derive the raw-traversal ceilings from the validated profile entry (nodes/edges from `graph_contract`, bytes from the measured graph size) or fail fast with an explicit message that only qualification-medium is supported."
+    }
+  ],
+  "sycophancy_screen": {
+    "reject_cap": 2,
+    "cap_overridden": false,
+    "cap_default": 2
+  }
+}
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/findings-round9.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/findings-round9.json
new file mode 100644
index 000000000..767c991d2
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/findings-round9.json
@@ -0,0 +1,43 @@
+{
+  "mode": "diff",
+  "verdict": "PASS",
+  "judge_model": "k3",
+  "producer_model": "gpt-5.6-sol",
+  "isolation_mode": "rest-gateway:http://localhost:4000/v1",
+  "cross_model_check": "verified-distinct",
+  "findings": [
+    {
+      "severity": "WARNING",
+      "file": "benchmarks/qualification/raw_traversal.py",
+      "claim": "Unknown keys inside a task's `expected` object are silently ignored by both validate_task and verify_expected, so a misspelled or unsupported expectation (e.g. `firstNodeID`, `containsEdgeIds`) passes validation and is never asserted while the run still reports oracleStatus PASS.",
+      "evidence": "validate_task only type-checks the five known keys via `expected.get(\"status\")`, `expected.get(\"containsNodeIds\", [])`, `expected.get(\"minimumEdgeCount\")`, and `expected.get(key)` for first/lastNodeId, and never rejects unrecognized keys; verify_expected likewise only reads those same keys with defaults. The README states 'the runner applies each contract and fails instead of publishing absent or mismatched oracle evidence', and acceptance task 2.3 requires '30 agent tasks with expected evidence' \u2014 a contract field that is silently dropped violates that fail-closed contract for any task document that is not the pinned file.",
+      "suggested_fix": "In validate_task, reject any key in `expected` outside the supported set {status, containsNodeIds, minimumEdgeCount, firstNodeId, lastNodeId} with a clean exit-2 input error, and add a regression test asserting a task with an unknown expectation key fails closed."
+    },
+    {
+      "severity": "WARNING",
+      "file": "benchmarks/qualification/raw_traversal.py",
+      "claim": "An empty `tasks` array produces a vacuously passing result: main enforces only the upper bound `len(tasks) > MAX_TASKS`, so a zero-task document yields `oracleStatus: PASS` with zero verified work.",
+      "evidence": "In main: `if len(tasks) > MAX_TASKS: raise LimitExceeded(...)` with no lower bound, after which the payload hardcodes `\"oracleStatus\": \"PASS\"` regardless of how many tasks executed. The project's bounded-work constraint requires that 'a limit error is a distinct outcome from an empty result'; the current-engine runner only catches this downstream because raw_traversal_summary hardcodes exactly 30 results, but the standalone documented invocation (README 'Run the bounded raw denominator') publishes PASS over an empty denominator.",
+      "suggested_fix": "Reject `len(tasks) == 0` as an input failure (exit 2) in main, and add a regression test covering the empty-tasks document."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "benchmarks/qualification/raw_traversal.py",
+      "claim": "load_graph silently coerces node/edge identity fields with `str(record.get(\"id\", \"\"))` (and the same for name, qualifiedName, source, target, edge id), so non-string JSON values are accepted and stringified instead of failing closed \u2014 inconsistent with the strict type validation applied to task limits and expected fields elsewhere in the same file.",
+      "evidence": "In load_graph: `node_id = str(record.get(\"id\", \"\"))`, `nodes[node_id] = (str(record.get(\"name\", \"\")), str(record.get(\"qualifiedName\", \"\")))`, and `source = str(record.get(\"source\", \"\"))` / `target = str(...)` / `edge_id = str(...)`. A record with `\"id\": 5` becomes the node \"5\" rather than an input error, unlike e.g. validate_declared_limits which rejects booleans masquerading as integers.",
+      "suggested_fix": "Type-check each field (`isinstance(value, str)` and non-empty) and raise ValueError on non-string node ids, names, qualified names, and edge source/target/id."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "benchmarks/qualification/run_current_baseline.py",
+      "claim": "raw_traversal_summary records the raw-denominator command with a hardcoded `\"python3\"` interpreter even though the measurement was executed with `sys.executable`, so the retained command can name a different interpreter than the one actually measured.",
+      "evidence": "In main the raw workload is launched via `raw_command = (sys.executable, str(raw_script_relative), ...)`, but raw_traversal_summary emits `\"command\": [\"python3\", *command[1:]]`, and the retained current-engine-baseline-v1.json therefore records `\"command\": [\"python3\", ...]`. A reproducer invoking the recorded command literally may resolve `python3` to a different interpreter than the sys.executable used for the measurement; only host.python (the runner's own version) pins what actually ran.",
+      "suggested_fix": "Record the raw command with the interpreter actually used (e.g. keep sys.executable resolved to a version string or record `pythonExecutable` alongside the command), or document in the schema that command[0] is a normalized label whose true version is host.python."
+    }
+  ],
+  "sycophancy_screen": {
+    "reject_cap": 2,
+    "cap_overridden": false,
+    "cap_default": 2
+  }
+}
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/findings.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/findings.json
new file mode 100644
index 000000000..9d6c7cdf5
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/findings.json
@@ -0,0 +1,47 @@
+{
+  "mode": "diff",
+  "verdict": "PASS",
+  "judge_model": "k3",
+  "producer_model": "gpt-5.6-sol",
+  "isolation_mode": "rest-gateway:http://localhost:4000/v1",
+  "cross_model_check": "verified-distinct",
+  "findings": [
+    {
+      "severity": "WARNING",
+      "file": "benchmarks/qualification/raw_traversal.py",
+      "line": 378,
+      "claim": "A deeply nested task document within the 1 MiB cap crashes with an uncaught RecursionError (traceback, exit 1), violating the documented contract that input failures exit 2 with a clean message.",
+      "evidence": "main() parses the task document with `json.loads(task_contents.decode(\"utf-8\"))` after only a byte cap (`MAX_TASK_BYTES = 1024 * 1024`); a ~4 KB payload of 2000 nested arrays exceeds Python's recursion limit, and the __main__ handler catches only `(LimitExceeded, OSError, TypeError, ValueError)` \u2014 RecursionError is a RuntimeError subclass and escapes. README.md states 'Exit status 2 is a limit or input failure', and test_raw_traversal.py asserts 'NotIn Traceback' for malformed inputs but never exercises nesting depth.",
+      "suggested_fix": "Add RecursionError (or RuntimeError) to the caught exception tuple, or pre-validate JSON nesting depth before json.loads, and add a regression test with a deeply nested task document asserting exit 2 and no traceback."
+    },
+    {
+      "severity": "WARNING",
+      "file": "benchmarks/qualification/raw-traversal-oracle-v1.json",
+      "line": 0,
+      "claim": "The retained timing-free oracle has no documented or scripted reproduction path, so refreshing it after a legitimate task-suite or generator change requires manual editing of a manifest-pinned evidence file.",
+      "evidence": "raw_traversal.py emits schema 'compass.qualification-raw-traversal/1' with per-task elapsedMicroseconds, limits, and oracleStatus, but the retained oracle uses a distinct schema 'compass.qualification-raw-oracle/1' containing only id/result plus graph and taskSuite pins. README.md documents only producing the disposable timing-inclusive output under target/ ('Run the bounded raw denominator'), and no transformer between the two schemas exists anywhere in the packet, while manifest-v1.json pins the oracle's exact bytes and verification.md claims 'the timing-free result set is retained' as reproducible evidence.",
+      "suggested_fix": "Add a small deterministic strip/pin step (e.g. an --oracle-output mode in raw_traversal.py or a documented transform script) that derives the oracle from a raw run, document it in README.md, and list any new script in manifest-v1.json."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "benchmarks/qualification/raw_traversal.py",
+      "line": 246,
+      "claim": "The impact operation hardcodes status 'complete' and can never emit 'empty', contradicting the README claim that all operations emit an explicit complete-or-empty status and making 'empty' an unsatisfiable expected status for impact tasks.",
+      "evidence": "The impact branch returns `{\"status\": \"complete\", \"nodeIds\": sorted(seen), ...}` unconditionally (seen always contains at least the resolved source), while validate_task accepts `\"status\": \"empty\"` in any task's expected object and README.md states 'All operations emit an explicit `complete` or `empty` status.' An impact task authored with expected status 'empty' can never pass verify_expected.",
+      "suggested_fix": "Either document that impact is always 'complete' by definition (and reject expected status 'empty' for impact in validate_task), or emit 'empty' when the blast radius contains only the source node."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "benchmarks/qualification/run_current_baseline.py",
+      "line": 303,
+      "claim": "Workload and metadata stdout/stderr byte caps are enforced only after process exit, so within its timeout a misbehaving measured process can write unbounded bytes to disk before the size check fires.",
+      "evidence": "In both _measure() and bounded_capture() the sequence is `metrics = run_measured(ProcessSpec(...))` followed by `size = path.stat().st_size; if size > max_output_bytes: raise` \u2014 the cap is a post-hoc inspection of the fully captured file; nothing in the packet shows run_measured itself truncating or capping the stream, while the bounded-work blocking constraint requires that 'subprocess output remains bounded' and verification.md claims explicit stdout/stderr limits on every measured workload.",
+      "suggested_fix": "Confirm run_measured enforces a streaming byte cap (and cite that in verification.md), or pass the byte limit into ProcessSpec so capture is truncated/failed at the limit rather than checked after the fact."
+    }
+  ],
+  "sycophancy_screen": {
+    "reject_cap": 2,
+    "cap_overridden": false,
+    "cap_default": 2
+  }
+}
\ No newline at end of file
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/round5-schema-feedback.md b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/round5-schema-feedback.md
new file mode 100644
index 000000000..195d5742b
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/round5-schema-feedback.md
@@ -0,0 +1,5 @@
+Return exactly one JSON object matching the reviewer mandate. It must contain a
+`findings` array. Each finding must use severity `CRITICAL`, `WARNING`, or
+`SUGGESTION` and include non-empty `claim` and `evidence` strings. If there are
+no findings, return an empty `findings` array plus the required `checked_classes`
+due-diligence list. Do not emit prose, Markdown fences, or a truncated object.
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-014/findings-round1.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-014/findings-round1.json
new file mode 100644
index 000000000..ee9af8546
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-014/findings-round1.json
@@ -0,0 +1,64 @@
+{
+  "mode": "diff",
+  "verdict": "BLOCK",
+  "judge_model": "k3",
+  "producer_model": "gpt-5.6-sol",
+  "isolation_mode": "rest-gateway:http://localhost:4000/v1",
+  "cross_model_check": "verified-distinct",
+  "findings": [
+    {
+      "severity": "CRITICAL",
+      "file": "Cargo.toml",
+      "claim": "The diff bundles multiple unrelated product changes (rmcp 2.2.0\u21923.1.4 SDK upgrade, new compass-partition workspace member, compass-mcp dependency changes, MCP/agent/graph-bytes CHANGELOG entries) that are outside this change's declared scope, acceptance criteria, and openspec files.txt, and their corresponding source and regression tests are absent from the diff.",
+      "evidence": "Cargo.toml hunk changes `rmcp = { version = \"2.2.0\"...` to `=3.1.4`, adds `http-body-util` and `compass-partition` workspace deps and a `crates/compass-partition` member; Cargo.lock shows `rmcp 3.1.4`, `compass-partition`, and new `http-body-util`/`sha2` deps on `compass-mcp` and a new `compass-partition` dep on `compass-history`; CHANGELOG.md gains entries for `compass agent list|install|doctor|...`, `compass.code_context.v1`, MCP 2026-07-28 transport requirements, the rmcp upgrade, compass-partition extraction, and COMPASS_MAX_GRAPH_BYTES \u2014 none of which appear in `openspec/changes/surreal-graph-projection/files.txt` or the acceptance criteria, and no compass-mcp/compass-history source or test changes are in the diff. This breaches the `no-unrelated-diff-noise` constraint and leaves behavior changes covered by `regression-test-present` without evidence in the change.",
+      "suggested_fix": "Split the rmcp/MCP-envelope/compass-partition/COMPASS_MAX_GRAPH_BYTES work into their own changes with their manifests, sources, and tests, or include full evidence here; keep this diff to the surreal-graph-projection scope."
+    },
+    {
+      "severity": "WARNING",
+      "file": "docs/implementation/surreal-graph-projection.md",
+      "claim": "The same diff asserts two different canonical graph byte bounds: the projection docs/decisions claim a 1 GiB canonical bound while the CHANGELOG claims the 2 GiB COMPASS_MAX_GRAPH_BYTES default is retained.",
+      "evidence": "docs/implementation/surreal-graph-projection.md: \"cap serialized projection data at the canonical 1 GiB graph bound\" and decisions.md: \"the canonical 1 GiB graph byte bound\"; CHANGELOG.md: \"Honor `COMPASS_MAX_GRAPH_BYTES` ... while retaining the 2 GiB default\". `ProjectionLimits::default()` uses `compass_model::DEFAULT_GRAPH_SIZE_CAP_BYTES`, whose value cannot be both.",
+      "suggested_fix": "Verify `DEFAULT_GRAPH_SIZE_CAP_BYTES` and make the docs, decisions record, and CHANGELOG state one consistent bound."
+    },
+    {
+      "severity": "WARNING",
+      "file": "crates/compass-graphdb-surreal/src/engine.rs",
+      "claim": "The idempotent-reactivation arm of `stage_generation` compares only fingerprint/counts/bytes/complete and never compares `source_tree_digest`, `schema_fingerprint`, or `schema_version`, nor verifies the generation's node/relation records still exist, before moving the active pointer.",
+      "evidence": "In the `if let Some(existing) = ...` branch, the mismatch check is `existing.projection_fingerprint != plan.projection_fingerprint || existing.node_count != ... || existing.relation_count != ... || existing.projected_bytes != projected_bytes || !existing.complete`; `fingerprint()` in projection.rs hashes only schema version, repository/generation IDs, and record keys/payloads \u2014 the two digest fields are neither hashed nor compared \u2014 and the branch then calls `upsert_pointer` without re-running `validate_candidate`. A same-generation plan with different tree/schema digests is silently accepted with the stale manifest retained, and a generation whose records are missing gets reactivated (reads then fail with \"records do not match the manifest\").",
+      "suggested_fix": "Include `source_tree_digest`/`schema_fingerprint` in the fingerprint or compare them explicitly in the existing-manifest check, and re-validate candidate identity sets before re-pointing the repository pointer."
+    },
+    {
+      "severity": "WARNING",
+      "file": "scripts/check_surreal_feature_isolation.sh",
+      "claim": "The `--binary` gate is effectively vacuous: after `cargo build -p compass-graphdb-surreal --features mem`, the second `cargo build -p compass-cli --locked` has an unchanged fingerprint and is a no-op, so `cmp` trivially passes on the untouched binary \u2014 yet constraints.json cites it as proof the default binary is byte-identical after a Mem build.",
+      "evidence": "The script does `cargo build -p compass-cli --locked; cp ... $baseline; cargo build -p compass-graphdb-surreal --features mem --locked; cargo build -p compass-cli --locked; cmp -s $baseline ...`. Nothing in compass-cli's inputs changes between the two builds, so cargo rebuilds nothing and the comparison cannot fail for the reason the gate claims; the real isolation signal comes only from the `cargo tree` checks.",
+      "suggested_fix": "Either drop the binary-comparison mode and rely on the dependency-tree checks, or make it meaningful by building a Surreal-enabled binary that actually links the projection crate and comparing it against the default artifact."
+    },
+    {
+      "severity": "WARNING",
+      "file": ".refiner/artifacts/C-014/dist/refinement-receipt.md",
+      "claim": "The receipt records \"PASS (deterministic gate)\" while stating the artifact-refiner's canonical controllers and schema assets were unavailable and a \"fallback state contract\" was used, so the blocking refiner-qa-evidence gate's PASS is self-attested rather than produced by the required gate.",
+      "evidence": "refinement-receipt.md: \"The installed artifact-refiner adapter lacks its referenced canonical controllers and schema assets, so this receipt uses the repository's established deterministic fallback state contract.\" The `refiner-qa-evidence` blocking constraint requires per-change manifests/constraints/decisions/logs/receipts as KBD certification evidence; a fallback receipt asserting PASS without the canonical gate weakens that certification.",
+      "suggested_fix": "Re-run the canonical refiner gate (or repair the adapter) and regenerate the receipt, or downgrade the recorded status to reflect that the canonical gate did not execute."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "crates/compass-graphdb-surreal/src/engine.rs",
+      "claim": "`InterruptAfter(0)` cannot interrupt before any mutation: the check runs only after `mutations += 1`, so `InterruptAfter(0)` fires after the first mutation rather than immediately.",
+      "evidence": "`interrupt_if_requested` is called only inside the node/relation loops after incrementing `mutations`; with `InterruptAfter(0)` the first evaluation is `1 >= 0` after one mutation has already been staged, which is an off-by-one in the public fault-injection API.",
+      "suggested_fix": "Check the interrupt condition before performing each mutation (or document that `InterruptAfter(n)` always allows at least one mutation when n == 0)."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "crates/compass-graphdb-surreal/src/engine.rs",
+      "claim": "The schema defines no indexes on repositoryId/generationId/compassNodeId/compassEdgeId, so every read and candidate validation performs filtered full-table scans; LIMIT bounds returned rows but not scanned work.",
+      "evidence": "The SCHEMA const contains only DEFINE TABLE/DEFINE FIELD statements; SELECT_NODE_IDS/SELECT_RELATION_IDS/SELECT_NODES/SELECT_RELATIONS all filter `WHERE repositoryId = $repository AND generationId = $generation ORDER BY ...` with no DEFINE INDEX, which matters once one database holds multiple repositories or retained historical generations.",
+      "suggested_fix": "Add composite indexes on (repositoryId, generationId, compassNodeId/compassEdgeId) for code_node and each relation table."
+    }
+  ],
+  "sycophancy_screen": {
+    "reject_cap": 2,
+    "cap_overridden": false,
+    "cap_default": 2
+  }
+}
\ No newline at end of file
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-014/findings-round2.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-014/findings-round2.json
new file mode 100644
index 000000000..37b41e3c3
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-014/findings-round2.json
@@ -0,0 +1,47 @@
+{
+  "mode": "diff",
+  "verdict": "PASS",
+  "judge_model": "k3",
+  "producer_model": "gpt-5.6-sol",
+  "isolation_mode": "rest-gateway:http://localhost:4000/v1",
+  "cross_model_check": "verified-distinct",
+  "findings": [
+    {
+      "severity": "WARNING",
+      "file": "crates/compass-graphdb-surreal/src/engine.rs",
+      "line": 226,
+      "claim": "When staging fails and the subsequent transaction.cancel() also fails, the original typed error (Interrupted, LimitExceeded, InvalidPlan, Database write failure) is discarded and replaced with a generic 'cancel_projection' Database error, masking the actionable root cause.",
+      "evidence": "activate_with_interrupt: `Err(error) => match transaction.cancel().await { Ok(_database) => Err(error), Err(cancel_error) => Err(database_error(\"cancel_projection\", cancel_error)) }` \u2014 the `error` binding is dropped on the cancel-failure path. The workspace no-unwrap-expect-panic constraint note requires 'typed errors with actionable context'.",
+      "suggested_fix": "Chain the cancel failure into the returned error, e.g. `Err(ProjectionError::Database { stage: \"cancel_projection\", message: format!(\"{cancel_error} (after staging failure: {error})\") })`, or add a dedicated variant carrying both."
+    },
+    {
+      "severity": "WARNING",
+      "file": "docs/README.md",
+      "line": 99,
+      "claim": "The docs/README.md hunk adds a row linking `implementation/mcp-conformance-and-interop.md`, which is unrelated to the Surreal projection change, is not added anywhere in this diff, is not listed in openspec/changes/surreal-graph-projection/files.txt, and cannot be confirmed to exist in the packet's file tree \u2014 this is unrelated diff noise plus a potentially dangling documentation link.",
+      "evidence": "docs/README.md hunk adds two rows: `| [MCP conformance and interoperability](implementation/mcp-conformance-and-interop.md) | ... |` and the Surreal projection row; files.txt enumerates only the Surreal-related docs. The refinement_log iteration 3 explicitly claims the corrected packet 'isolates exact C-014 additions', and the warning constraint no-unrelated-diff-noise requires the diff to 'contain no unrelated or generated noise'.",
+      "suggested_fix": "Remove the MCP conformance row from this change (it belongs to whichever change introduces that document) or include the linked document in this change."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "crates/compass-graphdb-surreal/tests/projection.rs",
+      "line": 110,
+      "claim": "The spec scenario 'Untrusted identities ... remain data values and cannot alter the selected statement or relation family' is only exercised at plan-construction level; no engine-level test activates a repository, node, or edge identity containing SurrealQL metacharacters through a real Mem database to prove parameter binding end-to-end.",
+      "evidence": "specs/surreal-graph-projection/spec.md scenario 'Untrusted identifiers'; tests/projection.rs uses `let repository = \"repo:'; DELETE code_node; --\";` only in the pure `ProjectionPlan::from_graph` test, while every tests/mem_projection.rs case uses plain identifiers like `\"repository\"`. The ambiguity-and-negative-cases warning constraint asks for negative-case coverage at the layer where the claim is made.",
+      "suggested_fix": "Add a Mem test that activates and reads back a plan built with the injection-shaped repository ID (and/or metacharacter node IDs) and asserts an exact round trip."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "openspec/changes/surreal-graph-projection/files.txt",
+      "line": 1,
+      "claim": "files.txt omits Cargo.toml, Cargo.lock, and CHANGELOG.md even though the same change's artifact_manifest.json lists all three as sourceArtifacts and shared-file-evidence.md documents exact C-014 deltas to them, leaving the change's file inventory internally inconsistent.",
+      "evidence": ".refiner/artifacts/C-014/artifact_manifest.json sourceArtifacts includes `Cargo.toml`, `Cargo.lock`, `CHANGELOG.md`; shared-file-evidence.md describes their exact deltas; openspec/changes/surreal-graph-projection/files.txt lists neither.",
+      "suggested_fix": "Add the three shared files to files.txt (with a note that their scoped deltas live in shared-file-evidence.md) or record in files.txt why they are intentionally excluded."
+    }
+  ],
+  "sycophancy_screen": {
+    "reject_cap": 2,
+    "cap_overridden": false,
+    "cap_default": 2
+  }
+}
\ No newline at end of file
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-014/findings.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-014/findings.json
new file mode 100644
index 000000000..c63b14ca3
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-014/findings.json
@@ -0,0 +1,63 @@
+{
+  "mode": "diff",
+  "verdict": "PASS",
+  "judge_model": "k3",
+  "producer_model": "gpt-5.6-sol",
+  "isolation_mode": "rest-gateway:http://localhost:4000/v1",
+  "cross_model_check": "verified-distinct",
+  "findings": [
+    {
+      "severity": "WARNING",
+      "file": "docs/implementation/surreal-graph-projection.md",
+      "line": 38,
+      "claim": "The documented claim that the default ProjectionLimits \"admit the ratified 1,000,000-node/2,500,000-relation qualification graph\" is arithmetically incompatible with the simultaneous 1 GiB max_projected_bytes cap.",
+      "evidence": "Docs and decisions.md state: \"Defaults admit the ratified 1,000,000-node/2,500,000-relation qualification graph and cap serialized projection data at the canonical GraphDocument reader's 1 GiB bound\". projection.rs projected_bytes() counts serde_json-serialized ProjectedNode/ProjectedRelation records, each carrying a 64-hex recordKey, ~71-char generationId, ~120-150 chars of field names, and the full payload_json; even a minimal ~300-byte average per record (far below realistic payloads) makes 3.5M records exceed 1,073,741,824 bytes. Activation of the ratified graph would therefore fail with LimitExceeded on \"projected bytes\" long before the node/relation caps bind, so the two defaults cannot both hold.",
+      "suggested_fix": "Either raise max_projected_bytes to a value that genuinely admits the ratified graph (and document the derivation), or correct the docs/decisions/constraints evidence to state that the byte cap binds first and the node/relation defaults are independent ceilings, not a jointly satisfiable qualification profile."
+    },
+    {
+      "severity": "WARNING",
+      "file": "scripts/check_surreal_feature_isolation.sh",
+      "line": 14,
+      "claim": "The isolation gate regex only matches 3 of the 7 SurrealDB-family crates that deny.toml flags as BUSL-1.1, so a leak of surrealdb-protocol, surrealdb-strand, surrealdb-collections, or surrealdb-types-derive into a default dependency tree would pass the gate.",
+      "evidence": "The script greps cargo tree output with '^(surrealdb|surrealdb-core|surrealdb-types)( |$)', which requires a space or end-of-line immediately after the name and therefore cannot match 'surrealdb-protocol v0.10.2', 'surrealdb-strand v3.2.4', 'surrealdb-collections v3.2.4', or 'surrealdb-types-derive v3.2.4' \u2014 all of which deny.toml explicitly excepts as BUSL-1.1 components the gate is supposed to keep out of default closures.",
+      "suggested_fix": "Match the full SurrealDB package family, e.g. '^surrealdb[A-Za-z0-9-]* ', or enumerate all seven crates from deny.toml in the pattern."
+    },
+    {
+      "severity": "WARNING",
+      "file": "scripts/check_product_boundary.sh",
+      "line": 16,
+      "claim": "The blocking product-boundary gate now unconditionally shells out to a cargo-tree-based check, changing the failure modes and runtime cost of an unrelated blocking constraint, and the --binary mode assumes a Unix 'debug/compass' artifact path.",
+      "evidence": "The hunk adds 'sh scripts/check_surreal_feature_isolation.sh' to check_product_boundary.sh, making the 'product-boundary' blocking constraint (command: 'sh scripts/check_product_boundary.sh') fail on any cargo/lockfile resolution problem rather than only on Graphify-boundary violations; additionally check_surreal_feature_isolation.sh tests '[ -x \"$target_root/debug/compass\" ]', which never matches the Windows 'compass.exe' artifact, conflicting with the platform-portable constraint's 'no Unix-only process behavior without a guarded implementation' rule.",
+      "suggested_fix": "Keep the surreal isolation check as its own gate invoked separately (CI/orchestrator), or at minimum emit its own labeled error before exiting; guard the binary check with a compass.exe fallback or restrict --binary mode to Unix with an explicit note."
+    },
+    {
+      "severity": "WARNING",
+      "file": ".refiner/artifacts/C-014/dist/refinement-receipt.md",
+      "line": 12,
+      "claim": "The PASS receipt is self-issued under a 'fallback state contract' because the canonical refiner controllers were unavailable, yet constraints.json marks every blocking constraint PASS, so the certification evidence does not come from the mandated deterministic gate.",
+      "evidence": "The receipt states: 'The installed artifact-refiner adapter lacks its referenced canonical controllers and schema assets, so this receipt uses the repository's established deterministic fallback state contract.' The refiner-qa-evidence constraint requires per-change manifests and receipts that are deterministic and repository-owned KBD certification evidence; a fallback receipt issued without the canonical controllers weakens every 'status': 'PASS' recorded in constraints.json to a self-attestation.",
+      "suggested_fix": "Re-run certification with a working artifact-refiner controller set, or downgrade constraints.json statuses to reflect fallback attestation until the canonical gate can be executed and its output attached."
+    },
+    {
+      "severity": "WARNING",
+      "file": "openspec/changes/surreal-graph-projection/shared-file-evidence.md",
+      "line": 1,
+      "claim": "Acceptance criterion 1.1 depends on workspace wiring (Cargo.toml member entry, '=3.2.4' workspace dependency, Cargo.lock resolution, CHANGELOG entry, docs/README.md row) that is absent from the diff and asserted only by this prose evidence file, so the packet itself cannot verify the crate is actually a workspace member or that the pin resolves.",
+      "evidence": "The diff contains no Cargo.toml, Cargo.lock, CHANGELOG.md, or docs/README.md hunks; shared-file-evidence.md says these 'represent C-014's exact shared-file deltas here' as quoted snippets. If the working tree diverges from these snippets (e.g., missing '\"crates/compass-graphdb-surreal\"' in workspace members or a missing 'surrealdb = { version = \"=3.2.4\", default-features = false }' entry), crates/compass-graphdb-surreal/Cargo.toml's 'surrealdb = { workspace = true, optional = true }' and every gate command in docs/implementation/surreal-graph-projection.md fail.",
+      "suggested_fix": "Include the exact Cargo.toml/Cargo.lock/CHANGELOG hunks for C-014 lines only (git diff with path filtering or -U0 extraction) in the review packet instead of prose quotations, so reviewers can diff the claims against the real files."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "crates/compass-graphdb-surreal/src/lib.rs",
+      "line": 23,
+      "claim": "A test-only fault-injection hook (InterruptAfter, activate_with_interrupt) is exported in the crate's permanent public API, which sits uneasily with the spec's closed-surface requirement that the adapter expose 'typed projection and activation operations only'.",
+      "evidence": "lib.rs does 'pub use engine::{ActivationOutcome, InterruptAfter, SurrealProjection}' with no cfg gate, and engine.rs documents InterruptAfter as 'Test fault-injection point'; spec.md's 'Typed and bounded adapter surface' requirement restricts the public surface to typed projection/activation operations.",
+      "suggested_fix": "Gate activate_with_interrupt and InterruptAfter behind #[cfg(test)] or a non-default 'testing' cargo feature, or document the hook explicitly in spec.md as part of the sanctioned surface."
+    }
+  ],
+  "sycophancy_screen": {
+    "reject_cap": 2,
+    "cap_overridden": false,
+    "cap_default": 2
+  }
+}
\ No newline at end of file
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-016/findings.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-016/findings.json
new file mode 100644
index 000000000..60b4af058
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-016/findings.json
@@ -0,0 +1,91 @@
+{
+  "mode": "diff",
+  "verdict": "BLOCK",
+  "judge_model": "k3",
+  "producer_model": "gpt-5.6-sol",
+  "isolation_mode": "rest-gateway:http://localhost:4000/v1",
+  "cross_model_check": "verified-distinct",
+  "findings": [
+    {
+      "severity": "CRITICAL",
+      "file": "crates/compass-mcp/src/code_query.rs",
+      "line": 478,
+      "claim": "envelope() cannot compile: json! moves `response` at `\"data\": response` and then uses `response.truncated` and `response.diagnostics` later in the same macro invocation (use of moved value, E0382).",
+      "evidence": "In the new `envelope` body: `\"data\": response,` followed by `\"truncation\": {\"truncated\": response.truncated, ...},` and `\"warnings\": response.diagnostics`. serde_json's json! macro converts each interpolated expression with `to_value($other)`, which takes the value by move, so the later field accesses are uses of a moved struct. Violates blocking constraint `build-passes`.",
+      "suggested_fix": "Compute `let truncated = response.truncated;` and `let warnings = response.diagnostics.clone();` (or serialize diagnostics before the json! block) before moving `response` into `\"data\"`."
+    },
+    {
+      "severity": "CRITICAL",
+      "file": "crates/compass-cli/build.rs",
+      "line": 49,
+      "claim": "The diff adds build-time collection of `compass-focused-skills/`, tests that read `compass-focused-skills/<name>/SKILL.md` and `trigger-corpus.json`, and skillgen validation of that directory \u2014 but the diff contains none of the six skill trees, no `trigger-corpus.json`, and no OpenSpec contract files, so the build/tests have no assets to operate on.",
+      "evidence": "build.rs now collects `\"compass-focused-skills\"`; `focused_skill_trigger_corpus_has_unique_boundaries_and_umbrella_fallback` asserts `cases.len() >= 14` from `compass-focused-skills/trigger-corpus.json` (returns Value::Null \u2192 0 cases \u2192 assert fails); `install_skill_package_at_scoped` errors with 'not found in package' when `asset_text(skill_asset)` is None; `validate_focused_skills` does `fs::read_dir(root)?` on the directory. Acceptance criteria 1.1 ('Add the focused-skill OpenSpec contract and deterministic trigger corpus') and 1.2 ('Add six spec-conformant focused skill trees') have no corresponding files anywhere in the diff. Violates blocking constraints `build-passes` and `tests-pass`.",
+      "suggested_fix": "Include the `crates/compass-cli/compass-focused-skills/{six skills}/**` trees, `trigger-corpus.json`, and the `openspec/changes/focused-agent-skills/` contract artifacts in the change."
+    },
+    {
+      "severity": "CRITICAL",
+      "file": "crates/compass-cli/src/install_commands.rs",
+      "line": 2930,
+      "claim": "Focused skills can never be recognized as managed, so uninstall always preserves them: `remove_managed_focused_skills` gates removal on `is_managed_skill`, which calls `legacy_skill_is_unmodified(parent)` \u2014 and that function validates the directory's files against the umbrella's `compass-skill/` digest set, which a focused skill tree can never match.",
+      "evidence": "`legacy_skill_is_unmodified` (hunk at ~3758) builds `expected_package_digests(&format!(\"{REFERENCE_BUNDLE}/\"))`, i.e. umbrella asset digests including the umbrella SKILL.md; a focused `SKILL.md` digest differs, so `is_managed_skill(focused/SKILL.md)` is false and `remove_managed_focused_skills` hits the 'preserved unowned or modified focused skill' branch every time. The new test `every_project_platform_installs_native_content` asserts `!tree_contains_focused_skill(...)` after uninstall and `uninstall_removes_one_shared_consumer_without_breaking_another` asserts the focused dirs are gone after the last consumer \u2014 both fail. Violates acceptance criterion 2.2 ('uninstall the complete sibling collection') and blocking constraint `tests-pass`.",
+      "suggested_fix": "In `remove_managed_focused_skills`, verify each focused tree against its own `.compass-install.json` manifest via `verify_manifest(directory)` (as `update_focused_skill_consumers` already does) instead of the umbrella-digest-based `is_managed_skill`."
+    },
+    {
+      "severity": "CRITICAL",
+      "file": ".prometheus/events.jsonl",
+      "line": 4,
+      "claim": "Newly committed event records embed the contributor's absolute machine path, violating the blocking no-machine-paths constraint.",
+      "evidence": "The eight added JSONL lines all contain an absolute `project_root` for the local checkout. Constraint `no-secrets-or-machine-paths`: 'No credentials, machine-specific paths ... committed outside the repository-owned .prometheus/knowledge/wiki transcript exception' \u2014 `.prometheus/events.jsonl` is not under `.prometheus/knowledge/wiki`.",
+      "suggested_fix": "Drop the events.jsonl additions from the change, or strip/relative-ize `project_root` before committing."
+    },
+    {
+      "severity": "CRITICAL",
+      "file": "N/A",
+      "claim": "Acceptance criterion 3.2 is not satisfied: it is explicitly unchecked in the packet and no evidence of focused tests, Clippy, workspace baselines, strict OpenSpec validation, graph refresh, or adversarial review is present.",
+      "evidence": "acceptance_criteria shows `[ ] 3.2 Run focused tests, formatting, Clippy, workspace baselines, strict OpenSpec validation, graph refresh, refinement, and adversarial review.` Blocking constraint `clippy-clean`/`tests-pass` cannot be confirmed, and per findings above the workspace as diffed does not compile or pass the new installer tests.",
+      "suggested_fix": "Run and record the criterion 3.2 gates before shipping."
+    },
+    {
+      "severity": "WARNING",
+      "file": "N/A",
+      "claim": "The diff for the 'focused-agent-skills' change bundles the entire C-001..C-010 wave (snapshot streaming, COMPASS_MAX_GRAPH_BYTES, preflight estimation, compass-partition extraction, rmcp 3.1.4 upgrade, stateless MCP HTTP, result envelope), CI workflow changes, AGENTS.md/CLAUDE.md managed blocks, and .kbd-orchestrator/.prometheus state \u2014 far outside the change's acceptance criteria.",
+      "evidence": "Warning constraint `no-unrelated-diff-noise`: 'git diff and git status --short contain no unrelated or generated noise'. The acceptance criteria cover only focused skills + installer + verification, yet the diff touches ~60 files across a dozen crates, docs, workflows, and orchestrator state.",
+      "suggested_fix": "Split the wave work into its own changes per the phase plan (C-001..C-010 each has its own OpenSpec name) and keep this diff to C-016 files only."
+    },
+    {
+      "severity": "WARNING",
+      "file": ".kbd-orchestrator/current-waypoint.md",
+      "claim": "Orchestrator state files contradict each other: progress.json marks C-001 through C-009 as DONE/COMPLETE (9/20) while current-waypoint.md says 'Implementation: 0/20' with 'Next pending change: C-001', and decision-log.md says C-001 is an uncommitted draft with remaining work.",
+      "evidence": "progress.json: `\"implementation_completed\": 9`, C-001 `\"status\": \"DONE\"`, `\"tasks_done\": 5`. current-waypoint.md: `**Implementation:** 0/20`, `Next pending change: C-001`. decision-log.md 2026-08-28: 'Remaining C-001 work is unchanged: reimplement validate_snapshot/snapshot_reference...'.",
+      "suggested_fix": "Reconcile the ledger: regenerate progress.json/waypoint from one source of truth so DONE markers reflect reality."
+    },
+    {
+      "severity": "WARNING",
+      "file": ".codex/skills/openspec-apply-change/SKILL.md",
+      "claim": "All `.codex/skills/openspec-*` and `.kimi/skills/openspec-*` skill files are deleted with no replacement, while the `.claude` and `.opencode` copies are updated to generatedBy 1.10.0 \u2014 Codex and Kimi harnesses lose the OpenSpec skills entirely in this change.",
+      "evidence": "16 deleted files under `.codex/skills/` and `.kimi/skills/`; the matching `.claude/skills/*` and `.opencode/skills/*` files are modified, not deleted. Nothing in the acceptance criteria covers removing those harnesses' skills, and E6 (native harness packages) is a future wave per plan.md.",
+      "suggested_fix": "Either keep the Codex/Kimi skill copies in sync with the 1.10.0 content or record the removal as an explicit, documented decision in the change."
+    },
+    {
+      "severity": "WARNING",
+      "file": "crates/compass-core/src/pipeline.rs",
+      "line": 84,
+      "claim": "The new preflight rejects any build whose total admitted source bytes \u00d7 60 exceeds the graph cap, which can fail-fast builds whose actual canonical graph would have been under 2 GiB \u2014 the 60x factor is calibrated on a single fixture and there is no escape except raising COMPASS_MAX_GRAPH_BYTES (which weakens the real cap).",
+      "evidence": "`PREFLIGHT_GRAPH_BYTES_PER_SOURCE_BYTE: u64 = 60` with comment 'Calibrated on the C-003 deterministic fixture: 112,893 source bytes produced 6,843,452 canonical bytes (60.62x)'; `enforce_preflight_graph_size` returns `SnapshotError::canonical_graph_too_large` before extraction. A repository with ~34 MB of in-scope sources (e.g., 2,000 \u00d7 17 KB markdown) is rejected pre-extraction even though its real graph may be far smaller.",
+      "suggested_fix": "Emit a progressive warning at the estimate and fail only on measured payload growth, or gate the hard failure behind a conservative confidence bound documented in the change's design doc."
+    },
+    {
+      "severity": "WARNING",
+      "file": ".kbd-orchestrator/phases/compass-scoping-and-bounds/progress.json",
+      "line": 2,
+      "claim": "progress.json schema regresses: `schemaVersion` changes from \"5\" to \"2\" and `children` changes type from array (`[]`) to object (`{}`), which may break consumers written against the v5 shape.",
+      "evidence": "Diff shows `\"schemaVersion\": \"5\"` \u2192 `\"schemaVersion\": \"2\"` and `\"children\": []` \u2192 `\"children\": {}`.",
+      "suggested_fix": "Confirm the kbd-runtime writer and all readers agree on the v2 shape, or keep schemaVersion/children compatible with the previous schema."
+    }
+  ],
+  "sycophancy_screen": {
+    "reject_cap": 2,
+    "cap_overridden": false,
+    "cap_default": 2
+  }
+}
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-016/findings.round2.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-016/findings.round2.json
new file mode 100644
index 000000000..ef53cc1d1
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-016/findings.round2.json
@@ -0,0 +1,55 @@
+{
+  "mode": "diff",
+  "verdict": "BLOCK",
+  "judge_model": "k3",
+  "producer_model": "gpt-5.6-sol",
+  "isolation_mode": "rest-gateway:http://localhost:4000/v1",
+  "cross_model_check": "verified-distinct",
+  "findings": [
+    {
+      "severity": "CRITICAL",
+      "file": "crates/compass-cli/src/install_commands.rs",
+      "line": 2975,
+      "claim": "Uninstall never removes focused skills: remove_managed_focused_skills gates deletion on is_managed_skill(), which delegates to legacy_skill_is_unmodified(), and that function builds its expected digest map exclusively from the umbrella `compass-skill/` bundle (REFERENCE_BUNDLE/SKILL_ASSET), so every focused directory fails the comparison and is always reported as 'preserved unowned or modified focused skill'.",
+      "evidence": "New code: `if !is_managed_skill(&destination) { lines.push(\"preserved unowned or modified focused skill ...\"); continue; }` in remove_managed_focused_skills, combined with the unchanged `is_managed_skill` body (`parent.join(\".compass_version\").is_file() && legacy_skill_is_unmodified(parent)`) and the modified `legacy_skill_is_unmodified` which still hardcodes `asset_text(SKILL_ASSET)` and `expected_package_digests(&format!(\"{REFERENCE_BUNDLE}/\"))`. A focused dir's SKILL.md digest can never equal the umbrella SKILL.md digest, and the focused dir lacks the umbrella references/agents entries. This violates the spec scenario 'Last consumer uninstall removes focused trees' (openspec/changes/focused-agent-skills/specs/focused-agent-skills/spec.md) and contradicts the diff's own tests `every_project_platform_installs_native_content` (asserts `!tree_contains_focused_skill` after uninstall) and `uninstall_removes_one_shared_consumer_without_breaking_another` (asserts each focused dir `!exists()`). Task 3.2 (running the tests) is unchecked, consistent with this escaping.",
+      "suggested_fix": "In remove_managed_focused_skills, replace the is_managed_skill gate with verify_manifest(directory) (checksum verification against the directory's own .compass-install.json, as update_focused_skill_consumers already does), or parameterize legacy_skill_is_unmodified by asset prefix/SKILL_ASSET so each focused tree is compared against its own embedded package."
+    },
+    {
+      "severity": "WARNING",
+      "file": "CHANGELOG.md",
+      "line": 5,
+      "claim": "The diff documents numerous features that are not part of this change (MCP `compass.code_context.v1` envelope, stateless MCP 2026-07-28 HTTP contract, rmcp 3.1.4 upgrade, compass-partition crate, COMPASS_MAX_GRAPH_BYTES handling, canonical graph-size preflight, SQLite chunk-streaming reads) in CHANGELOG.md, COMPATIBILITY.md, and docs/reference/commands.md (`compass serve` section), none of which have any implementing code in this diff.",
+      "evidence": "CHANGELOG.md adds eight entries before the relevance-matrix entry, only the first of which (focused Agent Skills) corresponds to any code in the diff; COMPATIBILITY.md adds 'MCP HTTP compatibility' and 'MCP structured result compatibility' sections; docs/reference/commands.md adds `--session-timeout` deprecation and stateless-HTTP contract text to `compass serve`. The constraint `no-unrelated-diff-noise` states 'git diff and git status --short contain no unrelated or generated noise', and these entries assert shipped user-visible behavior with no supporting change here, which also makes the compatibility documentation inaccurate for this delta.",
+      "suggested_fix": "Restrict this change's doc entries to the focused-agent-skills surface; land the MCP/partition/graph-bytes/SQLite entries with the diffs that actually implement them."
+    },
+    {
+      "severity": "WARNING",
+      "file": "tools/skillgen/mod.rs",
+      "line": 231,
+      "claim": "The Windows absolute-path marker in validate_portable_paths decodes to `C:\\\\` (two literal backslashes), which is never a substring of a normal single-backslash Windows path like `C:\\repo\\file`, so the 'no absolute filesystem paths' validation does not fire for the most common Windows path form.",
+      "evidence": "`for forbidden in [\"/Users/\", \"/home/\", \"file://\", \"C:\\\\\\\\\", \"C:/\"]` \u2014 as written the literal is C: followed by two backslashes; the spec requirement 'Portable complete skill trees' says focused content 'MUST contain no absolute filesystem paths' and the scenario 'Invalid portable content is rejected' requires validation to fail on absolute paths.",
+      "suggested_fix": "Use a single-backslash literal (`\"C:\\\\\"` in Rust source) or, more robustly, reject any `[A-Za-z]:[\\\\/]` prefix pattern and UNC `\\\\` prefixes."
+    },
+    {
+      "severity": "WARNING",
+      "file": "crates/compass-cli/Cargo.toml",
+      "line": 63,
+      "claim": "A new build-dependency (`sha2.workspace = true`) is added to compass-cli without any accompanying Cargo.lock change in the diff; if sha2 was not already a dependency edge of the compass-cli package, all `--locked` build/test/lint commands fail.",
+      "evidence": "The diff adds `[build-dependencies] sha2.workspace = true` but contains no Cargo.lock hunk; the blocking constraint `locked-dependencies` requires 'Build and test commands use --locked; Cargo.lock is updated when dependency resolution changes'. This is safe only if sha2 already appears in compass-cli's locked dependency set (e.g., backing the pre-existing digest_bytes), which cannot be confirmed from the packet.",
+      "suggested_fix": "Verify `cargo metadata --locked` succeeds and include the Cargo.lock update in the change if the lock's compass-cli dependency edges change."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "crates/compass-cli/src/install_commands.rs",
+      "line": 543,
+      "claim": "The install error path now unconditionally calls restore_transaction, removing the previous guard that skipped rollback when staging failed before any installed package was modified; this rewrites a healthy installed tree from snapshots (and changes the rollback message) even for pre-mutation failures such as a missing embedded asset.",
+      "evidence": "Old code: `let rollback = if error.contains(\"could not restore previous package\") { restore_transaction(...) } else { \"package staging or activation failed before changing the installed package\".to_owned() };` replaced by `let rollback = restore_transaction(&skill_snapshot, &adapter_snapshots);`. Collection-wide restore is needed for partial mid-collection installs, but not for errors raised before any destination changed.",
+      "suggested_fix": "Keep collection-wide restore for activation/partial-install failures, but retain the pre-mutation fast path (no restore, explicit 'no installed files changed' message) for errors that occur during staging before any rename."
+    }
+  ],
+  "sycophancy_screen": {
+    "reject_cap": 2,
+    "cap_overridden": false,
+    "cap_default": 2
+  }
+}
\ No newline at end of file
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-016/findings.round3.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-016/findings.round3.json
new file mode 100644
index 000000000..90f9458b1
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-016/findings.round3.json
@@ -0,0 +1,39 @@
+{
+  "mode": "diff",
+  "verdict": "PASS",
+  "judge_model": "k3",
+  "producer_model": "gpt-5.6-sol",
+  "isolation_mode": "rest-gateway:http://localhost:4000/v1",
+  "cross_model_check": "verified-distinct",
+  "findings": [
+    {
+      "severity": "WARNING",
+      "file": "CHANGELOG.md",
+      "line": 5,
+      "claim": "The diff for the focused-agent-skills target contains substantial unrelated content (MCP 2026-07-28 stateless HTTP contract, rmcp 3.1.4 upgrade, compass-partition extraction, COMPASS_MAX_GRAPH_BYTES, chunk-streaming reads), breaching the no-unrelated-diff-noise constraint.",
+      "evidence": "Constraint: 'git diff and git status --short contain no unrelated or generated noise'. The packet target is 'focused-agent-skills', yet the CHANGELOG hunk adds eight entries with no relation to skills, COMPATIBILITY.md gains entire 'MCP HTTP compatibility' and 'MCP structured result compatibility' sections, and docs/reference/commands.md gains a `compass serve` paragraph about `--session-timeout` deprecation. verification.md itself admits prior packets were 'repository-wide cumulative diff'; this packet still carries those cumulative hunks.",
+      "suggested_fix": "Split the MCP, partition, and graph-size doc/changelog hunks into their own changes so this diff contains only focused-agent-skills content."
+    },
+    {
+      "severity": "WARNING",
+      "file": "crates/compass-cli/src/install_commands.rs",
+      "line": 543,
+      "claim": "Acceptance criterion 3.1 is checked complete and claims 'rollback regressions' were added, but the diff contains no test that injects a mid-install failure and verifies the full seven-skill collection is restored, even though the rollback path was materially changed (conditional restore replaced by unconditional restore_transaction over the new SkillCollectionSnapshot).",
+      "evidence": "tasks.md 3.1: '[x] Add trigger-discrimination, complete-tree, checksum, idempotence, multi-consumer, conflict, and rollback regressions.' The new tests in the diff are the trigger-corpus unit test, install_preflights_unowned_focused_skill_before_mutation (fails before any mutation, so it exercises no rollback), and uninstall_preserves_a_modified_focused_skill. Meanwhile execute_skill_target now calls restore_transaction unconditionally on install_skill_at_scoped failure ('let rollback = restore_transaction(&skill_snapshot, &adapter_snapshots);'), replacing the prior conditional that skipped restore when staging failed before mutation \u2014 exactly the behavior a rollback regression should pin down.",
+      "suggested_fix": "Add a test that forces install_skill_package_at_scoped to fail after at least one sibling has been activated (e.g., via an unwritable focused destination that passes preflight or a fault-injecting hook) and asserts all seven destinations and adapter files are byte-identical to their pre-install state; or uncheck 3.1."
+    },
+    {
+      "severity": "WARNING",
+      "file": "tools/skillgen/mod.rs",
+      "line": 234,
+      "claim": "contains_windows_absolute_path matches URI schemes, so any future 'https://' or 'http://' link in a focused skill will fail the release build misreported as an absolute Windows path.",
+      "evidence": "The check is `window[0].is_ascii_alphabetic() && window[1] == b':' && matches!(window[2], b'\\\\' | b'/')`; in \"https://example.com\" the window ['s', ':', '/'] satisfies all three conditions. validate_portable_paths runs this over every focused SKILL.md body, and compass-mcp-setup is precisely the skill most likely to gain a documentation URL later. The build gate would then fail with 'focused skill contains an absolute Windows path marker', a misleading diagnostic.",
+      "suggested_fix": "Exclude the '://' form (e.g., require the character before the drive letter to be absent or non-alphanumeric, or reject only when window[2] == b'\\\\' or the colon is not followed by '//'), and add a unit case asserting contains_windows_absolute_path(\"https://example.com\") is false."
+    }
+  ],
+  "sycophancy_screen": {
+    "reject_cap": 2,
+    "cap_overridden": false,
+    "cap_default": 2
+  }
+}
\ No newline at end of file
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-017/findings.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-017/findings.json
new file mode 100644
index 000000000..6e5278666
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-017/findings.json
@@ -0,0 +1,50 @@
+{
+  "mode": "diff",
+  "verdict": "PASS",
+  "judge_model": "k3",
+  "producer_model": "gpt-5.6-sol",
+  "isolation_mode": "rest-gateway:http://localhost:4000/v1",
+  "cross_model_check": "verified-distinct",
+  "findings": [
+    {
+      "severity": "WARNING",
+      "file": "crates/compass-cli/src/agent_commands.rs",
+      "claim": "When graph.json resolves and exists but manifest.json is missing or unloadable, doctor misattributes the Manifest::load failure to source detection, reporting \"source detection failed: {error}\" even though detect() succeeded or never ran \u2014 a health-check tool whose purpose is accurate diagnosis emits a wrong cause.",
+      "evidence": "In doctor(): `let freshness = detect(root, &DetectOptions {...}).map(|detection| Manifest::load(&manifest_path, Some(root)).is_unchanged(&detection.files, ManifestKind::Ast));` followed by `Err(error) => fail_check(\"graph_freshness\", format!(\"source detection failed: {error}\"))`. The Manifest::load error is funneled into the same Err arm as a detect() failure.",
+      "suggested_fix": "Match on detect() and Manifest::load() separately so a missing/corrupt manifest produces a distinct \"could not load graph manifest\" detail (or a dedicated manifest_presence check), keeping load failure distinct from detection failure."
+    },
+    {
+      "severity": "WARNING",
+      "file": "crates/compass-cli/src/agent_commands.rs",
+      "claim": "Bundle/MCP-config file reads reject symlinks via entry.file_type()/symlink_metadata and then open the path in a separate syscall, so a writer with access to the bundle directory can swap a verified regular file for a symlink between the check and File::open, defeating the documented symlink-rejection guarantee for content that is then hashed and credential-scanned.",
+      "evidence": "collect_files_bounded_with_limits: `if file_type.is_symlink() { return Err(...) }` then later `let bytes = read_file_with_limit(&path, limit)` which does `fs::File::open(path)` with no O_NOFOLLOW; SECURITY.md excerpt added in this diff states validate \"rejects symlinks\" while treating bundles as untrusted.",
+      "suggested_fix": "Open with O_NOFOLLOW (std::os::unix::fs::OpenOptionsExt::custom_flags / equivalent guarded Windows handling) or verify symlink_metadata on the opened file handle, so the symlink check and the read are the same object."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "crates/compass-cli/src/agent_commands.rs",
+      "claim": "`--project=`/`--user=` (and `--project-root=`/`--user-root=`) with an explicitly empty value are silently accepted as an empty root path, while the space-separated forms error on a missing value, yielding an inconsistent boundary and a doctor run against \"\" instead of a usage error.",
+      "evidence": "parse_doctor_options: `root = PathBuf::from(value.split_once('=').map_or(\"\", |(_, value)| value));` \u2014 for `--project-root=` this produces PathBuf::from(\"\") with no error, unlike `required_value` which returns \"error: --project-root requires a value\".",
+      "suggested_fix": "Route the `=` forms through the same non-empty validation: `let v = value.split_once('=').map_or(\"\", |(_, v)| v); if v.is_empty() { return Err(...) }`."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "crates/compass-cli/src/agent_commands.rs",
+      "claim": "`compass agent validate --platform <NAME>` silently ignores the platform requirement for managed-install bundles, even though the help text says the option \"Require[s] a matching exported platform\" without qualification.",
+      "evidence": "validate_path: `if root.join(\"manifest.json\").is_file() { validate_export_bundle(root, expected_platform) } else if root.join(\".compass-install.json\").is_file() { validate_managed_bundle(root) }` \u2014 expected_platform is dropped on the managed path; help.rs page for \"agent validate\" documents `--platform <NAME>  Require a matching exported platform`.",
+      "suggested_fix": "Either reject --platform when the target is a managed install, or document that the option applies only to exported bundles."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "crates/compass-cli/tests/install_cli.rs",
+      "claim": "normalize_manifest_roots re-serializes both manifests through serde_json::to_vec_pretty before comparison, so byte-level differences in formatting or key ordering between direct and generic installs are normalized away and can no longer be detected by the byte-identical tree assertion.",
+      "evidence": "`let mut manifest: serde_json::Value = serde_json::from_slice(bytes)?; manifest[\"root\"] = ...; *bytes = serde_json::to_vec_pretty(&manifest)?;` applied to both trees before `assert_eq!(generic_tree, direct_tree)`.",
+      "suggested_fix": "Compare the parsed serde_json::Value of the manifests (with root normalized) for semantic equality, and separately compare raw bytes after a targeted byte-level replacement of the known root string, so formatting drift still fails the test."
+    }
+  ],
+  "sycophancy_screen": {
+    "reject_cap": 2,
+    "cap_overridden": false,
+    "cap_default": 2
+  }
+}
\ No newline at end of file
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-018/findings.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-018/findings.json
new file mode 100644
index 000000000..982f97af7
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-018/findings.json
@@ -0,0 +1,63 @@
+{
+  "mode": "diff",
+  "verdict": "PASS",
+  "judge_model": "k3",
+  "producer_model": "gpt-5.6-sol",
+  "isolation_mode": "rest-gateway:http://localhost:4000/v1",
+  "cross_model_check": "verified-distinct",
+  "findings": [
+    {
+      "severity": "WARNING",
+      "file": "crates/compass-cli/src/distribution.rs",
+      "line": 115,
+      "claim": "distribution.rs introduces a `toml` crate dependency (`toml::from_str::<DistributionInventory>`) but the diff contains no `crates/compass-cli/Cargo.toml`, root `Cargo.toml`, `Cargo.lock`, or `build.rs` hunks even though `openspec/changes/distribution-inventory-generators/files.txt` declares all four as changed \u2014 if `toml` is not already a direct dependency of compass-cli, the build-passes and locked-dependencies blocking constraints fail.",
+      "evidence": "distribution.rs `load_inventory()` calls `toml::from_str`; files.txt lists `Cargo.toml`, `Cargo.lock`, `crates/compass-cli/Cargo.toml`, and `crates/compass-cli/build.rs` but none of those files appear in the diff.",
+      "suggested_fix": "Include the manifest hunks adding `toml` via `{ workspace = true }` (or drop the build.rs/files.txt entries if the embedded include_str! approach made them unnecessary), and regenerate Cargo.lock with --locked."
+    },
+    {
+      "severity": "WARNING",
+      "file": "crates/compass-cli/src/agent_commands.rs",
+      "line": 1627,
+      "claim": "The diff deletes the entire inline test module (~15 tests covering doctor freshness/stale detection, symlink rejection, snapshot-selector escape, doctor scope conflicts, portability/credential rules, bounded collection, and manifest transport validation) while adding only one integration test, leaving those behaviors \u2014 and new behaviors like the `--platform`-on-managed-bundle rejection and `inline_option_value` \u2014 with no visible coverage at any level.",
+      "evidence": "The removed `#[cfg(test)] mod tests` block (tests `doctor_reports_healthy_stale_and_bad_checksum_states`, `validation_rejects_symbolic_links`, `doctor_fails_closed_on_invalid_snapshot_selector`, `doctor_scope_options_distinguish_duplicates_and_conflicts`, `portability_rules_reject_paths_and_secrets_but_allow_https`, etc.) versus a single added integration test `generic_agents_export_uses_the_doctor_configuration_path` in tests/agent_cli.rs; constraint `regression-test-present` requires integration coverage at the lowest public boundary for behavior changes, and `ambiguity-and-negative-cases` requires negative-case coverage.",
+      "suggested_fix": "Port the deleted behavior assertions (stale graph, corrupt checksums, symlink rejection, unsafe manifest path, transport mismatch, scope conflicts, new managed-bundle --platform rejection) into crates/compass-cli/tests/agent_cli.rs as integration tests."
+    },
+    {
+      "severity": "WARNING",
+      "file": "crates/compass-cli/src/agent_commands.rs",
+      "line": 1563,
+      "claim": "User-visible export layout changes (codex `mcp/codex.toml` \u2192 `.mcp.json` JSON, claude `mcp/claude.json` \u2192 `.mcp.json`, opencode `mcp/opencode.json` \u2192 `opencode.json`, agents `mcp/agents.json` \u2192 `.agents/mcp.json`) and the new mandatory `harness_version`/native-artifact requirements mean previously exported bundles now fail validation, yet the diff contains no MIGRATION.md note or CHANGELOG.md entry.",
+      "evidence": "`bundle_config_path` rewrite and `validate_native_package_files` requiring artifacts/`harness_version` that old bundles lack; constraint `compatibility-documented`: 'Incompatible user-visible changes include regression coverage, updated reference docs, a MIGRATION.md note when users must act, and a CHANGELOG.md entry when release-visible' \u2014 output files are explicitly listed as compatibility-sensitive.",
+      "suggested_fix": "Add a MIGRATION.md note describing the new bundle layout and validation requirements, and a CHANGELOG.md entry for the release-visible export format change."
+    },
+    {
+      "severity": "WARNING",
+      "file": "tools/skillgen/mod.rs",
+      "line": 263,
+      "claim": "`contains_windows_absolute_path` rejects any occurrence of a double backslash (`body.contains(r\"\\\\\")`), which is far broader than the previous targeted `C:\\\\` check and will false-positive on legitimate skill content such as regex escapes (`\\\\d`), JSON/string escape examples, or LaTeX line breaks, failing validation for previously valid skills.",
+      "evidence": "Old check: `for forbidden in [\"/Users/\", \"/home/\", \"file://\", \"C:\\\\\\\\\", \"C:/\"]`; new code adds `|| body.contains(r\"\\\\\")` to `contains_windows_absolute_path`, flagging any `\\` pair anywhere in the body regardless of whether it denotes a path.",
+      "suggested_fix": "Restrict the double-backslash check to UNC-style prefixes (e.g., `\\\\` at a token boundary followed by a non-space) instead of rejecting every escaped backslash pair."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "crates/compass-cli/src/agent_commands.rs",
+      "line": 1527,
+      "claim": "The non-Unix `opened_file_matches_path` fallback only compares file_type, length, and mtime, so a swapped-in replacement file with identical size and timestamp passes the TOCTOU check, giving false assurance on Windows/macOS.",
+      "evidence": "`#[cfg(not(unix))] fn opened_file_matches_path` returns `opened.file_type() == current.file_type() && opened.len() == current.len() && opened.modified().ok() == current.modified().ok()`.",
+      "suggested_fix": "Document the fallback as best-effort, or use a stronger identity check (e.g., opening with exclusive/no-follow semantics via OpenOptions on platforms that support it) instead of len+mtime equality."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "crates/compass-cli/src/distribution.rs",
+      "line": 262,
+      "claim": "`mcp_config` hardcodes `\"plugin\": [\"@compass/opencode-plugin\"]` instead of using the inventory's `npm_name`, so changing `npm_name` in distribution.toml silently produces a package.json and opencode.json that reference different plugin names.",
+      "evidence": "`harness.opencode` defines `npm_name = \"@compass/opencode-plugin\"` used by `opencode_manifest`, but `mcp_config` emits the literal string; `load_inventory` performs no cross-field consistency check between the two.",
+      "suggested_fix": "Pass the harness inventory (or npm_name) into `mcp_config`, or validate in `load_inventory` that the generated opencode.json plugin entry matches `npm_name`."
+    }
+  ],
+  "sycophancy_screen": {
+    "reject_cap": 2,
+    "cap_overridden": false,
+    "cap_default": 2
+  }
+}
\ No newline at end of file
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-018/findings.round1.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-018/findings.round1.json
new file mode 100644
index 000000000..59dbb6fc3
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-018/findings.round1.json
@@ -0,0 +1,112 @@
+{
+  "mode": "diff",
+  "verdict": "BLOCK",
+  "judge_model": "k3",
+  "producer_model": "gpt-5.6-sol",
+  "isolation_mode": "rest-gateway:http://localhost:4000/v1",
+  "cross_model_check": "verified-distinct",
+  "findings": [
+    {
+      "severity": "CRITICAL",
+      "file": "Cargo.toml",
+      "claim": "Dependency resolution changes (rmcp 2.2.0\u2192=3.1.4, new surrealdb =3.2.4, http-body-util, compass-partition workspace dep, two new workspace members, sha2 build-dep) ship without a Cargo.lock update in the diff, so all --locked build/test commands will fail.",
+      "evidence": "Constraint locked-dependencies (blocking): 'Build and test commands use --locked; Cargo.lock is updated when dependency resolution changes'. The diff modifies [workspace.dependencies] and members but contains no Cargo.lock hunk, even though files.txt lists Cargo.lock as part of the change. Likewise packages/compass-opencode/package.json adds @opencode-ai/plugin, typescript, and vitest with no package-lock.json hunk, breaking `npm ci` required by js-surface-verified.",
+      "suggested_fix": "Regenerate and commit Cargo.lock and package-lock.json for the new/changed dependencies, or drop the unrelated dependency changes from this phase."
+    },
+    {
+      "severity": "CRITICAL",
+      "file": "Cargo.toml",
+      "claim": "rmcp is bumped across a major version (2.2.0 \u2192 =3.1.4) with zero corresponding changes to compass-mcp source, which almost certainly breaks compilation and the MCP conformance surface, and is unrelated to this phase's acceptance criteria.",
+      "evidence": "Cargo.toml hunk: `-rmcp = { version = \"2.2.0\", ... }` \u2192 `+rmcp = { version = \"=3.1.4\", ... }`; the diff touches no files under crates/compass-mcp. Constraints build-passes (blocking) and no-unrelated-diff-noise ('git diff ... contain no unrelated or generated noise'). Nothing in the acceptance criteria (distribution inventory/generators) requires an MCP SDK upgrade.",
+      "suggested_fix": "Revert the rmcp bump in this phase, or include the compass-mcp migration, lockfile update, and MCP conformance gate evidence."
+    },
+    {
+      "severity": "CRITICAL",
+      "file": "crates/compass-cli/src/lib.rs",
+      "claim": "The MCP HTTP server default is changed from stateful (stateless=false, 3600s session timeout) to stateless with no integration coverage, no MIGRATION.md note, and no CHANGELOG.md entry for an incompatible user-visible behavior change.",
+      "evidence": "lib.rs hunk: `-let mut stateless = false; -let mut session_timeout = Some(Duration::from_secs(3600));` \u2192 `+let mut stateless = true; +let session_timeout = None;`. Constraint regression-test-present (blocking): 'Behavior changes require full integration coverage at the lowest public boundary'; compatibility-documented (warning): incompatible CLI/env behavior changes require 'regression coverage, updated reference docs, a MIGRATION.md note ... and a CHANGELOG.md entry'. The diff adds no serve/stateless test and no MIGRATION.md/CHANGELOG.md hunks.",
+      "suggested_fix": "Add integration coverage at the compass serve boundary for the new stateless default, document the incompatibility in MIGRATION.md and CHANGELOG.md, or split this change out of the distribution phase."
+    },
+    {
+      "severity": "WARNING",
+      "file": "crates/compass-cli/src/agent_commands.rs",
+      "line": 330,
+      "claim": "`agent doctor --user` is parsed as requiring a value, so a bare `--user` flag silently consumes the next token (even another flag such as `--format`) as the root path, and it is inconsistent with `agent install --user` being a boolean scope flag in the same CLI.",
+      "evidence": "parse_doctor_options: `\"--user\" | \"--user-root\" => { ... index += 1; root = PathBuf::from(required_value(args, index, args[index - 1].as_str())?); user = true; ... }` \u2014 required_value does not reject flag-like values, and the test file shows `agent install --platform codex --project` using scope flags boolean-style.",
+      "suggested_fix": "Make `--user` a boolean flag and `--user-root <PATH>` the valued form, and reject values beginning with '-' in required_value."
+    },
+    {
+      "severity": "WARNING",
+      "file": "crates/compass-cli/src/agent_commands.rs",
+      "line": 700,
+      "claim": "Export fails closed on false positives: scan_portability/contains_literal_credential run over every embedded skill document at export time with a much broader absolute-path list (/usr, /tmp, /var, /etc, /bin, ...) and a narrow credential-placeholder whitelist than the skill generator's own validator, so any skill doc legitimately mentioning e.g. `/usr/local/bin` or showing an `api_key` example makes `agent export` fail.",
+      "evidence": "agent_commands.rs contains_absolute_path UNIX_ROOTS list vs tools/skillgen/mod.rs validate_portable_paths which only forbids \"/Users/\", \"/home/\", \"file://\" and Windows drive paths; contains_literal_credential's is_credential_placeholder accepts only your_/your-/env:/${VAR}/<placeholder> forms. export_bundle aborts (`staged agent bundle failed validation`) on any finding. The two validators disagree, so content that passes skillgen can fail export.",
+      "suggested_fix": "Align the export-time portability/credential scan with the skillgen validator (single shared rule set), or scope strict scanning to generated files rather than reviewed, checked-in skill content."
+    },
+    {
+      "severity": "WARNING",
+      "file": "crates/compass-cli/src/agent_commands.rs",
+      "line": 1005,
+      "claim": "Doctor and export disagree on where the 'agents' platform MCP config lives: export writes `mcp/agents.json` while doctor only looks for `.agents/mcp.json`, so doctor can never validate the config shape the tool itself generates for that platform.",
+      "evidence": "bundle_config_path: `_ => \"mcp/agents.json\"`; locate_mcp_config: `\"agents\" => &[\".agents/mcp.json\"]`.",
+      "suggested_fix": "Unify the canonical config path per platform across bundle_config_path, install_commands, and locate_mcp_config, or have doctor accept the exported location."
+    },
+    {
+      "severity": "WARNING",
+      "file": "crates/compass-cli/src/agent_commands.rs",
+      "line": 1040,
+      "claim": "Doctor and bundle validation hard-require the MCP URL to be exactly http://127.0.0.1:8080/mcp, so a fully working user configuration on a custom --host/--port is reported as a failing check (healthy=false, exit 1).",
+      "evidence": "validate_mcp_config_bytes: `let url_is_compass = entry.get(\"url\").and_then(Value::as_str) == Some(MCP_HTTP_URL);` with `MCP_HTTP_URL: &str = \"http://127.0.0.1:8080/mcp\"`, while `compass serve` accepts --host/--port per mcp_help().",
+      "suggested_fix": "Accept any loopback http(s) MCP URL with path /mcp in validation, or record the configured endpoint at install time and validate against it."
+    },
+    {
+      "severity": "WARNING",
+      "file": "crates/compass-cli/src/distribution.rs",
+      "line": 305,
+      "claim": "The OpenCode JavaScript artifact is produced by a hand-rolled string-replacement 'TypeScript stripper' guarded only by two sentinel substrings; any other TypeScript-only syntax added to src/index.ts (parameter types, interfaces, enums, `as` casts) would be silently copied into the shipped src/index.js as invalid JavaScript.",
+      "evidence": "opencode_runtime_source() only replaces TYPED_IMPORT\u2192RUNTIME_IMPORT and TYPED_EXPORT\u2192RUNTIME_EXPORT; spec scenario requires 'JavaScript artifact generated from the checked TypeScript plugin source', and constraint safe-primitives-reused warns against reimplementing weaker local variants of existing tooling (the workspace already has tsc via packages/compass-opencode's typecheck script).",
+      "suggested_fix": "Generate src/index.js with the real TypeScript compiler (or esbuild) in a checked build step and have the CLI consume the compiled artifact, failing if it is stale."
+    },
+    {
+      "severity": "WARNING",
+      "file": "crates/compass-cli/Cargo.toml",
+      "claim": "sha2 is added as a compass-cli build-dependency but the build.rs hunk shows no sha2 usage, while the actual new sha2 consumer is tools/skillgen/mod.rs, whose manifest is not updated in the diff \u2014 either a dead dependency in compass-cli or a missing dependency that breaks the skillgen build.",
+      "evidence": "compass-cli/Cargo.toml hunk adds `[build-dependencies] sha2.workspace = true`; the build.rs hunk only adds \"compass-focused-skills\" to a directory list. tools/skillgen/mod.rs hunk adds `use sha2::{Digest, Sha256};` with no accompanying manifest change.",
+      "suggested_fix": "Move the sha2 dependency to the crate that actually uses it (the skillgen tool's manifest) and remove it from compass-cli build-dependencies unless build.rs uses it."
+    },
+    {
+      "severity": "WARNING",
+      "file": "Cargo.toml",
+      "claim": "The diff carries multiple changes unrelated to the distribution-inventory acceptance criteria: new workspace members compass-graphdb-surreal and compass-partition, new surrealdb/http-body-util workspace dependencies, dev/test/debugging profile reconfiguration, and an unrelated neo4j export --password validation change in compass-cli.",
+      "evidence": "Constraint no-unrelated-diff-noise (warning): 'git diff and git status --short contain no unrelated or generated noise'. Acceptance criteria cover only the inventory, generators, validation, docs, and OpenCode plugin; the lib.rs hunk `+if format == \"neo4j\" && push_uri.is_some() && push_password.is_none()` and the Cargo.toml member/profile additions serve other phases. Adding compass-graphdb-surreal to default workspace members also appears to conflict with scripts/check_surreal_feature_isolation.sh's purpose.",
+      "suggested_fix": "Split the surreal/partition workspace wiring, profile tuning, and neo4j validation into their own changes with their own evidence."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "distribution.toml",
+      "claim": "The inventory hardcodes package version \"0.3.7\" that must byte-match CARGO_PKG_VERSION, so every version bump silently breaks `agent export` until a human edits distribution.toml.",
+      "evidence": "distribution.toml `[package] version = \"0.3.7\"`; distribution.rs load_inventory: `if inventory.package.name != \"compass\" || inventory.package.version != env!(\"CARGO_PKG_VERSION\") { return Err(...) }`.",
+      "suggested_fix": "Generate the version line of distribution.toml from the workspace version in a checked script, or drop the version field from the inventory and always use CARGO_PKG_VERSION."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "crates/compass-cli/src/lib.rs",
+      "claim": "The --session-timeout deprecation warning is only emitted for --transport http; with stdio the flag is validated then silently discarded with no warning.",
+      "evidence": "run_mcp hunk: `if options.session_timeout_used && options.transport == \"http\" { ... SESSION_TIMEOUT_DEPRECATION ... }` while parse_mcp_options sets session_timeout_used for either transport and drops the parsed value (`let _validated = parse_session_timeout(raw)?;`).",
+      "suggested_fix": "Emit the deprecation warning whenever session_timeout_used is true, regardless of transport."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "tools/skillgen/mod.rs",
+      "line": 62,
+      "claim": "CANONICAL_SKILL_SHA256 hard-pins the umbrella skill's digest, so any legitimate edit to compass-skill/SKILL.md fails validation with no documented procedure for updating the constant.",
+      "evidence": "skillgen hunk: `const CANONICAL_SKILL_SHA256: &str = \"c6c097e0...\"` with error text 'canonical umbrella skill changed; focused skills must remain additive' and no accompanying docs update describing how to re-pin.",
+      "suggested_fix": "Document the re-pin procedure next to the constant or in docs/implementation/agent-distribution.md, or derive the check from a checked-in expected-digest file that is updated by an explicit command."
+    }
+  ],
+  "sycophancy_screen": {
+    "reject_cap": 2,
+    "cap_overridden": false,
+    "cap_default": 2
+  }
+}
\ No newline at end of file
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-019/findings.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-019/findings.json
new file mode 100644
index 000000000..40a603356
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-019/findings.json
@@ -0,0 +1,71 @@
+{
+  "mode": "diff",
+  "verdict": "PASS",
+  "judge_model": "k3",
+  "producer_model": "gpt-5.6-sol",
+  "isolation_mode": "rest-gateway:http://localhost:4000/v1",
+  "cross_model_check": "verified-distinct",
+  "findings": [
+    {
+      "severity": "WARNING",
+      "file": "scripts/qualify_harness_packages.sh",
+      "line": 95,
+      "claim": "No harness subprocess has a duration bound, violating the project constraint that subprocess integrations 'bound duration plus captured output'.",
+      "evidence": "run_logged() executes `\"$@\" 2>&1 | node \"$log_filter\" ...` with no `timeout` wrapper anywhere in the script; constraint `no-shell-construction` states 'Subprocess integrations pass arguments separately and bound duration plus captured output'. A hung `claude plugin install` / `codex plugin add` blocks until the CI job-level timeout.",
+      "suggested_fix": "Wrap each stage invocation in `timeout <seconds> -- \"$@\"` (or an equivalent bounded runner) and treat timeout as a distinct failure from stage failure."
+    },
+    {
+      "severity": "WARNING",
+      "file": "scripts/qualify_harness_packages.sh",
+      "line": 205,
+      "claim": "Sentinel preservation is only verified once, after uninstall, so the spec scenario requiring install, upgrade, and uninstall to each preserve the sentinel is not individually enforced.",
+      "evidence": "openspec/changes/harness-install-validation/specs/harness-lifecycle/spec.md: '**THEN** install, upgrade, and uninstall SHALL preserve its bytes'; the script calls `require_sentinel \"$codex_sentinel\"` only after `codex-uninstall`, `require_sentinel \"$claude_sentinel\"` only after `claude-uninstall`, and `require_sentinel \"$opencode_sentinel\"` only after `opencode-uninstall`.",
+      "suggested_fix": "Call require_sentinel after each mutating stage (install, upgrade, uninstall) for all three harnesses so the failing stage is identified and intermediate clobbering cannot be masked."
+    },
+    {
+      "severity": "WARNING",
+      "file": "scripts/qualify_harness_packages.sh",
+      "line": 293,
+      "claim": "The 'upgrade' stages reinstall the byte-identical artifact, so they cannot detect upgrade-transition defects (stale removed files, changed manifests, version migration), despite the design requiring that the lifecycle 'performs an upgrade'.",
+      "evidence": "openspec design.md: 'performs an upgrade'; but `codex-upgrade` repeats the identical `plugin add compass@compass-plugins --json` against the same unchanged marketplace directory, `claude-upgrade` runs `plugin update` against the same unchanged marketplace, and `opencode-upgrade` runs `npm install --force` of the same `$scratch/$tarball` that was just installed.",
+      "suggested_fix": "Export a second, deliberately different artifact (e.g., an added/removed skill file or bumped bundle version) and upgrade from the first export to the second, asserting the installed tree matches the new export exactly."
+    },
+    {
+      "severity": "WARNING",
+      "file": ".github/workflows/compass-ci.yml",
+      "line": 90,
+      "claim": "CI no longer compiles or runs any unit test code: the lib/bins test steps and the nextest run were removed, and clippy covers only --lib --bins (not --all-targets), so #[cfg(test)] modules can silently stop compiling.",
+      "evidence": "Removed hunks: 'Native tests' (`cargo test --workspace --lib --bins --locked`), 'Install pinned nextest runner', and 'Isolated native tests' (`cargo nextest run --workspace --lib --bins --locked`); replacements are `cargo test --workspace --test '*'` (integration targets only, which do not compile #[cfg(test)] code) and `cargo clippy --workspace --lib --bins`.",
+      "suggested_fix": "Keep a compile-only check of test code (e.g., `cargo check --workspace --all-targets --locked` or retain the lib/bins test step) so unit test code cannot bitrot undetected."
+    },
+    {
+      "severity": "WARNING",
+      "file": "scripts/qualify_harness_packages.sh",
+      "line": 252,
+      "claim": "Parsing the npm pack tarball filename is fragile because the log merges stderr into stdout, so any npm notice containing '[' before the JSON array corrupts the slice and fails with an opaque node exception.",
+      "evidence": "run_logged pipes `\"$@\" 2>&1` into the log; the parse does `JSON.parse(input.slice(input.indexOf(\"[\")))`. npm routes `npm notice` output to stderr, so notices land in the same log before/after the JSON array.",
+      "suggested_fix": "Capture `npm pack --json` stdout to a separate file (or use `npm pack --json 2>stderr.log` and parse only stdout), or extract the JSON with a strict regex anchored to the array."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "scripts/qualify_harness_packages.sh",
+      "line": 178,
+      "claim": "Harness version extraction via awk first/last field over the whole log is brittle: any extra output line produces a multi-line 'version' and confusing mismatch errors.",
+      "evidence": "`actual_codex_version=\"$(awk '{print $NF}' \"$logs/codex-version.log\")\"`, `actual_claude_version=\"$(awk '{print $1}' ...)\"`, `actual_opencode_version=\"$(awk '{print $NF}' ...)\"` operate on unfiltered combined-output logs.",
+      "suggested_fix": "Extract with a strict anchored regex (e.g., `grep -Eo '[0-9]+\\.[0-9]+\\.[0-9]+' | head -n1`) or parse a `--json` version output where the harness supports it."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "scripts/bounded_redacted_log.mjs",
+      "line": 20,
+      "claim": "Redaction runs after the 64 KiB truncation, so a secret split at the truncation boundary can leave an unredacted fragment (e.g., 'sk-' plus fewer than 8 characters) in the persisted log.",
+      "evidence": "Truncation cuts `chunks` at maximumBytes before `rendered.replaceAll(/\\bsk-[A-Za-z0-9_-]{8,}\\b/g, ...)` runs; the `{8,}` minimum means a truncated token tail shorter than 8 chars survives redaction in the file written by writeFile.",
+      "suggested_fix": "Redact before enforcing the byte cap (redact the full stream buffer, then truncate the redacted text), or lower the minimum and also redact trailing partial tokens at the cut boundary."
+    }
+  ],
+  "sycophancy_screen": {
+    "reject_cap": 2,
+    "cap_overridden": false,
+    "cap_default": 2
+  }
+}
\ No newline at end of file
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-019/findings.round1.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-019/findings.round1.json
new file mode 100644
index 000000000..35c7b221b
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-019/findings.round1.json
@@ -0,0 +1,111 @@
+{
+  "mode": "diff",
+  "verdict": "BLOCK",
+  "judge_model": "k3",
+  "producer_model": "gpt-5.6-sol",
+  "isolation_mode": "rest-gateway:http://localhost:4000/v1",
+  "cross_model_check": "verified-distinct",
+  "findings": [
+    {
+      "severity": "CRITICAL",
+      "file": "scripts/qualify_harness_packages.sh",
+      "line": 136,
+      "claim": "The OpenCode plugin-load check reads the project path from process.argv[2], but `node --input-type=module - \"$opencode_project\"` (script from stdin) places the first user argument at process.argv[1], so argv[2] is undefined and `path.join(undefined, ...)` throws \u2014 the gate can never pass and the new CI job is permanently red.",
+      "evidence": "Hunk: `node --input-type=module - \"$opencode_project\" <<'NODE'` followed by `const project = process.argv[2]`. For stdin/`-e` scripts Node omits the script-path slot, so argv is [execPath, \"$opencode_project\"]. The same script's own `manifest_harness_version` correctly uses `process.argv[1]` for the same invocation pattern, proving the off-by-one.",
+      "suggested_fix": "Change to `process.argv[2] ?? process.argv[1]` validation or, concretely, use `const project = process.argv[1]` and assert it is defined before path.join."
+    },
+    {
+      "severity": "CRITICAL",
+      "file": "scripts/qualify_harness_packages.sh",
+      "line": 2,
+      "claim": "Task 1.1 requires 'bounded redacted logs', but the script implements no log capture, bounding, or redaction whatsoever \u2014 harness output is either discarded to /dev/null (destroying failure diagnostics under set -e) or streamed raw and unbounded to the CI log.",
+      "evidence": "Acceptance criterion 1.1: 'lifecycle qualification with named-version enforcement and bounded redacted logs'. The script contains no log file, no size cap, no redaction pass; e.g. `CODEX_HOME=... \"$codex_binary\" plugin marketplace add ... --json >/dev/null` and unredirected stderr from every harness invocation.",
+      "suggested_fix": "Capture each stage's output to a bounded file (e.g. head -c N), apply a redaction filter for tokens/paths, and emit the redacted excerpt only on failure."
+    },
+    {
+      "severity": "WARNING",
+      "file": "scripts/qualify_harness_packages.sh",
+      "line": 100,
+      "claim": "The 'upgrade' stages reinstall the byte-identical artifact (Codex re-runs `plugin add` on the same marketplace package; OpenCode runs `npm install --force` of the same tarball), so file-replacement/stale-file semantics of a real version-to-version upgrade are never exercised.",
+      "evidence": "Hunk comment 'Codex documents plugin add as the reinstall/update operation' followed by repeating the identical `plugin add compass@compass-plugins`; `npm install --ignore-scripts --force --prefix \"$opencode_project\" \"$scratch/$tarball\"` reuses the same tarball packed moments earlier. Criterion 1.2 requires upgrade coverage of the lifecycle.",
+      "suggested_fix": "Export a second, modified package (or bump a content file) and upgrade from artifact A to artifact B, then assert B's content is what the harness serves."
+    },
+    {
+      "severity": "WARNING",
+      "file": "scripts/qualify_harness_packages.sh",
+      "line": 98,
+      "claim": "Criterion 1.2's 'complete skill discovery, MCP configuration/load' is not verified for Codex or Claude: the script only greps `plugin list`/`mcp list` output, which matches registered config entries without proving the harness discovered skills or completed an MCP handshake with the compass server.",
+      "evidence": "`CODEX_HOME=... \"$codex_binary\" mcp list | grep -q 'compass'` and `CLAUDE_CONFIG_DIR=... \"$claude_binary\" mcp list | grep -q 'compass'` \u2014 listing registered servers is configuration presence, not load; a stale or broken entry that fails to spawn would still grep-match. Only the OpenCode plugin is actually executed (via direct node import, not via the harness).",
+      "suggested_fix": "Drive an actual MCP initialize/tools-list round trip against the registered server per harness, and assert the harness reports the umbrella/focused skills as discovered."
+    },
+    {
+      "severity": "WARNING",
+      "file": "scripts/qualify_harness_packages.sh",
+      "line": 94,
+      "claim": "The user-sentinel preservation scenario proves nothing for Codex: HOME is never redirected for codex commands (only CODEX_HOME), and the sentinel at $state/user is outside Codex's managed state, so a Codex install/upgrade/uninstall that clobbered user files beside its real state would go undetected.",
+      "evidence": "Sentinel is `$state/user/USER-INSTRUCTIONS.md`; claude/opencode invocations set `HOME=\"$state/user\"`, but all codex invocations set only `CODEX_HOME=\"$codex_home\"`. Spec scenario: 'a sentinel instruction exists beside managed harness state \u2026 install, upgrade, and uninstall SHALL preserve its bytes' \u2014 for Codex the sentinel is not beside any state the harness touches.",
+      "suggested_fix": "Place a sentinel inside/adjacent to CODEX_HOME-managed territory (and run codex with an isolated HOME) so the preservation assertion binds to each harness's lifecycle."
+    },
+    {
+      "severity": "WARNING",
+      "file": "scripts/qualify_harness_packages.sh",
+      "line": 62,
+      "claim": "`export PATH=\"$(dirname \"$compass_binary\"):$PATH\"` exports a relative PATH entry (`target/debug` given the CI invocation `--compass target/debug/compass`), so any PATH-based `compass` resolution by a harness breaks after the script's `cd \"$opencode_project\"`.",
+      "evidence": "CI hunk: `scripts/qualify_harness_packages.sh --compass target/debug/compass`; script line 62 exports dirname verbatim; line 129 changes cwd inside a subshell that then invokes the opencode harness whose MCP configuration may spawn `compass` from PATH.",
+      "suggested_fix": "Resolve to an absolute path first, e.g. `compass_dir=\"$(cd \"$(dirname \"$compass_binary\")\" && pwd)\"; export PATH=\"$compass_dir:$PATH\"`."
+    },
+    {
+      "severity": "WARNING",
+      "file": ".github/workflows/compass-ci.yml",
+      "line": 0,
+      "claim": "CI no longer runs the existing unit/library/binary test suites anywhere: `--lib --bins` runs were deleted from both the quality and cross-target matrix jobs, and `cargo test --workspace --test '*'` skips doctests, so previously-green unit and doc tests can silently rot.",
+      "evidence": "Removed lines: `cargo test --workspace --lib --bins --locked` (quality), `cargo nextest run --workspace --lib --bins --locked`, and `cargo test --workspace --lib --bins --locked --target ${{ matrix.target }}`; replacements select only `--test '*'`, which excludes lib tests, bin tests, and doctests. The constraints prohibit unit tests as *new evidence* but do not direct removing existing coverage from CI.",
+      "suggested_fix": "Keep a `--lib --bins` (and doctests, if any) leg in CI alongside the new integration-target runs, or document the deliberate removal in the change."
+    },
+    {
+      "severity": "WARNING",
+      "file": ".github/workflows/compass-ci.yml",
+      "line": 0,
+      "claim": "`cargo nextest run --workspace --test '*' --locked` relies on cargo-style glob target selection that nextest does not necessarily implement; if unsupported or zero-matching, the isolation gate either errors out or silently runs no tests while passing.",
+      "evidence": "Hunk: `- run: cargo nextest run --workspace --test '*' --locked`. The prior line used `--lib --bins`, which nextest documents; glob patterns in `--test` are a cargo target-selection feature and are not a documented nextest target-selection behavior.",
+      "suggested_fix": "Use nextest's supported selection (e.g. `cargo nextest run --workspace --tests` or a filterset expression) and verify locally that the command enumerates the intended integration targets."
+    },
+    {
+      "severity": "WARNING",
+      "file": ".github/workflows/compass-ci.yml",
+      "line": 0,
+      "claim": "Task 2.1 requires wiring 'the lifecycle and OpenCode JavaScript integration gates into CI', but the new installed-agent-packages job runs only `npm ci` \u2014 no `npm run typecheck:js` or `npm run test:js` step appears anywhere in the diff.",
+      "evidence": "Acceptance criterion 2.1; new job steps end at `Qualify installed native packages` with no JS typecheck/test step; constraint js-surface-verified (`npm ci && npm run typecheck:js && npm run test:js`) applies to the OpenCode plugin surface this change exercises.",
+      "suggested_fix": "Add `npm run typecheck:js` and `npm run test:js` steps to the new job (or cite the existing job that covers them in the change record)."
+    },
+    {
+      "severity": "WARNING",
+      "file": "scripts/qualify_harness_packages.sh",
+      "line": 95,
+      "claim": "Every `harness \u2026 | grep -q \u2026` runs under `set -o pipefail`; grep -q exits immediately on first match, so a harness that keeps writing receives SIGPIPE (exit 141) and the pipeline fails spuriously for large outputs, making the gate flaky.",
+      "evidence": "`set -euo pipefail` at line 2 combined with e.g. `\"$codex_binary\" plugin list --available --json | grep -q '\"compass\"'` and `\"$opencode_binary\" mcp list` piped to `grep -q 'compass'`.",
+      "suggested_fix": "Capture output into a bounded variable/file first, then grep the capture (which also enables the required log bounding)."
+    },
+    {
+      "severity": "WARNING",
+      "file": ".github/workflows/compass-ci.yml",
+      "line": 0,
+      "claim": "The globally installed harness packages are version-pinned but not integrity-pinned, and the version-equality checks in the script parse `--version` output with inconsistent, format-fragile awk fields that fail silently via bare `[[ ]]` with no diagnostic message.",
+      "evidence": "Workflow: `npm install --global @openai/codex@0.146.0 @anthropic-ai/claude-code@2.1.251 opencode-ai@1.18.23` (no lockfile/integrity, unlike the SHA-pinned actions in the same file). Script: `awk '{print $NF}'` for codex/opencode vs `awk '{print $1}'` for claude, then bare `[[ \"$actual_codex_version\" == \"$expected_codex_version\" ]]` which exits 1 with no output on mismatch.",
+      "suggested_fix": "Install via a lockfile-controlled `npm ci` (or record integrity), and emit an echo of expected-vs-actual before each comparison."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "scripts/qualify_harness_packages.sh",
+      "line": 85,
+      "claim": "The harness binary variables are expanded unquoted in command substitutions (`$($codex_binary --version \u2026)` etc.), so an override path containing spaces passed via --codex/--claude/--opencode silently mis-parses.",
+      "evidence": "`actual_codex_version=\"$($codex_binary --version | awk '{print $NF}')\"` and the analogous claude/opencode lines, despite the script accepting arbitrary paths for these options.",
+      "suggested_fix": "Quote the expansions: `\"$(\"$codex_binary\" --version | awk '{print $NF}')\"`."
+    }
+  ],
+  "sycophancy_screen": {
+    "reject_cap": 2,
+    "cap_overridden": false,
+    "cap_default": 2
+  }
+}
\ No newline at end of file
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-019/findings.round2.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-019/findings.round2.json
new file mode 100644
index 000000000..c6127fbae
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-019/findings.round2.json
@@ -0,0 +1,78 @@
+{
+  "mode": "diff",
+  "verdict": "BLOCK",
+  "judge_model": "k3",
+  "producer_model": "gpt-5.6-sol",
+  "isolation_mode": "rest-gateway:http://localhost:4000/v1",
+  "cross_model_check": "verified-distinct",
+  "findings": [
+    {
+      "severity": "CRITICAL",
+      "file": "scripts/qualify_harness_packages.sh",
+      "claim": "No stage of the lifecycle harness verifies skill discovery (or plugin load) for any harness, so acceptance criterion 1.2 ('Cover complete skill discovery, MCP configuration/load') is unsatisfied for Codex and Claude Code.",
+      "evidence": "The script only asserts `plugin list`/`plugin list --available` output contains '\"compass\"' and `mcp list` output contains 'compass' (require_log_contains calls after codex-install, codex-list, claude-install). Nothing lists installed skills, inspects the harness plugin cache for copied `skills/**` files, or runs any harness command that exercises skill loading. Criterion 1.2 requires skill discovery coverage; spec.md Requirement 'Installed-artifact evidence' requires discovery and load to operate on the generated artifact. Only the OpenCode plugin gets a direct load check (opencode-plugin-load).",
+      "suggested_fix": "Add post-install assertions that the harness-managed skill directories/files exist and are byte-equal to the exported package, and/or invoke a harness command that enumerates discovered skills, for each of Codex, Claude Code, and OpenCode."
+    },
+    {
+      "severity": "CRITICAL",
+      "file": "scripts/qualify_harness_packages.sh",
+      "line": 127,
+      "claim": "The sentinel preservation check strips all newlines before comparing, so it does not verify the spec's byte-identical preservation requirement.",
+      "evidence": "spec.md Scenario 'User sentinel': 'install, upgrade, and uninstall SHALL preserve its bytes'; Requirement 'Ownership preservation': 'User-authored instructions ... SHALL remain byte-identical.' The implementation is `if [[ \"$(tr -d '\\n' <\"$1\")\" != \"$sentinel_content\" ]]`, which passes even if the harness appends or removes trailing newlines (e.g., a plugin manager normalizing the file), a modification the spec forbids.",
+      "suggested_fix": "Use `cmp -s \"$1\" <(printf '%s\\n' \"$sentinel_content\")` or compare against a stored copy with `cmp` so byte identity is actually enforced."
+    },
+    {
+      "severity": "WARNING",
+      "file": "scripts/qualify_harness_packages.sh",
+      "line": 183,
+      "claim": "Uninstall effectiveness is never verified, and the 'upgrade' stage reinstalls the identical artifact version, so neither operation's effect on the generated artifact is actually exercised.",
+      "evidence": "After codex-uninstall / claude-uninstall / opencode-uninstall there is no `plugin list`/`mcp list` assertion that 'compass' is absent and no check that managed files were removed \u2014 only exit status is checked. The upgrade stages (`plugin add compass@compass-plugins` again, `plugin update`, `npm install --force` of the same tarball) reinstall the exact same version, so no version-transition path is tested despite design.md claiming the harness 'performs an upgrade' and spec.md requiring upgrade to 'operate on the generated artifact.'",
+      "suggested_fix": "Assert post-uninstall absence of the plugin, MCP entry, and managed skill files; perform the upgrade against a differently-versioned export (e.g., a bumped manifest) so a real upgrade path runs."
+    },
+    {
+      "severity": "WARNING",
+      "file": "scripts/qualify_harness_packages.sh",
+      "line": 213,
+      "claim": "The OpenCode sentinel is placed in OPENCODE_CONFIG_DIR, but the install/upgrade/uninstall stages operate via npm --prefix on the project directory and never touch the config dir, making the OpenCode ownership-preservation check largely vacuous.",
+      "evidence": "`opencode_sentinel=\"$opencode_config/USER-INSTRUCTIONS.md\"` while opencode-install/upgrade/uninstall run `npm install/uninstall --prefix \"$opencode_project\"`; npm cannot modify `$opencode_config`, so require_sentinel for OpenCode cannot fail from the lifecycle operations it is meant to guard (unlike codex/claude, whose sentinels sit inside CODEX_HOME/CLAUDE_CONFIG_DIR that the harness commands mutate).",
+      "suggested_fix": "Place the OpenCode sentinel beside the managed files that install/uninstall actually mutate (e.g., inside the project directory next to node_modules/opencode.json), or add a step where the opencode harness itself performs install/remove against its config dir."
+    },
+    {
+      "severity": "WARNING",
+      "file": ".github/workflows/compass-ci.yml",
+      "line": 63,
+      "claim": "The installed-agent-packages job runs in parallel with the quality job's integration tests, contradicting the documented ordering that qualification runs after the phase-end integration build, and a lifecycle pass can coincide with failing integration tests.",
+      "evidence": "The new `installed-agent-packages` job has no `needs:` on the `quality` job (which owns `cargo test --workspace --test '*'`). design.md states 'CI runs it after the normal phase-end integration build and the OpenCode workspace JavaScript gates,' and docs/implementation/agent-distribution.md states 'The verification wave runs the full Rust integration targets, the installed-artifact harness qualification, and the workspace JavaScript typecheck and integration suite.' The job only builds compass-cli and runs the plugin's typecheck/test; the full integration targets run concurrently in a different job.",
+      "suggested_fix": "Either add `needs: quality` (or fold the qualification into the quality job after the integration-test step), or correct the docs to state the gates are independent."
+    },
+    {
+      "severity": "WARNING",
+      "file": "scripts/qualify_harness_packages.sh",
+      "line": 167,
+      "claim": "No network egress isolation or telemetry/update-check disabling is applied to the real Codex, Claude Code, and OpenCode CLIs, despite the spec scenario requiring every stage to pass 'without credentials, network model calls.'",
+      "evidence": "run_logged invocations only set CODEX_HOME/CLAUDE_CONFIG_DIR/OPENCODE_CONFIG_DIR/HOME; no env such as DISABLE_TELEMETRY/update-suppression flags, no firewall/proxy sandbox, and no detection of outbound connections. The version checks (codex-version, claude-version, opencode-version) run with the real user HOME entirely outside the isolated roots.",
+      "suggested_fix": "Set the documented telemetry/update-disable environment variables for each harness, run the version probes under the isolated HOME as well, and document (or enforce) that no model endpoint is contacted."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "scripts/qualify_harness_packages.sh",
+      "line": 222,
+      "claim": "Tarball extraction parses JSON out of the redacted, stderr-merged npm pack log with `input.slice(input.indexOf(\"[\"))`, which breaks if npm emits any warning containing '[' before the JSON array or any trailing text after it.",
+      "evidence": "opencode-pack pipes `npm pack ... --json` through `2>&1 | node bounded_redacted_log.mjs` and later does `JSON.parse(input.slice(input.indexOf(\"[\")))`. npm warnings/notices share the stream and the redaction pass can alter content; a stray '[' in a warning line or trailing notice makes JSON.parse throw. It fails closed, but the failure mode is opaque.",
+      "suggested_fix": "Capture npm pack stdout to a separate unfiltered JSON file (redact only the human log), or list `$scratch/*.tgz` after packing instead of parsing npm's JSON."
+    },
+    {
+      "severity": "SUGGESTION",
+      "file": "scripts/qualify_harness_packages.sh",
+      "line": 172,
+      "claim": "MCP registration assertions use bare substring matches (`grep -Fq compass`) over free-form CLI output, which can be satisfied by unrelated text such as binary paths in the output.",
+      "evidence": "`require_log_contains codex-mcp-list compass` and `require_log_contains claude-mcp-list compass` pass if 'compass' appears anywhere in the log, e.g., as part of a path or an unrelated server entry; `--json` variants (codex-mcp-list is not run with structured output parsed) would allow precise assertions.",
+      "suggested_fix": "Where the harness supports JSON output, parse it and assert a server entry named exactly 'compass' exists; otherwise match an anchored pattern such as a line beginning with the server name."
+    }
+  ],
+  "sycophancy_screen": {
+    "reject_cap": 2,
+    "cap_overridden": false,
+    "cap_default": 2
+  }
+}
\ No newline at end of file
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/assess/findings-r2.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/assess/findings-r2.json
new file mode 100644
index 000000000..695f8f44a
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/assess/findings-r2.json
@@ -0,0 +1,42 @@
+{
+  "mode": "artifact",
+  "verdict": "BLOCK",
+  "judge_model": "kbd-judge",
+  "producer_model": "claude-fable-5",
+  "isolation_mode": "rest-gateway:http://localhost:8181/v1",
+  "cross_model_check": "verified-distinct",
+  "findings": [
+    {
+      "severity": "CRITICAL",
+      "file": "assessment.md",
+      "line": 0,
+      "claim": "The assessment bases the first required action and change sequencing on an unverified claim that C-001 is already substantially implemented in an uncommitted diff.",
+      "evidence": "Assessment \u00a73 states: \"C-001 ... **substantially implemented but uncommitted**: `crates/compass-store/src/lib.rs` (+152/\u221217) adds `read_snapshot_manifest()` + streaming `read_snapshot_chunks()`\" and \"First required action ... reconcile C-001 \u2014 create its OpenSpec change, absorb the existing diff\". The packet's file_tree only proves `crates/compass-store/src/lib.rs` exists; no diff, branch state, git status, or source content is included.",
+      "suggested_fix": "Either include verifiable source/diff evidence in the packet or restate C-001 as unverified pending work and assess the gap from repository-visible facts only."
+    },
+    {
+      "severity": "WARNING",
+      "file": "assessment.md",
+      "line": 0,
+      "claim": "Multiple codebase-specific assertions are unsupported by the file tree and cited paths, so downstream analysis may inherit incorrect premises.",
+      "evidence": "Assessment \u00a75 claims: \"`Cargo.toml:86` pins `rmcp = \\\"2.2.0\\\"`\", \"`compass-store-redb` (~869 lines) ...\", \"`compass-mcp` serves 15 tools + 6 resources\", and \"Rust toolchain 1.97.1 satisfies rmcp 3.x's 1.88 MSRV.\" The file_tree shows only that `Cargo.toml`, `crates/compass-store-redb`, `crates/compass-mcp`, and `rust-toolchain.toml` exist; it does not provide these contents, counts, tool lists, or versions.",
+      "suggested_fix": "Limit findings to what the packet proves, or attach the inspected snippets/command outputs needed to substantiate each codebase claim."
+    },
+    {
+      "severity": "WARNING",
+      "file": "assessment.md",
+      "line": 0,
+      "claim": "The assessment cites docs/future research content as the basis for expanded gaps without packet evidence for that research document or its contents.",
+      "evidence": "Assessment \u00a73 says \"docs/future | did not exist | 3 notes (1,294 lines): research report, SurrealDB proposal, upstream contribution plan\" and \u00a77 says \"the qualification thresholds in the research doc are stated as \\\"ratify before measuring.\\\"\" The cited_paths only list `docs/future/SURREAL_DB.md` and `docs/future/upstream-contribution-plan.md`; the file_tree lists `./docs/future` only as a directory and does not include a research-report filename or contents.",
+      "suggested_fix": "Identify the specific research document path and include it in cited_paths, or remove conclusions that depend on unavailable research-doc contents."
+    },
+    {
+      "severity": "WARNING",
+      "file": "assessment.md",
+      "line": 0,
+      "claim": "The gap report for expanded goals is too coarse to drive planning for several multi-part goals.",
+      "evidence": "For E3, the goal requires \"schemafull nodes/relations, generation activation, bounded native reads, dual-engine semantic equivalence,\" but the gap is only \"entire crate + equivalence corpus.\" For E6, the goal requires \"Codex `.codex-plugin`, Claude `.claude-plugin` + marketplace, OpenCode plugin/npm\" generated from one inventory, but the gap is only \"inventory + generators + installed-artifact validation.\" These omit separate gap assessment for generation activation, bounded native reads, marketplace packaging, and npm/TypeScript plugin requirements.",
+      "suggested_fix": "Break each expanded goal into assessable sub-gaps that map directly to required implementation and validation work."
+    }
+  ]
+}
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/assess/findings.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/assess/findings.json
new file mode 100644
index 000000000..ee43dfdad
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/assess/findings.json
@@ -0,0 +1,50 @@
+{
+  "mode": "artifact",
+  "verdict": "BLOCK",
+  "judge_model": "kbd-judge",
+  "producer_model": "claude-fable-5",
+  "isolation_mode": "rest-gateway:http://localhost:8181/v1",
+  "cross_model_check": "verified-distinct",
+  "findings": [
+    {
+      "severity": "CRITICAL",
+      "file": "assessment.md",
+      "line": 0,
+      "claim": "The assessment expands the phase to E1\u2013E7 docs/future work that is not present in the supplied phase goals.",
+      "evidence": "The provided goals list only G1\u2013G4 and the architecture question under objective 'Make Compass fail gracefully...' with non-goals including 'Building a scoping feature' and 'Raising the 2 GiB default'; prior_handoffs is null. The assessment instead states 'Trigger: user directive to absorb implementation of the `docs/future/` program (SurrealDB, MCP 2026, Agent Skills, harness distribution) into this phase' and adds 'Expanded goals (new, from docs/future)' E1\u2013E7.",
+      "suggested_fix": "Remove E1\u2013E7 from this assessment or update the review packet goals with the explicit approved expanded scope before assessing it."
+    },
+    {
+      "severity": "CRITICAL",
+      "file": "assessment.md",
+      "line": 0,
+      "claim": "The assessment does not settle the required architecture question about graph partitioning/sharding versus a larger limit.",
+      "evidence": "The goals require: 'If a repository of this size genuinely cannot publish under 2 GiB even with correct exclusions, is the right answer graph partitioning/sharding rather than a larger number? Settle this before writing code.' The assessment only lists '\u2014 partition crate extraction | open | C-005 (gated on C-001)' and recommends 'Wave 2 ... C-004, C-005' without giving a verdict or rationale on partitioning/sharding versus larger number.",
+      "suggested_fix": "Add an explicit architecture verdict with evidence: whether partitioning/sharding is the chosen answer, why raising the default remains rejected, and what gap remains for implementation."
+    },
+    {
+      "severity": "WARNING",
+      "file": "assessment.md",
+      "line": 0,
+      "claim": "The assessment depends on undefined prior change IDs C-001 through C-006 while the packet contains no prior handoff.",
+      "evidence": "The assessment says 'original findings incorporated by reference below' and uses 'C-001\u2026C-006' throughout, but the packet has 'prior_handoffs': null and the provided goals do not define those change IDs.",
+      "suggested_fix": "Inline the definitions and findings for C-001 through C-006, or attach the prior assessment/plan as prior_handoffs."
+    },
+    {
+      "severity": "WARNING",
+      "file": "assessment.md",
+      "line": 0,
+      "claim": "Several codebase state claims are unsupported by the file tree or cited paths in the packet.",
+      "evidence": "The assessment claims '`crates/compass-store/src/lib.rs` (+152/\u221217)', 'work sits on branch `docs/claude-md`', 'installed `compass` 0.3.6, source manifest 0.3.7', and 'tool list spot-verified against the live MCP server this session'. The packet file_tree only lists paths, cited_paths only confirms existence of a few paths, and no git status, branch, diff, installed-binary output, or MCP server output is included.",
+      "suggested_fix": "Either remove these unverifiable claims or include concrete evidence in the packet, such as git status/diff summaries, version command output, and MCP tool-list output."
+    },
+    {
+      "severity": "WARNING",
+      "file": "assessment.md",
+      "line": 0,
+      "claim": "The assessment's external-fact claims are unverifiable from the packet.",
+      "evidence": "The assessment states 'external facts validated 2026-08-28 via Firecrawl search' and lists claims such as '`rmcp` 3.1.4 is current', 'MCP `2026-07-28` is the latest spec', and 'SurrealDB 3.2.4 is latest stable', but the packet includes no URLs, excerpts, or source records for those validations.",
+      "suggested_fix": "Include source URLs or quoted excerpts for each external fact, or move these claims to analysis where external landscape validation belongs."
+    }
+  ]
+}
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/plan/findings-r2.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/plan/findings-r2.json
new file mode 100644
index 000000000..a1eaf3739
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/plan/findings-r2.json
@@ -0,0 +1,31 @@
+{
+  "mode": "artifact",
+  "verdict": "PASS",
+  "judge_model": "kbd-judge",
+  "producer_model": "claude-fable-5",
+  "isolation_mode": "rest-gateway:http://localhost:8181/v1",
+  "cross_model_check": "verified-distinct",
+  "findings": [
+    {
+      "severity": "WARNING",
+      "file": "plan.md",
+      "claim": "C-018 weakens E6 by making marketplace packaging optional even though the goal requires a Claude marketplace deliverable.",
+      "evidence": "Goals E6 requires: \"Native harness packages (Codex `.codex-plugin`, Claude `.claude-plugin` + marketplace, OpenCode plugin/npm) generated from one canonical inventory.\" Plan C-018 says: \"Claude package (`.claude-plugin/plugin.json`, `.mcp.json`, skills, optional marketplace)\".",
+      "suggested_fix": "Make the Claude marketplace artifact a required C-018 deliverable, or explicitly amend E6 if marketplace generation is no longer in scope."
+    },
+    {
+      "severity": "WARNING",
+      "file": "plan.md",
+      "claim": "C-003's fail-fast acceptance criterion is too vague to enforce G3's recoverability requirement.",
+      "evidence": "G3 says: \"Fail fast: a doomed build should not consume 331s before reporting.\" C-003's acceptance criterion only says: \"Oversized build reports before full extraction completes,\" which still permits most of the 331-second extraction to occur and gives no measurable bound.",
+      "suggested_fix": "Add a measurable acceptance criterion, such as reporting before publication/extraction of file contents begins when the estimate already exceeds the limit, or a deterministic fixture asserting the limit is reported within a bounded phase/time budget."
+    },
+    {
+      "severity": "WARNING",
+      "file": "plan.md",
+      "claim": "C-018 omits the hard dependency on the completed MCP migration despite the plan stating Wave 7 must package the migrated MCP contract.",
+      "evidence": "Ordering rationale says: \"Wave 7 after Waves 3 and 6: packages distribute the migrated MCP contract and the split skills; generating them earlier packages contracts that are about to change.\" But C-018 lists only: \"Depends on: C-016, C-017; benefits from C-007\u2013C-010\".",
+      "suggested_fix": "Change C-018 dependencies to include C-010, or explicitly require C-007 through C-010 to be complete before package generation begins."
+    }
+  ]
+}
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/plan/findings.json b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/plan/findings.json
new file mode 100644
index 000000000..3f268b086
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/review/plan/findings.json
@@ -0,0 +1,38 @@
+{
+  "mode": "artifact",
+  "verdict": "BLOCK",
+  "judge_model": "kbd-judge",
+  "producer_model": "claude-fable-5",
+  "isolation_mode": "rest-gateway:http://localhost:8181/v1",
+  "cross_model_check": "verified-distinct",
+  "findings": [
+    {
+      "severity": "CRITICAL",
+      "file": "plan.md",
+      "claim": "The plan does not include a concrete decision point that settles the phase's graph partitioning/sharding architecture question before implementation work begins.",
+      "evidence": "Goals require: \"If a repository of this size genuinely cannot publish under 2 GiB even with correct exclusions, is the right answer graph partitioning/sharding rather than a larger number? Settle this before writing code.\" The plan's only partitioning-related change says: \"It positions for current-graph partitioned publication; it does not deliver it. That is a further change requiring the identity decision below.\" The only blocked decision listed is \"Identity/namespacing for shared record keys,\" not whether partitioning/sharding is the selected architecture.",
+      "suggested_fix": "Add an explicit architecture decision change before C-001/C-003/C-005 implementation work, with acceptance criteria that records partitioning/sharding vs non-partitioning recovery strategy and the implications for the rest of the plan."
+    },
+    {
+      "severity": "WARNING",
+      "file": "plan.md",
+      "claim": "C-004 leaves the required error-message follow-up ambiguous and potentially unassigned.",
+      "evidence": "C-002 says: \"Do not mention `COMPASS_MAX_GRAPH_BYTES` until C-004 ships.\" C-004 then says: \"C-002's message updated to advertise it, in the same change or immediately after.\" The plan has no separate change for the \"immediately after\" path, despite its own adversarial review warning: \"If C-004 slips, C-002's message stays permanently incomplete \u2014 track it rather than assuming the follow-up happens.\"",
+      "suggested_fix": "Make the C-002 message update a required part of C-004 itself, including the CLI regression test update, or add a separate dependent change that cannot be skipped."
+    },
+    {
+      "severity": "WARNING",
+      "file": "plan.md",
+      "claim": "The rmcp dependency pin is internally contradictory because Cargo version string `\"3.1.4\"` is not an exact pin.",
+      "evidence": "C-007 done criteria state: \"Workspace pins `rmcp = \\\"3.1.4\\\"` (exact reviewed pin, root `Cargo.toml`, `{name}.workspace = true` in members).\" In Cargo, `\"3.1.4\"` is a compatible semver requirement, not an exact `=3.1.4` requirement.",
+      "suggested_fix": "Use `rmcp = \"=3.1.4\"` if the intent is an exact reviewed pin, or revise the acceptance criterion to say the lockfile pins the resolved version and the manifest allows compatible updates."
+    },
+    {
+      "severity": "WARNING",
+      "file": "plan.md",
+      "claim": "JavaScript/TypeScript verification is missing from the acceptance criteria for the OpenCode TypeScript/npm plugin work.",
+      "evidence": "C-018 includes \"OpenCode TypeScript/npm plugin (thin bridge; no graph logic in TS).\" The project constraint `js-surface-verified` requires: \"JavaScript, viewer, or VS Code changes typecheck and test\" with command `npm ci && npm run typecheck:js && npm run test:js`. C-018 and C-019 acceptance criteria mention platform validators and lifecycle tests but do not require the JS typecheck/test gate.",
+      "suggested_fix": "Add `npm ci && npm run typecheck:js && npm run test:js` or an equivalent JS-surface verification gate to C-018/C-019."
+    }
+  ]
+}
diff --git a/.kbd-orchestrator/phases/compass-scoping-and-bounds/tasks.md b/.kbd-orchestrator/phases/compass-scoping-and-bounds/tasks.md
new file mode 100644
index 000000000..17659d5cd
--- /dev/null
+++ b/.kbd-orchestrator/phases/compass-scoping-and-bounds/tasks.md
@@ -0,0 +1,143 @@
+<!-- generated by kbd-runtime; source revision 300 -->
+# compass-scoping-and-bounds tasks
+
+## C-001 — Stop materializing snapshot payload in read_snapshot
+
+- [x] 1 — Complete streaming API and production call-site equivalence (COMPLETE)
+- [x] 2 — Add durability and compatibility coverage (COMPLETE)
+- [x] 3 — Update allocation documentation and changelog (COMPLETE)
+- [x] 4 — Run focused Rust verification (COMPLETE)
+- [x] 5 — Run repository baseline and refresh graph (COMPLETE)
+
+## C-002 — Make snapshot limit error actionable
+
+- [x] 1 — Define actionable limit-error contract (COMPLETE)
+- [x] 2 — Implement graph-layer remediation message (COMPLETE)
+- [x] 3 — Add CLI rendered-text and exit-code regression (COMPLETE)
+- [x] 4 — Run verification, QA, review, and archive (COMPLETE)
+
+## C-003 — Pre-flight graph size estimate
+
+- [x] 1 — Measure oversized baseline and payload composition (COMPLETE)
+- [x] 2 — Define bounded deterministic estimator contract (COMPLETE)
+- [x] 3 — Implement preflight estimate and regression (COMPLETE)
+- [x] 4 — Run verification QA review and archive (COMPLETE)
+
+## C-004 — Honor COMPASS_MAX_GRAPH_BYTES on publication path
+
+- [x] 1 — Define override contract (COMPLETE)
+- [x] 2 — Implement effective publication limit (COMPLETE)
+- [x] 3 — Update actionable public error (COMPLETE)
+- [x] 4 — Verify QA review and archive (COMPLETE)
+
+## C-005 — Extract compass-partition shared crate
+
+- [x] 1 — Define storage-neutral ownership and compatibility contract (COMPLETE)
+- [x] 2 — Extract partition container and encodings (COMPLETE)
+- [x] 3 — Preserve history compatibility boundary (COMPLETE)
+- [x] 4 — Run verification QA review and archive (COMPLETE)
+
+## C-006 — Decide vendor/ default-skip policy
+
+- [x] 1 — Record deliberate vendor discovery policy (COMPLETE)
+- [x] 2 — Pin detection and watcher behavior (COMPLETE)
+- [x] 3 — Run verification QA review and archive (COMPLETE)
+
+## C-007 — Upgrade rmcp 2.2.0 to 3.1.4 with stdio parity
+
+- [x] 1 — Measure rmcp API and dependency baseline (COMPLETE)
+- [x] 2 — Pin rmcp 3.1.4 and port stdio transport (COMPLETE)
+- [x] 3 — Prove discovery parity and dependency policy (COMPLETE)
+- [x] 4 — Run verification QA review and archive (COMPLETE)
+
+## C-008 — Stateless HTTP transport per MCP 2026-07-28
+
+- [x] 1 — Define stateless HTTP and legacy-mode contract (COMPLETE)
+- [x] 2 — Implement 2026-07-28 stateless HTTP transport (COMPLETE)
+- [x] 3 — Deprecate session timeout and update public docs (COMPLETE)
+- [x] 4 — Run verification QA review and archive (COMPLETE)
+
+## C-009 — Common result envelope and typed navigation results
+
+- [x] 1 — Define versioned result-envelope contract (COMPLETE)
+- [x] 2 — Implement typed navigation envelopes and output schemas (COMPLETE)
+- [x] 3 — Add golden and compatibility regressions (COMPLETE)
+- [x] 4 — Document verify review and archive (COMPLETE)
+
+## C-010 — MCP conformance and named-harness interop matrix
+
+- [x] 1 — Define pinned conformance and interop contract (COMPLETE)
+- [x] 2 — Implement reference conformance suite for stdio and HTTP (COMPLETE)
+- [x] 3 — Run named-client discovery and invocation matrix (COMPLETE)
+- [x] 4 — Document verify review and archive (COMPLETE)
+
+## C-011 — SurrealDB BSL 1.1 license and release decision
+
+- [x] C011-T1 — Capture pinned SurrealDB 3.2.4 BSL evidence and digest (COMPLETE)
+- [x] C011-T2 — Document exact artifact profiles and core-free fallback (COMPLETE)
+- [x] C011-T3 — Record explicit user or legal sign-off and provenance (COMPLETE)
+- [x] C011-T4 — Apply outcome, verify, refine, review, and archive (COMPLETE)
+
+## C-012 — Persistent SurrealKV and RocksDB throwaway probes
+
+- [x] C012-T1 — Version deterministic persistent-engine probe vectors (COMPLETE)
+- [x] C012-T2 — Build disposable feature-isolated SurrealDB 3.2.4 runner (COMPLETE)
+- [x] C012-T3 — Qualify persistent SurrealKV semantics recovery and resources (COMPLETE)
+- [x] C012-T4 — Qualify persistent RocksDB semantics recovery and resources (COMPLETE)
+- [x] C012-T5 — Compare outputs capture license dispose spike and record gate (COMPLETE)
+- [x] C012-T6 — Verify refine review and archive probe evidence (COMPLETE)
+
+## C-013 — Measurement corpora baselines and budget ratification
+
+- [x] C013-T1 — Freeze qualification contracts and precommitted budgets (COMPLETE)
+- [x] C013-T2 — Implement deterministic medium and large graph generators (COMPLETE)
+- [x] C013-T3 — Version semantic corpus and bounded raw traversal baseline (COMPLETE)
+- [x] C013-T4 — Version thirty-task agent evaluation suite (COMPLETE)
+- [x] C013-T5 — Freeze umbrella and focused skill prompt corpora (COMPLETE)
+- [x] C013-T6 — Measure reproducible current-engine baselines (COMPLETE)
+- [x] C013-T7 — Verify refine review ratify and archive qualification evidence (COMPLETE)
+
+## C-014 — compass-graphdb-surreal projection crate
+
+- [x] C014-T1 — Contract and dependency boundary (COMPLETE)
+- [x] C014-T2 — Deterministic projection core (COMPLETE)
+- [x] C014-T3 — Generation-atomic Surreal runtime (COMPLETE)
+- [x] C014-T4 — Documentation and qualification (COMPLETE)
+
+## C-015 — Bounded native reads and dual-engine equivalence
+
+- [x] C015-T1 — Contract and engine-neutral bounded read surface (COMPLETE)
+- [x] C015-T2 — Surreal native read implementation (COMPLETE)
+- [x] C015-T3 — Dual-engine equivalence and budget qualification (COMPLETE)
+- [ ] C015-T4 — Documentation verification review and archive (SKIPPED)
+
+## C-016 — Focused Agent Skills with umbrella preserved
+
+- [x] 1 — Define focused-skill and trigger-discrimination contract (COMPLETE)
+- [x] 2 — Implement and validate six focused skill trees (COMPLETE)
+- [x] 3 — Install complete trees idempotently with checksums (COMPLETE)
+- [x] 4 — Document verify review and archive (COMPLETE)
+
+## C-017 — compass agent CLI namespace
+
+- [x] C017-T1 — Namespace, help, inventory, MCP config, and install compatibility (COMPLETE)
+- [x] C017-T2 — Deterministic export and bounded validation (COMPLETE)
+- [x] C017-T3 — Offline doctor, public tests, and documentation (COMPLETE)
+- [x] C017-T4 — Qualification, refinement, review, and archive (COMPLETE)
+
+## C-018 — Canonical distribution inventory and package generators
+
+- [x] C018-T1 — Canonical inventory and deterministic generators (COMPLETE)
+- [x] C018-T2 — Complete native packages and fail-closed validation (COMPLETE)
+- [x] C018-T3 — Thin generated OpenCode bridge (COMPLETE)
+- [x] C018-T4 — Public integration coverage and compatibility documentation (COMPLETE)
+- [x] C018-T5 — Phase verification refinement review and archive (COMPLETE)
+
+## C-019 — Installed-artifact validation and clean-install tests
+
+- [x] C019-T1 — Exact-version installed artifact lifecycles (COMPLETE)
+- [x] C019-T2 — Bounded redacted qualification and ownership sentinels (COMPLETE)
+- [x] C019-T3 — Phase-end CI package gates (COMPLETE)
+- [x] C019-T4 — Verification refinement review and archive (COMPLETE)
+
+## C-020 — Conditional compass-store-surreal Store adapter
diff --git a/.kbd-orchestrator/position-reminder.txt b/.kbd-orchestrator/position-reminder.txt
new file mode 100644
index 000000000..d66b8c1f4
--- /dev/null
+++ b/.kbd-orchestrator/position-reminder.txt
@@ -0,0 +1,16 @@
+POSITION REMINDER — read this as your FIRST tool call every turn
+Phase: compass-scoping-and-bounds
+Stage: ready
+Project-wide progress: 18 of 20 (implementation, ALL phases)
+Next command: /opsx:new stream-snapshot-read
+
+GENERATED BY kbd-runtime at revision 300, 2026-08-29T19:17:43.033786+00:00.
+Do NOT hand-edit: this file is rewritten on every canonical phase
+transition and any manual change is discarded. To move position,
+use `prometheus kbd phase activate|transition`.
+
+The counter above is a PROJECT-WIDE roll-up across every phase in
+canonical state. It is NOT this phase's progress. `completion` is
+held on runtime state, not per phase, so a phase-scoped number is
+not available here. For THIS phase read
+phases/compass-scoping-and-bounds/progress.json, where changes[] is authoritative.
diff --git a/.kbd-orchestrator/position.json b/.kbd-orchestrator/position.json
new file mode 100644
index 000000000..faa2a04b8
--- /dev/null
+++ b/.kbd-orchestrator/position.json
@@ -0,0 +1,220 @@
+{
+  "schemaVersion": "1",
+  "generatedBy": "kbd-runtime",
+  "sourceRevision": 300,
+  "derivedRevision": 300,
+  "frontier": {
+    "dcb2293c-3722-4507-af1a-1786476c3817": 300
+  },
+  "conflictCount": 0,
+  "updatedAt": "2026-08-29T19:17:43.033786Z",
+  "cursor": [
+    "compass-scoping-and-bounds",
+    "execute"
+  ],
+  "root": {
+    "type": "phase",
+    "id": "a5ced554-588e-4e12-a6f7-6580bba975b3",
+    "status": "ready",
+    "progress": {
+      "done": 18,
+      "total": 20
+    },
+    "children": [
+      {
+        "type": "phase",
+        "id": "compass-scoping-and-bounds",
+        "canonicalId": "compass-scoping-and-bounds",
+        "status": "COMPLETE",
+        "progress": {
+          "done": 18,
+          "total": 20
+        },
+        "children": [
+          {
+            "type": "change",
+            "id": "C-001",
+            "status": "COMPLETE",
+            "progress": {
+              "done": 5,
+              "total": 5
+            }
+          },
+          {
+            "type": "change",
+            "id": "C-002",
+            "status": "COMPLETE",
+            "progress": {
+              "done": 4,
+              "total": 4
+            }
+          },
+          {
+            "type": "change",
+            "id": "C-003",
+            "status": "COMPLETE",
+            "progress": {
+              "done": 4,
+              "total": 4
+            }
+          },
+          {
+            "type": "change",
+            "id": "C-004",
+            "status": "COMPLETE",
+            "progress": {
+              "done": 4,
+              "total": 4
+            }
+          },
+          {
+            "type": "change",
+            "id": "C-005",
+            "status": "COMPLETE",
+            "progress": {
+              "done": 4,
+              "total": 4
+            }
+          },
+          {
+            "type": "change",
+            "id": "C-006",
+            "status": "COMPLETE",
+            "progress": {
+              "done": 3,
+              "total": 3
+            }
+          },
+          {
+            "type": "change",
+            "id": "C-007",
+            "status": "COMPLETE",
+            "progress": {
+              "done": 4,
+              "total": 4
+            }
+          },
+          {
+            "type": "change",
+            "id": "C-008",
+            "status": "COMPLETE",
+            "progress": {
+              "done": 4,
+              "total": 4
+            }
+          },
+          {
+            "type": "change",
+            "id": "C-009",
+            "status": "COMPLETE",
+            "progress": {
+              "done": 4,
+              "total": 4
+            }
+          },
+          {
+            "type": "change",
+            "id": "C-010",
+            "status": "COMPLETE",
+            "progress": {
+              "done": 4,
+              "total": 4
+            }
+          },
+          {
+            "type": "change",
+            "id": "C-011",
+            "status": "COMPLETE",
+            "progress": {
+              "done": 4,
+              "total": 4
+            }
+          },
+          {
+            "type": "change",
+            "id": "C-012",
+            "status": "COMPLETE",
+            "progress": {
+              "done": 6,
+              "total": 6
+            }
+          },
+          {
+            "type": "change",
+            "id": "C-013",
+            "status": "COMPLETE",
+            "progress": {
+              "done": 7,
+              "total": 7
+            }
+          },
+          {
+            "type": "change",
+            "id": "C-014",
+            "status": "COMPLETE",
+            "progress": {
+              "done": 4,
+              "total": 4
+            }
+          },
+          {
+            "type": "change",
+            "id": "C-015",
+            "status": "SKIPPED",
+            "progress": {
+              "done": 3,
+              "total": 4
+            }
+          },
+          {
+            "type": "change",
+            "id": "C-016",
+            "status": "COMPLETE",
+            "progress": {
+              "done": 4,
+              "total": 4
+            }
+          },
+          {
+            "type": "change",
+            "id": "C-017",
+            "status": "COMPLETE",
+            "progress": {
+              "done": 4,
+              "total": 4
+            }
+          },
+          {
+            "type": "change",
+            "id": "C-018",
+            "status": "COMPLETE",
+            "progress": {
+              "done": 5,
+              "total": 5
+            }
+          },
+          {
+            "type": "change",
+            "id": "C-019",
+            "status": "COMPLETE",
+            "progress": {
+              "done": 4,
+              "total": 4
+            }
+          },
+          {
+            "type": "change",
+            "id": "C-020",
+            "status": "SKIPPED",
+            "progress": {
+              "done": 0,
+              "total": 0
+            }
+          }
+        ],
+        "annotations": []
+      }
+    ],
+    "annotations": []
+  }
+}
diff --git a/.kbd-orchestrator/project.json b/.kbd-orchestrator/project.json
index c9117da62..bd1912651 100644
--- a/.kbd-orchestrator/project.json
+++ b/.kbd-orchestrator/project.json
@@ -1,7 +1,7 @@
 {
   "name": "Compass",
   "description": "Native local-first knowledge graph engine for source code and project artifacts",
-  "active_phase": "compass-scoping-and-bounds",
+  "activePhase": "compass-scoping-and-bounds",
   "worktreeRoot": "${HOME}/.claude/worktrees",
   "maxChildDepth": 4,
   "ux_profile": "advanced",
@@ -11,8 +11,8 @@
   ],
   "openspec_available": true,
   "constraint_file": ".kbd-orchestrator/constraints.md",
-  "build_health_command": "cargo check --workspace --locked",
-  "test_command": "cargo test --workspace --lib --bins --locked",
+  "build_health_command": "cargo test --workspace --test '*' --locked --no-run",
+  "test_command": "cargo test --workspace --test '*' --locked",
   "lint_command": "cargo clippy --workspace --lib --bins --locked -- -D warnings",
   "dev_command": null,
   "preferred_planning_agent": "claude",
@@ -59,7 +59,12 @@
       "evolver-execute-medium": "medium",
       "evolver-execute-high": "frontier",
       "evolver-reflect": "frontier",
-      "evolver-status": "small"
+      "evolver-status": "small",
+      "creator-specify": "frontier",
+      "creator-plan": "frontier",
+      "creator-execute": "tiered",
+      "creator-reflect": "frontier",
+      "creator-persist": "small"
     },
     "active_environment": "local"
   },
@@ -92,16 +97,16 @@
       ]
     }
   },
-  "focus_project_path": "/Users/gqadonis/Projects/references/compass",
+  "focus_project_path": ".",
   "workspace": {
     "workspace_file": null,
     "folders": [
       {
-        "path": "/Users/gqadonis/Projects/references/compass",
+        "path": ".",
         "role": "focus",
         "purpose": "Active project \u2014 all KBD operations target this directory",
         "write_access": true
       }
     ]
   }
-}
\ No newline at end of file
+}
diff --git a/.kimi/skills/openspec-apply-change/SKILL.md b/.kimi/skills/openspec-apply-change/SKILL.md
deleted file mode 100644
index 1375861c3..000000000
--- a/.kimi/skills/openspec-apply-change/SKILL.md
+++ /dev/null
@@ -1,160 +0,0 @@
----
-name: openspec-apply-change
-description: Implement tasks from an OpenSpec change. Use when the user wants to start implementing, continue implementation, or work through tasks.
-allowed-tools: Bash(openspec:*)
-license: MIT
-compatibility: Requires openspec CLI.
-metadata:
-  author: openspec
-  version: "1.0"
-  generatedBy: "1.6.0"
----
-
-Implement tasks from an OpenSpec change.
-
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
-
-**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
-
-**Steps**
-
-1. **Select the change**
-
-   If a name is provided, use it. Otherwise:
-   - Infer from conversation context if the user mentioned a change
-   - Auto-select if only one active change exists
-   - If ambiguous, run `openspec list --json` to get available changes and use the **AskUserQuestion tool** to let the user select
-
-   Always announce: "Using change: <name>" and how to override (e.g., `/opsx:apply <other>`).
-
-2. **Check status to understand the schema**
-   ```bash
-   openspec status --change "<name>" --json
-   ```
-   Parse the JSON to understand:
-   - `schemaName`: The workflow being used (e.g., "spec-driven")
-   - `planningHome`, `changeRoot`, and `actionContext`: planning scope and edit constraints
-   - Which artifact contains the tasks (typically "tasks" for spec-driven, check status for others)
-
-3. **Get apply instructions**
-
-   ```bash
-   openspec instructions apply --change "<name>" --json
-   ```
-
-   This returns:
-   - `contextFiles`: artifact ID -> array of concrete file paths (varies by schema - could be proposal/specs/design/tasks or spec/tests/implementation/docs)
-   - Progress (total, complete, remaining)
-   - Task list with status
-   - Dynamic instruction based on current state
-
-   **Handle states:**
-   - If `state: "blocked"` (missing artifacts): show message, suggest using openspec-continue-change
-   - If `state: "all_done"`: congratulate, suggest archive
-   - Otherwise: proceed to implementation
-
-4. **Read context files**
-
-   Read every file path listed under `contextFiles` from the apply instructions output.
-   The files depend on the schema being used:
-   - **spec-driven**: proposal, specs, design, tasks
-   - Other schemas: follow the contextFiles from CLI output
-
-5. **Show current progress**
-
-   Display:
-   - Schema being used
-   - Progress: "N/M tasks complete"
-   - Remaining tasks overview
-   - Dynamic instruction from CLI
-
-6. **Implement tasks (loop until done or blocked)**
-
-   For each pending task:
-   - Show which task is being worked on
-   - Make the code changes required
-   - Keep changes minimal and focused
-   - Mark task complete in the tasks file: `- [ ]` → `- [x]`
-   - Continue to next task
-
-   **Pause if:**
-   - Task is unclear → ask for clarification
-   - Implementation reveals a design issue → suggest updating artifacts
-   - Error or blocker encountered → report and wait for guidance
-   - User interrupts
-
-7. **On completion or pause, show status**
-
-   Display:
-   - Tasks completed this session
-   - Overall progress: "N/M tasks complete"
-   - If all done: suggest archive
-   - If paused: explain why and wait for guidance
-
-**Output During Implementation**
-
-```
-## Implementing: <change-name> (schema: <schema-name>)
-
-Working on task 3/7: <task description>
-[...implementation happening...]
-✓ Task complete
-
-Working on task 4/7: <task description>
-[...implementation happening...]
-✓ Task complete
-```
-
-**Output On Completion**
-
-```
-## Implementation Complete
-
-**Change:** <change-name>
-**Schema:** <schema-name>
-**Progress:** 7/7 tasks complete ✓
-
-### Completed This Session
-- [x] Task 1
-- [x] Task 2
-...
-
-All tasks complete! Ready to archive this change.
-```
-
-**Output On Pause (Issue Encountered)**
-
-```
-## Implementation Paused
-
-**Change:** <change-name>
-**Schema:** <schema-name>
-**Progress:** 4/7 tasks complete
-
-### Issue Encountered
-<description of the issue>
-
-**Options:**
-1. <option 1>
-2. <option 2>
-3. Other approach
-
-What would you like to do?
-```
-
-**Guardrails**
-- Keep going through tasks until done or blocked
-- Always read context files before starting (from the apply instructions output)
-- If task is ambiguous, pause and ask before implementing
-- If implementation reveals issues, pause and suggest artifact updates
-- Keep code changes minimal and scoped to each task
-- Update task checkbox immediately after completing each task
-- Pause on errors, blockers, or unclear requirements - don't guess
-- Use contextFiles from CLI output, don't assume specific file names
-
-**Fluid Workflow Integration**
-
-This skill supports the "actions on a change" model:
-
-- **Can be invoked anytime**: Before all artifacts are done (if tasks exist), after partial implementation, interleaved with other actions
-- **Allows artifact updates**: If implementation reveals design issues, suggest updating artifacts - not phase-locked, work fluidly
diff --git a/.kimi/skills/openspec-archive-change/SKILL.md b/.kimi/skills/openspec-archive-change/SKILL.md
deleted file mode 100644
index c0c169d14..000000000
--- a/.kimi/skills/openspec-archive-change/SKILL.md
+++ /dev/null
@@ -1,118 +0,0 @@
----
-name: openspec-archive-change
-description: Archive a completed change in the experimental workflow. Use when the user wants to finalize and archive a change after implementation is complete.
-allowed-tools: Bash(openspec:*)
-license: MIT
-compatibility: Requires openspec CLI.
-metadata:
-  author: openspec
-  version: "1.0"
-  generatedBy: "1.6.0"
----
-
-Archive a completed change in the experimental workflow.
-
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
-
-**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
-
-**Steps**
-
-1. **If no change name provided, prompt for selection**
-
-   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
-
-   Show only active changes (not already archived).
-   Include the schema used for each change if available.
-
-   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
-
-2. **Check artifact completion status**
-
-   Run `openspec status --change "<name>" --json` to check artifact completion.
-
-   Parse the JSON to understand:
-   - `schemaName`: The workflow being used
-   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context
-   - `artifacts`: List of artifacts with their status (`done` or other)
-
-   **If any artifacts are not `done`:**
-   - Display warning listing incomplete artifacts
-   - Use **AskUserQuestion tool** to confirm user wants to proceed
-   - Proceed if user confirms
-
-3. **Check task completion status**
-
-   Read the tasks file (typically `tasks.md`) to check for incomplete tasks.
-
-   Count tasks marked with `- [ ]` (incomplete) vs `- [x]` (complete).
-
-   **If incomplete tasks found:**
-   - Display warning showing count of incomplete tasks
-   - Use **AskUserQuestion tool** to confirm user wants to proceed
-   - Proceed if user confirms
-
-   **If no tasks file exists:** Proceed without task-related warning.
-
-4. **Assess delta spec sync state**
-
-   Use `artifactPaths.specs.existingOutputPaths` from status JSON to check for delta specs. If none exist, proceed without sync prompt.
-
-   **If delta specs exist:**
-   - Compare each delta spec with its corresponding main spec at `openspec/specs/<capability>/spec.md`
-   - Determine what changes would be applied (adds, modifications, removals, renames)
-   - Show a combined summary before prompting
-
-   **Prompt options:**
-   - If changes needed: "Sync now (recommended)", "Archive without syncing"
-   - If already synced: "Archive now", "Sync anyway", "Cancel"
-
-   If user chooses sync, use Task tool (subagent_type: "general-purpose", prompt: "Use Skill tool to invoke openspec-sync-specs for change '<name>'. Delta spec analysis: <include the analyzed delta spec summary>"). Proceed to archive regardless of choice.
-
-5. **Perform the archive**
-
-   Create an `archive` directory under `planningHome.changesDir` if it doesn't exist:
-   ```bash
-   mkdir -p "<planningHome.changesDir>/archive"
-   ```
-
-   Generate target name using current date: `YYYY-MM-DD-<change-name>`
-
-   **Check if target already exists:**
-   - If yes: Fail with error, suggest renaming existing archive or using different date
-   - If no: Move `changeRoot` to the archive directory
-
-   ```bash
-   mv "<changeRoot>" "<planningHome.changesDir>/archive/YYYY-MM-DD-<name>"
-   ```
-
-6. **Display summary**
-
-   Show archive completion summary including:
-   - Change name
-   - Schema that was used
-   - Archive location
-   - Whether specs were synced (if applicable)
-   - Note about any warnings (incomplete artifacts/tasks)
-
-**Output On Success**
-
-```
-## Archive Complete
-
-**Change:** <change-name>
-**Schema:** <schema-name>
-**Archived to:** the archive path derived from `planningHome.changesDir`/YYYY-MM-DD-<name>/
-**Specs:** ✓ Synced to main specs (or "No delta specs" or "Sync skipped")
-
-All artifacts complete. All tasks complete.
-```
-
-**Guardrails**
-- Always prompt for change selection if not provided
-- Use artifact graph (openspec status --json) for completion checking
-- Don't block archive on warnings - just inform and confirm
-- Preserve .openspec.yaml when moving to archive (it moves with the directory)
-- Show clear summary of what happened
-- If sync is requested, use openspec-sync-specs approach (agent-driven)
-- If delta specs exist, always run the sync assessment and show the combined summary before prompting
diff --git a/.kimi/skills/openspec-bulk-archive-change/SKILL.md b/.kimi/skills/openspec-bulk-archive-change/SKILL.md
deleted file mode 100644
index 309152af7..000000000
--- a/.kimi/skills/openspec-bulk-archive-change/SKILL.md
+++ /dev/null
@@ -1,249 +0,0 @@
----
-name: openspec-bulk-archive-change
-description: Archive multiple completed changes at once. Use when archiving several parallel changes.
-allowed-tools: Bash(openspec:*)
-license: MIT
-compatibility: Requires openspec CLI.
-metadata:
-  author: openspec
-  version: "1.0"
-  generatedBy: "1.6.0"
----
-
-Archive multiple completed changes in a single operation.
-
-This skill allows you to batch-archive changes, handling spec conflicts intelligently by checking the codebase to determine what's actually implemented.
-
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
-
-**Input**: None required (prompts for selection)
-
-**Steps**
-
-1. **Get active changes**
-
-   Run `openspec list --json` to get all active changes.
-
-   If no active changes exist, inform user and stop.
-
-2. **Prompt for change selection**
-
-   Use **AskUserQuestion tool** with multi-select to let user choose changes:
-   - Show each change with its schema
-   - Include an option for "All changes"
-   - Allow any number of selections (1+ works, 2+ is the typical use case)
-
-   **IMPORTANT**: Do NOT auto-select. Always let the user choose.
-
-3. **Batch validation - gather status for all selected changes**
-
-   For each selected change, collect:
-
-   a. **Artifact status** - Run `openspec status --change "<name>" --json`
-      - Parse `schemaName`, `artifacts`, `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`
-      - Note which artifacts are `done` vs other states
-
-   b. **Task completion** - Read `artifactPaths.tasks.existingOutputPaths` from status JSON
-      - Count `- [ ]` (incomplete) vs `- [x]` (complete)
-      - If no tasks file exists, note as "No tasks"
-
-   c. **Delta specs** - Check `artifactPaths.specs.existingOutputPaths` from status JSON
-      - List which capability specs exist
-      - For each, extract requirement names (lines matching `### Requirement: <name>`)
-
-4. **Detect spec conflicts**
-
-   Build a map of `capability -> [changes that touch it]`:
-
-   ```
-   auth -> [change-a, change-b]  <- CONFLICT (2+ changes)
-   api  -> [change-c]            <- OK (only 1 change)
-   ```
-
-   A conflict exists when 2+ selected changes have delta specs for the same capability.
-
-5. **Resolve conflicts agentically**
-
-   **For each conflict**, investigate the codebase:
-
-   a. **Read the delta specs** from each conflicting change to understand what each claims to add/modify
-
-   b. **Search the codebase** for implementation evidence:
-      - Look for code implementing requirements from each delta spec
-      - Check for related files, functions, or tests
-
-   c. **Determine resolution**:
-      - If only one change is actually implemented -> sync that one's specs
-      - If both implemented -> apply in chronological order (older first, newer overwrites)
-      - If neither implemented -> skip spec sync, warn user
-
-   d. **Record resolution** for each conflict:
-      - Which change's specs to apply
-      - In what order (if both)
-      - Rationale (what was found in codebase)
-
-6. **Show consolidated status table**
-
-   Display a table summarizing all changes:
-
-   ```
-   | Change              | Artifacts | Tasks | Specs   | Conflicts | Status |
-   |---------------------|-----------|-------|---------|-----------|--------|
-   | schema-management   | Done      | 5/5   | 2 delta | None      | Ready  |
-   | project-config      | Done      | 3/3   | 1 delta | None      | Ready  |
-   | add-oauth           | Done      | 4/4   | 1 delta | auth (!)  | Ready* |
-   | add-verify-skill    | 1 left    | 2/5   | None    | None      | Warn   |
-   ```
-
-   For conflicts, show the resolution:
-   ```
-   * Conflict resolution:
-     - auth spec: Will apply add-oauth then add-jwt (both implemented, chronological order)
-   ```
-
-   For incomplete changes, show warnings:
-   ```
-   Warnings:
-   - add-verify-skill: 1 incomplete artifact, 3 incomplete tasks
-   ```
-
-7. **Confirm batch operation**
-
-   Use **AskUserQuestion tool** with a single confirmation:
-
-   - "Archive N changes?" with options based on status
-   - Options might include:
-     - "Archive all N changes"
-     - "Archive only N ready changes (skip incomplete)"
-     - "Cancel"
-
-   If there are incomplete changes, make clear they'll be archived with warnings.
-
-8. **Execute archive for each confirmed change**
-
-   Process changes in the determined order (respecting conflict resolution):
-
-   a. **Sync specs** if delta specs exist:
-      - Use the openspec-sync-specs approach (agent-driven intelligent merge)
-      - For conflicts, apply in resolved order
-      - Track if sync was done
-
-   b. **Perform the archive**:
-      ```bash
-      mkdir -p "<planningHome.changesDir>/archive"
-      mv "<changeRoot>" "<planningHome.changesDir>/archive/YYYY-MM-DD-<name>"
-      ```
-
-   c. **Track outcome** for each change:
-      - Success: archived successfully
-      - Failed: error during archive (record error)
-      - Skipped: user chose not to archive (if applicable)
-
-9. **Display summary**
-
-   Show final results:
-
-   ```
-   ## Bulk Archive Complete
-
-   Archived 3 changes:
-   - schema-management-cli -> archive/2026-01-19-schema-management-cli/
-   - project-config -> archive/2026-01-19-project-config/
-   - add-oauth -> archive/2026-01-19-add-oauth/
-
-   Skipped 1 change:
-   - add-verify-skill (user chose not to archive incomplete)
-
-   Spec sync summary:
-   - 4 delta specs synced to main specs
-   - 1 conflict resolved (auth: applied both in chronological order)
-   ```
-
-   If any failures:
-   ```
-   Failed 1 change:
-   - some-change: Archive directory already exists
-   ```
-
-**Conflict Resolution Examples**
-
-Example 1: Only one implemented
-```
-Conflict: specs/auth/spec.md touched by [add-oauth, add-jwt]
-
-Checking add-oauth:
-- Delta adds "OAuth Provider Integration" requirement
-- Searching codebase... found src/auth/oauth.ts implementing OAuth flow
-
-Checking add-jwt:
-- Delta adds "JWT Token Handling" requirement
-- Searching codebase... no JWT implementation found
-
-Resolution: Only add-oauth is implemented. Will sync add-oauth specs only.
-```
-
-Example 2: Both implemented
-```
-Conflict: specs/api/spec.md touched by [add-rest-api, add-graphql]
-
-Checking add-rest-api (created 2026-01-10):
-- Delta adds "REST Endpoints" requirement
-- Searching codebase... found src/api/rest.ts
-
-Checking add-graphql (created 2026-01-15):
-- Delta adds "GraphQL Schema" requirement
-- Searching codebase... found src/api/graphql.ts
-
-Resolution: Both implemented. Will apply add-rest-api specs first,
-then add-graphql specs (chronological order, newer takes precedence).
-```
-
-**Output On Success**
-
-```
-## Bulk Archive Complete
-
-Archived N changes:
-- <change-1> -> archive/YYYY-MM-DD-<change-1>/
-- <change-2> -> archive/YYYY-MM-DD-<change-2>/
-
-Spec sync summary:
-- N delta specs synced to main specs
-- No conflicts (or: M conflicts resolved)
-```
-
-**Output On Partial Success**
-
-```
-## Bulk Archive Complete (partial)
-
-Archived N changes:
-- <change-1> -> archive/YYYY-MM-DD-<change-1>/
-
-Skipped M changes:
-- <change-2> (user chose not to archive incomplete)
-
-Failed K changes:
-- <change-3>: Archive directory already exists
-```
-
-**Output When No Changes**
-
-```
-## No Changes to Archive
-
-No active changes found. Create a new change to get started.
-```
-
-**Guardrails**
-- Allow any number of changes (1+ is fine, 2+ is the typical use case)
-- Always prompt for selection, never auto-select
-- Detect spec conflicts early and resolve by checking codebase
-- When both changes are implemented, apply specs in chronological order
-- Skip spec sync only when implementation is missing (warn user)
-- Show clear per-change status before confirming
-- Use single confirmation for entire batch
-- Track and report all outcomes (success/skip/fail)
-- Preserve .openspec.yaml when moving to archive
-- Archive directory target uses current date: YYYY-MM-DD-<name>
-- If archive target exists, fail that change but continue with others
diff --git a/.kimi/skills/openspec-explore/SKILL.md b/.kimi/skills/openspec-explore/SKILL.md
deleted file mode 100644
index 771271a8f..000000000
--- a/.kimi/skills/openspec-explore/SKILL.md
+++ /dev/null
@@ -1,290 +0,0 @@
----
-name: openspec-explore
-description: Enter explore mode - a thinking partner for exploring ideas, investigating problems, and clarifying requirements. Use when the user wants to think through something before or during a change.
-allowed-tools: Bash(openspec:*)
-license: MIT
-compatibility: Requires openspec CLI.
-metadata:
-  author: openspec
-  version: "1.0"
-  generatedBy: "1.6.0"
----
-
-Enter explore mode. Think deeply. Visualize freely. Follow the conversation wherever it goes.
-
-**IMPORTANT: Explore mode is for thinking, not implementing.** You may read files, search code, and investigate the codebase, but you must NEVER write code or implement features. If the user asks you to implement something, remind them to exit explore mode first and create a change proposal. You MAY create OpenSpec artifacts (proposals, designs, specs) if the user asks—that's capturing thinking, not implementing.
-
-**This is a stance, not a workflow.** There are no fixed steps, no required sequence, no mandatory outputs. You're a thinking partner helping the user explore.
-
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
-
----
-
-## The Stance
-
-- **Curious, not prescriptive** - Ask questions that emerge naturally, don't follow a script
-- **Open threads, not interrogations** - Surface multiple interesting directions and let the user follow what resonates. Don't funnel them through a single path of questions.
-- **Visual** - Use ASCII diagrams liberally when they'd help clarify thinking
-- **Adaptive** - Follow interesting threads, pivot when new information emerges
-- **Patient** - Don't rush to conclusions, let the shape of the problem emerge
-- **Grounded** - Explore the actual codebase when relevant, don't just theorize
-
----
-
-## What You Might Do
-
-Depending on what the user brings, you might:
-
-**Explore the problem space**
-- Ask clarifying questions that emerge from what they said
-- Challenge assumptions
-- Reframe the problem
-- Find analogies
-
-**Investigate the codebase**
-- Map existing architecture relevant to the discussion
-- Find integration points
-- Identify patterns already in use
-- Surface hidden complexity
-
-**Compare options**
-- Brainstorm multiple approaches
-- Build comparison tables
-- Sketch tradeoffs
-- Recommend a path (if asked)
-
-**Visualize**
-```
-┌─────────────────────────────────────────┐
-│     Use ASCII diagrams liberally        │
-├─────────────────────────────────────────┤
-│                                         │
-│      ┌────────┐         ┌────────┐      │
-│      │ State  │────────▶│ State  │      │
-│      │   A    │         │   B    │      │
-│      └────────┘         └────────┘      │
-│                                         │
-│   System diagrams, state machines,      │
-│   data flows, architecture sketches,    │
-│   dependency graphs, comparison tables  │
-│                                         │
-└─────────────────────────────────────────┘
-```
-
-**Surface risks and unknowns**
-- Identify what could go wrong
-- Find gaps in understanding
-- Suggest spikes or investigations
-
----
-
-## OpenSpec Awareness
-
-You have full context of the OpenSpec system. Use it naturally, don't force it.
-
-### Check for context
-
-At the start, quickly check what exists:
-```bash
-openspec list --json
-```
-
-This tells you:
-- If there are active changes
-- Their names, schemas, and status
-- What the user might be working on
-
-### When no change exists
-
-Think freely. When insights crystallize, you might offer:
-
-- "This feels solid enough to start a change. Want me to create a proposal?"
-- Or keep exploring - no pressure to formalize
-
-### When a change exists
-
-If the user mentions a change or you detect one is relevant:
-
-1. **Resolve and read existing artifacts for context**
-   - Run `openspec status --change "<name>" --json`.
-   - Use `changeRoot`, `artifactPaths`, and `actionContext` from the status JSON.
-   - Read existing files from `artifactPaths.<artifact>.existingOutputPaths`.
-
-2. **Reference them naturally in conversation**
-   - "Your design mentions using Redis, but we just realized SQLite fits better..."
-   - "The proposal scopes this to premium users, but we're now thinking everyone..."
-
-3. **Offer to capture when decisions are made**
-
-    | Insight Type               | Where to Capture               |
-    |----------------------------|--------------------------------|
-    | New requirement discovered | `specs/<capability>/spec.md` |
-    | Requirement changed        | `specs/<capability>/spec.md` |
-    | Design decision made       | `design.md`                  |
-    | Scope changed              | `proposal.md`                |
-    | New work identified        | `tasks.md`                   |
-    | Assumption invalidated     | Relevant artifact              |
-
-   Example offers:
-   - "That's a design decision. Capture it in design.md?"
-   - "This is a new requirement. Add it to specs?"
-   - "This changes scope. Update the proposal?"
-
-4. **The user decides** - Offer and move on. Don't pressure. Don't auto-capture.
-
----
-
-## What You Don't Have To Do
-
-- Follow a script
-- Ask the same questions every time
-- Produce a specific artifact
-- Reach a conclusion
-- Stay on topic if a tangent is valuable
-- Be brief (this is thinking time)
-
----
-
-## Handling Different Entry Points
-
-**User brings a vague idea:**
-```
-User: I'm thinking about adding real-time collaboration
-
-You: Real-time collab is a big space. Let me think about this...
-
-      COLLABORATION SPECTRUM
-      ════════════════════════════════════════════
-
-      Awareness          Coordination         Sync
-          │                   │                 │
-          ▼                   ▼                 ▼
-      ┌────────┐         ┌────────┐        ┌────────┐
-      │Presence│         │Cursors │        │  CRDT  │
-      │  "3    │         │ Multi  │        │Conflict│
-      │online" │         │ select │        │  free  │
-      └────────┘         └────────┘        └────────┘
-          │                   │                 │
-       trivial            moderate           complex
-
-      Where's your head at?
-```
-
-**User brings a specific problem:**
-```
-User: The auth system is a mess
-
-You: [reads codebase]
-
-     ┌─────────────────────────────────────────────┐
-     │              CURRENT AUTH FLOW              │
-     └─────────────────────────────────────────────┘
-                        │
-          ┌─────────────┼─────────────┐
-          ▼             ▼             ▼
-     ┌─────────┐  ┌─────────┐  ┌─────────┐
-     │ Google  │  │  GitHub │  │  Email  │
-     │  OAuth  │  │  OAuth  │  │  Magic  │
-     └────┬────┘  └────┬────┘  └────┬────┘
-          │             │             │
-          └─────────────┼─────────────┘
-                        ▼
-                  ┌───────────┐
-                  │  Session  │
-                  └─────┬─────┘
-                        │
-                        ▼
-                  ┌───────────┐
-                  │   Perms   │
-                  └───────────┘
-
-     I see three tangles. Which one's burning?
-```
-
-**User is stuck mid-implementation:**
-```
-User: /opsx:explore add-auth-system
-      The OAuth integration is more complex than expected
-
-You: [reads change artifacts]
-
-     You're on task 4: "Implement OAuth flow"
-
-     Let me trace what's involved...
-
-     [draws diagram, explores options, suggests paths]
-
-     Want to update the design to reflect this?
-     Or add a spike task to investigate?
-```
-
-**User wants to compare options:**
-```
-User: Should we use Postgres or SQLite?
-
-You: Generic answer is boring. What's the context?
-
-User: A CLI tool that tracks local dev environments
-
-You: That changes everything.
-
-     ┌─────────────────────────────────────────────────┐
-     │          CLI TOOL DATA STORAGE                  │
-     └─────────────────────────────────────────────────┘
-
-     Key constraints:
-     • No daemon running
-     • Must work offline
-     • Single user
-
-                  SQLite          Postgres
-     Deployment   embedded ✓      needs server ✗
-     Offline      yes ✓           no ✗
-     Single file  yes ✓           no ✗
-
-     SQLite. Not even close.
-
-     Unless... is there a sync component?
-```
-
----
-
-## Ending Discovery
-
-There's no required ending. Discovery might:
-
-- **Flow into a proposal**: "Ready to start? I can create a change proposal."
-- **Result in artifact updates**: "Updated design.md with these decisions"
-- **Just provide clarity**: User has what they need, moves on
-- **Continue later**: "We can pick this up anytime"
-
-When it feels like things are crystallizing, you might summarize:
-
-```
-## What We Figured Out
-
-**The problem**: [crystallized understanding]
-
-**The approach**: [if one emerged]
-
-**Open questions**: [if any remain]
-
-**Next steps** (if ready):
-- Create a change proposal
-- Keep exploring: just keep talking
-```
-
-But this summary is optional. Sometimes the thinking IS the value.
-
----
-
-## Guardrails
-
-- **Don't implement** - Never write code or implement features. Creating OpenSpec artifacts is fine, writing application code is not.
-- **Don't fake understanding** - If something is unclear, dig deeper
-- **Don't rush** - Discovery is thinking time, not task time
-- **Don't force structure** - Let patterns emerge naturally
-- **Don't auto-capture** - Offer to save insights, don't just do it
-- **Do visualize** - A good diagram is worth many paragraphs
-- **Do explore the codebase** - Ground discussions in reality
-- **Do question assumptions** - Including the user's and your own
diff --git a/.kimi/skills/openspec-ff-change/SKILL.md b/.kimi/skills/openspec-ff-change/SKILL.md
deleted file mode 100644
index 61fab93de..000000000
--- a/.kimi/skills/openspec-ff-change/SKILL.md
+++ /dev/null
@@ -1,105 +0,0 @@
----
-name: openspec-ff-change
-description: Fast-forward through OpenSpec artifact creation. Use when the user wants to quickly create all artifacts needed for implementation without stepping through each one individually.
-allowed-tools: Bash(openspec:*)
-license: MIT
-compatibility: Requires openspec CLI.
-metadata:
-  author: openspec
-  version: "1.0"
-  generatedBy: "1.6.0"
----
-
-Fast-forward through artifact creation - generate everything needed to start implementation in one go.
-
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
-
-**Input**: The user's request should include a change name (kebab-case) OR a description of what they want to build.
-
-**Steps**
-
-1. **If no clear input provided, ask what they want to build**
-
-   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
-   > "What change do you want to work on? Describe what you want to build or fix."
-
-   From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
-
-   **IMPORTANT**: Do NOT proceed without understanding what the user wants to build.
-
-2. **Create the change directory**
-   ```bash
-   openspec new change "<name>"
-   ```
-   This creates a scaffolded change in the planning home resolved by the CLI.
-
-3. **Get the artifact build order**
-   ```bash
-   openspec status --change "<name>" --json
-   ```
-   Parse the JSON to get:
-   - `applyRequires`: array of artifact IDs needed before implementation (e.g., `["tasks"]`)
-   - `artifacts`: list of all artifacts with their status and dependencies
-   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context. Use these instead of assuming repo-local paths.
-
-4. **Create artifacts in sequence until apply-ready**
-
-   Use the **TodoWrite tool** to track progress through the artifacts.
-
-   Loop through artifacts in dependency order (artifacts with no pending dependencies first):
-
-   a. **For each artifact that is `ready` (dependencies satisfied)**:
-      - Get instructions:
-        ```bash
-        openspec instructions <artifact-id> --change "<name>" --json
-        ```
-      - The instructions JSON includes:
-        - `context`: Project background (constraints for you - do NOT include in output)
-        - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
-        - `template`: The structure to use for your output file
-        - `instruction`: Schema-specific guidance for this artifact type
-        - `resolvedOutputPath`: Resolved path or pattern to write the artifact
-        - `dependencies`: Completed artifacts to read for context
-      - Read any completed dependency files for context
-      - Create the artifact file using `template` as the structure and write it to `resolvedOutputPath`
-      - Apply `context` and `rules` as constraints - but do NOT copy them into the file
-      - Show brief progress: "✓ Created <artifact-id>"
-
-   b. **Continue until all `applyRequires` artifacts are complete**
-      - After creating each artifact, re-run `openspec status --change "<name>" --json`
-      - Check if every artifact ID in `applyRequires` has `status: "done"` in the artifacts array
-      - Stop when all `applyRequires` artifacts are done
-
-   c. **If an artifact requires user input** (unclear context):
-      - Use **AskUserQuestion tool** to clarify
-      - Then continue with creation
-
-5. **Show final status**
-   ```bash
-   openspec status --change "<name>"
-   ```
-
-**Output**
-
-After completing all artifacts, summarize:
-- Change name and location
-- List of artifacts created with brief descriptions
-- What's ready: "All artifacts created! Ready for implementation."
-- Prompt: "Run `/opsx:apply` or ask me to implement to start working on the tasks."
-
-**Artifact Creation Guidelines**
-
-- Follow the `instruction` field from `openspec instructions` for each artifact type
-- The schema defines what each artifact should contain - follow it
-- Read dependency artifacts for context before creating new ones
-- Use `template` as the structure for your output file - fill in its sections
-- **IMPORTANT**: `context` and `rules` are constraints for YOU, not content for the file
-  - Do NOT copy `<context>`, `<rules>`, `<project_context>` blocks into the artifact
-  - These guide what you write, but should never appear in the output
-
-**Guardrails**
-- Create ALL artifacts needed for implementation (as defined by schema's `apply.requires`)
-- Always read dependency artifacts before creating a new one
-- If context is critically unclear, ask the user - but prefer making reasonable decisions to keep momentum
-- If a change with that name already exists, suggest continuing that change instead
-- Verify each artifact file exists after writing before proceeding to next
diff --git a/.kimi/skills/openspec-onboard/SKILL.md b/.kimi/skills/openspec-onboard/SKILL.md
deleted file mode 100644
index ac4ac6fee..000000000
--- a/.kimi/skills/openspec-onboard/SKILL.md
+++ /dev/null
@@ -1,555 +0,0 @@
----
-name: openspec-onboard
-description: Guided onboarding for OpenSpec - walk through a complete workflow cycle with narration and real codebase work.
-allowed-tools: Bash(openspec:*)
-license: MIT
-compatibility: Requires openspec CLI.
-metadata:
-  author: openspec
-  version: "1.0"
-  generatedBy: "1.6.0"
----
-
-Guide the user through their first complete OpenSpec workflow cycle. This is a teaching experience—you'll do real work in their codebase while explaining each step.
-
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
-
----
-
-## Preflight
-
-Before starting, check if the OpenSpec CLI is installed:
-
-```bash
-# Unix/macOS
-openspec --version 2>&1 || echo "CLI_NOT_INSTALLED"
-# Windows (PowerShell)
-# if (Get-Command openspec -ErrorAction SilentlyContinue) { openspec --version } else { echo "CLI_NOT_INSTALLED" }
-```
-
-**If CLI not installed:**
-> OpenSpec CLI is not installed. Install it first, then come back to `/opsx:onboard`.
-
-Stop here if not installed.
-
----
-
-## Phase 1: Welcome
-
-Display:
-
-```
-## Welcome to OpenSpec!
-
-I'll walk you through a complete change cycle—from idea to implementation—using a real task in your codebase. Along the way, you'll learn the workflow by doing it.
-
-**What we'll do:**
-1. Pick a small, real task in your codebase
-2. Explore the problem briefly
-3. Create a change (the container for our work)
-4. Build the artifacts: proposal → specs → design → tasks
-5. Implement the tasks
-6. Archive the completed change
-
-**Time:** ~15-20 minutes
-
-Let's start by finding something to work on.
-```
-
----
-
-## Phase 2: Task Selection
-
-### Codebase Analysis
-
-Scan the codebase for small improvement opportunities. Look for:
-
-1. **TODO/FIXME comments** - Search for `TODO`, `FIXME`, `HACK`, `XXX` in code files
-2. **Missing error handling** - `catch` blocks that swallow errors, risky operations without try-catch
-3. **Functions without tests** - Cross-reference `src/` with test directories
-4. **Type issues** - `any` types in TypeScript files (`: any`, `as any`)
-5. **Debug artifacts** - `console.log`, `console.debug`, `debugger` statements in non-debug code
-6. **Missing validation** - User input handlers without validation
-
-Also check recent git activity:
-```bash
-# Unix/macOS
-git log --oneline -10 2>/dev/null || echo "No git history"
-# Windows (PowerShell)
-# git log --oneline -10 2>$null; if ($LASTEXITCODE -ne 0) { echo "No git history" }
-```
-
-### Present Suggestions
-
-From your analysis, present 3-4 specific suggestions:
-
-```
-## Task Suggestions
-
-Based on scanning your codebase, here are some good starter tasks:
-
-**1. [Most promising task]**
-   Location: `src/path/to/file.ts:42`
-   Scope: ~1-2 files, ~20-30 lines
-   Why it's good: [brief reason]
-
-**2. [Second task]**
-   Location: `src/another/file.ts`
-   Scope: ~1 file, ~15 lines
-   Why it's good: [brief reason]
-
-**3. [Third task]**
-   Location: [location]
-   Scope: [estimate]
-   Why it's good: [brief reason]
-
-**4. Something else?**
-   Tell me what you'd like to work on.
-
-Which task interests you? (Pick a number or describe your own)
-```
-
-**If nothing found:** Fall back to asking what the user wants to build:
-> I didn't find obvious quick wins in your codebase. What's something small you've been meaning to add or fix?
-
-### Scope Guardrail
-
-If the user picks or describes something too large (major feature, multi-day work):
-
-```
-That's a valuable task, but it's probably larger than ideal for your first OpenSpec run-through.
-
-For learning the workflow, smaller is better—it lets you see the full cycle without getting stuck in implementation details.
-
-**Options:**
-1. **Slice it smaller** - What's the smallest useful piece of [their task]? Maybe just [specific slice]?
-2. **Pick something else** - One of the other suggestions, or a different small task?
-3. **Do it anyway** - If you really want to tackle this, we can. Just know it'll take longer.
-
-What would you prefer?
-```
-
-Let the user override if they insist—this is a soft guardrail.
-
----
-
-## Phase 3: Explore Demo
-
-Once a task is selected, briefly demonstrate explore mode:
-
-```
-Before we create a change, let me quickly show you **explore mode**—it's how you think through problems before committing to a direction.
-```
-
-Spend 1-2 minutes investigating the relevant code:
-- Read the file(s) involved
-- Draw a quick ASCII diagram if it helps
-- Note any considerations
-
-```
-## Quick Exploration
-
-[Your brief analysis—what you found, any considerations]
-
-┌─────────────────────────────────────────┐
-│   [Optional: ASCII diagram if helpful]  │
-└─────────────────────────────────────────┘
-
-Explore mode (`/opsx:explore`) is for this kind of thinking—investigating before implementing. You can use it anytime you need to think through a problem.
-
-Now let's create a change to hold our work.
-```
-
-**PAUSE** - Wait for user acknowledgment before proceeding.
-
----
-
-## Phase 4: Create the Change
-
-**EXPLAIN:**
-```
-## Creating a Change
-
-A "change" in OpenSpec is a container for all the thinking and planning around a piece of work. It lives at the `changeRoot` reported by `openspec status --change "<name>" --json` and holds your artifacts—proposal, specs, design, tasks.
-
-Let me create one for our task.
-```
-
-**DO:** Create the change with a derived kebab-case name:
-```bash
-openspec new change "<derived-name>"
-```
-
-**SHOW:**
-```
-Created: <changeRoot from status JSON>
-
-The folder structure:
-```
-<changeRoot>/
-├── proposal.md    ← Why we're doing this (empty, we'll fill it)
-├── design.md      ← How we'll build it (empty)
-├── specs/         ← Detailed requirements (empty)
-└── tasks.md       ← Implementation checklist (empty)
-```
-
-Now let's fill in the first artifact—the proposal.
-```
-
----
-
-## Phase 5: Proposal
-
-**EXPLAIN:**
-```
-## The Proposal
-
-The proposal captures **why** we're making this change and **what** it involves at a high level. It's the "elevator pitch" for the work.
-
-I'll draft one based on our task.
-```
-
-**DO:** Draft the proposal content (don't save yet):
-
-```
-Here's a draft proposal:
-
----
-
-## Why
-
-[1-2 sentences explaining the problem/opportunity]
-
-## What Changes
-
-[Bullet points of what will be different]
-
-## Capabilities
-
-### New Capabilities
-- `<capability-name>`: [brief description]
-
-### Modified Capabilities
-<!-- If modifying existing behavior -->
-
-## Impact
-
-- `src/path/to/file.ts`: [what changes]
-- [other files if applicable]
-
----
-
-Does this capture the intent? I can adjust before we save it.
-```
-
-**PAUSE** - Wait for user approval/feedback.
-
-After approval, save the proposal:
-```bash
-openspec instructions proposal --change "<name>" --json
-```
-Then write the content to the `resolvedOutputPath` from `openspec instructions proposal --change "<name>" --json`.
-
-```
-Proposal saved. This is your "why" document—you can always come back and refine it as understanding evolves.
-
-Next up: specs.
-```
-
----
-
-## Phase 6: Specs
-
-**EXPLAIN:**
-```
-## Specs
-
-Specs define **what** we're building in precise, testable terms. They use a requirement/scenario format that makes expected behavior crystal clear.
-
-For a small task like this, we might only need one spec file.
-```
-
-**DO:** Resolve where the spec file should be created:
-```bash
-openspec instructions specs --change "<name>" --json
-# Use resolvedOutputPath from the JSON. If it is a glob, choose the concrete file path using the schema instruction and the change's context.
-```
-
-Draft the spec content:
-
-```
-Here's the spec:
-
----
-
-## ADDED Requirements
-
-### Requirement: <Name>
-
-<Description of what the system should do>
-
-#### Scenario: <Scenario name>
-
-- **WHEN** <trigger condition>
-- **THEN** <expected outcome>
-- **AND** <additional outcome if needed>
-
----
-
-This format—WHEN/THEN/AND—makes requirements testable. You can literally read them as test cases.
-```
-
-Save to the concrete file path chosen from `resolvedOutputPath`.
-
----
-
-## Phase 7: Design
-
-**EXPLAIN:**
-```
-## Design
-
-The design captures **how** we'll build it—technical decisions, tradeoffs, approach.
-
-For small changes, this might be brief. That's fine—not every change needs deep design discussion.
-```
-
-**DO:** Draft design.md:
-
-```
-Here's the design:
-
----
-
-## Context
-
-[Brief context about the current state]
-
-## Goals / Non-Goals
-
-**Goals:**
-- [What we're trying to achieve]
-
-**Non-Goals:**
-- [What's explicitly out of scope]
-
-## Decisions
-
-### Decision 1: [Key decision]
-
-[Explanation of approach and rationale]
-
----
-
-For a small task, this captures the key decisions without over-engineering.
-```
-
-Save to the `resolvedOutputPath` from `openspec instructions design --change "<name>" --json`.
-
----
-
-## Phase 8: Tasks
-
-**EXPLAIN:**
-```
-## Tasks
-
-Finally, we break the work into implementation tasks—checkboxes that drive the apply phase.
-
-These should be small, clear, and in logical order.
-```
-
-**DO:** Generate tasks based on specs and design:
-
-```
-Here are the implementation tasks:
-
----
-
-## 1. [Category or file]
-
-- [ ] 1.1 [Specific task]
-- [ ] 1.2 [Specific task]
-
-## 2. Verify
-
-- [ ] 2.1 [Verification step]
-
----
-
-Each checkbox becomes a unit of work in the apply phase. Ready to implement?
-```
-
-**PAUSE** - Wait for user to confirm they're ready to implement.
-
-Save to the `resolvedOutputPath` from `openspec instructions tasks --change "<name>" --json`.
-
----
-
-## Phase 9: Apply (Implementation)
-
-**EXPLAIN:**
-```
-## Implementation
-
-Now we implement each task, checking them off as we go. I'll announce each one and occasionally note how the specs/design informed the approach.
-```
-
-**DO:** For each task:
-
-1. Announce: "Working on task N: [description]"
-2. Implement the change in the codebase
-3. Reference specs/design naturally: "The spec says X, so I'm doing Y"
-4. Mark complete in tasks.md: `- [ ]` → `- [x]`
-5. Brief status: "✓ Task N complete"
-
-Keep narration light—don't over-explain every line of code.
-
-After all tasks:
-
-```
-## Implementation Complete
-
-All tasks done:
-- [x] Task 1
-- [x] Task 2
-- [x] ...
-
-The change is implemented! One more step—let's archive it.
-```
-
----
-
-## Phase 10: Archive
-
-**EXPLAIN:**
-```
-## Archiving
-
-When a change is complete, we archive it. The archive path is derived from `planningHome.changesDir` and the date.
-
-Archived changes become your project's decision history—you can always find them later to understand why something was built a certain way.
-```
-
-**DO:**
-```bash
-openspec archive "<name>"
-```
-
-**SHOW:**
-```
-Archived to: `<planningHome.changesDir>/archive/YYYY-MM-DD-<name>/`
-
-The change is now part of your project's history. The code is in your codebase, the decision record is preserved.
-```
-
----
-
-## Phase 11: Recap & Next Steps
-
-```
-## Congratulations!
-
-You just completed a full OpenSpec cycle:
-
-1. **Explore** - Thought through the problem
-2. **New** - Created a change container
-3. **Proposal** - Captured WHY
-4. **Specs** - Defined WHAT in detail
-5. **Design** - Decided HOW
-6. **Tasks** - Broke it into steps
-7. **Apply** - Implemented the work
-8. **Archive** - Preserved the record
-
-This same rhythm works for any size change—a small fix or a major feature.
-
----
-
-## Command Reference
-
-**Core workflow:**
-
- | Command           | What it does                               |
- |-------------------|--------------------------------------------|
- | `/opsx:propose` | Create a change and generate all artifacts |
- | `/opsx:explore` | Think through problems before/during work  |
- | `/opsx:apply`   | Implement tasks from a change              |
- | `/opsx:archive` | Archive a completed change                 |
-
-**Additional commands:**
-
- | Command            | What it does                                             |
- |--------------------|----------------------------------------------------------|
- | `/opsx:new`      | Start a new change, step through artifacts one at a time |
- | `/opsx:continue` | Continue working on an existing change                   |
- | `/opsx:ff`       | Fast-forward: create all artifacts at once               |
- | `/opsx:verify`   | Verify implementation matches artifacts                  |
-
----
-
-## What's Next?
-
-Try `/opsx:propose` on something you actually want to build. You've got the rhythm now!
-```
-
----
-
-## Graceful Exit Handling
-
-### User wants to stop mid-way
-
-If the user says they need to stop, want to pause, or seem disengaged:
-
-```
-No problem! Your change is saved at the `changeRoot` reported by `openspec status --change "<name>" --json`.
-
-To pick up where we left off later:
-- `/opsx:continue <name>` - Resume artifact creation
-- `/opsx:apply <name>` - Jump to implementation (if tasks exist)
-
-The work won't be lost. Come back whenever you're ready.
-```
-
-Exit gracefully without pressure.
-
-### User just wants command reference
-
-If the user says they just want to see the commands or skip the tutorial:
-
-```
-## OpenSpec Quick Reference
-
-**Core workflow:**
-
- | Command                  | What it does                               |
- |--------------------------|--------------------------------------------|
- | `/opsx:propose <name>` | Create a change and generate all artifacts |
- | `/opsx:explore`        | Think through problems (no code changes)   |
- | `/opsx:apply <name>`   | Implement tasks                            |
- | `/opsx:archive <name>` | Archive when done                          |
-
-**Additional commands:**
-
- | Command                   | What it does                        |
- |---------------------------|-------------------------------------|
- | `/opsx:new <name>`      | Start a new change, step by step    |
- | `/opsx:continue <name>` | Continue an existing change         |
- | `/opsx:ff <name>`       | Fast-forward: all artifacts at once |
- | `/opsx:verify <name>`   | Verify implementation               |
-
-Try `/opsx:propose` to start your first change.
-```
-
-Exit gracefully.
-
----
-
-## Guardrails
-
-- **Follow the EXPLAIN → DO → SHOW → PAUSE pattern** at key transitions (after explore, after proposal draft, after tasks, after archive)
-- **Keep narration light** during implementation—teach without lecturing
-- **Don't skip phases** even if the change is small—the goal is teaching the workflow
-- **Pause for acknowledgment** at marked points, but don't over-pause
-- **Handle exits gracefully**—never pressure the user to continue
-- **Use real codebase tasks**—don't simulate or use fake examples
-- **Adjust scope gently**—guide toward smaller tasks but respect user choice
diff --git a/.kimi/skills/openspec-sync-specs/SKILL.md b/.kimi/skills/openspec-sync-specs/SKILL.md
deleted file mode 100644
index b6aad67ab..000000000
--- a/.kimi/skills/openspec-sync-specs/SKILL.md
+++ /dev/null
@@ -1,148 +0,0 @@
----
-name: openspec-sync-specs
-description: Sync delta specs from a change to main specs. Use when the user wants to update main specs with changes from a delta spec, without archiving the change.
-allowed-tools: Bash(openspec:*)
-license: MIT
-compatibility: Requires openspec CLI.
-metadata:
-  author: openspec
-  version: "1.0"
-  generatedBy: "1.6.0"
----
-
-Sync delta specs from a change to main specs.
-
-This is an **agent-driven** operation - you will read delta specs and directly edit main specs to apply the changes. This allows intelligent merging (e.g., adding a scenario without copying the entire requirement).
-
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
-
-**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
-
-**Steps**
-
-1. **If no change name provided, prompt for selection**
-
-   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
-
-   Show changes that have delta specs (under `specs/` directory).
-
-   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
-
-2. **Resolve change context**
-
-   Run:
-   ```bash
-   openspec status --change "<name>" --json
-   ```
-
-3. **Find delta specs**
-
-   Use `artifactPaths.specs.existingOutputPaths` from the status JSON as the list of delta spec files.
-
-   Each delta spec file contains sections like:
-   - `## ADDED Requirements` - New requirements to add
-   - `## MODIFIED Requirements` - Changes to existing requirements
-   - `## REMOVED Requirements` - Requirements to remove
-   - `## RENAMED Requirements` - Requirements to rename (FROM:/TO: format)
-
-   If no delta specs found, inform user and stop.
-
-4. **For each delta spec, apply changes to main specs**
-
-   For each repo-local capability delta spec path returned by the CLI:
-
-   a. **Read the delta spec** to understand the intended changes
-
-   b. **Read the main spec** at `openspec/specs/<capability>/spec.md` (may not exist yet)
-
-   c. **Apply changes intelligently**:
-
-      **ADDED Requirements:**
-      - If requirement doesn't exist in main spec → add it
-      - If requirement already exists → update it to match (treat as implicit MODIFIED)
-
-      **MODIFIED Requirements:**
-      - Find the requirement in main spec
-      - Apply the changes - this can be:
-        - Adding new scenarios (don't need to copy existing ones)
-        - Modifying existing scenarios
-        - Changing the requirement description
-      - Preserve scenarios/content not mentioned in the delta
-
-      **REMOVED Requirements:**
-      - Remove the entire requirement block from main spec
-
-      **RENAMED Requirements:**
-      - Find the FROM requirement, rename to TO
-
-   d. **Create new main spec** if capability doesn't exist yet:
-      - Create `openspec/specs/<capability>/spec.md`
-      - Add Purpose section (can be brief, mark as TBD)
-      - Add Requirements section with the ADDED requirements
-
-5. **Show summary**
-
-   After applying all changes, summarize:
-   - Which capabilities were updated
-   - What changes were made (requirements added/modified/removed/renamed)
-
-**Delta Spec Format Reference**
-
-```markdown
-## ADDED Requirements
-
-### Requirement: New Feature
-The system SHALL do something new.
-
-#### Scenario: Basic case
-- **WHEN** user does X
-- **THEN** system does Y
-
-## MODIFIED Requirements
-
-### Requirement: Existing Feature
-#### Scenario: New scenario to add
-- **WHEN** user does A
-- **THEN** system does B
-
-## REMOVED Requirements
-
-### Requirement: Deprecated Feature
-
-## RENAMED Requirements
-
-- FROM: `### Requirement: Old Name`
-- TO: `### Requirement: New Name`
-```
-
-**Key Principle: Intelligent Merging**
-
-Unlike programmatic merging, you can apply **partial updates**:
-- To add a scenario, just include that scenario under MODIFIED - don't copy existing scenarios
-- The delta represents *intent*, not a wholesale replacement
-- Use your judgment to merge changes sensibly
-
-**Output On Success**
-
-```
-## Specs Synced: <change-name>
-
-Updated main specs:
-
-**<capability-1>**:
-- Added requirement: "New Feature"
-- Modified requirement: "Existing Feature" (added 1 scenario)
-
-**<capability-2>**:
-- Created new spec file
-- Added requirement: "Another Feature"
-
-Main specs are now updated. The change remains active - archive when implementation is complete.
-```
-
-**Guardrails**
-- Read both delta and main specs before making changes
-- Preserve existing content not mentioned in delta
-- If something is unclear, ask for clarification
-- Show what you're changing as you go
-- The operation should be idempotent - running twice should give same result
diff --git a/.opencode/commands/opsx-apply.md b/.opencode/commands/opsx-apply.md
index f5c574ffa..39ea6432c 100644
--- a/.opencode/commands/opsx-apply.md
+++ b/.opencode/commands/opsx-apply.md
@@ -1,12 +1,13 @@
 ---
-description: Implement tasks from an OpenSpec change (Experimental)
+description: "Implement tasks from an OpenSpec change (Experimental)"
 ---
 
 Implement tasks from an OpenSpec change.
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
 
 **Input**: Optionally specify a change name (e.g., `/opsx-apply add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+**Provided arguments**: $ARGUMENTS
 
 **Steps**
 
@@ -15,7 +16,7 @@ Implement tasks from an OpenSpec change.
    If a name is provided, use it. Otherwise:
    - Infer from conversation context if the user mentioned a change
    - Auto-select if only one active change exists
-   - If ambiguous, run `openspec list --json` to get available changes and use the **AskUserQuestion tool** to let the user select
+   - If ambiguous, run `openspec list --json` to get available changes and ask the user to select one
 
    Always announce: "Using change: <name>" and how to override (e.g., `/opsx-apply <other>`).
 
@@ -35,16 +36,33 @@ Implement tasks from an OpenSpec change.
    ```
 
    This returns:
-   - `contextFiles`: artifact ID -> array of concrete file paths (varies by schema)
+   - `contextFiles`: artifact ID -> array of concrete file paths (varies by schema - could be proposal/specs/design/tasks or spec/tests/implementation/docs)
    - Progress (total, complete, remaining)
    - Task list with status
    - Dynamic instruction based on current state
+   - Optional `context`: current required project instruction input from the selected root
+   - Optional `operationGuidance`: current advisory guidance for apply
 
    **Handle states:**
-   - If `state: "blocked"` (missing artifacts): show message, suggest using `/opsx-continue`
+   - If `state: "blocked"` (missing artifacts): show message, suggest using `/opsx-continue` (if it is not installed, run `openspec status --change "<name>" --json` to see the next artifact and `openspec instructions <artifact-id> --change "<name>" --json` for how to create it)
    - If `state: "all_done"`: congratulate, suggest archive
    - Otherwise: proceed to implementation
 
+   Treat `context` as a required prompt-level input. Read and consider it, and
+   apply relevant project facts, conventions, and constraints while implementing.
+   Treat `operationGuidance` as optional additive advice. Read and consider every
+   entry, and follow entries that are applicable and compatible with the built-in
+   workflow.
+
+   Keep both fields separate from CLI-returned state, missing artifacts, tasks,
+   progress, `contextFiles`, and the built-in `instruction`. They are not
+   evidence of task completion, do not replace the built-in instruction, and do
+   not permit bypassing a blocked state. If context conflicts with the built-in
+   instruction, an explicit user choice, or a CLI-controlled value, report the
+   conflict and preserve the controlling value. If guidance is inapplicable or
+   conflicts with those controlling inputs, do not follow it and explain why.
+   These are prompt-level behavior contracts, not enforceable checks.
+
 4. **Read context files**
 
    Read every file path listed under `contextFiles` from the apply instructions output.
@@ -52,6 +70,9 @@ Implement tasks from an OpenSpec change.
    - **spec-driven**: proposal, specs, design, tasks
    - Other schemas: follow the contextFiles from CLI output
 
+   Do not copy `context` or `operationGuidance` verbatim into implementation
+   files or planning artifacts unless the user separately asks for that content.
+
 5. **Show current progress**
 
    Display:
@@ -72,6 +93,7 @@ Implement tasks from an OpenSpec change.
    **Pause if:**
    - Task is unclear → ask for clarification
    - Implementation reveals a design issue → suggest updating artifacts
+   - A task needs work beyond what the spec and tasks describe, or you are tempted to drop, narrow, defer, or accept exceptions to specified behavior to make it fit → surface the added scope and ask; do not absorb it silently
    - Error or blocker encountered → report and wait for guidance
    - User interrupts
 
@@ -142,7 +164,14 @@ What would you like to do?
 - Keep code changes minimal and scoped to each task
 - Update task checkbox immediately after completing each task
 - Pause on errors, blockers, or unclear requirements - don't guess
+- When a task needs work beyond what the spec describes, surface the added scope and pause - never silently narrow, defer, or simplify away specified behavior
+- Only mark a task `- [x]` when its specified behavior is fully implemented, not when it is partially done or deferred
 - Use contextFiles from CLI output, don't assume specific file names
+- Do not use context or operation guidance as proof that a task is complete
+- Apply relevant project context; report conflicts with controlling workflow inputs
+- Consider every guidance entry; explain any inapplicable or conflicting advice
+- Do not copy runtime context or operation guidance into implementation files or planning artifacts
+- Preserve CLI-controlled blocked/ready/all-done behavior and completion criteria
 
 **Fluid Workflow Integration**
 
diff --git a/.opencode/commands/opsx-archive.md b/.opencode/commands/opsx-archive.md
index 7f3a696fc..6d99f3aff 100644
--- a/.opencode/commands/opsx-archive.md
+++ b/.opencode/commands/opsx-archive.md
@@ -1,23 +1,56 @@
 ---
-description: Archive a completed change in the experimental workflow
+description: "Archive a completed change in the experimental workflow"
 ---
 
 Archive a completed change in the experimental workflow.
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+`<capability-path>` is the spec directory relative to `specs/` (for example, `user-auth` or `identity/user-auth`). Preserve the full path from each delta spec when resolving its main spec.
 
 **Input**: Optionally specify a change name after `/opsx-archive` (e.g., `/opsx-archive add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+**Provided arguments**: $ARGUMENTS
 
 **Steps**
 
-1. **If no change name provided, prompt for selection**
+1. **Select the change**
 
-   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes and ask the user to select one
 
-   Show only active changes (not already archived).
+   When prompting, show only active changes (not already archived).
    Include the schema used for each change if available.
 
-   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+   Always announce: "Using change: <name>" and how to override (e.g., `/opsx-archive <other>`).
+
+   **Load current archive inputs before the existing archive checks:**
+
+   After resolving the selected change and planning root, run:
+   ```bash
+   openspec instructions archive --change "<name>" --json
+   ```
+   Keep the same selected-root flags on this command. This lookup is advisory and
+   optional: it only supplies extra prompt inputs, so it must never block archiving.
+   If it exits non-zero or returns invalid JSON — for example on an older CLI that
+   does not support this command yet — continue the archive workflow with no
+   context and no operation guidance. Do not report an error and do not stop.
+
+   A successful response may omit both optional fields. Treat `context` as a
+   required prompt-level input: read and consider it, and apply relevant project
+   facts, conventions, and constraints. Treat `operationGuidance` as optional
+   additive advice: read and consider every entry, and follow entries that are
+   applicable and compatible with the built-in archive workflow.
+
+   Keep both fields separate from built-in steps, explicit user choices, resolved
+   paths, CLI checks, and command contracts. If context conflicts with one of those
+   controlling inputs, report the conflict and preserve the controlling value. If
+   guidance is inapplicable or conflicts with a controlling input, do not follow it
+   and explain why. Do not infer replacement paths, skipped prompts, or flags from
+   either field, and do not copy their text verbatim into specs, change artifacts,
+   or archive summaries unless the user separately asks for it. These are
+   prompt-level behavior contracts, not enforceable checks.
 
 2. **Check artifact completion status**
 
@@ -26,9 +59,9 @@ Archive a completed change in the experimental workflow.
    Parse the JSON to understand:
    - `schemaName`: The workflow being used
    - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context
-   - `artifacts`: List of artifacts with their status (`done` or other)
+   - `artifacts`: List of artifacts with their status (`done`, `skipped`, or other)
 
-   **If any artifacts are not `done`:**
+   **If any artifacts are neither `done` nor `skipped`** (skipped artifacts satisfy the requirement - the change declares skip_specs):
    - Display warning listing incomplete artifacts
    - Prompt user for confirmation to continue
    - Proceed if user confirms
@@ -48,10 +81,13 @@ Archive a completed change in the experimental workflow.
 
 4. **Assess delta spec sync state**
 
-   Use `artifactPaths.specs.existingOutputPaths` from status JSON to check for delta specs. If none exist, proceed without sync prompt.
+   Use `artifactPaths.specs.existingOutputPaths` from status JSON as the only
+   delta-spec source. If the `specs` entry is missing or
+   `existingOutputPaths` is empty, proceed without a sync prompt and do not infer
+   delta specs from other artifacts.
 
    **If delta specs exist:**
-   - Compare each delta spec with its corresponding main spec at `openspec/specs/<capability>/spec.md`
+   - Compare each delta spec with its corresponding main spec at `<planningHome.root>/openspec/specs/<capability-path>/spec.md` (use the store-aware `planningHome.root` from step 2, not a hardcoded repo path)
    - Determine what changes would be applied (adds, modifications, removals, renames)
    - Show a combined summary before prompting
 
@@ -59,7 +95,30 @@ Archive a completed change in the experimental workflow.
    - If changes needed: "Sync now (recommended)", "Archive without syncing"
    - If already synced: "Archive now", "Sync anyway", "Cancel"
 
-   If user chooses sync, use Task tool (subagent_type: "general-purpose", prompt: "Use Skill tool to invoke openspec-sync-specs for change '<name>'. Delta spec analysis: <include the analyzed delta spec summary>"). Proceed to archive regardless of choice.
+   Route on the answer:
+   - "Cancel" — stop, do not archive
+   - "Archive without syncing" or "Archive now" — proceed to archive
+   - "Sync now" or "Sync anyway" — sync, then verify (below)
+   - Anything else — ask again rather than archiving
+
+   Before a selected sync writes any main spec, run
+   `openspec instructions specs --change "<name>" --json` once with the same
+   selected-root flags. Require a zero exit status and valid artifact-instruction
+   JSON. If the lookup fails or returns invalid JSON, report the error and stop
+   before writing any main spec or moving the change. A valid response with omitted
+   `rules` is the no-rules case. Apply returned `rules` only to the content and
+   form of main specs produced by this merge; do not use them as archive guidance,
+   change CLI behavior, or copy the rule text into any output file.
+
+   Then run the `/opsx-sync` workflow inline (agent-driven intelligent merge) for change '<name>', passing the delta spec analysis and the fetched specs-rule snapshot from above, and wait for it to finish. The inline sync must reuse that snapshot without fetching `specs` instructions again. Do not delegate it to a background task — step 5 would move `changeRoot` out from under a sync that is still reading it, leaving the change archived and the main specs never updated. If your agent can only run it by delegation, delegate synchronously and wait for the result.
+
+   Then re-run the comparison from the top of this step against every capability that has a delta spec in `artifactPaths.specs.existingOutputPaths` — not only the ones the sync reports it touched. A successful sync leaves nothing left to apply, so each capability must now read as already synced:
+   - ADDED requirements present
+   - MODIFIED requirements carrying the scenario and description changes named in the delta, with their other scenarios intact
+   - REMOVED requirements gone — and where this sync retired a capability (removed its last requirement, leaving `## Requirements` empty), its main spec deleted rather than left empty; a spec the sync deliberately kept and reported is also a match
+   - RENAMED requirements present under the new name and absent under the old one
+
+   If the sync failed, or any capability does not match, report what differs and stop — do not archive. Nothing has moved and `changeRoot` is intact, so the user can fix the mismatch or re-run the sync and start the archive again.
 
 5. **Perform the archive**
 
@@ -68,14 +127,14 @@ Archive a completed change in the experimental workflow.
    mkdir -p "<planningHome.changesDir>/archive"
    ```
 
-   Generate target name using current date: `YYYY-MM-DD-<change-name>`
+   Generate the target name: use the change name as-is when it already starts with a `YYYY-MM-DD-` prefix; otherwise prepend the current date as `YYYY-MM-DD-<change-name>`. Never stack a second date (same rule as `openspec archive`).
 
    **Check if target already exists:**
    - If yes: Fail with error, suggest renaming existing archive or using different date
    - If no: Move `changeRoot` to the archive directory
 
    ```bash
-   mv "<changeRoot>" "<planningHome.changesDir>/archive/YYYY-MM-DD-<name>"
+   mv "<changeRoot>" "<planningHome.changesDir>/archive/<target-name>"
    ```
 
 6. **Display summary**
@@ -89,12 +148,12 @@ Archive a completed change in the experimental workflow.
 
 **Output On Success**
 
-```
+```markdown
 ## Archive Complete
 
 **Change:** <change-name>
 **Schema:** <schema-name>
-**Archived to:** the archive path derived from `planningHome.changesDir`/YYYY-MM-DD-<name>/
+**Archived to:** the archive path derived from `planningHome.changesDir`/<target-name>/
 **Specs:** ✓ Synced to main specs
 
 All artifacts complete. All tasks complete.
@@ -102,12 +161,12 @@ All artifacts complete. All tasks complete.
 
 **Output On Success (No Delta Specs)**
 
-```
+```markdown
 ## Archive Complete
 
 **Change:** <change-name>
 **Schema:** <schema-name>
-**Archived to:** the archive path derived from `planningHome.changesDir`/YYYY-MM-DD-<name>/
+**Archived to:** the archive path derived from `planningHome.changesDir`/<target-name>/
 **Specs:** No delta specs
 
 All artifacts complete. All tasks complete.
@@ -115,12 +174,12 @@ All artifacts complete. All tasks complete.
 
 **Output On Success With Warnings**
 
-```
+```markdown
 ## Archive Complete (with warnings)
 
 **Change:** <change-name>
 **Schema:** <schema-name>
-**Archived to:** the archive path derived from `planningHome.changesDir`/YYYY-MM-DD-<name>/
+**Archived to:** the archive path derived from `planningHome.changesDir`/<target-name>/
 **Specs:** Sync skipped (user chose to skip)
 
 **Warnings:**
@@ -133,11 +192,11 @@ Review the archive if this was not intentional.
 
 **Output On Error (Archive Exists)**
 
-```
+```markdown
 ## Archive Failed
 
 **Change:** <change-name>
-**Target:** the archive path derived from `planningHome.changesDir`/YYYY-MM-DD-<name>/
+**Target:** the archive path derived from `planningHome.changesDir`/<target-name>/
 
 Target archive directory already exists.
 
@@ -148,10 +207,16 @@ Target archive directory already exists.
 ```
 
 **Guardrails**
-- Always prompt for change selection if not provided
+- Announce the selected change; prompt for selection when it is ambiguous
 - Use artifact graph (openspec status --json) for completion checking
 - Don't block archive on warnings - just inform and confirm
 - Preserve .openspec.yaml when moving to archive (it moves with the directory)
 - Show clear summary of what happened
-- If sync is requested, use the Skill tool to invoke `openspec-sync-specs` (agent-driven)
+- If sync is requested, run the `/opsx-sync` workflow inline (agent-driven)
+- Never archive while a spec sync is still in flight — run the sync inline and verify the main specs before moving `changeRoot`
 - If delta specs exist, always run the sync assessment and show the combined summary before prompting
+- Apply relevant runtime context and report conflicts; operation guidance remains advisory
+- Consider every guidance entry and explain any inapplicable or conflicting advice
+- Existing CLI checks, resolved paths, prompts, and command contracts are unchanged
+- Artifact rules constrain only the specs being written and are never operation guidance
+- Never copy runtime context, operation guidance, or artifact-rule text verbatim into output files
diff --git a/.opencode/commands/opsx-bulk-archive.md b/.opencode/commands/opsx-bulk-archive.md
index 138d44bca..01bff3d7a 100644
--- a/.opencode/commands/opsx-bulk-archive.md
+++ b/.opencode/commands/opsx-bulk-archive.md
@@ -1,12 +1,14 @@
 ---
-description: Archive multiple completed changes at once
+description: "Archive multiple completed changes at once"
 ---
 
 Archive multiple completed changes in a single operation.
 
 This skill allows you to batch-archive changes, handling spec conflicts intelligently by checking the codebase to determine what's actually implemented.
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+`<capability-path>` is the spec directory relative to `specs/` (for example, `user-auth` or `identity/user-auth`). Preserve the full path from each delta spec when resolving its main spec.
 
 **Input**: None required (prompts for selection)
 
@@ -20,13 +22,38 @@ This skill allows you to batch-archive changes, handling spec conflicts intellig
 
 2. **Prompt for change selection**
 
-   Use **AskUserQuestion tool** with multi-select to let user choose changes:
+   Ask the user to choose changes (multi-select):
    - Show each change with its schema
    - Include an option for "All changes"
    - Allow any number of selections (1+ works, 2+ is the typical use case)
 
    **IMPORTANT**: Do NOT auto-select. Always let the user choose.
 
+   **Load current archive inputs once for the selected root before batch validation:**
+
+   Choose one selected change from this root and run
+   `openspec instructions archive --change "<selected-change>" --json` with the
+   same selected-root flags. This lookup is advisory and optional: it only supplies
+   extra prompt inputs, so it must never block the batch. If it fails or returns
+   invalid JSON — for example on an older CLI that does not support this command
+   yet — continue the batch with no context and no operation guidance. Do not
+   report an error and do not stop.
+
+   A valid response may omit `context` and `operationGuidance`. Treat
+   `context` as a required prompt-level input across the batch: read and consider
+   it, and apply relevant project facts, conventions, and constraints. Treat
+   `operationGuidance` as optional additive advice: read and consider every
+   entry, and follow entries that are applicable and compatible with the built-in
+   batch workflow.
+
+   Keep both fields separate from conflict analysis, explicit user choices,
+   resolved paths, CLI checks, and command contracts. If context conflicts with one
+   of those controlling inputs, report the conflict and preserve the controlling
+   value. If guidance is inapplicable or conflicts with a controlling input, do not
+   follow it and explain why. Do not infer skipped prompts, replacement paths, or
+   flags from either field, and do not copy their text verbatim into specs, changes,
+   or summaries. These are prompt-level behavior contracts, not enforceable checks.
+
 3. **Batch validation - gather status for all selected changes**
 
    For each selected change, collect:
@@ -42,17 +69,22 @@ This skill allows you to batch-archive changes, handling spec conflicts intellig
    c. **Delta specs** - Check `artifactPaths.specs.existingOutputPaths` from status JSON
       - List which capability specs exist
       - For each, extract requirement names (lines matching `### Requirement: <name>`)
+      - Treat this list as the only delta-spec source. If the `specs` entry is
+        missing or the list is empty, perform no spec sync or specs-instruction
+        lookup for that change; do not infer deltas from unrelated artifacts.
+      - Evaluate this independently for every change, including mixed-schema
+        batches where some schemas have no `specs` artifact.
 
 4. **Detect spec conflicts**
 
-   Build a map of `capability -> [changes that touch it]`:
+   Build a map keyed by `<capability-path>`, the exact path relative to `specs/`:
 
-   ```
-   auth -> [change-a, change-b]  <- CONFLICT (2+ changes)
-   api  -> [change-c]            <- OK (only 1 change)
+   ```text
+   identity/user-auth -> [change-a, change-b]  <- CONFLICT (2+ changes)
+   billing/user-auth  -> [change-c]            <- OK (different full path)
    ```
 
-   A conflict exists when 2+ selected changes have delta specs for the same capability.
+   A conflict exists when 2+ selected changes have delta specs for the exact same `<capability-path>`.
 
 5. **Resolve conflicts agentically**
 
@@ -70,38 +102,39 @@ This skill allows you to batch-archive changes, handling spec conflicts intellig
       - If neither implemented -> skip spec sync, warn user
 
    d. **Record resolution** for each conflict:
-      - Which change's specs to apply
-      - In what order (if both)
+      - An inclusion or exclusion decision for every delta spec, keyed by change and `<capability-path>`
+      - Which included delta specs to apply and in what order
+      - Which delta specs to exclude from sync because their implementation is missing
       - Rationale (what was found in codebase)
 
 6. **Show consolidated status table**
 
    Display a table summarizing all changes:
 
-   ```
+   ```markdown
    | Change              | Artifacts | Tasks | Specs   | Conflicts | Status |
    |---------------------|-----------|-------|---------|-----------|--------|
    | schema-management   | Done      | 5/5   | 2 delta | None      | Ready  |
    | project-config      | Done      | 3/3   | 1 delta | None      | Ready  |
-   | add-oauth           | Done      | 4/4   | 1 delta | auth (!)  | Ready* |
+   | add-oauth           | Done      | 4/4   | 1 delta | identity/user-auth (!) | Ready* |
    | add-verify-skill    | 1 left    | 2/5   | None    | None      | Warn   |
    ```
 
    For conflicts, show the resolution:
-   ```
+   ```text
    * Conflict resolution:
-     - auth spec: Will apply add-oauth then add-jwt (both implemented, chronological order)
+     - identity/user-auth spec: Will apply add-oauth then add-jwt (both implemented, chronological order)
    ```
 
    For incomplete changes, show warnings:
-   ```
+   ```text
    Warnings:
    - add-verify-skill: 1 incomplete artifact, 3 incomplete tasks
    ```
 
 7. **Confirm batch operation**
 
-   Use **AskUserQuestion tool** with a single confirmation:
+   Ask the user a single confirmation question:
 
    - "Archive N changes?" with options based on status
    - Options might include:
@@ -111,31 +144,73 @@ This skill allows you to batch-archive changes, handling spec conflicts intellig
 
    If there are incomplete changes, make clear they'll be archived with warnings.
 
+   Route on the answer by intent, not by exact label — you wrote these labels,
+   so match what the user picked rather than the wording above:
+   - "Cancel" — stop, do not archive. Report that nothing was archived and skip the remaining steps.
+   - The archive-everything option — proceed with every selected change
+   - The ready-only option — proceed with only the changes the step 6 table marks `Ready` or `Ready*`, and record the rest as Skipped in step 8d. If a `Ready*` change's conflict partner is skipped, re-derive that conflict's resolution using only the changes being archived.
+   - Anything else — ask again rather than archiving
+
+   Before step 8 writes the first main spec or moves any change, fetch every
+   required specs-rule snapshot for the confirmed batch. For each change that will
+   sync concrete `artifactPaths.specs.existingOutputPaths`, run
+   `openspec instructions specs --change "<name>" --json` exactly once with the
+   same selected-root flags. Obtain all snapshots before the first write or move.
+   If any lookup exits non-zero or returns invalid artifact-instruction JSON,
+   identify the affected change, report the error, and stop the whole batch before
+   any main-spec write or change move. Do not treat lookup failure as omitted
+   rules. A valid response without `rules` is the no-rules case.
+
 8. **Execute archive for each confirmed change**
 
+   Before processing, carry the recorded decisions from step 5 (after any step 7 re-derivation) into two per-delta sets:
+   - `includedDeltas`: all non-conflicting delta specs from confirmed changes plus conflict deltas selected for sync
+   - `excludedDeltas`: conflict deltas from confirmed changes excluded because their implementation is missing
+   - A single change can have both included and excluded delta specs. Keep the decision per delta; do not collapse it into a per-change sync flag.
+
    Process changes in the determined order (respecting conflict resolution):
 
-   a. **Sync specs** if delta specs exist:
-      - Use the openspec-sync-specs approach (agent-driven intelligent merge)
-      - For conflicts, apply in resolved order
-      - Track if sync was done
+   a. **Sync included delta specs**:
+      - Run the `/opsx-sync` workflow inline (agent-driven intelligent merge) only for changes with entries in `includedDeltas`, passing only the included delta paths and explicitly instructing it to ignore that change's `excludedDeltas`. Wait for it to finish.
+      - For conflicts, apply in resolved order.
+      - Pass that change's fetched specs-rule snapshot into inline sync; inline
+        sync must reuse it without fetching instructions again
+      - Apply artifact rules only to main specs produced by that change. They do
+        not change conflict resolution, archive behavior, or CLI contracts, and
+        their text is not copied into an output file
+      - Do not delegate to a background task — step 8c would move `changeRoot` out from under a sync that is still reading it.
+      - If a change has no included delta specs, do not run the sync workflow for it.
+
+   b. **Verify included delta specs before moving changeRoot**:
+      - Re-run the comparison only for delta specs in `includedDeltas` against main spec at `<planningHome.root>/openspec/specs/<capability-path>/spec.md` (use the store-aware `planningHome.root` from step 3 status JSON, not a hardcoded repo path).
+      - Verify that main specs are updated:
+        - ADDED requirements present
+        - MODIFIED requirements carrying scenario and description changes named in the delta, with their other scenarios intact
+        - REMOVED requirements gone — and where this sync retired a capability (removed its last requirement, leaving `## Requirements` empty), its main spec deleted rather than left empty; a spec the sync deliberately kept and reported is also a match
+        - RENAMED requirements present under the new name and absent under the old one
+      - Do not verify delta specs in `excludedDeltas`; they are intentionally left unsynced.
+      - If sync failed or any capability does not match verification, report what differs and fail/skip moving that change's `changeRoot` — do not archive that change. `changeRoot` remains intact.
+
+   c. **Perform the archive**:
+
+      Target name: use the change name as-is when it already starts with a `YYYY-MM-DD-` prefix; otherwise prepend the current date as `YYYY-MM-DD-<name>` (same rule as `openspec archive`).
 
-   b. **Perform the archive**:
       ```bash
       mkdir -p "<planningHome.changesDir>/archive"
-      mv "<changeRoot>" "<planningHome.changesDir>/archive/YYYY-MM-DD-<name>"
+      mv "<changeRoot>" "<planningHome.changesDir>/archive/<target-name>"
       ```
 
-   c. **Track outcome** for each change:
+   d. **Track outcome** for each change:
       - Success: archived successfully
-      - Failed: error during archive (record error)
+      - Failed: error during archive or spec verification (record error)
       - Skipped: user chose not to archive (if applicable)
+      - Sync skipped: for every delta in `excludedDeltas`, report `sync skipped` with the change, `<capability-path>`, and recorded reason. This is distinct from skipping the archive.
 
 9. **Display summary**
 
    Show final results:
 
-   ```
+   ```markdown
    ## Bulk Archive Complete
 
    Archived 3 changes:
@@ -148,11 +223,12 @@ This skill allows you to batch-archive changes, handling spec conflicts intellig
 
    Spec sync summary:
    - 4 delta specs synced to main specs
-   - 1 conflict resolved (auth: applied both in chronological order)
+   - 1 delta spec sync skipped (add-jwt, identity/user-auth: implementation not found)
+   - 1 conflict resolved (identity/user-auth: synced add-oauth, skipped add-jwt)
    ```
 
    If any failures:
-   ```
+   ```text
    Failed 1 change:
    - some-change: Archive directory already exists
    ```
@@ -160,8 +236,8 @@ This skill allows you to batch-archive changes, handling spec conflicts intellig
 **Conflict Resolution Examples**
 
 Example 1: Only one implemented
-```
-Conflict: specs/auth/spec.md touched by [add-oauth, add-jwt]
+```text
+Conflict: <planningHome.root>/openspec/specs/auth/spec.md touched by [add-oauth, add-jwt]
 
 Checking add-oauth:
 - Delta adds "OAuth Provider Integration" requirement
@@ -175,8 +251,8 @@ Resolution: Only add-oauth is implemented. Will sync add-oauth specs only.
 ```
 
 Example 2: Both implemented
-```
-Conflict: specs/api/spec.md touched by [add-rest-api, add-graphql]
+```text
+Conflict: <planningHome.root>/openspec/specs/api/spec.md touched by [add-rest-api, add-graphql]
 
 Checking add-rest-api (created 2026-01-10):
 - Delta adds "REST Endpoints" requirement
@@ -192,12 +268,12 @@ then add-graphql specs (chronological order, newer takes precedence).
 
 **Output On Success**
 
-```
+```markdown
 ## Bulk Archive Complete
 
 Archived N changes:
-- <change-1> -> archive/YYYY-MM-DD-<change-1>/
-- <change-2> -> archive/YYYY-MM-DD-<change-2>/
+- <change-1> -> archive/<target-name-1>/
+- <change-2> -> archive/<target-name-2>/
 
 Spec sync summary:
 - N delta specs synced to main specs
@@ -206,11 +282,11 @@ Spec sync summary:
 
 **Output On Partial Success**
 
-```
+```markdown
 ## Bulk Archive Complete (partial)
 
 Archived N changes:
-- <change-1> -> archive/YYYY-MM-DD-<change-1>/
+- <change-1> -> archive/<target-name-1>/
 
 Skipped M changes:
 - <change-2> (user chose not to archive incomplete)
@@ -221,7 +297,7 @@ Failed K changes:
 
 **Output When No Changes**
 
-```
+```markdown
 ## No Changes to Archive
 
 No active changes found. Create a new change to get started.
@@ -235,7 +311,22 @@ No active changes found. Create a new change to get started.
 - Skip spec sync only when implementation is missing (warn user)
 - Show clear per-change status before confirming
 - Use single confirmation for entire batch
+- Never archive after the user cancels the confirmation — a cancelled batch archives nothing
 - Track and report all outcomes (success/skip/fail)
 - Preserve .openspec.yaml when moving to archive
-- Archive directory target uses current date: YYYY-MM-DD-<name>
+- Archive directory target uses current date: YYYY-MM-DD-<name>; a name that already starts with a `YYYY-MM-DD-` prefix is used as-is (never stack a second date)
 - If archive target exists, fail that change but continue with others
+- If sync is requested, run the `/opsx-sync` workflow inline (agent-driven) for each change with included delta specs
+- Carry the per-delta `includedDeltas` and `excludedDeltas` decisions into execution; sync and verify only included deltas
+- Report every excluded delta as `sync skipped` without treating the archive itself as skipped
+- Never archive a change while a spec sync is still in flight — run the sync inline and verify main specs at `<planningHome.root>/openspec/specs/<capability-path>/spec.md` before moving `changeRoot`
+- Fetch archive inputs once per selected root before spec inspection or moves
+- Fetch all required specs-rule snapshots before the batch's first main-spec write or move
+- A failed archive-inputs lookup never blocks the batch; it proceeds with no context or guidance
+- A failed specs instruction lookup stops the whole batch atomically
+- Changes without concrete `artifactPaths.specs.existingOutputPaths` continue without spec sync
+- Apply relevant runtime context across the batch and report conflicts
+- Operation guidance remains advisory; consider every entry and explain rejected advice
+- Keep runtime inputs, conflict analysis, CLI-derived values, and artifact rules separate
+- Artifact rules constrain only written specs
+- Never copy runtime input or artifact-rule text verbatim into output files
diff --git a/.opencode/commands/opsx-continue.md b/.opencode/commands/opsx-continue.md
index cc3ff5a8f..3f98f8fb4 100644
--- a/.opencode/commands/opsx-continue.md
+++ b/.opencode/commands/opsx-continue.md
@@ -1,20 +1,24 @@
 ---
-description: Continue working on a change - create the next artifact (Experimental)
+description: "Continue working on a change - create the next artifact (Experimental)"
 ---
 
 Continue working on a change by creating the next artifact.
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
 
 **Input**: Optionally specify a change name after `/opsx-continue` (e.g., `/opsx-continue add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+**Provided arguments**: $ARGUMENTS
 
 **Steps**
 
-1. **If no change name provided, prompt for selection**
+1. **Select the change**
 
-   Run `openspec list --json` to get available changes sorted by most recently modified. Then use the **AskUserQuestion tool** to let the user select which change to work on.
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes sorted by most recently modified, and ask the user to select one
 
-   Present the top 3-4 most recently modified changes as options, showing:
+   When prompting, present the top 3-4 most recently modified changes as options, showing:
    - Change name
    - Schema (from `schema` field if present, otherwise "spec-driven")
    - Status (e.g., "0/5 tasks", "complete", "no tasks")
@@ -22,7 +26,7 @@ Continue working on a change by creating the next artifact.
 
    Mark the most recently modified change as "(Recommended)" since it's likely what the user wants to continue.
 
-   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+   Always announce: "Using change: <name>" and how to override (e.g., `/opsx-continue <other>`).
 
 2. **Check current status**
    ```bash
@@ -30,18 +34,18 @@ Continue working on a change by creating the next artifact.
    ```
    Parse the JSON to understand current state. The response includes:
    - `schemaName`: The workflow schema being used (e.g., "spec-driven")
-   - `artifacts`: Array of artifacts with their status ("done", "ready", "blocked")
-   - `isComplete`: Boolean indicating if all artifacts are complete
+   - `artifacts`: Array of artifacts with their status ("done", "skipped", "ready", "blocked")
+   - `isPlanningComplete`: Boolean indicating if all planning artifacts are complete. Older CLI versions expose the same value as `isComplete`.
    - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context. Use these instead of assuming repo-local paths.
 
 3. **Act based on status**:
 
    ---
 
-   **If all artifacts are complete (`isComplete: true`)**:
+   **If all planning artifacts are complete (`isPlanningComplete: true`, or legacy `isComplete: true`)**:
    - Congratulate the user
    - Show final status including the schema used
-   - Suggest: "All artifacts created! You can now implement this change with `/opsx-apply` or archive it with `/opsx-archive`."
+   - Suggest: "Planning is complete! You can now implement this change with `/opsx-apply`. Once implementation and any tracked work are complete, archive it with `/opsx-archive`."
    - STOP
 
    ---
@@ -58,10 +62,12 @@ Continue working on a change by creating the next artifact.
      - `template`: The structure to use for your output file
      - `instruction`: Schema-specific guidance
      - `resolvedOutputPath`: Resolved path or pattern to write the artifact
-     - `dependencies`: Completed artifacts to read for context
+     - `dependencies`: Completed artifacts to read for context (entries with `skipped: true` have no files - do not look for them)
+     - `skipped`/`warning`: present when the change declares skip_specs and this artifact must NOT be created - pick another artifact
    - **Create the artifact file**:
-     - Read any completed dependency files for context
-     - Use `template` as the structure - fill in its sections
+     - Read any completed dependency files for context - always re-read them from disk, even if you saw them earlier in the conversation (the user may have edited them)
+     - If the `instruction` field delegates creation to a specific skill or command, invoke it to produce the artifact instead of writing the file yourself, then verify the artifact file exists at `resolvedOutputPath`
+     - Otherwise use `template` as the structure - fill in its sections
      - Apply `context` and `rules` as constraints when writing - but do NOT copy them into the file
      - Write to the `resolvedOutputPath` specified in instructions. If it is a glob pattern, choose the concrete file path using the schema instruction and the change's context
    - Show what was created and what's now unlocked
@@ -89,22 +95,13 @@ After each invocation, show:
 
 **Artifact Creation Guidelines**
 
-The artifact types and their purpose depend on the schema. Use the `instruction` field from the instructions output to understand what to create.
+The artifact types and their purpose depend on the schema. The `instruction` field from the instructions output is the authoritative guidance for each artifact - follow it even when the artifact has a familiar name (proposal.md, tasks.md, etc.), since custom schemas may define different content or a different process for the same file names.
 
-Common artifact patterns:
-
-**spec-driven schema** (proposal → specs → design → tasks):
-- **proposal.md**: Ask user about the change if not clear. Fill in Why, What Changes, Capabilities, Impact.
-  - The Capabilities section is critical - each capability listed will need a spec file.
-- **specs/<capability>/spec.md**: Create one spec per capability listed in the proposal's Capabilities section (use the capability name, not the change name).
-- **design.md**: Document technical decisions, architecture, and implementation approach.
-- **tasks.md**: Break down implementation into checkboxed tasks.
-
-For other schemas, follow the `instruction` field from the CLI output.
+If the `instruction` field directs you to use a specific skill or command to create the artifact, invoke it instead of writing the artifact directly.
 
 **Guardrails**
 - Create ONE artifact per invocation
-- Always read dependency artifacts before creating a new one
+- Always read dependency artifacts before creating a new one - re-read from disk, not from conversation memory (files may have changed since you last saw them)
 - Never skip artifacts or create out of order
 - If context is unclear, ask the user before creating
 - Verify the artifact file exists after writing before marking progress
diff --git a/.opencode/commands/opsx-explore.md b/.opencode/commands/opsx-explore.md
index 928233b45..13b00d5ad 100644
--- a/.opencode/commands/opsx-explore.md
+++ b/.opencode/commands/opsx-explore.md
@@ -1,14 +1,14 @@
 ---
-description: Enter explore mode - think through ideas, investigate problems, clarify requirements
+description: "Enter explore mode - think through ideas, investigate problems, clarify requirements"
 ---
 
 Enter explore mode. Think deeply. Visualize freely. Follow the conversation wherever it goes.
 
-**IMPORTANT: Explore mode is for thinking, not implementing.** You may read files, search code, and investigate the codebase, but you must NEVER write code or implement features. If the user asks you to implement something, remind them to exit explore mode first and create a change proposal. You MAY create OpenSpec artifacts (proposals, designs, specs) if the user asks—that's capturing thinking, not implementing.
+**IMPORTANT: Explore mode is for thinking, not implementing.** You may read files, search code, and investigate the codebase, but you must NEVER write code or implement features. If the user asks you to implement something, remind them to exit explore mode first and create a change proposal. You MAY create OpenSpec artifacts (proposals, designs, specs) if the user asks—that's capturing thinking, not implementing. For a new change, scaffold it first as described below.
 
 **This is a stance, not a workflow.** There are no fixed steps, no required sequence, no mandatory outputs. You're a thinking partner helping the user explore.
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
 
 **Input**: The argument after `/opsx-explore` is whatever the user wants to think about. Could be:
 - A vague idea: "real-time collaboration"
@@ -16,6 +16,7 @@ Enter explore mode. Think deeply. Visualize freely. Follow the conversation wher
 - A change name: "add-dark-mode" (to explore in context of that change)
 - A comparison: "postgres vs sqlite for this"
 - Nothing (just enter explore mode)
+**Provided arguments**: $ARGUMENTS
 
 ---
 
@@ -93,6 +94,12 @@ This tells you:
 - Their names, schemas, and status
 - What the user might be working on
 
+Then read the project's own context from the resolved root - `<root.path>/openspec/config.yaml` (or `config.yml`). Use the `root.path` returned above, and skip this if neither file exists:
+- `context`: project background - tech stack, conventions, constraints
+- `rules`: keyed by artifact id - the entries for an artifact apply only when you write that artifact
+
+Ground your thinking in these. They are constraints for you to follow, not content to reproduce: do NOT copy them into the conversation or into any artifact you create.
+
 If the user mentioned a specific change name, read its artifacts for context.
 
 ### When no change exists
@@ -102,6 +109,15 @@ Think freely. When insights crystallize, you might offer:
 - "This feels solid enough to start a change. Want me to create a proposal?"
 - Or keep exploring - no pressure to formalize
 
+If the user asks you to capture the exploration as a new change, transition seamlessly into the requested capture:
+
+1. Run `openspec new change "<name>"` (with `--store <id>` when applicable) before creating any artifacts. Never create a new change directory under `openspec/changes/` by hand; the CLI scaffold creates required metadata such as `.openspec.yaml`. Keep the selected `--store <id>` on every applicable follow-up `status` and `instructions` command.
+2. Run `openspec status --change "<name>" --json` (append the confirmed `--store "<id>"` only for a registered standalone store), then process the requested artifacts in dependency order. For each requested artifact that is `ready`, run `openspec instructions "<artifact-id>" --change "<name>" --json` (append the confirmed `--store "<id>"` only for a registered standalone store). Before creating a requested artifact, evaluate any condition in its own `instruction` against the explored change; record a deliberate skip instead when the condition does not apply. If a requested artifact is blocked by a direct prerequisite the user did not request, run `openspec instructions "<prerequisite-id>" --change "<name>" --json` (append the confirmed `--store "<id>"` only for a registered standalone store) for that prerequisite whether it is `ready` or `blocked`. If its own `instruction` states a condition, evaluate that condition against the explored change and record a deliberate skip only when the condition does not apply. If the condition applies, or the prerequisite is not conditional, treat it as a normal prerequisite and ask before expanding the capture. Do not create an unrequested prerequisite unless the user approves.
+3. Follow the returned `template` and `instruction` fields. Read completed dependency files listed in `dependencies`, and apply `context` and `rules` as constraints without copying them into the artifact. If the instruction delegates creation to a specific skill or command, invoke it; otherwise write the artifact to `resolvedOutputPath`, using the instruction to choose a concrete path when it is a glob. Verify that the selected concrete output exists.
+4. After creating each artifact, re-run `openspec status --change "<name>" --json` (append the confirmed `--store "<id>"` only for a registered standalone store) and continue until every requested artifact is `done`, `skipped`, or was deliberately skipped because its own `instruction` stated a condition that did not apply. Tell the user about a deliberate conditional skip, remember it, and do not reconsider it. Dependencies are enablers, not gates: if a requested artifact is still `blocked` only because you deliberately skipped a conditional prerequisite, run `openspec instructions "<artifact-id>" --change "<name>" --json` (append the confirmed `--store "<id>"` only for a registered standalone store) despite the blocked status, then create it using step 3 only when those recorded conditional skips are its sole missing dependencies. If a requested artifact is blocked by a prerequisite the user did not ask to capture and cannot be conditionally skipped, explain that dependency and ask before expanding the capture.
+
+Capture the artifact(s) the user requested without asking them to invoke another workflow command. If they asked only to start a change, stop after scaffolding and show its status.
+
 ### When a change exists
 
 If the user mentions a change or you detect one is relevant:
@@ -117,14 +133,16 @@ If the user mentions a change or you detect one is relevant:
 
 3. **Offer to capture when decisions are made**
 
-    | Insight Type               | Where to Capture               |
-    |----------------------------|--------------------------------|
-    | New requirement discovered | `specs/<capability>/spec.md` |
-    | Requirement changed        | `specs/<capability>/spec.md` |
-    | Design decision made       | `design.md`                  |
-    | Scope changed              | `proposal.md`                |
-    | New work identified        | `tasks.md`                   |
-    | Assumption invalidated     | Relevant artifact              |
+   `<capability-path>` is the spec directory relative to `specs/` (for example, `user-auth` or `identity/user-auth`). Preserve an existing capability's full path and follow the project's established organization for new capabilities.
+
+    | Insight Type               | Where to Capture                    |
+    |----------------------------|-------------------------------------|
+    | New requirement discovered | `specs/<capability-path>/spec.md` |
+    | Requirement changed        | `specs/<capability-path>/spec.md` |
+    | Design decision made       | `design.md`                       |
+    | Scope changed              | `proposal.md`                     |
+    | New work identified        | `tasks.md`                        |
+    | Assumption invalidated     | Relevant artifact                   |
 
    Example offers:
    - "That's a design decision. Capture it in design.md?"
@@ -166,6 +184,7 @@ When things crystallize, you might offer a summary - but it's optional. Sometime
 - **Don't rush** - Discovery is thinking time, not task time
 - **Don't force structure** - Let patterns emerge naturally
 - **Don't auto-capture** - Offer to save insights, don't just do it
+- **Don't manually scaffold changes** - Never create a new change directory under `openspec/changes/` by hand. Always use `openspec new change "<name>"` (with `--store <id>` when applicable) so required metadata such as `.openspec.yaml` is created before writing artifacts.
 - **Do visualize** - A good diagram is worth many paragraphs
 - **Do explore the codebase** - Ground discussions in reality
 - **Do question assumptions** - Including the user's and your own
diff --git a/.opencode/commands/opsx-ff.md b/.opencode/commands/opsx-ff.md
index 21955dc2d..be77cc625 100644
--- a/.opencode/commands/opsx-ff.md
+++ b/.opencode/commands/opsx-ff.md
@@ -1,18 +1,19 @@
 ---
-description: Create a change and generate all artifacts needed for implementation in one go
+description: "Create a change and generate all artifacts needed for implementation in one go"
 ---
 
 Fast-forward through artifact creation - generate everything needed to start implementation.
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
 
 **Input**: The argument after `/opsx-ff` is the change name (kebab-case), OR a description of what the user wants to build.
+**Provided arguments**: $ARGUMENTS
 
 **Steps**
 
 1. **If no input provided, ask what they want to build**
 
-   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
+   Ask the user (open-ended, no preset options):
    > "What change do you want to work on? Describe what you want to build or fix."
 
    From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
@@ -31,12 +32,12 @@ Fast-forward through artifact creation - generate everything needed to start imp
    ```
    Parse the JSON to get:
    - `applyRequires`: array of artifact IDs needed before implementation (e.g., `["tasks"]`)
-   - `artifacts`: list of all artifacts with their status and dependencies
+   - `artifacts`: list of all artifacts, each with its `status` and its `requires` edges (the artifact IDs it directly depends on)
    - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context. Use these instead of assuming repo-local paths.
 
-4. **Create artifacts in sequence until apply-ready**
+4. **Create every artifact in the required set**
 
-   Use the **TodoWrite tool** to track progress through the artifacts.
+   Use a todo list to track progress through the artifacts.
 
    Loop through artifacts in dependency order (artifacts with no pending dependencies first):
 
@@ -50,20 +51,27 @@ Fast-forward through artifact creation - generate everything needed to start imp
         - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
         - `template`: The structure to use for your output file
         - `instruction`: Schema-specific guidance for this artifact type
+        - `skipped`/`warning`: present when the change declares skip_specs and this artifact must NOT be created - stop and pick another artifact
         - `resolvedOutputPath`: Resolved path or pattern to write the artifact
         - `dependencies`: Completed artifacts to read for context
-      - Read any completed dependency files for context
-      - Create the artifact file using `template` as the structure and write it to `resolvedOutputPath`
+      - Read any completed dependency files for context - always re-read them from disk, even if you saw them earlier in the conversation (the user may have edited them)
+      - If the `instruction` field delegates creation to a specific skill or command, invoke it to produce the artifact instead of writing the file yourself, then verify the artifact file exists at `resolvedOutputPath`
+      - Otherwise create the artifact file using `template` as the structure and write it to `resolvedOutputPath`. If `resolvedOutputPath` is a glob, follow `instruction` to choose the concrete file path
       - Apply `context` and `rules` as constraints - but do NOT copy them into the file
       - Show brief progress: "✓ Created <artifact-id>"
 
-   b. **Continue until all `applyRequires` artifacts are complete**
+   b. **Continue until every artifact in the required set exists (not just `apply.requires`)**
       - After creating each artifact, re-run `openspec status --change "<name>" --json`
-      - Check if every artifact ID in `applyRequires` has `status: "done"` in the artifacts array
-      - Stop when all `applyRequires` artifacts are done
+      - The required set is `applyRequires` plus every artifact reachable from those by following the `requires` edges in `status --json` - walk them transitively (spec-driven closes over proposal, specs, design, tasks). Leave artifacts outside that set alone
+      - `status` is file-existence only, so an `applyRequires` artifact reading `done` does NOT mean its dependencies exist - writing `tasks.md` early marks `tasks` done while `specs` was never written. Use each artifact's `requires` edges, not its `status`, to build the required set: a `done` artifact still lists what it depends on
+      - An artifact already reading `status: "skipped"` is satisfied: the change declares `skip_specs` in `.openspec.yaml`, so its files must NOT exist. Never try to create one
+      - Create every artifact in the required set that is missing, then re-check - creating one can unblock others
+      - Skip one only when `status` already reports it `skipped`, or when its own `instruction` says it is conditional: run `openspec instructions <artifact-id> --change "<name>" --json` and skip only if its `instruction` field marks it optional (e.g. "create only if..."). Spec-driven's `design.md` qualifies; `specs` qualifies only via the `skipped` status above, never by your own judgment. Tell the user, and do not reconsider it
+      - Dependencies are enablers, not gates: if a required artifact is still `blocked` only because you skipped a conditional dependency, write it anyway
+      - Stop when every artifact in the required set is `done`, `skipped`, or was deliberately skipped
 
    c. **If an artifact requires user input** (unclear context):
-      - Use **AskUserQuestion tool** to clarify
+      - Ask the user to clarify
       - Then continue with creation
 
 5. **Show final status**
@@ -75,13 +83,14 @@ Fast-forward through artifact creation - generate everything needed to start imp
 
 After completing all artifacts, summarize:
 - Change name and location
-- List of artifacts created with brief descriptions
-- What's ready: "All artifacts created! Ready for implementation."
+- List of artifacts created with brief descriptions, plus any conditional artifact you skipped and why
+- What's ready: "All artifacts needed for implementation are ready."
 - Prompt: "Run `/opsx-apply` to start implementing."
 
 **Artifact Creation Guidelines**
 
-- Follow the `instruction` field from `openspec instructions` for each artifact type
+- Follow the `instruction` field from `openspec instructions` for each artifact type - it is the authoritative guidance, even for familiar artifact names
+- If the `instruction` field directs you to use a specific skill or command to create the artifact, invoke it instead of writing the artifact directly
 - The schema defines what each artifact should contain - follow it
 - Read dependency artifacts for context before creating new ones
 - Use `template` as the structure for your output file - fill in its sections
@@ -90,8 +99,8 @@ After completing all artifacts, summarize:
   - These guide what you write, but should never appear in the output
 
 **Guardrails**
-- Create ALL artifacts needed for implementation (as defined by schema's `apply.requires`)
-- Always read dependency artifacts before creating a new one
+- Create every artifact the apply phase transitively depends on, not just the ids listed in `apply.requires`
+- Always read dependency artifacts before creating a new one - re-read from disk, not from conversation memory (files may have changed since you last saw them)
 - If context is critically unclear, ask the user - but prefer making reasonable decisions to keep momentum
 - If a change with that name already exists, ask if user wants to continue it or create a new one
 - Verify each artifact file exists after writing before proceeding to next
diff --git a/.opencode/commands/opsx-new.md b/.opencode/commands/opsx-new.md
index f81075435..9c7dad319 100644
--- a/.opencode/commands/opsx-new.md
+++ b/.opencode/commands/opsx-new.md
@@ -1,18 +1,19 @@
 ---
-description: Start a new change using the experimental artifact workflow (OPSX)
+description: "Start a new change using the experimental artifact workflow (OPSX)"
 ---
 
 Start a new change using the experimental artifact-driven approach.
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
 
 **Input**: The argument after `/opsx-new` is the change name (kebab-case), OR a description of what the user wants to build.
+**Provided arguments**: $ARGUMENTS
 
 **Steps**
 
 1. **If no input provided, ask what they want to build**
 
-   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
+   Ask the user (open-ended, no preset options):
    > "What change do you want to work on? Describe what you want to build or fix."
 
    From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
diff --git a/.opencode/commands/opsx-onboard.md b/.opencode/commands/opsx-onboard.md
index 3ba27d123..90a03735c 100644
--- a/.opencode/commands/opsx-onboard.md
+++ b/.opencode/commands/opsx-onboard.md
@@ -1,10 +1,10 @@
 ---
-description: Guided onboarding - walk through a complete OpenSpec workflow cycle with narration
+description: "Guided onboarding - walk through a complete OpenSpec workflow cycle with narration"
 ---
 
 Guide the user through their first complete OpenSpec workflow cycle. This is a teaching experience—you'll do real work in their codebase while explaining each step.
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
 
 ---
 
@@ -203,6 +203,11 @@ I'll draft one based on our task.
 
 **DO:** Draft the proposal content (don't save yet):
 
+`<capability-path>` is the spec directory relative to `specs/` (for example,
+`user-auth` or `identity/user-auth`). Use the exact existing path for modified
+capabilities. For new capabilities, follow the project's established spec
+organization.
+
 ```
 Here's a draft proposal:
 
@@ -219,10 +224,11 @@ Here's a draft proposal:
 ## Capabilities
 
 ### New Capabilities
-- `<capability-name>`: [brief description]
+- `<capability-path>`: [brief description]
 
 ### Modified Capabilities
 <!-- If modifying existing behavior -->
+- `<existing-capability-path>`: [brief description]
 
 ## Impact
 
@@ -360,12 +366,12 @@ Here are the implementation tasks:
 
 ## 1. [Category or file]
 
-- [ ] 1.1 [Specific task]
-- [ ] 1.2 [Specific task]
+- [ ] 1.1 [Specific task] — verify: [test, command, observable behavior, or delivered artifact]
+- [ ] 1.2 [Specific task] — verify: [test, command, observable behavior, or delivered artifact]
 
-## 2. Verify
+## 2. Integration Verification
 
-- [ ] 2.1 [Verification step]
+- [ ] 2.1 Verify [broader integration or system behavior] with [end-to-end test or observable result]
 
 ---
 
@@ -423,14 +429,14 @@ When a change is complete, we archive it. The archive path is derived from `plan
 Archived changes become your project's decision history—you can always find them later to understand why something was built a certain way.
 ```
 
-**DO:**
+**DO:** Archive the change (`--yes` answers the confirmation prompts, which you cannot answer from a tool call):
 ```bash
-openspec archive "<name>"
+openspec archive "<name>" --yes
 ```
 
 **SHOW:**
 ```
-Archived to: `<planningHome.changesDir>/archive/YYYY-MM-DD-<name>/`
+Archived to: `<planningHome.changesDir>/archive/<target-name>/` (the target name prepends today's date, unless the name already starts with a `YYYY-MM-DD-` prefix — then it is kept as-is, no second date)
 
 The change is now part of your project's history. The code is in your codebase, the decision record is preserved.
 ```
@@ -468,7 +474,7 @@ This same rhythm works for any size change—a small fix or a major feature.
  | `/opsx-apply`   | Implement tasks from a change              |
  | `/opsx-archive` | Archive a completed change                 |
 
-**Additional commands:**
+**Additional commands** (only if installed - availability depends on your profile):
 
  | Command            | What it does                                             |
  |--------------------|----------------------------------------------------------|
@@ -496,7 +502,7 @@ If the user says they need to stop, want to pause, or seem disengaged:
 No problem! Your change is saved at the `changeRoot` reported by `openspec status --change "<name>" --json`.
 
 To pick up where we left off later:
-- `/opsx-continue <name>` - Resume artifact creation
+- `/opsx-continue <name>` - Resume artifact creation (if installed; otherwise `openspec status --change "<name>" --json` shows the next artifact)
 - `/opsx-apply <name>` - Jump to implementation (if tasks exist)
 
 The work won't be lost. Come back whenever you're ready.
@@ -520,7 +526,7 @@ If the user says they just want to see the commands or skip the tutorial:
  | `/opsx-apply <name>`   | Implement tasks                            |
  | `/opsx-archive <name>` | Archive when done                          |
 
-**Additional commands:**
+**Additional commands** (only if installed - availability depends on your profile):
 
  | Command                   | What it does                        |
  |---------------------------|-------------------------------------|
diff --git a/.opencode/commands/opsx-sync.md b/.opencode/commands/opsx-sync.md
index 5f1b7bb4a..b704224d2 100644
--- a/.opencode/commands/opsx-sync.md
+++ b/.opencode/commands/opsx-sync.md
@@ -1,24 +1,30 @@
 ---
-description: Sync delta specs from a change to main specs
+description: "Sync delta specs from a change to main specs"
 ---
 
 Sync delta specs from a change to main specs.
 
 This is an **agent-driven** operation - you will read delta specs and directly edit main specs to apply the changes. This allows intelligent merging (e.g., adding a scenario without copying the entire requirement).
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+`<capability-path>` is the spec directory relative to `specs/` (for example, `user-auth` or `identity/user-auth`). Preserve the full path from each delta spec when resolving its main spec.
 
 **Input**: Optionally specify a change name after `/opsx-sync` (e.g., `/opsx-sync add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+**Provided arguments**: $ARGUMENTS
 
 **Steps**
 
-1. **If no change name provided, prompt for selection**
+1. **Select the change**
 
-   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes and ask the user to select one
 
-   Show changes that have delta specs (under `specs/` directory).
+   When prompting, show changes that have delta specs (under `specs/` directory).
 
-   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+   Always announce: "Using change: <name>" and how to override (e.g., `/opsx-sync <other>`).
 
 2. **Resolve change context**
 
@@ -27,9 +33,29 @@ This is an **agent-driven** operation - you will read delta specs and directly e
    openspec status --change "<name>" --json
    ```
 
+   The JSON includes `planningHome.root`. Main specs live under `<planningHome.root>/openspec/specs/` — use that (store-aware) root for every main-spec path below, not a hardcoded repo path. When a store is selected it points at the store, not the current repository.
+
 3. **Find delta specs**
 
-   Use `artifactPaths.specs.existingOutputPaths` from the status JSON as the list of delta spec files.
+   Use `artifactPaths.specs.existingOutputPaths` from the status JSON as the
+   only source of delta spec paths. If the `specs` entry is missing or
+   `existingOutputPaths` is empty, report that there are no delta specs to sync,
+   do not infer them from other artifacts, and stop without requesting artifact
+   instructions or writing a main spec.
+
+   Sync every path in `existingOutputPaths` unless the caller narrowed the set.
+   A caller narrows it by naming an explicit list of complete entries from
+   `existingOutputPaths` — copy those absolute values verbatim. Archive does
+   this inline, and a user can too (for example, by selecting the entry ending
+   in `/specs/billing/invoices/spec.md`).
+   Then sync only the named paths and leave the remaining delta specs untouched:
+   bulk archive excludes a delta whose implementation it could not find, and
+   syncing it anyway would write a main spec the caller deliberately withheld.
+   Carry that narrowed selection through step 4; never widen it back to the full
+   list. If a named path is not in `existingOutputPaths`, do not sync it —
+   report it and stop, rather than dropping it silently. If the named list is
+   empty, report that there is nothing to sync and stop without writing a main
+   spec.
 
    Each delta spec file contains sections like:
    - `## ADDED Requirements` - New requirements to add
@@ -41,11 +67,27 @@ This is an **agent-driven** operation - you will read delta specs and directly e
 
 4. **For each delta spec, apply changes to main specs**
 
-   For each repo-local capability delta spec path returned by the CLI:
+   Before the first main-spec write, obtain one current specs-rule snapshot:
+   - If archive invoked this workflow inline and supplied a valid snapshot from
+     `openspec instructions specs --change "<name>" --json`, reuse it and do not
+     fetch the same instructions again.
+   - Otherwise run that command once now with the same selected-root flags.
+   - If the direct lookup exits non-zero or returns invalid artifact-instruction
+     JSON, report the error and stop before writing any main spec. Do not treat the
+     failure as an absent rule set.
+   - A valid response with omitted `rules` means no artifact rules are configured
+     and the existing semantic merge continues.
+
+   Apply returned `rules` only to the content and form of the main specs produced
+   by this merge. Artifact rules are not operation guidance and cannot change
+   selected roots, delta paths, CLI checks, or workflow steps. Use their text as
+   constraints without copying it verbatim into a main spec or summary.
+
+   For each capability delta spec path selected in step 3 — the full `existingOutputPaths` list, or the narrowed subset when a caller supplied one (these may belong to a selected store, not the repo):
 
    a. **Read the delta spec** to understand the intended changes
 
-   b. **Read the main spec** at `openspec/specs/<capability>/spec.md` (may not exist yet)
+   b. **Read the main spec** at `<planningHome.root>/openspec/specs/<capability-path>/spec.md` (may not exist yet)
 
    c. **Apply changes intelligently**:
 
@@ -56,31 +98,72 @@ This is an **agent-driven** operation - you will read delta specs and directly e
       **MODIFIED Requirements:**
       - Find the requirement in main spec
       - Apply the changes - this can be:
-        - Adding new scenarios (don't need to copy existing ones)
+        - Adding new scenarios the main spec does not have yet
         - Modifying existing scenarios
         - Changing the requirement description
       - Preserve scenarios/content not mentioned in the delta
 
       **REMOVED Requirements:**
       - Remove the entire requirement block from main spec
+      - Retiring the capability. Delete the whole `spec.md` - and the directory once
+        nothing else is left in it - only when ALL of these hold:
+        1. removing the requirements *this run* left no requirement blocks;
+        2. the rest of the spec is well-formed (it still has a `## Purpose`);
+        3. the main spec was not already empty before this sync - if you removed
+           nothing, change nothing;
+        4. every other nonblank line in the whole file is accounted for as the
+           title, Purpose, Requirements header, or a canonical requirement's
+           statement, scenarios, or fenced examples;
+        5. the change's `.openspec.yaml` declares `retire_capabilities: true`;
+        6. the `spec.md` resolves inside the real specs root (do not follow a
+           capability-directory symlink to delete an external file).
+        If removing the selected requirements would leave no requirement blocks and
+        any retirement condition is not satisfied, do not modify the main spec. Stop
+        the sync for that capability, report the blocking condition, and tell the user
+        how to resolve it. Never write or leave an empty `## Requirements` section.
+        When only the marker is missing, say that too - it is the one thing the user
+        can add to make the retirement go through.
+      - Deleting the file also deletes its `## Purpose`; any other section blocks
+        retirement. Name Purpose when you report the retirement. Include a pasteable
+        `git checkout` only when the spec lived in the caller's checkout;
+        otherwise give checkout-scoped recovery guidance.
 
       **RENAMED Requirements:**
       - Find the FROM requirement, rename to TO
 
+      **`## Purpose` in the delta:**
+      - The main spec already has one and it is authoritative - leave it alone
+        (this is what `openspec archive` does; it warns and moves on)
+
    d. **Create new main spec** if capability doesn't exist yet:
-      - Create `openspec/specs/<capability>/spec.md`
-      - Add Purpose section (can be brief, mark as TBD)
+      - Create `<planningHome.root>/openspec/specs/<capability-path>/spec.md`
+      - Add Purpose section: copy the delta's `## Purpose` body verbatim when it has one
+        (this is what `openspec archive` does); only write a brief TBD placeholder when it does not
       - Add Requirements section with the ADDED requirements
+      - Follow the **Main Spec Format Reference** below
+
+5. **Validate updated main specs**
 
-5. **Show summary**
+   Run `openspec validate --specs` with the same selected-root flags used earlier.
+   If validation fails, report the problems and do not claim the sync succeeded.
+
+6. **Show summary**
 
    After applying all changes, summarize:
    - Which capabilities were updated
    - What changes were made (requirements added/modified/removed/renamed)
+   - Any new main spec left with a TBD Purpose placeholder, so it gets written
+     now rather than lingering
+   - Any capability retired, naming the deleted `spec.md`, its Purpose, and
+     either a pasteable `git checkout` or checkout-scoped recovery guidance
 
 **Delta Spec Format Reference**
 
 ```markdown
+## Purpose
+
+Only on a delta that introduces a brand-new capability. Seeds the new main spec.
+
 ## ADDED Requirements
 
 ### Requirement: New Feature
@@ -93,6 +176,12 @@ The system SHALL do something new.
 ## MODIFIED Requirements
 
 ### Requirement: Existing Feature
+The system SHALL keep doing the existing thing, now also handling A.
+
+#### Scenario: Scenario the main spec already has
+- **WHEN** user does X
+- **THEN** system does Y
+
 #### Scenario: New scenario to add
 - **WHEN** user does A
 - **THEN** system does B
@@ -107,16 +196,36 @@ The system SHALL do something new.
 - TO: `### Requirement: New Name`
 ```
 
+**Main Spec Format Reference**
+
+Main specs are what the delta merges INTO. They must never contain delta operation headers (`## ADDED/MODIFIED/REMOVED/RENAMED Requirements`) - after syncing, every requirement lives under a single `## Requirements` section:
+
+```markdown
+# <capability> Specification
+
+## Purpose
+Short description of what this capability does and why it exists.
+
+## Requirements
+
+### Requirement: New Feature
+The system SHALL do something new.
+
+#### Scenario: Basic case
+- **WHEN** user does X
+- **THEN** system does Y
+```
+
 **Key Principle: Intelligent Merging**
 
-Unlike programmatic merging, you can apply **partial updates**:
-- To add a scenario, just include that scenario under MODIFIED - don't copy existing scenarios
-- The delta represents *intent*, not a wholesale replacement
+Unlike programmatic merging, you merge rather than overwrite:
+- A MODIFIED block carries the whole requirement - body plus every scenario that survives the change. `openspec validate` and `openspec archive` both reject one that drops a scenario the main spec still has.
+- Keep anything the delta does not mention, in the main spec's existing order
 - Use your judgment to merge changes sensibly
 
 **Output On Success**
 
-```
+```markdown
 ## Specs Synced: <change-name>
 
 Updated main specs:
@@ -135,6 +244,12 @@ Main specs are now updated. The change remains active - archive when implementat
 **Guardrails**
 - Read both delta and main specs before making changes
 - Preserve existing content not mentioned in delta
+- Never copy a delta file into a main spec as-is - merge its content so the main spec keeps the Main Spec Format Reference structure, with no delta operation headers
 - If something is unclear, ask for clarification
 - Show what you're changing as you go
 - The operation should be idempotent - running twice should give same result
+- Use only `artifactPaths.specs.existingOutputPaths`; never infer delta specs from unrelated artifacts
+- Honor a caller-supplied subset of `existingOutputPaths`; never widen it back to the full list
+- Fetch specs instructions once for direct sync, or reuse the archive-supplied snapshot inline
+- Stop before every main-spec write on a non-zero or invalid JSON specs-instruction response
+- Artifact rules constrain only the specs being written and are never copied into output files
diff --git a/.opencode/commands/opsx-verify.md b/.opencode/commands/opsx-verify.md
index de6d1450f..6c0b7bc6e 100644
--- a/.opencode/commands/opsx-verify.md
+++ b/.opencode/commands/opsx-verify.md
@@ -1,24 +1,28 @@
 ---
-description: Verify implementation matches change artifacts before archiving
+description: "Verify implementation matches change artifacts before archiving"
 ---
 
 Verify that an implementation matches the change artifacts (specs, tasks, design).
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
 
 **Input**: Optionally specify a change name after `/opsx-verify` (e.g., `/opsx-verify add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+**Provided arguments**: $ARGUMENTS
 
 **Steps**
 
-1. **If no change name provided, prompt for selection**
+1. **Select the change**
 
-   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes and ask the user to select one
 
-   Show changes that have implementation tasks (tasks artifact exists).
+   When prompting, show changes that have implementation tasks (tasks artifact exists).
    Include the schema used for each change if available.
    Mark changes with incomplete tasks as "(In Progress)".
 
-   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+   Always announce: "Using change: <name>" and how to override (e.g., `/opsx-verify <other>`).
 
 2. **Check status to understand the schema**
    ```bash
@@ -106,7 +110,7 @@ Verify that an implementation matches the change artifacts (specs, tasks, design
 8. **Generate Verification Report**
 
    **Summary Scorecard**:
-   ```
+   ```markdown
    ## Verification Report: <change-name>
 
    ### Summary
diff --git a/.opencode/skills/openspec-apply-change/SKILL.md b/.opencode/skills/openspec-apply-change/SKILL.md
index e44e01f95..15ddcc3f3 100644
--- a/.opencode/skills/openspec-apply-change/SKILL.md
+++ b/.opencode/skills/openspec-apply-change/SKILL.md
@@ -7,14 +7,14 @@ compatibility: Requires openspec CLI.
 metadata:
   author: openspec
   version: "1.0"
-  generatedBy: "1.6.0"
+  generatedBy: "1.10.0"
 ---
 
 Implement tasks from an OpenSpec change.
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
 
-**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+**Input**: Optionally specify a change name (e.g., `/opsx-apply add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
 
 **Steps**
 
@@ -23,7 +23,7 @@ Implement tasks from an OpenSpec change.
    If a name is provided, use it. Otherwise:
    - Infer from conversation context if the user mentioned a change
    - Auto-select if only one active change exists
-   - If ambiguous, run `openspec list --json` to get available changes and use the **AskUserQuestion tool** to let the user select
+   - If ambiguous, run `openspec list --json` to get available changes and ask the user to select one
 
    Always announce: "Using change: <name>" and how to override (e.g., `/opsx-apply <other>`).
 
@@ -47,12 +47,29 @@ Implement tasks from an OpenSpec change.
    - Progress (total, complete, remaining)
    - Task list with status
    - Dynamic instruction based on current state
+   - Optional `context`: current required project instruction input from the selected root
+   - Optional `operationGuidance`: current advisory guidance for apply
 
    **Handle states:**
-   - If `state: "blocked"` (missing artifacts): show message, suggest using openspec-continue-change
+   - If `state: "blocked"` (missing artifacts): show message, suggest using `/opsx-continue` (if it is not installed, run `openspec status --change "<name>" --json` to see the next artifact and `openspec instructions <artifact-id> --change "<name>" --json` for how to create it)
    - If `state: "all_done"`: congratulate, suggest archive
    - Otherwise: proceed to implementation
 
+   Treat `context` as a required prompt-level input. Read and consider it, and
+   apply relevant project facts, conventions, and constraints while implementing.
+   Treat `operationGuidance` as optional additive advice. Read and consider every
+   entry, and follow entries that are applicable and compatible with the built-in
+   workflow.
+
+   Keep both fields separate from CLI-returned state, missing artifacts, tasks,
+   progress, `contextFiles`, and the built-in `instruction`. They are not
+   evidence of task completion, do not replace the built-in instruction, and do
+   not permit bypassing a blocked state. If context conflicts with the built-in
+   instruction, an explicit user choice, or a CLI-controlled value, report the
+   conflict and preserve the controlling value. If guidance is inapplicable or
+   conflicts with those controlling inputs, do not follow it and explain why.
+   These are prompt-level behavior contracts, not enforceable checks.
+
 4. **Read context files**
 
    Read every file path listed under `contextFiles` from the apply instructions output.
@@ -60,6 +77,9 @@ Implement tasks from an OpenSpec change.
    - **spec-driven**: proposal, specs, design, tasks
    - Other schemas: follow the contextFiles from CLI output
 
+   Do not copy `context` or `operationGuidance` verbatim into implementation
+   files or planning artifacts unless the user separately asks for that content.
+
 5. **Show current progress**
 
    Display:
@@ -80,6 +100,7 @@ Implement tasks from an OpenSpec change.
    **Pause if:**
    - Task is unclear → ask for clarification
    - Implementation reveals a design issue → suggest updating artifacts
+   - A task needs work beyond what the spec and tasks describe, or you are tempted to drop, narrow, defer, or accept exceptions to specified behavior to make it fit → surface the added scope and ask; do not absorb it silently
    - Error or blocker encountered → report and wait for guidance
    - User interrupts
 
@@ -119,7 +140,7 @@ Working on task 4/7: <task description>
 - [x] Task 2
 ...
 
-All tasks complete! Ready to archive this change.
+All tasks complete! You can archive this change with `/opsx-archive`.
 ```
 
 **Output On Pause (Issue Encountered)**
@@ -150,7 +171,14 @@ What would you like to do?
 - Keep code changes minimal and scoped to each task
 - Update task checkbox immediately after completing each task
 - Pause on errors, blockers, or unclear requirements - don't guess
+- When a task needs work beyond what the spec describes, surface the added scope and pause - never silently narrow, defer, or simplify away specified behavior
+- Only mark a task `- [x]` when its specified behavior is fully implemented, not when it is partially done or deferred
 - Use contextFiles from CLI output, don't assume specific file names
+- Do not use context or operation guidance as proof that a task is complete
+- Apply relevant project context; report conflicts with controlling workflow inputs
+- Consider every guidance entry; explain any inapplicable or conflicting advice
+- Do not copy runtime context or operation guidance into implementation files or planning artifacts
+- Preserve CLI-controlled blocked/ready/all-done behavior and completion criteria
 
 **Fluid Workflow Integration**
 
diff --git a/.opencode/skills/openspec-archive-change/SKILL.md b/.opencode/skills/openspec-archive-change/SKILL.md
index c0c169d14..33a10eca2 100644
--- a/.opencode/skills/openspec-archive-change/SKILL.md
+++ b/.opencode/skills/openspec-archive-change/SKILL.md
@@ -7,25 +7,57 @@ compatibility: Requires openspec CLI.
 metadata:
   author: openspec
   version: "1.0"
-  generatedBy: "1.6.0"
+  generatedBy: "1.10.0"
 ---
 
 Archive a completed change in the experimental workflow.
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+`<capability-path>` is the spec directory relative to `specs/` (for example, `user-auth` or `identity/user-auth`). Preserve the full path from each delta spec when resolving its main spec.
 
 **Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
 
 **Steps**
 
-1. **If no change name provided, prompt for selection**
+1. **Select the change**
 
-   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes and ask the user to select one
 
-   Show only active changes (not already archived).
+   When prompting, show only active changes (not already archived).
    Include the schema used for each change if available.
 
-   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+   Always announce: "Using change: <name>" and how to override (e.g., `/opsx-archive <other>`).
+
+   **Load current archive inputs before the existing archive checks:**
+
+   After resolving the selected change and planning root, run:
+   ```bash
+   openspec instructions archive --change "<name>" --json
+   ```
+   Keep the same selected-root flags on this command. This lookup is advisory and
+   optional: it only supplies extra prompt inputs, so it must never block archiving.
+   If it exits non-zero or returns invalid JSON — for example on an older CLI that
+   does not support this command yet — continue the archive workflow with no
+   context and no operation guidance. Do not report an error and do not stop.
+
+   A successful response may omit both optional fields. Treat `context` as a
+   required prompt-level input: read and consider it, and apply relevant project
+   facts, conventions, and constraints. Treat `operationGuidance` as optional
+   additive advice: read and consider every entry, and follow entries that are
+   applicable and compatible with the built-in archive workflow.
+
+   Keep both fields separate from built-in steps, explicit user choices, resolved
+   paths, CLI checks, and command contracts. If context conflicts with one of those
+   controlling inputs, report the conflict and preserve the controlling value. If
+   guidance is inapplicable or conflicts with a controlling input, do not follow it
+   and explain why. Do not infer replacement paths, skipped prompts, or flags from
+   either field, and do not copy their text verbatim into specs, change artifacts,
+   or archive summaries unless the user separately asks for it. These are
+   prompt-level behavior contracts, not enforceable checks.
 
 2. **Check artifact completion status**
 
@@ -34,11 +66,11 @@ Archive a completed change in the experimental workflow.
    Parse the JSON to understand:
    - `schemaName`: The workflow being used
    - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context
-   - `artifacts`: List of artifacts with their status (`done` or other)
+   - `artifacts`: List of artifacts with their status (`done`, `skipped`, or other)
 
-   **If any artifacts are not `done`:**
+   **If any artifacts are neither `done` nor `skipped`** (skipped artifacts satisfy the requirement - the change declares skip_specs):
    - Display warning listing incomplete artifacts
-   - Use **AskUserQuestion tool** to confirm user wants to proceed
+   - Ask the user to confirm they want to proceed
    - Proceed if user confirms
 
 3. **Check task completion status**
@@ -49,17 +81,20 @@ Archive a completed change in the experimental workflow.
 
    **If incomplete tasks found:**
    - Display warning showing count of incomplete tasks
-   - Use **AskUserQuestion tool** to confirm user wants to proceed
+   - Ask the user to confirm they want to proceed
    - Proceed if user confirms
 
    **If no tasks file exists:** Proceed without task-related warning.
 
 4. **Assess delta spec sync state**
 
-   Use `artifactPaths.specs.existingOutputPaths` from status JSON to check for delta specs. If none exist, proceed without sync prompt.
+   Use `artifactPaths.specs.existingOutputPaths` from status JSON as the only
+   delta-spec source. If the `specs` entry is missing or
+   `existingOutputPaths` is empty, proceed without a sync prompt and do not infer
+   delta specs from other artifacts.
 
    **If delta specs exist:**
-   - Compare each delta spec with its corresponding main spec at `openspec/specs/<capability>/spec.md`
+   - Compare each delta spec with its corresponding main spec at `<planningHome.root>/openspec/specs/<capability-path>/spec.md` (use the store-aware `planningHome.root` from step 2, not a hardcoded repo path)
    - Determine what changes would be applied (adds, modifications, removals, renames)
    - Show a combined summary before prompting
 
@@ -67,7 +102,30 @@ Archive a completed change in the experimental workflow.
    - If changes needed: "Sync now (recommended)", "Archive without syncing"
    - If already synced: "Archive now", "Sync anyway", "Cancel"
 
-   If user chooses sync, use Task tool (subagent_type: "general-purpose", prompt: "Use Skill tool to invoke openspec-sync-specs for change '<name>'. Delta spec analysis: <include the analyzed delta spec summary>"). Proceed to archive regardless of choice.
+   Route on the answer:
+   - "Cancel" — stop, do not archive
+   - "Archive without syncing" or "Archive now" — proceed to archive
+   - "Sync now" or "Sync anyway" — sync, then verify (below)
+   - Anything else — ask again rather than archiving
+
+   Before a selected sync writes any main spec, run
+   `openspec instructions specs --change "<name>" --json` once with the same
+   selected-root flags. Require a zero exit status and valid artifact-instruction
+   JSON. If the lookup fails or returns invalid JSON, report the error and stop
+   before writing any main spec or moving the change. A valid response with omitted
+   `rules` is the no-rules case. Apply returned `rules` only to the content and
+   form of main specs produced by this merge; do not use them as archive guidance,
+   change CLI behavior, or copy the rule text into any output file.
+
+   Then run the `openspec-sync-specs` workflow inline (agent-driven intelligent merge) for change '<name>', passing the delta spec analysis and the fetched specs-rule snapshot from above, and wait for it to finish. The inline sync must reuse that snapshot without fetching `specs` instructions again. Do not delegate it to a background task — step 5 would move `changeRoot` out from under a sync that is still reading it, leaving the change archived and the main specs never updated. If your agent can only run it by delegation, delegate synchronously and wait for the result.
+
+   Then re-run the comparison from the top of this step against every capability that has a delta spec in `artifactPaths.specs.existingOutputPaths` — not only the ones the sync reports it touched. A successful sync leaves nothing left to apply, so each capability must now read as already synced:
+   - ADDED requirements present
+   - MODIFIED requirements carrying the scenario and description changes named in the delta, with their other scenarios intact
+   - REMOVED requirements gone — and where this sync retired a capability (removed its last requirement, leaving `## Requirements` empty), its main spec deleted rather than left empty; a spec the sync deliberately kept and reported is also a match
+   - RENAMED requirements present under the new name and absent under the old one
+
+   If the sync failed, or any capability does not match, report what differs and stop — do not archive. Nothing has moved and `changeRoot` is intact, so the user can fix the mismatch or re-run the sync and start the archive again.
 
 5. **Perform the archive**
 
@@ -76,14 +134,14 @@ Archive a completed change in the experimental workflow.
    mkdir -p "<planningHome.changesDir>/archive"
    ```
 
-   Generate target name using current date: `YYYY-MM-DD-<change-name>`
+   Generate the target name: use the change name as-is when it already starts with a `YYYY-MM-DD-` prefix; otherwise prepend the current date as `YYYY-MM-DD-<change-name>`. Never stack a second date (same rule as `openspec archive`).
 
    **Check if target already exists:**
    - If yes: Fail with error, suggest renaming existing archive or using different date
    - If no: Move `changeRoot` to the archive directory
 
    ```bash
-   mv "<changeRoot>" "<planningHome.changesDir>/archive/YYYY-MM-DD-<name>"
+   mv "<changeRoot>" "<planningHome.changesDir>/archive/<target-name>"
    ```
 
 6. **Display summary**
@@ -97,22 +155,28 @@ Archive a completed change in the experimental workflow.
 
 **Output On Success**
 
-```
+```markdown
 ## Archive Complete
 
 **Change:** <change-name>
 **Schema:** <schema-name>
-**Archived to:** the archive path derived from `planningHome.changesDir`/YYYY-MM-DD-<name>/
-**Specs:** ✓ Synced to main specs (or "No delta specs" or "Sync skipped")
+**Archived to:** the archive path derived from `planningHome.changesDir`/<target-name>/
+**Specs:** <"✓ Synced to main specs" only if the step 4 verification passed; otherwise "No delta specs" or "Sync skipped">
 
-All artifacts complete. All tasks complete.
+<"All artifacts complete. All tasks complete." — or, if archived with warnings, list them instead (e.g. "Archived with 2 incomplete tasks")>
 ```
 
 **Guardrails**
-- Always prompt for change selection if not provided
+- Announce the selected change; prompt for selection when it is ambiguous
 - Use artifact graph (openspec status --json) for completion checking
 - Don't block archive on warnings - just inform and confirm
 - Preserve .openspec.yaml when moving to archive (it moves with the directory)
 - Show clear summary of what happened
-- If sync is requested, use openspec-sync-specs approach (agent-driven)
+- If sync is requested, run the `openspec-sync-specs` workflow inline (agent-driven)
+- Never archive while a spec sync is still in flight — run the sync inline and verify the main specs before moving `changeRoot`
 - If delta specs exist, always run the sync assessment and show the combined summary before prompting
+- Apply relevant runtime context and report conflicts; operation guidance remains advisory
+- Consider every guidance entry and explain any inapplicable or conflicting advice
+- Existing CLI checks, resolved paths, prompts, and command contracts are unchanged
+- Artifact rules constrain only the specs being written and are never operation guidance
+- Never copy runtime context, operation guidance, or artifact-rule text verbatim into output files
diff --git a/.opencode/skills/openspec-bulk-archive-change/SKILL.md b/.opencode/skills/openspec-bulk-archive-change/SKILL.md
index 309152af7..0faa60c60 100644
--- a/.opencode/skills/openspec-bulk-archive-change/SKILL.md
+++ b/.opencode/skills/openspec-bulk-archive-change/SKILL.md
@@ -7,14 +7,16 @@ compatibility: Requires openspec CLI.
 metadata:
   author: openspec
   version: "1.0"
-  generatedBy: "1.6.0"
+  generatedBy: "1.10.0"
 ---
 
 Archive multiple completed changes in a single operation.
 
 This skill allows you to batch-archive changes, handling spec conflicts intelligently by checking the codebase to determine what's actually implemented.
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+`<capability-path>` is the spec directory relative to `specs/` (for example, `user-auth` or `identity/user-auth`). Preserve the full path from each delta spec when resolving its main spec.
 
 **Input**: None required (prompts for selection)
 
@@ -28,13 +30,38 @@ This skill allows you to batch-archive changes, handling spec conflicts intellig
 
 2. **Prompt for change selection**
 
-   Use **AskUserQuestion tool** with multi-select to let user choose changes:
+   Ask the user to choose changes (multi-select):
    - Show each change with its schema
    - Include an option for "All changes"
    - Allow any number of selections (1+ works, 2+ is the typical use case)
 
    **IMPORTANT**: Do NOT auto-select. Always let the user choose.
 
+   **Load current archive inputs once for the selected root before batch validation:**
+
+   Choose one selected change from this root and run
+   `openspec instructions archive --change "<selected-change>" --json` with the
+   same selected-root flags. This lookup is advisory and optional: it only supplies
+   extra prompt inputs, so it must never block the batch. If it fails or returns
+   invalid JSON — for example on an older CLI that does not support this command
+   yet — continue the batch with no context and no operation guidance. Do not
+   report an error and do not stop.
+
+   A valid response may omit `context` and `operationGuidance`. Treat
+   `context` as a required prompt-level input across the batch: read and consider
+   it, and apply relevant project facts, conventions, and constraints. Treat
+   `operationGuidance` as optional additive advice: read and consider every
+   entry, and follow entries that are applicable and compatible with the built-in
+   batch workflow.
+
+   Keep both fields separate from conflict analysis, explicit user choices,
+   resolved paths, CLI checks, and command contracts. If context conflicts with one
+   of those controlling inputs, report the conflict and preserve the controlling
+   value. If guidance is inapplicable or conflicts with a controlling input, do not
+   follow it and explain why. Do not infer skipped prompts, replacement paths, or
+   flags from either field, and do not copy their text verbatim into specs, changes,
+   or summaries. These are prompt-level behavior contracts, not enforceable checks.
+
 3. **Batch validation - gather status for all selected changes**
 
    For each selected change, collect:
@@ -50,17 +77,21 @@ This skill allows you to batch-archive changes, handling spec conflicts intellig
    c. **Delta specs** - Check `artifactPaths.specs.existingOutputPaths` from status JSON
       - List which capability specs exist
       - For each, extract requirement names (lines matching `### Requirement: <name>`)
-
+      - Treat this list as the only delta-spec source. If the `specs` entry is
+        missing or the list is empty, perform no spec sync or specs-instruction
+        lookup for that change; do not infer deltas from unrelated artifacts.
+      - Evaluate this independently for every change, including mixed-schema
+        batches where some schemas have no `specs` artifact.
 4. **Detect spec conflicts**
 
-   Build a map of `capability -> [changes that touch it]`:
+   Build a map keyed by `<capability-path>`, the exact path relative to `specs/`:
 
-   ```
-   auth -> [change-a, change-b]  <- CONFLICT (2+ changes)
-   api  -> [change-c]            <- OK (only 1 change)
+   ```text
+   identity/user-auth -> [change-a, change-b]  <- CONFLICT (2+ changes)
+   billing/user-auth  -> [change-c]            <- OK (different full path)
    ```
 
-   A conflict exists when 2+ selected changes have delta specs for the same capability.
+   A conflict exists when 2+ selected changes have delta specs for the exact same `<capability-path>`.
 
 5. **Resolve conflicts agentically**
 
@@ -78,38 +109,39 @@ This skill allows you to batch-archive changes, handling spec conflicts intellig
       - If neither implemented -> skip spec sync, warn user
 
    d. **Record resolution** for each conflict:
-      - Which change's specs to apply
-      - In what order (if both)
+      - An inclusion or exclusion decision for every delta spec, keyed by change and `<capability-path>`
+      - Which included delta specs to apply and in what order
+      - Which delta specs to exclude from sync because their implementation is missing
       - Rationale (what was found in codebase)
 
 6. **Show consolidated status table**
 
    Display a table summarizing all changes:
 
-   ```
+   ```markdown
    | Change              | Artifacts | Tasks | Specs   | Conflicts | Status |
    |---------------------|-----------|-------|---------|-----------|--------|
    | schema-management   | Done      | 5/5   | 2 delta | None      | Ready  |
    | project-config      | Done      | 3/3   | 1 delta | None      | Ready  |
-   | add-oauth           | Done      | 4/4   | 1 delta | auth (!)  | Ready* |
+   | add-oauth           | Done      | 4/4   | 1 delta | identity/user-auth (!) | Ready* |
    | add-verify-skill    | 1 left    | 2/5   | None    | None      | Warn   |
    ```
 
    For conflicts, show the resolution:
-   ```
+   ```text
    * Conflict resolution:
-     - auth spec: Will apply add-oauth then add-jwt (both implemented, chronological order)
+     - identity/user-auth spec: Will apply add-oauth then add-jwt (both implemented, chronological order)
    ```
 
    For incomplete changes, show warnings:
-   ```
+   ```text
    Warnings:
    - add-verify-skill: 1 incomplete artifact, 3 incomplete tasks
    ```
 
 7. **Confirm batch operation**
 
-   Use **AskUserQuestion tool** with a single confirmation:
+   Ask the user a single confirmation question:
 
    - "Archive N changes?" with options based on status
    - Options might include:
@@ -119,31 +151,73 @@ This skill allows you to batch-archive changes, handling spec conflicts intellig
 
    If there are incomplete changes, make clear they'll be archived with warnings.
 
+   Route on the answer by intent, not by exact label — you wrote these labels,
+   so match what the user picked rather than the wording above:
+   - "Cancel" — stop, do not archive. Report that nothing was archived and skip the remaining steps.
+   - The archive-everything option — proceed with every selected change
+   - The ready-only option — proceed with only the changes the step 6 table marks `Ready` or `Ready*`, and record the rest as Skipped in step 8d. If a `Ready*` change's conflict partner is skipped, re-derive that conflict's resolution using only the changes being archived.
+   - Anything else — ask again rather than archiving
+
+   Before step 8 writes the first main spec or moves any change, fetch every
+   required specs-rule snapshot for the confirmed batch. For each change that will
+   sync concrete `artifactPaths.specs.existingOutputPaths`, run
+   `openspec instructions specs --change "<name>" --json` exactly once with the
+   same selected-root flags. Obtain all snapshots before the first write or move.
+   If any lookup exits non-zero or returns invalid artifact-instruction JSON,
+   identify the affected change, report the error, and stop the whole batch before
+   any main-spec write or change move. Do not treat lookup failure as omitted
+   rules. A valid response without `rules` is the no-rules case.
+
 8. **Execute archive for each confirmed change**
 
+   Before processing, carry the recorded decisions from step 5 (after any step 7 re-derivation) into two per-delta sets:
+   - `includedDeltas`: all non-conflicting delta specs from confirmed changes plus conflict deltas selected for sync
+   - `excludedDeltas`: conflict deltas from confirmed changes excluded because their implementation is missing
+   - A single change can have both included and excluded delta specs. Keep the decision per delta; do not collapse it into a per-change sync flag.
+
    Process changes in the determined order (respecting conflict resolution):
 
-   a. **Sync specs** if delta specs exist:
-      - Use the openspec-sync-specs approach (agent-driven intelligent merge)
-      - For conflicts, apply in resolved order
-      - Track if sync was done
+   a. **Sync included delta specs**:
+      - Run the `openspec-sync-specs` workflow inline (agent-driven intelligent merge) only for changes with entries in `includedDeltas`, passing only the included delta paths and explicitly instructing it to ignore that change's `excludedDeltas`. Wait for it to finish.
+      - For conflicts, apply in resolved order.
+      - Pass that change's fetched specs-rule snapshot into inline sync; inline
+        sync must reuse it without fetching instructions again
+      - Apply artifact rules only to main specs produced by that change. They do
+        not change conflict resolution, archive behavior, or CLI contracts, and
+        their text is not copied into an output file
+      - Do not delegate to a background task — step 8c would move `changeRoot` out from under a sync that is still reading it.
+      - If a change has no included delta specs, do not run the sync workflow for it.
+
+   b. **Verify included delta specs before moving changeRoot**:
+      - Re-run the comparison only for delta specs in `includedDeltas` against main spec at `<planningHome.root>/openspec/specs/<capability-path>/spec.md` (use the store-aware `planningHome.root` from step 3 status JSON, not a hardcoded repo path).
+      - Verify that main specs are updated:
+        - ADDED requirements present
+        - MODIFIED requirements carrying scenario and description changes named in the delta, with their other scenarios intact
+        - REMOVED requirements gone — and where this sync retired a capability (removed its last requirement, leaving `## Requirements` empty), its main spec deleted rather than left empty; a spec the sync deliberately kept and reported is also a match
+        - RENAMED requirements present under the new name and absent under the old one
+      - Do not verify delta specs in `excludedDeltas`; they are intentionally left unsynced.
+      - If sync failed or any capability does not match verification, report what differs and fail/skip moving that change's `changeRoot` — do not archive that change. `changeRoot` remains intact.
+
+   c. **Perform the archive**:
+
+      Target name: use the change name as-is when it already starts with a `YYYY-MM-DD-` prefix; otherwise prepend the current date as `YYYY-MM-DD-<name>` (same rule as `openspec archive`).
 
-   b. **Perform the archive**:
       ```bash
       mkdir -p "<planningHome.changesDir>/archive"
-      mv "<changeRoot>" "<planningHome.changesDir>/archive/YYYY-MM-DD-<name>"
+      mv "<changeRoot>" "<planningHome.changesDir>/archive/<target-name>"
       ```
 
-   c. **Track outcome** for each change:
+   d. **Track outcome** for each change:
       - Success: archived successfully
-      - Failed: error during archive (record error)
+      - Failed: error during archive or spec verification (record error)
       - Skipped: user chose not to archive (if applicable)
+      - Sync skipped: for every delta in `excludedDeltas`, report `sync skipped` with the change, `<capability-path>`, and recorded reason. This is distinct from skipping the archive.
 
 9. **Display summary**
 
    Show final results:
 
-   ```
+   ```markdown
    ## Bulk Archive Complete
 
    Archived 3 changes:
@@ -156,11 +230,12 @@ This skill allows you to batch-archive changes, handling spec conflicts intellig
 
    Spec sync summary:
    - 4 delta specs synced to main specs
-   - 1 conflict resolved (auth: applied both in chronological order)
+   - 1 delta spec sync skipped (add-jwt, identity/user-auth: implementation not found)
+   - 1 conflict resolved (identity/user-auth: synced add-oauth, skipped add-jwt)
    ```
 
    If any failures:
-   ```
+   ```text
    Failed 1 change:
    - some-change: Archive directory already exists
    ```
@@ -168,8 +243,8 @@ This skill allows you to batch-archive changes, handling spec conflicts intellig
 **Conflict Resolution Examples**
 
 Example 1: Only one implemented
-```
-Conflict: specs/auth/spec.md touched by [add-oauth, add-jwt]
+```text
+Conflict: <planningHome.root>/openspec/specs/auth/spec.md touched by [add-oauth, add-jwt]
 
 Checking add-oauth:
 - Delta adds "OAuth Provider Integration" requirement
@@ -183,8 +258,8 @@ Resolution: Only add-oauth is implemented. Will sync add-oauth specs only.
 ```
 
 Example 2: Both implemented
-```
-Conflict: specs/api/spec.md touched by [add-rest-api, add-graphql]
+```text
+Conflict: <planningHome.root>/openspec/specs/api/spec.md touched by [add-rest-api, add-graphql]
 
 Checking add-rest-api (created 2026-01-10):
 - Delta adds "REST Endpoints" requirement
@@ -200,12 +275,12 @@ then add-graphql specs (chronological order, newer takes precedence).
 
 **Output On Success**
 
-```
+```markdown
 ## Bulk Archive Complete
 
 Archived N changes:
-- <change-1> -> archive/YYYY-MM-DD-<change-1>/
-- <change-2> -> archive/YYYY-MM-DD-<change-2>/
+- <change-1> -> archive/<target-name-1>/
+- <change-2> -> archive/<target-name-2>/
 
 Spec sync summary:
 - N delta specs synced to main specs
@@ -214,11 +289,11 @@ Spec sync summary:
 
 **Output On Partial Success**
 
-```
+```markdown
 ## Bulk Archive Complete (partial)
 
 Archived N changes:
-- <change-1> -> archive/YYYY-MM-DD-<change-1>/
+- <change-1> -> archive/<target-name-1>/
 
 Skipped M changes:
 - <change-2> (user chose not to archive incomplete)
@@ -229,7 +304,7 @@ Failed K changes:
 
 **Output When No Changes**
 
-```
+```markdown
 ## No Changes to Archive
 
 No active changes found. Create a new change to get started.
@@ -243,7 +318,22 @@ No active changes found. Create a new change to get started.
 - Skip spec sync only when implementation is missing (warn user)
 - Show clear per-change status before confirming
 - Use single confirmation for entire batch
+- Never archive after the user cancels the confirmation — a cancelled batch archives nothing
 - Track and report all outcomes (success/skip/fail)
 - Preserve .openspec.yaml when moving to archive
-- Archive directory target uses current date: YYYY-MM-DD-<name>
+- Archive directory target uses current date: YYYY-MM-DD-<name>; a name that already starts with a `YYYY-MM-DD-` prefix is used as-is (never stack a second date)
 - If archive target exists, fail that change but continue with others
+- If sync is requested, run the `openspec-sync-specs` workflow inline (agent-driven) for each change with included delta specs
+- Carry the per-delta `includedDeltas` and `excludedDeltas` decisions into execution; sync and verify only included deltas
+- Report every excluded delta as `sync skipped` without treating the archive itself as skipped
+- Never archive a change while a spec sync is still in flight — run the sync inline and verify main specs at `<planningHome.root>/openspec/specs/<capability-path>/spec.md` before moving `changeRoot`
+- Fetch archive inputs once per selected root before spec inspection or moves
+- Fetch all required specs-rule snapshots before the batch's first main-spec write or move
+- A failed archive-inputs lookup never blocks the batch; it proceeds with no context or guidance
+- A failed specs instruction lookup stops the whole batch atomically
+- Changes without concrete `artifactPaths.specs.existingOutputPaths` continue without spec sync
+- Apply relevant runtime context across the batch and report conflicts
+- Operation guidance remains advisory; consider every entry and explain rejected advice
+- Keep runtime inputs, conflict analysis, CLI-derived values, and artifact rules separate
+- Artifact rules constrain only written specs
+- Never copy runtime input or artifact-rule text verbatim into output files
diff --git a/.opencode/skills/openspec-continue-change/SKILL.md b/.opencode/skills/openspec-continue-change/SKILL.md
index 31b476f24..f61a83461 100644
--- a/.opencode/skills/openspec-continue-change/SKILL.md
+++ b/.opencode/skills/openspec-continue-change/SKILL.md
@@ -7,22 +7,25 @@ compatibility: Requires openspec CLI.
 metadata:
   author: openspec
   version: "1.0"
-  generatedBy: "1.6.0"
+  generatedBy: "1.10.0"
 ---
 
 Continue working on a change by creating the next artifact.
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
 
 **Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
 
 **Steps**
 
-1. **If no change name provided, prompt for selection**
+1. **Select the change**
 
-   Run `openspec list --json` to get available changes sorted by most recently modified. Then use the **AskUserQuestion tool** to let the user select which change to work on.
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes sorted by most recently modified, and ask the user to select one
 
-   Present the top 3-4 most recently modified changes as options, showing:
+   When prompting, present the top 3-4 most recently modified changes as options, showing:
    - Change name
    - Schema (from `schema` field if present, otherwise "spec-driven")
    - Status (e.g., "0/5 tasks", "complete", "no tasks")
@@ -30,7 +33,7 @@ Continue working on a change by creating the next artifact.
 
    Mark the most recently modified change as "(Recommended)" since it's likely what the user wants to continue.
 
-   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+   Always announce: "Using change: <name>" and how to override (e.g., `/opsx-continue <other>`).
 
 2. **Check current status**
    ```bash
@@ -38,18 +41,18 @@ Continue working on a change by creating the next artifact.
    ```
    Parse the JSON to understand current state. The response includes:
    - `schemaName`: The workflow schema being used (e.g., "spec-driven")
-   - `artifacts`: Array of artifacts with their status ("done", "ready", "blocked")
-   - `isComplete`: Boolean indicating if all artifacts are complete
+   - `artifacts`: Array of artifacts with their status ("done", "skipped", "ready", "blocked")
+   - `isPlanningComplete`: Boolean indicating if all planning artifacts are complete. Older CLI versions expose the same value as `isComplete`.
    - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context. Use these instead of assuming repo-local paths.
 
 3. **Act based on status**:
 
    ---
 
-   **If all artifacts are complete (`isComplete: true`)**:
+   **If all planning artifacts are complete (`isPlanningComplete: true`, or legacy `isComplete: true`)**:
    - Congratulate the user
    - Show final status including the schema used
-   - Suggest: "All artifacts created! You can now implement this change or archive it."
+   - Suggest: "Planning is complete! You can now implement this change. Once implementation and any tracked work are complete, archive it."
    - STOP
 
    ---
@@ -66,10 +69,12 @@ Continue working on a change by creating the next artifact.
      - `template`: The structure to use for your output file
      - `instruction`: Schema-specific guidance
      - `resolvedOutputPath`: Resolved path or pattern to write the artifact
-     - `dependencies`: Completed artifacts to read for context
+     - `dependencies`: Completed artifacts to read for context (entries with `skipped: true` have no files - do not look for them)
+     - `skipped`/`warning`: present when the change declares skip_specs and this artifact must NOT be created - pick another artifact
    - **Create the artifact file**:
-     - Read any completed dependency files for context
-     - Use `template` as the structure - fill in its sections
+     - Read any completed dependency files for context - always re-read them from disk, even if you saw them earlier in the conversation (the user may have edited them)
+     - If the `instruction` field delegates creation to a specific skill or command, invoke it to produce the artifact instead of writing the file yourself, then verify the artifact file exists at `resolvedOutputPath`
+     - Otherwise use `template` as the structure - fill in its sections
      - Apply `context` and `rules` as constraints when writing - but do NOT copy them into the file
      - Write to the `resolvedOutputPath` specified in instructions. If it is a glob pattern, choose the concrete file path using the schema instruction and the change's context
    - Show what was created and what's now unlocked
@@ -97,22 +102,13 @@ After each invocation, show:
 
 **Artifact Creation Guidelines**
 
-The artifact types and their purpose depend on the schema. Use the `instruction` field from the instructions output to understand what to create.
+The artifact types and their purpose depend on the schema. The `instruction` field from the instructions output is the authoritative guidance for each artifact - follow it even when the artifact has a familiar name (proposal.md, tasks.md, etc.), since custom schemas may define different content or a different process for the same file names.
 
-Common artifact patterns:
-
-**spec-driven schema** (proposal → specs → design → tasks):
-- **proposal.md**: Ask user about the change if not clear. Fill in Why, What Changes, Capabilities, Impact.
-  - The Capabilities section is critical - each capability listed will need a spec file.
-- **specs/<capability>/spec.md**: Create one spec per capability listed in the proposal's Capabilities section (use the capability name, not the change name).
-- **design.md**: Document technical decisions, architecture, and implementation approach.
-- **tasks.md**: Break down implementation into checkboxed tasks.
-
-For other schemas, follow the `instruction` field from the CLI output.
+If the `instruction` field directs you to use a specific skill or command to create the artifact, invoke it instead of writing the artifact directly.
 
 **Guardrails**
 - Create ONE artifact per invocation
-- Always read dependency artifacts before creating a new one
+- Always read dependency artifacts before creating a new one - re-read from disk, not from conversation memory (files may have changed since you last saw them)
 - Never skip artifacts or create out of order
 - If context is unclear, ask the user before creating
 - Verify the artifact file exists after writing before marking progress
diff --git a/.opencode/skills/openspec-explore/SKILL.md b/.opencode/skills/openspec-explore/SKILL.md
index 894ef32e2..e11d80a42 100644
--- a/.opencode/skills/openspec-explore/SKILL.md
+++ b/.opencode/skills/openspec-explore/SKILL.md
@@ -7,16 +7,16 @@ compatibility: Requires openspec CLI.
 metadata:
   author: openspec
   version: "1.0"
-  generatedBy: "1.6.0"
+  generatedBy: "1.10.0"
 ---
 
 Enter explore mode. Think deeply. Visualize freely. Follow the conversation wherever it goes.
 
-**IMPORTANT: Explore mode is for thinking, not implementing.** You may read files, search code, and investigate the codebase, but you must NEVER write code or implement features. If the user asks you to implement something, remind them to exit explore mode first and create a change proposal. You MAY create OpenSpec artifacts (proposals, designs, specs) if the user asks—that's capturing thinking, not implementing.
+**IMPORTANT: Explore mode is for thinking, not implementing.** You may read files, search code, and investigate the codebase, but you must NEVER write code or implement features. If the user asks you to implement something, remind them to exit explore mode first and create a change proposal. You MAY create OpenSpec artifacts (proposals, designs, specs) if the user asks—that's capturing thinking, not implementing. For a new change, scaffold it first as described below.
 
 **This is a stance, not a workflow.** There are no fixed steps, no required sequence, no mandatory outputs. You're a thinking partner helping the user explore.
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
 
 ---
 
@@ -94,6 +94,12 @@ This tells you:
 - Their names, schemas, and status
 - What the user might be working on
 
+Then read the project's own context from the resolved root - `<root.path>/openspec/config.yaml` (or `config.yml`). Use the `root.path` returned above, and skip this if neither file exists:
+- `context`: project background - tech stack, conventions, constraints
+- `rules`: keyed by artifact id - the entries for an artifact apply only when you write that artifact
+
+Ground your thinking in these. They are constraints for you to follow, not content to reproduce: do NOT copy them into the conversation or into any artifact you create.
+
 ### When no change exists
 
 Think freely. When insights crystallize, you might offer:
@@ -101,6 +107,15 @@ Think freely. When insights crystallize, you might offer:
 - "This feels solid enough to start a change. Want me to create a proposal?"
 - Or keep exploring - no pressure to formalize
 
+If the user asks you to capture the exploration as a new change, transition seamlessly into the requested capture:
+
+1. Run `openspec new change "<name>"` (with `--store <id>` when applicable) before creating any artifacts. Never create a new change directory under `openspec/changes/` by hand; the CLI scaffold creates required metadata such as `.openspec.yaml`. Keep the selected `--store <id>` on every applicable follow-up `status` and `instructions` command.
+2. Run `openspec status --change "<name>" --json` (append the confirmed `--store "<id>"` only for a registered standalone store), then process the requested artifacts in dependency order. For each requested artifact that is `ready`, run `openspec instructions "<artifact-id>" --change "<name>" --json` (append the confirmed `--store "<id>"` only for a registered standalone store). Before creating a requested artifact, evaluate any condition in its own `instruction` against the explored change; record a deliberate skip instead when the condition does not apply. If a requested artifact is blocked by a direct prerequisite the user did not request, run `openspec instructions "<prerequisite-id>" --change "<name>" --json` (append the confirmed `--store "<id>"` only for a registered standalone store) for that prerequisite whether it is `ready` or `blocked`. If its own `instruction` states a condition, evaluate that condition against the explored change and record a deliberate skip only when the condition does not apply. If the condition applies, or the prerequisite is not conditional, treat it as a normal prerequisite and ask before expanding the capture. Do not create an unrequested prerequisite unless the user approves.
+3. Follow the returned `template` and `instruction` fields. Read completed dependency files listed in `dependencies`, and apply `context` and `rules` as constraints without copying them into the artifact. If the instruction delegates creation to a specific skill or command, invoke it; otherwise write the artifact to `resolvedOutputPath`, using the instruction to choose a concrete path when it is a glob. Verify that the selected concrete output exists.
+4. After creating each artifact, re-run `openspec status --change "<name>" --json` (append the confirmed `--store "<id>"` only for a registered standalone store) and continue until every requested artifact is `done`, `skipped`, or was deliberately skipped because its own `instruction` stated a condition that did not apply. Tell the user about a deliberate conditional skip, remember it, and do not reconsider it. Dependencies are enablers, not gates: if a requested artifact is still `blocked` only because you deliberately skipped a conditional prerequisite, run `openspec instructions "<artifact-id>" --change "<name>" --json` (append the confirmed `--store "<id>"` only for a registered standalone store) despite the blocked status, then create it using step 3 only when those recorded conditional skips are its sole missing dependencies. If a requested artifact is blocked by a prerequisite the user did not ask to capture and cannot be conditionally skipped, explain that dependency and ask before expanding the capture.
+
+Capture the artifact(s) the user requested without asking them to invoke another workflow command. If they asked only to start a change, stop after scaffolding and show its status.
+
 ### When a change exists
 
 If the user mentions a change or you detect one is relevant:
@@ -116,14 +131,16 @@ If the user mentions a change or you detect one is relevant:
 
 3. **Offer to capture when decisions are made**
 
-    | Insight Type               | Where to Capture               |
-    |----------------------------|--------------------------------|
-    | New requirement discovered | `specs/<capability>/spec.md` |
-    | Requirement changed        | `specs/<capability>/spec.md` |
-    | Design decision made       | `design.md`                  |
-    | Scope changed              | `proposal.md`                |
-    | New work identified        | `tasks.md`                   |
-    | Assumption invalidated     | Relevant artifact              |
+   `<capability-path>` is the spec directory relative to `specs/` (for example, `user-auth` or `identity/user-auth`). Preserve an existing capability's full path and follow the project's established organization for new capabilities.
+
+    | Insight Type               | Where to Capture                    |
+    |----------------------------|-------------------------------------|
+    | New requirement discovered | `specs/<capability-path>/spec.md` |
+    | Requirement changed        | `specs/<capability-path>/spec.md` |
+    | Design decision made       | `design.md`                       |
+    | Scope changed              | `proposal.md`                     |
+    | New work identified        | `tasks.md`                        |
+    | Assumption invalidated     | Relevant artifact                   |
 
    Example offers:
    - "That's a design decision. Capture it in design.md?"
@@ -285,6 +302,7 @@ But this summary is optional. Sometimes the thinking IS the value.
 - **Don't rush** - Discovery is thinking time, not task time
 - **Don't force structure** - Let patterns emerge naturally
 - **Don't auto-capture** - Offer to save insights, don't just do it
+- **Don't manually scaffold changes** - Never create a new change directory under `openspec/changes/` by hand. Always use `openspec new change "<name>"` (with `--store <id>` when applicable) so required metadata such as `.openspec.yaml` is created before writing artifacts.
 - **Do visualize** - A good diagram is worth many paragraphs
 - **Do explore the codebase** - Ground discussions in reality
 - **Do question assumptions** - Including the user's and your own
diff --git a/.opencode/skills/openspec-ff-change/SKILL.md b/.opencode/skills/openspec-ff-change/SKILL.md
index 81780739b..20ec94ebe 100644
--- a/.opencode/skills/openspec-ff-change/SKILL.md
+++ b/.opencode/skills/openspec-ff-change/SKILL.md
@@ -7,12 +7,12 @@ compatibility: Requires openspec CLI.
 metadata:
   author: openspec
   version: "1.0"
-  generatedBy: "1.6.0"
+  generatedBy: "1.10.0"
 ---
 
 Fast-forward through artifact creation - generate everything needed to start implementation in one go.
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
 
 **Input**: The user's request should include a change name (kebab-case) OR a description of what they want to build.
 
@@ -20,7 +20,7 @@ Fast-forward through artifact creation - generate everything needed to start imp
 
 1. **If no clear input provided, ask what they want to build**
 
-   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
+   Ask the user (open-ended, no preset options):
    > "What change do you want to work on? Describe what you want to build or fix."
 
    From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
@@ -39,12 +39,12 @@ Fast-forward through artifact creation - generate everything needed to start imp
    ```
    Parse the JSON to get:
    - `applyRequires`: array of artifact IDs needed before implementation (e.g., `["tasks"]`)
-   - `artifacts`: list of all artifacts with their status and dependencies
+   - `artifacts`: list of all artifacts, each with its `status` and its `requires` edges (the artifact IDs it directly depends on)
    - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context. Use these instead of assuming repo-local paths.
 
-4. **Create artifacts in sequence until apply-ready**
+4. **Create every artifact in the required set**
 
-   Use the **TodoWrite tool** to track progress through the artifacts.
+   Use a todo list to track progress through the artifacts.
 
    Loop through artifacts in dependency order (artifacts with no pending dependencies first):
 
@@ -58,20 +58,27 @@ Fast-forward through artifact creation - generate everything needed to start imp
         - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
         - `template`: The structure to use for your output file
         - `instruction`: Schema-specific guidance for this artifact type
+        - `skipped`/`warning`: present when the change declares skip_specs and this artifact must NOT be created - stop and pick another artifact
         - `resolvedOutputPath`: Resolved path or pattern to write the artifact
         - `dependencies`: Completed artifacts to read for context
-      - Read any completed dependency files for context
-      - Create the artifact file using `template` as the structure and write it to `resolvedOutputPath`
+      - Read any completed dependency files for context - always re-read them from disk, even if you saw them earlier in the conversation (the user may have edited them)
+      - If the `instruction` field delegates creation to a specific skill or command, invoke it to produce the artifact instead of writing the file yourself, then verify the artifact file exists at `resolvedOutputPath`
+      - Otherwise create the artifact file using `template` as the structure and write it to `resolvedOutputPath`. If `resolvedOutputPath` is a glob, follow `instruction` to choose the concrete file path
       - Apply `context` and `rules` as constraints - but do NOT copy them into the file
       - Show brief progress: "✓ Created <artifact-id>"
 
-   b. **Continue until all `applyRequires` artifacts are complete**
+   b. **Continue until every artifact in the required set exists (not just `apply.requires`)**
       - After creating each artifact, re-run `openspec status --change "<name>" --json`
-      - Check if every artifact ID in `applyRequires` has `status: "done"` in the artifacts array
-      - Stop when all `applyRequires` artifacts are done
+      - The required set is `applyRequires` plus every artifact reachable from those by following the `requires` edges in `status --json` - walk them transitively (spec-driven closes over proposal, specs, design, tasks). Leave artifacts outside that set alone
+      - `status` is file-existence only, so an `applyRequires` artifact reading `done` does NOT mean its dependencies exist - writing `tasks.md` early marks `tasks` done while `specs` was never written. Use each artifact's `requires` edges, not its `status`, to build the required set: a `done` artifact still lists what it depends on
+      - An artifact already reading `status: "skipped"` is satisfied: the change declares `skip_specs` in `.openspec.yaml`, so its files must NOT exist. Never try to create one
+      - Create every artifact in the required set that is missing, then re-check - creating one can unblock others
+      - Skip one only when `status` already reports it `skipped`, or when its own `instruction` says it is conditional: run `openspec instructions <artifact-id> --change "<name>" --json` and skip only if its `instruction` field marks it optional (e.g. "create only if..."). Spec-driven's `design.md` qualifies; `specs` qualifies only via the `skipped` status above, never by your own judgment. Tell the user, and do not reconsider it
+      - Dependencies are enablers, not gates: if a required artifact is still `blocked` only because you skipped a conditional dependency, write it anyway
+      - Stop when every artifact in the required set is `done`, `skipped`, or was deliberately skipped
 
    c. **If an artifact requires user input** (unclear context):
-      - Use **AskUserQuestion tool** to clarify
+      - Ask the user to clarify
       - Then continue with creation
 
 5. **Show final status**
@@ -83,13 +90,14 @@ Fast-forward through artifact creation - generate everything needed to start imp
 
 After completing all artifacts, summarize:
 - Change name and location
-- List of artifacts created with brief descriptions
-- What's ready: "All artifacts created! Ready for implementation."
+- List of artifacts created with brief descriptions, plus any conditional artifact you skipped and why
+- What's ready: "All artifacts needed for implementation are ready."
 - Prompt: "Run `/opsx-apply` or ask me to implement to start working on the tasks."
 
 **Artifact Creation Guidelines**
 
-- Follow the `instruction` field from `openspec instructions` for each artifact type
+- Follow the `instruction` field from `openspec instructions` for each artifact type - it is the authoritative guidance, even for familiar artifact names
+- If the `instruction` field directs you to use a specific skill or command to create the artifact, invoke it instead of writing the artifact directly
 - The schema defines what each artifact should contain - follow it
 - Read dependency artifacts for context before creating new ones
 - Use `template` as the structure for your output file - fill in its sections
@@ -98,8 +106,8 @@ After completing all artifacts, summarize:
   - These guide what you write, but should never appear in the output
 
 **Guardrails**
-- Create ALL artifacts needed for implementation (as defined by schema's `apply.requires`)
-- Always read dependency artifacts before creating a new one
+- Create every artifact the apply phase transitively depends on, not just the ids listed in `apply.requires`
+- Always read dependency artifacts before creating a new one - re-read from disk, not from conversation memory (files may have changed since you last saw them)
 - If context is critically unclear, ask the user - but prefer making reasonable decisions to keep momentum
 - If a change with that name already exists, suggest continuing that change instead
 - Verify each artifact file exists after writing before proceeding to next
diff --git a/.opencode/skills/openspec-new-change/SKILL.md b/.opencode/skills/openspec-new-change/SKILL.md
index b4d8a9e70..88c6005da 100644
--- a/.opencode/skills/openspec-new-change/SKILL.md
+++ b/.opencode/skills/openspec-new-change/SKILL.md
@@ -7,12 +7,12 @@ compatibility: Requires openspec CLI.
 metadata:
   author: openspec
   version: "1.0"
-  generatedBy: "1.6.0"
+  generatedBy: "1.10.0"
 ---
 
 Start a new change using the experimental artifact-driven approach.
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
 
 **Input**: The user's request should include a change name (kebab-case) OR a description of what they want to build.
 
@@ -20,7 +20,7 @@ Start a new change using the experimental artifact-driven approach.
 
 1. **If no clear input provided, ask what they want to build**
 
-   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
+   Ask the user (open-ended, no preset options):
    > "What change do you want to work on? Describe what you want to build or fix."
 
    From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
diff --git a/.opencode/skills/openspec-onboard/SKILL.md b/.opencode/skills/openspec-onboard/SKILL.md
index 52c4228fc..ec7ef56cf 100644
--- a/.opencode/skills/openspec-onboard/SKILL.md
+++ b/.opencode/skills/openspec-onboard/SKILL.md
@@ -7,12 +7,12 @@ compatibility: Requires openspec CLI.
 metadata:
   author: openspec
   version: "1.0"
-  generatedBy: "1.6.0"
+  generatedBy: "1.10.0"
 ---
 
 Guide the user through their first complete OpenSpec workflow cycle. This is a teaching experience—you'll do real work in their codebase while explaining each step.
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
 
 ---
 
@@ -211,6 +211,11 @@ I'll draft one based on our task.
 
 **DO:** Draft the proposal content (don't save yet):
 
+`<capability-path>` is the spec directory relative to `specs/` (for example,
+`user-auth` or `identity/user-auth`). Use the exact existing path for modified
+capabilities. For new capabilities, follow the project's established spec
+organization.
+
 ```
 Here's a draft proposal:
 
@@ -227,10 +232,11 @@ Here's a draft proposal:
 ## Capabilities
 
 ### New Capabilities
-- `<capability-name>`: [brief description]
+- `<capability-path>`: [brief description]
 
 ### Modified Capabilities
 <!-- If modifying existing behavior -->
+- `<existing-capability-path>`: [brief description]
 
 ## Impact
 
@@ -368,12 +374,12 @@ Here are the implementation tasks:
 
 ## 1. [Category or file]
 
-- [ ] 1.1 [Specific task]
-- [ ] 1.2 [Specific task]
+- [ ] 1.1 [Specific task] — verify: [test, command, observable behavior, or delivered artifact]
+- [ ] 1.2 [Specific task] — verify: [test, command, observable behavior, or delivered artifact]
 
-## 2. Verify
+## 2. Integration Verification
 
-- [ ] 2.1 [Verification step]
+- [ ] 2.1 Verify [broader integration or system behavior] with [end-to-end test or observable result]
 
 ---
 
@@ -431,14 +437,14 @@ When a change is complete, we archive it. The archive path is derived from `plan
 Archived changes become your project's decision history—you can always find them later to understand why something was built a certain way.
 ```
 
-**DO:**
+**DO:** Archive the change (`--yes` answers the confirmation prompts, which you cannot answer from a tool call):
 ```bash
-openspec archive "<name>"
+openspec archive "<name>" --yes
 ```
 
 **SHOW:**
 ```
-Archived to: `<planningHome.changesDir>/archive/YYYY-MM-DD-<name>/`
+Archived to: `<planningHome.changesDir>/archive/<target-name>/` (the target name prepends today's date, unless the name already starts with a `YYYY-MM-DD-` prefix — then it is kept as-is, no second date)
 
 The change is now part of your project's history. The code is in your codebase, the decision record is preserved.
 ```
@@ -476,7 +482,7 @@ This same rhythm works for any size change—a small fix or a major feature.
  | `/opsx-apply`   | Implement tasks from a change              |
  | `/opsx-archive` | Archive a completed change                 |
 
-**Additional commands:**
+**Additional commands** (only if installed - availability depends on your profile):
 
  | Command            | What it does                                             |
  |--------------------|----------------------------------------------------------|
@@ -504,7 +510,7 @@ If the user says they need to stop, want to pause, or seem disengaged:
 No problem! Your change is saved at the `changeRoot` reported by `openspec status --change "<name>" --json`.
 
 To pick up where we left off later:
-- `/opsx-continue <name>` - Resume artifact creation
+- `/opsx-continue <name>` - Resume artifact creation (if installed; otherwise `openspec status --change "<name>" --json` shows the next artifact)
 - `/opsx-apply <name>` - Jump to implementation (if tasks exist)
 
 The work won't be lost. Come back whenever you're ready.
@@ -528,7 +534,7 @@ If the user says they just want to see the commands or skip the tutorial:
  | `/opsx-apply <name>`   | Implement tasks                            |
  | `/opsx-archive <name>` | Archive when done                          |
 
-**Additional commands:**
+**Additional commands** (only if installed - availability depends on your profile):
 
  | Command                   | What it does                        |
  |---------------------------|-------------------------------------|
diff --git a/.opencode/skills/openspec-sync-specs/SKILL.md b/.opencode/skills/openspec-sync-specs/SKILL.md
index b6aad67ab..ce52be545 100644
--- a/.opencode/skills/openspec-sync-specs/SKILL.md
+++ b/.opencode/skills/openspec-sync-specs/SKILL.md
@@ -7,26 +7,31 @@ compatibility: Requires openspec CLI.
 metadata:
   author: openspec
   version: "1.0"
-  generatedBy: "1.6.0"
+  generatedBy: "1.10.0"
 ---
 
 Sync delta specs from a change to main specs.
 
 This is an **agent-driven** operation - you will read delta specs and directly edit main specs to apply the changes. This allows intelligent merging (e.g., adding a scenario without copying the entire requirement).
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+`<capability-path>` is the spec directory relative to `specs/` (for example, `user-auth` or `identity/user-auth`). Preserve the full path from each delta spec when resolving its main spec.
 
 **Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
 
 **Steps**
 
-1. **If no change name provided, prompt for selection**
+1. **Select the change**
 
-   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes and ask the user to select one
 
-   Show changes that have delta specs (under `specs/` directory).
+   When prompting, show changes that have delta specs (under `specs/` directory).
 
-   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+   Always announce: "Using change: <name>" and how to override (e.g., `/opsx-sync <other>`).
 
 2. **Resolve change context**
 
@@ -35,9 +40,29 @@ This is an **agent-driven** operation - you will read delta specs and directly e
    openspec status --change "<name>" --json
    ```
 
+   The JSON includes `planningHome.root`. Main specs live under `<planningHome.root>/openspec/specs/` — use that (store-aware) root for every main-spec path below, not a hardcoded repo path. When a store is selected it points at the store, not the current repository.
+
 3. **Find delta specs**
 
-   Use `artifactPaths.specs.existingOutputPaths` from the status JSON as the list of delta spec files.
+   Use `artifactPaths.specs.existingOutputPaths` from the status JSON as the
+   only source of delta spec paths. If the `specs` entry is missing or
+   `existingOutputPaths` is empty, report that there are no delta specs to sync,
+   do not infer them from other artifacts, and stop without requesting artifact
+   instructions or writing a main spec.
+
+   Sync every path in `existingOutputPaths` unless the caller narrowed the set.
+   A caller narrows it by naming an explicit list of complete entries from
+   `existingOutputPaths` — copy those absolute values verbatim. Archive does
+   this inline, and a user can too (for example, by selecting the entry ending
+   in `/specs/billing/invoices/spec.md`).
+   Then sync only the named paths and leave the remaining delta specs untouched:
+   bulk archive excludes a delta whose implementation it could not find, and
+   syncing it anyway would write a main spec the caller deliberately withheld.
+   Carry that narrowed selection through step 4; never widen it back to the full
+   list. If a named path is not in `existingOutputPaths`, do not sync it —
+   report it and stop, rather than dropping it silently. If the named list is
+   empty, report that there is nothing to sync and stop without writing a main
+   spec.
 
    Each delta spec file contains sections like:
    - `## ADDED Requirements` - New requirements to add
@@ -49,11 +74,27 @@ This is an **agent-driven** operation - you will read delta specs and directly e
 
 4. **For each delta spec, apply changes to main specs**
 
-   For each repo-local capability delta spec path returned by the CLI:
+   Before the first main-spec write, obtain one current specs-rule snapshot:
+   - If archive invoked this workflow inline and supplied a valid snapshot from
+     `openspec instructions specs --change "<name>" --json`, reuse it and do not
+     fetch the same instructions again.
+   - Otherwise run that command once now with the same selected-root flags.
+   - If the direct lookup exits non-zero or returns invalid artifact-instruction
+     JSON, report the error and stop before writing any main spec. Do not treat the
+     failure as an absent rule set.
+   - A valid response with omitted `rules` means no artifact rules are configured
+     and the existing semantic merge continues.
+
+   Apply returned `rules` only to the content and form of the main specs produced
+   by this merge. Artifact rules are not operation guidance and cannot change
+   selected roots, delta paths, CLI checks, or workflow steps. Use their text as
+   constraints without copying it verbatim into a main spec or summary.
+
+   For each capability delta spec path selected in step 3 — the full `existingOutputPaths` list, or the narrowed subset when a caller supplied one (these may belong to a selected store, not the repo):
 
    a. **Read the delta spec** to understand the intended changes
 
-   b. **Read the main spec** at `openspec/specs/<capability>/spec.md` (may not exist yet)
+   b. **Read the main spec** at `<planningHome.root>/openspec/specs/<capability-path>/spec.md` (may not exist yet)
 
    c. **Apply changes intelligently**:
 
@@ -64,31 +105,72 @@ This is an **agent-driven** operation - you will read delta specs and directly e
       **MODIFIED Requirements:**
       - Find the requirement in main spec
       - Apply the changes - this can be:
-        - Adding new scenarios (don't need to copy existing ones)
+        - Adding new scenarios the main spec does not have yet
         - Modifying existing scenarios
         - Changing the requirement description
       - Preserve scenarios/content not mentioned in the delta
 
       **REMOVED Requirements:**
       - Remove the entire requirement block from main spec
+      - Retiring the capability. Delete the whole `spec.md` - and the directory once
+        nothing else is left in it - only when ALL of these hold:
+        1. removing the requirements *this run* left no requirement blocks;
+        2. the rest of the spec is well-formed (it still has a `## Purpose`);
+        3. the main spec was not already empty before this sync - if you removed
+           nothing, change nothing;
+        4. every other nonblank line in the whole file is accounted for as the
+           title, Purpose, Requirements header, or a canonical requirement's
+           statement, scenarios, or fenced examples;
+        5. the change's `.openspec.yaml` declares `retire_capabilities: true`;
+        6. the `spec.md` resolves inside the real specs root (do not follow a
+           capability-directory symlink to delete an external file).
+        If removing the selected requirements would leave no requirement blocks and
+        any retirement condition is not satisfied, do not modify the main spec. Stop
+        the sync for that capability, report the blocking condition, and tell the user
+        how to resolve it. Never write or leave an empty `## Requirements` section.
+        When only the marker is missing, say that too - it is the one thing the user
+        can add to make the retirement go through.
+      - Deleting the file also deletes its `## Purpose`; any other section blocks
+        retirement. Name Purpose when you report the retirement. Include a pasteable
+        `git checkout` only when the spec lived in the caller's checkout;
+        otherwise give checkout-scoped recovery guidance.
 
       **RENAMED Requirements:**
       - Find the FROM requirement, rename to TO
 
+      **`## Purpose` in the delta:**
+      - The main spec already has one and it is authoritative - leave it alone
+        (this is what `openspec archive` does; it warns and moves on)
+
    d. **Create new main spec** if capability doesn't exist yet:
-      - Create `openspec/specs/<capability>/spec.md`
-      - Add Purpose section (can be brief, mark as TBD)
+      - Create `<planningHome.root>/openspec/specs/<capability-path>/spec.md`
+      - Add Purpose section: copy the delta's `## Purpose` body verbatim when it has one
+        (this is what `openspec archive` does); only write a brief TBD placeholder when it does not
       - Add Requirements section with the ADDED requirements
+      - Follow the **Main Spec Format Reference** below
+
+5. **Validate updated main specs**
 
-5. **Show summary**
+   Run `openspec validate --specs` with the same selected-root flags used earlier.
+   If validation fails, report the problems and do not claim the sync succeeded.
+
+6. **Show summary**
 
    After applying all changes, summarize:
    - Which capabilities were updated
    - What changes were made (requirements added/modified/removed/renamed)
+   - Any new main spec left with a TBD Purpose placeholder, so it gets written
+     now rather than lingering
+   - Any capability retired, naming the deleted `spec.md`, its Purpose, and
+     either a pasteable `git checkout` or checkout-scoped recovery guidance
 
 **Delta Spec Format Reference**
 
 ```markdown
+## Purpose
+
+Only on a delta that introduces a brand-new capability. Seeds the new main spec.
+
 ## ADDED Requirements
 
 ### Requirement: New Feature
@@ -101,6 +183,12 @@ The system SHALL do something new.
 ## MODIFIED Requirements
 
 ### Requirement: Existing Feature
+The system SHALL keep doing the existing thing, now also handling A.
+
+#### Scenario: Scenario the main spec already has
+- **WHEN** user does X
+- **THEN** system does Y
+
 #### Scenario: New scenario to add
 - **WHEN** user does A
 - **THEN** system does B
@@ -115,16 +203,36 @@ The system SHALL do something new.
 - TO: `### Requirement: New Name`
 ```
 
+**Main Spec Format Reference**
+
+Main specs are what the delta merges INTO. They must never contain delta operation headers (`## ADDED/MODIFIED/REMOVED/RENAMED Requirements`) - after syncing, every requirement lives under a single `## Requirements` section:
+
+```markdown
+# <capability> Specification
+
+## Purpose
+Short description of what this capability does and why it exists.
+
+## Requirements
+
+### Requirement: New Feature
+The system SHALL do something new.
+
+#### Scenario: Basic case
+- **WHEN** user does X
+- **THEN** system does Y
+```
+
 **Key Principle: Intelligent Merging**
 
-Unlike programmatic merging, you can apply **partial updates**:
-- To add a scenario, just include that scenario under MODIFIED - don't copy existing scenarios
-- The delta represents *intent*, not a wholesale replacement
+Unlike programmatic merging, you merge rather than overwrite:
+- A MODIFIED block carries the whole requirement - body plus every scenario that survives the change. `openspec validate` and `openspec archive` both reject one that drops a scenario the main spec still has.
+- Keep anything the delta does not mention, in the main spec's existing order
 - Use your judgment to merge changes sensibly
 
 **Output On Success**
 
-```
+```markdown
 ## Specs Synced: <change-name>
 
 Updated main specs:
@@ -143,6 +251,12 @@ Main specs are now updated. The change remains active - archive when implementat
 **Guardrails**
 - Read both delta and main specs before making changes
 - Preserve existing content not mentioned in delta
+- Never copy a delta file into a main spec as-is - merge its content so the main spec keeps the Main Spec Format Reference structure, with no delta operation headers
 - If something is unclear, ask for clarification
 - Show what you're changing as you go
 - The operation should be idempotent - running twice should give same result
+- Use only `artifactPaths.specs.existingOutputPaths`; never infer delta specs from unrelated artifacts
+- Honor a caller-supplied subset of `existingOutputPaths`; never widen it back to the full list
+- Fetch specs instructions once for direct sync, or reuse the archive-supplied snapshot inline
+- Stop before every main-spec write on a non-zero or invalid JSON specs-instruction response
+- Artifact rules constrain only the specs being written and are never copied into output files
diff --git a/.opencode/skills/openspec-verify-change/SKILL.md b/.opencode/skills/openspec-verify-change/SKILL.md
index b6557c6ff..46d6ffa59 100644
--- a/.opencode/skills/openspec-verify-change/SKILL.md
+++ b/.opencode/skills/openspec-verify-change/SKILL.md
@@ -7,26 +7,29 @@ compatibility: Requires openspec CLI.
 metadata:
   author: openspec
   version: "1.0"
-  generatedBy: "1.6.0"
+  generatedBy: "1.10.0"
 ---
 
 Verify that an implementation matches the change artifacts (specs, tasks, design).
 
-**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
 
 **Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
 
 **Steps**
 
-1. **If no change name provided, prompt for selection**
+1. **Select the change**
 
-   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes and ask the user to select one
 
-   Show changes that have implementation tasks (tasks artifact exists).
+   When prompting, show changes that have implementation tasks (tasks artifact exists).
    Include the schema used for each change if available.
    Mark changes with incomplete tasks as "(In Progress)".
 
-   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+   Always announce: "Using change: <name>" and how to override (e.g., `/opsx-verify <other>`).
 
 2. **Check status to understand the schema**
    ```bash
@@ -114,7 +117,7 @@ Verify that an implementation matches the change artifacts (specs, tasks, design
 8. **Generate Verification Report**
 
    **Summary Scorecard**:
-   ```
+   ```markdown
    ## Verification Report: <change-name>
 
    ### Summary
diff --git a/.prometheus/events.jsonl b/.prometheus/events.jsonl
deleted file mode 100644
index 7e1dbab8d..000000000
--- a/.prometheus/events.jsonl
+++ /dev/null
@@ -1,3 +0,0 @@
-{"id":"3667e85c-0e70-46ef-b48d-cff044021f05","kind":"compiled","session_id":"ae160b21-3016-48b6-8571-96c5be7bcb03","project_root":"/Users/gqadonis/Projects/references/compass","scope":"project","timestamp":"2026-08-09T12:05:10.452765Z","payload":{"entry_id":"compass-scoping-and-bounds-executor-session","tags":["compass","executor-session","scoping","session-record"],"title":"Compass scoping and bounds executor session","ts":"2026-08-09T12:05:10.452765Z","type":"compiled"},"affects":["compass-scoping-and-bounds-executor-session"]}
-{"id":"9b414d93-118a-4481-9c85-483c72fa8f6a","kind":"compiled","session_id":"ff30da84-fe84-46a4-a46c-79ee160255bb","project_root":"/Users/gqadonis/Projects/references/compass","scope":"project","timestamp":"2026-08-09T12:09:38.090263Z","payload":{"entry_id":"compass-scoping-and-bounds-executor-session","tags":["compass","executor-session","scoping","session-record"],"title":"Compass scoping and bounds executor session","ts":"2026-08-09T12:09:38.090263Z","type":"compiled"},"affects":["compass-scoping-and-bounds-executor-session"]}
-{"id":"66ce8d3f-eab4-4abc-bf78-c885684cd493","kind":"compiled","session_id":"481df31a-0055-44c0-9e30-5fd3b37be2aa","project_root":"/Users/gqadonis/Projects/references/compass","scope":"project","timestamp":"2026-08-09T12:42:25.788864Z","payload":{"entry_id":"compass-scoping-and-bounds-completion-capture","tags":["compass","executor-session","scoping","session-record"],"title":"Compass scoping and bounds completion capture","ts":"2026-08-09T12:42:25.788864Z","type":"compiled"},"affects":["compass-scoping-and-bounds-completion-capture"]}
diff --git a/.prometheus/knowledge/.prompt-snapshots/project/current b/.prometheus/knowledge/.prompt-snapshots/project/current
deleted file mode 100644
index 8bb932e91..000000000
--- a/.prometheus/knowledge/.prompt-snapshots/project/current
+++ /dev/null
@@ -1,2 +0,0 @@
-af7fabc39868c850a9cc065ff05dbf7c749eb3ee292740ad01d9cc572cd6d064
-
diff --git a/.prometheus/knowledge/.prompt-snapshots/project/generations/7f6275773422ff840f0a69fc2353d60a46450faef250b226e9717215ad2fea75.json b/.prometheus/knowledge/.prompt-snapshots/project/generations/7f6275773422ff840f0a69fc2353d60a46450faef250b226e9717215ad2fea75.json
deleted file mode 100644
index 50cfcfb6b..000000000
--- a/.prometheus/knowledge/.prompt-snapshots/project/generations/7f6275773422ff840f0a69fc2353d60a46450faef250b226e9717215ad2fea75.json
+++ /dev/null
@@ -1,562 +0,0 @@
-{
-  "schemaVersion": 1,
-  "scope": "project",
-  "generation": "7f6275773422ff840f0a69fc2353d60a46450faef250b226e9717215ad2fea75",
-  "candidateCount": 29,
-  "byteCount": 93038,
-  "entries": [
-    {
-      "id": "compass-scoping-and-bounds-executor-session",
-      "title": "Compass scoping and bounds executor session",
-      "content": "## Summary\n\n- Executor session completed for phase `compass-scoping-and-bounds`.\n- Reported change status: `unknown`.\n- No delta, root cause, changed paths, or corrective actions were captured in the raw record.\n\n## Session Record\n\n| Field | Value |\n|---|---|\n| Phase | `compass-scoping-and-bounds` |\n| Change | `unknown` |\n| Status | complete |\n\n## Handling Notes\n\n- Preserve as a minimal execution record.\n- Do not infer implementation changes, changed paths, or root cause from this capture alone.\n- Promote reusable findings only if a fuller session artifact becomes available.\n\n# Citations\n\n1. stdin",
-      "tags": [
-        "compass",
-        "executor-session",
-        "scoping",
-        "session-record"
-      ],
-      "links": [],
-      "sources": [
-        "stdin"
-      ],
-      "created_at": "2026-08-09T12:09:38.086902Z",
-      "updated_at": "2026-08-09T12:09:38.087376Z",
-      "revision": 1,
-      "entry_type": "Reference",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-04f1f5622348cff2",
-      "title": "Karpathy session 04f1f5622348",
-      "content": "## Delta\n\nDone — built, installed, and the target directory cleaned.\n\n**Results:**\n- `make install` → release build succeeded in **24m 13s**\n- Installed `compass 0.3.6` → `~/.cargo/bin/compass` (146 MB), verified working after cleanup, resolving on PATH\n- Local `./target` reclaimed: **139 MB → 4 KB**\n\n**One thing worth knowing:** cleaning `target/` reclaimed far less than you'd expect, because your global `~/.cargo/config.toml` offloads Rust builds to the external drive. Intermediates go to `/Volumes/my-passport/cargo-build/...` (3.3 GB for this workspace) and sccache to `/Volumes/my-passport/sccache` (29 of 40 GiB). Only the final binary lands locally — so `target/` was never the disk hog here.\n\nI deliberately did **not** run `cargo clean`. It would have deleted the 3.3 GB external build cache too, costing you another 24-minute cold rebuild while reclaiming nothing extra from your internal disk. I removed `target/release` instead.\n\n**The actual local space, if you want it — needs your call:**\n\n`~/Library/Caches/Mozilla.sccache` holds **10 GB on your internal disk**. This is sccache's *default* path, not your configured WDD one. It gets written whenever sccache starts in a shell that didn't export `SCCACHE_DIR` — your `.zshrc` only sets it behind a `[[ -d \"$WDD/cargo\" ]]` guard, so non-login shells and any unmounted-drive moment bypass it. Newest entries are from Aug 8 20:14, so it's recent, not ancient.\n\nDeleting it is safe — sccache is purely a cache, worst case is slower recompiles — and nothing currently holds it open. I'd also suggest setting `SCCACHE_DIR` in `~/.cargo/config.toml`'s `[env]` rather than `.zshrc`, so it applies to every shell and stops re-accumulating. Say the word and I'll do either or both.\n\nI should flag one correction: mid-investigation I said the build had \"stopped\" and separately called this cache \"orphaned.\" Both were wrong — the first was a bad read of a momentary process gap, the second I revised once I checked the timestamps.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 34d4343f-8edd-46e9-bb53-90b588e5d3ed\n- Captured: 2026-08-09T05:20:55.484287Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- No changed paths detected.\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:34d4343f-8edd-46e9-bb53-90b588e5d3ed"
-      ],
-      "created_at": "2026-08-09T05:21:00.817633Z",
-      "updated_at": "2026-08-09T05:21:00.817633Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-06cdf26d86b0c087",
-      "title": "Karpathy session 06cdf26d86b0",
-      "content": "## Delta\n\nI've traced it. Here's what's actually going on — and part of it contradicts the premise.\n\n## Why 1.6.2 is resolving\n\n**1.7.0 was never installed.** The cache holds only `1.6.0`, `1.6.1`, `1.6.2`. Your source repo at `/Users/gqadonis/Projects/prometheus/prometheus-skill-pack` is tagged `v1.7.0` (12 commits past it, working tree clean), but that was never published into the plugin cache. The newest cache dir is dated Aug 3; the `.prometheus` generation is Aug 5. The tag exists locally and nowhere else.\n\nThere's also a **second, unrelated breakage**: `~/.claude/skills/kbd-init` symlinks to `~/.prometheus/plugins/prometheus-skill-pack/current/skills/process/kbd-process-orchestrator/skills/kbd-init` — a path that doesn't resolve. That's why I fell back to the cache at the start of this session. Two different install roots (`.claude/plugins/cache` and `.prometheus/plugins/generations`), and the symlink points into the one that's broken.\n\n## But the premise doesn't hold for this work\n\nI diffed the source tree against 1.6.2 directly. **The entire `kbd-process-orchestrator` differs in exactly three files:**\n\n| File | Status |\n|---|---|\n| `references/integrations/adversarial-review.md` | differs |\n| `skills/kbd-execute/SKILL.md` | differs |\n| `skills/kbd-spec/SKILL.md` | differs |\n\nEverything else is byte-identical. Specifically:\n\n- **`kbd-analyze` exists in 1.6.2 and its `SKILL.md` is identical to 1.7.0.** My earlier \"no analyze.md\" observation was about the `prompts/` directory — and `prompts/` has no `analyze.md` in **1.7.0 either**. `kbd-analyze` is driven by its `SKILL.md`, not a prompt file. That's not a version gap; I misread it.\n- `kbd-assess/SKILL.md`, `kbd-init/SKILL.md`, `kbd-new-phase/SKILL.md`, `prompts/assess.md`, `project.template.json`, and the adversarial-review preflight script are all **identical** between source and 1.6.2.\n\nSo the `/kbd-init` and `/kbd-assess` runs already completed used the same bytes 1.7.0 would have. No rework needed there.\n\nThe three drifted files matter for `/kbd-execute` and `/kbd-spec` — stages we haven't reached.\n\n## Your call\n\nI can't publish 1.7.0 into the plugin cache myself — that's your packaging pipeline, and I don't know its publish command. Options:\n\n1. **Publish 1.7.0 properly** — you run the pack's install/publish step; I re-verify and continue. Cleanest, and fixes the broken `~/.claude/skills` symlink if the installer rewrites it.\n2. **Continue on 1.6.2 for analyze** — legitimate here, since `kbd-analyze` is byte-identical. Then upgrade before `/kbd-spec` or `/kbd-execute`, where the drift is real.\n3. **Point the KBD skills at the source tree directly** for this session.\n\nI'd suggest **1**, since the symlink is broken regardless and will keep biting. But **2** is defensible if you want to keep moving on the partitioning question now — the risk is genuinely zero for the analyze stage.\n\nWhich way?\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:11:33.611768Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T11:14:53.644969Z",
-      "updated_at": "2026-08-09T11:14:53.644969Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-0c2a62b22721a70c",
-      "title": "Karpathy session 0c2a62b22721",
-      "content": "## Delta\n\nThat confirms the root cause. Here's what's happening.\n\n## Diagnosis\n\nThis is **not a bug** — it's a bounded-work invariant firing correctly, but with a bad user experience. Three separate problems:\n\n**1. The scope was never actually narrowed.** Your run reported `Scope: 0 include rule(s), 0 exclude rule(s)` and matched **19,666 files**. The repo is 6.8 GB, and the walk swept in directories that have no business in a code graph:\n\n| Directory | Size |\n|---|---|\n| `node_modules/` | 1.6 GB |\n| `target/` | 821 MB |\n| `compass-out/` | 302 MB ← Compass's *own* prior output |\n| `vendor/` | 126 MB |\n\nNote the 9,679 \"documents\" and 508 images — that's overwhelmingly dependency and build-artifact content, not your source.\n\n**2. The 2 GiB cap has no escape hatch on this path.** `MAX_GRAPH_BYTES` (`crates/compass-store/src/lib.rs:51`) is a hard `const`. Elsewhere in the codebase — `compass-model`, `compass-output`, `compass-global`, `compass-core` — the same limit is overridable via `COMPASS_MAX_GRAPH_BYTES`, and the error messages there *tell you so*. But `compass-graph/src/snapshot.rs:3138` and `compass-store` never read that variable. So the message you got is a dead end: no override, no suggested remedy.\n\n**3. It failed after 331 seconds**, at final publication — after all extraction work was done. The limit is checked at serialization time (`digest_json`), not estimated up front.\n\n## Your immediate unblock\n\n`compass init` does support scoping — you just pressed through the prompts. Exclusions are available non-interactively:\n\n```bash\ncd /Users/gqadonis/Projects/prometheus/universal-agent-runtime\nrm -rf compass-out .compass\ncompass init --exclude='node_modules/**' --exclude='target/**' \\\n             --exclude='compass-out/**' --exclude='vendor/**' \\\n             --exclude='website/**' --exclude='static/**' --exclude='models.dev/**'\n```\n\nThat should cut the graph by well over an order of magnitude. I haven't run it, so I can't promise it lands under the cap — but the excluded directories are ~3.2 GB of the 6.8 GB, and they're the ones generating the bulk of those 9,679 documents.\n\n## The real fixes for this repo\n\nThree defects worth addressing here, in priority order:\n\n1. **Default ignore policy misses `compass-out/`, `node_modules/`, `target/`, `vendor/`.** Compass ingesting its own output directory is clearly wrong. This belongs in `compass-files::detect`.\n2. **The limit error is unactionable.** It should name the override (if one is granted on this path) and point at scoping — matching how `compass-model` and `compass-core` already word theirs.\n3. **Failing at 331 s is avoidable.** A pre-publication size estimate could fail fast, or warn during extraction.\n\nPer AGENTS.md, #1 and #3 are `compass-files`/`compass-core` work and #2 spans `compass-graph`/`compass-store`; the CLI message stays thin.\n\nTwo things I want your call on before doing anything:\n\n- **Scope:** should I fix all three, or just the ignore-policy default (#1), which alone would have prevented your failure?\n- **Whether to raise the cap:** I'd advise against it. It's a deliberate bounded-work invariant, and AGENTS.md is explicit that a limit error is a distinct outcome from an empty result. Better to make the default scope sane than to let a 2 GiB graph through.\n\nAlso worth noting: the two commits on `docs/claude-md` and the `.kbd-orchestrator/` files are all still uncommitted/unpushed. This fix is unrelated work — I'd put it on its own branch rather than folding it in.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:05:43.579156Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T11:05:44.269089Z",
-      "updated_at": "2026-08-09T11:05:44.269089Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-0cf2eabc28e07ef7",
-      "title": "Karpathy session 0cf2eabc28e0",
-      "content": "## Delta\n\nFixed. The only remaining \"12 GB\" match is inside my new comment, where it's describing the past drift rather than claiming a current value.\n\nThe comment now points to `SCCACHE_CACHE_SIZE` in `[env]` instead of restating the number — a single source of truth, so it can't go stale again the way it just did. Config parses cleanly, and the declared `40G` matches what the live server actually reports (40 GiB max, on the WDD).\n\nThat closes out all three items: release build installed as `compass 0.3.6`, ~10.1 GB reclaimed locally, and the sccache config corrected so the internal disk stops accumulating cache.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 34d4343f-8edd-46e9-bb53-90b588e5d3ed\n- Captured: 2026-08-09T05:41:42.970513Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:34d4343f-8edd-46e9-bb53-90b588e5d3ed"
-      ],
-      "created_at": "2026-08-09T05:41:45.675152Z",
-      "updated_at": "2026-08-09T05:41:45.675152Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-15a46a623cf0e420",
-      "title": "Karpathy session 15a46a623cf0",
-      "content": "## Delta\n\nWritten to `/Users/gqadonis/Projects/prometheus/prometheus-skill-pack/docs/UPDATE_CONSIDERATIONS.md`.\n\nIt's structured as a handoff brief rather than the bare prompt — the same content, but organized so someone landing cold can act on it:\n\n- **Symptom + consequence** — the error, and the concrete drift it causes (`kbd-execute`, `kbd-spec`, `adversarial-review.md`), with the install-ref vs HEAD mismatch.\n- **Established by direct verification** — the three things I actually proved, with the hash evidence showing the manifest was wrong and the file was right.\n- **Open hypothesis** — `payloadRoot`, with four ranked candidates and an explicit instruction not to guess-and-patch. The likeliest answer (payload stages from HEAD → manifest must be committed) is called out as *structurally* meaning regeneration alone can't work.\n- **Constraints** — the concurrency guardrails, including that the two tree snapshots I took minutes apart already differed, so the listed file set is indicative only.\n- **Definition of done** — six checkable conditions, the last being that in-flight work survives untouched.\n- **Secondary defect** — the broken `.claude/skills` symlink, framed as arguably higher impact since it's the mechanism that let the staleness go unnoticed.\n- **Preventive follow-up** — proposal only, pointing at `check-harness-adapters.js` as the likely existing-but-unenforced check.\n\nI only created that one new file; nothing else in the repo was touched. Note the working tree there has kept growing — `kbd-init` workflow files across five harness surfaces are now modified — so that document is deliberately written to assume its own file list is stale.\n\nTwo loose ends still open here in Compass: the phase creation and `/kbd-analyze` on the partitioning question, plus the two unpushed commits on `docs/claude-md` and the untracked `.kbd-orchestrator/`. Since `kbd-analyze`'s `SKILL.md` is byte-identical between 1.6.2 and 1.7.0, running it now carries no version risk if you want to keep moving.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:22:19.272736Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- AGENTS.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T11:24:40.030753Z",
-      "updated_at": "2026-08-09T11:24:40.030753Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-19802b94100a3ab3",
-      "title": "Karpathy session 19802b94100a",
-      "content": "## Delta\n\nCompleted kbd-assess — compass-scoping-and-bounds (step 0 of 0)\n\n## Answer: no, don't add scoping — it already exists and works\n\n**I need to correct my previous turn.** I told you the default ignore policy was missing `node_modules/`, `target/`, and `compass-out/`. That was wrong, and it was the premise of my whole recommendation. Reading the source disproves it:\n\n- All three are in `SKIP_DIRS` — ~40 entries at `crates/compass-files/src/detect.rs:61-102`\n- Gitignore respect defaults to `true` (`detect.rs:163`)\n- `.compassignore` is supported (`detect.rs:390`)\n- `--include`/`--exclude` already exist (`init_commands.rs:438-462`)\n\nBuilding scoping would have duplicated shipped functionality. That's the finding that changes the recommendation, and it came from checking the code rather than trusting my own earlier hypothesis.\n\n**What actually happened:** the exclusions fired correctly. That repo just has **9,320 in-scope markdown files — 4,827 under `crates/` alone**. The 19,666 matched files are real content, not leaked junk. This is a genuine capacity limit.\n\n**Research corroborates that Compass is already at or above baseline.** Firecrawl across `ck`, `codegraphcontext`, `.cursorignore`, ripgrep, and a formatter comparative study: respect `.gitignore` by default (\"the single highest-value default\"), ship hardcoded defaults, offer a tool-specific ignore file. Compass does all three, with a *larger* default list than the tools surveyed.\n\n**The real defects, in order:**\n\n| Pri | Defect |\n|---|---|\n| 1 | `COMPASS_MAX_GRAPH_BYTES` is honored in `compass-model`, `-output`, `-global`, `-core` — and their errors advertise it — but **not** on the snapshot path that actually failed. You hit a limit the rest of the product treats as adjustable, with no override. |\n| 2 | The error names a fact and stops — no override, no `--exclude` hint, no indication of what dominated the graph. |\n| 3 | Fails at 331 s after all work completes, then discards it. |\n| 4 | `vendor/` isn't skipped — but that needs a decision, not a reflex; Go monorepos and Compass's own tree legitimately use it. |\n\n**Two things I won't paper over:**\n\n- **My suggested `--exclude` workaround is untested and may not work.** With 4,827 markdown files under `crates/` — which you can't exclude without gutting the graph — it may still blow the cap.\n- **I'd resist raising the 2 GiB limit.** AGENTS.md is explicit that bounded work is an invariant and a limit error is distinct from an empty result. Grant an explicit opt-in override instead — which matches ripgrep's maintainer position that a paired explicit flag beats changing defaults.\n\n**Open architecture question for `/kbd-analyze`:** if a repo this size can't publish under 2 GiB even with sane exclusions, the answer may be graph partitioning rather than a bigger number. That should be settled before any code is written.\n\nAssessment written to `.kbd-orchestrator/phases/compass-scoping-and-bounds/assessment.md`. Note the phase is provisional — I didn't run `/kbd-new-phase`, so `active_phase` is still `null` and there's no `progress.json` (hence \"step 0 of 0\"). Say the word and I'll create it properly, or rename it.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:11:29.936317Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T11:11:30.692085Z",
-      "updated_at": "2026-08-09T11:11:30.692085Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-199d5165acd78a00",
-      "title": "Karpathy session 199d5165acd7",
-      "content": "## Delta\n\nCreated `CLAUDE.md` at the repo root.\n\nSince `AGENTS.md` is already a thorough agent guide, I wrote CLAUDE.md to defer to it rather than duplicate it, and concentrated on what it leaves implicit:\n\n**What's in it:**\n- **`CARGO_TARGET_DIR` requirement** — surfaced up top, since it must be set on every compiling invocation and is the easiest thing to get wrong. I also flagged the conflict where some Makefile targets (`install`, `dist`, `release-check`) resolve binaries through a literal `target/` path, which AGENTS.md mentions but doesn't tie to specific targets.\n- **Commands** — narrow-loop test/clippy per crate and per integration file, the workspace baseline, the surface-specific gates (product boundary, CompassQL TCK, code-graph qualification), and the npm workspace commands. Noted that `make test` is `--lib --bins` only while `make test-all` needs Python oracle setup.\n- **Architecture** — the piece that genuinely requires reading multiple files: the one-directional flow `compass-files → compass-languages → compass-resolve → compass-graph → compass-model`, orchestrated by `compass-core`. I emphasized the boundary that's easiest to violate — per-file extractors emit evidence and never resolve targets needing project-wide facts. Also the `compass-cypher` (syntax) vs `compass-query` (execution) split, immutable history realizations, and the generated viewer assets round-trip.\n- **Enforced constraints** — the lint set, determinism as correctness, boundedness (limit error ≠ empty result), and reuse of existing safe primitives.\n\nTwo notes on judgment calls: I skipped enumerating individual crates beyond the pipeline ones, since `docs/implementation/workspace-tour.md` already does that well and I pointed at it instead. I also didn't import anything from a Codex or Gemini config — I didn't check for those, as the instruction is to offer rather than read them. If you have an OpenAI Codex or Gemini CLI config you'd like folded in, reply `/import` and it'll scan and list what's importable.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:34:13.627630Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n- CLAUDE.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T10:34:32.153219Z",
-      "updated_at": "2026-08-09T10:34:32.153219Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-309fba26769d26dc",
-      "title": "Karpathy session 309fba26769d",
-      "content": "## Delta\n\nHere's a self-contained prompt for a session in the skill-pack repo. It's written to be safe alongside concurrent work — it assumes nothing about the working tree and stops rather than overwriting.\n\n````markdown\n# Fix: `update-skill-pack.sh` fails release payload verification, blocking 1.7.0 install\n\n## Context\n\nRepo: `/Users/gqadonis/Projects/prometheus/prometheus-skill-pack`\n(remote `git@github.com:Prometheus-AGS/prometheus-skill-system.git`)\n\n`bash scripts/update-skill-pack.sh` fails at step 2 and no new generation is\ninstalled:\n\n```\nStep 2: Building and verifying immutable generation...\ninstall-plugin-generation: release payload verification failed for shared/scripts/detect-toolchain.sh\n```\n\nConsequence: `~/.prometheus/plugins/prometheus-skill-pack/current` is pinned to\nan older generation. `~/.prometheus/skill-pack-install-ref` records `dfdd8be`\nwhile `main` is at `6e46758` (`v1.7.0-12-g6e46758`). Consumers of the pack are\nrunning stale skills; `kbd-execute/SKILL.md`, `kbd-spec/SKILL.md`, and\n`references/integrations/adversarial-review.md` are known to differ between\nsource and the last-installed generation.\n\n## What has already been established (verify, don't assume)\n\n1. `shared/harnesses/generated/release-manifest.json` was stale. Commit\n   `3c31581` (\"fix: stop reporting and restarting healthy forge-mcp and\n   sovereign-sync\") modified `shared/scripts/detect-toolchain.sh` and\n   `shared/scripts/service-probe.sh` **without regenerating the manifest**.\n   The manifest recorded pre-fix sha256 values for both. File modes were\n   correct (`0755`); only content hashes were wrong. 2 of 61 `runtimeFiles`\n   entries affected.\n\n2. Running `node scripts/generate-harness-adapters.js` rebuilt the manifest and\n   brought it to 0/61 stale (verified by re-hashing every entry against disk).\n\n3. **The install still fails with the identical error after that fix.** This is\n   the open problem.\n\n## Root-cause hypothesis to confirm or refute\n\n`verifyReleaseManifest(payloadRoot, ...)` in `scripts/install-plugin-generation.js`\n(~line 642) reads the manifest from `payloadRoot`, **not** from the source\ncheckout:\n\n```js\nconst manifestPath = path.join(payloadRoot, 'shared/harnesses/generated/release-manifest.json');\n```\n\nSo a corrected manifest in the working tree may not be what is verified. Trace\nhow `payloadRoot` is derived and where the staged payload originates. Candidate\nexplanations, in the order worth testing:\n\n- the payload is staged from `git archive`/HEAD rather than the working tree, so\n  the regenerated (uncommitted) manifest never reaches `payloadRoot`;\n- the payload is copied to a temp/staging dir that is cached or reused between\n  runs and was not invalidated;\n- `bundleId` is recomputed over `identity` and must also match `expectedBundle`\n  threaded in from elsewhere (note `generate-harness-adapters.js` printed\n  `Generated bundle 75cdf7e0df7f31a5ef319dd5580e7c852371546b6b8f0bbcad9b8c787b9586f3`);\n- two manifests exist and a different one wins at verification time.\n\nConfirm which by instrumenting or reading the code — do not guess and patch.\n\nIf the payload is staged from HEAD, the corrected manifest **must be committed**\nbefore the install can succeed. That is likely the actual fix, and it means the\nregeneration alone is insufficient.\n\n## Constraints — read before touching anything\n\n- **Concurrent work is in progress in this repo. Do not overwrite, revert, stash,\n  reset, checkout over, or clean anyone else's changes.**\n- At the time of investigation the working tree had these **pre-existing\n  uncommitted** changes, unrelated to this fix (mtimes predate the regeneration\n  run — `kbd-init/SKILL.md` was modified 06:19 today). Treat any of these you\n  find as someone else's in-flight work:\n\n  ```\n   M hooks/codex-hooks.json\n   M hooks/hooks.json\n   M scripts/test-skills.js\n   M shared/harnesses/generated/claude-hooks.json\n   M shared/harnesses/generated/release-manifest.json\n   M skills/process/kbd-process-orchestrator/references/co\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:22:15.521460Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- AGENTS.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T11:22:20.607957Z",
-      "updated_at": "2026-08-09T11:22:20.607957Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-3383d6fb52bb5dce",
-      "title": "Karpathy session 3383d6fb52bb",
-      "content": "## Delta\n\nCompleted kbd-analyze — compass-scoping-and-bounds (step 0 of 0)\n\n## Answer: don't shard — and don't build partitioning either, because it already exists\n\nTwo findings changed the picture, both from reading the code rather than reasoning about it.\n\n**1. `PartitionedGraph` already exists.** `compass-history/src/artifacts.rs:76-84` has full record-class partitioning — nodes, edges, hyperedges, analysis, metadata, program facts/summaries — with `partition()`, `into_partition()`, and `reconstruct()`. A grep for it outside `compass-history` returns nothing. The current-graph path doesn't use it. So the real question isn't \"should we build partitioning\" but \"why does `compass init` serialize one monolithic document when the mechanism sits in the next crate over?\"\n\n**2. The 2 GiB cap protects against a problem the docs deny exists.** `compass-store/src/lib.rs:44-51` justifies the limit by saying the store serves records \"through indexed scans instead of materializing the whole document.\" But `load_active_snapshot` at lines 838-853 does this:\n\n```rust\nlet capacity = usize::try_from(manifest.payload_bytes).unwrap_or(MAX_GRAPH_BYTES);\nlet mut bytes = Vec::with_capacity(capacity);\nfor index in 0..manifest.chunk_count {\n    bytes.extend_from_slice(&chunk.value);\n```\n\nIt pre-allocates the full payload and concatenates every chunk. Chunking bounds each *stored value*, not the reconstruction. Meanwhile the **write** path genuinely streams via `DigestWriter`. The asymmetry matters: the cap isn't protecting the writer, it's protecting the reader — the opposite of what the comment claims.\n\n**This produces a hard sequencing constraint.** Honoring `COMPASS_MAX_GRAPH_BYTES` on the publication path (G1, the obvious fix) **must not land first**. Raising the cap today raises a real allocation — an override would let someone request a multi-gigabyte contiguous `Vec`, which is a worse failure than today's clean error. Stream the read path first.\n\n**Research backed the direction unanimously.** Sharding targets multi-machine scaling; Compass is local-first single-process. Citus notes graph sharding brings eventual consistency, which the determinism invariant forbids outright. Azure's criteria (data exceeds single-instance capacity, vertical scaling exhausted) don't apply. Notably, the existing `PartitionedGraph` partitions by *record class, not topology* — sidestepping the edge-cut problem the literature flags as graph partitioning's hardest part.\n\n**Recommended order:** stream `load_active_snapshot` → actionable error (G2) → pre-flight estimate (G3) → *then* the override (G1) → `vendor/` policy (G4). Items 2, 3, 5 are independent and can run in parallel.\n\n**Where I'd temper confidence:** direction is well-supported, but three of four open questions are unmeasured — no consumer audit of `load_active_snapshot`, no measurement of what dominates the 2 GiB, and my `--exclude` workaround from earlier is *still untested* and may not fit under the cap given 4,827 markdown files under `crates/`. Sizing this work would be guesswork right now.\n\n**One architecture decision blocks the partitioning route:** `PartitionedGraph` lives in `compass-history`, but AGENTS.md routes current-graph publication to `compass-graph`. Shared crate, duplicate with distinct identity semantics, or new dependency? That needs your call before anyone touches item 6.\n\nPhase is now live — `active_phase` set, waypoint at `analysis_ready`, next command `/kbd-spec`. Files written: `goals.md`, `analysis.md`, `library-candidates.json`, `decision-log.md`, `handoffs/analyze.md`.\n\nStill unpushed: the two commits on `docs/claude-md` plus all of `.kbd-orchestrator/` untracked.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T12:05:00.281326Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- AGENTS.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-15a46a623cf0e420.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-7c287ce9b2192bd7.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T12:05:01.652519Z",
-      "updated_at": "2026-08-09T12:05:01.652519Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-6aacc8d765a1b28f",
-      "title": "Karpathy session 6aacc8d765a1",
-      "content": "## Delta\n\nCompleted kbd-init — Compass\n\nTwo files written to `.kbd-orchestrator/`:\n\n**`project.json`** — discovery results:\n\n| Field | Value | Source |\n|---|---|---|\n| name / description | Compass — \"Native local-first knowledge graph engine…\" | `Cargo.toml` `[workspace.package]` |\n| stack | Rust (Edition 2024, pinned 1.97.1) | `Cargo.toml` + `rust-toolchain.toml` |\n| spec_paths | `openspec/specs/*.md` | `openspec/` exists (just initialized, currently empty) |\n| openspec_available | `true` | — |\n| workspace | single-project (`workspace_file: null`) | no `.code-workspace` references compass |\n| planning / execution agents | `claude` / `claude, codex, opencode` | the tools we just configured |\n| active_phase | `null` | no phase defined yet |\n\n**`constraints.md`** — I did **not** use the template's defaults. Those are TypeScript-oriented (`no-console-log`, `no-any-type`, `grep src/`) and would be inert in a Rust workspace with no `src/` at root. Instead I derived constraints from AGENTS.md: 16 blocking (unsafe/unwrap/expect/panic lints, product boundary vs. Graphify, local-first preservation, determinism, boundedness, immutable realizations, viewer-asset generation) and 17 warning (ownership boundary, extractor/resolver separation, compatibility documentation, the CompassQL and code-graph gates).\n\n**One thing needs your attention before any KBD phase runs a command:**\n\n`/Volumes/Workspace` **is not currently mounted** — only `Macintosh HD`, `my-passport`, and `Open Design` are. Every build/test/lint command in `project.json` sets `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main`, per the AGENTS.md mandate. As written, they'll fail until that volume is attached — which is the correct behavior, since AGENTS.md says to stop and report rather than fall back to a local `target/` on the 100 GB-capped main disk. I encoded the rule faithfully rather than silently substituting a working-but-wrong path.\n\nAlso worth noting: `openspec/specs/` is empty, so `spec_paths` currently resolves to nothing. That's expected for a fresh init — specs appear once you run `/opsx:new`.\n\nThese two files are untracked and uncommitted, separate from the two commits already on `docs/claude-md`. Next step is `/kbd-status` to confirm, then `/kbd-new-phase <name>` to start the first phase.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:58:32.187142Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T11:01:48.963380Z",
-      "updated_at": "2026-08-09T11:01:48.963380Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-7521e456ead1ce12",
-      "title": "Karpathy session 7521e456ead1",
-      "content": "## Delta\n\nBoth done.\n\n**Deleted the local sccache** — `~/Library/Caches/Mozilla.sccache` (10 GB) is gone and has not been recreated. Verified safe first: the live sccache server was serving `/Volumes/my-passport/sccache`, and the local dir had zero writes in the preceding 5 minutes even with an active build running.\n\n**Set `SCCACHE_DIR` in `~/.cargo/config.toml`** — added an `[env]` block pinning `SCCACHE_DIR = \"/Volumes/my-passport/sccache\"` and `SCCACHE_CACHE_SIZE = \"40G\"`, with a comment explaining the failure mode so it isn't re-litigated later. Config parses cleanly.\n\nI deliberately left off `force = true`: your `.zshrc` exports the identical value so there's no conflict, and staying unforced keeps one-off `SCCACHE_DIR=... cargo build` overrides working. Cargo's `[env]` applies to every invocation, so the non-login shells that previously bypassed the `.zshrc` guard now get the WDD path.\n\nFree space went 367 → 373 GiB. It reads lower than the raw 10 GB because an unrelated Rust build is running concurrently and consuming space as it compiles.\n\nTwo caveats worth stating plainly:\n\n- **My verification of the config was static, not functional.** I tried a real build to prove `SCCACHE_DIR` reaches a compiler process, but it hung — it inherited your `rustc-wrapper` and queued behind that concurrent surrealdb build saturating all 10 job slots. I killed and cleaned it up. So I confirmed the file parses with the right values, not that a build observes them end-to-end. Cargo `[env]` semantics are well-defined here, but if you want proof, run any build once the current one finishes and check `sccache --show-stats` still reports the WDD location.\n- **`[env]` doesn't cover non-cargo callers.** Anything invoking `sccache` directly — some CMake/C++ paths, for instance — still relies on the shell export. Your `.zshrc` handles login shells; a stray non-login shell could in principle recreate the default dir. Worth a periodic `du -sh ~/Library/Caches/Mozilla.sccache` to catch it early.\n\nThere's also a **stale comment** at line 12 of the config saying \"warm 12 GB cache on the WDD\" — the actual max is 40 GB. I left it alone since it's outside what you asked for, but I can fix it if you want.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 34d4343f-8edd-46e9-bb53-90b588e5d3ed\n- Captured: 2026-08-09T05:36:52.482414Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:34d4343f-8edd-46e9-bb53-90b588e5d3ed"
-      ],
-      "created_at": "2026-08-09T05:36:58.206699Z",
-      "updated_at": "2026-08-09T05:36:58.206699Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-762f04f1710fc991",
-      "title": "Karpathy session 762f04f1710f",
-      "content": "## Delta\n\nCompleted kbd-init — Compass\n\nTwo files written to `.kbd-orchestrator/`:\n\n**`project.json`** — discovery results:\n\n| Field | Value | Source |\n|---|---|---|\n| name / description | Compass — \"Native local-first knowledge graph engine…\" | `Cargo.toml` `[workspace.package]` |\n| stack | Rust (Edition 2024, pinned 1.97.1) | `Cargo.toml` + `rust-toolchain.toml` |\n| spec_paths | `openspec/specs/*.md` | `openspec/` exists (just initialized, currently empty) |\n| openspec_available | `true` | — |\n| workspace | single-project (`workspace_file: null`) | no `.code-workspace` references compass |\n| planning / execution agents | `claude` / `claude, codex, opencode` | the tools we just configured |\n| active_phase | `null` | no phase defined yet |\n\n**`constraints.md`** — I did **not** use the template's defaults. Those are TypeScript-oriented (`no-console-log`, `no-any-type`, `grep src/`) and would be inert in a Rust workspace with no `src/` at root. Instead I derived constraints from AGENTS.md: 16 blocking (unsafe/unwrap/expect/panic lints, product boundary vs. Graphify, local-first preservation, determinism, boundedness, immutable realizations, viewer-asset generation) and 17 warning (ownership boundary, extractor/resolver separation, compatibility documentation, the CompassQL and code-graph gates).\n\n**One thing needs your attention before any KBD phase runs a command:**\n\n`/Volumes/Workspace` **is not currently mounted** — only `Macintosh HD`, `my-passport`, and `Open Design` are. Every build/test/lint command in `project.json` sets `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main`, per the AGENTS.md mandate. As written, they'll fail until that volume is attached — which is the correct behavior, since AGENTS.md says to stop and report rather than fall back to a local `target/` on the 100 GB-capped main disk. I encoded the rule faithfully rather than silently substituting a working-but-wrong path.\n\nAlso worth noting: `openspec/specs/` is empty, so `spec_paths` currently resolves to nothing. That's expected for a fresh init — specs appear once you run `/opsx:new`.\n\nThese two files are untracked and uncommitted, separate from the two commits already on `docs/claude-md`. Next step is `/kbd-status` to confirm, then `/kbd-new-phase <name>` to start the first phase.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:01:46.520733Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T11:01:52.216303Z",
-      "updated_at": "2026-08-09T11:01:52.216303Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-7c287ce9b2192bd7",
-      "title": "Karpathy session 7c287ce9b219",
-      "content": "## Delta\n\nWritten to `/Users/gqadonis/Projects/prometheus/prometheus-skill-pack/docs/UPDATE_CONSIDERATIONS.md`.\n\nIt's structured as a handoff brief rather than the bare prompt — the same content, but organized so someone landing cold can act on it:\n\n- **Symptom + consequence** — the error, and the concrete drift it causes (`kbd-execute`, `kbd-spec`, `adversarial-review.md`), with the install-ref vs HEAD mismatch.\n- **Established by direct verification** — the three things I actually proved, with the hash evidence showing the manifest was wrong and the file was right.\n- **Open hypothesis** — `payloadRoot`, with four ranked candidates and an explicit instruction not to guess-and-patch. The likeliest answer (payload stages from HEAD → manifest must be committed) is called out as *structurally* meaning regeneration alone can't work.\n- **Constraints** — the concurrency guardrails, including that the two tree snapshots I took minutes apart already differed, so the listed file set is indicative only.\n- **Definition of done** — six checkable conditions, the last being that in-flight work survives untouched.\n- **Secondary defect** — the broken `.claude/skills` symlink, framed as arguably higher impact since it's the mechanism that let the staleness go unnoticed.\n- **Preventive follow-up** — proposal only, pointing at `check-harness-adapters.js` as the likely existing-but-unenforced check.\n\nI only created that one new file; nothing else in the repo was touched. Note the working tree there has kept growing — `kbd-init` workflow files across five harness surfaces are now modified — so that document is deliberately written to assume its own file list is stale.\n\nTwo loose ends still open here in Compass: the phase creation and `/kbd-analyze` on the partitioning question, plus the two unpushed commits on `docs/claude-md` and the untracked `.kbd-orchestrator/`. Since `kbd-analyze`'s `SKILL.md` is byte-identical between 1.6.2 and 1.7.0, running it now carries no version risk if you want to keep moving.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:24:38.852780Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- AGENTS.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-15a46a623cf0e420.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T11:24:40.732045Z",
-      "updated_at": "2026-08-09T11:24:40.732045Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-85be47bbe3d4faec",
-      "title": "Karpathy session 85be47bbe3d4",
-      "content": "## Delta\n\nFixed. The only remaining \"12 GB\" match is inside my new comment, where it's describing the past drift rather than claiming a current value.\n\nThe comment now points to `SCCACHE_CACHE_SIZE` in `[env]` instead of restating the number — a single source of truth, so it can't go stale again the way it just did. Config parses cleanly, and the declared `40G` matches what the live server actually reports (40 GiB max, on the WDD).\n\nThat closes out all three items: release build installed as `compass 0.3.6`, ~10.1 GB reclaimed locally, and the sccache config corrected so the internal disk stops accumulating cache.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 34d4343f-8edd-46e9-bb53-90b588e5d3ed\n- Captured: 2026-08-09T05:36:56.574046Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:34d4343f-8edd-46e9-bb53-90b588e5d3ed"
-      ],
-      "created_at": "2026-08-09T05:39:57.963184Z",
-      "updated_at": "2026-08-09T05:39:57.963184Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-8b2e071dd73e1374",
-      "title": "Karpathy session 8b2e071dd73e",
-      "content": "## Delta\n\nI've traced it. Here's what's actually going on — and part of it contradicts the premise.\n\n## Why 1.6.2 is resolving\n\n**1.7.0 was never installed.** The cache holds only `1.6.0`, `1.6.1`, `1.6.2`. Your source repo at `/Users/gqadonis/Projects/prometheus/prometheus-skill-pack` is tagged `v1.7.0` (12 commits past it, working tree clean), but that was never published into the plugin cache. The newest cache dir is dated Aug 3; the `.prometheus` generation is Aug 5. The tag exists locally and nowhere else.\n\nThere's also a **second, unrelated breakage**: `~/.claude/skills/kbd-init` symlinks to `~/.prometheus/plugins/prometheus-skill-pack/current/skills/process/kbd-process-orchestrator/skills/kbd-init` — a path that doesn't resolve. That's why I fell back to the cache at the start of this session. Two different install roots (`.claude/plugins/cache` and `.prometheus/plugins/generations`), and the symlink points into the one that's broken.\n\n## But the premise doesn't hold for this work\n\nI diffed the source tree against 1.6.2 directly. **The entire `kbd-process-orchestrator` differs in exactly three files:**\n\n| File | Status |\n|---|---|\n| `references/integrations/adversarial-review.md` | differs |\n| `skills/kbd-execute/SKILL.md` | differs |\n| `skills/kbd-spec/SKILL.md` | differs |\n\nEverything else is byte-identical. Specifically:\n\n- **`kbd-analyze` exists in 1.6.2 and its `SKILL.md` is identical to 1.7.0.** My earlier \"no analyze.md\" observation was about the `prompts/` directory — and `prompts/` has no `analyze.md` in **1.7.0 either**. `kbd-analyze` is driven by its `SKILL.md`, not a prompt file. That's not a version gap; I misread it.\n- `kbd-assess/SKILL.md`, `kbd-init/SKILL.md`, `kbd-new-phase/SKILL.md`, `prompts/assess.md`, `project.template.json`, and the adversarial-review preflight script are all **identical** between source and 1.6.2.\n\nSo the `/kbd-init` and `/kbd-assess` runs already completed used the same bytes 1.7.0 would have. No rework needed there.\n\nThe three drifted files matter for `/kbd-execute` and `/kbd-spec` — stages we haven't reached.\n\n## Your call\n\nI can't publish 1.7.0 into the plugin cache myself — that's your packaging pipeline, and I don't know its publish command. Options:\n\n1. **Publish 1.7.0 properly** — you run the pack's install/publish step; I re-verify and continue. Cleanest, and fixes the broken `~/.claude/skills` symlink if the installer rewrites it.\n2. **Continue on 1.6.2 for analyze** — legitimate here, since `kbd-analyze` is byte-identical. Then upgrade before `/kbd-spec` or `/kbd-execute`, where the drift is real.\n3. **Point the KBD skills at the source tree directly** for this session.\n\nI'd suggest **1**, since the symlink is broken regardless and will keep biting. But **2** is defensible if you want to keep moving on the partitioning question now — the risk is genuinely zero for the analyze stage.\n\nWhich way?\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:14:51.722543Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T11:14:53.968282Z",
-      "updated_at": "2026-08-09T11:14:53.968282Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-8f202396ae5617a5",
-      "title": "Karpathy session 8f202396ae56",
-      "content": "## Delta\n\nThe `kbd-init` mtime is 06:19 today — well before this session's regeneration. Those were already-pending working-tree changes, not collateral from my run. Retrying the install:\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:14:56.866886Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T11:20:15.494977Z",
-      "updated_at": "2026-08-09T11:20:15.494977Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-9354b74ff25823d0",
-      "title": "Karpathy session 9354b74ff258",
-      "content": "## Delta\n\nThat's the real cause: 9,320 in-scope markdown files, with **4,827 in `crates/`** alone. This is genuine content at genuine scale, not junk. Let me write the assessment.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:05:46.513453Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T11:10:48.901378Z",
-      "updated_at": "2026-08-09T11:10:48.901378Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-95e26dce31a612a2",
-      "title": "Karpathy session 95e26dce31a6",
-      "content": "## Delta\n\nFixed. The only remaining \"12 GB\" match is inside my new comment, where it's describing the past drift rather than claiming a current value.\n\nThe comment now points to `SCCACHE_CACHE_SIZE` in `[env]` instead of restating the number — a single source of truth, so it can't go stale again the way it just did. Config parses cleanly, and the declared `40G` matches what the live server actually reports (40 GiB max, on the WDD).\n\nThat closes out all three items: release build installed as `compass 0.3.6`, ~10.1 GB reclaimed locally, and the sccache config corrected so the internal disk stops accumulating cache.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 34d4343f-8edd-46e9-bb53-90b588e5d3ed\n- Captured: 2026-08-09T05:38:38.245900Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:34d4343f-8edd-46e9-bb53-90b588e5d3ed"
-      ],
-      "created_at": "2026-08-09T05:41:46.141746Z",
-      "updated_at": "2026-08-09T05:41:46.141746Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-a0b489beb0d312d9",
-      "title": "Karpathy session a0b489beb0d3",
-      "content": "## Delta\n\nCommitted as `dd7679fb` on a new branch `docs/claude-md` (1 file, 212 insertions).\n\nTwo things worth flagging:\n\n- **I branched off `main` rather than committing directly to it**, per the repo's git conventions. Say the word if you'd rather this land on `main` directly.\n- **`.prometheus/` was left untracked** — it looked like local tooling state, not part of this change, and AGENTS.md explicitly says not to commit local state directories. Let me know if it's actually meant to be tracked.\n\nNothing is pushed yet. I can push and open a PR if you want.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:52:26.193194Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T10:52:30.420142Z",
-      "updated_at": "2026-08-09T10:52:30.420142Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-b0a4e7ceb012e58d",
-      "title": "Karpathy session b0a4e7ceb012",
-      "content": "## Delta\n\nCompleted kbd-init — Compass\n\nTwo files written to `.kbd-orchestrator/`:\n\n**`project.json`** — discovery results:\n\n| Field | Value | Source |\n|---|---|---|\n| name / description | Compass — \"Native local-first knowledge graph engine…\" | `Cargo.toml` `[workspace.package]` |\n| stack | Rust (Edition 2024, pinned 1.97.1) | `Cargo.toml` + `rust-toolchain.toml` |\n| spec_paths | `openspec/specs/*.md` | `openspec/` exists (just initialized, currently empty) |\n| openspec_available | `true` | — |\n| workspace | single-project (`workspace_file: null`) | no `.code-workspace` references compass |\n| planning / execution agents | `claude` / `claude, codex, opencode` | the tools we just configured |\n| active_phase | `null` | no phase defined yet |\n\n**`constraints.md`** — I did **not** use the template's defaults. Those are TypeScript-oriented (`no-console-log`, `no-any-type`, `grep src/`) and would be inert in a Rust workspace with no `src/` at root. Instead I derived constraints from AGENTS.md: 16 blocking (unsafe/unwrap/expect/panic lints, product boundary vs. Graphify, local-first preservation, determinism, boundedness, immutable realizations, viewer-asset generation) and 17 warning (ownership boundary, extractor/resolver separation, compatibility documentation, the CompassQL and code-graph gates).\n\n**One thing needs your attention before any KBD phase runs a command:**\n\n`/Volumes/Workspace` **is not currently mounted** — only `Macintosh HD`, `my-passport`, and `Open Design` are. Every build/test/lint command in `project.json` sets `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main`, per the AGENTS.md mandate. As written, they'll fail until that volume is attached — which is the correct behavior, since AGENTS.md says to stop and report rather than fall back to a local `target/` on the 100 GB-capped main disk. I encoded the rule faithfully rather than silently substituting a working-but-wrong path.\n\nAlso worth noting: `openspec/specs/` is empty, so `spec_paths` currently resolves to nothing. That's expected for a fresh init — specs appear once you run `/opsx:new`.\n\nThese two files are untracked and uncommitted, separate from the two commits already on `docs/claude-md`. Next step is `/kbd-status` to confirm, then `/kbd-new-phase <name>` to start the first phase.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:55:59.021325Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T10:58:30.244136Z",
-      "updated_at": "2026-08-09T10:58:30.244136Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-b5d49ca1d46e60a2",
-      "title": "Karpathy session b5d49ca1d46e",
-      "content": "## Delta\n\nBoth commits are on `docs/claude-md`:\n\n| Commit | Contents |\n|---|---|\n| `dd7679fb` | `docs: add CLAUDE.md agent guide` — 1 file |\n| `c349fdf6` | `chore: track Prometheus wiki and initialize OpenSpec` — 73 files, 12,227 insertions |\n\n**What landed:**\n- **`.prometheus/knowledge/wiki/`** — all 12 files tracked as-is, per your call.\n- **OpenSpec** initialized with `schema: spec-driven`, generating `.claude/`, `.codex/`, `.kimi/`, `.opencode/` plus `openspec/config.yaml`.\n\n**Three things to know:**\n\n1. **Zed got nothing.** It isn't a supported `openspec init` target, so there's no generated config for it. If you use Zed here, that gap is still open — I can hand-write a rules file, but it'd be unofficial and liable to drift from openspec's format.\n\n2. **Kimi has skills but no commands.** OpenSpec reported \"Commands skipped for: kimi (no adapter)\" — it got 10 skill files, no `/opsx:*` slash commands. Claude, Codex, and OpenCode got both.\n\n3. **`.claude/settings.local.json` stayed untracked.** It's your personal permission allowlist with machine-specific paths, and your global gitignore already excludes it — so it was never at risk of being committed.\n\n`openspec/config.yaml` is currently all commented-out scaffolding. Its `context:` field feeds project background to AI tools when creating artifacts, and this repo has strong conventions worth putting there (local-first Rust, no-unwrap/expect/panic lints, determinism requirements, the `CARGO_TARGET_DIR` rule). Want me to fill it in?\n\nNothing is pushed yet. Say the word and I'll push and open a PR.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:52:28.835309Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- No changed paths detected.\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T10:56:00.254334Z",
-      "updated_at": "2026-08-09T10:56:00.254334Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-b6f086fb31ed31c5",
-      "title": "Karpathy session b6f086fb31ed",
-      "content": "## Delta\n\nBoth commits are on `docs/claude-md`:\n\n| Commit | Contents |\n|---|---|\n| `dd7679fb` | `docs: add CLAUDE.md agent guide` — 1 file |\n| `c349fdf6` | `chore: track Prometheus wiki and initialize OpenSpec` — 73 files, 12,227 insertions |\n\n**What landed:**\n- **`.prometheus/knowledge/wiki/`** — all 12 files tracked as-is, per your call.\n- **OpenSpec** initialized with `schema: spec-driven`, generating `.claude/`, `.codex/`, `.kimi/`, `.opencode/` plus `openspec/config.yaml`.\n\n**Three things to know:**\n\n1. **Zed got nothing.** It isn't a supported `openspec init` target, so there's no generated config for it. If you use Zed here, that gap is still open — I can hand-write a rules file, but it'd be unofficial and liable to drift from openspec's format.\n\n2. **Kimi has skills but no commands.** OpenSpec reported \"Commands skipped for: kimi (no adapter)\" — it got 10 skill files, no `/opsx:*` slash commands. Claude, Codex, and OpenCode got both.\n\n3. **`.claude/settings.local.json` stayed untracked.** It's your personal permission allowlist with machine-specific paths, and your global gitignore already excludes it — so it was never at risk of being committed.\n\n`openspec/config.yaml` is currently all commented-out scaffolding. Its `context:` field feeds project background to AI tools when creating artifacts, and this repo has strong conventions worth putting there (local-first Rust, no-unwrap/expect/panic lints, determinism requirements, the `CARGO_TARGET_DIR` rule). Want me to fill it in?\n\nNothing is pushed yet. Say the word and I'll push and open a PR.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:55:56.151200Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T10:56:01.152228Z",
-      "updated_at": "2026-08-09T10:56:01.152228Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-bb64c62e88af6029",
-      "title": "Karpathy session bb64c62e88af",
-      "content": "## Delta\n\nCreated `CLAUDE.md` at the repo root.\n\nSince `AGENTS.md` is already a thorough agent guide, I wrote CLAUDE.md to defer to it rather than duplicate it, and concentrated on what it leaves implicit:\n\n**What's in it:**\n- **`CARGO_TARGET_DIR` requirement** — surfaced up top, since it must be set on every compiling invocation and is the easiest thing to get wrong. I also flagged the conflict where some Makefile targets (`install`, `dist`, `release-check`) resolve binaries through a literal `target/` path, which AGENTS.md mentions but doesn't tie to specific targets.\n- **Commands** — narrow-loop test/clippy per crate and per integration file, the workspace baseline, the surface-specific gates (product boundary, CompassQL TCK, code-graph qualification), and the npm workspace commands. Noted that `make test` is `--lib --bins` only while `make test-all` needs Python oracle setup.\n- **Architecture** — the piece that genuinely requires reading multiple files: the one-directional flow `compass-files → compass-languages → compass-resolve → compass-graph → compass-model`, orchestrated by `compass-core`. I emphasized the boundary that's easiest to violate — per-file extractors emit evidence and never resolve targets needing project-wide facts. Also the `compass-cypher` (syntax) vs `compass-query` (execution) split, immutable history realizations, and the generated viewer assets round-trip.\n- **Enforced constraints** — the lint set, determinism as correctness, boundedness (limit error ≠ empty result), and reuse of existing safe primitives.\n\nTwo notes on judgment calls: I skipped enumerating individual crates beyond the pipeline ones, since `docs/implementation/workspace-tour.md` already does that well and I pointed at it instead. I also didn't import anything from a Codex or Gemini config — I didn't check for those, as the instruction is to offer rather than read them. If you have an OpenAI Codex or Gemini CLI config you'd like folded in, reply `/import` and it'll scan and list what's importable.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:37:15.181272Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n- CLAUDE.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T10:37:28.812655Z",
-      "updated_at": "2026-08-09T10:37:28.812655Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-c13ff840014cf2b3",
-      "title": "Karpathy session c13ff840014c",
-      "content": "## Delta\n\n`cargo config` needs nightly. Let me verify with a functional test instead — the stronger check anyway, since it proves the var reaches a real build process.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 34d4343f-8edd-46e9-bb53-90b588e5d3ed\n- Captured: 2026-08-09T05:20:58.608418Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- No changed paths detected.\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:34d4343f-8edd-46e9-bb53-90b588e5d3ed"
-      ],
-      "created_at": "2026-08-09T05:26:55.781482Z",
-      "updated_at": "2026-08-09T05:26:55.781482Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-cd330c925600f45f",
-      "title": "Karpathy session cd330c925600",
-      "content": "## Delta\n\nI have what I need to give you a straight answer — and it includes a correction to my own recommendation.\n\n## The doc comment tells you what this type is for\n\n```rust\n/// Deterministic typed records used to construct the five Prolly trees.\npub struct PartitionedGraph { ... }\n```\n\n`PartitionedGraph` isn't a general-purpose partitioning abstraction. It's **the input format for Prolly tree construction** — history's immutable-storage engine. The struct body is plain `Vec<(Vec<u8>, Vec<u8>)>` and looks portable, but the meaning is history-specific.\n\nThe producing logic confirms it. `into_partition` (`artifacts.rs:349-400+`) is entangled with concerns that don't exist on the current-graph path:\n\n| Dependency | Belongs to |\n|---|---|\n| `CompletionEvidence` | history realization completion |\n| `authoritative_sidecars` / `TRUSTED_GRAPH_CONTENT` | history provenance |\n| `AnalysisBundle`, `compass_ir::ProgramBundle` | `compass-analysis` / `compass-ir` |\n| `HistoryError` | history error taxonomy |\n| `prolly::{KeyBuilder, VersionedValue}` | Prolly storage |\n\nAnd the crate dependency sets diverge sharply. `compass-history` pulls `prolly-map`, `prolly-store-sqlite`, `compass-ir`, `compass-analysis`. `compass-graph` pulls none of those. A shared crate has to either carry that weight — forcing Prolly and IR onto the current-graph path, which contradicts the local-first minimal-dependency posture — or be gutted down to the struct alone.\n\n**If it's gutted to the struct alone, you've shared 9 lines of field declarations and left all 2,300 lines of actual logic behind.** That's not reuse.\n\n## What I'd do instead\n\nI over-indexed on \"the mechanism exists\" in the analysis. On closer reading, what exists is *history's* mechanism, and the shared-crate framing inherits a coupling that doesn't serve the current-graph path.\n\nThe sequencing finding still stands and is the load-bearing one: **stream `load_active_snapshot` first**. That removes the actual constraint. Whether current-graph publication later adopts a record-partitioned format is a separate question that gets much easier to answer *after* the read path stops materializing 2 GiB — and it may not need `PartitionedGraph`'s shape at all, since it has no Prolly trees to feed.\n\nSo I'd put the shared crate behind the streaming fix rather than in front of it.\n\nThat said — you've made a call, and you may be seeing a longer arc than I am (a future where current-graph and history publication genuinely converge, which would justify the shared crate now). If that's the intent, say so and I'll spec it properly. Three questions I'd need answered either way:\n\n1. **Crate name and scope** — `compass-partition`? Does it carry just the type, or the record-encoding helpers (`node_key`, `edge_key`, `hyperedge_key`, `canonical_json_bytes`) too?\n2. **Does it take the Prolly dependency?** If yes, `compass-graph` inherits it. If no, the encoding logic stays in history and the shared crate is nearly empty.\n3. **Identity semantics** — history fingerprints are meaning-affecting and realizations are immutable. If current-graph reuses the same record keys, do the two paths risk producing colliding or conflatable identities? AGENTS.md is strict here.\n\nWant me to spec the shared crate as you've directed, or run `/kbd-spec` on the streaming fix first and revisit this once the read path is honest?\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T12:06:25.091241Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- AGENTS.md\n- .kbd-orchestrator/\n- .prometheus/events.jsonl\n- .prometheus/knowledge/.prompt-snapshots/\n- .prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-session.md\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-15a46a623cf0e420.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md\n- .prometheus/knowledge/wiki/karpathy-session-3383d6fb52bb5dce.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-7c287ce9b2192bd7.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T12:06:26.089450Z",
-      "updated_at": "2026-08-09T12:06:26.089450Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-f8eff00b52d5f657",
-      "title": "Karpathy session f8eff00b52d5",
-      "content": "## Delta\n\nCreated `CLAUDE.md` at the repo root.\n\nSince `AGENTS.md` is already a thorough agent guide, I wrote CLAUDE.md to defer to it rather than duplicate it, and concentrated on what it leaves implicit:\n\n**What's in it:**\n- **`CARGO_TARGET_DIR` requirement** — surfaced up top, since it must be set on every compiling invocation and is the easiest thing to get wrong. I also flagged the conflict where some Makefile targets (`install`, `dist`, `release-check`) resolve binaries through a literal `target/` path, which AGENTS.md mentions but doesn't tie to specific targets.\n- **Commands** — narrow-loop test/clippy per crate and per integration file, the workspace baseline, the surface-specific gates (product boundary, CompassQL TCK, code-graph qualification), and the npm workspace commands. Noted that `make test` is `--lib --bins` only while `make test-all` needs Python oracle setup.\n- **Architecture** — the piece that genuinely requires reading multiple files: the one-directional flow `compass-files → compass-languages → compass-resolve → compass-graph → compass-model`, orchestrated by `compass-core`. I emphasized the boundary that's easiest to violate — per-file extractors emit evidence and never resolve targets needing project-wide facts. Also the `compass-cypher` (syntax) vs `compass-query` (execution) split, immutable history realizations, and the generated viewer assets round-trip.\n- **Enforced constraints** — the lint set, determinism as correctness, boundedness (limit error ≠ empty result), and reuse of existing safe primitives.\n\nTwo notes on judgment calls: I skipped enumerating individual crates beyond the pipeline ones, since `docs/implementation/workspace-tour.md` already does that well and I pointed at it instead. I also didn't import anything from a Codex or Gemini config — I didn't check for those, as the instruction is to offer rather than read them. If you have an OpenAI Codex or Gemini CLI config you'd like folded in, reply `/import` and it'll scan and list what's importable.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:34:10.259136Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n- CLAUDE.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T10:34:18.362064Z",
-      "updated_at": "2026-08-09T10:34:18.362064Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-f8f9c99266231745",
-      "title": "Karpathy session f8f9c9926623",
-      "content": "## Delta\n\nI have what I need to give you a straight answer — and it includes a correction to my own recommendation.\n\n## The doc comment tells you what this type is for\n\n```rust\n/// Deterministic typed records used to construct the five Prolly trees.\npub struct PartitionedGraph { ... }\n```\n\n`PartitionedGraph` isn't a general-purpose partitioning abstraction. It's **the input format for Prolly tree construction** — history's immutable-storage engine. The struct body is plain `Vec<(Vec<u8>, Vec<u8>)>` and looks portable, but the meaning is history-specific.\n\nThe producing logic confirms it. `into_partition` (`artifacts.rs:349-400+`) is entangled with concerns that don't exist on the current-graph path:\n\n| Dependency | Belongs to |\n|---|---|\n| `CompletionEvidence` | history realization completion |\n| `authoritative_sidecars` / `TRUSTED_GRAPH_CONTENT` | history provenance |\n| `AnalysisBundle`, `compass_ir::ProgramBundle` | `compass-analysis` / `compass-ir` |\n| `HistoryError` | history error taxonomy |\n| `prolly::{KeyBuilder, VersionedValue}` | Prolly storage |\n\nAnd the crate dependency sets diverge sharply. `compass-history` pulls `prolly-map`, `prolly-store-sqlite`, `compass-ir`, `compass-analysis`. `compass-graph` pulls none of those. A shared crate has to either carry that weight — forcing Prolly and IR onto the current-graph path, which contradicts the local-first minimal-dependency posture — or be gutted down to the struct alone.\n\n**If it's gutted to the struct alone, you've shared 9 lines of field declarations and left all 2,300 lines of actual logic behind.** That's not reuse.\n\n## What I'd do instead\n\nI over-indexed on \"the mechanism exists\" in the analysis. On closer reading, what exists is *history's* mechanism, and the shared-crate framing inherits a coupling that doesn't serve the current-graph path.\n\nThe sequencing finding still stands and is the load-bearing one: **stream `load_active_snapshot` first**. That removes the actual constraint. Whether current-graph publication later adopts a record-partitioned format is a separate question that gets much easier to answer *after* the read path stops materializing 2 GiB — and it may not need `PartitionedGraph`'s shape at all, since it has no Prolly trees to feed.\n\nSo I'd put the shared crate behind the streaming fix rather than in front of it.\n\nThat said — you've made a call, and you may be seeing a longer arc than I am (a future where current-graph and history publication genuinely converge, which would justify the shared crate now). If that's the intent, say so and I'll spec it properly. Three questions I'd need answered either way:\n\n1. **Crate name and scope** — `compass-partition`? Does it carry just the type, or the record-encoding helpers (`node_key`, `edge_key`, `hyperedge_key`, `canonical_json_bytes`) too?\n2. **Does it take the Prolly dependency?** If yes, `compass-graph` inherits it. If no, the encoding logic stays in history and the shared crate is nearly empty.\n3. **Identity semantics** — history fingerprints are meaning-affecting and realizations are immutable. If current-graph reuses the same record keys, do the two paths risk producing colliding or conflatable identities? AGENTS.md is strict here.\n\nWant me to spec the shared crate as you've directed, or run `/kbd-spec` on the streaming fix first and revisit this once the read path is honest?\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T12:05:04.010581Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- AGENTS.md\n- .kbd-orchestrator/\n- .prometheus/events.jsonl\n- .prometheus/knowledge/.prompt-snapshots/\n- .prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-session.md\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-15a46a623cf0e420.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md\n- .prometheus/knowledge/wiki/karpathy-session-3383d6fb52bb5dce.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-7c287ce9b2192bd7.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-cd330c925600f45f.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T12:06:26.689357Z",
-      "updated_at": "2026-08-09T12:06:26.689357Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-f90cdbd5fafd1d1d",
-      "title": "Karpathy session f90cdbd5fafd",
-      "content": "## Delta\n\nCompleted kbd-init — Compass\n\nTwo files written to `.kbd-orchestrator/`:\n\n**`project.json`** — discovery results:\n\n| Field | Value | Source |\n|---|---|---|\n| name / description | Compass — \"Native local-first knowledge graph engine…\" | `Cargo.toml` `[workspace.package]` |\n| stack | Rust (Edition 2024, pinned 1.97.1) | `Cargo.toml` + `rust-toolchain.toml` |\n| spec_paths | `openspec/specs/*.md` | `openspec/` exists (just initialized, currently empty) |\n| openspec_available | `true` | — |\n| workspace | single-project (`workspace_file: null`) | no `.code-workspace` references compass |\n| planning / execution agents | `claude` / `claude, codex, opencode` | the tools we just configured |\n| active_phase | `null` | no phase defined yet |\n\n**`constraints.md`** — I did **not** use the template's defaults. Those are TypeScript-oriented (`no-console-log`, `no-any-type`, `grep src/`) and would be inert in a Rust workspace with no `src/` at root. Instead I derived constraints from AGENTS.md: 16 blocking (unsafe/unwrap/expect/panic lints, product boundary vs. Graphify, local-first preservation, determinism, boundedness, immutable realizations, viewer-asset generation) and 17 warning (ownership boundary, extractor/resolver separation, compatibility documentation, the CompassQL and code-graph gates).\n\n**One thing needs your attention before any KBD phase runs a command:**\n\n`/Volumes/Workspace` **is not currently mounted** — only `Macintosh HD`, `my-passport`, and `Open Design` are. Every build/test/lint command in `project.json` sets `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main`, per the AGENTS.md mandate. As written, they'll fail until that volume is attached — which is the correct behavior, since AGENTS.md says to stop and report rather than fall back to a local `target/` on the 100 GB-capped main disk. I encoded the rule faithfully rather than silently substituting a working-but-wrong path.\n\nAlso worth noting: `openspec/specs/` is empty, so `spec_paths` currently resolves to nothing. That's expected for a fresh init — specs appear once you run `/opsx:new`.\n\nThese two files are untracked and uncommitted, separate from the two commits already on `docs/claude-md`. Next step is `/kbd-status` to confirm, then `/kbd-new-phase <name>` to start the first phase.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:58:29.463044Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T10:58:32.854406Z",
-      "updated_at": "2026-08-09T10:58:32.854406Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    }
-  ]
-}
diff --git a/.prometheus/knowledge/.prompt-snapshots/project/generations/af7fabc39868c850a9cc065ff05dbf7c749eb3ee292740ad01d9cc572cd6d064.json b/.prometheus/knowledge/.prompt-snapshots/project/generations/af7fabc39868c850a9cc065ff05dbf7c749eb3ee292740ad01d9cc572cd6d064.json
deleted file mode 100644
index 49dbf700a..000000000
--- a/.prometheus/knowledge/.prompt-snapshots/project/generations/af7fabc39868c850a9cc065ff05dbf7c749eb3ee292740ad01d9cc572cd6d064.json
+++ /dev/null
@@ -1,794 +0,0 @@
-{
-  "schemaVersion": 1,
-  "scope": "project",
-  "generation": "af7fabc39868c850a9cc065ff05dbf7c749eb3ee292740ad01d9cc572cd6d064",
-  "candidateCount": 41,
-  "byteCount": 134195,
-  "entries": [
-    {
-      "id": "compass-scoping-and-bounds-completion-capture",
-      "title": "Compass scoping and bounds completion capture",
-      "content": "## Session Record\n\n- Executor session completed for phase `compass-scoping-and-bounds`.\n- Reported change status: `unknown`.\n- No implementation delta, root cause, changed paths, or corrective actions were present in the capture.\n\n## Handling Notes\n\n- Preserve as a minimal execution record.\n- Do not infer code changes or operational impact from this record alone.\n- Related minimal record: [Compass scoping and bounds executor session](/compass-scoping-and-bounds-executor-session.md).\n\n# Citations\n\n1. stdin",
-      "tags": [
-        "compass",
-        "executor-session",
-        "scoping",
-        "session-record"
-      ],
-      "links": [
-        "compass-scoping-and-bounds-executor-session"
-      ],
-      "sources": [
-        "stdin"
-      ],
-      "created_at": "2026-08-09T12:42:25.785210Z",
-      "updated_at": "2026-08-09T12:42:25.785210Z",
-      "revision": 0,
-      "entry_type": "Reference",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "compass-scoping-and-bounds-executor-session",
-      "title": "Compass scoping and bounds executor session",
-      "content": "## Summary\n\n- Executor session completed for phase `compass-scoping-and-bounds`.\n- Reported change status: `unknown`.\n- No delta, root cause, changed paths, or corrective actions were captured in the raw record.\n\n## Session Record\n\n| Field | Value |\n|---|---|\n| Phase | `compass-scoping-and-bounds` |\n| Change | `unknown` |\n| Status | complete |\n\n## Handling Notes\n\n- Preserve as a minimal execution record.\n- Do not infer implementation changes, changed paths, or root cause from this capture alone.\n- Promote reusable findings only if a fuller session artifact becomes available.\n\n# Citations\n\n1. stdin",
-      "tags": [
-        "compass",
-        "executor-session",
-        "scoping",
-        "session-record"
-      ],
-      "links": [],
-      "sources": [
-        "stdin"
-      ],
-      "created_at": "2026-08-09T12:09:38.086902Z",
-      "updated_at": "2026-08-09T12:09:38.087376Z",
-      "revision": 1,
-      "entry_type": "Reference",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-04f1f5622348cff2",
-      "title": "Karpathy session 04f1f5622348",
-      "content": "## Delta\n\nDone — built, installed, and the target directory cleaned.\n\n**Results:**\n- `make install` → release build succeeded in **24m 13s**\n- Installed `compass 0.3.6` → `~/.cargo/bin/compass` (146 MB), verified working after cleanup, resolving on PATH\n- Local `./target` reclaimed: **139 MB → 4 KB**\n\n**One thing worth knowing:** cleaning `target/` reclaimed far less than you'd expect, because your global `~/.cargo/config.toml` offloads Rust builds to the external drive. Intermediates go to `/Volumes/my-passport/cargo-build/...` (3.3 GB for this workspace) and sccache to `/Volumes/my-passport/sccache` (29 of 40 GiB). Only the final binary lands locally — so `target/` was never the disk hog here.\n\nI deliberately did **not** run `cargo clean`. It would have deleted the 3.3 GB external build cache too, costing you another 24-minute cold rebuild while reclaiming nothing extra from your internal disk. I removed `target/release` instead.\n\n**The actual local space, if you want it — needs your call:**\n\n`~/Library/Caches/Mozilla.sccache` holds **10 GB on your internal disk**. This is sccache's *default* path, not your configured WDD one. It gets written whenever sccache starts in a shell that didn't export `SCCACHE_DIR` — your `.zshrc` only sets it behind a `[[ -d \"$WDD/cargo\" ]]` guard, so non-login shells and any unmounted-drive moment bypass it. Newest entries are from Aug 8 20:14, so it's recent, not ancient.\n\nDeleting it is safe — sccache is purely a cache, worst case is slower recompiles — and nothing currently holds it open. I'd also suggest setting `SCCACHE_DIR` in `~/.cargo/config.toml`'s `[env]` rather than `.zshrc`, so it applies to every shell and stops re-accumulating. Say the word and I'll do either or both.\n\nI should flag one correction: mid-investigation I said the build had \"stopped\" and separately called this cache \"orphaned.\" Both were wrong — the first was a bad read of a momentary process gap, the second I revised once I checked the timestamps.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 34d4343f-8edd-46e9-bb53-90b588e5d3ed\n- Captured: 2026-08-09T05:20:55.484287Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- No changed paths detected.\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:34d4343f-8edd-46e9-bb53-90b588e5d3ed"
-      ],
-      "created_at": "2026-08-09T05:21:00.817633Z",
-      "updated_at": "2026-08-09T05:21:00.817633Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-06cdf26d86b0c087",
-      "title": "Karpathy session 06cdf26d86b0",
-      "content": "## Delta\n\nI've traced it. Here's what's actually going on — and part of it contradicts the premise.\n\n## Why 1.6.2 is resolving\n\n**1.7.0 was never installed.** The cache holds only `1.6.0`, `1.6.1`, `1.6.2`. Your source repo at `/Users/gqadonis/Projects/prometheus/prometheus-skill-pack` is tagged `v1.7.0` (12 commits past it, working tree clean), but that was never published into the plugin cache. The newest cache dir is dated Aug 3; the `.prometheus` generation is Aug 5. The tag exists locally and nowhere else.\n\nThere's also a **second, unrelated breakage**: `~/.claude/skills/kbd-init` symlinks to `~/.prometheus/plugins/prometheus-skill-pack/current/skills/process/kbd-process-orchestrator/skills/kbd-init` — a path that doesn't resolve. That's why I fell back to the cache at the start of this session. Two different install roots (`.claude/plugins/cache` and `.prometheus/plugins/generations`), and the symlink points into the one that's broken.\n\n## But the premise doesn't hold for this work\n\nI diffed the source tree against 1.6.2 directly. **The entire `kbd-process-orchestrator` differs in exactly three files:**\n\n| File | Status |\n|---|---|\n| `references/integrations/adversarial-review.md` | differs |\n| `skills/kbd-execute/SKILL.md` | differs |\n| `skills/kbd-spec/SKILL.md` | differs |\n\nEverything else is byte-identical. Specifically:\n\n- **`kbd-analyze` exists in 1.6.2 and its `SKILL.md` is identical to 1.7.0.** My earlier \"no analyze.md\" observation was about the `prompts/` directory — and `prompts/` has no `analyze.md` in **1.7.0 either**. `kbd-analyze` is driven by its `SKILL.md`, not a prompt file. That's not a version gap; I misread it.\n- `kbd-assess/SKILL.md`, `kbd-init/SKILL.md`, `kbd-new-phase/SKILL.md`, `prompts/assess.md`, `project.template.json`, and the adversarial-review preflight script are all **identical** between source and 1.6.2.\n\nSo the `/kbd-init` and `/kbd-assess` runs already completed used the same bytes 1.7.0 would have. No rework needed there.\n\nThe three drifted files matter for `/kbd-execute` and `/kbd-spec` — stages we haven't reached.\n\n## Your call\n\nI can't publish 1.7.0 into the plugin cache myself — that's your packaging pipeline, and I don't know its publish command. Options:\n\n1. **Publish 1.7.0 properly** — you run the pack's install/publish step; I re-verify and continue. Cleanest, and fixes the broken `~/.claude/skills` symlink if the installer rewrites it.\n2. **Continue on 1.6.2 for analyze** — legitimate here, since `kbd-analyze` is byte-identical. Then upgrade before `/kbd-spec` or `/kbd-execute`, where the drift is real.\n3. **Point the KBD skills at the source tree directly** for this session.\n\nI'd suggest **1**, since the symlink is broken regardless and will keep biting. But **2** is defensible if you want to keep moving on the partitioning question now — the risk is genuinely zero for the analyze stage.\n\nWhich way?\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:11:33.611768Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T11:14:53.644969Z",
-      "updated_at": "2026-08-09T11:14:53.644969Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-0c2a62b22721a70c",
-      "title": "Karpathy session 0c2a62b22721",
-      "content": "## Delta\n\nThat confirms the root cause. Here's what's happening.\n\n## Diagnosis\n\nThis is **not a bug** — it's a bounded-work invariant firing correctly, but with a bad user experience. Three separate problems:\n\n**1. The scope was never actually narrowed.** Your run reported `Scope: 0 include rule(s), 0 exclude rule(s)` and matched **19,666 files**. The repo is 6.8 GB, and the walk swept in directories that have no business in a code graph:\n\n| Directory | Size |\n|---|---|\n| `node_modules/` | 1.6 GB |\n| `target/` | 821 MB |\n| `compass-out/` | 302 MB ← Compass's *own* prior output |\n| `vendor/` | 126 MB |\n\nNote the 9,679 \"documents\" and 508 images — that's overwhelmingly dependency and build-artifact content, not your source.\n\n**2. The 2 GiB cap has no escape hatch on this path.** `MAX_GRAPH_BYTES` (`crates/compass-store/src/lib.rs:51`) is a hard `const`. Elsewhere in the codebase — `compass-model`, `compass-output`, `compass-global`, `compass-core` — the same limit is overridable via `COMPASS_MAX_GRAPH_BYTES`, and the error messages there *tell you so*. But `compass-graph/src/snapshot.rs:3138` and `compass-store` never read that variable. So the message you got is a dead end: no override, no suggested remedy.\n\n**3. It failed after 331 seconds**, at final publication — after all extraction work was done. The limit is checked at serialization time (`digest_json`), not estimated up front.\n\n## Your immediate unblock\n\n`compass init` does support scoping — you just pressed through the prompts. Exclusions are available non-interactively:\n\n```bash\ncd /Users/gqadonis/Projects/prometheus/universal-agent-runtime\nrm -rf compass-out .compass\ncompass init --exclude='node_modules/**' --exclude='target/**' \\\n             --exclude='compass-out/**' --exclude='vendor/**' \\\n             --exclude='website/**' --exclude='static/**' --exclude='models.dev/**'\n```\n\nThat should cut the graph by well over an order of magnitude. I haven't run it, so I can't promise it lands under the cap — but the excluded directories are ~3.2 GB of the 6.8 GB, and they're the ones generating the bulk of those 9,679 documents.\n\n## The real fixes for this repo\n\nThree defects worth addressing here, in priority order:\n\n1. **Default ignore policy misses `compass-out/`, `node_modules/`, `target/`, `vendor/`.** Compass ingesting its own output directory is clearly wrong. This belongs in `compass-files::detect`.\n2. **The limit error is unactionable.** It should name the override (if one is granted on this path) and point at scoping — matching how `compass-model` and `compass-core` already word theirs.\n3. **Failing at 331 s is avoidable.** A pre-publication size estimate could fail fast, or warn during extraction.\n\nPer AGENTS.md, #1 and #3 are `compass-files`/`compass-core` work and #2 spans `compass-graph`/`compass-store`; the CLI message stays thin.\n\nTwo things I want your call on before doing anything:\n\n- **Scope:** should I fix all three, or just the ignore-policy default (#1), which alone would have prevented your failure?\n- **Whether to raise the cap:** I'd advise against it. It's a deliberate bounded-work invariant, and AGENTS.md is explicit that a limit error is a distinct outcome from an empty result. Better to make the default scope sane than to let a 2 GiB graph through.\n\nAlso worth noting: the two commits on `docs/claude-md` and the `.kbd-orchestrator/` files are all still uncommitted/unpushed. This fix is unrelated work — I'd put it on its own branch rather than folding it in.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:05:43.579156Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T11:05:44.269089Z",
-      "updated_at": "2026-08-09T11:05:44.269089Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-0cf2eabc28e07ef7",
-      "title": "Karpathy session 0cf2eabc28e0",
-      "content": "## Delta\n\nFixed. The only remaining \"12 GB\" match is inside my new comment, where it's describing the past drift rather than claiming a current value.\n\nThe comment now points to `SCCACHE_CACHE_SIZE` in `[env]` instead of restating the number — a single source of truth, so it can't go stale again the way it just did. Config parses cleanly, and the declared `40G` matches what the live server actually reports (40 GiB max, on the WDD).\n\nThat closes out all three items: release build installed as `compass 0.3.6`, ~10.1 GB reclaimed locally, and the sccache config corrected so the internal disk stops accumulating cache.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 34d4343f-8edd-46e9-bb53-90b588e5d3ed\n- Captured: 2026-08-09T05:41:42.970513Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:34d4343f-8edd-46e9-bb53-90b588e5d3ed"
-      ],
-      "created_at": "2026-08-09T05:41:45.675152Z",
-      "updated_at": "2026-08-09T05:41:45.675152Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-1371f12708207b52",
-      "title": "Karpathy session 1371f1270820",
-      "content": "## Delta\n\nPlan vetted. Now the waypoint refresh and handoff — I'll hold off emitting OpenSpec change structures pending a scope question.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T12:21:59.257230Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- AGENTS.md\n- .kbd-orchestrator/\n- .prometheus/events.jsonl\n- .prometheus/knowledge/.prompt-snapshots/\n- .prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-session.md\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-15a46a623cf0e420.md\n- .prometheus/knowledge/wiki/karpathy-session-178be089fef7012d.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md\n- .prometheus/knowledge/wiki/karpathy-session-3383d6fb52bb5dce.md\n- .prometheus/knowledge/wiki/karpathy-session-4301f5fbc8d2baa8.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-7c287ce9b2192bd7.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-cd330c925600f45f.md\n- .prometheus/knowledge/wiki/karpathy-session-f8f9c99266231745.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T12:27:10.263975Z",
-      "updated_at": "2026-08-09T12:27:10.263975Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-15a46a623cf0e420",
-      "title": "Karpathy session 15a46a623cf0",
-      "content": "## Delta\n\nWritten to `/Users/gqadonis/Projects/prometheus/prometheus-skill-pack/docs/UPDATE_CONSIDERATIONS.md`.\n\nIt's structured as a handoff brief rather than the bare prompt — the same content, but organized so someone landing cold can act on it:\n\n- **Symptom + consequence** — the error, and the concrete drift it causes (`kbd-execute`, `kbd-spec`, `adversarial-review.md`), with the install-ref vs HEAD mismatch.\n- **Established by direct verification** — the three things I actually proved, with the hash evidence showing the manifest was wrong and the file was right.\n- **Open hypothesis** — `payloadRoot`, with four ranked candidates and an explicit instruction not to guess-and-patch. The likeliest answer (payload stages from HEAD → manifest must be committed) is called out as *structurally* meaning regeneration alone can't work.\n- **Constraints** — the concurrency guardrails, including that the two tree snapshots I took minutes apart already differed, so the listed file set is indicative only.\n- **Definition of done** — six checkable conditions, the last being that in-flight work survives untouched.\n- **Secondary defect** — the broken `.claude/skills` symlink, framed as arguably higher impact since it's the mechanism that let the staleness go unnoticed.\n- **Preventive follow-up** — proposal only, pointing at `check-harness-adapters.js` as the likely existing-but-unenforced check.\n\nI only created that one new file; nothing else in the repo was touched. Note the working tree there has kept growing — `kbd-init` workflow files across five harness surfaces are now modified — so that document is deliberately written to assume its own file list is stale.\n\nTwo loose ends still open here in Compass: the phase creation and `/kbd-analyze` on the partitioning question, plus the two unpushed commits on `docs/claude-md` and the untracked `.kbd-orchestrator/`. Since `kbd-analyze`'s `SKILL.md` is byte-identical between 1.6.2 and 1.7.0, running it now carries no version risk if you want to keep moving.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:22:19.272736Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- AGENTS.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T11:24:40.030753Z",
-      "updated_at": "2026-08-09T11:24:40.030753Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-178be089fef7012d",
-      "title": "Karpathy session 178be089fef7",
-      "content": "## Delta\n\nI have what I need to give you a straight answer — and it includes a correction to my own recommendation.\n\n## The doc comment tells you what this type is for\n\n```rust\n/// Deterministic typed records used to construct the five Prolly trees.\npub struct PartitionedGraph { ... }\n```\n\n`PartitionedGraph` isn't a general-purpose partitioning abstraction. It's **the input format for Prolly tree construction** — history's immutable-storage engine. The struct body is plain `Vec<(Vec<u8>, Vec<u8>)>` and looks portable, but the meaning is history-specific.\n\nThe producing logic confirms it. `into_partition` (`artifacts.rs:349-400+`) is entangled with concerns that don't exist on the current-graph path:\n\n| Dependency | Belongs to |\n|---|---|\n| `CompletionEvidence` | history realization completion |\n| `authoritative_sidecars` / `TRUSTED_GRAPH_CONTENT` | history provenance |\n| `AnalysisBundle`, `compass_ir::ProgramBundle` | `compass-analysis` / `compass-ir` |\n| `HistoryError` | history error taxonomy |\n| `prolly::{KeyBuilder, VersionedValue}` | Prolly storage |\n\nAnd the crate dependency sets diverge sharply. `compass-history` pulls `prolly-map`, `prolly-store-sqlite`, `compass-ir`, `compass-analysis`. `compass-graph` pulls none of those. A shared crate has to either carry that weight — forcing Prolly and IR onto the current-graph path, which contradicts the local-first minimal-dependency posture — or be gutted down to the struct alone.\n\n**If it's gutted to the struct alone, you've shared 9 lines of field declarations and left all 2,300 lines of actual logic behind.** That's not reuse.\n\n## What I'd do instead\n\nI over-indexed on \"the mechanism exists\" in the analysis. On closer reading, what exists is *history's* mechanism, and the shared-crate framing inherits a coupling that doesn't serve the current-graph path.\n\nThe sequencing finding still stands and is the load-bearing one: **stream `load_active_snapshot` first**. That removes the actual constraint. Whether current-graph publication later adopts a record-partitioned format is a separate question that gets much easier to answer *after* the read path stops materializing 2 GiB — and it may not need `PartitionedGraph`'s shape at all, since it has no Prolly trees to feed.\n\nSo I'd put the shared crate behind the streaming fix rather than in front of it.\n\nThat said — you've made a call, and you may be seeing a longer arc than I am (a future where current-graph and history publication genuinely converge, which would justify the shared crate now). If that's the intent, say so and I'll spec it properly. Three questions I'd need answered either way:\n\n1. **Crate name and scope** — `compass-partition`? Does it carry just the type, or the record-encoding helpers (`node_key`, `edge_key`, `hyperedge_key`, `canonical_json_bytes`) too?\n2. **Does it take the Prolly dependency?** If yes, `compass-graph` inherits it. If no, the encoding logic stays in history and the shared crate is nearly empty.\n3. **Identity semantics** — history fingerprints are meaning-affecting and realizations are immutable. If current-graph reuses the same record keys, do the two paths risk producing colliding or conflatable identities? AGENTS.md is strict here.\n\nWant me to spec the shared crate as you've directed, or run `/kbd-spec` on the streaming fix first and revisit this once the read path is honest?\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T12:09:31.964016Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- AGENTS.md\n- .kbd-orchestrator/\n- .prometheus/events.jsonl\n- .prometheus/knowledge/.prompt-snapshots/\n- .prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-session.md\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-15a46a623cf0e420.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md\n- .prometheus/knowledge/wiki/karpathy-session-3383d6fb52bb5dce.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-7c287ce9b2192bd7.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-cd330c925600f45f.md\n- .prometheus/knowledge/wiki/karpathy-session-f8f9c99266231745.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T12:09:34.902228Z",
-      "updated_at": "2026-08-09T12:09:34.902228Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-19802b94100a3ab3",
-      "title": "Karpathy session 19802b94100a",
-      "content": "## Delta\n\nCompleted kbd-assess — compass-scoping-and-bounds (step 0 of 0)\n\n## Answer: no, don't add scoping — it already exists and works\n\n**I need to correct my previous turn.** I told you the default ignore policy was missing `node_modules/`, `target/`, and `compass-out/`. That was wrong, and it was the premise of my whole recommendation. Reading the source disproves it:\n\n- All three are in `SKIP_DIRS` — ~40 entries at `crates/compass-files/src/detect.rs:61-102`\n- Gitignore respect defaults to `true` (`detect.rs:163`)\n- `.compassignore` is supported (`detect.rs:390`)\n- `--include`/`--exclude` already exist (`init_commands.rs:438-462`)\n\nBuilding scoping would have duplicated shipped functionality. That's the finding that changes the recommendation, and it came from checking the code rather than trusting my own earlier hypothesis.\n\n**What actually happened:** the exclusions fired correctly. That repo just has **9,320 in-scope markdown files — 4,827 under `crates/` alone**. The 19,666 matched files are real content, not leaked junk. This is a genuine capacity limit.\n\n**Research corroborates that Compass is already at or above baseline.** Firecrawl across `ck`, `codegraphcontext`, `.cursorignore`, ripgrep, and a formatter comparative study: respect `.gitignore` by default (\"the single highest-value default\"), ship hardcoded defaults, offer a tool-specific ignore file. Compass does all three, with a *larger* default list than the tools surveyed.\n\n**The real defects, in order:**\n\n| Pri | Defect |\n|---|---|\n| 1 | `COMPASS_MAX_GRAPH_BYTES` is honored in `compass-model`, `-output`, `-global`, `-core` — and their errors advertise it — but **not** on the snapshot path that actually failed. You hit a limit the rest of the product treats as adjustable, with no override. |\n| 2 | The error names a fact and stops — no override, no `--exclude` hint, no indication of what dominated the graph. |\n| 3 | Fails at 331 s after all work completes, then discards it. |\n| 4 | `vendor/` isn't skipped — but that needs a decision, not a reflex; Go monorepos and Compass's own tree legitimately use it. |\n\n**Two things I won't paper over:**\n\n- **My suggested `--exclude` workaround is untested and may not work.** With 4,827 markdown files under `crates/` — which you can't exclude without gutting the graph — it may still blow the cap.\n- **I'd resist raising the 2 GiB limit.** AGENTS.md is explicit that bounded work is an invariant and a limit error is distinct from an empty result. Grant an explicit opt-in override instead — which matches ripgrep's maintainer position that a paired explicit flag beats changing defaults.\n\n**Open architecture question for `/kbd-analyze`:** if a repo this size can't publish under 2 GiB even with sane exclusions, the answer may be graph partitioning rather than a bigger number. That should be settled before any code is written.\n\nAssessment written to `.kbd-orchestrator/phases/compass-scoping-and-bounds/assessment.md`. Note the phase is provisional — I didn't run `/kbd-new-phase`, so `active_phase` is still `null` and there's no `progress.json` (hence \"step 0 of 0\"). Say the word and I'll create it properly, or rename it.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:11:29.936317Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T11:11:30.692085Z",
-      "updated_at": "2026-08-09T11:11:30.692085Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-199d5165acd78a00",
-      "title": "Karpathy session 199d5165acd7",
-      "content": "## Delta\n\nCreated `CLAUDE.md` at the repo root.\n\nSince `AGENTS.md` is already a thorough agent guide, I wrote CLAUDE.md to defer to it rather than duplicate it, and concentrated on what it leaves implicit:\n\n**What's in it:**\n- **`CARGO_TARGET_DIR` requirement** — surfaced up top, since it must be set on every compiling invocation and is the easiest thing to get wrong. I also flagged the conflict where some Makefile targets (`install`, `dist`, `release-check`) resolve binaries through a literal `target/` path, which AGENTS.md mentions but doesn't tie to specific targets.\n- **Commands** — narrow-loop test/clippy per crate and per integration file, the workspace baseline, the surface-specific gates (product boundary, CompassQL TCK, code-graph qualification), and the npm workspace commands. Noted that `make test` is `--lib --bins` only while `make test-all` needs Python oracle setup.\n- **Architecture** — the piece that genuinely requires reading multiple files: the one-directional flow `compass-files → compass-languages → compass-resolve → compass-graph → compass-model`, orchestrated by `compass-core`. I emphasized the boundary that's easiest to violate — per-file extractors emit evidence and never resolve targets needing project-wide facts. Also the `compass-cypher` (syntax) vs `compass-query` (execution) split, immutable history realizations, and the generated viewer assets round-trip.\n- **Enforced constraints** — the lint set, determinism as correctness, boundedness (limit error ≠ empty result), and reuse of existing safe primitives.\n\nTwo notes on judgment calls: I skipped enumerating individual crates beyond the pipeline ones, since `docs/implementation/workspace-tour.md` already does that well and I pointed at it instead. I also didn't import anything from a Codex or Gemini config — I didn't check for those, as the instruction is to offer rather than read them. If you have an OpenAI Codex or Gemini CLI config you'd like folded in, reply `/import` and it'll scan and list what's importable.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:34:13.627630Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n- CLAUDE.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T10:34:32.153219Z",
-      "updated_at": "2026-08-09T10:34:32.153219Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-309fba26769d26dc",
-      "title": "Karpathy session 309fba26769d",
-      "content": "## Delta\n\nHere's a self-contained prompt for a session in the skill-pack repo. It's written to be safe alongside concurrent work — it assumes nothing about the working tree and stops rather than overwriting.\n\n````markdown\n# Fix: `update-skill-pack.sh` fails release payload verification, blocking 1.7.0 install\n\n## Context\n\nRepo: `/Users/gqadonis/Projects/prometheus/prometheus-skill-pack`\n(remote `git@github.com:Prometheus-AGS/prometheus-skill-system.git`)\n\n`bash scripts/update-skill-pack.sh` fails at step 2 and no new generation is\ninstalled:\n\n```\nStep 2: Building and verifying immutable generation...\ninstall-plugin-generation: release payload verification failed for shared/scripts/detect-toolchain.sh\n```\n\nConsequence: `~/.prometheus/plugins/prometheus-skill-pack/current` is pinned to\nan older generation. `~/.prometheus/skill-pack-install-ref` records `dfdd8be`\nwhile `main` is at `6e46758` (`v1.7.0-12-g6e46758`). Consumers of the pack are\nrunning stale skills; `kbd-execute/SKILL.md`, `kbd-spec/SKILL.md`, and\n`references/integrations/adversarial-review.md` are known to differ between\nsource and the last-installed generation.\n\n## What has already been established (verify, don't assume)\n\n1. `shared/harnesses/generated/release-manifest.json` was stale. Commit\n   `3c31581` (\"fix: stop reporting and restarting healthy forge-mcp and\n   sovereign-sync\") modified `shared/scripts/detect-toolchain.sh` and\n   `shared/scripts/service-probe.sh` **without regenerating the manifest**.\n   The manifest recorded pre-fix sha256 values for both. File modes were\n   correct (`0755`); only content hashes were wrong. 2 of 61 `runtimeFiles`\n   entries affected.\n\n2. Running `node scripts/generate-harness-adapters.js` rebuilt the manifest and\n   brought it to 0/61 stale (verified by re-hashing every entry against disk).\n\n3. **The install still fails with the identical error after that fix.** This is\n   the open problem.\n\n## Root-cause hypothesis to confirm or refute\n\n`verifyReleaseManifest(payloadRoot, ...)` in `scripts/install-plugin-generation.js`\n(~line 642) reads the manifest from `payloadRoot`, **not** from the source\ncheckout:\n\n```js\nconst manifestPath = path.join(payloadRoot, 'shared/harnesses/generated/release-manifest.json');\n```\n\nSo a corrected manifest in the working tree may not be what is verified. Trace\nhow `payloadRoot` is derived and where the staged payload originates. Candidate\nexplanations, in the order worth testing:\n\n- the payload is staged from `git archive`/HEAD rather than the working tree, so\n  the regenerated (uncommitted) manifest never reaches `payloadRoot`;\n- the payload is copied to a temp/staging dir that is cached or reused between\n  runs and was not invalidated;\n- `bundleId` is recomputed over `identity` and must also match `expectedBundle`\n  threaded in from elsewhere (note `generate-harness-adapters.js` printed\n  `Generated bundle 75cdf7e0df7f31a5ef319dd5580e7c852371546b6b8f0bbcad9b8c787b9586f3`);\n- two manifests exist and a different one wins at verification time.\n\nConfirm which by instrumenting or reading the code — do not guess and patch.\n\nIf the payload is staged from HEAD, the corrected manifest **must be committed**\nbefore the install can succeed. That is likely the actual fix, and it means the\nregeneration alone is insufficient.\n\n## Constraints — read before touching anything\n\n- **Concurrent work is in progress in this repo. Do not overwrite, revert, stash,\n  reset, checkout over, or clean anyone else's changes.**\n- At the time of investigation the working tree had these **pre-existing\n  uncommitted** changes, unrelated to this fix (mtimes predate the regeneration\n  run — `kbd-init/SKILL.md` was modified 06:19 today). Treat any of these you\n  find as someone else's in-flight work:\n\n  ```\n   M hooks/codex-hooks.json\n   M hooks/hooks.json\n   M scripts/test-skills.js\n   M shared/harnesses/generated/claude-hooks.json\n   M shared/harnesses/generated/release-manifest.json\n   M skills/process/kbd-process-orchestrator/references/co\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:22:15.521460Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- AGENTS.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T11:22:20.607957Z",
-      "updated_at": "2026-08-09T11:22:20.607957Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-3383d6fb52bb5dce",
-      "title": "Karpathy session 3383d6fb52bb",
-      "content": "## Delta\n\nCompleted kbd-analyze — compass-scoping-and-bounds (step 0 of 0)\n\n## Answer: don't shard — and don't build partitioning either, because it already exists\n\nTwo findings changed the picture, both from reading the code rather than reasoning about it.\n\n**1. `PartitionedGraph` already exists.** `compass-history/src/artifacts.rs:76-84` has full record-class partitioning — nodes, edges, hyperedges, analysis, metadata, program facts/summaries — with `partition()`, `into_partition()`, and `reconstruct()`. A grep for it outside `compass-history` returns nothing. The current-graph path doesn't use it. So the real question isn't \"should we build partitioning\" but \"why does `compass init` serialize one monolithic document when the mechanism sits in the next crate over?\"\n\n**2. The 2 GiB cap protects against a problem the docs deny exists.** `compass-store/src/lib.rs:44-51` justifies the limit by saying the store serves records \"through indexed scans instead of materializing the whole document.\" But `load_active_snapshot` at lines 838-853 does this:\n\n```rust\nlet capacity = usize::try_from(manifest.payload_bytes).unwrap_or(MAX_GRAPH_BYTES);\nlet mut bytes = Vec::with_capacity(capacity);\nfor index in 0..manifest.chunk_count {\n    bytes.extend_from_slice(&chunk.value);\n```\n\nIt pre-allocates the full payload and concatenates every chunk. Chunking bounds each *stored value*, not the reconstruction. Meanwhile the **write** path genuinely streams via `DigestWriter`. The asymmetry matters: the cap isn't protecting the writer, it's protecting the reader — the opposite of what the comment claims.\n\n**This produces a hard sequencing constraint.** Honoring `COMPASS_MAX_GRAPH_BYTES` on the publication path (G1, the obvious fix) **must not land first**. Raising the cap today raises a real allocation — an override would let someone request a multi-gigabyte contiguous `Vec`, which is a worse failure than today's clean error. Stream the read path first.\n\n**Research backed the direction unanimously.** Sharding targets multi-machine scaling; Compass is local-first single-process. Citus notes graph sharding brings eventual consistency, which the determinism invariant forbids outright. Azure's criteria (data exceeds single-instance capacity, vertical scaling exhausted) don't apply. Notably, the existing `PartitionedGraph` partitions by *record class, not topology* — sidestepping the edge-cut problem the literature flags as graph partitioning's hardest part.\n\n**Recommended order:** stream `load_active_snapshot` → actionable error (G2) → pre-flight estimate (G3) → *then* the override (G1) → `vendor/` policy (G4). Items 2, 3, 5 are independent and can run in parallel.\n\n**Where I'd temper confidence:** direction is well-supported, but three of four open questions are unmeasured — no consumer audit of `load_active_snapshot`, no measurement of what dominates the 2 GiB, and my `--exclude` workaround from earlier is *still untested* and may not fit under the cap given 4,827 markdown files under `crates/`. Sizing this work would be guesswork right now.\n\n**One architecture decision blocks the partitioning route:** `PartitionedGraph` lives in `compass-history`, but AGENTS.md routes current-graph publication to `compass-graph`. Shared crate, duplicate with distinct identity semantics, or new dependency? That needs your call before anyone touches item 6.\n\nPhase is now live — `active_phase` set, waypoint at `analysis_ready`, next command `/kbd-spec`. Files written: `goals.md`, `analysis.md`, `library-candidates.json`, `decision-log.md`, `handoffs/analyze.md`.\n\nStill unpushed: the two commits on `docs/claude-md` plus all of `.kbd-orchestrator/` untracked.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T12:05:00.281326Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- AGENTS.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-15a46a623cf0e420.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-7c287ce9b2192bd7.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T12:05:01.652519Z",
-      "updated_at": "2026-08-09T12:05:01.652519Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-4301f5fbc8d2baa8",
-      "title": "Karpathy session 4301f5fbc8d2",
-      "content": "## Delta\n\nCompleted kbd-spec — compass-scoping-and-bounds (step 0 of 6)\n\n## The audit changed the shape of the main change\n\nI ran the consumer audit that analyze had flagged as blocking. `read_snapshot` (`compass-store/src/lib.rs:829`) returns `(SnapshotManifest, Vec<u8>)` — the materialized payload is right in the signature. Eight call sites:\n\n- **`validate_snapshot`** (`:935`) — discards it: `.map(|(manifest, _)| manifest)`\n- **`snapshot_reference`** (`:1184`) — discards it: `let (manifest, _)`\n- Five tests, plus `compass-query` which calls `begin_read_snapshot` and then reads through **`GraphSnapshotReader::open_selector`** — an indexed reader that never materializes anything.\n\n**No production consumer uses those bytes.** The 2 GiB contiguous allocation happens for a value everything in production throws away. So C-001 is an API split — add a manifest-only read, reimplement the two callers on it — not the streaming refactor analyze assumed.\n\n## Six changes, three hard gates\n\n| ID | Change | Owner | Depends |\n|---|---|---|---|\n| C-001 | Stop materializing payload in `read_snapshot` | `compass-store` | — |\n| C-002 | Actionable limit error | `compass-graph`/`cli` | — |\n| C-003 | Pre-flight size estimate | `compass-core` | — |\n| C-004 | Honor `COMPASS_MAX_GRAPH_BYTES` | `compass-graph`/`store` | **C-001** |\n| C-005 | Extract `compass-partition` | new crate | **C-001** |\n| C-006 | `vendor/` skip policy | `compass-files` | — |\n\nThe gates: C-004 can't precede C-001 (an override before streaming lets someone request a multi-gigabyte `Vec`); C-002 must not advertise an override that doesn't exist yet; and C-005 must not pull `prolly-map`, `prolly-store-sqlite`, `compass-ir`, or `compass-analysis` onto the current-graph path — if that can't be satisfied, stop and report, because it means the shared-crate framing doesn't hold.\n\n## On the shared crate — scope stated plainly\n\nI specced it as you directed. What moves is dependency-light: `PartitionedGraph` (9 lines of fields), `node_key`/`edge_key`/`hyperedge_key`, and `canonical_json_bytes`. What stays is `into_partition` and everything coupled to `CompletionEvidence`, sidecars, `AnalysisBundle`, `ProgramBundle`, and Prolly.\n\nSo this extracts a struct and four functions from a 2,317-line module. It **positions for** current-graph partitioned publication without delivering it — that's a further change gated on the identity question. I've written that into the spec rather than letting the delivered scope be mistaken for the larger capability.\n\n## Two things blocking execution\n\n**`/Volumes/Workspace` is not mounted.** Every compiling command needs `CARGO_TARGET_DIR` pointed there. Nothing can be verified until that volume is back.\n\n**Identity/namespacing is unresolved** — history fingerprints are meaning-affecting and realizations immutable. Before any current-graph consumer adopts the shared keys, either namespace them per path or prove non-collision with a test. This blocks C-005 *adoption*, not the extraction itself.\n\nAlso still unverified since assessment: whether `--exclude` actually gets that repo under 2 GiB. With 4,827 markdown files under `crates/`, it may not.\n\nFiles written: `spec.md`, `tasks.json`, `handoffs/spec.md`, appended `decision-log.md`. Waypoint at `spec_ready`, 6 changes registered, next `/kbd-plan`.\n\nEverything in `.kbd-orchestrator/` is still untracked, and the two commits on `docs/claude-md` are unpushed.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T12:21:54.806670Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- AGENTS.md\n- .kbd-orchestrator/\n- .prometheus/events.jsonl\n- .prometheus/knowledge/.prompt-snapshots/\n- .prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-session.md\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-15a46a623cf0e420.md\n- .prometheus/knowledge/wiki/karpathy-session-178be089fef7012d.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md\n- .prometheus/knowledge/wiki/karpathy-session-3383d6fb52bb5dce.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-7c287ce9b2192bd7.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-cd330c925600f45f.md\n- .prometheus/knowledge/wiki/karpathy-session-f8f9c99266231745.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T12:22:00.073281Z",
-      "updated_at": "2026-08-09T12:22:00.073281Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-6aacc8d765a1b28f",
-      "title": "Karpathy session 6aacc8d765a1",
-      "content": "## Delta\n\nCompleted kbd-init — Compass\n\nTwo files written to `.kbd-orchestrator/`:\n\n**`project.json`** — discovery results:\n\n| Field | Value | Source |\n|---|---|---|\n| name / description | Compass — \"Native local-first knowledge graph engine…\" | `Cargo.toml` `[workspace.package]` |\n| stack | Rust (Edition 2024, pinned 1.97.1) | `Cargo.toml` + `rust-toolchain.toml` |\n| spec_paths | `openspec/specs/*.md` | `openspec/` exists (just initialized, currently empty) |\n| openspec_available | `true` | — |\n| workspace | single-project (`workspace_file: null`) | no `.code-workspace` references compass |\n| planning / execution agents | `claude` / `claude, codex, opencode` | the tools we just configured |\n| active_phase | `null` | no phase defined yet |\n\n**`constraints.md`** — I did **not** use the template's defaults. Those are TypeScript-oriented (`no-console-log`, `no-any-type`, `grep src/`) and would be inert in a Rust workspace with no `src/` at root. Instead I derived constraints from AGENTS.md: 16 blocking (unsafe/unwrap/expect/panic lints, product boundary vs. Graphify, local-first preservation, determinism, boundedness, immutable realizations, viewer-asset generation) and 17 warning (ownership boundary, extractor/resolver separation, compatibility documentation, the CompassQL and code-graph gates).\n\n**One thing needs your attention before any KBD phase runs a command:**\n\n`/Volumes/Workspace` **is not currently mounted** — only `Macintosh HD`, `my-passport`, and `Open Design` are. Every build/test/lint command in `project.json` sets `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main`, per the AGENTS.md mandate. As written, they'll fail until that volume is attached — which is the correct behavior, since AGENTS.md says to stop and report rather than fall back to a local `target/` on the 100 GB-capped main disk. I encoded the rule faithfully rather than silently substituting a working-but-wrong path.\n\nAlso worth noting: `openspec/specs/` is empty, so `spec_paths` currently resolves to nothing. That's expected for a fresh init — specs appear once you run `/opsx:new`.\n\nThese two files are untracked and uncommitted, separate from the two commits already on `docs/claude-md`. Next step is `/kbd-status` to confirm, then `/kbd-new-phase <name>` to start the first phase.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:58:32.187142Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T11:01:48.963380Z",
-      "updated_at": "2026-08-09T11:01:48.963380Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-6ee868a466335f1d",
-      "title": "Karpathy session 6ee868a46633",
-      "content": "## Delta\n\nIt's from `AGENTS.md` lines 24–56, committed in your repo — \"Disk and external-checkout policy.\" It's not something I invented.\n\nThe rule says the main disk is capped at 100 GB, so Cargo artifacts must go on a mounted workspace volume, with the literal example path `/Volumes/Workspace/crabbuild-target/compass-main`. And explicitly: *\"If `/Volumes/Workspace` is unavailable, stop and report it rather than falling back to a local `target/` directory.\"*\n\nThat's why I kept checking it and kept flagging it as a blocker — the policy tells me to stop rather than build locally.\n\nCurrently mounted: `Macintosh HD`, `my-passport`, `Open Design`. No `Workspace`.\n\nSo one of these is true, and only you know which:\n\n- **The volume is just detached** — plug it in and the rule works as written.\n- **It got renamed** (`my-passport`? something else?) — then `AGENTS.md` has a stale path and should be corrected.\n- **The whole policy is obsolete** — maybe disk pressure was resolved and this rule outlived its purpose. Note the wiki transcripts from earlier today mention reclaiming ~10.1 GB and fixing sccache config, so something in this area did change recently.\n\nIf it's stale or obsolete, `AGENTS.md` is the fix — and I'd want that corrected before execution, because I baked those paths into `.kbd-orchestrator/project.json` and `constraints.md`, which are now committed. Every build/test/lint command there points at `/Volumes/Workspace`.\n\nWhich is it? If you tell me the volume is gone for good, I'll update `AGENTS.md`, `project.json`, and `constraints.md` together so they stop referencing a path that doesn't exist.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T12:31:22.016671Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .prometheus/knowledge/wiki/karpathy-session-badb024212b1a395.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T12:31:50.167151Z",
-      "updated_at": "2026-08-09T12:31:50.167151Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-7521e456ead1ce12",
-      "title": "Karpathy session 7521e456ead1",
-      "content": "## Delta\n\nBoth done.\n\n**Deleted the local sccache** — `~/Library/Caches/Mozilla.sccache` (10 GB) is gone and has not been recreated. Verified safe first: the live sccache server was serving `/Volumes/my-passport/sccache`, and the local dir had zero writes in the preceding 5 minutes even with an active build running.\n\n**Set `SCCACHE_DIR` in `~/.cargo/config.toml`** — added an `[env]` block pinning `SCCACHE_DIR = \"/Volumes/my-passport/sccache\"` and `SCCACHE_CACHE_SIZE = \"40G\"`, with a comment explaining the failure mode so it isn't re-litigated later. Config parses cleanly.\n\nI deliberately left off `force = true`: your `.zshrc` exports the identical value so there's no conflict, and staying unforced keeps one-off `SCCACHE_DIR=... cargo build` overrides working. Cargo's `[env]` applies to every invocation, so the non-login shells that previously bypassed the `.zshrc` guard now get the WDD path.\n\nFree space went 367 → 373 GiB. It reads lower than the raw 10 GB because an unrelated Rust build is running concurrently and consuming space as it compiles.\n\nTwo caveats worth stating plainly:\n\n- **My verification of the config was static, not functional.** I tried a real build to prove `SCCACHE_DIR` reaches a compiler process, but it hung — it inherited your `rustc-wrapper` and queued behind that concurrent surrealdb build saturating all 10 job slots. I killed and cleaned it up. So I confirmed the file parses with the right values, not that a build observes them end-to-end. Cargo `[env]` semantics are well-defined here, but if you want proof, run any build once the current one finishes and check `sccache --show-stats` still reports the WDD location.\n- **`[env]` doesn't cover non-cargo callers.** Anything invoking `sccache` directly — some CMake/C++ paths, for instance — still relies on the shell export. Your `.zshrc` handles login shells; a stray non-login shell could in principle recreate the default dir. Worth a periodic `du -sh ~/Library/Caches/Mozilla.sccache` to catch it early.\n\nThere's also a **stale comment** at line 12 of the config saying \"warm 12 GB cache on the WDD\" — the actual max is 40 GB. I left it alone since it's outside what you asked for, but I can fix it if you want.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 34d4343f-8edd-46e9-bb53-90b588e5d3ed\n- Captured: 2026-08-09T05:36:52.482414Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:34d4343f-8edd-46e9-bb53-90b588e5d3ed"
-      ],
-      "created_at": "2026-08-09T05:36:58.206699Z",
-      "updated_at": "2026-08-09T05:36:58.206699Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-762f04f1710fc991",
-      "title": "Karpathy session 762f04f1710f",
-      "content": "## Delta\n\nCompleted kbd-init — Compass\n\nTwo files written to `.kbd-orchestrator/`:\n\n**`project.json`** — discovery results:\n\n| Field | Value | Source |\n|---|---|---|\n| name / description | Compass — \"Native local-first knowledge graph engine…\" | `Cargo.toml` `[workspace.package]` |\n| stack | Rust (Edition 2024, pinned 1.97.1) | `Cargo.toml` + `rust-toolchain.toml` |\n| spec_paths | `openspec/specs/*.md` | `openspec/` exists (just initialized, currently empty) |\n| openspec_available | `true` | — |\n| workspace | single-project (`workspace_file: null`) | no `.code-workspace` references compass |\n| planning / execution agents | `claude` / `claude, codex, opencode` | the tools we just configured |\n| active_phase | `null` | no phase defined yet |\n\n**`constraints.md`** — I did **not** use the template's defaults. Those are TypeScript-oriented (`no-console-log`, `no-any-type`, `grep src/`) and would be inert in a Rust workspace with no `src/` at root. Instead I derived constraints from AGENTS.md: 16 blocking (unsafe/unwrap/expect/panic lints, product boundary vs. Graphify, local-first preservation, determinism, boundedness, immutable realizations, viewer-asset generation) and 17 warning (ownership boundary, extractor/resolver separation, compatibility documentation, the CompassQL and code-graph gates).\n\n**One thing needs your attention before any KBD phase runs a command:**\n\n`/Volumes/Workspace` **is not currently mounted** — only `Macintosh HD`, `my-passport`, and `Open Design` are. Every build/test/lint command in `project.json` sets `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main`, per the AGENTS.md mandate. As written, they'll fail until that volume is attached — which is the correct behavior, since AGENTS.md says to stop and report rather than fall back to a local `target/` on the 100 GB-capped main disk. I encoded the rule faithfully rather than silently substituting a working-but-wrong path.\n\nAlso worth noting: `openspec/specs/` is empty, so `spec_paths` currently resolves to nothing. That's expected for a fresh init — specs appear once you run `/opsx:new`.\n\nThese two files are untracked and uncommitted, separate from the two commits already on `docs/claude-md`. Next step is `/kbd-status` to confirm, then `/kbd-new-phase <name>` to start the first phase.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:01:46.520733Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T11:01:52.216303Z",
-      "updated_at": "2026-08-09T11:01:52.216303Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-7c287ce9b2192bd7",
-      "title": "Karpathy session 7c287ce9b219",
-      "content": "## Delta\n\nWritten to `/Users/gqadonis/Projects/prometheus/prometheus-skill-pack/docs/UPDATE_CONSIDERATIONS.md`.\n\nIt's structured as a handoff brief rather than the bare prompt — the same content, but organized so someone landing cold can act on it:\n\n- **Symptom + consequence** — the error, and the concrete drift it causes (`kbd-execute`, `kbd-spec`, `adversarial-review.md`), with the install-ref vs HEAD mismatch.\n- **Established by direct verification** — the three things I actually proved, with the hash evidence showing the manifest was wrong and the file was right.\n- **Open hypothesis** — `payloadRoot`, with four ranked candidates and an explicit instruction not to guess-and-patch. The likeliest answer (payload stages from HEAD → manifest must be committed) is called out as *structurally* meaning regeneration alone can't work.\n- **Constraints** — the concurrency guardrails, including that the two tree snapshots I took minutes apart already differed, so the listed file set is indicative only.\n- **Definition of done** — six checkable conditions, the last being that in-flight work survives untouched.\n- **Secondary defect** — the broken `.claude/skills` symlink, framed as arguably higher impact since it's the mechanism that let the staleness go unnoticed.\n- **Preventive follow-up** — proposal only, pointing at `check-harness-adapters.js` as the likely existing-but-unenforced check.\n\nI only created that one new file; nothing else in the repo was touched. Note the working tree there has kept growing — `kbd-init` workflow files across five harness surfaces are now modified — so that document is deliberately written to assume its own file list is stale.\n\nTwo loose ends still open here in Compass: the phase creation and `/kbd-analyze` on the partitioning question, plus the two unpushed commits on `docs/claude-md` and the untracked `.kbd-orchestrator/`. Since `kbd-analyze`'s `SKILL.md` is byte-identical between 1.6.2 and 1.7.0, running it now carries no version risk if you want to keep moving.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:24:38.852780Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- AGENTS.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-15a46a623cf0e420.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T11:24:40.732045Z",
-      "updated_at": "2026-08-09T11:24:40.732045Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-7da9adb3b7b11504",
-      "title": "Karpathy session 7da9adb3b7b1",
-      "content": "## Delta\n\nIt's from `AGENTS.md` lines 24–56, committed in your repo — \"Disk and external-checkout policy.\" It's not something I invented.\n\nThe rule says the main disk is capped at 100 GB, so Cargo artifacts must go on a mounted workspace volume, with the literal example path `/Volumes/Workspace/crabbuild-target/compass-main`. And explicitly: *\"If `/Volumes/Workspace` is unavailable, stop and report it rather than falling back to a local `target/` directory.\"*\n\nThat's why I kept checking it and kept flagging it as a blocker — the policy tells me to stop rather than build locally.\n\nCurrently mounted: `Macintosh HD`, `my-passport`, `Open Design`. No `Workspace`.\n\nSo one of these is true, and only you know which:\n\n- **The volume is just detached** — plug it in and the rule works as written.\n- **It got renamed** (`my-passport`? something else?) — then `AGENTS.md` has a stale path and should be corrected.\n- **The whole policy is obsolete** — maybe disk pressure was resolved and this rule outlived its purpose. Note the wiki transcripts from earlier today mention reclaiming ~10.1 GB and fixing sccache config, so something in this area did change recently.\n\nIf it's stale or obsolete, `AGENTS.md` is the fix — and I'd want that corrected before execution, because I baked those paths into `.kbd-orchestrator/project.json` and `constraints.md`, which are now committed. Every build/test/lint command there points at `/Volumes/Workspace`.\n\nWhich is it? If you tell me the volume is gone for good, I'll update `AGENTS.md`, `project.json`, and `constraints.md` together so they stop referencing a path that doesn't exist.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T12:31:25.361399Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .prometheus/knowledge/wiki/karpathy-session-6ee868a466335f1d.md\n- .prometheus/knowledge/wiki/karpathy-session-badb024212b1a395.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T12:31:50.620113Z",
-      "updated_at": "2026-08-09T12:31:50.620113Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-85be47bbe3d4faec",
-      "title": "Karpathy session 85be47bbe3d4",
-      "content": "## Delta\n\nFixed. The only remaining \"12 GB\" match is inside my new comment, where it's describing the past drift rather than claiming a current value.\n\nThe comment now points to `SCCACHE_CACHE_SIZE` in `[env]` instead of restating the number — a single source of truth, so it can't go stale again the way it just did. Config parses cleanly, and the declared `40G` matches what the live server actually reports (40 GiB max, on the WDD).\n\nThat closes out all three items: release build installed as `compass 0.3.6`, ~10.1 GB reclaimed locally, and the sccache config corrected so the internal disk stops accumulating cache.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 34d4343f-8edd-46e9-bb53-90b588e5d3ed\n- Captured: 2026-08-09T05:36:56.574046Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:34d4343f-8edd-46e9-bb53-90b588e5d3ed"
-      ],
-      "created_at": "2026-08-09T05:39:57.963184Z",
-      "updated_at": "2026-08-09T05:39:57.963184Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-87bd3daa965ea4d0",
-      "title": "Karpathy session 87bd3daa965e",
-      "content": "## Delta\n\nAll four steps done.\n\n## 1. Upstream remote added and fetched\n\n`upstream` → `https://github.com/crabbuild/compass.git`. Confirmed your repo is a fork of `crabbuild/compass` (`Cargo.toml` already pointed there).\n\n## 2. Not already fixed\n\n`upstream/main` still has **7 occurrences** in `AGENTS.md`. No existing issue mentioned `Volumes` or `CARGO_TARGET_DIR`.\n\n## 3. Merged\n\n`upstream/main` merged cleanly — 38 files, including the 0.3.7 release and query-recall work.\n\n## 4. Removed, and it was worse than documentation\n\nThe blast radius was ~60 occurrences across 25 tracked files, and **two were executable, not advisory**:\n\n- **`scripts/qualify_compass_store_release.sh` hard-failed with `exit 1`** unless the volume was mounted — the store qualification gate was unrunnable for anyone else.\n- **Both qualification scripts** used `${CARGO_TARGET_DIR:-/Volumes/Workspace/...}`, silently writing to an absolute path outside the checkout when the var was unset.\n- `skills/compass-release/SKILL.md` gated the release procedure on `test -d /Volumes/Workspace`.\n\nCommitted as `5bd14cd4` (41 files). Both scripts pass `bash -n`. I kept the guidance that's actually project-relevant — per-checkout target dirs, the non-persistence of `CARGO_TARGET_DIR`, read-only qualification repos — and dropped only the machine-specific mandate. Docs now use `<cargo-target-dir>` / `<qualification-corpus-root>` placeholders.\n\nI also regenerated `.kbd-orchestrator/project.json` and `constraints.md`, and cleared the \"environment blocker\" from the phase artifacts. **The plan is now executable** — that blocker was an artifact of the bad rule, not a real constraint.\n\nHistorical `.prometheus` transcripts were left untouched; they record what was true when written.\n\n## 5. Issue filed\n\n**https://github.com/crabbuild/compass/issues/211**\n\nIt leads with the agent-workflow impact (an agent following `AGENTS.md` faithfully refuses to verify anything), documents the executable failures with code, and offers a PR.\n\nYour branch is now 4 commits ahead plus the merge. Two things worth deciding: whether to push and open that upstream PR, and whether to run `/kbd-execute` on C-001 now that nothing blocks it.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T12:42:07.361443Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- No changed paths detected.\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T12:42:07.953294Z",
-      "updated_at": "2026-08-09T12:42:07.953294Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-8b2e071dd73e1374",
-      "title": "Karpathy session 8b2e071dd73e",
-      "content": "## Delta\n\nI've traced it. Here's what's actually going on — and part of it contradicts the premise.\n\n## Why 1.6.2 is resolving\n\n**1.7.0 was never installed.** The cache holds only `1.6.0`, `1.6.1`, `1.6.2`. Your source repo at `/Users/gqadonis/Projects/prometheus/prometheus-skill-pack` is tagged `v1.7.0` (12 commits past it, working tree clean), but that was never published into the plugin cache. The newest cache dir is dated Aug 3; the `.prometheus` generation is Aug 5. The tag exists locally and nowhere else.\n\nThere's also a **second, unrelated breakage**: `~/.claude/skills/kbd-init` symlinks to `~/.prometheus/plugins/prometheus-skill-pack/current/skills/process/kbd-process-orchestrator/skills/kbd-init` — a path that doesn't resolve. That's why I fell back to the cache at the start of this session. Two different install roots (`.claude/plugins/cache` and `.prometheus/plugins/generations`), and the symlink points into the one that's broken.\n\n## But the premise doesn't hold for this work\n\nI diffed the source tree against 1.6.2 directly. **The entire `kbd-process-orchestrator` differs in exactly three files:**\n\n| File | Status |\n|---|---|\n| `references/integrations/adversarial-review.md` | differs |\n| `skills/kbd-execute/SKILL.md` | differs |\n| `skills/kbd-spec/SKILL.md` | differs |\n\nEverything else is byte-identical. Specifically:\n\n- **`kbd-analyze` exists in 1.6.2 and its `SKILL.md` is identical to 1.7.0.** My earlier \"no analyze.md\" observation was about the `prompts/` directory — and `prompts/` has no `analyze.md` in **1.7.0 either**. `kbd-analyze` is driven by its `SKILL.md`, not a prompt file. That's not a version gap; I misread it.\n- `kbd-assess/SKILL.md`, `kbd-init/SKILL.md`, `kbd-new-phase/SKILL.md`, `prompts/assess.md`, `project.template.json`, and the adversarial-review preflight script are all **identical** between source and 1.6.2.\n\nSo the `/kbd-init` and `/kbd-assess` runs already completed used the same bytes 1.7.0 would have. No rework needed there.\n\nThe three drifted files matter for `/kbd-execute` and `/kbd-spec` — stages we haven't reached.\n\n## Your call\n\nI can't publish 1.7.0 into the plugin cache myself — that's your packaging pipeline, and I don't know its publish command. Options:\n\n1. **Publish 1.7.0 properly** — you run the pack's install/publish step; I re-verify and continue. Cleanest, and fixes the broken `~/.claude/skills` symlink if the installer rewrites it.\n2. **Continue on 1.6.2 for analyze** — legitimate here, since `kbd-analyze` is byte-identical. Then upgrade before `/kbd-spec` or `/kbd-execute`, where the drift is real.\n3. **Point the KBD skills at the source tree directly** for this session.\n\nI'd suggest **1**, since the symlink is broken regardless and will keep biting. But **2** is defensible if you want to keep moving on the partitioning question now — the risk is genuinely zero for the analyze stage.\n\nWhich way?\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:14:51.722543Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T11:14:53.968282Z",
-      "updated_at": "2026-08-09T11:14:53.968282Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-8cd321cc802fed9d",
-      "title": "Karpathy session 8cd321cc802f",
-      "content": "## Delta\n\n**It was in the original `AGENTS.md`.** Not the skill pack, not me.\n\n- Introduced in commit `dd14b3ce`, *\"docs: add AI contributor guidance\"*, on **2026-08-01** by **forhappy** — eight days before this session.\n- Present at `57b9fe28`, the commit this session started from, with 7 occurrences of `/Volumes/Workspace`.\n\nThe only `AGENTS.md` change during this session was the Prometheus state-ownership section — 9 lines, added by you, entirely about `.prometheus/` paths. The disk policy was untouched.\n\nSo the chain is: `AGENTS.md` mandated it → I applied it when generating `.kbd-orchestrator/project.json` and `constraints.md` during `/kbd-init` → the KBD `kbd-init` skill's own guidance reinforces it (\"Read `AGENTS.md`… for mandatory command wrappers, environment variables, toolchain selectors, and storage paths… Treat a command policy as transitive\"). But the *source* of the path is your repo's committed contributor guidance from a week ago.\n\nWhich raises the real question: **does that volume actually exist on your machine, or is `dd14b3ce` describing someone else's setup?** `forhappy` isn't the git user configured here (that's Travis James). If this guidance came from a different contributor's environment, the path may never have been valid for you — which would make it a stale rule in `AGENTS.md`, not a missing drive.\n\nIf that's the case, the fix is to correct `AGENTS.md` first, then regenerate `project.json` and `constraints.md` from it. Want me to look at what that section should say for your actual setup?\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T12:32:12.077290Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .prometheus/knowledge/wiki/karpathy-session-6ee868a466335f1d.md\n- .prometheus/knowledge/wiki/karpathy-session-7da9adb3b7b11504.md\n- .prometheus/knowledge/wiki/karpathy-session-b1a29789942105c1.md\n- .prometheus/knowledge/wiki/karpathy-session-badb024212b1a395.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T12:32:13.511112Z",
-      "updated_at": "2026-08-09T12:32:13.511112Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-8f202396ae5617a5",
-      "title": "Karpathy session 8f202396ae56",
-      "content": "## Delta\n\nThe `kbd-init` mtime is 06:19 today — well before this session's regeneration. Those were already-pending working-tree changes, not collateral from my run. Retrying the install:\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:14:56.866886Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T11:20:15.494977Z",
-      "updated_at": "2026-08-09T11:20:15.494977Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-9354b74ff25823d0",
-      "title": "Karpathy session 9354b74ff258",
-      "content": "## Delta\n\nThat's the real cause: 9,320 in-scope markdown files, with **4,827 in `crates/`** alone. This is genuine content at genuine scale, not junk. Let me write the assessment.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:05:46.513453Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T11:10:48.901378Z",
-      "updated_at": "2026-08-09T11:10:48.901378Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-95e26dce31a612a2",
-      "title": "Karpathy session 95e26dce31a6",
-      "content": "## Delta\n\nFixed. The only remaining \"12 GB\" match is inside my new comment, where it's describing the past drift rather than claiming a current value.\n\nThe comment now points to `SCCACHE_CACHE_SIZE` in `[env]` instead of restating the number — a single source of truth, so it can't go stale again the way it just did. Config parses cleanly, and the declared `40G` matches what the live server actually reports (40 GiB max, on the WDD).\n\nThat closes out all three items: release build installed as `compass 0.3.6`, ~10.1 GB reclaimed locally, and the sccache config corrected so the internal disk stops accumulating cache.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 34d4343f-8edd-46e9-bb53-90b588e5d3ed\n- Captured: 2026-08-09T05:38:38.245900Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:34d4343f-8edd-46e9-bb53-90b588e5d3ed"
-      ],
-      "created_at": "2026-08-09T05:41:46.141746Z",
-      "updated_at": "2026-08-09T05:41:46.141746Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-a0b489beb0d312d9",
-      "title": "Karpathy session a0b489beb0d3",
-      "content": "## Delta\n\nCommitted as `dd7679fb` on a new branch `docs/claude-md` (1 file, 212 insertions).\n\nTwo things worth flagging:\n\n- **I branched off `main` rather than committing directly to it**, per the repo's git conventions. Say the word if you'd rather this land on `main` directly.\n- **`.prometheus/` was left untracked** — it looked like local tooling state, not part of this change, and AGENTS.md explicitly says not to commit local state directories. Let me know if it's actually meant to be tracked.\n\nNothing is pushed yet. I can push and open a PR if you want.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:52:26.193194Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T10:52:30.420142Z",
-      "updated_at": "2026-08-09T10:52:30.420142Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-b0a4e7ceb012e58d",
-      "title": "Karpathy session b0a4e7ceb012",
-      "content": "## Delta\n\nCompleted kbd-init — Compass\n\nTwo files written to `.kbd-orchestrator/`:\n\n**`project.json`** — discovery results:\n\n| Field | Value | Source |\n|---|---|---|\n| name / description | Compass — \"Native local-first knowledge graph engine…\" | `Cargo.toml` `[workspace.package]` |\n| stack | Rust (Edition 2024, pinned 1.97.1) | `Cargo.toml` + `rust-toolchain.toml` |\n| spec_paths | `openspec/specs/*.md` | `openspec/` exists (just initialized, currently empty) |\n| openspec_available | `true` | — |\n| workspace | single-project (`workspace_file: null`) | no `.code-workspace` references compass |\n| planning / execution agents | `claude` / `claude, codex, opencode` | the tools we just configured |\n| active_phase | `null` | no phase defined yet |\n\n**`constraints.md`** — I did **not** use the template's defaults. Those are TypeScript-oriented (`no-console-log`, `no-any-type`, `grep src/`) and would be inert in a Rust workspace with no `src/` at root. Instead I derived constraints from AGENTS.md: 16 blocking (unsafe/unwrap/expect/panic lints, product boundary vs. Graphify, local-first preservation, determinism, boundedness, immutable realizations, viewer-asset generation) and 17 warning (ownership boundary, extractor/resolver separation, compatibility documentation, the CompassQL and code-graph gates).\n\n**One thing needs your attention before any KBD phase runs a command:**\n\n`/Volumes/Workspace` **is not currently mounted** — only `Macintosh HD`, `my-passport`, and `Open Design` are. Every build/test/lint command in `project.json` sets `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main`, per the AGENTS.md mandate. As written, they'll fail until that volume is attached — which is the correct behavior, since AGENTS.md says to stop and report rather than fall back to a local `target/` on the 100 GB-capped main disk. I encoded the rule faithfully rather than silently substituting a working-but-wrong path.\n\nAlso worth noting: `openspec/specs/` is empty, so `spec_paths` currently resolves to nothing. That's expected for a fresh init — specs appear once you run `/opsx:new`.\n\nThese two files are untracked and uncommitted, separate from the two commits already on `docs/claude-md`. Next step is `/kbd-status` to confirm, then `/kbd-new-phase <name>` to start the first phase.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:55:59.021325Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T10:58:30.244136Z",
-      "updated_at": "2026-08-09T10:58:30.244136Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-b1a29789942105c1",
-      "title": "Karpathy session b1a297899421",
-      "content": "## Delta\n\nIt's from `AGENTS.md` lines 24–56, committed in your repo — \"Disk and external-checkout policy.\" It's not something I invented.\n\nThe rule says the main disk is capped at 100 GB, so Cargo artifacts must go on a mounted workspace volume, with the literal example path `/Volumes/Workspace/crabbuild-target/compass-main`. And explicitly: *\"If `/Volumes/Workspace` is unavailable, stop and report it rather than falling back to a local `target/` directory.\"*\n\nThat's why I kept checking it and kept flagging it as a blocker — the policy tells me to stop rather than build locally.\n\nCurrently mounted: `Macintosh HD`, `my-passport`, `Open Design`. No `Workspace`.\n\nSo one of these is true, and only you know which:\n\n- **The volume is just detached** — plug it in and the rule works as written.\n- **It got renamed** (`my-passport`? something else?) — then `AGENTS.md` has a stale path and should be corrected.\n- **The whole policy is obsolete** — maybe disk pressure was resolved and this rule outlived its purpose. Note the wiki transcripts from earlier today mention reclaiming ~10.1 GB and fixing sccache config, so something in this area did change recently.\n\nIf it's stale or obsolete, `AGENTS.md` is the fix — and I'd want that corrected before execution, because I baked those paths into `.kbd-orchestrator/project.json` and `constraints.md`, which are now committed. Every build/test/lint command there points at `/Volumes/Workspace`.\n\nWhich is it? If you tell me the volume is gone for good, I'll update `AGENTS.md`, `project.json`, and `constraints.md` together so they stop referencing a path that doesn't exist.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T12:30:02.796796Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .prometheus/knowledge/wiki/karpathy-session-6ee868a466335f1d.md\n- .prometheus/knowledge/wiki/karpathy-session-7da9adb3b7b11504.md\n- .prometheus/knowledge/wiki/karpathy-session-badb024212b1a395.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T12:31:51.013497Z",
-      "updated_at": "2026-08-09T12:31:51.013497Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-b5d49ca1d46e60a2",
-      "title": "Karpathy session b5d49ca1d46e",
-      "content": "## Delta\n\nBoth commits are on `docs/claude-md`:\n\n| Commit | Contents |\n|---|---|\n| `dd7679fb` | `docs: add CLAUDE.md agent guide` — 1 file |\n| `c349fdf6` | `chore: track Prometheus wiki and initialize OpenSpec` — 73 files, 12,227 insertions |\n\n**What landed:**\n- **`.prometheus/knowledge/wiki/`** — all 12 files tracked as-is, per your call.\n- **OpenSpec** initialized with `schema: spec-driven`, generating `.claude/`, `.codex/`, `.kimi/`, `.opencode/` plus `openspec/config.yaml`.\n\n**Three things to know:**\n\n1. **Zed got nothing.** It isn't a supported `openspec init` target, so there's no generated config for it. If you use Zed here, that gap is still open — I can hand-write a rules file, but it'd be unofficial and liable to drift from openspec's format.\n\n2. **Kimi has skills but no commands.** OpenSpec reported \"Commands skipped for: kimi (no adapter)\" — it got 10 skill files, no `/opsx:*` slash commands. Claude, Codex, and OpenCode got both.\n\n3. **`.claude/settings.local.json` stayed untracked.** It's your personal permission allowlist with machine-specific paths, and your global gitignore already excludes it — so it was never at risk of being committed.\n\n`openspec/config.yaml` is currently all commented-out scaffolding. Its `context:` field feeds project background to AI tools when creating artifacts, and this repo has strong conventions worth putting there (local-first Rust, no-unwrap/expect/panic lints, determinism requirements, the `CARGO_TARGET_DIR` rule). Want me to fill it in?\n\nNothing is pushed yet. Say the word and I'll push and open a PR.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:52:28.835309Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- No changed paths detected.\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T10:56:00.254334Z",
-      "updated_at": "2026-08-09T10:56:00.254334Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-b6f086fb31ed31c5",
-      "title": "Karpathy session b6f086fb31ed",
-      "content": "## Delta\n\nBoth commits are on `docs/claude-md`:\n\n| Commit | Contents |\n|---|---|\n| `dd7679fb` | `docs: add CLAUDE.md agent guide` — 1 file |\n| `c349fdf6` | `chore: track Prometheus wiki and initialize OpenSpec` — 73 files, 12,227 insertions |\n\n**What landed:**\n- **`.prometheus/knowledge/wiki/`** — all 12 files tracked as-is, per your call.\n- **OpenSpec** initialized with `schema: spec-driven`, generating `.claude/`, `.codex/`, `.kimi/`, `.opencode/` plus `openspec/config.yaml`.\n\n**Three things to know:**\n\n1. **Zed got nothing.** It isn't a supported `openspec init` target, so there's no generated config for it. If you use Zed here, that gap is still open — I can hand-write a rules file, but it'd be unofficial and liable to drift from openspec's format.\n\n2. **Kimi has skills but no commands.** OpenSpec reported \"Commands skipped for: kimi (no adapter)\" — it got 10 skill files, no `/opsx:*` slash commands. Claude, Codex, and OpenCode got both.\n\n3. **`.claude/settings.local.json` stayed untracked.** It's your personal permission allowlist with machine-specific paths, and your global gitignore already excludes it — so it was never at risk of being committed.\n\n`openspec/config.yaml` is currently all commented-out scaffolding. Its `context:` field feeds project background to AI tools when creating artifacts, and this repo has strong conventions worth putting there (local-first Rust, no-unwrap/expect/panic lints, determinism requirements, the `CARGO_TARGET_DIR` rule). Want me to fill it in?\n\nNothing is pushed yet. Say the word and I'll push and open a PR.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:55:56.151200Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T10:56:01.152228Z",
-      "updated_at": "2026-08-09T10:56:01.152228Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-badb024212b1a395",
-      "title": "Karpathy session badb024212b1",
-      "content": "## Delta\n\nCommitted as `eced6dec` — 48 files, 4,679 insertions. Working tree is clean.\n\nThree commits now on `docs/claude-md`:\n\n| Commit | Contents |\n|---|---|\n| `dd7679fb` | `docs: add CLAUDE.md agent guide` — 1 file |\n| `c349fdf6` | `chore: track Prometheus wiki and initialize OpenSpec` — 73 files |\n| `eced6dec` | `chore(kbd): track orchestrator state and Prometheus knowledge` — 48 files |\n\n**What landed in this one:**\n- **`.kbd-orchestrator/`** — all 17 files: `project.json`, `constraints.md`, the six phase artifacts for `compass-scoping-and-bounds`, three stage handoffs, both machine contracts, and the waypoint at `plan_ready`.\n- **`.prometheus/`** — 24 new wiki transcripts (grown from 10 during this session), `events.jsonl`, and the prompt snapshots.\n- **`AGENTS.md`** — the Prometheus state ownership rule.\n\nTwo things worth noting:\n\n**Your `AGENTS.md` edit settled the question I raised earlier.** It now explicitly classifies `.prometheus/knowledge/wiki/**` as repository-owned tracked content \"including generated session transcripts and their embedded machine-specific project paths.\" That's a repository rule authorizing exactly what I'd flagged as a concern, so the earlier objection is resolved on the record rather than just overridden.\n\n**I scanned before staging** — ran a pattern check for API keys, tokens, and private key headers across both new directories. Nothing matched. `.claude/settings.local.json` stayed untracked, protected by your global gitignore.\n\nNothing is pushed. The branch is three commits ahead of `main`, and `/Volumes/Workspace` is still unmounted, so C-001 can't be verified yet. Say the word and I'll push and open a PR.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T12:29:59.534218Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- No changed paths detected.\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T12:30:00.586013Z",
-      "updated_at": "2026-08-09T12:30:00.586013Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-bb64c62e88af6029",
-      "title": "Karpathy session bb64c62e88af",
-      "content": "## Delta\n\nCreated `CLAUDE.md` at the repo root.\n\nSince `AGENTS.md` is already a thorough agent guide, I wrote CLAUDE.md to defer to it rather than duplicate it, and concentrated on what it leaves implicit:\n\n**What's in it:**\n- **`CARGO_TARGET_DIR` requirement** — surfaced up top, since it must be set on every compiling invocation and is the easiest thing to get wrong. I also flagged the conflict where some Makefile targets (`install`, `dist`, `release-check`) resolve binaries through a literal `target/` path, which AGENTS.md mentions but doesn't tie to specific targets.\n- **Commands** — narrow-loop test/clippy per crate and per integration file, the workspace baseline, the surface-specific gates (product boundary, CompassQL TCK, code-graph qualification), and the npm workspace commands. Noted that `make test` is `--lib --bins` only while `make test-all` needs Python oracle setup.\n- **Architecture** — the piece that genuinely requires reading multiple files: the one-directional flow `compass-files → compass-languages → compass-resolve → compass-graph → compass-model`, orchestrated by `compass-core`. I emphasized the boundary that's easiest to violate — per-file extractors emit evidence and never resolve targets needing project-wide facts. Also the `compass-cypher` (syntax) vs `compass-query` (execution) split, immutable history realizations, and the generated viewer assets round-trip.\n- **Enforced constraints** — the lint set, determinism as correctness, boundedness (limit error ≠ empty result), and reuse of existing safe primitives.\n\nTwo notes on judgment calls: I skipped enumerating individual crates beyond the pipeline ones, since `docs/implementation/workspace-tour.md` already does that well and I pointed at it instead. I also didn't import anything from a Codex or Gemini config — I didn't check for those, as the instruction is to offer rather than read them. If you have an OpenAI Codex or Gemini CLI config you'd like folded in, reply `/import` and it'll scan and list what's importable.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:37:15.181272Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n- CLAUDE.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T10:37:28.812655Z",
-      "updated_at": "2026-08-09T10:37:28.812655Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-c13ff840014cf2b3",
-      "title": "Karpathy session c13ff840014c",
-      "content": "## Delta\n\n`cargo config` needs nightly. Let me verify with a functional test instead — the stronger check anyway, since it proves the var reaches a real build process.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 34d4343f-8edd-46e9-bb53-90b588e5d3ed\n- Captured: 2026-08-09T05:20:58.608418Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- No changed paths detected.\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:34d4343f-8edd-46e9-bb53-90b588e5d3ed"
-      ],
-      "created_at": "2026-08-09T05:26:55.781482Z",
-      "updated_at": "2026-08-09T05:26:55.781482Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-ca329344b0f175d8",
-      "title": "Karpathy session ca329344b0f1",
-      "content": "## Delta\n\nCompleted kbd-plan — compass-scoping-and-bounds (step 0 of 6)\n\n## Plan written — 6 changes, 2 waves\n\n```\nWave 1 (parallel)          Wave 2 (after C-001)\n├── C-001  read_snapshot   ├── C-004  env override   [HARD GATE]\n├── C-002  error message   └── C-005  compass-partition\n├── C-003  size estimate\n└── C-006  vendor/ policy\n```\n\nBackend is **OpenSpec** (`openspec/` present, `openspec_available: true`). No evolver cycle.\n\n**Apply C-001 first** — it's the only Wave 1 item that unblocks others, and the spec-stage audit shrank it from a streaming refactor to an API split.\n\nThe adversarial pass found no surviving CRITICAL: the ordering error this stage exists to catch (C-004 before C-001) was already caught at spec, and is now enforced twice — by wave structure and by an inline gate on the change itself.\n\n**Two coupling risks worth watching:**\n\n- **C-002 ↔ C-004 share the error text.** C-002 must *omit* the `COMPASS_MAX_GRAPH_BYTES` mention (advertising a nonexistent override is the exact defect being fixed), then C-004 adds it. If C-004 slips, C-002's message stays permanently incomplete. Tracked rather than assumed.\n- **C-003 has testable criteria but no calibration data.** Measuring what actually dominates the 2 GiB is its *first task*, not an afterthought — otherwise it ships an invented heuristic.\n\n## One blocker stops execution outright\n\n**`/Volumes/Workspace` is still not mounted** — I re-checked at plan time. Every compiling command needs `CARGO_TARGET_DIR` beneath it, and AGENTS.md explicitly forbids falling back to a local `target/`. **Every acceptance checkbox in this plan is unverifiable until that volume is back.** The plan is complete and correct; it just isn't runnable yet.\n\n## I stopped short of one step\n\nStep 10 of the skill emits OpenSpec change structures — six `/opsx:new` invocations creating `openspec/changes/<id>/` directories with proposals. I've written the exact commands into `plan.md` but haven't run them, for two reasons: it's six new tracked directories in your repo, and creating scaffolding for changes that can't be verified yet may be premature. Say the word and I'll emit all six, or just C-001.\n\nFiles written: `plan.md`, `current-waypoint.md`, `handoffs/plan.md`; waypoint at `plan_ready`, `progress.json` marked `plan_complete`.\n\nStill outstanding from earlier: two unpushed commits on `docs/claude-md`, and all of `.kbd-orchestrator/` untracked.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T12:27:40.809364Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- AGENTS.md\n- .kbd-orchestrator/\n- .prometheus/events.jsonl\n- .prometheus/knowledge/.prompt-snapshots/\n- .prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-session.md\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-1371f12708207b52.md\n- .prometheus/knowledge/wiki/karpathy-session-15a46a623cf0e420.md\n- .prometheus/knowledge/wiki/karpathy-session-178be089fef7012d.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md\n- .prometheus/knowledge/wiki/karpathy-session-3383d6fb52bb5dce.md\n- .prometheus/knowledge/wiki/karpathy-session-4301f5fbc8d2baa8.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-7c287ce9b2192bd7.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-cd330c925600f45f.md\n- .prometheus/knowledge/wiki/karpathy-session-e2c00470b2ce9770.md\n- .prometheus/knowledge/wiki/karpathy-session-f8f9c99266231745.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T12:28:29.645888Z",
-      "updated_at": "2026-08-09T12:28:29.645888Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-cd330c925600f45f",
-      "title": "Karpathy session cd330c925600",
-      "content": "## Delta\n\nI have what I need to give you a straight answer — and it includes a correction to my own recommendation.\n\n## The doc comment tells you what this type is for\n\n```rust\n/// Deterministic typed records used to construct the five Prolly trees.\npub struct PartitionedGraph { ... }\n```\n\n`PartitionedGraph` isn't a general-purpose partitioning abstraction. It's **the input format for Prolly tree construction** — history's immutable-storage engine. The struct body is plain `Vec<(Vec<u8>, Vec<u8>)>` and looks portable, but the meaning is history-specific.\n\nThe producing logic confirms it. `into_partition` (`artifacts.rs:349-400+`) is entangled with concerns that don't exist on the current-graph path:\n\n| Dependency | Belongs to |\n|---|---|\n| `CompletionEvidence` | history realization completion |\n| `authoritative_sidecars` / `TRUSTED_GRAPH_CONTENT` | history provenance |\n| `AnalysisBundle`, `compass_ir::ProgramBundle` | `compass-analysis` / `compass-ir` |\n| `HistoryError` | history error taxonomy |\n| `prolly::{KeyBuilder, VersionedValue}` | Prolly storage |\n\nAnd the crate dependency sets diverge sharply. `compass-history` pulls `prolly-map`, `prolly-store-sqlite`, `compass-ir`, `compass-analysis`. `compass-graph` pulls none of those. A shared crate has to either carry that weight — forcing Prolly and IR onto the current-graph path, which contradicts the local-first minimal-dependency posture — or be gutted down to the struct alone.\n\n**If it's gutted to the struct alone, you've shared 9 lines of field declarations and left all 2,300 lines of actual logic behind.** That's not reuse.\n\n## What I'd do instead\n\nI over-indexed on \"the mechanism exists\" in the analysis. On closer reading, what exists is *history's* mechanism, and the shared-crate framing inherits a coupling that doesn't serve the current-graph path.\n\nThe sequencing finding still stands and is the load-bearing one: **stream `load_active_snapshot` first**. That removes the actual constraint. Whether current-graph publication later adopts a record-partitioned format is a separate question that gets much easier to answer *after* the read path stops materializing 2 GiB — and it may not need `PartitionedGraph`'s shape at all, since it has no Prolly trees to feed.\n\nSo I'd put the shared crate behind the streaming fix rather than in front of it.\n\nThat said — you've made a call, and you may be seeing a longer arc than I am (a future where current-graph and history publication genuinely converge, which would justify the shared crate now). If that's the intent, say so and I'll spec it properly. Three questions I'd need answered either way:\n\n1. **Crate name and scope** — `compass-partition`? Does it carry just the type, or the record-encoding helpers (`node_key`, `edge_key`, `hyperedge_key`, `canonical_json_bytes`) too?\n2. **Does it take the Prolly dependency?** If yes, `compass-graph` inherits it. If no, the encoding logic stays in history and the shared crate is nearly empty.\n3. **Identity semantics** — history fingerprints are meaning-affecting and realizations are immutable. If current-graph reuses the same record keys, do the two paths risk producing colliding or conflatable identities? AGENTS.md is strict here.\n\nWant me to spec the shared crate as you've directed, or run `/kbd-spec` on the streaming fix first and revisit this once the read path is honest?\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T12:06:25.091241Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- AGENTS.md\n- .kbd-orchestrator/\n- .prometheus/events.jsonl\n- .prometheus/knowledge/.prompt-snapshots/\n- .prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-session.md\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-15a46a623cf0e420.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md\n- .prometheus/knowledge/wiki/karpathy-session-3383d6fb52bb5dce.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-7c287ce9b2192bd7.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T12:06:26.089450Z",
-      "updated_at": "2026-08-09T12:06:26.089450Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-e2c00470b2ce9770",
-      "title": "Karpathy session e2c00470b2ce",
-      "content": "## Delta\n\nCompleted kbd-plan — compass-scoping-and-bounds (step 0 of 6)\n\n## Plan written — 6 changes, 2 waves\n\n```\nWave 1 (parallel)          Wave 2 (after C-001)\n├── C-001  read_snapshot   ├── C-004  env override   [HARD GATE]\n├── C-002  error message   └── C-005  compass-partition\n├── C-003  size estimate\n└── C-006  vendor/ policy\n```\n\nBackend is **OpenSpec** (`openspec/` present, `openspec_available: true`). No evolver cycle.\n\n**Apply C-001 first** — it's the only Wave 1 item that unblocks others, and the spec-stage audit shrank it from a streaming refactor to an API split.\n\nThe adversarial pass found no surviving CRITICAL: the ordering error this stage exists to catch (C-004 before C-001) was already caught at spec, and is now enforced twice — by wave structure and by an inline gate on the change itself.\n\n**Two coupling risks worth watching:**\n\n- **C-002 ↔ C-004 share the error text.** C-002 must *omit* the `COMPASS_MAX_GRAPH_BYTES` mention (advertising a nonexistent override is the exact defect being fixed), then C-004 adds it. If C-004 slips, C-002's message stays permanently incomplete. Tracked rather than assumed.\n- **C-003 has testable criteria but no calibration data.** Measuring what actually dominates the 2 GiB is its *first task*, not an afterthought — otherwise it ships an invented heuristic.\n\n## One blocker stops execution outright\n\n**`/Volumes/Workspace` is still not mounted** — I re-checked at plan time. Every compiling command needs `CARGO_TARGET_DIR` beneath it, and AGENTS.md explicitly forbids falling back to a local `target/`. **Every acceptance checkbox in this plan is unverifiable until that volume is back.** The plan is complete and correct; it just isn't runnable yet.\n\n## I stopped short of one step\n\nStep 10 of the skill emits OpenSpec change structures — six `/opsx:new` invocations creating `openspec/changes/<id>/` directories with proposals. I've written the exact commands into `plan.md` but haven't run them, for two reasons: it's six new tracked directories in your repo, and creating scaffolding for changes that can't be verified yet may be premature. Say the word and I'll emit all six, or just C-001.\n\nFiles written: `plan.md`, `current-waypoint.md`, `handoffs/plan.md`; waypoint at `plan_ready`, `progress.json` marked `plan_complete`.\n\nStill outstanding from earlier: two unpushed commits on `docs/claude-md`, and all of `.kbd-orchestrator/` untracked.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T12:27:37.267036Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- AGENTS.md\n- .kbd-orchestrator/\n- .prometheus/events.jsonl\n- .prometheus/knowledge/.prompt-snapshots/\n- .prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-session.md\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-1371f12708207b52.md\n- .prometheus/knowledge/wiki/karpathy-session-15a46a623cf0e420.md\n- .prometheus/knowledge/wiki/karpathy-session-178be089fef7012d.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md\n- .prometheus/knowledge/wiki/karpathy-session-3383d6fb52bb5dce.md\n- .prometheus/knowledge/wiki/karpathy-session-4301f5fbc8d2baa8.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-7c287ce9b2192bd7.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-cd330c925600f45f.md\n- .prometheus/knowledge/wiki/karpathy-session-f8f9c99266231745.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T12:27:38.259256Z",
-      "updated_at": "2026-08-09T12:27:38.259256Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-f8eff00b52d5f657",
-      "title": "Karpathy session f8eff00b52d5",
-      "content": "## Delta\n\nCreated `CLAUDE.md` at the repo root.\n\nSince `AGENTS.md` is already a thorough agent guide, I wrote CLAUDE.md to defer to it rather than duplicate it, and concentrated on what it leaves implicit:\n\n**What's in it:**\n- **`CARGO_TARGET_DIR` requirement** — surfaced up top, since it must be set on every compiling invocation and is the easiest thing to get wrong. I also flagged the conflict where some Makefile targets (`install`, `dist`, `release-check`) resolve binaries through a literal `target/` path, which AGENTS.md mentions but doesn't tie to specific targets.\n- **Commands** — narrow-loop test/clippy per crate and per integration file, the workspace baseline, the surface-specific gates (product boundary, CompassQL TCK, code-graph qualification), and the npm workspace commands. Noted that `make test` is `--lib --bins` only while `make test-all` needs Python oracle setup.\n- **Architecture** — the piece that genuinely requires reading multiple files: the one-directional flow `compass-files → compass-languages → compass-resolve → compass-graph → compass-model`, orchestrated by `compass-core`. I emphasized the boundary that's easiest to violate — per-file extractors emit evidence and never resolve targets needing project-wide facts. Also the `compass-cypher` (syntax) vs `compass-query` (execution) split, immutable history realizations, and the generated viewer assets round-trip.\n- **Enforced constraints** — the lint set, determinism as correctness, boundedness (limit error ≠ empty result), and reuse of existing safe primitives.\n\nTwo notes on judgment calls: I skipped enumerating individual crates beyond the pipeline ones, since `docs/implementation/workspace-tour.md` already does that well and I pointed at it instead. I also didn't import anything from a Codex or Gemini config — I didn't check for those, as the instruction is to offer rather than read them. If you have an OpenAI Codex or Gemini CLI config you'd like folded in, reply `/import` and it'll scan and list what's importable.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:34:10.259136Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n- CLAUDE.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T10:34:18.362064Z",
-      "updated_at": "2026-08-09T10:34:18.362064Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-f8f9c99266231745",
-      "title": "Karpathy session f8f9c9926623",
-      "content": "## Delta\n\nI have what I need to give you a straight answer — and it includes a correction to my own recommendation.\n\n## The doc comment tells you what this type is for\n\n```rust\n/// Deterministic typed records used to construct the five Prolly trees.\npub struct PartitionedGraph { ... }\n```\n\n`PartitionedGraph` isn't a general-purpose partitioning abstraction. It's **the input format for Prolly tree construction** — history's immutable-storage engine. The struct body is plain `Vec<(Vec<u8>, Vec<u8>)>` and looks portable, but the meaning is history-specific.\n\nThe producing logic confirms it. `into_partition` (`artifacts.rs:349-400+`) is entangled with concerns that don't exist on the current-graph path:\n\n| Dependency | Belongs to |\n|---|---|\n| `CompletionEvidence` | history realization completion |\n| `authoritative_sidecars` / `TRUSTED_GRAPH_CONTENT` | history provenance |\n| `AnalysisBundle`, `compass_ir::ProgramBundle` | `compass-analysis` / `compass-ir` |\n| `HistoryError` | history error taxonomy |\n| `prolly::{KeyBuilder, VersionedValue}` | Prolly storage |\n\nAnd the crate dependency sets diverge sharply. `compass-history` pulls `prolly-map`, `prolly-store-sqlite`, `compass-ir`, `compass-analysis`. `compass-graph` pulls none of those. A shared crate has to either carry that weight — forcing Prolly and IR onto the current-graph path, which contradicts the local-first minimal-dependency posture — or be gutted down to the struct alone.\n\n**If it's gutted to the struct alone, you've shared 9 lines of field declarations and left all 2,300 lines of actual logic behind.** That's not reuse.\n\n## What I'd do instead\n\nI over-indexed on \"the mechanism exists\" in the analysis. On closer reading, what exists is *history's* mechanism, and the shared-crate framing inherits a coupling that doesn't serve the current-graph path.\n\nThe sequencing finding still stands and is the load-bearing one: **stream `load_active_snapshot` first**. That removes the actual constraint. Whether current-graph publication later adopts a record-partitioned format is a separate question that gets much easier to answer *after* the read path stops materializing 2 GiB — and it may not need `PartitionedGraph`'s shape at all, since it has no Prolly trees to feed.\n\nSo I'd put the shared crate behind the streaming fix rather than in front of it.\n\nThat said — you've made a call, and you may be seeing a longer arc than I am (a future where current-graph and history publication genuinely converge, which would justify the shared crate now). If that's the intent, say so and I'll spec it properly. Three questions I'd need answered either way:\n\n1. **Crate name and scope** — `compass-partition`? Does it carry just the type, or the record-encoding helpers (`node_key`, `edge_key`, `hyperedge_key`, `canonical_json_bytes`) too?\n2. **Does it take the Prolly dependency?** If yes, `compass-graph` inherits it. If no, the encoding logic stays in history and the shared crate is nearly empty.\n3. **Identity semantics** — history fingerprints are meaning-affecting and realizations are immutable. If current-graph reuses the same record keys, do the two paths risk producing colliding or conflatable identities? AGENTS.md is strict here.\n\nWant me to spec the shared crate as you've directed, or run `/kbd-spec` on the streaming fix first and revisit this once the read path is honest?\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T12:05:04.010581Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- AGENTS.md\n- .kbd-orchestrator/\n- .prometheus/events.jsonl\n- .prometheus/knowledge/.prompt-snapshots/\n- .prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-session.md\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-15a46a623cf0e420.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md\n- .prometheus/knowledge/wiki/karpathy-session-3383d6fb52bb5dce.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-7c287ce9b2192bd7.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-cd330c925600f45f.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T12:06:26.689357Z",
-      "updated_at": "2026-08-09T12:06:26.689357Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-f90cdbd5fafd1d1d",
-      "title": "Karpathy session f90cdbd5fafd",
-      "content": "## Delta\n\nCompleted kbd-init — Compass\n\nTwo files written to `.kbd-orchestrator/`:\n\n**`project.json`** — discovery results:\n\n| Field | Value | Source |\n|---|---|---|\n| name / description | Compass — \"Native local-first knowledge graph engine…\" | `Cargo.toml` `[workspace.package]` |\n| stack | Rust (Edition 2024, pinned 1.97.1) | `Cargo.toml` + `rust-toolchain.toml` |\n| spec_paths | `openspec/specs/*.md` | `openspec/` exists (just initialized, currently empty) |\n| openspec_available | `true` | — |\n| workspace | single-project (`workspace_file: null`) | no `.code-workspace` references compass |\n| planning / execution agents | `claude` / `claude, codex, opencode` | the tools we just configured |\n| active_phase | `null` | no phase defined yet |\n\n**`constraints.md`** — I did **not** use the template's defaults. Those are TypeScript-oriented (`no-console-log`, `no-any-type`, `grep src/`) and would be inert in a Rust workspace with no `src/` at root. Instead I derived constraints from AGENTS.md: 16 blocking (unsafe/unwrap/expect/panic lints, product boundary vs. Graphify, local-first preservation, determinism, boundedness, immutable realizations, viewer-asset generation) and 17 warning (ownership boundary, extractor/resolver separation, compatibility documentation, the CompassQL and code-graph gates).\n\n**One thing needs your attention before any KBD phase runs a command:**\n\n`/Volumes/Workspace` **is not currently mounted** — only `Macintosh HD`, `my-passport`, and `Open Design` are. Every build/test/lint command in `project.json` sets `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main`, per the AGENTS.md mandate. As written, they'll fail until that volume is attached — which is the correct behavior, since AGENTS.md says to stop and report rather than fall back to a local `target/` on the 100 GB-capped main disk. I encoded the rule faithfully rather than silently substituting a working-but-wrong path.\n\nAlso worth noting: `openspec/specs/` is empty, so `spec_paths` currently resolves to nothing. That's expected for a fresh init — specs appear once you run `/opsx:new`.\n\nThese two files are untracked and uncommitted, separate from the two commits already on `docs/claude-md`. Next step is `/kbd-status` to confirm, then `/kbd-new-phase <name>` to start the first phase.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:58:29.463044Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T10:58:32.854406Z",
-      "updated_at": "2026-08-09T10:58:32.854406Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    }
-  ]
-}
diff --git a/.prometheus/knowledge/.prompt-snapshots/project/generations/d8234ef2341584c455b4c9ce94b3c57e74845d1f48f3ff5a37b929885585f87e.json b/.prometheus/knowledge/.prompt-snapshots/project/generations/d8234ef2341584c455b4c9ce94b3c57e74845d1f48f3ff5a37b929885585f87e.json
deleted file mode 100644
index 000a156af..000000000
--- a/.prometheus/knowledge/.prompt-snapshots/project/generations/d8234ef2341584c455b4c9ce94b3c57e74845d1f48f3ff5a37b929885585f87e.json
+++ /dev/null
@@ -1,524 +0,0 @@
-{
-  "schemaVersion": 1,
-  "scope": "project",
-  "generation": "d8234ef2341584c455b4c9ce94b3c57e74845d1f48f3ff5a37b929885585f87e",
-  "candidateCount": 27,
-  "byteCount": 81879,
-  "entries": [
-    {
-      "id": "compass-scoping-and-bounds-executor-session",
-      "title": "Compass scoping and bounds executor session",
-      "content": "## Summary\n\n- Executor session completed for phase `compass-scoping-and-bounds`.\n- Reported change status: `unknown`.\n- No delta, root cause, changed paths, or corrective actions were captured in the raw record.\n\n## Session Record\n\n| Field | Value |\n|---|---|\n| Phase | `compass-scoping-and-bounds` |\n| Change | `unknown` |\n| Status | complete |\n\n## Handling Notes\n\n- Preserve as a minimal execution record.\n- Do not infer implementation changes or root cause from this capture alone.\n- Promote reusable findings only if a fuller session artifact becomes available.\n\n# Citations\n\n1. stdin",
-      "tags": [
-        "compass",
-        "executor-session",
-        "scoping",
-        "session-record"
-      ],
-      "links": [],
-      "sources": [
-        "stdin"
-      ],
-      "created_at": "2026-08-09T12:05:10.450410Z",
-      "updated_at": "2026-08-09T12:05:10.450410Z",
-      "revision": 0,
-      "entry_type": "Reference",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-04f1f5622348cff2",
-      "title": "Karpathy session 04f1f5622348",
-      "content": "## Delta\n\nDone — built, installed, and the target directory cleaned.\n\n**Results:**\n- `make install` → release build succeeded in **24m 13s**\n- Installed `compass 0.3.6` → `~/.cargo/bin/compass` (146 MB), verified working after cleanup, resolving on PATH\n- Local `./target` reclaimed: **139 MB → 4 KB**\n\n**One thing worth knowing:** cleaning `target/` reclaimed far less than you'd expect, because your global `~/.cargo/config.toml` offloads Rust builds to the external drive. Intermediates go to `/Volumes/my-passport/cargo-build/...` (3.3 GB for this workspace) and sccache to `/Volumes/my-passport/sccache` (29 of 40 GiB). Only the final binary lands locally — so `target/` was never the disk hog here.\n\nI deliberately did **not** run `cargo clean`. It would have deleted the 3.3 GB external build cache too, costing you another 24-minute cold rebuild while reclaiming nothing extra from your internal disk. I removed `target/release` instead.\n\n**The actual local space, if you want it — needs your call:**\n\n`~/Library/Caches/Mozilla.sccache` holds **10 GB on your internal disk**. This is sccache's *default* path, not your configured WDD one. It gets written whenever sccache starts in a shell that didn't export `SCCACHE_DIR` — your `.zshrc` only sets it behind a `[[ -d \"$WDD/cargo\" ]]` guard, so non-login shells and any unmounted-drive moment bypass it. Newest entries are from Aug 8 20:14, so it's recent, not ancient.\n\nDeleting it is safe — sccache is purely a cache, worst case is slower recompiles — and nothing currently holds it open. I'd also suggest setting `SCCACHE_DIR` in `~/.cargo/config.toml`'s `[env]` rather than `.zshrc`, so it applies to every shell and stops re-accumulating. Say the word and I'll do either or both.\n\nI should flag one correction: mid-investigation I said the build had \"stopped\" and separately called this cache \"orphaned.\" Both were wrong — the first was a bad read of a momentary process gap, the second I revised once I checked the timestamps.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 34d4343f-8edd-46e9-bb53-90b588e5d3ed\n- Captured: 2026-08-09T05:20:55.484287Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- No changed paths detected.\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:34d4343f-8edd-46e9-bb53-90b588e5d3ed"
-      ],
-      "created_at": "2026-08-09T05:21:00.817633Z",
-      "updated_at": "2026-08-09T05:21:00.817633Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-06cdf26d86b0c087",
-      "title": "Karpathy session 06cdf26d86b0",
-      "content": "## Delta\n\nI've traced it. Here's what's actually going on — and part of it contradicts the premise.\n\n## Why 1.6.2 is resolving\n\n**1.7.0 was never installed.** The cache holds only `1.6.0`, `1.6.1`, `1.6.2`. Your source repo at `/Users/gqadonis/Projects/prometheus/prometheus-skill-pack` is tagged `v1.7.0` (12 commits past it, working tree clean), but that was never published into the plugin cache. The newest cache dir is dated Aug 3; the `.prometheus` generation is Aug 5. The tag exists locally and nowhere else.\n\nThere's also a **second, unrelated breakage**: `~/.claude/skills/kbd-init` symlinks to `~/.prometheus/plugins/prometheus-skill-pack/current/skills/process/kbd-process-orchestrator/skills/kbd-init` — a path that doesn't resolve. That's why I fell back to the cache at the start of this session. Two different install roots (`.claude/plugins/cache` and `.prometheus/plugins/generations`), and the symlink points into the one that's broken.\n\n## But the premise doesn't hold for this work\n\nI diffed the source tree against 1.6.2 directly. **The entire `kbd-process-orchestrator` differs in exactly three files:**\n\n| File | Status |\n|---|---|\n| `references/integrations/adversarial-review.md` | differs |\n| `skills/kbd-execute/SKILL.md` | differs |\n| `skills/kbd-spec/SKILL.md` | differs |\n\nEverything else is byte-identical. Specifically:\n\n- **`kbd-analyze` exists in 1.6.2 and its `SKILL.md` is identical to 1.7.0.** My earlier \"no analyze.md\" observation was about the `prompts/` directory — and `prompts/` has no `analyze.md` in **1.7.0 either**. `kbd-analyze` is driven by its `SKILL.md`, not a prompt file. That's not a version gap; I misread it.\n- `kbd-assess/SKILL.md`, `kbd-init/SKILL.md`, `kbd-new-phase/SKILL.md`, `prompts/assess.md`, `project.template.json`, and the adversarial-review preflight script are all **identical** between source and 1.6.2.\n\nSo the `/kbd-init` and `/kbd-assess` runs already completed used the same bytes 1.7.0 would have. No rework needed there.\n\nThe three drifted files matter for `/kbd-execute` and `/kbd-spec` — stages we haven't reached.\n\n## Your call\n\nI can't publish 1.7.0 into the plugin cache myself — that's your packaging pipeline, and I don't know its publish command. Options:\n\n1. **Publish 1.7.0 properly** — you run the pack's install/publish step; I re-verify and continue. Cleanest, and fixes the broken `~/.claude/skills` symlink if the installer rewrites it.\n2. **Continue on 1.6.2 for analyze** — legitimate here, since `kbd-analyze` is byte-identical. Then upgrade before `/kbd-spec` or `/kbd-execute`, where the drift is real.\n3. **Point the KBD skills at the source tree directly** for this session.\n\nI'd suggest **1**, since the symlink is broken regardless and will keep biting. But **2** is defensible if you want to keep moving on the partitioning question now — the risk is genuinely zero for the analyze stage.\n\nWhich way?\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:11:33.611768Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T11:14:53.644969Z",
-      "updated_at": "2026-08-09T11:14:53.644969Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-0c2a62b22721a70c",
-      "title": "Karpathy session 0c2a62b22721",
-      "content": "## Delta\n\nThat confirms the root cause. Here's what's happening.\n\n## Diagnosis\n\nThis is **not a bug** — it's a bounded-work invariant firing correctly, but with a bad user experience. Three separate problems:\n\n**1. The scope was never actually narrowed.** Your run reported `Scope: 0 include rule(s), 0 exclude rule(s)` and matched **19,666 files**. The repo is 6.8 GB, and the walk swept in directories that have no business in a code graph:\n\n| Directory | Size |\n|---|---|\n| `node_modules/` | 1.6 GB |\n| `target/` | 821 MB |\n| `compass-out/` | 302 MB ← Compass's *own* prior output |\n| `vendor/` | 126 MB |\n\nNote the 9,679 \"documents\" and 508 images — that's overwhelmingly dependency and build-artifact content, not your source.\n\n**2. The 2 GiB cap has no escape hatch on this path.** `MAX_GRAPH_BYTES` (`crates/compass-store/src/lib.rs:51`) is a hard `const`. Elsewhere in the codebase — `compass-model`, `compass-output`, `compass-global`, `compass-core` — the same limit is overridable via `COMPASS_MAX_GRAPH_BYTES`, and the error messages there *tell you so*. But `compass-graph/src/snapshot.rs:3138` and `compass-store` never read that variable. So the message you got is a dead end: no override, no suggested remedy.\n\n**3. It failed after 331 seconds**, at final publication — after all extraction work was done. The limit is checked at serialization time (`digest_json`), not estimated up front.\n\n## Your immediate unblock\n\n`compass init` does support scoping — you just pressed through the prompts. Exclusions are available non-interactively:\n\n```bash\ncd /Users/gqadonis/Projects/prometheus/universal-agent-runtime\nrm -rf compass-out .compass\ncompass init --exclude='node_modules/**' --exclude='target/**' \\\n             --exclude='compass-out/**' --exclude='vendor/**' \\\n             --exclude='website/**' --exclude='static/**' --exclude='models.dev/**'\n```\n\nThat should cut the graph by well over an order of magnitude. I haven't run it, so I can't promise it lands under the cap — but the excluded directories are ~3.2 GB of the 6.8 GB, and they're the ones generating the bulk of those 9,679 documents.\n\n## The real fixes for this repo\n\nThree defects worth addressing here, in priority order:\n\n1. **Default ignore policy misses `compass-out/`, `node_modules/`, `target/`, `vendor/`.** Compass ingesting its own output directory is clearly wrong. This belongs in `compass-files::detect`.\n2. **The limit error is unactionable.** It should name the override (if one is granted on this path) and point at scoping — matching how `compass-model` and `compass-core` already word theirs.\n3. **Failing at 331 s is avoidable.** A pre-publication size estimate could fail fast, or warn during extraction.\n\nPer AGENTS.md, #1 and #3 are `compass-files`/`compass-core` work and #2 spans `compass-graph`/`compass-store`; the CLI message stays thin.\n\nTwo things I want your call on before doing anything:\n\n- **Scope:** should I fix all three, or just the ignore-policy default (#1), which alone would have prevented your failure?\n- **Whether to raise the cap:** I'd advise against it. It's a deliberate bounded-work invariant, and AGENTS.md is explicit that a limit error is a distinct outcome from an empty result. Better to make the default scope sane than to let a 2 GiB graph through.\n\nAlso worth noting: the two commits on `docs/claude-md` and the `.kbd-orchestrator/` files are all still uncommitted/unpushed. This fix is unrelated work — I'd put it on its own branch rather than folding it in.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:05:43.579156Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T11:05:44.269089Z",
-      "updated_at": "2026-08-09T11:05:44.269089Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-0cf2eabc28e07ef7",
-      "title": "Karpathy session 0cf2eabc28e0",
-      "content": "## Delta\n\nFixed. The only remaining \"12 GB\" match is inside my new comment, where it's describing the past drift rather than claiming a current value.\n\nThe comment now points to `SCCACHE_CACHE_SIZE` in `[env]` instead of restating the number — a single source of truth, so it can't go stale again the way it just did. Config parses cleanly, and the declared `40G` matches what the live server actually reports (40 GiB max, on the WDD).\n\nThat closes out all three items: release build installed as `compass 0.3.6`, ~10.1 GB reclaimed locally, and the sccache config corrected so the internal disk stops accumulating cache.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 34d4343f-8edd-46e9-bb53-90b588e5d3ed\n- Captured: 2026-08-09T05:41:42.970513Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:34d4343f-8edd-46e9-bb53-90b588e5d3ed"
-      ],
-      "created_at": "2026-08-09T05:41:45.675152Z",
-      "updated_at": "2026-08-09T05:41:45.675152Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-15a46a623cf0e420",
-      "title": "Karpathy session 15a46a623cf0",
-      "content": "## Delta\n\nWritten to `/Users/gqadonis/Projects/prometheus/prometheus-skill-pack/docs/UPDATE_CONSIDERATIONS.md`.\n\nIt's structured as a handoff brief rather than the bare prompt — the same content, but organized so someone landing cold can act on it:\n\n- **Symptom + consequence** — the error, and the concrete drift it causes (`kbd-execute`, `kbd-spec`, `adversarial-review.md`), with the install-ref vs HEAD mismatch.\n- **Established by direct verification** — the three things I actually proved, with the hash evidence showing the manifest was wrong and the file was right.\n- **Open hypothesis** — `payloadRoot`, with four ranked candidates and an explicit instruction not to guess-and-patch. The likeliest answer (payload stages from HEAD → manifest must be committed) is called out as *structurally* meaning regeneration alone can't work.\n- **Constraints** — the concurrency guardrails, including that the two tree snapshots I took minutes apart already differed, so the listed file set is indicative only.\n- **Definition of done** — six checkable conditions, the last being that in-flight work survives untouched.\n- **Secondary defect** — the broken `.claude/skills` symlink, framed as arguably higher impact since it's the mechanism that let the staleness go unnoticed.\n- **Preventive follow-up** — proposal only, pointing at `check-harness-adapters.js` as the likely existing-but-unenforced check.\n\nI only created that one new file; nothing else in the repo was touched. Note the working tree there has kept growing — `kbd-init` workflow files across five harness surfaces are now modified — so that document is deliberately written to assume its own file list is stale.\n\nTwo loose ends still open here in Compass: the phase creation and `/kbd-analyze` on the partitioning question, plus the two unpushed commits on `docs/claude-md` and the untracked `.kbd-orchestrator/`. Since `kbd-analyze`'s `SKILL.md` is byte-identical between 1.6.2 and 1.7.0, running it now carries no version risk if you want to keep moving.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:22:19.272736Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- AGENTS.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T11:24:40.030753Z",
-      "updated_at": "2026-08-09T11:24:40.030753Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-19802b94100a3ab3",
-      "title": "Karpathy session 19802b94100a",
-      "content": "## Delta\n\nCompleted kbd-assess — compass-scoping-and-bounds (step 0 of 0)\n\n## Answer: no, don't add scoping — it already exists and works\n\n**I need to correct my previous turn.** I told you the default ignore policy was missing `node_modules/`, `target/`, and `compass-out/`. That was wrong, and it was the premise of my whole recommendation. Reading the source disproves it:\n\n- All three are in `SKIP_DIRS` — ~40 entries at `crates/compass-files/src/detect.rs:61-102`\n- Gitignore respect defaults to `true` (`detect.rs:163`)\n- `.compassignore` is supported (`detect.rs:390`)\n- `--include`/`--exclude` already exist (`init_commands.rs:438-462`)\n\nBuilding scoping would have duplicated shipped functionality. That's the finding that changes the recommendation, and it came from checking the code rather than trusting my own earlier hypothesis.\n\n**What actually happened:** the exclusions fired correctly. That repo just has **9,320 in-scope markdown files — 4,827 under `crates/` alone**. The 19,666 matched files are real content, not leaked junk. This is a genuine capacity limit.\n\n**Research corroborates that Compass is already at or above baseline.** Firecrawl across `ck`, `codegraphcontext`, `.cursorignore`, ripgrep, and a formatter comparative study: respect `.gitignore` by default (\"the single highest-value default\"), ship hardcoded defaults, offer a tool-specific ignore file. Compass does all three, with a *larger* default list than the tools surveyed.\n\n**The real defects, in order:**\n\n| Pri | Defect |\n|---|---|\n| 1 | `COMPASS_MAX_GRAPH_BYTES` is honored in `compass-model`, `-output`, `-global`, `-core` — and their errors advertise it — but **not** on the snapshot path that actually failed. You hit a limit the rest of the product treats as adjustable, with no override. |\n| 2 | The error names a fact and stops — no override, no `--exclude` hint, no indication of what dominated the graph. |\n| 3 | Fails at 331 s after all work completes, then discards it. |\n| 4 | `vendor/` isn't skipped — but that needs a decision, not a reflex; Go monorepos and Compass's own tree legitimately use it. |\n\n**Two things I won't paper over:**\n\n- **My suggested `--exclude` workaround is untested and may not work.** With 4,827 markdown files under `crates/` — which you can't exclude without gutting the graph — it may still blow the cap.\n- **I'd resist raising the 2 GiB limit.** AGENTS.md is explicit that bounded work is an invariant and a limit error is distinct from an empty result. Grant an explicit opt-in override instead — which matches ripgrep's maintainer position that a paired explicit flag beats changing defaults.\n\n**Open architecture question for `/kbd-analyze`:** if a repo this size can't publish under 2 GiB even with sane exclusions, the answer may be graph partitioning rather than a bigger number. That should be settled before any code is written.\n\nAssessment written to `.kbd-orchestrator/phases/compass-scoping-and-bounds/assessment.md`. Note the phase is provisional — I didn't run `/kbd-new-phase`, so `active_phase` is still `null` and there's no `progress.json` (hence \"step 0 of 0\"). Say the word and I'll create it properly, or rename it.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:11:29.936317Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T11:11:30.692085Z",
-      "updated_at": "2026-08-09T11:11:30.692085Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-199d5165acd78a00",
-      "title": "Karpathy session 199d5165acd7",
-      "content": "## Delta\n\nCreated `CLAUDE.md` at the repo root.\n\nSince `AGENTS.md` is already a thorough agent guide, I wrote CLAUDE.md to defer to it rather than duplicate it, and concentrated on what it leaves implicit:\n\n**What's in it:**\n- **`CARGO_TARGET_DIR` requirement** — surfaced up top, since it must be set on every compiling invocation and is the easiest thing to get wrong. I also flagged the conflict where some Makefile targets (`install`, `dist`, `release-check`) resolve binaries through a literal `target/` path, which AGENTS.md mentions but doesn't tie to specific targets.\n- **Commands** — narrow-loop test/clippy per crate and per integration file, the workspace baseline, the surface-specific gates (product boundary, CompassQL TCK, code-graph qualification), and the npm workspace commands. Noted that `make test` is `--lib --bins` only while `make test-all` needs Python oracle setup.\n- **Architecture** — the piece that genuinely requires reading multiple files: the one-directional flow `compass-files → compass-languages → compass-resolve → compass-graph → compass-model`, orchestrated by `compass-core`. I emphasized the boundary that's easiest to violate — per-file extractors emit evidence and never resolve targets needing project-wide facts. Also the `compass-cypher` (syntax) vs `compass-query` (execution) split, immutable history realizations, and the generated viewer assets round-trip.\n- **Enforced constraints** — the lint set, determinism as correctness, boundedness (limit error ≠ empty result), and reuse of existing safe primitives.\n\nTwo notes on judgment calls: I skipped enumerating individual crates beyond the pipeline ones, since `docs/implementation/workspace-tour.md` already does that well and I pointed at it instead. I also didn't import anything from a Codex or Gemini config — I didn't check for those, as the instruction is to offer rather than read them. If you have an OpenAI Codex or Gemini CLI config you'd like folded in, reply `/import` and it'll scan and list what's importable.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:34:13.627630Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n- CLAUDE.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T10:34:32.153219Z",
-      "updated_at": "2026-08-09T10:34:32.153219Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-309fba26769d26dc",
-      "title": "Karpathy session 309fba26769d",
-      "content": "## Delta\n\nHere's a self-contained prompt for a session in the skill-pack repo. It's written to be safe alongside concurrent work — it assumes nothing about the working tree and stops rather than overwriting.\n\n````markdown\n# Fix: `update-skill-pack.sh` fails release payload verification, blocking 1.7.0 install\n\n## Context\n\nRepo: `/Users/gqadonis/Projects/prometheus/prometheus-skill-pack`\n(remote `git@github.com:Prometheus-AGS/prometheus-skill-system.git`)\n\n`bash scripts/update-skill-pack.sh` fails at step 2 and no new generation is\ninstalled:\n\n```\nStep 2: Building and verifying immutable generation...\ninstall-plugin-generation: release payload verification failed for shared/scripts/detect-toolchain.sh\n```\n\nConsequence: `~/.prometheus/plugins/prometheus-skill-pack/current` is pinned to\nan older generation. `~/.prometheus/skill-pack-install-ref` records `dfdd8be`\nwhile `main` is at `6e46758` (`v1.7.0-12-g6e46758`). Consumers of the pack are\nrunning stale skills; `kbd-execute/SKILL.md`, `kbd-spec/SKILL.md`, and\n`references/integrations/adversarial-review.md` are known to differ between\nsource and the last-installed generation.\n\n## What has already been established (verify, don't assume)\n\n1. `shared/harnesses/generated/release-manifest.json` was stale. Commit\n   `3c31581` (\"fix: stop reporting and restarting healthy forge-mcp and\n   sovereign-sync\") modified `shared/scripts/detect-toolchain.sh` and\n   `shared/scripts/service-probe.sh` **without regenerating the manifest**.\n   The manifest recorded pre-fix sha256 values for both. File modes were\n   correct (`0755`); only content hashes were wrong. 2 of 61 `runtimeFiles`\n   entries affected.\n\n2. Running `node scripts/generate-harness-adapters.js` rebuilt the manifest and\n   brought it to 0/61 stale (verified by re-hashing every entry against disk).\n\n3. **The install still fails with the identical error after that fix.** This is\n   the open problem.\n\n## Root-cause hypothesis to confirm or refute\n\n`verifyReleaseManifest(payloadRoot, ...)` in `scripts/install-plugin-generation.js`\n(~line 642) reads the manifest from `payloadRoot`, **not** from the source\ncheckout:\n\n```js\nconst manifestPath = path.join(payloadRoot, 'shared/harnesses/generated/release-manifest.json');\n```\n\nSo a corrected manifest in the working tree may not be what is verified. Trace\nhow `payloadRoot` is derived and where the staged payload originates. Candidate\nexplanations, in the order worth testing:\n\n- the payload is staged from `git archive`/HEAD rather than the working tree, so\n  the regenerated (uncommitted) manifest never reaches `payloadRoot`;\n- the payload is copied to a temp/staging dir that is cached or reused between\n  runs and was not invalidated;\n- `bundleId` is recomputed over `identity` and must also match `expectedBundle`\n  threaded in from elsewhere (note `generate-harness-adapters.js` printed\n  `Generated bundle 75cdf7e0df7f31a5ef319dd5580e7c852371546b6b8f0bbcad9b8c787b9586f3`);\n- two manifests exist and a different one wins at verification time.\n\nConfirm which by instrumenting or reading the code — do not guess and patch.\n\nIf the payload is staged from HEAD, the corrected manifest **must be committed**\nbefore the install can succeed. That is likely the actual fix, and it means the\nregeneration alone is insufficient.\n\n## Constraints — read before touching anything\n\n- **Concurrent work is in progress in this repo. Do not overwrite, revert, stash,\n  reset, checkout over, or clean anyone else's changes.**\n- At the time of investigation the working tree had these **pre-existing\n  uncommitted** changes, unrelated to this fix (mtimes predate the regeneration\n  run — `kbd-init/SKILL.md` was modified 06:19 today). Treat any of these you\n  find as someone else's in-flight work:\n\n  ```\n   M hooks/codex-hooks.json\n   M hooks/hooks.json\n   M scripts/test-skills.js\n   M shared/harnesses/generated/claude-hooks.json\n   M shared/harnesses/generated/release-manifest.json\n   M skills/process/kbd-process-orchestrator/references/co\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:22:15.521460Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- AGENTS.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T11:22:20.607957Z",
-      "updated_at": "2026-08-09T11:22:20.607957Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-3383d6fb52bb5dce",
-      "title": "Karpathy session 3383d6fb52bb",
-      "content": "## Delta\n\nCompleted kbd-analyze — compass-scoping-and-bounds (step 0 of 0)\n\n## Answer: don't shard — and don't build partitioning either, because it already exists\n\nTwo findings changed the picture, both from reading the code rather than reasoning about it.\n\n**1. `PartitionedGraph` already exists.** `compass-history/src/artifacts.rs:76-84` has full record-class partitioning — nodes, edges, hyperedges, analysis, metadata, program facts/summaries — with `partition()`, `into_partition()`, and `reconstruct()`. A grep for it outside `compass-history` returns nothing. The current-graph path doesn't use it. So the real question isn't \"should we build partitioning\" but \"why does `compass init` serialize one monolithic document when the mechanism sits in the next crate over?\"\n\n**2. The 2 GiB cap protects against a problem the docs deny exists.** `compass-store/src/lib.rs:44-51` justifies the limit by saying the store serves records \"through indexed scans instead of materializing the whole document.\" But `load_active_snapshot` at lines 838-853 does this:\n\n```rust\nlet capacity = usize::try_from(manifest.payload_bytes).unwrap_or(MAX_GRAPH_BYTES);\nlet mut bytes = Vec::with_capacity(capacity);\nfor index in 0..manifest.chunk_count {\n    bytes.extend_from_slice(&chunk.value);\n```\n\nIt pre-allocates the full payload and concatenates every chunk. Chunking bounds each *stored value*, not the reconstruction. Meanwhile the **write** path genuinely streams via `DigestWriter`. The asymmetry matters: the cap isn't protecting the writer, it's protecting the reader — the opposite of what the comment claims.\n\n**This produces a hard sequencing constraint.** Honoring `COMPASS_MAX_GRAPH_BYTES` on the publication path (G1, the obvious fix) **must not land first**. Raising the cap today raises a real allocation — an override would let someone request a multi-gigabyte contiguous `Vec`, which is a worse failure than today's clean error. Stream the read path first.\n\n**Research backed the direction unanimously.** Sharding targets multi-machine scaling; Compass is local-first single-process. Citus notes graph sharding brings eventual consistency, which the determinism invariant forbids outright. Azure's criteria (data exceeds single-instance capacity, vertical scaling exhausted) don't apply. Notably, the existing `PartitionedGraph` partitions by *record class, not topology* — sidestepping the edge-cut problem the literature flags as graph partitioning's hardest part.\n\n**Recommended order:** stream `load_active_snapshot` → actionable error (G2) → pre-flight estimate (G3) → *then* the override (G1) → `vendor/` policy (G4). Items 2, 3, 5 are independent and can run in parallel.\n\n**Where I'd temper confidence:** direction is well-supported, but three of four open questions are unmeasured — no consumer audit of `load_active_snapshot`, no measurement of what dominates the 2 GiB, and my `--exclude` workaround from earlier is *still untested* and may not fit under the cap given 4,827 markdown files under `crates/`. Sizing this work would be guesswork right now.\n\n**One architecture decision blocks the partitioning route:** `PartitionedGraph` lives in `compass-history`, but AGENTS.md routes current-graph publication to `compass-graph`. Shared crate, duplicate with distinct identity semantics, or new dependency? That needs your call before anyone touches item 6.\n\nPhase is now live — `active_phase` set, waypoint at `analysis_ready`, next command `/kbd-spec`. Files written: `goals.md`, `analysis.md`, `library-candidates.json`, `decision-log.md`, `handoffs/analyze.md`.\n\nStill unpushed: the two commits on `docs/claude-md` plus all of `.kbd-orchestrator/` untracked.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T12:05:00.281326Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- AGENTS.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-15a46a623cf0e420.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-7c287ce9b2192bd7.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T12:05:01.652519Z",
-      "updated_at": "2026-08-09T12:05:01.652519Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-6aacc8d765a1b28f",
-      "title": "Karpathy session 6aacc8d765a1",
-      "content": "## Delta\n\nCompleted kbd-init — Compass\n\nTwo files written to `.kbd-orchestrator/`:\n\n**`project.json`** — discovery results:\n\n| Field | Value | Source |\n|---|---|---|\n| name / description | Compass — \"Native local-first knowledge graph engine…\" | `Cargo.toml` `[workspace.package]` |\n| stack | Rust (Edition 2024, pinned 1.97.1) | `Cargo.toml` + `rust-toolchain.toml` |\n| spec_paths | `openspec/specs/*.md` | `openspec/` exists (just initialized, currently empty) |\n| openspec_available | `true` | — |\n| workspace | single-project (`workspace_file: null`) | no `.code-workspace` references compass |\n| planning / execution agents | `claude` / `claude, codex, opencode` | the tools we just configured |\n| active_phase | `null` | no phase defined yet |\n\n**`constraints.md`** — I did **not** use the template's defaults. Those are TypeScript-oriented (`no-console-log`, `no-any-type`, `grep src/`) and would be inert in a Rust workspace with no `src/` at root. Instead I derived constraints from AGENTS.md: 16 blocking (unsafe/unwrap/expect/panic lints, product boundary vs. Graphify, local-first preservation, determinism, boundedness, immutable realizations, viewer-asset generation) and 17 warning (ownership boundary, extractor/resolver separation, compatibility documentation, the CompassQL and code-graph gates).\n\n**One thing needs your attention before any KBD phase runs a command:**\n\n`/Volumes/Workspace` **is not currently mounted** — only `Macintosh HD`, `my-passport`, and `Open Design` are. Every build/test/lint command in `project.json` sets `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main`, per the AGENTS.md mandate. As written, they'll fail until that volume is attached — which is the correct behavior, since AGENTS.md says to stop and report rather than fall back to a local `target/` on the 100 GB-capped main disk. I encoded the rule faithfully rather than silently substituting a working-but-wrong path.\n\nAlso worth noting: `openspec/specs/` is empty, so `spec_paths` currently resolves to nothing. That's expected for a fresh init — specs appear once you run `/opsx:new`.\n\nThese two files are untracked and uncommitted, separate from the two commits already on `docs/claude-md`. Next step is `/kbd-status` to confirm, then `/kbd-new-phase <name>` to start the first phase.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:58:32.187142Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T11:01:48.963380Z",
-      "updated_at": "2026-08-09T11:01:48.963380Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-7521e456ead1ce12",
-      "title": "Karpathy session 7521e456ead1",
-      "content": "## Delta\n\nBoth done.\n\n**Deleted the local sccache** — `~/Library/Caches/Mozilla.sccache` (10 GB) is gone and has not been recreated. Verified safe first: the live sccache server was serving `/Volumes/my-passport/sccache`, and the local dir had zero writes in the preceding 5 minutes even with an active build running.\n\n**Set `SCCACHE_DIR` in `~/.cargo/config.toml`** — added an `[env]` block pinning `SCCACHE_DIR = \"/Volumes/my-passport/sccache\"` and `SCCACHE_CACHE_SIZE = \"40G\"`, with a comment explaining the failure mode so it isn't re-litigated later. Config parses cleanly.\n\nI deliberately left off `force = true`: your `.zshrc` exports the identical value so there's no conflict, and staying unforced keeps one-off `SCCACHE_DIR=... cargo build` overrides working. Cargo's `[env]` applies to every invocation, so the non-login shells that previously bypassed the `.zshrc` guard now get the WDD path.\n\nFree space went 367 → 373 GiB. It reads lower than the raw 10 GB because an unrelated Rust build is running concurrently and consuming space as it compiles.\n\nTwo caveats worth stating plainly:\n\n- **My verification of the config was static, not functional.** I tried a real build to prove `SCCACHE_DIR` reaches a compiler process, but it hung — it inherited your `rustc-wrapper` and queued behind that concurrent surrealdb build saturating all 10 job slots. I killed and cleaned it up. So I confirmed the file parses with the right values, not that a build observes them end-to-end. Cargo `[env]` semantics are well-defined here, but if you want proof, run any build once the current one finishes and check `sccache --show-stats` still reports the WDD location.\n- **`[env]` doesn't cover non-cargo callers.** Anything invoking `sccache` directly — some CMake/C++ paths, for instance — still relies on the shell export. Your `.zshrc` handles login shells; a stray non-login shell could in principle recreate the default dir. Worth a periodic `du -sh ~/Library/Caches/Mozilla.sccache` to catch it early.\n\nThere's also a **stale comment** at line 12 of the config saying \"warm 12 GB cache on the WDD\" — the actual max is 40 GB. I left it alone since it's outside what you asked for, but I can fix it if you want.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 34d4343f-8edd-46e9-bb53-90b588e5d3ed\n- Captured: 2026-08-09T05:36:52.482414Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:34d4343f-8edd-46e9-bb53-90b588e5d3ed"
-      ],
-      "created_at": "2026-08-09T05:36:58.206699Z",
-      "updated_at": "2026-08-09T05:36:58.206699Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-762f04f1710fc991",
-      "title": "Karpathy session 762f04f1710f",
-      "content": "## Delta\n\nCompleted kbd-init — Compass\n\nTwo files written to `.kbd-orchestrator/`:\n\n**`project.json`** — discovery results:\n\n| Field | Value | Source |\n|---|---|---|\n| name / description | Compass — \"Native local-first knowledge graph engine…\" | `Cargo.toml` `[workspace.package]` |\n| stack | Rust (Edition 2024, pinned 1.97.1) | `Cargo.toml` + `rust-toolchain.toml` |\n| spec_paths | `openspec/specs/*.md` | `openspec/` exists (just initialized, currently empty) |\n| openspec_available | `true` | — |\n| workspace | single-project (`workspace_file: null`) | no `.code-workspace` references compass |\n| planning / execution agents | `claude` / `claude, codex, opencode` | the tools we just configured |\n| active_phase | `null` | no phase defined yet |\n\n**`constraints.md`** — I did **not** use the template's defaults. Those are TypeScript-oriented (`no-console-log`, `no-any-type`, `grep src/`) and would be inert in a Rust workspace with no `src/` at root. Instead I derived constraints from AGENTS.md: 16 blocking (unsafe/unwrap/expect/panic lints, product boundary vs. Graphify, local-first preservation, determinism, boundedness, immutable realizations, viewer-asset generation) and 17 warning (ownership boundary, extractor/resolver separation, compatibility documentation, the CompassQL and code-graph gates).\n\n**One thing needs your attention before any KBD phase runs a command:**\n\n`/Volumes/Workspace` **is not currently mounted** — only `Macintosh HD`, `my-passport`, and `Open Design` are. Every build/test/lint command in `project.json` sets `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main`, per the AGENTS.md mandate. As written, they'll fail until that volume is attached — which is the correct behavior, since AGENTS.md says to stop and report rather than fall back to a local `target/` on the 100 GB-capped main disk. I encoded the rule faithfully rather than silently substituting a working-but-wrong path.\n\nAlso worth noting: `openspec/specs/` is empty, so `spec_paths` currently resolves to nothing. That's expected for a fresh init — specs appear once you run `/opsx:new`.\n\nThese two files are untracked and uncommitted, separate from the two commits already on `docs/claude-md`. Next step is `/kbd-status` to confirm, then `/kbd-new-phase <name>` to start the first phase.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:01:46.520733Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T11:01:52.216303Z",
-      "updated_at": "2026-08-09T11:01:52.216303Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-7c287ce9b2192bd7",
-      "title": "Karpathy session 7c287ce9b219",
-      "content": "## Delta\n\nWritten to `/Users/gqadonis/Projects/prometheus/prometheus-skill-pack/docs/UPDATE_CONSIDERATIONS.md`.\n\nIt's structured as a handoff brief rather than the bare prompt — the same content, but organized so someone landing cold can act on it:\n\n- **Symptom + consequence** — the error, and the concrete drift it causes (`kbd-execute`, `kbd-spec`, `adversarial-review.md`), with the install-ref vs HEAD mismatch.\n- **Established by direct verification** — the three things I actually proved, with the hash evidence showing the manifest was wrong and the file was right.\n- **Open hypothesis** — `payloadRoot`, with four ranked candidates and an explicit instruction not to guess-and-patch. The likeliest answer (payload stages from HEAD → manifest must be committed) is called out as *structurally* meaning regeneration alone can't work.\n- **Constraints** — the concurrency guardrails, including that the two tree snapshots I took minutes apart already differed, so the listed file set is indicative only.\n- **Definition of done** — six checkable conditions, the last being that in-flight work survives untouched.\n- **Secondary defect** — the broken `.claude/skills` symlink, framed as arguably higher impact since it's the mechanism that let the staleness go unnoticed.\n- **Preventive follow-up** — proposal only, pointing at `check-harness-adapters.js` as the likely existing-but-unenforced check.\n\nI only created that one new file; nothing else in the repo was touched. Note the working tree there has kept growing — `kbd-init` workflow files across five harness surfaces are now modified — so that document is deliberately written to assume its own file list is stale.\n\nTwo loose ends still open here in Compass: the phase creation and `/kbd-analyze` on the partitioning question, plus the two unpushed commits on `docs/claude-md` and the untracked `.kbd-orchestrator/`. Since `kbd-analyze`'s `SKILL.md` is byte-identical between 1.6.2 and 1.7.0, running it now carries no version risk if you want to keep moving.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:24:38.852780Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- AGENTS.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-15a46a623cf0e420.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-309fba26769d26dc.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-8f202396ae5617a5.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T11:24:40.732045Z",
-      "updated_at": "2026-08-09T11:24:40.732045Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-85be47bbe3d4faec",
-      "title": "Karpathy session 85be47bbe3d4",
-      "content": "## Delta\n\nFixed. The only remaining \"12 GB\" match is inside my new comment, where it's describing the past drift rather than claiming a current value.\n\nThe comment now points to `SCCACHE_CACHE_SIZE` in `[env]` instead of restating the number — a single source of truth, so it can't go stale again the way it just did. Config parses cleanly, and the declared `40G` matches what the live server actually reports (40 GiB max, on the WDD).\n\nThat closes out all three items: release build installed as `compass 0.3.6`, ~10.1 GB reclaimed locally, and the sccache config corrected so the internal disk stops accumulating cache.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 34d4343f-8edd-46e9-bb53-90b588e5d3ed\n- Captured: 2026-08-09T05:36:56.574046Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:34d4343f-8edd-46e9-bb53-90b588e5d3ed"
-      ],
-      "created_at": "2026-08-09T05:39:57.963184Z",
-      "updated_at": "2026-08-09T05:39:57.963184Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-8b2e071dd73e1374",
-      "title": "Karpathy session 8b2e071dd73e",
-      "content": "## Delta\n\nI've traced it. Here's what's actually going on — and part of it contradicts the premise.\n\n## Why 1.6.2 is resolving\n\n**1.7.0 was never installed.** The cache holds only `1.6.0`, `1.6.1`, `1.6.2`. Your source repo at `/Users/gqadonis/Projects/prometheus/prometheus-skill-pack` is tagged `v1.7.0` (12 commits past it, working tree clean), but that was never published into the plugin cache. The newest cache dir is dated Aug 3; the `.prometheus` generation is Aug 5. The tag exists locally and nowhere else.\n\nThere's also a **second, unrelated breakage**: `~/.claude/skills/kbd-init` symlinks to `~/.prometheus/plugins/prometheus-skill-pack/current/skills/process/kbd-process-orchestrator/skills/kbd-init` — a path that doesn't resolve. That's why I fell back to the cache at the start of this session. Two different install roots (`.claude/plugins/cache` and `.prometheus/plugins/generations`), and the symlink points into the one that's broken.\n\n## But the premise doesn't hold for this work\n\nI diffed the source tree against 1.6.2 directly. **The entire `kbd-process-orchestrator` differs in exactly three files:**\n\n| File | Status |\n|---|---|\n| `references/integrations/adversarial-review.md` | differs |\n| `skills/kbd-execute/SKILL.md` | differs |\n| `skills/kbd-spec/SKILL.md` | differs |\n\nEverything else is byte-identical. Specifically:\n\n- **`kbd-analyze` exists in 1.6.2 and its `SKILL.md` is identical to 1.7.0.** My earlier \"no analyze.md\" observation was about the `prompts/` directory — and `prompts/` has no `analyze.md` in **1.7.0 either**. `kbd-analyze` is driven by its `SKILL.md`, not a prompt file. That's not a version gap; I misread it.\n- `kbd-assess/SKILL.md`, `kbd-init/SKILL.md`, `kbd-new-phase/SKILL.md`, `prompts/assess.md`, `project.template.json`, and the adversarial-review preflight script are all **identical** between source and 1.6.2.\n\nSo the `/kbd-init` and `/kbd-assess` runs already completed used the same bytes 1.7.0 would have. No rework needed there.\n\nThe three drifted files matter for `/kbd-execute` and `/kbd-spec` — stages we haven't reached.\n\n## Your call\n\nI can't publish 1.7.0 into the plugin cache myself — that's your packaging pipeline, and I don't know its publish command. Options:\n\n1. **Publish 1.7.0 properly** — you run the pack's install/publish step; I re-verify and continue. Cleanest, and fixes the broken `~/.claude/skills` symlink if the installer rewrites it.\n2. **Continue on 1.6.2 for analyze** — legitimate here, since `kbd-analyze` is byte-identical. Then upgrade before `/kbd-spec` or `/kbd-execute`, where the drift is real.\n3. **Point the KBD skills at the source tree directly** for this session.\n\nI'd suggest **1**, since the symlink is broken regardless and will keep biting. But **2** is defensible if you want to keep moving on the partitioning question now — the risk is genuinely zero for the analyze stage.\n\nWhich way?\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:14:51.722543Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T11:14:53.968282Z",
-      "updated_at": "2026-08-09T11:14:53.968282Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-8f202396ae5617a5",
-      "title": "Karpathy session 8f202396ae56",
-      "content": "## Delta\n\nThe `kbd-init` mtime is 06:19 today — well before this session's regeneration. Those were already-pending working-tree changes, not collateral from my run. Retrying the install:\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:14:56.866886Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-06cdf26d86b0c087.md\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-19802b94100a3ab3.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-8b2e071dd73e1374.md\n- .prometheus/knowledge/wiki/karpathy-session-9354b74ff25823d0.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T11:20:15.494977Z",
-      "updated_at": "2026-08-09T11:20:15.494977Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-9354b74ff25823d0",
-      "title": "Karpathy session 9354b74ff258",
-      "content": "## Delta\n\nThat's the real cause: 9,320 in-scope markdown files, with **4,827 in `crates/`** alone. This is genuine content at genuine scale, not junk. Let me write the assessment.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T11:05:46.513453Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-0c2a62b22721a70c.md\n- .prometheus/knowledge/wiki/karpathy-session-6aacc8d765a1b28f.md\n- .prometheus/knowledge/wiki/karpathy-session-762f04f1710fc991.md\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n- .prometheus/knowledge/wiki/karpathy-session-f90cdbd5fafd1d1d.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T11:10:48.901378Z",
-      "updated_at": "2026-08-09T11:10:48.901378Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-95e26dce31a612a2",
-      "title": "Karpathy session 95e26dce31a6",
-      "content": "## Delta\n\nFixed. The only remaining \"12 GB\" match is inside my new comment, where it's describing the past drift rather than claiming a current value.\n\nThe comment now points to `SCCACHE_CACHE_SIZE` in `[env]` instead of restating the number — a single source of truth, so it can't go stale again the way it just did. Config parses cleanly, and the declared `40G` matches what the live server actually reports (40 GiB max, on the WDD).\n\nThat closes out all three items: release build installed as `compass 0.3.6`, ~10.1 GB reclaimed locally, and the sccache config corrected so the internal disk stops accumulating cache.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 34d4343f-8edd-46e9-bb53-90b588e5d3ed\n- Captured: 2026-08-09T05:38:38.245900Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:34d4343f-8edd-46e9-bb53-90b588e5d3ed"
-      ],
-      "created_at": "2026-08-09T05:41:46.141746Z",
-      "updated_at": "2026-08-09T05:41:46.141746Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-a0b489beb0d312d9",
-      "title": "Karpathy session a0b489beb0d3",
-      "content": "## Delta\n\nCommitted as `dd7679fb` on a new branch `docs/claude-md` (1 file, 212 insertions).\n\nTwo things worth flagging:\n\n- **I branched off `main` rather than committing directly to it**, per the repo's git conventions. Say the word if you'd rather this land on `main` directly.\n- **`.prometheus/` was left untracked** — it looked like local tooling state, not part of this change, and AGENTS.md explicitly says not to commit local state directories. Let me know if it's actually meant to be tracked.\n\nNothing is pushed yet. I can push and open a PR if you want.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:52:26.193194Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T10:52:30.420142Z",
-      "updated_at": "2026-08-09T10:52:30.420142Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-b0a4e7ceb012e58d",
-      "title": "Karpathy session b0a4e7ceb012",
-      "content": "## Delta\n\nCompleted kbd-init — Compass\n\nTwo files written to `.kbd-orchestrator/`:\n\n**`project.json`** — discovery results:\n\n| Field | Value | Source |\n|---|---|---|\n| name / description | Compass — \"Native local-first knowledge graph engine…\" | `Cargo.toml` `[workspace.package]` |\n| stack | Rust (Edition 2024, pinned 1.97.1) | `Cargo.toml` + `rust-toolchain.toml` |\n| spec_paths | `openspec/specs/*.md` | `openspec/` exists (just initialized, currently empty) |\n| openspec_available | `true` | — |\n| workspace | single-project (`workspace_file: null`) | no `.code-workspace` references compass |\n| planning / execution agents | `claude` / `claude, codex, opencode` | the tools we just configured |\n| active_phase | `null` | no phase defined yet |\n\n**`constraints.md`** — I did **not** use the template's defaults. Those are TypeScript-oriented (`no-console-log`, `no-any-type`, `grep src/`) and would be inert in a Rust workspace with no `src/` at root. Instead I derived constraints from AGENTS.md: 16 blocking (unsafe/unwrap/expect/panic lints, product boundary vs. Graphify, local-first preservation, determinism, boundedness, immutable realizations, viewer-asset generation) and 17 warning (ownership boundary, extractor/resolver separation, compatibility documentation, the CompassQL and code-graph gates).\n\n**One thing needs your attention before any KBD phase runs a command:**\n\n`/Volumes/Workspace` **is not currently mounted** — only `Macintosh HD`, `my-passport`, and `Open Design` are. Every build/test/lint command in `project.json` sets `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main`, per the AGENTS.md mandate. As written, they'll fail until that volume is attached — which is the correct behavior, since AGENTS.md says to stop and report rather than fall back to a local `target/` on the 100 GB-capped main disk. I encoded the rule faithfully rather than silently substituting a working-but-wrong path.\n\nAlso worth noting: `openspec/specs/` is empty, so `spec_paths` currently resolves to nothing. That's expected for a fresh init — specs appear once you run `/opsx:new`.\n\nThese two files are untracked and uncommitted, separate from the two commits already on `docs/claude-md`. Next step is `/kbd-status` to confirm, then `/kbd-new-phase <name>` to start the first phase.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:55:59.021325Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T10:58:30.244136Z",
-      "updated_at": "2026-08-09T10:58:30.244136Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-b5d49ca1d46e60a2",
-      "title": "Karpathy session b5d49ca1d46e",
-      "content": "## Delta\n\nBoth commits are on `docs/claude-md`:\n\n| Commit | Contents |\n|---|---|\n| `dd7679fb` | `docs: add CLAUDE.md agent guide` — 1 file |\n| `c349fdf6` | `chore: track Prometheus wiki and initialize OpenSpec` — 73 files, 12,227 insertions |\n\n**What landed:**\n- **`.prometheus/knowledge/wiki/`** — all 12 files tracked as-is, per your call.\n- **OpenSpec** initialized with `schema: spec-driven`, generating `.claude/`, `.codex/`, `.kimi/`, `.opencode/` plus `openspec/config.yaml`.\n\n**Three things to know:**\n\n1. **Zed got nothing.** It isn't a supported `openspec init` target, so there's no generated config for it. If you use Zed here, that gap is still open — I can hand-write a rules file, but it'd be unofficial and liable to drift from openspec's format.\n\n2. **Kimi has skills but no commands.** OpenSpec reported \"Commands skipped for: kimi (no adapter)\" — it got 10 skill files, no `/opsx:*` slash commands. Claude, Codex, and OpenCode got both.\n\n3. **`.claude/settings.local.json` stayed untracked.** It's your personal permission allowlist with machine-specific paths, and your global gitignore already excludes it — so it was never at risk of being committed.\n\n`openspec/config.yaml` is currently all commented-out scaffolding. Its `context:` field feeds project background to AI tools when creating artifacts, and this repo has strong conventions worth putting there (local-first Rust, no-unwrap/expect/panic lints, determinism requirements, the `CARGO_TARGET_DIR` rule). Want me to fill it in?\n\nNothing is pushed yet. Say the word and I'll push and open a PR.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:52:28.835309Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- No changed paths detected.\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T10:56:00.254334Z",
-      "updated_at": "2026-08-09T10:56:00.254334Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-b6f086fb31ed31c5",
-      "title": "Karpathy session b6f086fb31ed",
-      "content": "## Delta\n\nBoth commits are on `docs/claude-md`:\n\n| Commit | Contents |\n|---|---|\n| `dd7679fb` | `docs: add CLAUDE.md agent guide` — 1 file |\n| `c349fdf6` | `chore: track Prometheus wiki and initialize OpenSpec` — 73 files, 12,227 insertions |\n\n**What landed:**\n- **`.prometheus/knowledge/wiki/`** — all 12 files tracked as-is, per your call.\n- **OpenSpec** initialized with `schema: spec-driven`, generating `.claude/`, `.codex/`, `.kimi/`, `.opencode/` plus `openspec/config.yaml`.\n\n**Three things to know:**\n\n1. **Zed got nothing.** It isn't a supported `openspec init` target, so there's no generated config for it. If you use Zed here, that gap is still open — I can hand-write a rules file, but it'd be unofficial and liable to drift from openspec's format.\n\n2. **Kimi has skills but no commands.** OpenSpec reported \"Commands skipped for: kimi (no adapter)\" — it got 10 skill files, no `/opsx:*` slash commands. Claude, Codex, and OpenCode got both.\n\n3. **`.claude/settings.local.json` stayed untracked.** It's your personal permission allowlist with machine-specific paths, and your global gitignore already excludes it — so it was never at risk of being committed.\n\n`openspec/config.yaml` is currently all commented-out scaffolding. Its `context:` field feeds project background to AI tools when creating artifacts, and this repo has strong conventions worth putting there (local-first Rust, no-unwrap/expect/panic lints, determinism requirements, the `CARGO_TARGET_DIR` rule). Want me to fill it in?\n\nNothing is pushed yet. Say the word and I'll push and open a PR.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:55:56.151200Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T10:56:01.152228Z",
-      "updated_at": "2026-08-09T10:56:01.152228Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-bb64c62e88af6029",
-      "title": "Karpathy session bb64c62e88af",
-      "content": "## Delta\n\nCreated `CLAUDE.md` at the repo root.\n\nSince `AGENTS.md` is already a thorough agent guide, I wrote CLAUDE.md to defer to it rather than duplicate it, and concentrated on what it leaves implicit:\n\n**What's in it:**\n- **`CARGO_TARGET_DIR` requirement** — surfaced up top, since it must be set on every compiling invocation and is the easiest thing to get wrong. I also flagged the conflict where some Makefile targets (`install`, `dist`, `release-check`) resolve binaries through a literal `target/` path, which AGENTS.md mentions but doesn't tie to specific targets.\n- **Commands** — narrow-loop test/clippy per crate and per integration file, the workspace baseline, the surface-specific gates (product boundary, CompassQL TCK, code-graph qualification), and the npm workspace commands. Noted that `make test` is `--lib --bins` only while `make test-all` needs Python oracle setup.\n- **Architecture** — the piece that genuinely requires reading multiple files: the one-directional flow `compass-files → compass-languages → compass-resolve → compass-graph → compass-model`, orchestrated by `compass-core`. I emphasized the boundary that's easiest to violate — per-file extractors emit evidence and never resolve targets needing project-wide facts. Also the `compass-cypher` (syntax) vs `compass-query` (execution) split, immutable history realizations, and the generated viewer assets round-trip.\n- **Enforced constraints** — the lint set, determinism as correctness, boundedness (limit error ≠ empty result), and reuse of existing safe primitives.\n\nTwo notes on judgment calls: I skipped enumerating individual crates beyond the pipeline ones, since `docs/implementation/workspace-tour.md` already does that well and I pointed at it instead. I also didn't import anything from a Codex or Gemini config — I didn't check for those, as the instruction is to offer rather than read them. If you have an OpenAI Codex or Gemini CLI config you'd like folded in, reply `/import` and it'll scan and list what's importable.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:37:15.181272Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n- CLAUDE.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T10:37:28.812655Z",
-      "updated_at": "2026-08-09T10:37:28.812655Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-c13ff840014cf2b3",
-      "title": "Karpathy session c13ff840014c",
-      "content": "## Delta\n\n`cargo config` needs nightly. Let me verify with a functional test instead — the stronger check anyway, since it proves the var reaches a real build process.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 34d4343f-8edd-46e9-bb53-90b588e5d3ed\n- Captured: 2026-08-09T05:20:58.608418Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- No changed paths detected.\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:34d4343f-8edd-46e9-bb53-90b588e5d3ed"
-      ],
-      "created_at": "2026-08-09T05:26:55.781482Z",
-      "updated_at": "2026-08-09T05:26:55.781482Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-f8eff00b52d5f657",
-      "title": "Karpathy session f8eff00b52d5",
-      "content": "## Delta\n\nCreated `CLAUDE.md` at the repo root.\n\nSince `AGENTS.md` is already a thorough agent guide, I wrote CLAUDE.md to defer to it rather than duplicate it, and concentrated on what it leaves implicit:\n\n**What's in it:**\n- **`CARGO_TARGET_DIR` requirement** — surfaced up top, since it must be set on every compiling invocation and is the easiest thing to get wrong. I also flagged the conflict where some Makefile targets (`install`, `dist`, `release-check`) resolve binaries through a literal `target/` path, which AGENTS.md mentions but doesn't tie to specific targets.\n- **Commands** — narrow-loop test/clippy per crate and per integration file, the workspace baseline, the surface-specific gates (product boundary, CompassQL TCK, code-graph qualification), and the npm workspace commands. Noted that `make test` is `--lib --bins` only while `make test-all` needs Python oracle setup.\n- **Architecture** — the piece that genuinely requires reading multiple files: the one-directional flow `compass-files → compass-languages → compass-resolve → compass-graph → compass-model`, orchestrated by `compass-core`. I emphasized the boundary that's easiest to violate — per-file extractors emit evidence and never resolve targets needing project-wide facts. Also the `compass-cypher` (syntax) vs `compass-query` (execution) split, immutable history realizations, and the generated viewer assets round-trip.\n- **Enforced constraints** — the lint set, determinism as correctness, boundedness (limit error ≠ empty result), and reuse of existing safe primitives.\n\nTwo notes on judgment calls: I skipped enumerating individual crates beyond the pipeline ones, since `docs/implementation/workspace-tour.md` already does that well and I pointed at it instead. I also didn't import anything from a Codex or Gemini config — I didn't check for those, as the instruction is to offer rather than read them. If you have an OpenAI Codex or Gemini CLI config you'd like folded in, reply `/import` and it'll scan and list what's importable.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:34:10.259136Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/\n- CLAUDE.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T10:34:18.362064Z",
-      "updated_at": "2026-08-09T10:34:18.362064Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    },
-    {
-      "id": "karpathy-session-f90cdbd5fafd1d1d",
-      "title": "Karpathy session f90cdbd5fafd",
-      "content": "## Delta\n\nCompleted kbd-init — Compass\n\nTwo files written to `.kbd-orchestrator/`:\n\n**`project.json`** — discovery results:\n\n| Field | Value | Source |\n|---|---|---|\n| name / description | Compass — \"Native local-first knowledge graph engine…\" | `Cargo.toml` `[workspace.package]` |\n| stack | Rust (Edition 2024, pinned 1.97.1) | `Cargo.toml` + `rust-toolchain.toml` |\n| spec_paths | `openspec/specs/*.md` | `openspec/` exists (just initialized, currently empty) |\n| openspec_available | `true` | — |\n| workspace | single-project (`workspace_file: null`) | no `.code-workspace` references compass |\n| planning / execution agents | `claude` / `claude, codex, opencode` | the tools we just configured |\n| active_phase | `null` | no phase defined yet |\n\n**`constraints.md`** — I did **not** use the template's defaults. Those are TypeScript-oriented (`no-console-log`, `no-any-type`, `grep src/`) and would be inert in a Rust workspace with no `src/` at root. Instead I derived constraints from AGENTS.md: 16 blocking (unsafe/unwrap/expect/panic lints, product boundary vs. Graphify, local-first preservation, determinism, boundedness, immutable realizations, viewer-asset generation) and 17 warning (ownership boundary, extractor/resolver separation, compatibility documentation, the CompassQL and code-graph gates).\n\n**One thing needs your attention before any KBD phase runs a command:**\n\n`/Volumes/Workspace` **is not currently mounted** — only `Macintosh HD`, `my-passport`, and `Open Design` are. Every build/test/lint command in `project.json` sets `CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main`, per the AGENTS.md mandate. As written, they'll fail until that volume is attached — which is the correct behavior, since AGENTS.md says to stop and report rather than fall back to a local `target/` on the 100 GB-capped main disk. I encoded the rule faithfully rather than silently substituting a working-but-wrong path.\n\nAlso worth noting: `openspec/specs/` is empty, so `spec_paths` currently resolves to nothing. That's expected for a fresh init — specs appear once you run `/opsx:new`.\n\nThese two files are untracked and uncommitted, separate from the two commits already on `docs/claude-md`. Next step is `/kbd-status` to confirm, then `/kbd-new-phase <name>` to start the first phase.\n\n## Root Cause\n\nNo explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.\n\n## Corrective Actions\n\nReview and promote only reusable findings.\n\n## Session Metadata\n\n- Harness: claude-code\n- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3\n- Captured: 2026-08-09T10:58:29.463044Z\n- Project: /Users/gqadonis/Projects/references/compass\n\n## Changed Paths\n\n- .prometheus/knowledge/wiki/index.md\n- .prometheus/knowledge/wiki/log.md\n- .kbd-orchestrator/\n- .prometheus/knowledge/wiki/karpathy-session-b0a4e7ceb012e58d.md\n- .prometheus/knowledge/wiki/karpathy-session-b5d49ca1d46e60a2.md\n- .prometheus/knowledge/wiki/karpathy-session-b6f086fb31ed31c5.md\n",
-      "tags": [
-        "karpathy",
-        "session-learning"
-      ],
-      "links": [],
-      "sources": [
-        "session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3"
-      ],
-      "created_at": "2026-08-09T10:58:32.854406Z",
-      "updated_at": "2026-08-09T10:58:32.854406Z",
-      "revision": 0,
-      "entry_type": "SessionRecord",
-      "description": null,
-      "extra": {}
-    }
-  ]
-}
diff --git a/.prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-completion-record.md b/.prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-completion-record.md
new file mode 100644
index 000000000..4214016e7
--- /dev/null
+++ b/.prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-completion-record.md
@@ -0,0 +1,38 @@
+---
+type: Reference
+id: compass-scoping-and-bounds-executor-completion-record
+title: Compass scoping and bounds executor completion record
+tags:
+- compass
+- executor-session
+- scoping
+- session-record
+links:
+- compass-scoping-and-bounds-executor-session
+- compass-scoping-and-bounds-completion-capture
+sources:
+- stdin
+timestamp: 2026-08-09T12:55:26.408761+00:00
+created_at: 2026-08-09T12:55:26.408761+00:00
+updated_at: 2026-08-09T12:55:26.408761+00:00
+revision: 0
+---
+
+## Session Record
+
+| Field | Value |
+|---|---|
+| Phase | `compass-scoping-and-bounds` |
+| Status | complete |
+| Change | `unknown` |
+
+## Handling Notes
+
+- Raw capture contains only completion status for the executor session.
+- No implementation delta, root cause, changed paths, or corrective actions were captured.
+- Treat as a minimal session record; do not infer code changes or operational impact from this capture alone.
+- Related prior minimal records: [Compass scoping and bounds executor session](/compass-scoping-and-bounds-executor-session.md) and [Compass scoping and bounds completion capture](/compass-scoping-and-bounds-completion-capture.md).
+
+# Citations
+
+1. stdin
\ No newline at end of file
diff --git a/.prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-completion-status.md b/.prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-completion-status.md
new file mode 100644
index 000000000..435da17da
--- /dev/null
+++ b/.prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-completion-status.md
@@ -0,0 +1,42 @@
+---
+type: Reference
+id: compass-scoping-and-bounds-executor-completion-status
+title: Compass scoping and bounds executor session complete
+tags:
+- compass
+- executor-session
+- scoping
+- session-record
+links:
+- compass-scoping-and-bounds-executor-session
+- compass-scoping-and-bounds-executor-completion-status
+- compass-scoping-and-bounds-executor-completion
+- compass-scoping-and-bounds-executor-completion-record
+- compass-scoping-and-bounds-completion-capture
+sources:
+- stdin
+timestamp: 2026-08-28T12:43:24.206156+00:00
+created_at: 2026-08-28T12:43:24.204545+00:00
+updated_at: 2026-08-28T12:43:24.206156+00:00
+revision: 1
+content_hash: 63c33603f1b50b34c2a10551f7490be2d309f86f3c20d3b1c577e347fb136786
+---
+
+## Session Record
+
+| Field | Value |
+|---|---|
+| Phase | `compass-scoping-and-bounds` |
+| Status | complete |
+| Change | `unknown` |
+
+## Handling Notes
+
+- Raw capture records only executor-session completion for phase `compass-scoping-and-bounds`.
+- No implementation delta, root cause, changed paths, validation results, corrective actions, or operational impact were captured.
+- Preserve as a minimal execution record; do not infer code changes from this capture alone.
+- Consistent with related minimal records including [Compass scoping and bounds executor session](/compass-scoping-and-bounds-executor-session.md), [Compass scoping and bounds executor completion status](/compass-scoping-and-bounds-executor-completion-status.md), [Compass scoping and bounds executor completion](/compass-scoping-and-bounds-executor-completion.md), [Compass scoping and bounds executor completion record](/compass-scoping-and-bounds-executor-completion-record.md), and [Compass scoping and bounds completion capture](/compass-scoping-and-bounds-completion-capture.md).
+
+# Citations
+
+1. stdin
\ No newline at end of file
diff --git a/.prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-completion.md b/.prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-completion.md
new file mode 100644
index 000000000..603032f54
--- /dev/null
+++ b/.prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-completion.md
@@ -0,0 +1,39 @@
+---
+type: Reference
+id: compass-scoping-and-bounds-executor-completion
+title: Compass scoping and bounds executor completion
+tags:
+- compass
+- executor-session
+- scoping
+- session-record
+links:
+- compass-scoping-and-bounds-executor-session
+- compass-scoping-and-bounds-executor-completion-record
+- compass-scoping-and-bounds-completion-capture
+sources:
+- stdin
+timestamp: 2026-08-09T13:37:09.320890+00:00
+created_at: 2026-08-09T13:37:09.320890+00:00
+updated_at: 2026-08-09T13:37:09.320890+00:00
+revision: 0
+---
+
+## Session Record
+
+| Field | Value |
+|---|---|
+| Phase | `compass-scoping-and-bounds` |
+| Status | complete |
+| Change | `unknown` |
+
+## Handling Notes
+
+- Raw capture records only executor-session completion for phase `compass-scoping-and-bounds`.
+- No implementation delta, root cause, changed paths, validation results, or corrective actions were captured.
+- Treat as a minimal execution record; do not infer code changes or operational impact from this capture alone.
+- This record is consistent with prior minimal records: [Compass scoping and bounds executor session](/compass-scoping-and-bounds-executor-session.md), [Compass scoping and bounds executor completion record](/compass-scoping-and-bounds-executor-completion-record.md), and [Compass scoping and bounds completion capture](/compass-scoping-and-bounds-completion-capture.md).
+
+# Citations
+
+1. [1] stdin
\ No newline at end of file
diff --git a/.prometheus/knowledge/wiki/index.md b/.prometheus/knowledge/wiki/index.md
index 396110d13..fe11b1612 100644
--- a/.prometheus/knowledge/wiki/index.md
+++ b/.prometheus/knowledge/wiki/index.md
@@ -3,24 +3,34 @@
 ## Reference
 
 * [Compass scoping and bounds completion capture](/compass-scoping-and-bounds-completion-capture.md)
+* [Compass scoping and bounds executor completion](/compass-scoping-and-bounds-executor-completion.md)
+* [Compass scoping and bounds executor completion record](/compass-scoping-and-bounds-executor-completion-record.md)
 * [Compass scoping and bounds executor session](/compass-scoping-and-bounds-executor-session.md)
+* [Compass scoping and bounds executor session complete](/compass-scoping-and-bounds-executor-completion-status.md)
 
 ## SessionRecord
 
 * [Karpathy session 04f1f5622348](/karpathy-session-04f1f5622348cff2.md)
 * [Karpathy session 06cdf26d86b0](/karpathy-session-06cdf26d86b0c087.md)
 * [Karpathy session 0c2a62b22721](/karpathy-session-0c2a62b22721a70c.md)
+* [Karpathy session 0c9f8df23506](/karpathy-session-0c9f8df23506c16a.md)
 * [Karpathy session 0cf2eabc28e0](/karpathy-session-0cf2eabc28e07ef7.md)
 * [Karpathy session 1371f1270820](/karpathy-session-1371f12708207b52.md)
 * [Karpathy session 15a46a623cf0](/karpathy-session-15a46a623cf0e420.md)
 * [Karpathy session 178be089fef7](/karpathy-session-178be089fef7012d.md)
 * [Karpathy session 19802b94100a](/karpathy-session-19802b94100a3ab3.md)
 * [Karpathy session 199d5165acd7](/karpathy-session-199d5165acd78a00.md)
+* [Karpathy session 1ecfe43654c6](/karpathy-session-1ecfe43654c6f90b.md)
+* [Karpathy session 2143b246d1cf](/karpathy-session-2143b246d1cf0ba5.md)
 * [Karpathy session 309fba26769d](/karpathy-session-309fba26769d26dc.md)
 * [Karpathy session 3383d6fb52bb](/karpathy-session-3383d6fb52bb5dce.md)
+* [Karpathy session 361f6082f855](/karpathy-session-361f6082f855b168.md)
 * [Karpathy session 4301f5fbc8d2](/karpathy-session-4301f5fbc8d2baa8.md)
+* [Karpathy session 495b53196088](/karpathy-session-495b53196088c2c2.md)
 * [Karpathy session 6aacc8d765a1](/karpathy-session-6aacc8d765a1b28f.md)
+* [Karpathy session 6c67c5011b34](/karpathy-session-6c67c5011b34fce2.md)
 * [Karpathy session 6ee868a46633](/karpathy-session-6ee868a466335f1d.md)
+* [Karpathy session 6f294af7050a](/karpathy-session-6f294af7050aa95f.md)
 * [Karpathy session 7521e456ead1](/karpathy-session-7521e456ead1ce12.md)
 * [Karpathy session 762f04f1710f](/karpathy-session-762f04f1710fc991.md)
 * [Karpathy session 7c287ce9b219](/karpathy-session-7c287ce9b2192bd7.md)
@@ -33,6 +43,7 @@
 * [Karpathy session 9354b74ff258](/karpathy-session-9354b74ff25823d0.md)
 * [Karpathy session 95e26dce31a6](/karpathy-session-95e26dce31a612a2.md)
 * [Karpathy session a0b489beb0d3](/karpathy-session-a0b489beb0d312d9.md)
+* [Karpathy session a217668de21b](/karpathy-session-a217668de21b25d6.md)
 * [Karpathy session b0a4e7ceb012](/karpathy-session-b0a4e7ceb012e58d.md)
 * [Karpathy session b1a297899421](/karpathy-session-b1a29789942105c1.md)
 * [Karpathy session b5d49ca1d46e](/karpathy-session-b5d49ca1d46e60a2.md)
@@ -42,7 +53,12 @@
 * [Karpathy session c13ff840014c](/karpathy-session-c13ff840014cf2b3.md)
 * [Karpathy session ca329344b0f1](/karpathy-session-ca329344b0f175d8.md)
 * [Karpathy session cd330c925600](/karpathy-session-cd330c925600f45f.md)
+* [Karpathy session d968e02c779c](/karpathy-session-d968e02c779c42b0.md)
+* [Karpathy session e0ee5520d062](/karpathy-session-e0ee5520d0620fb6.md)
 * [Karpathy session e2c00470b2ce](/karpathy-session-e2c00470b2ce9770.md)
+* [Karpathy session e9325c7eec4c](/karpathy-session-e9325c7eec4c9735.md)
+* [Karpathy session ef9837e583f6](/karpathy-session-ef9837e583f69b53.md)
+* [Karpathy session f437ebdbcc68](/karpathy-session-f437ebdbcc6811b9.md)
 * [Karpathy session f8eff00b52d5](/karpathy-session-f8eff00b52d5f657.md)
 * [Karpathy session f8f9c9926623](/karpathy-session-f8f9c99266231745.md)
 * [Karpathy session f90cdbd5fafd](/karpathy-session-f90cdbd5fafd1d1d.md)
diff --git a/.prometheus/knowledge/wiki/karpathy-session-0c9f8df23506c16a.md b/.prometheus/knowledge/wiki/karpathy-session-0c9f8df23506c16a.md
new file mode 100644
index 000000000..aae62b37d
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-0c9f8df23506c16a.md
@@ -0,0 +1,118 @@
+---
+type: SessionRecord
+id: karpathy-session-0c9f8df23506c16a
+title: Karpathy session 0c9f8df23506
+tags:
+- karpathy
+- session-learning
+sources:
+- session:f5bc84e3-1901-40c0-9330-f98003584919
+timestamp: 2026-08-28T12:43:11.437901+00:00
+created_at: 2026-08-28T12:43:11.437901+00:00
+updated_at: 2026-08-28T12:43:11.437901+00:00
+revision: 0
+---
+
+## Delta
+
+Handoff is ready. One thing changed in the process: I ran the verify-first check myself rather than leaving it for Codex.
+
+## The handoff document
+
+[EXECUTION-HANDOFF.md](.kbd-orchestrator/phases/compass-scoping-and-bounds/handoffs/EXECUTION-HANDOFF.md) — self-contained, assumes no chat history. Ten sections: what the phase is and the settled architecture decision, the authoritative document list, verified state, how to run OpenSpec under Codex, the enforced rules that fail review, wave order with the five gates that bind it, branch hygiene, known-open items, the adversarial record, and the Compass MCP setup.
+
+## C-001 verify-first: passed, so I closed it
+
+The plan told the executor to verify the uncommitted diff before absorbing it. Handing off an unverified premise would just relocate the risk, so I ran it:
+
+```
+git diff --stat  → +152/−17
+read_snapshot_manifest  lib.rs:837
+read_snapshot_chunks    lib.rs:856
+read_snapshot           lib.rs:901  (retained)
+cargo check -p compass-store --locked → clean, 27.95s
+```
+
+That also closes the round-2 CRITICAL on the assessment, which was only ever unverifiable because artifact-mode review packets carry no git state. Recorded in [decision-log.md](.kbd-orchestrator/phases/compass-scoping-and-bounds/decision-log.md) and [plan.md](.kbd-orchestrator/phases/compass-scoping-and-bounds/plan.md).
+
+The draft is a **starting point, not finished work** — the handoff is explicit that `validate_snapshot` and `snapshot_reference` still need reimplementing on the manifest reader, plus tests and CHANGELOG.
+
+## Environment is ready
+
+Codex CLI 0.146.0 installed; Compass MCP wired in `.codex/config.toml`; OpenSpec 1.10.0 skills in `.agents/skills/`. Codex uses skills rather than slash commands, so the entry point is `$openspec-new-change "stream-snapshot-read"`. Waypoint now reads `sourceTool: codex` and points at the handoff doc.
+
+## To start Codex
+
+```bash
+cd /Users/gqadonis/Projects/references/compass && codex
+```
+
+Then give it:
+
+```
+Read .kbd-orchestrator/phases/compass-scoping-and-bounds/handoffs/EXECUTION-HANDOFF.md and begin C-001.
+```
+
+Two things worth flagging before you hand over:
+
+**The branch.** Everything currently sits on `docs/claude-md` with 47 untracked harness paths. The handoff instructs a clean branch or worktree per change, but nothing enforces it — if you want that guaranteed, create the C-001 branch yourself before starting Codex.
+
+**C-011 is yours, not Codex's.** The SurrealDB BSL license decision blocks Waves 5 and 8 and cannot be closed by writing code. Codex will reach Wave 4 and stop there waiting on you.
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: f5bc84e3-1901-40c0-9330-f98003584919
+- Captured: 2026-08-28T12:43:10.771527Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .claude/commands/opsx/apply.md
+- .claude/commands/opsx/archive.md
+- .claude/commands/opsx/bulk-archive.md
+- .claude/commands/opsx/continue.md
+- .claude/commands/opsx/explore.md
+- .claude/commands/opsx/ff.md
+- .claude/commands/opsx/new.md
+- .claude/commands/opsx/onboard.md
+- .claude/commands/opsx/sync.md
+- .claude/commands/opsx/verify.md
+- .claude/skills/openspec-apply-change/SKILL.md
+- .claude/skills/openspec-archive-change/SKILL.md
+- .claude/skills/openspec-bulk-archive-change/SKILL.md
+- .claude/skills/openspec-continue-change/SKILL.md
+- .claude/skills/openspec-explore/SKILL.md
+- .claude/skills/openspec-ff-change/SKILL.md
+- .claude/skills/openspec-new-change/SKILL.md
+- .claude/skills/openspec-onboard/SKILL.md
+- .claude/skills/openspec-sync-specs/SKILL.md
+- .claude/skills/openspec-verify-change/SKILL.md
+- .codex/skills/openspec-apply-change/SKILL.md
+- .codex/skills/openspec-archive-change/SKILL.md
+- .codex/skills/openspec-bulk-archive-change/SKILL.md
+- .codex/skills/openspec-continue-change/SKILL.md
+- .codex/skills/openspec-explore/SKILL.md
+- .codex/skills/openspec-ff-change/SKILL.md
+- .codex/skills/openspec-new-change/SKILL.md
+- .codex/skills/openspec-onboard/SKILL.md
+- .codex/skills/openspec-sync-specs/SKILL.md
+- .codex/skills/openspec-verify-change/SKILL.md
+- .kbd-orchestrator/current-waypoint.json
+- .kbd-orchestrator/current-waypoint.md
+- .kbd-orchestrator/model-preflight.json
+- .kbd-orchestrator/phases/compass-scoping-and-bounds/assessment.md
+- .kbd-orchestrator/phases/compass-scoping-and-bounds/decision-log.md
+- .kbd-orchestrator/phases/compass-scoping-and-bounds/goals.md
+- .kbd-orchestrator/phases/compass-scoping-and-bounds/plan.md
+- .kbd-orchestrator/phases/compass-scoping-and-bounds/progress.json
+- .kbd-orchestrator/project.json
+- .kimi/skills/openspec-apply-change/SKILL.md
diff --git a/.prometheus/knowledge/wiki/karpathy-session-1ecfe43654c6f90b.md b/.prometheus/knowledge/wiki/karpathy-session-1ecfe43654c6f90b.md
new file mode 100644
index 000000000..9bcc57c6f
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-1ecfe43654c6f90b.md
@@ -0,0 +1,73 @@
+---
+type: SessionRecord
+id: karpathy-session-1ecfe43654c6f90b
+title: Karpathy session 1ecfe43654c6
+tags:
+- karpathy
+- session-learning
+sources:
+- session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+timestamp: 2026-08-09T12:55:13.508858+00:00
+created_at: 2026-08-09T12:55:13.508858+00:00
+updated_at: 2026-08-09T12:55:13.508858+00:00
+revision: 0
+---
+
+## Delta
+
+SurrealDB 3.2.4 confirmed. Here's my honest read.
+
+## The architecture already anticipates this
+
+`compass-store` is documented as **"Backend-neutral, namespace-scoped storage"** with a `Store` trait, and it explicitly says: *"Other backends can implement `Store` without importing Compass graph records or query code"* and *"A remote adapter may put a bounded blocking boundary around its client."* `compass-store-redb` (869 lines) already proves a second backend works. So a `compass-store-surrealdb` adapter is a **supported extension point**, not a fight with the design.
+
+## But the framing needs splitting — the two halves have opposite answers
+
+**Storage backend: plausible, and cleanly so.** SurrealDB embedded (SurrealKV/RocksDB) with a remote option maps onto the existing trait. Your "embedded with an option for remote" instinct matches what the crate doc already contemplates.
+
+**Vector support: this is the part I'd push back on.** It's not a missing feature — it's a *deliberate exclusion*, stated identically in `AGENTS.md:65` and `README.md:89`:
+
+> Structural extraction and graph queries must continue to work without Python, model credentials, **embeddings, a vector database**, runtime grammar downloads, or Graphify.
+
+That's a product invariant, and it's the differentiator in the README's own positioning against Graphify. Vector search isn't absent because nobody got to it; it's absent because deterministic structural evidence with provenance is the claim. Grepping confirms no embedding code exists anywhere.
+
+Adding vectors *as an optional layer* wouldn't violate the letter of the invariant. But it changes what Compass is, and that's your call to make explicitly rather than as a side effect of picking a storage backend.
+
+## Where it doesn't help
+
+For the problem in front of us — a 2 GiB canonical payload — SurrealDB wouldn't fix it. The failure is `digest_json` capping serialization of one monolithic `CanonicalGraphDocument`, plus a read path that materialized the whole thing. That's Compass's own encoding, above any storage layer. Swapping SQLite for SurrealDB leaves it exactly where it is.
+
+There's also real cost: SurrealDB pulls a large dependency tree into a product whose stated identity is "one native Rust executable," and the `Store` trait is **synchronous** while SurrealDB is async — you'd need that bounded blocking boundary the docs mention, which is doable but not free.
+
+## My recommendation
+
+Don't fold this into the current phase. C-001 is half-implemented (two compile errors away from tests running), and the sequencing gate on C-004 still holds regardless of backend.
+
+If you want to pursue it, I'd scope it as its own phase with the two questions separated:
+
+1. **`compass-store-surrealdb` adapter** — evaluated against `compass-store-redb` as the precedent. Bounded, reversible, fits the design.
+2. **Vector/embedding support** — a product-direction decision that needs `AGENTS.md` and `README.md` amended first, since both currently promise its absence.
+
+Want me to finish C-001 first, or park it and run `/kbd-new-phase` on the SurrealDB question now? I'd finish C-001 — it's close, and it's the actual fix for the failure that started this.
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+- Captured: 2026-08-09T12:55:13.042640Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .prometheus/knowledge/wiki/index.md
+- .prometheus/knowledge/wiki/log.md
+- crates/compass-store/src/lib.rs
+- .prometheus/knowledge/wiki/karpathy-session-e0ee5520d0620fb6.md
diff --git a/.prometheus/knowledge/wiki/karpathy-session-2143b246d1cf0ba5.md b/.prometheus/knowledge/wiki/karpathy-session-2143b246d1cf0ba5.md
new file mode 100644
index 000000000..b8af1a41f
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-2143b246d1cf0ba5.md
@@ -0,0 +1,101 @@
+---
+type: SessionRecord
+id: karpathy-session-2143b246d1cf0ba5
+title: Karpathy session 2143b246d1cf
+tags:
+- karpathy
+- session-learning
+sources:
+- session:f5bc84e3-1901-40c0-9330-f98003584919
+timestamp: 2026-08-28T12:39:30.834735+00:00
+created_at: 2026-08-28T12:39:30.834735+00:00
+updated_at: 2026-08-28T12:39:30.834735+00:00
+revision: 0
+---
+
+## Delta
+
+Completed kbd-plan — compass-scoping-and-bounds (step 0 of 20)
+
+## Plan re-run complete
+
+[plan.md](.kbd-orchestrator/phases/compass-scoping-and-bounds/plan.md) now carries **20 changes across 8 waves** — the six original changes preserved verbatim (they were already vetted), fourteen added for the expanded scope:
+
+| Wave | Changes | Gate |
+|---|---|---|
+| 1 | C-001 read-path split *(verify-first)*, C-002 error text, C-003 size estimate, C-006 vendor policy | — |
+| 2 | C-004 env override, C-005 `compass-partition` | HARD: C-001 |
+| 3 | C-007 `rmcp =3.1.4`, C-008 stateless HTTP, C-009 result envelope, C-010 conformance+interop | interop is the merge gate |
+| 4 | C-011 **BSL license decision (yours/legal — not code)**, C-012 persistent probes, C-013 corpora + budget ratification | blocks Wave 5 |
+| 5 | C-014 Surreal projection crate, C-015 dual-engine equivalence | HARD: C-011+C-012+C-013 |
+| 6 | C-016 focused skills, C-017 `compass agent` CLI | parallelizable with 4–5 |
+| 7 | C-018 distribution inventory+generators, C-019 install validation | HARD: C-010 |
+| 8 | C-020 Store adapter | **conditional** — dropped at 19 changes unless a user problem is recorded |
+
+**Adversarial review:** round 1 **BLOCK** (1 CRITICAL — the settled partitioning-vs-larger-number verdict wasn't in the plan; now a top-of-plan section) → all four findings fixed → round 2 **PASS**. The three r2 WARNINGs were fixed in-place rather than carried: Claude marketplace is now a required C-018 deliverable per goals E6, C-003 got a baseline-first measurable time-to-error criterion, and C-018 gained its hard dependency on C-010.
+
+**Ledger and waypoint refreshed:** `progress.json` 0/20; typed stage entry committed (`prometheus kbd stage enter`, revision 3, local commit — control plane unreachable, which is normal here); handoff written for execute.
+
+Two things that remain yours, not the pipeline's:
+1. **C-011** — the SurrealDB BSL decision needs your (or legal) sign-off; everything Surreal-flavored is parked behind it.
+2. **Mode assumption** — the plan assumes fork-local implementation; upstream PR submission follows your contribution plan as exit work. Say so if you intended upstream-first instead, and Wave ordering changes (PR-0 becomes the first gate).
+
+**Next:** `/kbd-execute` (per the orchestrator), which will start Wave 1 with `/opsx:new stream-snapshot-read` — beginning with the verify-first check on the uncommitted C-001 diff.
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: f5bc84e3-1901-40c0-9330-f98003584919
+- Captured: 2026-08-28T12:39:30.028149Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .claude/commands/opsx/apply.md
+- .claude/commands/opsx/archive.md
+- .claude/commands/opsx/bulk-archive.md
+- .claude/commands/opsx/continue.md
+- .claude/commands/opsx/explore.md
+- .claude/commands/opsx/ff.md
+- .claude/commands/opsx/new.md
+- .claude/commands/opsx/onboard.md
+- .claude/commands/opsx/sync.md
+- .claude/commands/opsx/verify.md
+- .claude/skills/openspec-apply-change/SKILL.md
+- .claude/skills/openspec-archive-change/SKILL.md
+- .claude/skills/openspec-bulk-archive-change/SKILL.md
+- .claude/skills/openspec-continue-change/SKILL.md
+- .claude/skills/openspec-explore/SKILL.md
+- .claude/skills/openspec-ff-change/SKILL.md
+- .claude/skills/openspec-new-change/SKILL.md
+- .claude/skills/openspec-onboard/SKILL.md
+- .claude/skills/openspec-sync-specs/SKILL.md
+- .claude/skills/openspec-verify-change/SKILL.md
+- .codex/skills/openspec-apply-change/SKILL.md
+- .codex/skills/openspec-archive-change/SKILL.md
+- .codex/skills/openspec-bulk-archive-change/SKILL.md
+- .codex/skills/openspec-continue-change/SKILL.md
+- .codex/skills/openspec-explore/SKILL.md
+- .codex/skills/openspec-ff-change/SKILL.md
+- .codex/skills/openspec-new-change/SKILL.md
+- .codex/skills/openspec-onboard/SKILL.md
+- .codex/skills/openspec-sync-specs/SKILL.md
+- .codex/skills/openspec-verify-change/SKILL.md
+- .kbd-orchestrator/current-waypoint.json
+- .kbd-orchestrator/current-waypoint.md
+- .kbd-orchestrator/model-preflight.json
+- .kbd-orchestrator/phases/compass-scoping-and-bounds/assessment.md
+- .kbd-orchestrator/phases/compass-scoping-and-bounds/goals.md
+- .kbd-orchestrator/phases/compass-scoping-and-bounds/plan.md
+- .kbd-orchestrator/phases/compass-scoping-and-bounds/progress.json
+- .kbd-orchestrator/project.json
+- .kimi/skills/openspec-apply-change/SKILL.md
+- .kimi/skills/openspec-archive-change/SKILL.md
diff --git a/.prometheus/knowledge/wiki/karpathy-session-361f6082f855b168.md b/.prometheus/knowledge/wiki/karpathy-session-361f6082f855b168.md
new file mode 100644
index 000000000..26b3101be
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-361f6082f855b168.md
@@ -0,0 +1,98 @@
+---
+type: SessionRecord
+id: karpathy-session-361f6082f855b168
+title: Karpathy session 361f6082f855
+tags:
+- karpathy
+- session-learning
+sources:
+- session:f5bc84e3-1901-40c0-9330-f98003584919
+timestamp: 2026-08-28T12:10:19.068465+00:00
+created_at: 2026-08-28T12:10:19.068465+00:00
+updated_at: 2026-08-28T12:10:19.068465+00:00
+revision: 0
+---
+
+## Delta
+
+Completed kbd-init — Compass
+
+KBD was already initialized, so this was a targeted repair rather than a re-init. Two changes to [project.json](.kbd-orchestrator/project.json), exactly as scoped:
+
+1. **`active_phase` → `activePhase`** — the schema declares `"not": {"required": ["active_phase"]}`, so the old key violated the writer contract. Nothing was broken at runtime (readers explicitly fall back to the legacy key), but the file now conforms. The value is unchanged and still matches the live phase directory.
+
+2. **Five `creator-*` model_policy entries added** — new in the 1.7.0 template; your file predated them. Now 25 phase entries, up from 20.
+
+Everything else is untouched: active phase pointer, `preferred_planning_agent: "claude"`, your Compass-tuned model policy, agents_config, and all build/test/lint commands. Backup at `scratchpad/project.json.bak`.
+
+Validator: `configuration valid; execution prerequisites ready`. The phase directory `compass-scoping-and-bounds/` is intact — all ten files including `progress.json` and `tasks.json`.
+
+I need to correct one thing from my analysis before the confirmation: I listed `worktreeRoot` and `maxChildDepth` as missing. They were already present on lines 5–6. Only two of the four changes I proposed were real.
+
+Three things I did **not** change, which you should know about:
+
+- **`creator-execute` is set to `"tiered"`**, copied verbatim from the template. But `"tiered"` isn't a key in your `registry` block, which only defines `small`/`medium`/`frontier`. It appears nowhere in the skill pack except the templates themselves. This looks like an upstream template defect — it will likely fail to resolve if `creator-execute` ever runs. I copied it rather than substituting a guess. Worth raising with the skill-pack maintainer.
+
+- **`openspec/specs/` is empty**, so `spec_paths: ["openspec/specs/*.md"]` currently matches nothing while `openspec_available: true`. Aspirational, not an error — but any KBD step that reads specs will find none.
+
+- **`AGENTS.md` has no "Never Do" section**, so I couldn't re-derive constraints from it. The existing [constraints.md](.kbd-orchestrator/constraints.md) came from somewhere else and I left it alone.
+
+Next: `/kbd-status` to confirm orchestrator state, or `/kbd-assess` since a phase is already active.
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: f5bc84e3-1901-40c0-9330-f98003584919
+- Captured: 2026-08-28T12:10:18.527210Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .claude/commands/opsx/apply.md
+- .claude/commands/opsx/archive.md
+- .claude/commands/opsx/bulk-archive.md
+- .claude/commands/opsx/continue.md
+- .claude/commands/opsx/explore.md
+- .claude/commands/opsx/ff.md
+- .claude/commands/opsx/new.md
+- .claude/commands/opsx/onboard.md
+- .claude/commands/opsx/sync.md
+- .claude/commands/opsx/verify.md
+- .claude/skills/openspec-apply-change/SKILL.md
+- .claude/skills/openspec-archive-change/SKILL.md
+- .claude/skills/openspec-bulk-archive-change/SKILL.md
+- .claude/skills/openspec-continue-change/SKILL.md
+- .claude/skills/openspec-explore/SKILL.md
+- .claude/skills/openspec-ff-change/SKILL.md
+- .claude/skills/openspec-new-change/SKILL.md
+- .claude/skills/openspec-onboard/SKILL.md
+- .claude/skills/openspec-sync-specs/SKILL.md
+- .claude/skills/openspec-verify-change/SKILL.md
+- .codex/skills/openspec-apply-change/SKILL.md
+- .codex/skills/openspec-archive-change/SKILL.md
+- .codex/skills/openspec-bulk-archive-change/SKILL.md
+- .codex/skills/openspec-continue-change/SKILL.md
+- .codex/skills/openspec-explore/SKILL.md
+- .codex/skills/openspec-ff-change/SKILL.md
+- .codex/skills/openspec-new-change/SKILL.md
+- .codex/skills/openspec-onboard/SKILL.md
+- .codex/skills/openspec-sync-specs/SKILL.md
+- .codex/skills/openspec-verify-change/SKILL.md
+- .kbd-orchestrator/project.json
+- .kimi/skills/openspec-apply-change/SKILL.md
+- .kimi/skills/openspec-archive-change/SKILL.md
+- .kimi/skills/openspec-bulk-archive-change/SKILL.md
+- .kimi/skills/openspec-continue-change/SKILL.md
+- .kimi/skills/openspec-explore/SKILL.md
+- .kimi/skills/openspec-ff-change/SKILL.md
+- .kimi/skills/openspec-new-change/SKILL.md
+- .kimi/skills/openspec-onboard/SKILL.md
+- .kimi/skills/openspec-sync-specs/SKILL.md
diff --git a/.prometheus/knowledge/wiki/karpathy-session-6c67c5011b34fce2.md b/.prometheus/knowledge/wiki/karpathy-session-6c67c5011b34fce2.md
new file mode 100644
index 000000000..c925ae448
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-6c67c5011b34fce2.md
@@ -0,0 +1,101 @@
+---
+type: SessionRecord
+id: karpathy-session-6c67c5011b34fce2
+title: Karpathy session 6c67c5011b34
+tags:
+- karpathy
+- session-learning
+sources:
+- session:f5bc84e3-1901-40c0-9330-f98003584919
+timestamp: 2026-08-28T12:05:02.766538+00:00
+created_at: 2026-08-28T12:05:02.766538+00:00
+updated_at: 2026-08-28T12:05:02.766538+00:00
+revision: 0
+---
+
+## Delta
+
+Done. OpenSpec 1.10.0 is now wired up for all six tools.
+
+**What was already there:** `openspec/` existed (config.yaml, specs, changes/archive) — this was a refresh, not a fresh init. Skills were upgraded from 1.6.0 to 1.10.0 in the process.
+
+**What each tool got:**
+
+| Tool | Skills | Commands |
+|---|---|---|
+| Codex | `.agents/skills/` | uses skills (no separate commands) |
+| Claude Code | `.claude/skills/` | `.claude/commands/opsx/` → `/opsx:new` |
+| Kimi Code | `.kimi-code/skills/` | none (no adapter) |
+| OpenCode | `.opencode/skills/` | `.opencode/commands/` → `/opsx-new` |
+| Zed | `.agents/skills/` (shared with Codex) | — |
+| MiniMax Code | `~/.minimax/skills/` (global, not repo-local) | none (no adapter) |
+
+Three things worth flagging:
+
+1. **Zed shares Codex's tree.** The CLI wrote one `.agents/skills/` for both, which is why Zed didn't appear in the "Refreshed" line. Your existing [.zed/settings.json](.zed/settings.json) (the Compass MCP server) was left alone.
+
+2. **Kimi skills landed in a new directory.** OpenSpec 1.10.0 writes to `.kimi-code/`, not `.kimi/`. Git shows the ten `.kimi/skills/openspec-*` files as deleted, with new copies under `.kimi-code/`. Your `.kimi/skills/compass/` and `.kimi/mcp.json` are untouched.
+
+3. **MiniMax went global.** Its skills went to `~/.minimax/skills`, outside this repo — so they won't be committed or shared with collaborators.
+
+I removed the ten stale `.codex/skills/` duplicates as you approved; `.codex/config.toml` and `.codex/hooks.json` are untouched.
+
+`openspec doctor` reports the root as ok, and `openspec list` shows no active changes. Nothing is committed — the changes are staged in the working tree for you to review. Start a change with `/opsx:new "your idea"` here in Claude Code.
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: f5bc84e3-1901-40c0-9330-f98003584919
+- Captured: 2026-08-28T12:05:01.797680Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .claude/commands/opsx/apply.md
+- .claude/commands/opsx/archive.md
+- .claude/commands/opsx/bulk-archive.md
+- .claude/commands/opsx/continue.md
+- .claude/commands/opsx/explore.md
+- .claude/commands/opsx/ff.md
+- .claude/commands/opsx/new.md
+- .claude/commands/opsx/onboard.md
+- .claude/commands/opsx/sync.md
+- .claude/commands/opsx/verify.md
+- .claude/skills/openspec-apply-change/SKILL.md
+- .claude/skills/openspec-archive-change/SKILL.md
+- .claude/skills/openspec-bulk-archive-change/SKILL.md
+- .claude/skills/openspec-continue-change/SKILL.md
+- .claude/skills/openspec-explore/SKILL.md
+- .claude/skills/openspec-ff-change/SKILL.md
+- .claude/skills/openspec-new-change/SKILL.md
+- .claude/skills/openspec-onboard/SKILL.md
+- .claude/skills/openspec-sync-specs/SKILL.md
+- .claude/skills/openspec-verify-change/SKILL.md
+- .codex/skills/openspec-apply-change/SKILL.md
+- .codex/skills/openspec-archive-change/SKILL.md
+- .codex/skills/openspec-bulk-archive-change/SKILL.md
+- .codex/skills/openspec-continue-change/SKILL.md
+- .codex/skills/openspec-explore/SKILL.md
+- .codex/skills/openspec-ff-change/SKILL.md
+- .codex/skills/openspec-new-change/SKILL.md
+- .codex/skills/openspec-onboard/SKILL.md
+- .codex/skills/openspec-sync-specs/SKILL.md
+- .codex/skills/openspec-verify-change/SKILL.md
+- .kimi/skills/openspec-apply-change/SKILL.md
+- .kimi/skills/openspec-archive-change/SKILL.md
+- .kimi/skills/openspec-bulk-archive-change/SKILL.md
+- .kimi/skills/openspec-continue-change/SKILL.md
+- .kimi/skills/openspec-explore/SKILL.md
+- .kimi/skills/openspec-ff-change/SKILL.md
+- .kimi/skills/openspec-new-change/SKILL.md
+- .kimi/skills/openspec-onboard/SKILL.md
+- .kimi/skills/openspec-sync-specs/SKILL.md
+- .kimi/skills/openspec-verify-change/SKILL.md
diff --git a/.prometheus/knowledge/wiki/karpathy-session-6f294af7050aa95f.md b/.prometheus/knowledge/wiki/karpathy-session-6f294af7050aa95f.md
new file mode 100644
index 000000000..0ea6eea4b
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-6f294af7050aa95f.md
@@ -0,0 +1,70 @@
+---
+type: SessionRecord
+id: karpathy-session-6f294af7050aa95f
+title: Karpathy session 6f294af7050a
+tags:
+- karpathy
+- session-learning
+sources:
+- session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+timestamp: 2026-08-09T13:31:58.881892+00:00
+created_at: 2026-08-09T13:31:58.881892+00:00
+updated_at: 2026-08-09T13:31:58.881892+00:00
+revision: 0
+---
+
+## Delta
+
+Still compiling heavy dependencies — tree-sitter pack, AWS SDK, candle. This is a cold build and will take a while. Let me report where things stand.
+
+**C-001 is implemented and verified at the crate level.** What's done:
+
+**The change** (`crates/compass-store/src/lib.rs`):
+- **`read_snapshot_manifest()`** — reads and validates the manifest without touching chunk objects. Zero payload allocation.
+- **`read_snapshot_chunks(f)`** — streams stored chunks one at a time through a callback, hashing incrementally with `Sha256`. Keeps the running total and `MAX_GRAPH_BYTES` check, and verifies length and digest after the final chunk.
+- **`read_snapshot()`** — kept as the explicit opt-in that materializes, now implemented *on top of* the streaming form rather than duplicating the loop.
+- **`validate_snapshot`** → `read_snapshot_chunks(|_| Ok(()))` — still verifies full payload integrity, but no longer allocates.
+- **`snapshot_reference`** → `read_snapshot_manifest()` — metadata only, as it always needed.
+- **The doc comment corrected.** It claimed records were served "through indexed scans instead of materializing" — untrue of `read_snapshot`. It now names which paths stream and which one deliberately allocates.
+
+**Three new tests**, all passing (16/16 in the crate):
+- `snapshot_manifest_read_matches_full_read` — manifest-only equals full read, multi-chunk payload
+- `snapshot_chunks_stream_without_materializing_payload` — asserts no single chunk carries the whole payload and each stays within `CHUNK_BYTES`
+- `snapshot_reads_reject_a_missing_chunk` — deletes a chunk row directly in SQLite; manifest read still succeeds (it never touches chunks), while all three payload paths correctly fail
+
+**Gates passed so far:** `cargo fmt --all --check`, `cargo clippy -p compass-store --all-targets --all-features -- -D warnings`, and the full `cargo clippy --workspace --lib --bins -- -D warnings` (5 min, clean).
+
+**Still running:** `cargo test --workspace --lib --bins` — cold build, currently compiling the tree-sitter pack and AWS/candle deps. No failures so far. I'll report when it lands rather than claim it passed.
+
+I also wrote **`docs/future/SURREAL_DB.md`**. It splits the idea in two, because they have different answers: Proposal A (store backend adapter) is architecturally supported — `compass-store` is explicitly backend-neutral and `compass-store-redb` proves the precedent — with open questions on the sync/async boundary, dependency weight, and determinism. Proposal B (vectors) is flagged as a *documented product exclusion* in both `AGENTS.md` and `README.md`, so adopting it means amending those first. The doc also notes plainly that neither would have fixed the 2 GiB failure.
+
+Nothing committed yet — I'll commit once the workspace tests confirm.
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+- Captured: 2026-08-09T13:31:56.624467Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .prometheus/events.jsonl
+- .prometheus/knowledge/.prompt-snapshots/project/current
+- .prometheus/knowledge/wiki/index.md
+- .prometheus/knowledge/wiki/log.md
+- crates/compass-store/src/lib.rs
+- .prometheus/knowledge/.prompt-snapshots/project/generations/f5b230286eabe44bedd0546b2e237d0a3ed3a31240c91bc789181d67a54e19cc.json
+- .prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-completion-record.md
+- .prometheus/knowledge/wiki/karpathy-session-1ecfe43654c6f90b.md
+- .prometheus/knowledge/wiki/karpathy-session-e0ee5520d0620fb6.md
+- .prometheus/knowledge/wiki/karpathy-session-e9325c7eec4c9735.md
+- docs/future/
diff --git a/.prometheus/knowledge/wiki/karpathy-session-a217668de21b25d6.md b/.prometheus/knowledge/wiki/karpathy-session-a217668de21b25d6.md
new file mode 100644
index 000000000..62a906201
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-a217668de21b25d6.md
@@ -0,0 +1,135 @@
+---
+type: SessionRecord
+id: karpathy-session-a217668de21b25d6
+title: Karpathy session a217668de21b
+tags:
+- karpathy
+- session-learning
+sources:
+- session:f5bc84e3-1901-40c0-9330-f98003584919
+timestamp: 2026-08-28T12:11:29.608800+00:00
+created_at: 2026-08-28T12:11:29.608800+00:00
+updated_at: 2026-08-28T12:11:29.608800+00:00
+revision: 0
+---
+
+## Delta
+
+Confirmed. Rendering status.
+
+```
+KBD STATUS — Compass
+phase: compass-scoping-and-bounds
+worktree: /Users/gqadonis/Projects/references/compass  ⚠ outside worktreeRoot (/Users/gqadonis/.claude/worktrees)
+Last updated by: claude (2026-08-09T12:27:19Z)
+
+Implementation: 0/6 PENDING
+Evidence:       NOT_STARTED
+Certification:  NOT_TRACKED
+Publication:    NOT_TRACKED
+
+Stage: plan_ready  (assessment ✅ · plan ✅ · execution ⬜ · reflection ⬜)
+Backend: openspec · wave 1
+
+Goals:
+  [⬜] G1 — Honor COMPASS_MAX_GRAPH_BYTES on publication path      → C-004
+  [⬜] G2 — Make the limit error actionable                        → C-002
+  [⬜] G3 — Fail fast (don't burn 331s on a doomed build)          → C-003
+  [⬜] G4 — Decide vendor/ default-skip policy                     → C-006
+
+Changes:
+  Wave 1 (parallel, no dependencies)
+  PENDING: C-001 Stop materializing snapshot payload in read_snapshot   ⚠ see below
+  PENDING: C-002 Make snapshot limit error actionable
+  PENDING: C-003 Pre-flight graph size estimate
+  PENDING: C-006 Decide vendor/ default-skip policy
+
+  Wave 2 (HARD GATE on C-001)
+  PENDING: C-004 Honor COMPASS_MAX_GRAPH_BYTES on publication path
+  PENDING: C-005 Extract compass-partition shared crate
+
+Next action (from waypoint): /opsx:new stream-snapshot-read
+```
+
+**Decision log** (6 entries, dense — `ux_profile: advanced`):
+
+```
+2026-08-09T12:03:31Z · Scoping rejected as a feature              [Assess]
+2026-08-09T12:03:31Z · Sharding rejected                          [Analyze]
+2026-08-09T12:03:31Z · Partitioning already exists                [Analyze]
+2026-08-09T12:03:31Z · Read-path allocation is the true constraint [Analyze]
+2026-08-09T12:21:35Z · PartitionedGraph → shared crate (user)     [Analyze]
+2026-08-09T12:21:35Z · Consumer audit changes C-001 scope         [Spec]
+```
+
+Two things the ledger doesn't reflect, both worth your attention before you run the next command:
+
+**1. C-001 appears to be substantially implemented but is recorded as `pending`.** [crates/compass-store/src/lib.rs](crates/compass-store/src/lib.rs) has 152 uncommitted insertions that match C-001's spec precisely — `read_snapshot` split into `read_snapshot_manifest()` plus a streaming `read_snapshot_chunks()`, with `MAX_GRAPH_BYTES` docs updated to describe the opt-in allocation. That is the API split the Spec-stage decision entry describes.
+
+It is uncommitted, has no OpenSpec change backing it (`openspec/changes/` holds only an empty `archive/`), and `execution_dispatched: false`. So the waypoint's `/opsx:new stream-snapshot-read` would open a change for work that already largely exists in the tree. I have not verified the edit compiles or is complete — only that it exists and matches the spec's shape.
+
+**2. The worktree warning is real but probably benign.** You're in the main checkout, not under `worktreeRoot`. That's expected for direct work; it only matters if the phase intended isolated worktrees per change.
+
+Also worth noting: the branch is `docs/claude-md`, which doesn't match the phase's subject matter — the C-001 edit is sitting on a docs branch.
+
+Given the drift, `/opsx:new stream-snapshot-read` is likely the wrong next step as-is. The choices are to reconcile first (inspect the diff fully, then either commit it under a properly-created change or reset it), or to proceed and let the new change absorb the existing edit. I'd reconcile — but tell me which you want.
+
+Completed kbd-status — compass-scoping-and-bounds
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: f5bc84e3-1901-40c0-9330-f98003584919
+- Captured: 2026-08-28T12:11:28.836043Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .claude/commands/opsx/apply.md
+- .claude/commands/opsx/archive.md
+- .claude/commands/opsx/bulk-archive.md
+- .claude/commands/opsx/continue.md
+- .claude/commands/opsx/explore.md
+- .claude/commands/opsx/ff.md
+- .claude/commands/opsx/new.md
+- .claude/commands/opsx/onboard.md
+- .claude/commands/opsx/sync.md
+- .claude/commands/opsx/verify.md
+- .claude/skills/openspec-apply-change/SKILL.md
+- .claude/skills/openspec-archive-change/SKILL.md
+- .claude/skills/openspec-bulk-archive-change/SKILL.md
+- .claude/skills/openspec-continue-change/SKILL.md
+- .claude/skills/openspec-explore/SKILL.md
+- .claude/skills/openspec-ff-change/SKILL.md
+- .claude/skills/openspec-new-change/SKILL.md
+- .claude/skills/openspec-onboard/SKILL.md
+- .claude/skills/openspec-sync-specs/SKILL.md
+- .claude/skills/openspec-verify-change/SKILL.md
+- .codex/skills/openspec-apply-change/SKILL.md
+- .codex/skills/openspec-archive-change/SKILL.md
+- .codex/skills/openspec-bulk-archive-change/SKILL.md
+- .codex/skills/openspec-continue-change/SKILL.md
+- .codex/skills/openspec-explore/SKILL.md
+- .codex/skills/openspec-ff-change/SKILL.md
+- .codex/skills/openspec-new-change/SKILL.md
+- .codex/skills/openspec-onboard/SKILL.md
+- .codex/skills/openspec-sync-specs/SKILL.md
+- .codex/skills/openspec-verify-change/SKILL.md
+- .kbd-orchestrator/project.json
+- .kimi/skills/openspec-apply-change/SKILL.md
+- .kimi/skills/openspec-archive-change/SKILL.md
+- .kimi/skills/openspec-bulk-archive-change/SKILL.md
+- .kimi/skills/openspec-continue-change/SKILL.md
+- .kimi/skills/openspec-explore/SKILL.md
+- .kimi/skills/openspec-ff-change/SKILL.md
+- .kimi/skills/openspec-new-change/SKILL.md
+- .kimi/skills/openspec-onboard/SKILL.md
+- .kimi/skills/openspec-sync-specs/SKILL.md
diff --git a/.prometheus/knowledge/wiki/karpathy-session-d968e02c779c42b0.md b/.prometheus/knowledge/wiki/karpathy-session-d968e02c779c42b0.md
new file mode 100644
index 000000000..8eaf01b44
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-d968e02c779c42b0.md
@@ -0,0 +1,97 @@
+---
+type: SessionRecord
+id: karpathy-session-d968e02c779c42b0
+title: Karpathy session d968e02c779c
+tags:
+- karpathy
+- session-learning
+sources:
+- session:f5bc84e3-1901-40c0-9330-f98003584919
+timestamp: 2026-08-28T12:27:30.414237+00:00
+created_at: 2026-08-28T12:27:30.414237+00:00
+updated_at: 2026-08-28T12:27:30.414237+00:00
+revision: 0
+---
+
+## Delta
+
+Completed adversarial-review — BLOCK→accepted-with-findings (1/3/0 unresolved after 2 rounds)
+
+Completed kbd-assess — compass-scoping-and-bounds (step 0 of 6)
+
+## What was done
+
+**Re-assessment written** to [assessment.md](.kbd-orchestrator/phases/compass-scoping-and-bounds/assessment.md), and the expanded scope formally recorded in [goals.md](.kbd-orchestrator/phases/compass-scoping-and-bounds/goals.md) as a dated user decision (E1–E7 added to the original G1–G4).
+
+**Research (Firecrawl, validated today):** every load-bearing external fact in the notes holds — `rmcp 3.1.4` (2026-08-20) is current and implements the stable MCP `2026-07-28` spec; that spec retired `initialize` and `Mcp-Session-Id`, which makes compass-mcp's shipped session-based HTTP a **legacy contract, not just outdated**; SurrealDB 3.2.4 is latest stable. Codebase verification confirmed the seams: `rmcp 2.2.0` pinned, no surreal deps, `compass-graphdb`/`compass-store-redb`/qualification crates all real precedents.
+
+**Adversarial review (isolated cross-model, judge `kbd-judge` ≠ producer, verified-distinct):**
+- **Round 1: BLOCK (2 CRITICAL)** — both legitimate and fixed: the expanded scope wasn't in `goals.md` (now is), and the phase's required partitioning-vs-larger-number verdict was missing from the assessment (now stated explicitly: neither — eliminate the read-path allocation; partitioning already ships).
+- **Round 2: BLOCK (1 CRITICAL)** — accepted-unresolved per the two-round cap: the judge can't verify the uncommitted C-001 diff because artifact packets carry no git state (a packet-builder gap, noted for upstream). Disposition recorded: C-001 formalization must **verify-first** (`git diff` + `cargo check -p compass-store --locked`) before absorbing the diff.
+- **Sycophancy screen:** the bundled gate lib was missing both rounds, so I ran the sycophancy-correction MCP tool directly on the assessment: **score 0.0, clean**.
+
+## What the assessment says (short version)
+
+The expanded phase is implementable — but three gates are not code: the **SurrealDB BSL license decision**, **numeric-budget ratification before measuring**, and (if you intend upstream landing rather than fork-local work) **maintainer agreement**. That last ambiguity — fork-local vs upstream — is flagged for the plan stage to resolve; I assumed fork-local. Recommended structure: 8 waves with per-wave verify/reflect, original C-001…C-006 first, MCP migration (urgent) third, everything SurrealDB behind the license/probe gate.
+
+Worth stating plainly: your own notes advise running this as a separate phase, and that reasoning remains technically sound. The assessment records your directive as overriding it and structures the risk accordingly rather than pretending the tension away.
+
+**Next:** `/kbd-plan compass-scoping-and-bounds` to regenerate the change list against the expanded goals (the orchestrator hook says the same). The stale waypoint (`/opsx:new stream-snapshot-read`) will be rewritten by the plan stage.
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: f5bc84e3-1901-40c0-9330-f98003584919
+- Captured: 2026-08-28T12:27:29.657568Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .claude/commands/opsx/apply.md
+- .claude/commands/opsx/archive.md
+- .claude/commands/opsx/bulk-archive.md
+- .claude/commands/opsx/continue.md
+- .claude/commands/opsx/explore.md
+- .claude/commands/opsx/ff.md
+- .claude/commands/opsx/new.md
+- .claude/commands/opsx/onboard.md
+- .claude/commands/opsx/sync.md
+- .claude/commands/opsx/verify.md
+- .claude/skills/openspec-apply-change/SKILL.md
+- .claude/skills/openspec-archive-change/SKILL.md
+- .claude/skills/openspec-bulk-archive-change/SKILL.md
+- .claude/skills/openspec-continue-change/SKILL.md
+- .claude/skills/openspec-explore/SKILL.md
+- .claude/skills/openspec-ff-change/SKILL.md
+- .claude/skills/openspec-new-change/SKILL.md
+- .claude/skills/openspec-onboard/SKILL.md
+- .claude/skills/openspec-sync-specs/SKILL.md
+- .claude/skills/openspec-verify-change/SKILL.md
+- .codex/skills/openspec-apply-change/SKILL.md
+- .codex/skills/openspec-archive-change/SKILL.md
+- .codex/skills/openspec-bulk-archive-change/SKILL.md
+- .codex/skills/openspec-continue-change/SKILL.md
+- .codex/skills/openspec-explore/SKILL.md
+- .codex/skills/openspec-ff-change/SKILL.md
+- .codex/skills/openspec-new-change/SKILL.md
+- .codex/skills/openspec-onboard/SKILL.md
+- .codex/skills/openspec-sync-specs/SKILL.md
+- .codex/skills/openspec-verify-change/SKILL.md
+- .kbd-orchestrator/model-preflight.json
+- .kbd-orchestrator/phases/compass-scoping-and-bounds/assessment.md
+- .kbd-orchestrator/phases/compass-scoping-and-bounds/goals.md
+- .kbd-orchestrator/phases/compass-scoping-and-bounds/progress.json
+- .kbd-orchestrator/project.json
+- .kimi/skills/openspec-apply-change/SKILL.md
+- .kimi/skills/openspec-archive-change/SKILL.md
+- .kimi/skills/openspec-bulk-archive-change/SKILL.md
+- .kimi/skills/openspec-continue-change/SKILL.md
+- .kimi/skills/openspec-explore/SKILL.md
diff --git a/.prometheus/knowledge/wiki/karpathy-session-e0ee5520d0620fb6.md b/.prometheus/knowledge/wiki/karpathy-session-e0ee5520d0620fb6.md
new file mode 100644
index 000000000..467d44827
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-e0ee5520d0620fb6.md
@@ -0,0 +1,37 @@
+---
+type: SessionRecord
+id: karpathy-session-e0ee5520d0620fb6
+title: Karpathy session e0ee5520d062
+tags:
+- karpathy
+- session-learning
+sources:
+- session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+timestamp: 2026-08-09T12:49:55.860955+00:00
+created_at: 2026-08-09T12:49:55.860955+00:00
+updated_at: 2026-08-09T12:49:55.860955+00:00
+revision: 0
+---
+
+## Delta
+
+`validate_snapshot` must still verify payload integrity, so it streams rather than skipping chunks. `snapshot_reference` only needs metadata:
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+- Captured: 2026-08-09T12:44:52.957043Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- crates/compass-store/src/lib.rs
diff --git a/.prometheus/knowledge/wiki/karpathy-session-e9325c7eec4c9735.md b/.prometheus/knowledge/wiki/karpathy-session-e9325c7eec4c9735.md
new file mode 100644
index 000000000..cbdbb841c
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-e9325c7eec4c9735.md
@@ -0,0 +1,74 @@
+---
+type: SessionRecord
+id: karpathy-session-e9325c7eec4c9735
+title: Karpathy session e9325c7eec4c
+tags:
+- karpathy
+- session-learning
+sources:
+- session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+timestamp: 2026-08-09T12:55:24.073382+00:00
+created_at: 2026-08-09T12:55:24.073382+00:00
+updated_at: 2026-08-09T12:55:24.073382+00:00
+revision: 0
+---
+
+## Delta
+
+SurrealDB 3.2.4 confirmed. Here's my honest read.
+
+## The architecture already anticipates this
+
+`compass-store` is documented as **"Backend-neutral, namespace-scoped storage"** with a `Store` trait, and it explicitly says: *"Other backends can implement `Store` without importing Compass graph records or query code"* and *"A remote adapter may put a bounded blocking boundary around its client."* `compass-store-redb` (869 lines) already proves a second backend works. So a `compass-store-surrealdb` adapter is a **supported extension point**, not a fight with the design.
+
+## But the framing needs splitting — the two halves have opposite answers
+
+**Storage backend: plausible, and cleanly so.** SurrealDB embedded (SurrealKV/RocksDB) with a remote option maps onto the existing trait. Your "embedded with an option for remote" instinct matches what the crate doc already contemplates.
+
+**Vector support: this is the part I'd push back on.** It's not a missing feature — it's a *deliberate exclusion*, stated identically in `AGENTS.md:65` and `README.md:89`:
+
+> Structural extraction and graph queries must continue to work without Python, model credentials, **embeddings, a vector database**, runtime grammar downloads, or Graphify.
+
+That's a product invariant, and it's the differentiator in the README's own positioning against Graphify. Vector search isn't absent because nobody got to it; it's absent because deterministic structural evidence with provenance is the claim. Grepping confirms no embedding code exists anywhere.
+
+Adding vectors *as an optional layer* wouldn't violate the letter of the invariant. But it changes what Compass is, and that's your call to make explicitly rather than as a side effect of picking a storage backend.
+
+## Where it doesn't help
+
+For the problem in front of us — a 2 GiB canonical payload — SurrealDB wouldn't fix it. The failure is `digest_json` capping serialization of one monolithic `CanonicalGraphDocument`, plus a read path that materialized the whole thing. That's Compass's own encoding, above any storage layer. Swapping SQLite for SurrealDB leaves it exactly where it is.
+
+There's also real cost: SurrealDB pulls a large dependency tree into a product whose stated identity is "one native Rust executable," and the `Store` trait is **synchronous** while SurrealDB is async — you'd need that bounded blocking boundary the docs mention, which is doable but not free.
+
+## My recommendation
+
+Don't fold this into the current phase. C-001 is half-implemented (two compile errors away from tests running), and the sequencing gate on C-004 still holds regardless of backend.
+
+If you want to pursue it, I'd scope it as its own phase with the two questions separated:
+
+1. **`compass-store-surrealdb` adapter** — evaluated against `compass-store-redb` as the precedent. Bounded, reversible, fits the design.
+2. **Vector/embedding support** — a product-direction decision that needs `AGENTS.md` and `README.md` amended first, since both currently promise its absence.
+
+Want me to finish C-001 first, or park it and run `/kbd-new-phase` on the SurrealDB question now? I'd finish C-001 — it's close, and it's the actual fix for the failure that started this.
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+- Captured: 2026-08-09T12:55:17.370754Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .prometheus/knowledge/wiki/index.md
+- .prometheus/knowledge/wiki/log.md
+- crates/compass-store/src/lib.rs
+- .prometheus/knowledge/wiki/karpathy-session-1ecfe43654c6f90b.md
+- .prometheus/knowledge/wiki/karpathy-session-e0ee5520d0620fb6.md
diff --git a/.prometheus/knowledge/wiki/karpathy-session-ef9837e583f69b53.md b/.prometheus/knowledge/wiki/karpathy-session-ef9837e583f69b53.md
new file mode 100644
index 000000000..fcc7c0dba
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-ef9837e583f69b53.md
@@ -0,0 +1,70 @@
+---
+type: SessionRecord
+id: karpathy-session-ef9837e583f69b53
+title: Karpathy session ef9837e583f6
+tags:
+- karpathy
+- session-learning
+sources:
+- session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+timestamp: 2026-08-09T13:33:55.346837+00:00
+created_at: 2026-08-09T13:33:55.346837+00:00
+updated_at: 2026-08-09T13:33:55.346837+00:00
+revision: 0
+---
+
+## Delta
+
+All clear. Nothing is building.
+
+- Both background tasks stopped (`bcha1o34q` workspace test, `b8uyw3sab` monitor)
+- No `cargo build/test/check/clippy` processes, no `rustc`
+- No `target/.cargo-lock`
+- `~/.cargo/.package-cache` is a zero-byte file dated Aug 3 — that's cargo's normal advisory lock file, not a held lock; nothing is holding it
+
+I won't run any further builds or tests until you say so.
+
+**Where C-001 stands** — code is written and formatted, sitting uncommitted in the working tree:
+
+| Verified | Not verified |
+|---|---|
+| `cargo test -p compass-store --lib` — 16/16 pass | `cargo test --workspace --lib --bins` — **killed mid-compile** |
+| `cargo clippy -p compass-store --all-targets --all-features -D warnings` — clean | |
+| `cargo clippy --workspace --lib --bins -D warnings` — clean | |
+| `cargo fmt --all --check` — clean | |
+
+The workspace test baseline is the one gate that didn't finish. It never got past compiling dependencies, so it produced no results either way — I'm not claiming it would have passed. That gate is required by AGENTS.md before this change is complete, so C-001 is **implemented but not fully verified**.
+
+Also uncommitted: `docs/future/SURREAL_DB.md`.
+
+Nothing is lost — it's all in the working tree on `docs/claude-md`, ready to resume whenever you want.
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+- Captured: 2026-08-09T13:33:54.842464Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .prometheus/events.jsonl
+- .prometheus/knowledge/.prompt-snapshots/project/current
+- .prometheus/knowledge/wiki/index.md
+- .prometheus/knowledge/wiki/log.md
+- crates/compass-store/src/lib.rs
+- .prometheus/knowledge/.prompt-snapshots/project/generations/f5b230286eabe44bedd0546b2e237d0a3ed3a31240c91bc789181d67a54e19cc.json
+- .prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-completion-record.md
+- .prometheus/knowledge/wiki/karpathy-session-1ecfe43654c6f90b.md
+- .prometheus/knowledge/wiki/karpathy-session-6f294af7050aa95f.md
+- .prometheus/knowledge/wiki/karpathy-session-e0ee5520d0620fb6.md
+- .prometheus/knowledge/wiki/karpathy-session-e9325c7eec4c9735.md
+- docs/future/
diff --git a/.prometheus/knowledge/wiki/karpathy-session-f437ebdbcc6811b9.md b/.prometheus/knowledge/wiki/karpathy-session-f437ebdbcc6811b9.md
new file mode 100644
index 000000000..bbecd3c74
--- /dev/null
+++ b/.prometheus/knowledge/wiki/karpathy-session-f437ebdbcc6811b9.md
@@ -0,0 +1,73 @@
+---
+type: SessionRecord
+id: karpathy-session-f437ebdbcc6811b9
+title: Karpathy session f437ebdbcc68
+tags:
+- karpathy
+- session-learning
+sources:
+- session:626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+timestamp: 2026-08-09T13:37:14.155976+00:00
+created_at: 2026-08-09T13:37:14.155976+00:00
+updated_at: 2026-08-09T13:37:14.155976+00:00
+revision: 0
+---
+
+## Delta
+
+All clear. Nothing is building.
+
+- Both background tasks stopped (`bcha1o34q` workspace test, `b8uyw3sab` monitor)
+- No `cargo build/test/check/clippy` processes, no `rustc`
+- No `target/.cargo-lock`
+- `~/.cargo/.package-cache` is a zero-byte file dated Aug 3 — that's cargo's normal advisory lock file, not a held lock; nothing is holding it
+
+I won't run any further builds or tests until you say so.
+
+**Where C-001 stands** — code is written and formatted, sitting uncommitted in the working tree:
+
+| Verified | Not verified |
+|---|---|
+| `cargo test -p compass-store --lib` — 16/16 pass | `cargo test --workspace --lib --bins` — **killed mid-compile** |
+| `cargo clippy -p compass-store --all-targets --all-features -D warnings` — clean | |
+| `cargo clippy --workspace --lib --bins -D warnings` — clean | |
+| `cargo fmt --all --check` — clean | |
+
+The workspace test baseline is the one gate that didn't finish. It never got past compiling dependencies, so it produced no results either way — I'm not claiming it would have passed. That gate is required by AGENTS.md before this change is complete, so C-001 is **implemented but not fully verified**.
+
+Also uncommitted: `docs/future/SURREAL_DB.md`.
+
+Nothing is lost — it's all in the working tree on `docs/claude-md`, ready to resume whenever you want.
+
+## Root Cause
+
+No explicit root-cause section was captured; preserve this as a session record, not an inferred diagnosis.
+
+## Corrective Actions
+
+Review and promote only reusable findings.
+
+## Session Metadata
+
+- Harness: claude-code
+- Session: 626aa7ee-9dcb-4292-9ce9-4e4f58af7dc3
+- Captured: 2026-08-09T13:37:01.546274Z
+- Project: /Users/gqadonis/Projects/references/compass
+
+## Changed Paths
+
+- .prometheus/events.jsonl
+- .prometheus/knowledge/.prompt-snapshots/project/current
+- .prometheus/knowledge/wiki/index.md
+- .prometheus/knowledge/wiki/log.md
+- crates/compass-store/src/lib.rs
+- .prometheus/knowledge/.prompt-snapshots/project/generations/0fe7700948f68b460eb4c836d873b71453b1c3b42bab27d454a7d65c2e02e3b0.json
+- .prometheus/knowledge/.prompt-snapshots/project/generations/f5b230286eabe44bedd0546b2e237d0a3ed3a31240c91bc789181d67a54e19cc.json
+- .prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-completion-record.md
+- .prometheus/knowledge/wiki/compass-scoping-and-bounds-executor-completion.md
+- .prometheus/knowledge/wiki/karpathy-session-1ecfe43654c6f90b.md
+- .prometheus/knowledge/wiki/karpathy-session-6f294af7050aa95f.md
+- .prometheus/knowledge/wiki/karpathy-session-e0ee5520d0620fb6.md
+- .prometheus/knowledge/wiki/karpathy-session-e9325c7eec4c9735.md
+- .prometheus/knowledge/wiki/karpathy-session-ef9837e583f69b53.md
+- docs/future/
diff --git a/.prometheus/knowledge/wiki/log.md b/.prometheus/knowledge/wiki/log.md
index b37f47715..d0c83d1c7 100644
--- a/.prometheus/knowledge/wiki/log.md
+++ b/.prometheus/knowledge/wiki/log.md
@@ -1,6 +1,27 @@
 # Update Log
 
+## 2026-08-28
+* **Update**: [Compass scoping and bounds executor session complete](/compass-scoping-and-bounds-executor-completion-status.md)
+* **Ingest**: [Karpathy session 0c9f8df23506](/karpathy-session-0c9f8df23506c16a.md)
+* **Update**: [Compass scoping and bounds executor completion status](/compass-scoping-and-bounds-executor-completion-status.md)
+* **Ingest**: [Karpathy session 2143b246d1cf](/karpathy-session-2143b246d1cf0ba5.md)
+* **Update**: [Compass scoping and bounds executor session status](/compass-scoping-and-bounds-executor-completion-status.md)
+* **Ingest**: [Karpathy session d968e02c779c](/karpathy-session-d968e02c779c42b0.md)
+* **Update**: [Compass scoping and bounds executor status capture](/compass-scoping-and-bounds-executor-completion-status.md)
+* **Ingest**: [Karpathy session a217668de21b](/karpathy-session-a217668de21b25d6.md)
+* **Ingest**: [Karpathy session 361f6082f855](/karpathy-session-361f6082f855b168.md)
+* **Creation**: [Compass scoping and bounds executor completion status](/compass-scoping-and-bounds-executor-completion-status.md)
+* **Ingest**: [Karpathy session 6c67c5011b34](/karpathy-session-6c67c5011b34fce2.md)
+
 ## 2026-08-09
+* **Ingest**: [Karpathy session f437ebdbcc68](/karpathy-session-f437ebdbcc6811b9.md)
+* **Creation**: [Compass scoping and bounds executor completion](/compass-scoping-and-bounds-executor-completion.md)
+* **Ingest**: [Karpathy session ef9837e583f6](/karpathy-session-ef9837e583f69b53.md)
+* **Ingest**: [Karpathy session 6f294af7050a](/karpathy-session-6f294af7050aa95f.md)
+* **Creation**: [Compass scoping and bounds executor completion record](/compass-scoping-and-bounds-executor-completion-record.md)
+* **Ingest**: [Karpathy session e9325c7eec4c](/karpathy-session-e9325c7eec4c9735.md)
+* **Ingest**: [Karpathy session 1ecfe43654c6](/karpathy-session-1ecfe43654c6f90b.md)
+* **Ingest**: [Karpathy session e0ee5520d062](/karpathy-session-e0ee5520d0620fb6.md)
 * **Creation**: [Compass scoping and bounds completion capture](/compass-scoping-and-bounds-completion-capture.md)
 * **Ingest**: [Karpathy session 495b53196088](/karpathy-session-495b53196088c2c2.md)
 * **Ingest**: [Karpathy session 87bd3daa965e](/karpathy-session-87bd3daa965ea4d0.md)
diff --git a/.refiner/artifacts/C-001/artifact_manifest.json b/.refiner/artifacts/C-001/artifact_manifest.json
new file mode 100644
index 000000000..e26bb979d
--- /dev/null
+++ b/.refiner/artifacts/C-001/artifact_manifest.json
@@ -0,0 +1,19 @@
+{
+  "schemaVersion": "1",
+  "artifactName": "C-001",
+  "artifactType": "code",
+  "contentType": "direct:code",
+  "status": "validated",
+  "sourceArtifacts": [
+    "crates/compass-store/src/lib.rs",
+    "CHANGELOG.md",
+    "openspec/changes/stream-snapshot-read/proposal.md",
+    "openspec/changes/stream-snapshot-read/design.md",
+    "openspec/changes/stream-snapshot-read/specs/snapshot-streaming/spec.md",
+    "openspec/changes/stream-snapshot-read/tasks.md"
+  ],
+  "distFiles": [
+    "qa-receipt.md"
+  ],
+  "validatedAt": "2026-08-28T13:43:30Z"
+}
diff --git a/.refiner/artifacts/C-001/constraints.json b/.refiner/artifacts/C-001/constraints.json
new file mode 100644
index 000000000..31617188d
--- /dev/null
+++ b/.refiner/artifacts/C-001/constraints.json
@@ -0,0 +1,23 @@
+{
+  "schemaVersion": "1",
+  "source": ".kbd-orchestrator/constraints.md",
+  "artifact": "C-001",
+  "blocking": [
+    {"id": "build-passes", "status": "PASS", "evidence": "cargo check --workspace --locked"},
+    {"id": "tests-pass", "status": "PASS", "evidence": "cargo test --workspace --lib --bins --locked"},
+    {"id": "clippy-clean", "status": "PASS", "evidence": "cargo clippy --workspace --lib --bins --locked -- -D warnings"},
+    {"id": "fmt-clean", "status": "PASS", "evidence": "cargo fmt --all -- --check"},
+    {"id": "no-unsafe-code", "status": "PASS", "evidence": "No forbidden unsafe additions in the C-001 diff; workspace forbids unsafe code"},
+    {"id": "no-unwrap-expect-panic", "status": "PASS", "evidence": "No unwrap, expect, or panic additions in the C-001 diff; Clippy all-target gate passes"},
+    {"id": "product-boundary", "status": "PASS", "evidence": "sh scripts/check_product_boundary.sh"},
+    {"id": "local-first-preserved", "status": "PASS", "evidence": "No network, model, vector, Python, or runtime grammar dependency added"},
+    {"id": "no-secrets-or-machine-paths", "status": "PASS", "evidence": "No credential or private-key pattern in the C-001 diff"},
+    {"id": "locked-dependencies", "status": "PASS", "evidence": "All Cargo commands used --locked; no dependency file changed"},
+    {"id": "regression-test-present", "status": "PASS", "evidence": "22 compass-store tests plus full workspace tests pass"},
+    {"id": "determinism-preserved", "status": "PASS", "evidence": "Chunk order is manifest-index order; no unordered collection added"},
+    {"id": "bounded-work", "status": "PASS", "evidence": "Per-chunk delivery, explicit CHUNK_BYTES guard, saturating aggregate count, existing 2 GiB cap, length and digest validation"},
+    {"id": "immutable-realizations", "status": "PASS", "evidence": "No historical realization or snapshot format mutation"},
+    {"id": "no-real-credentials-in-tests", "status": "PASS", "evidence": "Tests use only temporary local SQLite stores"},
+    {"id": "viewer-assets-generated", "status": "PASS", "evidence": "node scripts/check_viewer_assets.mjs after npm ci"}
+  ]
+}
diff --git a/.refiner/artifacts/C-001/decisions.md b/.refiner/artifacts/C-001/decisions.md
new file mode 100644
index 000000000..e0bac6ea9
--- /dev/null
+++ b/.refiner/artifacts/C-001/decisions.md
@@ -0,0 +1,23 @@
+# Decisions — C-001 refinement
+
+## 2026-08-28 — Preserve corrupt-reference semantics
+
+Use one chunk-streaming validation pass for `snapshot_reference` rather than a manifest-only read. This retains the prior rejection behavior for missing or modified payload chunks while removing the payload-sized allocation.
+
+## 2026-08-28 — Preserve the compatibility collector
+
+Keep `read_snapshot() -> Result<(SnapshotManifest, Vec<u8>), StoreError>` unchanged and implement it over the streaming API. The full allocation remains explicit and opt-in; production callers use bounded paths.
+
+## 2026-08-28 — Accept deterministic validation fallback
+
+The installed artifact-refiner package is incomplete. Persist the KBD constraint results and the tooling degradation instead of claiming schema/agent execution that the host cannot perform.
+
+## 2026-08-28 — Keep the callback error contract compatible
+
+The second adversarial review suggested a generic consumer error type. C-001 is explicitly additive and compatibility-preserving, and introducing a public streaming error wrapper would broaden its contract and migration surface. Keep the fallible `StoreError` callback for this change; record a generic callback error as follow-up design work if a production caller demonstrates that need.
+
+## 2026-08-28 — Enforce the chunk bound before BLOB materialization
+
+Use SQLite's `length(value)` metadata path before selecting a chunk BLOB, then repeat the bound in the value query. Current SQLite documentation confirms that BLOB length can be determined without reading the complete content. This makes the corruption boundary allocation-safe while retaining normal row-digest validation. The compatibility collector now preallocates from the already-validated manifest and streams that same captured generation.
+
+SQLite's dynamic storage classes require an additional rule: snapshot chunks must remain BLOB values. Reject TEXT or other classes before the size probe, repeat the type predicate in the bounded value query, and retain a defensive Rust byte check. Repeat the graph-size cap immediately before full-read allocation even though manifest validation already enforces it.
diff --git a/.refiner/artifacts/C-001/dist/qa-receipt.md b/.refiner/artifacts/C-001/dist/qa-receipt.md
new file mode 100644
index 000000000..47b46e151
--- /dev/null
+++ b/.refiner/artifacts/C-001/dist/qa-receipt.md
@@ -0,0 +1,14 @@
+# QA receipt — C-001
+
+Artifact: `stream-snapshot-read`
+
+Result: PASS
+
+All applicable blocking constraints in `.kbd-orchestrator/constraints.md` passed. Exact commands and the artifact-refiner package degradation are recorded in `../refinement_log.md`; source hashes were captured immediately before this receipt.
+
+- `crates/compass-store/src/lib.rs`: `113a0460d1858fe648fb6f939f5d9c79cf90b1622baab4dd48d5a6f188c04dcd`
+- `CHANGELOG.md`: `91aaf04ab47f4a7a46953c3034b7711b2180b8620e9aeee8de6ddfb3a4ddeb20`
+- `proposal.md`: `040d15a233ce2d0bf947ef3f4b3208f537ec1efa8531d41cef7c85a6277764a7`
+- `design.md`: `04ee33b1aa7db703bf3e2ce9ed4cc8d01e88cf0329d0bd2b1683935e0d048f6e`
+- `spec.md`: `dbb046c83b2f4faca88adcca2d1c066df4049d0d2dd6e6571d352796be0330eb`
+- `tasks.md`: `40cfb233f10d830d962704033b1104a01023a431c887ca205030a4d1043f1ffc`
diff --git a/.refiner/artifacts/C-001/refinement_log.md b/.refiner/artifacts/C-001/refinement_log.md
new file mode 100644
index 000000000..9a4399a57
--- /dev/null
+++ b/.refiner/artifacts/C-001/refinement_log.md
@@ -0,0 +1,125 @@
+# Refinement log — C-001
+
+## Iteration 1 — 2026-08-28
+
+Scope: `stream-snapshot-read`, validated against `.kbd-orchestrator/constraints.md`.
+
+- Corrected the starting draft so `snapshot_reference` preserves corrupt-payload rejection through streaming validation.
+- Added exact error-equivalence coverage for full read, stream, validation, and reference generation.
+- Added consumer-stop, reopen, and interrupted-before-selector-swap coverage.
+- Preserved the public `read_snapshot` signature and all serialized store contracts.
+- Added the Unreleased changelog entry; no migration action is required.
+
+Validation evidence:
+
+- PASS — `cargo fmt --all -- --check`
+- PASS — `cargo check --workspace --locked`
+- PASS — `cargo test -p compass-store --locked` (18 tests)
+- PASS — `cargo clippy -p compass-store --all-targets --all-features --locked -- -D warnings`
+- PASS — `cargo clippy --workspace --lib --bins --locked -- -D warnings`
+- PASS — `cargo test --workspace --lib --bins --locked`
+- PASS — `sh scripts/check_product_boundary.sh`
+- PASS — `node scripts/check_viewer_assets.mjs`
+- PASS — `openspec validate stream-snapshot-read --strict`
+- PASS — `compass update .` (119,733 nodes, 281,337 edges; existing partial-graph warning reports 68 omitted edges and zero identity collisions)
+
+Tooling note: the installed artifact-refiner adapter lacks its declared canonical controllers, JSON schemas, and `artifact-validator` agent. The KBD-defined deterministic fallback was used and this state was persisted explicitly; no unavailable validator is represented as having run. `npm ci` reported ten existing dependency advisories (one low, one moderate, eight high); C-001 changes no JavaScript or dependency manifests.
+
+Overall: PASS — all applicable blocking constraints passed; proceed to adversarial diff review.
+
+## Iteration 2 — 2026-08-28
+
+Scope: reviewer-requested hardening of the final `stream-snapshot-read` diff.
+
+- Added an explicit per-chunk `CHUNK_BYTES` rejection guard at the storage boundary.
+- Added a raw-SQLite oversized-chunk regression that preserves the row digest so the
+  test exercises the streaming bound itself.
+- Reused the existing lowercase digest formatting path for incremental hashing.
+- Refreshed the source hash in the QA receipt after the final code change.
+
+Validation evidence:
+
+- PASS — `cargo fmt --all -- --check`
+- PASS — `cargo test -p compass-store --locked` (19 tests)
+- PASS — `cargo clippy -p compass-store --all-targets --all-features --locked -- -D warnings`
+- PASS — `cargo clippy --workspace --lib --bins --locked -- -D warnings`
+- PASS — `cargo test --workspace --lib --bins --locked`
+- PASS — `sh scripts/check_product_boundary.sh`
+- PASS — `node scripts/check_viewer_assets.mjs`
+- PASS — `openspec validate stream-snapshot-read --strict`
+
+Overall: PASS — the warning and suggestion from adversarial review iteration 1 are resolved.
+
+## Iteration 3 — 2026-08-28
+
+Scope: documentation and negative-path coverage requested by adversarial review iteration 2.
+
+- Documented that streamed chunks remain provisional until successful terminal
+  length and digest validation, with an explicit stage-then-commit pattern.
+- Added direct, distinct regression coverage for payload-length mismatch and
+  payload-digest mismatch.
+- Recorded the generic callback-error suggestion as follow-up design work; it
+  would expand the public error contract beyond this compatibility-preserving change.
+
+Validation evidence:
+
+- PASS — `cargo fmt --all -- --check`
+- PASS — `cargo test -p compass-store --locked` (21 tests)
+- PASS — `cargo clippy -p compass-store --all-targets --all-features --locked -- -D warnings`
+- PASS — `cargo clippy --workspace --lib --bins --locked -- -D warnings`
+- PASS — `cargo test --workspace --lib --bins --locked`
+- PASS — `sh scripts/check_product_boundary.sh`
+- PASS — `node scripts/check_viewer_assets.mjs`
+- PASS — `openspec validate stream-snapshot-read --strict`
+- PASS — `compass update .` (119,741 nodes, 281,449 edges; existing partial-graph warning reports 68 omitted edges and zero identity collisions)
+
+Overall: PASS — the final implementation and specification satisfy all applicable blocking constraints.
+
+## Iteration 4 — 2026-08-28
+
+Scope: allocation-bound enforcement requested by adversarial review iteration 3.
+
+- Moved the corrupt-row chunk bound ahead of BLOB materialization using
+  SQLite's BLOB-length metadata, with the bound repeated in the value query.
+- Restored validated capacity reservation for the explicit full-read path while
+  retaining one captured manifest generation.
+- Extended the manifest-equivalence helper to cover node and edge counts.
+- Confirmed SQLite BLOB-length semantics through current Context7 documentation.
+
+Validation evidence:
+
+- PASS — `cargo fmt --all -- --check`
+- PASS — `cargo test -p compass-store --locked` (21 tests)
+- PASS — `cargo clippy -p compass-store --all-targets --all-features --locked -- -D warnings`
+- PASS — `openspec validate stream-snapshot-read --strict`
+- PASS — `cargo clippy --workspace --lib --bins --locked -- -D warnings`
+- PASS — `cargo test --workspace --lib --bins --locked`
+- PASS — `sh scripts/check_product_boundary.sh`
+- PASS — `node scripts/check_viewer_assets.mjs`
+- PASS — `compass update .` (119,752 nodes, 281,489 edges; existing partial-graph warning reports 68 omitted edges and zero identity collisions)
+
+Overall: PASS — the final storage read path enforces its chunk bound before allocating chunk content.
+
+## Iteration 5 — 2026-08-28
+
+Scope: SQLite dynamic-typing and allocation-site hardening requested by adversarial review iteration 4.
+
+- Reject non-BLOB snapshot chunks before the length probe and value read.
+- Repeat the BLOB-type and byte-length predicates in the value query and retain
+  a defensive Rust byte-length check.
+- Added a multibyte TEXT corruption regression proving no chunk reaches the consumer.
+- Repeated the graph-size cap immediately before full-read allocation.
+
+Validation evidence:
+
+- PASS — `cargo fmt --all -- --check`
+- PASS — `cargo test -p compass-store --locked` (22 tests)
+- PASS — `cargo clippy -p compass-store --all-targets --all-features --locked -- -D warnings`
+- PASS — `openspec validate stream-snapshot-read --strict`
+- PASS — `cargo clippy --workspace --lib --bins --locked -- -D warnings`
+- PASS — `cargo test --workspace --lib --bins --locked`
+- PASS — `sh scripts/check_product_boundary.sh`
+- PASS — `node scripts/check_viewer_assets.mjs`
+- PASS — `compass update .` (119,755 nodes, 281,524 edges; existing partial-graph warning reports 68 omitted edges and zero identity collisions)
+
+Overall: PASS — dynamic SQLite storage classes cannot bypass the chunk-byte contract.
diff --git a/.refiner/artifacts/C-002/artifact_manifest.json b/.refiner/artifacts/C-002/artifact_manifest.json
new file mode 100644
index 000000000..1ed4d1eb7
--- /dev/null
+++ b/.refiner/artifacts/C-002/artifact_manifest.json
@@ -0,0 +1,23 @@
+{
+  "schemaVersion": "1",
+  "artifactName": "C-002",
+  "artifactType": "code",
+  "contentType": "direct:code",
+  "status": "validated",
+  "sourceArtifacts": [
+    "crates/compass-graph/src/lib.rs",
+    "crates/compass-graph/src/snapshot.rs",
+    "crates/compass-cli/tests/snapshot_limit_cli.rs",
+    "CHANGELOG.md",
+    "openspec/changes/actionable-snapshot-limit-error/proposal.md",
+    "openspec/changes/actionable-snapshot-limit-error/design.md",
+    "openspec/changes/actionable-snapshot-limit-error/specs/snapshot-publication-errors/spec.md",
+    "openspec/changes/actionable-snapshot-limit-error/tasks.md",
+    "openspec/changes/actionable-snapshot-limit-error/files.txt",
+    "openspec/changes/actionable-snapshot-limit-error/verification.md"
+  ],
+  "distFiles": [
+    "qa-receipt.md"
+  ],
+  "validatedAt": "2026-08-28T14:48:58Z"
+}
diff --git a/.refiner/artifacts/C-002/constraints.json b/.refiner/artifacts/C-002/constraints.json
new file mode 100644
index 000000000..5d9c6d583
--- /dev/null
+++ b/.refiner/artifacts/C-002/constraints.json
@@ -0,0 +1,22 @@
+{
+  "schemaVersion": "1",
+  "source": ".kbd-orchestrator/constraints.md",
+  "artifact": "C-002",
+  "blocking": [
+    {"id": "tests-pass", "status": "PASS", "evidence": "Focused graph unit and binary-level CLI regressions plus cargo test --workspace --lib --bins --locked"},
+    {"id": "clippy-clean", "status": "PASS", "evidence": "All-target/all-feature affected crates and workspace lib/bin Clippy with -D warnings"},
+    {"id": "fmt-clean", "status": "PASS", "evidence": "cargo fmt --all -- --check and git diff --check"},
+    {"id": "no-unsafe-code", "status": "PASS", "evidence": "No unsafe code added; workspace lints remain clean"},
+    {"id": "no-unwrap-expect-panic", "status": "PASS", "evidence": "No unwrap, expect, or panic added; all-target Clippy passes"},
+    {"id": "product-boundary", "status": "PASS", "evidence": "compass_product integration test and scripts/check_product_boundary.sh"},
+    {"id": "local-first-preserved", "status": "PASS", "evidence": "The regression uses only a temporary project and local SQLite store"},
+    {"id": "no-secrets-or-machine-paths", "status": "PASS", "evidence": "No credentials or machine-specific paths in product artifacts"},
+    {"id": "locked-dependencies", "status": "PASS", "evidence": "No dependency manifest or lockfile change remains; all Cargo commands use --locked"},
+    {"id": "regression-test-present", "status": "PASS", "evidence": "Unit classification test and actual compass binary exit/text regression"},
+    {"id": "determinism-preserved", "status": "PASS", "evidence": "No ordering or identity behavior changed; fixture qualification byte equivalence passed"},
+    {"id": "bounded-work", "status": "PASS", "evidence": "Existing MAX_GRAPH_BYTES bound remains authoritative; this change only classifies and renders its failure"},
+    {"id": "immutable-realizations", "status": "PASS", "evidence": "No snapshot schema or historical realization changed"},
+    {"id": "no-real-credentials-in-tests", "status": "PASS", "evidence": "The CLI test uses only a temporary local SQLite database"},
+    {"id": "code-graph-qualification", "status": "PASS", "evidence": "Final-source scripts/qualify_code_graph_v1.sh --fixtures-only, including scale and deterministic-equivalence gates"}
+  ]
+}
diff --git a/.refiner/artifacts/C-002/decisions.md b/.refiner/artifacts/C-002/decisions.md
new file mode 100644
index 000000000..b8a510994
--- /dev/null
+++ b/.refiner/artifacts/C-002/decisions.md
@@ -0,0 +1,25 @@
+# Decisions — C-002 refinement
+
+## 2026-08-28 — Keep resource-limit and corruption classes distinct
+
+An oversized, otherwise well-formed manifest is a typed `SnapshotError::Limit`; an empty byte count remains `SnapshotError::Corrupt`. This preserves machine classification instead of making callers parse remediation prose.
+
+## 2026-08-28 — Advertise only effective controls
+
+The remediation names `--exclude <pattern>` and `.compassignore`. It deliberately omits `COMPASS_MAX_GRAPH_BYTES` until C-004 wires that override into the publication path.
+
+## 2026-08-28 — Exercise immutable reference selection in the CLI regression
+
+The store engine pins `store.ref`, not the mutable active selector. The regression therefore publishes a digest-consistent oversized manifest and rewrites both the selector and its immutable reference before invoking the actual binary.
+
+## 2026-08-28 — Make remediation valid for publication and reads
+
+Manifest validation is shared by publishers and immutable readers. Use `retry or rebuild with a smaller scope` so the action is accurate in both contexts while retaining one typed, machine-classifiable limit error.
+
+## 2026-08-28 — Keep storage layout in the graph owner
+
+Expose the versioned manifest-key encoder and existing layout constants from `compass-graph`, then use the backend-neutral `Store` interface in the CLI contract test. This avoids raw SQLite coupling and makes the same regression portable to any conforming local adapter.
+
+## 2026-08-28 — Accept deterministic validation fallback
+
+The installed artifact-refiner package is incomplete. Persist the KBD constraint results and tooling degradation instead of claiming schema or validator-agent execution that the host cannot perform.
diff --git a/.refiner/artifacts/C-002/dist/qa-receipt.md b/.refiner/artifacts/C-002/dist/qa-receipt.md
new file mode 100644
index 000000000..d1735313f
--- /dev/null
+++ b/.refiner/artifacts/C-002/dist/qa-receipt.md
@@ -0,0 +1,18 @@
+# QA receipt — C-002
+
+Artifact: `actionable-snapshot-limit-error`
+
+Result: PASS
+
+All applicable blocking constraints in `.kbd-orchestrator/constraints.md` passed. Exact commands, the unrelated package-test baseline failure, and the artifact-refiner package degradation are recorded in `../refinement_log.md`; source hashes were captured immediately before this receipt.
+
+- `crates/compass-graph/src/lib.rs`: `747a233e3d6edb33cfcab2e0b23544916eff3f01c7457434cff3c4bfce8d5946`
+- `crates/compass-graph/src/snapshot.rs`: `eb8f738dc19bbe162b861b081d359bf4a65838acc41ab7382d1e0754a8f693dc`
+- `crates/compass-cli/tests/snapshot_limit_cli.rs`: `6d7d4cf5e6237b6131b3ce622fbd1c60c24ddb78443b062e3810130aac2d3904`
+- `CHANGELOG.md`: `86519d9531ebd6fd25211c4934de93ed0cd6b52d62b62ae07a2305d685cdb5a4`
+- `proposal.md`: `ffd9c42d841c11226e987bec5dc7507579d1563df470c83dffe2c939fd167ccf`
+- `design.md`: `d5d7de45ecc978ed51ce53ce41caea6b7dd04a0e50cc92ee65772657f99aec54`
+- `spec.md`: `88f2ee65a6a73fa7ecc25c5b053a58ba6862bb6950ef61019db89691934b9eee`
+- `tasks.md`: `a1210f3940c9df0abdef3f0c5064616b6298cdf383d36bf11895a6af96446efa`
+- `files.txt`: `45bdaa16a6781482882d7582fd0bf3ecd9c752b2dd40509f0956447925b8ffec`
+- `verification.md`: `84faeee012ae50585ac34f0c3ad14cfc2601d3616c2033dcd89d1950066dc97a`
diff --git a/.refiner/artifacts/C-002/refinement_log.md b/.refiner/artifacts/C-002/refinement_log.md
new file mode 100644
index 000000000..74a1022c5
--- /dev/null
+++ b/.refiner/artifacts/C-002/refinement_log.md
@@ -0,0 +1,104 @@
+# Refinement log — C-002
+
+## Iteration 1 — 2026-08-28
+
+Scope: `actionable-snapshot-limit-error`, validated against `.kbd-orchestrator/constraints.md`.
+
+- Centralized canonical graph oversize failures in a typed `SnapshotError::Limit` constructor.
+- Kept a zero-byte manifest classified as corruption rather than conflating it with a resource limit.
+- Named only shipped remediation controls: `--exclude <pattern>` and `.compassignore`.
+- Added a real-binary regression that mutates a digest-consistent immutable SQLite snapshot and asserts stderr plus exit code 1.
+- Withheld `COMPASS_MAX_GRAPH_BYTES` from the message until C-004 implements it on the publication path.
+- Used the backend-neutral store contract; no dependency manifest or lockfile change remains.
+
+Validation evidence:
+
+- PASS — `openspec validate actionable-snapshot-limit-error --strict`
+- PASS — `cargo fmt --all -- --check`
+- PASS — focused graph limit classification test
+- PASS — `cargo test -p compass-cli --test snapshot_limit_cli --locked`
+- PASS — affected-crate all-target/all-feature Clippy with `-D warnings`
+- PASS — `cargo test -p compass-cli --test compass_product --locked`
+- PASS — `sh scripts/check_product_boundary.sh`
+- PASS — `cargo clippy --workspace --lib --bins --locked -- -D warnings`
+- PASS — `cargo test --workspace --lib --bins --locked`
+- PASS — `./scripts/qualify_code_graph_v1.sh --fixtures-only`
+- PASS — `compass update .` (119,818 nodes, 281,678 edges; existing partial-graph warning reports 68 omitted edges and zero identity collisions)
+
+Non-blocking baseline note: `cargo test -p compass-graph --locked` reaches and passes the changed unit test, then reproduces an unrelated existing failure in `tests/import_alias_identity.rs` because a framework import fixture lacks a direct-evidence source anchor. The mandated workspace lib/bin baseline and all C-002-specific/public gates pass.
+
+Tooling note: the installed artifact-refiner adapter lacks its declared canonical controllers, JSON schemas, and `artifact-validator` agent. The KBD-defined deterministic fallback was used and persisted explicitly; no unavailable validator is represented as having run.
+
+Overall: PASS — all applicable blocking constraints and C-002 contract evidence pass; proceed to adversarial diff review.
+
+## Iteration 2 — 2026-08-28
+
+Scope: first adversarial review and packet-scope correction.
+
+- Clarified the recovery text so it is accurate during both failed publication
+  and read-side validation of an existing immutable snapshot: retry or rebuild
+  with a smaller scope.
+- Documented why the shared manifest validator deliberately carries the same
+  remediation in both contexts.
+- Added the public compatibility classification to the changelog.
+- Confirmed the original critical and unused-dependency findings were caused by
+  the packet builder omitting the untracked CLI regression; the scoped packet
+  is regenerated with that new file included.
+
+Validation evidence:
+
+- PASS — `cargo fmt --all -- --check`
+- PASS — `openspec validate actionable-snapshot-limit-error --strict`
+- PASS — focused graph limit classification test
+- PASS — `cargo test -p compass-cli --test snapshot_limit_cli --locked`
+- PASS — affected-crate all-target/all-feature Clippy with `-D warnings`
+
+Overall: PASS — substantive review feedback is resolved and the review input now contains the complete C-002 diff.
+
+## Iteration 3 — 2026-08-28
+
+Scope: ownership and stable-contract hardening from the completed PASS review.
+
+- Replaced raw SQLite table and namespace manipulation with the public
+  backend-neutral `Store` interface.
+- Added a graph-owned public manifest-key encoder and re-exported the existing
+  snapshot layout constants instead of duplicating private storage layout.
+- Removed the temporary `rusqlite` test dependency and lockfile change.
+- Pinned the complete stable remediation message in the graph unit test.
+- Confirmed `sha2` and `tempfile` were already declared `compass-cli`
+  dependencies; the review warning about missing declarations was a false alarm.
+
+Validation evidence:
+
+- PASS — focused graph and CLI regressions
+- PASS — affected-crate all-target/all-feature Clippy with `-D warnings`
+- PASS — strict OpenSpec validation and diff hygiene
+
+## Iteration 4 — 2026-08-28
+
+Scope: final variant audit, helper scope, and platform portability.
+
+- Audited every `SnapshotError::Corrupt` and `SnapshotError::Limit` use: no
+  production caller branches on the reclassified variant; external matches are
+  test assertions, while core/query wrappers remain variant-agnostic.
+- Renamed the bounded digest helper to `digest_canonical_graph_json` and
+  confirmed it has no selector, delta, or tree call sites.
+- Passed the graph path to the CLI as an `OsStr` rather than lossy UTF-8.
+- The fourth judge confirmation produced no response on its initial call or
+  single allowed retry; no confirmation verdict is claimed. The last completed
+  independent review was PASS (0 critical, 2 warnings, 1 suggestion), and all
+  of those follow-ups are resolved with focused tests.
+
+Final validation evidence:
+
+- PASS — `cargo fmt --all -- --check`
+- PASS — focused graph and real-binary CLI regressions
+- PASS — affected-crate all-target/all-feature Clippy with `-D warnings`
+- PASS — `cargo test -p compass-cli --test compass_product --locked`
+- PASS — `sh scripts/check_product_boundary.sh`
+- PASS — `cargo clippy --workspace --lib --bins --locked -- -D warnings`
+- PASS — `cargo test --workspace --lib --bins --locked`
+- PASS — final-source `./scripts/qualify_code_graph_v1.sh --fixtures-only`
+- PASS — `compass update .` (119,806 nodes, 281,681 edges; existing partial-graph warning reports 68 omitted edges and zero identity collisions)
+
+Overall: PASS — final source satisfies all applicable blocking constraints.
diff --git a/.refiner/artifacts/C-003/artifact_manifest.json b/.refiner/artifacts/C-003/artifact_manifest.json
new file mode 100644
index 000000000..1ea529956
--- /dev/null
+++ b/.refiner/artifacts/C-003/artifact_manifest.json
@@ -0,0 +1,17 @@
+{
+  "schemaVersion": "1",
+  "artifactName": "C-003",
+  "artifactType": "code",
+  "contentType": "direct:code",
+  "status": "validated",
+  "sourceArtifacts": [
+    "crates/compass-core/src/pipeline.rs",
+    "crates/compass-core/tests/pipeline_scale.rs",
+    "crates/compass-graph/src/lib.rs",
+    "crates/compass-graph/src/snapshot.rs",
+    "CHANGELOG.md",
+    "openspec/changes/preflight-graph-size-estimate"
+  ],
+  "distFiles": ["qa-receipt.md"],
+  "validatedAt": "2026-08-28T16:20:00Z"
+}
diff --git a/.refiner/artifacts/C-003/constraints.json b/.refiner/artifacts/C-003/constraints.json
new file mode 100644
index 000000000..adb069064
--- /dev/null
+++ b/.refiner/artifacts/C-003/constraints.json
@@ -0,0 +1,15 @@
+{
+  "schemaVersion": "1",
+  "artifact": "C-003",
+  "blocking": [
+    {"id":"focused-regression","status":"PASS","evidence":"Unit and pipeline-scale preflight regressions pass"},
+    {"id":"workspace-baseline","status":"PASS","evidence":"fmt, diff check, workspace lib/bin Clippy and tests pass"},
+    {"id":"bounded-work","status":"PASS","evidence":"One metadata lookup per discovered source with saturating arithmetic; no source read or extraction"},
+    {"id":"determinism","status":"PASS","evidence":"Root-relative equivalent-checkout regression and fixture qualification pass"},
+    {"id":"typed-limit","status":"PASS","evidence":"Reuses SnapshotError::canonical_graph_too_large and actionable C-002 text"},
+    {"id":"product-boundary","status":"PASS","evidence":"compass_product and check_product_boundary.sh pass"},
+    {"id":"qualification","status":"PASS","evidence":"qualify_code_graph_v1.sh --fixtures-only passes all byte comparisons"},
+    {"id":"openspec","status":"PASS","evidence":"strict validation passes"},
+    {"id":"graph-refresh","status":"PASS","evidence":"119836 nodes, 281818 edges, 68 existing omitted edges, zero identity collisions"}
+  ]
+}
diff --git a/.refiner/artifacts/C-003/decisions.md b/.refiner/artifacts/C-003/decisions.md
new file mode 100644
index 000000000..791f1fc38
--- /dev/null
+++ b/.refiner/artifacts/C-003/decisions.md
@@ -0,0 +1,11 @@
+# C-003 refinement decisions
+
+- The current 16 GB external checkout is not a valid size-isolation corpus: it
+  fails with a worker stack overflow after 73.82 s. Use the handoff-approved
+  deterministic synthetic equivalent.
+- Calibrate at the measured 60.62x source-to-canonical ratio and round down to
+  60x instead of adding an unmeasured safety factor.
+- Account for parser-rejected sources as fixed inventory records so a sparse or
+  generated oversized file does not receive a false extraction multiplier.
+- Run preflight after verified-output reuse checks but before any cold
+  extraction, preserving fast warm builds.
diff --git a/.refiner/artifacts/C-003/dist/qa-receipt.md b/.refiner/artifacts/C-003/dist/qa-receipt.md
new file mode 100644
index 000000000..580063bf4
--- /dev/null
+++ b/.refiner/artifacts/C-003/dist/qa-receipt.md
@@ -0,0 +1,14 @@
+# QA receipt — C-003
+
+Artifact: `preflight-graph-size-estimate`
+
+Result: PASS
+
+All applicable blocking constraints pass under the deterministic fallback.
+Source hashes:
+
+- `pipeline.rs`: `2dd693c41cfbcca5489213fe0804005d844c06ea6ad34a8e1b90af52d29be1da`
+- `pipeline_scale.rs`: `1ebee3e736a045c6ce89be9e71c7f8dc27b9985e7038d69f8520af1f8734f23c`
+- `compass-graph/src/lib.rs`: `e4f012c4b91e0570495eeba55ce93a8107b162481531992cc72d38b78c3de6c0`
+- `compass-graph/src/snapshot.rs`: `69aee0a7b23e16d5c6dd63dd4e681f331351a041759df7a53c7b29801848004c`
+- `CHANGELOG.md`: `2d86cdf42f7f0e32e8887bc27c2173dd6b03836a052c139df286dad3050ac577`
diff --git a/.refiner/artifacts/C-003/refinement_log.md b/.refiner/artifacts/C-003/refinement_log.md
new file mode 100644
index 000000000..868d305c6
--- /dev/null
+++ b/.refiner/artifacts/C-003/refinement_log.md
@@ -0,0 +1,31 @@
+# Refinement log — C-003
+
+## Iteration 1 — 2026-08-28
+
+- Measured the real checkout and recorded its earlier stack-overflow failure.
+- Built the 2,000-file deterministic equivalent and measured total bytes,
+  payload composition, and full-build time.
+- Implemented a root-relative, saturating, metadata-only estimate after
+  verified-output reuse and before cold extraction.
+- Added unit and end-to-end regressions for determinism, typed limit outcome,
+  actionable text, oversized partial files, zero extraction progress, and the
+  pinned 20% timing ceiling.
+
+Validation: focused regressions, affected all-target/all-feature Clippy, strict
+OpenSpec, public product tests, product boundary, workspace lib/bin Clippy and
+tests, code-graph fixture qualification, formatting, and diff hygiene pass.
+Compass graph refresh passes with 68 existing omitted edges and zero identity
+collisions.
+
+The broader `cargo test -p compass-core --locked` reproduces an unrelated
+existing TypeScript star-reexport assertion (4 edges observed vs 2 expected).
+The mandated workspace lib/bin baseline and every C-003-specific gate pass.
+
+Tooling note: the installed artifact-refiner package lacks its declared
+canonical controllers, schemas, and validator agent. The deterministic KBD
+fallback was used; no unavailable validator is claimed. Independent K3 review
+was dispatched with judge != producer, but both the initial call and its single
+allowed retry returned no response within three minutes, so no verdict is
+claimed.
+
+Overall: PASS.
diff --git a/.refiner/artifacts/C-004/artifact_manifest.json b/.refiner/artifacts/C-004/artifact_manifest.json
new file mode 100644
index 000000000..b9c3dbb4c
--- /dev/null
+++ b/.refiner/artifacts/C-004/artifact_manifest.json
@@ -0,0 +1,18 @@
+{
+  "schemaVersion": "1",
+  "artifactName": "C-004",
+  "artifactType": "code",
+  "contentType": "direct:code",
+  "status": "validated",
+  "sourceArtifacts": [
+    "crates/compass-store/src/lib.rs",
+    "crates/compass-graph/src/lib.rs",
+    "crates/compass-graph/src/snapshot.rs",
+    "crates/compass-core/src/pipeline.rs",
+    "crates/compass-cli/tests/snapshot_limit_cli.rs",
+    "CHANGELOG.md",
+    "openspec/changes/honor-max-graph-bytes-on-publication"
+  ],
+  "distFiles": ["qa-receipt.md"],
+  "validatedAt": "2026-08-28T17:20:00Z"
+}
diff --git a/.refiner/artifacts/C-004/constraints.json b/.refiner/artifacts/C-004/constraints.json
new file mode 100644
index 000000000..98fdd3d8f
--- /dev/null
+++ b/.refiner/artifacts/C-004/constraints.json
@@ -0,0 +1,15 @@
+{
+  "schemaVersion": "1",
+  "artifact": "C-004",
+  "blocking": [
+    {"id":"default-bound","status":"PASS","evidence":"MAX_GRAPH_BYTES remains 2 GiB"},
+    {"id":"explicit-opt-in","status":"PASS","evidence":"Only COMPASS_MAX_GRAPH_BYTES changes the effective bound"},
+    {"id":"invalid-fails-closed","status":"PASS","evidence":"Unit coverage for missing, zero, invalid, overflow and valid byte/MB/GB forms"},
+    {"id":"publication-consistency","status":"PASS","evidence":"Preflight, canonical digest, manifest validation, delta, read and legacy publication paths share the effective limit"},
+    {"id":"streaming-gate","status":"PASS","evidence":"C-001 completed before C-004; production snapshot reads stream bounded chunks"},
+    {"id":"public-error","status":"PASS","evidence":"Graph and real CLI regressions require the override guidance"},
+    {"id":"workspace-baseline","status":"PASS","evidence":"fmt, diff, workspace Clippy and lib/bin tests pass"},
+    {"id":"product-and-qualification","status":"PASS","evidence":"compass_product, product boundary and fixture qualification pass"},
+    {"id":"graph-refresh","status":"PASS","evidence":"119856 nodes, 281856 edges, 68 existing omitted edges, zero identity collisions"}
+  ]
+}
diff --git a/.refiner/artifacts/C-004/dist/qa-receipt.md b/.refiner/artifacts/C-004/dist/qa-receipt.md
new file mode 100644
index 000000000..4361b31f5
--- /dev/null
+++ b/.refiner/artifacts/C-004/dist/qa-receipt.md
@@ -0,0 +1,9 @@
+# QA receipt — C-004
+
+Artifact: `honor-max-graph-bytes-on-publication`
+
+Result: PASS
+
+All applicable blocking constraints pass under the deterministic fallback.
+The exact commands and unavailable independent-review verdict are recorded in
+`../refinement_log.md`.
diff --git a/.refiner/artifacts/C-004/refinement_log.md b/.refiner/artifacts/C-004/refinement_log.md
new file mode 100644
index 000000000..e902f4d98
--- /dev/null
+++ b/.refiner/artifacts/C-004/refinement_log.md
@@ -0,0 +1,19 @@
+# Refinement log — C-004
+
+## Iteration 1 — 2026-08-28
+
+- Centralized snapshot-limit parsing in `compass-store` with raw-byte, MB, GB,
+  underscore, zero, invalid, overflow, and platform-representation coverage.
+- Kept the default at 2 GiB and made the override process-local and explicit.
+- Applied the effective limit to C-003 preflight and every canonical snapshot
+  publication, validation, read, streaming, and delta boundary.
+- Updated C-002's stable actionable message and real CLI regression to name
+  the now-shipped override.
+
+All focused, workspace, product, qualification, strict OpenSpec, formatting,
+diff, and graph-refresh gates pass. The installed artifact-refiner package
+lacks its canonical controllers/schemas/validator, so the documented
+deterministic fallback was used. K3 judge dispatch and the single allowed retry
+both returned no response within three minutes; no verdict is claimed.
+
+Overall: PASS.
diff --git a/.refiner/artifacts/C-005/artifact_manifest.json b/.refiner/artifacts/C-005/artifact_manifest.json
new file mode 100644
index 000000000..a8d517960
--- /dev/null
+++ b/.refiner/artifacts/C-005/artifact_manifest.json
@@ -0,0 +1,17 @@
+{
+  "schemaVersion": "1",
+  "artifactName": "C-005",
+  "artifactType": "code",
+  "contentType": "direct:code",
+  "status": "validated",
+  "sourceArtifacts": [
+    "Cargo.toml",
+    "Cargo.lock",
+    "CHANGELOG.md",
+    "crates/compass-partition",
+    "crates/compass-history",
+    "openspec/changes/extract-compass-partition"
+  ],
+  "distFiles": ["qa-receipt.md"],
+  "validatedAt": "2026-08-28T15:44:46Z"
+}
diff --git a/.refiner/artifacts/C-005/constraints.json b/.refiner/artifacts/C-005/constraints.json
new file mode 100644
index 000000000..b249f1ddc
--- /dev/null
+++ b/.refiner/artifacts/C-005/constraints.json
@@ -0,0 +1,16 @@
+{
+  "schemaVersion": "1",
+  "artifact": "C-005",
+  "blocking": [
+    {"id":"storage-neutral-dependencies","status":"PASS","evidence":"cargo tree reaches only serde_json and thiserror; forbidden dependency grep is empty"},
+    {"id":"no-graph-transitive-dependency","status":"PASS","evidence":"cargo tree -p compass-graph contains no compass-partition"},
+    {"id":"byte-compatibility","status":"PASS","evidence":"new golden vectors and unchanged compass-history canonical, diff, and round-trip suites pass"},
+    {"id":"typed-errors","status":"PASS","evidence":"PartitionError is owned by compass-partition and converted through HistoryError::Partition"},
+    {"id":"workspace-member","status":"PASS","evidence":"workspace metadata and dependency-first publication inventory include compass-partition"},
+    {"id":"focused-quality","status":"PASS","evidence":"compass-partition and full compass-history tests plus affected all-target all-feature Clippy pass"},
+    {"id":"workspace-baseline","status":"PASS","evidence":"fmt, workspace Clippy, and workspace lib/bin tests pass under --locked"},
+    {"id":"package-contract","status":"PASS","evidence":"cargo package -p compass-partition --locked --allow-dirty --no-verify succeeds"},
+    {"id":"product-boundary","status":"PASS","evidence":"scripts/check_product_boundary.sh passes"},
+    {"id":"graph-refresh","status":"PASS","evidence":"119876 nodes, 281866 edges, 68 pre-existing omitted edges, zero identity collisions"}
+  ]
+}
diff --git a/.refiner/artifacts/C-005/dist/qa-receipt.md b/.refiner/artifacts/C-005/dist/qa-receipt.md
new file mode 100644
index 000000000..26c1b893c
--- /dev/null
+++ b/.refiner/artifacts/C-005/dist/qa-receipt.md
@@ -0,0 +1,9 @@
+# QA receipt — C-005
+
+Artifact: `extract-compass-partition`
+
+Result: PASS
+
+All applicable blocking constraints pass under the deterministic fallback.
+Exact evidence and the independent-review disposition are recorded in
+`../refinement_log.md` and the KBD review directory.
diff --git a/.refiner/artifacts/C-005/refinement_log.md b/.refiner/artifacts/C-005/refinement_log.md
new file mode 100644
index 000000000..be4d04085
--- /dev/null
+++ b/.refiner/artifacts/C-005/refinement_log.md
@@ -0,0 +1,28 @@
+# Refinement log — C-005
+
+## Iteration 1 — 2026-08-28
+
+- Extracted the storage-neutral partition container, canonical JSON encoder,
+  and typed-key constructors into `compass-partition`.
+- Preserved Prolly's segment encoding byte-for-byte with local golden vectors,
+  without bringing Prolly or history's IR/analysis dependencies into the crate.
+- Kept `compass-history` public helpers source-compatible and converted the new
+  typed `PartitionError` at the history boundary.
+- Verified unchanged history canonical, diff, round-trip, publication, reopen,
+  maintenance, and SQLite contract suites.
+
+Focused tests, affected Clippy, dependency gates, workspace formatting/Clippy/
+lib-bin tests, package metadata, packaging, product boundary, strict OpenSpec,
+diff checks, and graph refresh pass. The installed artifact-refiner package
+lacks its canonical controllers, schemas, and validator agent, so the documented
+deterministic fallback was used.
+
+Overall: PASS.
+
+## Iteration 2 — 2026-08-28
+
+The first fresh-context review blocked on an absent verification record. Added
+the exact command/results record, reran focused QA, and rebuilt the packet. The
+second review passed with two warnings: the direct internal dependency was moved
+to the plan-required workspace declaration, and cumulative changelog provenance
+from completed C-001 through C-004 was acknowledged and retained.
diff --git a/.refiner/artifacts/C-006/artifact_manifest.json b/.refiner/artifacts/C-006/artifact_manifest.json
new file mode 100644
index 000000000..e2e10f972
--- /dev/null
+++ b/.refiner/artifacts/C-006/artifact_manifest.json
@@ -0,0 +1,15 @@
+{
+  "schemaVersion": "1",
+  "artifactName": "C-006",
+  "artifactType": "code",
+  "contentType": "direct:code",
+  "status": "validated",
+  "sourceArtifacts": [
+    "crates/compass-files/tests/contracts.rs",
+    "crates/compass-core/tests/vendor_policy.rs",
+    "docs/reference/configuration.md",
+    "openspec/changes/vendor-skip-policy"
+  ],
+  "distFiles": ["qa-receipt.md"],
+  "validatedAt": "2026-08-28T15:59:11Z"
+}
diff --git a/.refiner/artifacts/C-006/constraints.json b/.refiner/artifacts/C-006/constraints.json
new file mode 100644
index 000000000..7172e19e0
--- /dev/null
+++ b/.refiner/artifacts/C-006/constraints.json
@@ -0,0 +1,16 @@
+{
+  "schemaVersion": "1",
+  "artifact": "C-006",
+  "blocking": [
+    {"id":"deliberate-decision","status":"PASS","evidence":"Design compares all three planned policies and records leave with explicit exclusion"},
+    {"id":"compatibility","status":"PASS","evidence":"Default discovery remains unchanged; no migration required"},
+    {"id":"workspace-member","status":"PASS","evidence":"Regression discovers vendor/parser-pack/src/lib.rs under a declared workspace member"},
+    {"id":"go-vendor","status":"PASS","evidence":"Regressions discover and publish non-workspace vendor/go-dependency/tool.go"},
+    {"id":"publication","status":"PASS","evidence":"compass-core build contract publishes both vendor sources by default and omits their file inventory and anchored nodes for every explicit exclusion surface"},
+    {"id":"watcher-parity","status":"PASS","evidence":"WatchPathFilter allows both eligible vendor paths"},
+    {"id":"focused-tests","status":"PASS","evidence":"All compass-files tests pass"},
+    {"id":"workspace-baseline","status":"PASS","evidence":"fmt, workspace lib/bin Clippy, and workspace lib/bin tests pass under --locked"},
+    {"id":"product-boundary","status":"PASS","evidence":"scripts/check_product_boundary.sh passes"},
+    {"id":"graph-refresh","status":"PASS","evidence":"119880 nodes, 281907 edges, 68 pre-existing omitted edges, zero identity collisions"}
+  ]
+}
diff --git a/.refiner/artifacts/C-006/dist/qa-receipt.md b/.refiner/artifacts/C-006/dist/qa-receipt.md
new file mode 100644
index 000000000..39d686016
--- /dev/null
+++ b/.refiner/artifacts/C-006/dist/qa-receipt.md
@@ -0,0 +1,9 @@
+# QA receipt — C-006
+
+Artifact: `vendor-skip-policy`
+
+Result: PASS
+
+All applicable blocking constraints pass under the deterministic fallback.
+The exact commands and the pre-existing all-target lint distinction are recorded
+in `../refinement_log.md` and the OpenSpec verification record.
diff --git a/.refiner/artifacts/C-006/refinement_log.md b/.refiner/artifacts/C-006/refinement_log.md
new file mode 100644
index 000000000..6a8bcdd79
--- /dev/null
+++ b/.refiner/artifacts/C-006/refinement_log.md
@@ -0,0 +1,37 @@
+# Refinement log — C-006
+
+## Iteration 1 — 2026-08-28
+
+- Compared skip, skip-unless-workspace-member, and leave policies against the
+  language-neutral discovery boundary.
+- Retained current behavior because Go vendor trees are build-relevant source
+  and workspace membership cannot describe every supported ecosystem.
+- Documented the explicit `.compassignore`, saved-scope, and `--exclude`
+  controls for repositories that want vendor source omitted.
+- Added one regression covering Rust workspace-member source, non-member Go
+  vendor source, deterministic discovery, and watcher parity.
+
+Focused tests, crate tests, crate lib Clippy, workspace formatting/Clippy/
+lib-bin tests, product boundary, strict OpenSpec, diff checks, and graph refresh
+pass. The installed artifact-refiner package lacks its canonical controllers,
+schemas, and validator agent, so the documented deterministic fallback was used.
+The attempted all-target crate Clippy run exposed two unrelated pre-existing
+test-target lints; neither is in the added regression.
+
+Overall: PASS.
+
+## Iteration 2 — 2026-08-28
+
+The first fresh-context review correctly blocked on two fixture gaps. Made the
+declared workspace member structurally valid with its own Cargo manifest and
+added vendor-specific assertions for `.compassignore`, command-line-style extra
+exclusions, saved project scope, and watcher rejection. Focused QA and review
+were rerun after the correction.
+
+## Iteration 3 — 2026-08-28
+
+The second fresh-context review found that discovery eligibility alone did not
+prove the proposal's classification/publication claim. Added a `compass-core`
+build contract that publishes Rust workspace-member and Go vendor source into
+the graph by default and proves `.compassignore`, CLI-style extra excludes, and
+saved project scope each remove the matching file inventory and anchored nodes.
diff --git a/.refiner/artifacts/C-007/artifact_manifest.json b/.refiner/artifacts/C-007/artifact_manifest.json
new file mode 100644
index 000000000..1934cafe3
--- /dev/null
+++ b/.refiner/artifacts/C-007/artifact_manifest.json
@@ -0,0 +1,16 @@
+{
+  "schemaVersion": "1",
+  "artifactName": "C-007",
+  "artifactType": "code",
+  "contentType": "direct:code",
+  "status": "validated",
+  "sourceArtifacts": [
+    "Cargo.toml",
+    "Cargo.lock",
+    "crates/compass-mcp",
+    "CHANGELOG.md",
+    "openspec/changes/rmcp-3-migration"
+  ],
+  "distFiles": ["qa-receipt.md"],
+  "validatedAt": "2026-08-28T20:35:00Z"
+}
diff --git a/.refiner/artifacts/C-007/constraints.json b/.refiner/artifacts/C-007/constraints.json
new file mode 100644
index 000000000..57b6c0349
--- /dev/null
+++ b/.refiner/artifacts/C-007/constraints.json
@@ -0,0 +1,15 @@
+{
+  "schemaVersion": "1",
+  "artifact": "C-007",
+  "blocking": [
+    {"id":"exact-pin","status":"PASS","evidence":"Workspace resolves only rmcp 3.1.4 from an exact =3.1.4 declaration"},
+    {"id":"stdio-parity","status":"PASS","evidence":"Existing duplex initialization, tool/resource, error, and shutdown tests pass unchanged"},
+    {"id":"discovery-parity","status":"PASS","evidence":"Real server/discover plus live tool/resource lists match the rmcp 2.2 golden"},
+    {"id":"dependency-delta","status":"PASS","evidence":"rmcp subtree adds only base64 0.23.1 while retaining Apache-2.0 and a compatible MSRV"},
+    {"id":"dependency-policy","status":"PASS","evidence":"cargo-deny advisories, bans, licenses, and sources all pass"},
+    {"id":"unsafe-policy","status":"PASS","evidence":"Workspace unsafe_code=forbid remains active and workspace Clippy passes"},
+    {"id":"scope-boundary","status":"PASS","evidence":"No tools, envelopes, SurrealDB dependencies, or public CLI flags were added"},
+    {"id":"workspace-baseline","status":"PASS","evidence":"fmt, workspace lib/bin Clippy, and workspace lib/bin tests pass under --locked"},
+    {"id":"graph-refresh","status":"PASS","evidence":"119961 nodes, 282152 edges, 68 pre-existing omitted edges, zero identity collisions"}
+  ]
+}
diff --git a/.refiner/artifacts/C-007/dist/qa-receipt.md b/.refiner/artifacts/C-007/dist/qa-receipt.md
new file mode 100644
index 000000000..f48af2cad
--- /dev/null
+++ b/.refiner/artifacts/C-007/dist/qa-receipt.md
@@ -0,0 +1,10 @@
+# QA receipt — C-007
+
+Artifact: `rmcp-3-migration`
+
+Result: PASS
+
+All applicable blocking constraints pass under the deterministic fallback.
+Exact commands, dependency deltas, API adaptations, and the non-blocking
+workspace-package attempt are recorded in `../refinement_log.md` and the
+OpenSpec verification record.
diff --git a/.refiner/artifacts/C-007/refinement_log.md b/.refiner/artifacts/C-007/refinement_log.md
new file mode 100644
index 000000000..681666c6e
--- /dev/null
+++ b/.refiner/artifacts/C-007/refinement_log.md
@@ -0,0 +1,21 @@
+# Refinement log — C-007
+
+## Iteration 1 — 2026-08-28
+
+- Captured a passing rmcp 2.2 discovery golden before changing the dependency.
+- Resolved and pinned rmcp exactly at 3.1.4.
+- Adapted only the three compile-time API deltas: MRTR tool/resource response
+  enums and the legacy-session configuration method rename.
+- Preserved the stdio service lifecycle and current HTTP session selection.
+- Added local and protocol-level `server/discover` golden comparisons.
+- Measured the exact transitive delta and retained Apache-2.0 compatibility.
+- Updated vulnerable `h2 0.4.15` and yanked `chacha20 0.10.1` to compatible
+  patch releases so the repository dependency policy passes without exceptions.
+
+Focused tests, all-target Clippy, workspace formatting/Clippy/lib-bin tests,
+product contract, product boundary, cargo-deny, strict OpenSpec, diff checks,
+and graph refresh pass. The installed artifact-refiner package lacks its
+canonical controllers, schemas, and validator agent, so the documented
+deterministic fallback was used.
+
+Overall: PASS.
diff --git a/.refiner/artifacts/C-008/artifact_manifest.json b/.refiner/artifacts/C-008/artifact_manifest.json
new file mode 100644
index 000000000..217c6c832
--- /dev/null
+++ b/.refiner/artifacts/C-008/artifact_manifest.json
@@ -0,0 +1,19 @@
+{
+  "schemaVersion": "1",
+  "artifactName": "C-008",
+  "artifactType": "code",
+  "contentType": "direct:code",
+  "status": "validated",
+  "sourceArtifacts": [
+    "crates/compass-mcp",
+    "crates/compass-cli",
+    "COMPATIBILITY.md",
+    "MIGRATION.md",
+    "SECURITY.md",
+    "CHANGELOG.md",
+    "docs/reference",
+    "openspec/changes/mcp-stateless-http"
+  ],
+  "distFiles": ["qa-receipt.md"],
+  "validatedAt": "2026-08-28T17:30:00Z"
+}
diff --git a/.refiner/artifacts/C-008/constraints.json b/.refiner/artifacts/C-008/constraints.json
new file mode 100644
index 000000000..df75299a2
--- /dev/null
+++ b/.refiner/artifacts/C-008/constraints.json
@@ -0,0 +1,18 @@
+{
+  "schemaVersion": "1",
+  "artifact": "C-008",
+  "blocking": [
+    {"id":"stateless-http","status":"PASS","evidence":"HTTP service disables legacy sessions and issues no Mcp-Session-Id"},
+    {"id":"protocol-2026","status":"PASS","evidence":"HTTP discovery advertises only 2026-07-28 and the gate requires matching protocol and method headers"},
+    {"id":"request-metadata","status":"PASS","evidence":"raw-wire cases assert typed errors for missing and incomplete metadata, missing and mismatched method headers, and initialize"},
+    {"id":"no-legacy-mode","status":"PASS","evidence":"MCP-2025 and initialize/session HTTP paths are rejected; no legacy flag exists"},
+    {"id":"session-timeout-deprecation","status":"PASS","evidence":"Both spellings validate, warn, are ignored through 0.4.x, and are documented for removal in 0.5.0"},
+    {"id":"exit-taxonomy","status":"PASS","evidence":"Unit and executable tests retain usage code 2 and runtime code 1"},
+    {"id":"security-boundaries","status":"PASS","evidence":"Bearer/API-key auth runs before outer allowed-host enforcement; invalid authenticated hosts cannot reach protocol diagnostics; 16 MiB request and 64 MiB streaming response limits pass"},
+    {"id":"stdio-boundary","status":"PASS","evidence":"Existing stdio discovery and handler compatibility tests remain green"},
+    {"id":"workspace-baseline","status":"PASS","evidence":"fmt, workspace lib/bin Clippy, workspace lib/bin tests, product contract, and product boundary pass"},
+    {"id":"adversarial-repair","status":"PASS","evidence":"all four major findings across two review rounds were repaired; dependency-scope baseline contamination was corrected"},
+    {"id":"final-review","status":"PASS","evidence":"fourth isolated review returned zero findings; strict anti-theater gate passed at score 0.0"},
+    {"id":"graph-refresh","status":"PASS","evidence":"120020 nodes, 282421 edges, 68 pre-existing omitted edges, zero identity collisions"}
+  ]
+}
diff --git a/.refiner/artifacts/C-008/dist/qa-receipt.md b/.refiner/artifacts/C-008/dist/qa-receipt.md
new file mode 100644
index 000000000..78dc3670b
--- /dev/null
+++ b/.refiner/artifacts/C-008/dist/qa-receipt.md
@@ -0,0 +1,15 @@
+# QA receipt — C-008
+
+Artifact: `mcp-stateless-http`
+
+Result: PASS
+
+All applicable blocking constraints pass under the deterministic fallback.
+Protocol, CLI, compatibility, migration, security, and verification evidence
+is recorded in `../refinement_log.md` and the OpenSpec verification record. A
+second deterministic iteration repaired both first-round adversarial findings:
+the response-size boundary and the missing raw-wire negative matrix. A third
+iteration closed host-validation ordering and supplied a true chunked-overflow
+proof. A fourth iteration clarified the accepted rmcp/session semantics, added
+the remaining Host matrix, and passed the isolated review plus anti-theater
+gate with no findings.
diff --git a/.refiner/artifacts/C-008/refinement_log.md b/.refiner/artifacts/C-008/refinement_log.md
new file mode 100644
index 000000000..08a063b8e
--- /dev/null
+++ b/.refiner/artifacts/C-008/refinement_log.md
@@ -0,0 +1,77 @@
+# Refinement log — C-008
+
+## Iteration 1 — 2026-08-28
+
+- Made Streamable HTTP stateless and advertised only MCP 2026-07-28 on HTTP.
+- Required exact `Mcp-Protocol-Version`, `Mcp-Method`, and rmcp per-request
+  metadata before handler dispatch.
+- Removed the stateful SSE-to-JSON adapter and all HTTP session keep-alive use.
+- Preserved stdio protocol compatibility through a transport-specific protocol
+  profile.
+- Proved raw-wire discovery and `tools/list` work independently without
+  `Mcp-Session-Id`, while authentication and host validation remain enforced.
+- Rejected legacy or incomplete HTTP requests with bounded typed JSON-RPC
+  errors, including the old initialize/session path.
+- Kept `--stateless` as a compatibility spelling and deprecated
+  `--session-timeout` through 0.4.x with removal in 0.5.0.
+- Added unit and executable-level regressions for warning text and unchanged
+  usage/runtime exit codes.
+
+Focused tests, all-target Clippy, workspace formatting/Clippy/lib-bin tests,
+product contract, product boundary, strict OpenSpec, diff checks, and graph
+refresh pass. The installed artifact-refiner package lacks its canonical
+controllers, schemas, and validator agent, so the documented deterministic
+fallback was used.
+
+Overall: PASS.
+
+## Iteration 2 — 2026-08-28
+
+- Repaired the first adversarial review's two major findings.
+- Restored the explicit 64 MiB HTTP response boundary with a streaming body
+  limiter. Known oversized bodies return the distinct typed JSON-RPC error
+  `-32023`; unknown-length bodies remain streaming but fail when the bound is
+  crossed.
+- Expanded the raw-wire regression to assert typed failures for absent and
+  incomplete request metadata, a mismatched `Mcp-Method`, and the explicitly
+  rejected current-version `initialize` path.
+- Proved that a valid current request carrying an obsolete `Mcp-Session-Id`
+  succeeds independently and receives no session identifier.
+- Re-ran all focused checks, workspace formatting/Clippy/lib-bin tests, product
+  contract, product boundary, strict OpenSpec validation, diff checks, and the
+  Compass graph refresh.
+
+Overall after adversarial repair: PASS.
+
+## Iteration 3 — 2026-08-28
+
+- Moved allowed-host enforcement into the outer authenticated gate before any
+  protocol diagnostic can return, while retaining rmcp's inner defense in
+  depth.
+- Added authenticated raw-wire cases proving an untrusted host receives HTTP
+  403 even when the protocol version is missing or obsolete.
+- Replaced the inferred streaming-limit check with an unknown-length,
+  multi-chunk channel body. The test observes the first in-bound chunk and an
+  explicit `LengthLimitError` instead of the overflowing chunk.
+- Corrected the isolated review baseline so C-007's `sha2` discovery-golden
+  dependency does not appear as C-008 scope.
+- Re-ran focused tests and Clippy, the full native baseline, product gates,
+  strict OpenSpec validation, diff checks, and graph refresh.
+
+Overall after second adversarial repair: PASS.
+
+## Iteration 4 — 2026-08-28
+
+- Made the accepted rmcp host-equivalence and obsolete-session semantics
+  explicit in source comments, tests, OpenSpec, and migration guidance.
+- Added invalid-auth/host, missing Host, malformed Host, and portless-allowlist
+  raw-wire coverage.
+- Scoped the `http-body-util` channel feature to the test dependency and removed
+  the final Unreleased changelog ambiguity.
+- The fourth fresh-context packet review returned zero findings across all
+  checked classes; the strict anti-theater gate accepted its detailed evidence
+  trail with score 0.0.
+- The final focused and workspace/product baselines, strict OpenSpec validation,
+  diff check, and graph refresh all pass.
+
+Final overall result: PASS.
diff --git a/.refiner/artifacts/C-009/final-verdict.md b/.refiner/artifacts/C-009/final-verdict.md
new file mode 100644
index 000000000..9d22f18ef
--- /dev/null
+++ b/.refiner/artifacts/C-009/final-verdict.md
@@ -0,0 +1,11 @@
+# C-009 deterministic QA final verdict
+
+PASS after four iterations. Artifact Refiner's canonical controllers, schemas,
+and validator agent are not installed in this workspace, so the required QA
+stage used the documented deterministic fallback. Contract, implementation,
+regression, workspace, product, and graph-refresh evidence are all green;
+three adversarial-review rounds found and drove repairs for identity coherence,
+schema closure, discovery metadata, compatibility goldens, response bounds,
+deprecation status, documentation parity, malformed standalone identities, and
+negative edge/detail coverage. The final independent pass is recorded under the
+phase review directory.
diff --git a/.refiner/artifacts/C-009/iteration-1-contract.md b/.refiner/artifacts/C-009/iteration-1-contract.md
new file mode 100644
index 000000000..eea74c8bf
--- /dev/null
+++ b/.refiner/artifacts/C-009/iteration-1-contract.md
@@ -0,0 +1,17 @@
+# C-009 deterministic QA — iteration 1
+
+## Focus
+
+Contract completeness and compatibility.
+
+## Evidence
+
+- `openspec validate mcp-result-envelope --strict` passed.
+- The design records the envelope fields, freshness semantics, all 15 tool
+  statuses, result discriminator separation, and migration boundary.
+- Root compatibility, migration, release, integration, and reference docs are
+  updated for the top-level structured-content change.
+
+## Verdict
+
+PASS. No unresolved contract placeholder or undocumented tool status remains.
diff --git a/.refiner/artifacts/C-009/iteration-2-implementation.md b/.refiner/artifacts/C-009/iteration-2-implementation.md
new file mode 100644
index 000000000..b3a3c7abb
--- /dev/null
+++ b/.refiner/artifacts/C-009/iteration-2-implementation.md
@@ -0,0 +1,25 @@
+# C-009 deterministic QA — iteration 2
+
+## Focus
+
+Implementation ownership, determinism, and boundedness.
+
+## Evidence
+
+- Envelope construction stays inside `compass-mcp`; query semantics remain in
+  `compass-query` and typed records remain in `compass-model`.
+- Metadata comes from the exact pinned graph or immutable store realization
+  used by `CodeQueryEngine`, so an atomic replacement cannot skew the envelope
+  identity away from its payload.
+- One `compass-model` validator rejects empty source-tree/generation identities
+  for strict JSON graphs, immutable store metadata summaries, and query-engine
+  metadata from either backend.
+- Evidence/confidence summaries use saturating counters and iterate only over
+  bounded returned records.
+- Tool discovery remains a fixed vector; local and rmcp wire goldens pin exact
+  output-schema digests and deprecation metadata.
+
+## Verdict
+
+PASS. The MCP layer is thin and adds no unbounded read or nondeterministic map
+iteration at the public contract boundary.
diff --git a/.refiner/artifacts/C-009/iteration-3-regressions.md b/.refiner/artifacts/C-009/iteration-3-regressions.md
new file mode 100644
index 000000000..2531c6441
--- /dev/null
+++ b/.refiner/artifacts/C-009/iteration-3-regressions.md
@@ -0,0 +1,32 @@
+# C-009 deterministic QA — iteration 3
+
+## Focus
+
+Golden outputs and semantic preservation.
+
+## Evidence
+
+- Four checked-in complete result fixtures pass for `search_symbols`,
+  `get_callers`, `get_callees`, and `get_impact`.
+- Each result retains the prior `compass.query/1` response under `data`.
+- Tests cover directed caller/callee results, exact edge multiplicity in the
+  fixture, explicit ambiguity, bounded truncation, warnings, null continuation,
+  stable order, closed output schemas (including every tagged detail variant
+  and graph enum), and MCP 2026 `resultType: complete`.
+- Table-driven schema checks serialize all 45 node kinds, 13 node roles, 29
+  edge kinds, 12 node-detail variants, and 5 edge-detail variants, including
+  per-variant negative mutations.
+- A separate pre-envelope golden pins two parallel call occurrences with
+  distinct IDs, source sites, detail payloads, evidence, and stable order.
+- The inner-pass/outer-fail response bound is exercised through rmcp
+  `call_tool` and preserves `query_response_too_large`.
+- Empty repository/generation identities fail graph validation before an MCP
+  envelope is emitted.
+- A low-level immutable-store snapshot regression proves empty identities are
+  also rejected when metadata is read without materializing the complete graph.
+- `cargo test -p compass-mcp --locked` passed: 20 unit, 8 result-contract, 6
+  coverage-path, and 2 discovery tests.
+
+## Verdict
+
+PASS. The wrapper does not discard or reinterpret typed query evidence.
diff --git a/.refiner/artifacts/C-009/iteration-4-verification.md b/.refiner/artifacts/C-009/iteration-4-verification.md
new file mode 100644
index 000000000..1ba4a7bab
--- /dev/null
+++ b/.refiner/artifacts/C-009/iteration-4-verification.md
@@ -0,0 +1,20 @@
+# C-009 deterministic QA — iteration 4
+
+## Focus
+
+Repository integration and release readiness.
+
+## Evidence
+
+- `cargo fmt --all -- --check` passed.
+- Workspace lib/bin Clippy with `-D warnings` passed.
+- Workspace lib/bin tests passed.
+- `cargo test -p compass-cli --test compass_product --locked` passed: 7 tests.
+- `sh scripts/check_product_boundary.sh` passed.
+- Strict OpenSpec validation and `git diff --check` passed.
+- `compass update .` completed with 120,215 nodes, 283,082 edges, 3,385
+  communities, zero identity collisions, and 68 pre-existing omitted edges.
+
+## Verdict
+
+PASS. No generated noise or product-boundary regression was introduced.
diff --git a/.refiner/artifacts/C-010/artifact_manifest.json b/.refiner/artifacts/C-010/artifact_manifest.json
new file mode 100644
index 000000000..559c55429
--- /dev/null
+++ b/.refiner/artifacts/C-010/artifact_manifest.json
@@ -0,0 +1,22 @@
+{
+  "schemaVersion": "1",
+  "artifactName": "C-010",
+  "artifactType": "conformance",
+  "contentType": "direct:evidence",
+  "status": "refined",
+  "sourceArtifacts": [
+    ".github/workflows/compass-ci.yml",
+    "crates/compass-mcp/src/transport.rs",
+    "crates/compass-mcp/tests/protocol_conformance.rs",
+    "scripts/fixtures/mcp-conformance-expected-failures.yaml",
+    "scripts/qualify_mcp_conformance.sh",
+    "scripts/qualify_codex_mcp_client.py",
+    "docs/implementation/mcp-conformance-and-interop.md",
+    "openspec/changes/mcp-conformance-interop",
+    ".kbd-orchestrator/phases/compass-scoping-and-bounds/execution.md"
+  ],
+  "distFiles": [
+    "dist/refinement-receipt.md"
+  ],
+  "validatedAt": "2026-08-29"
+}
diff --git a/.refiner/artifacts/C-010/constraints.json b/.refiner/artifacts/C-010/constraints.json
new file mode 100644
index 000000000..09cbb3cb3
--- /dev/null
+++ b/.refiner/artifacts/C-010/constraints.json
@@ -0,0 +1,36 @@
+{
+  "schemaVersion": "1",
+  "artifact": "C-010",
+  "blocking": [
+    {
+      "id": "latest-protocol",
+      "status": "PASS",
+      "evidence": "Official Model Context Protocol documentation identifies 2026-07-28 as the latest published revision; both Compass transports advertise only that revision and do not restore legacy initialize, sessions, resumable SSE, or the independent GET stream"
+    },
+    {
+      "id": "both-transports-conform",
+      "status": "PASS",
+      "evidence": "Native stdio conformance passes with exact ordered tool/resource inventories and the bounded pinned official HTTP qualification reports MCP conformance passed for spec 2026-07-28; fixture-only diagnostic failures remain check-granular expected failures"
+    },
+    {
+      "id": "named-client-evidence",
+      "status": "PASS",
+      "evidence": "Exact Codex CLI 0.150.1, Claude Code 2.1.251, and OpenCode 1.18.25 stdio/HTTP outcomes are recorded; passing cells prove real graph_stats discovery and invocation, and OpenCode HTTP is explicitly incompatible rather than mislabeled as passing"
+    },
+    {
+      "id": "compatibility-documented",
+      "status": "PASS",
+      "evidence": "OpenSpec, the implementation guide, COMPATIBILITY.md, phase plan, execution gate, and decision log consistently retain latest-MCP behavior and reject a legacy HTTP fallback"
+    },
+    {
+      "id": "product-boundary",
+      "status": "PASS",
+      "evidence": "scripts/check_product_boundary.sh passes and no Graphify or runtime fallback dependency was introduced"
+    },
+    {
+      "id": "repository-baseline",
+      "status": "PASS",
+      "evidence": "cargo fmt, workspace lib/bin Clippy with denied warnings, workspace lib/bin tests, portable runner timeout validation, spawned-server liveness, and separately named CI legs pass under the pinned locked toolchain"
+    }
+  ]
+}
diff --git a/.refiner/artifacts/C-010/decisions.md b/.refiner/artifacts/C-010/decisions.md
new file mode 100644
index 000000000..ec5506e6f
--- /dev/null
+++ b/.refiner/artifacts/C-010/decisions.md
@@ -0,0 +1,13 @@
+# Refinement decisions — C-010
+
+- Kept MCP 2026-07-28 as the normative server contract because official current
+  documentation identifies it as the latest published revision.
+- Treated independent stdio and HTTP conformance as the merge gate.
+- Preserved the exact named-client matrix as release evidence, including a real
+  tool invocation for every passing cell.
+- Recorded OpenCode 1.18.25 HTTP as incompatible because it requests the older
+  2025-11-25 initialize/GET lifecycle; did not relabel it as passing.
+- Applied the user's explicit direction to use the latest MCP revision, so a
+  lagging client does not force Compass to reintroduce removed behavior.
+- Kept regressions in current conformance and previously passing client cells
+  blocking, distinguishing server defects from external version lag.
diff --git a/.refiner/artifacts/C-010/dist/refinement-receipt.md b/.refiner/artifacts/C-010/dist/refinement-receipt.md
new file mode 100644
index 000000000..0374046f0
--- /dev/null
+++ b/.refiner/artifacts/C-010/dist/refinement-receipt.md
@@ -0,0 +1,14 @@
+# C-010 refinement receipt
+
+Status: **PASS**
+Date: 2026-08-29
+
+The latest-MCP conformance policy, exact client matrix, public documentation,
+and governing OpenSpec/KBD artifacts agree. Both current-protocol conformance
+legs pass. OpenCode 1.18.25 HTTP remains explicitly incompatible and no legacy
+Compass HTTP mode was added.
+
+The final clean, declared-file review passed with zero critical findings, three
+warnings, and one suggestion. Its strict sycophancy-correction gate also passed
+with score 0.0. The non-blocking observations are preserved in the durable C-010
+findings artifact; no unresolved blocker remains.
diff --git a/.refiner/artifacts/C-010/refinement_log.md b/.refiner/artifacts/C-010/refinement_log.md
new file mode 100644
index 000000000..fc0275af2
--- /dev/null
+++ b/.refiner/artifacts/C-010/refinement_log.md
@@ -0,0 +1,133 @@
+# Refinement log — C-010
+
+## Iteration 1 — 2026-08-29
+
+- Verified the latest published MCP revision through official Context7-backed
+  Model Context Protocol documentation.
+- Reframed the OpenSpec proposal, design, and normative scenarios around latest-
+  protocol conformance while retaining exact named-client evidence.
+- Updated the public implementation guide and KBD plan, execution gate, and
+  decision log to distinguish an older-client incompatibility from a Compass
+  conformance failure.
+- Re-ran strict OpenSpec validation, native stdio conformance, the pinned official
+  HTTP conformance suite, the product-boundary check, formatting, workspace
+  Clippy, and workspace library/binary tests successfully.
+- Syntax-validated the persisted artifact manifest and constraint record and
+  checked that every declared source and distribution artifact exists and is
+  non-empty.
+
+Overall after deterministic refinement: PASS.
+
+## Iteration 2 — review-packet correction
+
+- The initial isolated review packet omitted the CLI, migration, and changelog
+  files that implement and document the session-timeout deprecation path.
+- Verified both the unit and real-binary regressions for warning text and exit
+  taxonomy, plus the existing `MIGRATION.md` and `CHANGELOG.md` entries.
+- Expanded the declared C-010 review surface so the reviewer receives those
+  implementation and documentation hunks instead of inferring their absence.
+
+Overall after refinement iteration 2: PASS; fresh-context re-review required.
+
+## Iteration 3 — complete-surface review findings
+
+- Removed a machine-specific absolute KBD skill path from the repository-owned
+  execution handoff.
+- Split stdio and HTTP into separately named CI conformance steps.
+- Added exact ordered tool and resource inventory assertions to the native stdio
+  conformance test and removed a stale nonexistent-fixture reference.
+- Corrected the verification receipt to disclose the one baselined header-runner
+  invalid-argument check precisely.
+- Added spawned-server liveness checking to prevent a fixed-port readiness false
+  positive and bounded every official runner subprocess to a configurable 1–1800
+  second interval using a portable Python subprocess boundary.
+
+Overall after refinement iteration 3: PASS; fresh-context re-review required.
+
+## Iteration 4 — PASS-review follow-up
+
+- Disclosed that the reference runner's identifier-only expected-failure format
+  cannot distinguish its invalid-argument cause from a future header defect.
+- Added a native regression that directly pins optional-whitespace normalization.
+- Relabeled the execution ledger as a historical dispatch snapshot with the
+  canonical live-progress pointer.
+- Corrected the Codex reproduction wording and the HTTP-only runner's final
+  success message.
+
+Overall after refinement iteration 4: PASS.
+
+## Iteration 5 — final-review hardening
+
+- Made whitespace-only normalized MCP headers disappear so downstream validation
+  treats them exactly like missing required headers.
+- Moved HTTP Compass startup/readiness inside the interop harness cleanup scope
+  and redirected server stderr to a bounded temporary-file lifecycle instead of
+  an undrained pipe.
+- Replaced optimization-sensitive Python assertions for subprocess pipes with
+  explicit diagnostics.
+- Disclosed identifier-only failure matching for every reference-runner baseline,
+  and separated those unadvertised diagnostic gaps from native product claims.
+
+Overall after refinement iteration 5: PASS.
+
+## Isolated review before final hardening — 2026-08-29
+
+- Rebuilt the isolated review packet with every declared source artifact,
+  including untracked additions, through a temporary Git index.
+- Fresh-context adversarial review returned PASS with zero critical findings,
+  three warnings, and two suggestions.
+- The remaining observations are non-blocking: two concern C-008-owned context
+  outside this packet, and one recommends a future output bound for a local
+  qualification subprocess.
+
+That review pass was superseded by a later full-packet review after spec sync.
+
+## Iteration 6 — protocol and receipt proof
+
+- Configured the stdio client leg to use only the 2026-07-28 discovery
+  lifecycle and assert the negotiated peer version before inventory or
+  invocation checks.
+- Made the Codex harness require an explicit expected version, verify the
+  binary's exact `codex --version` output, and emit version, discovery,
+  invocation, and overall PASS fields in its receipt.
+- Added a successful end-to-end HTTP `graph_stats` request with optional
+  whitespace around `Mcp-Name`.
+- Cause-gated the reference runner's whitespace-header baseline to the reviewed
+  HTTP 400 / JSON-RPC `-32602` invalid-argument result, so the identifier cannot
+  mask a header mismatch.
+- Re-ran focused Rust tests, the official HTTP runner, and strict OpenSpec
+  validation successfully.
+
+Overall after refinement iteration 6: PASS; fresh-context re-review required.
+
+## Iteration 7 — latest-only production stdio
+
+- A path-contaminated review nevertheless surfaced one valid policy gap:
+  production stdio advertised legacy protocol revisions even though its test
+  client selected 2026-07-28.
+- Restricted both production transports to 2026-07-28 and made the removed
+  `initialize` lifecycle fail explicitly on stdio as it already did on HTTP.
+- Added a regression that proves a 2025-11-25 stdio initialize is rejected.
+- Updated compatibility, migration, changelog, implementation, OpenSpec, and
+  refinement records to disclose the intentional stdio cutover.
+- Corrected packet assembly to use the OpenSpec change name, allowing the
+  reviewer to consume `files.txt` instead of the repository's cumulative dirty
+  diff.
+
+Overall after refinement iteration 7: PASS; fresh-context re-review required.
+
+## Iteration 8 — clean scoped final review
+
+- Rebuilt the packet against the `mcp-conformance-interop` declared file set
+  through a temporary Git index, excluding unrelated dirty-tree files from the
+  diff under review.
+- The external fresh-context judge completed through the REST gateway and
+  returned PASS with zero critical findings, three warnings, and one suggestion.
+- The strict sycophancy-correction gate passed with a score of 0.0.
+- The remaining observations are non-blocking and recorded in the durable
+  findings artifact: cumulative hunks inside shared compatibility documents,
+  parity risk in the defensive host-header diagnostic helper, the prerequisite
+  rmcp pin living in C-007, and a suggested explicit `curl` preflight for the
+  qualification script.
+
+Overall after refinement iteration 8: PASS; ready to archive.
diff --git a/.refiner/artifacts/C-011/artifact_manifest.json b/.refiner/artifacts/C-011/artifact_manifest.json
new file mode 100644
index 000000000..295f64c8d
--- /dev/null
+++ b/.refiner/artifacts/C-011/artifact_manifest.json
@@ -0,0 +1,26 @@
+{
+  "schemaVersion": "1",
+  "artifactName": "C-011",
+  "artifactType": "decision",
+  "contentType": "direct:evidence",
+  "status": "refined",
+  "sourceArtifacts": [
+    "docs/future/surrealdb-license-decision.md",
+    "docs/future/surreal-persistent-probe-results.md",
+    ".kbd-orchestrator/phases/compass-scoping-and-bounds/decision-log.md",
+    ".kbd-orchestrator/phases/compass-scoping-and-bounds/execution.md",
+    ".kbd-orchestrator/phases/compass-scoping-and-bounds/plan.md",
+    "openspec/changes/archive/2026-08-29-surrealdb-license-decision",
+    ".refiner/artifacts/C-012/constraints.json",
+    ".refiner/artifacts/C-012/dist/refinement-receipt.md",
+    ".refiner/artifacts/C-013/constraints.json",
+    ".refiner/artifacts/C-013/dist/refinement-receipt.md",
+    "docs/future/qualification-corpora-baselines.md",
+    "scripts/fixtures/surreal-persistent-probes/manifest-v1.json",
+    "scripts/fixtures/surreal-persistent-probes/SURREALDB-3.2.4-LICENSE.txt"
+  ],
+  "distFiles": [
+    "dist/refinement-receipt.md"
+  ],
+  "validatedAt": "2026-08-29"
+}
diff --git a/.refiner/artifacts/C-011/constraints.json b/.refiner/artifacts/C-011/constraints.json
new file mode 100644
index 000000000..c38173ef9
--- /dev/null
+++ b/.refiner/artifacts/C-011/constraints.json
@@ -0,0 +1,46 @@
+{
+  "schemaVersion": "1",
+  "artifact": "C-011",
+  "blocking": [
+    {
+      "id": "explicit-authority",
+      "status": "PASS",
+      "evidence": "The project user explicitly wrote C-011: ACCEPT in the active Codex task on 2026-08-29; the decision artifact and phase decision log preserve that exact provenance and identify the authority role as user"
+    },
+    {
+      "id": "closed-profile-scope",
+      "status": "PASS",
+      "evidence": "The governing design defines ACCEPT as approval of every named artifact profile under its stated conditions, and the sign-off records exactly that scope without inventing exclusions or waivers"
+    },
+    {
+      "id": "pinned-license-boundary",
+      "status": "PASS",
+      "evidence": "Acceptance applies only to SurrealDB 3.2.4 at the pinned license digest and retains the exact BSL license, notices, Change Date, Change License, redistribution duties, and Database Service restriction"
+    },
+    {
+      "id": "upgrade-fails-closed",
+      "status": "PASS",
+      "evidence": "Every SurrealDB version upgrade requires a fresh license and artifact-profile review; this decision cannot silently authorize a different version"
+    },
+    {
+      "id": "precommitment-immutable",
+      "status": "PASS",
+      "evidence": "The phase plan still has the exact C-013 pinned SHA-256 46e37804d513cf32ce8e7d008816642dffbb9d3b7b60fd3f2e82a482cd398ebf; live gate status is recorded outside that immutable planning snapshot"
+    },
+    {
+      "id": "license-byte-identity",
+      "status": "PASS",
+      "evidence": "A bounded 2026-08-29 fetch of the official raw v3.2.4 LICENSE matched the retained fixture byte-for-byte and both hashed to 98a94ac615f88370865016487b436fa404560910bd329794ed7502277a94b805"
+    },
+    {
+      "id": "downstream-gates",
+      "status": "PASS",
+      "evidence": "C-012 and C-013 have retained completion evidence and C-011 passed mandatory pre-archive review and is published in the dated archive; the C-014/C-015 Wave 5 gate is closed, while C-020 remains conditional on a separately recorded independent user problem"
+    },
+    {
+      "id": "no-runtime-change",
+      "status": "PASS",
+      "evidence": "C-011 records a release decision only and adds no SurrealDB dependency, code, runtime behavior, or shipped artifact"
+    }
+  ]
+}
diff --git a/.refiner/artifacts/C-011/decisions.md b/.refiner/artifacts/C-011/decisions.md
new file mode 100644
index 000000000..2351b7109
--- /dev/null
+++ b/.refiner/artifacts/C-011/decisions.md
@@ -0,0 +1,20 @@
+# Decisions — C-011
+
+## Accept every named SurrealDB 3.2.4 artifact profile
+
+- Decision: `ACCEPT`
+- Authority: project user
+- Date: 2026-08-29
+- Provenance: active Codex task message, “C-011: ACCEPT”
+- Scope: every artifact profile named in
+  `docs/future/surrealdb-license-decision.md`, under its stated release
+  conditions
+- Falsifier: any version change, license-text/digest change, artifact profile
+  outside the recorded inventory, or failure to satisfy the recorded BSL notice,
+  redistribution, or Database Service conditions requires a fresh decision and
+  blocks release
+
+This decision satisfies the approval component of the Wave 5 gate, passed
+mandatory pre-archive review, and is published in the dated OpenSpec archive.
+C-012 and C-013 are already complete, so C-014/C-015 may proceed. C-020 remains
+conditional on its distinct independent-user-problem prerequisite.
diff --git a/.refiner/artifacts/C-011/dist/refinement-receipt.md b/.refiner/artifacts/C-011/dist/refinement-receipt.md
new file mode 100644
index 000000000..5a912efed
--- /dev/null
+++ b/.refiner/artifacts/C-011/dist/refinement-receipt.md
@@ -0,0 +1,23 @@
+# C-011 refinement receipt
+
+Result: PASS
+
+The user's explicit `ACCEPT` decision is recorded with exact provenance and the
+closed semantics defined before approval: every named SurrealDB 3.2.4 artifact
+profile is approved under its stated release conditions. The decision remains
+limited to the pinned version and license digest, preserves all BSL notice,
+redistribution, and Database Service conditions, and fails closed on upgrades.
+
+C-012 and C-013 have retained completion evidence, and C-011's corrected
+pre-archive fresh-context review passed with zero critical findings. C-011 is
+published in the dated OpenSpec archive, satisfying the Wave 5 entry gate and
+unblocking C-014/C-015. C-020 remains conditional on a separately recorded independent
+user problem. This decision record adds no dependency or runtime behavior.
+
+The C-013 plan precommitment remains byte-identical to its pinned SHA-256, and a
+bounded re-fetch of the official raw v3.2.4 license matched the retained fixture
+byte-for-byte at the pinned digest.
+
+The final archived-state external review passed with zero critical findings and
+three warnings; its strict anti-sycophancy gate passed. All findings remain in
+the durable C-011 KBD review record.
diff --git a/.refiner/artifacts/C-011/refinement_log.md b/.refiner/artifacts/C-011/refinement_log.md
new file mode 100644
index 000000000..34c4bdaa3
--- /dev/null
+++ b/.refiner/artifacts/C-011/refinement_log.md
@@ -0,0 +1,109 @@
+# Refinement log — C-011
+
+## Iteration 1 — 2026-08-29
+
+- Recorded the user's exact `C-011: ACCEPT` provenance, decision role, and date.
+- Applied the OpenSpec design's closed acceptance semantics: every named profile
+  is approved under its stated conditions.
+- Preserved the pinned SurrealDB 3.2.4 license digest, BSL notices, Change Date,
+  Change License, redistribution duties, Database Service restriction, and
+  mandatory fresh review for every upgrade.
+- Updated the phase decision log, execution contract, plan, and probe disposition
+  so C-014/C-015 are unblocked after the already completed C-012/C-013 gates.
+- Preserved C-020's independent-user-problem condition; the license decision
+  does not authorize that optional change by itself.
+
+Overall after deterministic refinement: PASS; adversarial review required.
+
+## Iteration 2 — adversarial evidence closure
+
+- The first review correctly rejected a gate-satisfaction claim whose scoped
+  packet omitted the existing C-012/C-013 certification records.
+- Added the prerequisite OpenSpec verification records, refinement constraints
+  and receipts, budget decision, and pinned SurrealDB license/fixture manifest to
+  the declared review surface.
+- Changed every downstream gate statement to keep C-014/C-015 blocked until
+  C-011 itself passes mandatory review and archive certification.
+
+Overall after refinement iteration 2: PASS; adversarial re-review required.
+
+## Iteration 3 — corrected pre-archive PASS review
+
+- The corrected external fresh-context review returned PASS with zero critical
+  findings, three warnings, and one suggestion.
+- Its strict anti-sycophancy gate passed with score 0.0.
+- Labeled the plan's completion counter as its historical planning snapshot,
+  marked the carried Wave 5 decision block resolved, and added the execution
+  contract's last-updated date.
+- The remaining unrelated-hunk warning is an acknowledged consequence of the
+  repository's cumulative uncommitted phase ledger, not missing C-011 evidence.
+
+Overall after refinement iteration 3: PASS; archive publication and archived-state review required.
+
+## Iteration 4 — archive-state correction
+
+- A terminal-state review correctly rejected the change because task 2.2 and the
+  gate were marked complete before the active OpenSpec directory had moved to
+  the dated archive.
+- Added every file named by the retained C-012 fixture manifest to the review
+  surface and corrected the C-012/C-013 artifact manifests to their dated
+  archive paths.
+- Published C-011 to the dated OpenSpec archive before building the final review
+  packet, so the judge evaluates the actual final repository state.
+
+Overall after refinement iteration 4: archived-state review BLOCK; correction required.
+
+## Iteration 5 — immutable precommitment repair
+
+- The first archived-state audit correctly caught that live Wave 5 status edits
+  had mutated C-013's SHA-256-pinned pre-measurement plan.
+- Restored `plan.md` byte-for-byte to its pinned
+  `46e37804d513cf32ce8e7d008816642dffbb9d3b7b60fd3f2e82a482cd398ebf`
+  realization; live gate resolution remains in the decision log, execution
+  contract, and KBD progress projection.
+- This restoration intentionally reverted Iteration 3's plan counter label and
+  Wave 5 block annotation; only the execution contract's last-updated field from
+  that iteration remains in force.
+- Re-fetched the official raw SurrealDB v3.2.4 license through a 30-second
+  network bound and verified both its SHA-256 and byte-for-byte identity against
+  the retained fixture.
+- Clarified that task 2.2's mandatory review is the corrected pre-archive PASS;
+  the archived-state audit is an additional fail-closed publication check.
+
+Overall after refinement iteration 5: PASS; fresh archived-state review required.
+
+## Iteration 6 — prerequisite provenance separation
+
+- Restored C-012's probe-results disposition as a historical 2026-08-28 record
+  that neither incorporates nor depends on C-011's later acceptance.
+- Revalidated C-012 on 2026-08-29 after normalizing its manifest to the dated
+  archive path; all source/dist paths, PASS constraints, and fixture hashes pass.
+- Added the BSL conversion acceleration clause from the pinned license and
+  standardized the downstream status as “gate satisfied / changes unblocked.”
+
+Overall after refinement iteration 6: PASS; fresh archived-state review required.
+
+## Iteration 7 — complete prerequisite packet
+
+- Added the existing C-012/C-013 decisions and C-013 ten-round refinement log to
+  the declared packet; the prior reviewer had inferred absence from their
+  omission in `files.txt` even though the repository files already existed.
+- Replaced C-013's contradictory early filesystem timestamp with the verified
+  ordering relation around its unchanged pinned plan hash.
+- Recorded the exact pre-archive and post-archive OpenSpec validation commands
+  and results in the archived C-011 verification artifact.
+
+Overall after refinement iteration 7: PASS; fresh archived-state review required.
+
+## Final archived-state review
+
+- External fresh-context judge `k3` reviewed the complete dated archive packet
+  through the isolated REST gateway.
+- Verdict: PASS with zero critical findings, three warnings, and no suggestions.
+- The strict anti-sycophancy gate passed with score 0.0.
+- Non-blocking warnings remain preserved in the durable KBD findings record:
+  the deliberately immutable plan snapshot reads historically, the C-013 prose
+  ordering is stricter than its enforced Wave 5 criterion, and the cumulative
+  uncommitted phase ledger adds unrelated hunks to per-change diffs.
+
+Final certification: PASS.
diff --git a/.refiner/artifacts/C-012/artifact_manifest.json b/.refiner/artifacts/C-012/artifact_manifest.json
new file mode 100644
index 000000000..1a305cbb7
--- /dev/null
+++ b/.refiner/artifacts/C-012/artifact_manifest.json
@@ -0,0 +1,16 @@
+{
+  "schemaVersion": "1",
+  "artifactName": "C-012",
+  "artifactType": "evaluation",
+  "contentType": "direct:evidence",
+  "status": "refined",
+  "sourceArtifacts": [
+    "docs/future/surreal-persistent-probe-results.md",
+    "scripts/fixtures/surreal-persistent-probes",
+    "openspec/changes/archive/2026-08-28-surreal-persistent-probes"
+  ],
+  "distFiles": [
+    "dist/refinement-receipt.md"
+  ],
+  "validatedAt": "2026-08-29"
+}
diff --git a/.refiner/artifacts/C-012/constraints.json b/.refiner/artifacts/C-012/constraints.json
new file mode 100644
index 000000000..9b755572f
--- /dev/null
+++ b/.refiner/artifacts/C-012/constraints.json
@@ -0,0 +1,41 @@
+{
+  "schemaVersion": "1",
+  "artifact": "C-012",
+  "blocking": [
+    {
+      "id": "persistent-engines",
+      "status": "PASS",
+      "evidence": "Identical workloads completed on persistent SurrealKV and RocksDB; Mem was not substituted"
+    },
+    {
+      "id": "semantic-equivalence",
+      "status": "PASS",
+      "evidence": "Canonical semantic summaries are byte-identical across engines for 2051 directed relations and 17 pages"
+    },
+    {
+      "id": "dirty-shutdown-recovery",
+      "status": "PASS",
+      "evidence": "A killed candidate writer never replaced active generation g-0001 on either engine"
+    },
+    {
+      "id": "deterministic-fixtures",
+      "status": "PASS",
+      "evidence": "Sorted manifest checksums and independent ordered-ID digest verification pass"
+    },
+    {
+      "id": "license-capture",
+      "status": "PASS",
+      "evidence": "Retained v3.2.4 license bytes match upstream SHA-256 98a94ac615f88370865016487b436fa404560910bd329794ed7502277a94b805"
+    },
+    {
+      "id": "disposable-boundary",
+      "status": "PASS",
+      "evidence": "Spike source, targets, databases, and logs were deleted; Compass manifests and Cargo.lock remain unchanged with no SurrealDB package"
+    },
+    {
+      "id": "claims-boundary",
+      "status": "PASS",
+      "evidence": "Measurements are explicitly descriptive and remain gated by C-011 licensing and C-013 budget ratification"
+    }
+  ]
+}
diff --git a/.refiner/artifacts/C-012/decisions.md b/.refiner/artifacts/C-012/decisions.md
new file mode 100644
index 000000000..dcbbc13aa
--- /dev/null
+++ b/.refiner/artifacts/C-012/decisions.md
@@ -0,0 +1,13 @@
+# Refinement decisions — C-012
+
+- Kept the runner outside the workspace and deleted it after measurement.
+- Required both persistent engines; in-memory behavior is not acceptance
+  evidence.
+- Compared one canonical semantic summary instead of engine-native file bytes.
+- Tested application-level immutable generation activation: partial candidates
+  may remain unreachable, but cannot become active after a killed writer.
+- Stored confidence as a six-decimal string to make round-trip equality exact.
+- Recorded resource values without budget verdicts because C-013 must ratify
+  budgets independently and before later Surreal measurements are considered.
+- Kept license capture and release approval distinct: exact bytes are evidence,
+  while C-011 retains decision authority.
diff --git a/.refiner/artifacts/C-012/dist/refinement-receipt.md b/.refiner/artifacts/C-012/dist/refinement-receipt.md
new file mode 100644
index 000000000..f8baa4011
--- /dev/null
+++ b/.refiner/artifacts/C-012/dist/refinement-receipt.md
@@ -0,0 +1,14 @@
+# C-012 refinement receipt
+
+Result: PASS
+
+The retained artifacts prove both persistent engines preserve the required
+semantic and dirty-shutdown visibility contracts on the deterministic vector.
+They also preserve exact license evidence and descriptive resource costs while
+leaving no production dependency or disposable probe artifact in Compass.
+An isolated cross-model review passed with zero critical findings; all four
+auditability warnings were resolved before archive.
+
+The dated archive path and historical probe disposition were revalidated on
+2026-08-29 without changing the qualified engine results or depending on C-011's
+later decision.
diff --git a/.refiner/artifacts/C-012/refinement_log.md b/.refiner/artifacts/C-012/refinement_log.md
new file mode 100644
index 000000000..7eec76a52
--- /dev/null
+++ b/.refiner/artifacts/C-012/refinement_log.md
@@ -0,0 +1,54 @@
+# Refinement log — C-012
+
+## Iteration 1 — 2026-08-28
+
+- Defined a versioned engine-neutral vector with stable IDs, parallel direction,
+  provenance, confidence, generations, and bounded pagination.
+- Built one disposable SurrealDB 3.2.4 runner with mutually exclusive persistent
+  SurrealKV and RocksDB feature profiles.
+- Corrected the crash harness so baseline publication happens in a separate
+  process; this ensures the storage handle is closed before the killed writer
+  opens the database.
+- Retained exact per-engine semantic/resource results and official license bytes.
+- Verified engine equivalence, checksums, license identity, Compass dependency
+  cleanliness, and complete disposal of the spike.
+
+The installed artifact-refiner adapter lacks its referenced canonical
+controllers, schemas, and validator. The repository's deterministic fallback
+record format was used, and its JSON documents are syntax-validated.
+
+Overall after refinement: PASS.
+
+## Iteration 2 — adversarial findings
+
+- Retained the exact scale-edge expansion rule recovered from the executed
+  disposable runner.
+- Added independent expected ordered-ID and expanded-relation digests.
+- Added per-engine post-crash active generation, relation count, and ordered-ID
+  digest evidence.
+- Recorded the exact pre/post Compass manifest and lockfile checksum-ledger
+  digest.
+- Verified the review's link suggestion points to the existing C-011 decision
+  record.
+
+The isolated cross-model review verdict remains PASS with no critical finding;
+all warnings are resolved in the retained artifacts.
+
+## Final qualification
+
+- All retained JSON and checksum-manifest entries validate.
+- The official tagged license comparison, product-boundary gate, OpenSpec
+  strict validation, and scoped whitespace check pass.
+- Final graph refresh indexed 713 files, 121,261 nodes, 285,681 edges, and
+  3,389 communities with zero identity collisions; 68 invalid edges remain
+  explicitly omitted by the existing partial-publication boundary.
+
+## Post-archive provenance revalidation — 2026-08-29
+
+- Normalized the OpenSpec source-artifact path to the dated archive location.
+- Kept the probe disposition historical to its 2026-08-28 completion date; it
+  does not incorporate or depend on C-011's later acceptance outcome.
+- Revalidated every source/dist path, every PASS constraint, and every retained
+  fixture checksum after the provenance correction.
+
+Post-archive provenance validation: PASS.
diff --git a/.refiner/artifacts/C-013/artifact_manifest.json b/.refiner/artifacts/C-013/artifact_manifest.json
new file mode 100644
index 000000000..e754397f4
--- /dev/null
+++ b/.refiner/artifacts/C-013/artifact_manifest.json
@@ -0,0 +1,16 @@
+{
+  "schemaVersion": "1",
+  "artifactName": "C-013",
+  "artifactType": "qualification",
+  "contentType": "direct:evidence",
+  "status": "refined",
+  "sourceArtifacts": [
+    "benchmarks/qualification",
+    "docs/future/qualification-corpora-baselines.md",
+    "openspec/changes/archive/2026-08-29-qualification-corpora-baselines"
+  ],
+  "distFiles": [
+    "dist/refinement-receipt.md"
+  ],
+  "validatedAt": "2026-08-29"
+}
diff --git a/.refiner/artifacts/C-013/constraints.json b/.refiner/artifacts/C-013/constraints.json
new file mode 100644
index 000000000..ef9b83013
--- /dev/null
+++ b/.refiner/artifacts/C-013/constraints.json
@@ -0,0 +1,46 @@
+{
+  "schemaVersion": "1",
+  "artifact": "C-013",
+  "blocking": [
+    {
+      "id": "precommitted-budgets",
+      "status": "PASS",
+      "evidence": "The complete budget table was ratified unchanged with pre-measurement plan and research-section SHA-256 provenance; C-012 measurements were excluded from the decision basis"
+    },
+    {
+      "id": "deterministic-scale-profiles",
+      "status": "PASS",
+      "evidence": "Full metadata-only iteration reproduced pinned node and edge digests for 100000/250000 and 1000000/2500000 profiles"
+    },
+    {
+      "id": "closed-artifact-inventory",
+      "status": "PASS",
+      "evidence": "manifest-v1.json lists every retained qualification file with exact byte count and SHA-256; the test suite rejects omissions or mismatches"
+    },
+    {
+      "id": "bounded-work",
+      "status": "PASS",
+      "evidence": "Generation, graph scanning, task-document bytes/count, declared task limits, traversal depth/results, every metadata, warmup, and measured subprocess, streamed binary compression, source-patch capture, and retained artifact sizes have explicit limits; every task and result has explicit expected/actual status; graph and JSON results publish atomically; exhaustion is exit 2, never an empty result"
+    },
+    {
+      "id": "semantic-and-task-corpora",
+      "status": "PASS",
+      "evidence": "Pinned semantic sources cover identity, direction, multiplicity, evidence, ambiguity, negatives, ordering, and pagination; exactly 30 balanced tasks pass the bounded raw-traversal oracle"
+    },
+    {
+      "id": "skill-compatibility-corpora",
+      "status": "PASS",
+      "evidence": "The shipped 14-case trigger corpus is pinned and partitioned exactly into two umbrella and twelve focused boundary cases with two cases for every focused skill"
+    },
+    {
+      "id": "current-engine-baseline",
+      "status": "PASS",
+      "evidence": "One reproducible runner validates the supplied graph bytes/hash/counts/logical digests, emits the complete retained schema with repository-relative paths plus tracked-patch/explicit tracked/non-ignored-untracked source identities, and records binary/runtime-pinned gzip size, cold start, five explicitly bounded query workloads, nearest-rank p95, peak RSS, host/tool versions, commands, and the measured raw 30-task denominator"
+    },
+    {
+      "id": "product-boundary",
+      "status": "PASS",
+      "evidence": "The change adds developer qualification artifacts only; the product-boundary gate passes and no runtime dependency or public command changes"
+    }
+  ]
+}
diff --git a/.refiner/artifacts/C-013/decisions.md b/.refiner/artifacts/C-013/decisions.md
new file mode 100644
index 000000000..42719f839
--- /dev/null
+++ b/.refiner/artifacts/C-013/decisions.md
@@ -0,0 +1,17 @@
+# Refinement decisions — C-013
+
+- Kept the research thresholds unchanged and recorded their source hashes before
+  considering any future Surreal projection result.
+- Used streaming graph emission and metadata-only full logical iteration so the
+  million-node profile is reproducible without checking in a multi-gigabyte graph.
+- Pinned full node-record and edge-record digests rather than relying only on a
+  small sample or generator source hash.
+- Made the retained benchmark manifest closed: every retained file below
+  `benchmarks/qualification/` other than the manifest itself must be listed.
+- Required exactly 30 balanced tasks and verified all expected evidence through
+  the bounded raw-traversal denominator on the exact medium graph.
+- Preserved process-level current-engine measurements as host-specific evidence,
+  not universal performance claims or future-engine verdicts.
+- Kept generated graphs, caches, logs, and binaries disposable under `target/`.
+- Kept KBD-required `.refiner/artifacts/C-013` receipts as project QA evidence;
+  these are distinct from generated product data and local `.compass/` state.
diff --git a/.refiner/artifacts/C-013/dist/refinement-receipt.md b/.refiner/artifacts/C-013/dist/refinement-receipt.md
new file mode 100644
index 000000000..7e07b4f49
--- /dev/null
+++ b/.refiner/artifacts/C-013/dist/refinement-receipt.md
@@ -0,0 +1,19 @@
+# C-013 refinement receipt
+
+Result: PASS
+
+The retained artifacts form a closed, deterministic qualification surface for
+future engine comparisons. Exact scale identities, bounded traversal behavior,
+semantic/task/skill corpora, precommitted budgets, and reproducible current-engine
+measurements all pass their deterministic checks. This receipt does not approve
+SurrealDB licensing or claim that a future engine meets the ratified budgets.
+
+Final deterministic evidence: 30 qualification tests, strict OpenSpec
+validation, the product-boundary gate, retained JSON parsing, checksum closure,
+and a repository graph refresh all pass. The refreshed graph contains 121,261
+nodes and 285,681 edges; its explicit partial-publication warning reports 68
+omitted edges, zero omitted nodes, and zero quarantined identity collisions.
+
+The concluding isolated cross-model review passed with 0 critical findings,
+2 warnings, and 2 suggestions; its anti-theater screen passed and all findings
+remain retained in the KBD review record.
diff --git a/.refiner/artifacts/C-013/refinement_log.md b/.refiner/artifacts/C-013/refinement_log.md
new file mode 100644
index 000000000..eebb90c98
--- /dev/null
+++ b/.refiner/artifacts/C-013/refinement_log.md
@@ -0,0 +1,181 @@
+# Refinement log — C-013
+
+## Iteration 1 — 2026-08-28
+
+- Ratified the Wave 5 budget table unchanged with exact pre-measurement source
+  provenance and an explicit prohibition on post-result threshold tuning.
+- Added bounded deterministic medium and large generators with complete logical
+  digests, stable identities, directed parallel edges, and source evidence.
+- Added a pinned semantic corpus, a bounded traversal denominator, exactly 30
+  balanced agent tasks, and umbrella/focused-skill compatibility corpora.
+- Measured the current release engine against the exact medium graph, retaining
+  five samples per workload, p95, peak RSS, graph/binary identities, and host data.
+- Added a closed checksum manifest and a regression that verifies every retained
+  qualification file's byte count and SHA-256 while rejecting omissions.
+- Re-ran all 12 qualification tests, full medium/large metadata digest generation,
+  strict OpenSpec validation, JSON parsing, scoped whitespace checks, and the
+  product-boundary gate successfully.
+
+The installed artifact-refiner adapter lacks its referenced canonical
+controllers, schemas, and validator. The repository's deterministic fallback
+record format was used, and both JSON records are syntax-validated.
+
+Overall after deterministic refinement: PASS.
+
+## Iteration 2 — adversarial findings
+
+- Reworked the baseline runner so a single documented invocation measures and
+  emits the complete retained schema, including the bounded raw denominator,
+  computed Git/source-patch identity, and repository-relative paths.
+- Replaced the mislabeled path endpoints with a verified exact three-hop
+  shortest path. The legacy command has no depth flag, so the fixed finite graph
+  and 120-second subprocess timeout are recorded as independent bounds.
+- Added clean exit-2 validation for malformed tasks, invalid small profiles,
+  and out-of-range sample ordinals; regression tests reject tracebacks.
+- Added deadline checks inside full node scans for symbol resolution and search.
+- Added a timing-free exact-medium raw oracle and continuously validate every
+  expected result for all 30 versioned tasks.
+- Confirmed `.refiner/artifacts/C-013` is required project QA evidence under the
+  KBD per-change persistence contract, consistent with the existing C-001 through
+  C-009, C-012, and C-017 receipts; it is not a generated product artifact or
+  `.compass/` runtime state.
+- Re-ran the complete five-sample current-engine baseline and all 18
+  qualification tests after the corrections.
+
+Overall after refinement iteration 2: PASS; adversarial re-review required.
+
+## Iteration 3 — PASS-review warnings and suggestions
+
+- Routed Git patch capture and every Git/binary/Rust/Cargo metadata command
+  through the repository's bounded measured-process helper with explicit
+  time, stdout, and stderr limits.
+- Made the README invocation match the retained cache path and destination.
+- Added a normal regression test that fully regenerates both medium and large
+  logical digests and compares all pinned counts and hashes.
+- Made the synthetic source file's `contentDigest` profile-specific, regenerated
+  the exact medium graph, and re-ran the full baseline against its new hash.
+- Added source-derived assertions for every semantic corpus count claim.
+- Re-ran all 19 tests, strict OpenSpec validation, JSON/manifest checks, the
+  product-boundary gate, and scoped whitespace checks successfully.
+
+Overall after refinement iteration 3: PASS; final adversarial re-review required.
+
+## Iteration 4 — final-review findings
+
+- Restored the reproduction destination to disposable `target/` and documented
+  retained-baseline promotion as a separate dated manifest update.
+- Corrected verification language: the synthetic file content digest is
+  profile-specific, while its stable file ID intentionally denotes the common
+  source path across profiles.
+- Added explicit stdout/stderr limits to every measured workload and regression
+  coverage that rejects an oversized capture.
+- Validated the supplied graph's bytes, file SHA-256, node/edge counts, and full
+  logical digests against generator metadata and the pinned scale digest catalog;
+  mismatches fail before measurement.
+- Removed the test's dependency on a pre-existing repository `target/` directory.
+- Re-ran the final five-sample baseline with all graph, process, and output checks
+  active, then passed all 21 qualification tests and the remaining gates.
+
+Overall after refinement iteration 4: PASS; fresh-context review required.
+
+## Iteration 5 — PASS-review warnings and suggestion
+
+- Added explicit required-key/type validation for malformed generator profiles
+  and incomplete raw traversal evidence; both now fail cleanly without tracebacks.
+- Complemented the tracked patch digest with bounded deterministic full-tree and
+  untracked-subset identities for the complete selected build-input scope.
+- Expanded that scope before final review to the root Cargo/toolchain inputs,
+  every workspace crate, and both vendored path dependencies (638 files total),
+  then re-ran the complete baseline against the broader identity.
+- Classified only `.refiner/artifacts/<change-id>/` as repository-owned KBD QA
+  evidence in the project constraint configuration, with portability and
+  secret/generated-data prohibitions; arbitrary refiner runtime state is excluded.
+- Re-ran the full baseline with the source-complete provenance contract active,
+  then passed all 22 qualification tests and every deterministic gate.
+
+Overall after refinement iteration 5: PASS; fresh-context review required.
+
+## Iteration 6 — final PASS-review warnings and suggestions
+
+- Replaced recursive source discovery with explicit Git inventories: existing
+  tracked files plus non-ignored untracked files form the combined tree identity,
+  and tracked/untracked counts, bytes, and digests are recorded independently.
+- Updated the refinement evidence date to the date of the final retained run.
+- Added strict type and domain validation for every supported expected-result
+  field before task execution; booleans can no longer masquerade as edge counts.
+- Reject duplicate graph edge IDs before publishing traversal results.
+- Re-ran the complete five-sample engine baseline after the corrections.
+
+Overall after refinement iteration 6: PASS; final fresh-context review required.
+
+## Iteration 7 — final-review warning and suggestions
+
+- Made the expected-evidence object mandatory for every task, including explicit
+  rejection of missing and JSON-null contracts.
+- Added one portable, crash-safe text publisher for qualification evidence and
+  routed raw traversal and current-baseline JSON outputs through it.
+- Corrected the proposal's stale claim about baseline-runner `/tmp` support.
+- Regenerated the closed checksum manifest and passed all 24 qualification tests.
+
+Overall after refinement iteration 7: PASS; clean fresh-context review required.
+
+## Iteration 8 — clean-review warnings and suggestions
+
+- Changed future baseline promotion to add immutable versioned artifacts rather
+  than replace a published historical realization.
+- Pinned search to `--max-candidates 256` and routed discarded warmups through
+  the same bounded measured-process helper as retained samples.
+- Added crash-safe atomic streaming for generated graphs and metadata, with a
+  regression proving interrupted generation preserves the prior complete file.
+- Streamed gzip-9 size calculation and recorded the governing zlib runtime next
+  to Python in the host contract.
+- Re-ran the complete five-sample baseline after these measurement-contract
+  changes; graph, binary, and gzip identities remained unchanged.
+
+Overall after refinement iteration 8: PASS; clean fresh-context review required.
+
+## Iteration 9 — raw-contract warnings and suggestions
+
+- Made status explicit for search, callers, callees, impact, and path; empty
+  search now has a directly tested `empty` status rather than an implicit default.
+- Enforced the versioned task limit block against effective CLI values and bounded
+  the task document to 1 MiB and 100 tasks.
+- Made the current-engine runner fail before measurement for any profile other
+  than the ratified `qualification-medium` baseline profile.
+- Regenerated the complete timing-free oracle and full five-sample baseline after
+  the status-contract change.
+
+Overall after refinement iteration 9: PASS; clean fresh-context review required.
+
+## Iteration 10 — final fail-closed warnings and suggestions
+
+- Reject unsupported keys in expected-evidence objects and reject empty task
+  suites instead of publishing a vacuous PASS.
+- Require non-empty strings for every graph node identity/name and edge identity/
+  endpoint field; malformed numeric identities fail cleanly.
+- Document the portable `python3` command label with the measured executable name
+  and `host.python` version field in retained raw-traversal evidence.
+- Re-ran the complete five-sample baseline after adding per-record validation.
+
+Overall after refinement iteration 10: PASS.
+
+## Final isolated review
+
+- Cross-model review used judge `k3` against producer `gpt-5.6-sol` through the
+  isolated REST gateway; the distinct-model check was verified.
+- Verdict: PASS with 0 critical findings, 2 warnings, and 2 suggestions.
+- The anti-theater gate passed. Noncritical follow-up findings remain preserved in
+  `.kbd-orchestrator/phases/compass-scoping-and-bounds/review/C-013/findings.json`.
+
+Final certification: PASS.
+
+## Post-archive provenance clarification — 2026-08-29
+
+- Corrected the narrative pin order: the immutable plan realization was pinned
+  after the 2026-08-28T12:45:00Z verify-first handoff entry and before C-013
+  ratification. The earlier filesystem timestamp is not provenance.
+- Revalidated the unchanged plan bytes at SHA-256
+  `46e37804d513cf32ce8e7d008816642dffbb9d3b7b60fd3f2e82a482cd398ebf`
+  and confirmed every C-013 source/dist path and PASS constraint still resolves.
+
+Post-archive provenance validation: PASS.
diff --git a/.refiner/artifacts/C-014/artifact_manifest.json b/.refiner/artifacts/C-014/artifact_manifest.json
new file mode 100644
index 000000000..a19ff61aa
--- /dev/null
+++ b/.refiner/artifacts/C-014/artifact_manifest.json
@@ -0,0 +1,24 @@
+{
+  "schemaVersion": "1",
+  "artifactName": "C-014",
+  "artifactType": "integration",
+  "contentType": "rust:library",
+  "status": "refined",
+  "sourceArtifacts": [
+    "Cargo.toml",
+    "Cargo.lock",
+    "deny.toml",
+    "CHANGELOG.md",
+    "THIRD_PARTY_NOTICES.md",
+    "crates/compass-graphdb-surreal",
+    "docs/implementation/surreal-graph-projection.md",
+    "scripts/check_surreal_feature_isolation.sh",
+    "scripts/check_product_boundary.sh",
+    "openspec/changes/archive/2026-08-29-surreal-graph-projection",
+    "openspec/changes/archive/2026-08-29-surreal-graph-projection/shared-file-evidence.md"
+  ],
+  "distFiles": [
+    "dist/refinement-receipt.md"
+  ],
+  "validatedAt": "2026-08-29"
+}
diff --git a/.refiner/artifacts/C-014/constraints.json b/.refiner/artifacts/C-014/constraints.json
new file mode 100644
index 000000000..48500b8c7
--- /dev/null
+++ b/.refiner/artifacts/C-014/constraints.json
@@ -0,0 +1,41 @@
+{
+  "schemaVersion": "1",
+  "artifact": "C-014",
+  "blocking": [
+    {
+      "id": "optional-dependency-isolation",
+      "status": "PASS",
+      "evidence": "SurrealDB is exact-pinned at 3.2.4 behind explicit Mem, SurrealKV, and RocksDB features; default Compass CLI, MCP, core, and projection dependency trees contain no Surreal package, and the default compass binary is built only from that SurrealDB-free dependency closure"
+    },
+    {
+      "id": "license-boundary",
+      "status": "PASS",
+      "evidence": "The accepted C-011 profile is preserved through exact BUSL-1.1 package exceptions, THIRD_PARTY_NOTICES disclosure, and feature/profile documentation; no version other than the reviewed 3.2.4 is permitted"
+    },
+    {
+      "id": "deterministic-lossless-projection",
+      "status": "PASS",
+      "evidence": "Validated compass.graph/1 inputs produce ordered length-delimited SHA-256 record identities, exact typed JSON payloads, and an exhaustive five-family mapping for all 29 edge kinds; tests preserve parallel, reverse, self-loop, direction, provenance, anchor, and confidence semantics"
+    },
+    {
+      "id": "generation-atomic-publication",
+      "status": "PASS",
+      "evidence": "Schemafull records, candidate identity validation, immutable manifest publication, and repository-pointer activation occur in one SurrealDB transaction; a real Mem failure-injection test proves cancellation leaves the prior complete generation visible"
+    },
+    {
+      "id": "typed-bounded-surface",
+      "status": "PASS",
+      "evidence": "The public API exposes typed plans and operations only, all untrusted values are bound, relation tables are a closed enum, positive node/relation/serialized-byte limits are checked before activation and reads, every set query has a finite LIMIT, and returned records must match manifest counts and bytes"
+    },
+    {
+      "id": "repository-baseline",
+      "status": "PASS",
+      "evidence": "Rust formatting, workspace lib/bin Clippy with denied warnings, workspace lib/bin tests, default and Mem tests, all three embedded feature compile gates, product boundary, feature isolation, default binary build, strict OpenSpec validation, package inventory, and diff whitespace checks pass"
+    },
+    {
+      "id": "graph-refresh",
+      "status": "PASS",
+      "evidence": "compass update . completed after the final review follow-up and published 121737 nodes and 286776 edges; it truthfully reported the repository's partial-graph warning for 68 unresolved edges and zero omitted nodes"
+    }
+  ]
+}
diff --git a/.refiner/artifacts/C-014/decisions.md b/.refiner/artifacts/C-014/decisions.md
new file mode 100644
index 000000000..a5edb9e07
--- /dev/null
+++ b/.refiner/artifacts/C-014/decisions.md
@@ -0,0 +1,20 @@
+# Refinement decisions — C-014
+
+- Keep `compass-model` as the canonical graph authority and make SurrealDB an
+  additive projection crate with no CLI or MCP route in this change.
+- Pin every engine profile to the user-approved SurrealDB 3.2.4 release with
+  default SDK features disabled and exact feature isolation.
+- Preserve exact canonical node and edge JSON alongside indexed typed fields so
+  round trips retain identities, direction, multiplicity, source anchors,
+  provenance, and confidence without interpreting unknown attributes.
+- Use one immutable generation transaction for staging, validation, manifest
+  publication, and repository-pointer activation; cancellation cannot expose a
+  candidate generation.
+- Restrict execution to closed static statements and parameter-bound values.
+- Make finite limits part of each engine client. The 1,000,000-node,
+  2,500,000-relation, and canonical `GraphDocument` reader 1 GiB serialized-byte
+  defaults are independent ceilings, not a promise that every maximum-sized
+  record population fits under the byte ceiling. C-015 owns qualification-corpus
+  measurement; constrained callers may select smaller positive limits.
+- Leave native multi-hop reads and dual-engine semantic qualification to C-015,
+  as required by the phase dependency graph.
diff --git a/.refiner/artifacts/C-014/dist/refinement-receipt.md b/.refiner/artifacts/C-014/dist/refinement-receipt.md
new file mode 100644
index 000000000..27c8d1428
--- /dev/null
+++ b/.refiner/artifacts/C-014/dist/refinement-receipt.md
@@ -0,0 +1,20 @@
+# C-014 refinement receipt
+
+Status: **PASS**
+Date: 2026-08-29
+
+The optional SurrealDB projection is exact-versioned, feature-isolated,
+deterministic, lossless, generation-atomic, typed, and bounded. Default Compass
+dependency closures and binary builds remain free of SurrealDB. All targeted feature
+profiles and the complete repository baseline pass after the bounded-read
+correction.
+
+The installed artifact-refiner adapter lacks its referenced canonical
+controllers and schema assets, so this receipt uses the repository's established
+deterministic fallback state contract. The final isolated REST-gateway review by
+`k3` was verified distinct from producer `gpt-5.6-sol` and returned PASS with
+zero critical findings, five warnings, and one suggestion. Its strict
+anti-sycophancy gate passed. Actionable implementation and portability warnings
+were closed before the final repository baseline and graph refresh; the retained
+non-blocking findings document the fallback tooling and cumulative-dirty-tree
+packet limitations.
diff --git a/.refiner/artifacts/C-014/refinement_log.md b/.refiner/artifacts/C-014/refinement_log.md
new file mode 100644
index 000000000..5e24d3df9
--- /dev/null
+++ b/.refiner/artifacts/C-014/refinement_log.md
@@ -0,0 +1,96 @@
+# Refinement log — C-014
+
+## Iteration 1 — 2026-08-29
+
+- Added the feature-isolated `compass-graphdb-surreal` workspace crate with the
+  exact reviewed SurrealDB 3.2.4 dependency and Mem, SurrealKV, and RocksDB
+  profiles.
+- Implemented deterministic canonical generation planning, schemafull typed
+  record families, lossless payload preservation, stable record identities,
+  and exhaustive `EdgeKind` mapping.
+- Implemented single-transaction candidate staging, exact identity validation,
+  immutable manifests, active-generation pointers, idempotent reactivation, and
+  injected cancellation.
+- Added pure projection tests and real Mem runtime coverage for successful
+  round-trip, parallel/reverse/self-loop semantics, idempotence, interruption,
+  and later successful activation.
+- Added dependency-tree and default-binary closure gates, license policy records,
+  integration documentation, and strict OpenSpec artifacts.
+
+Overall after deterministic refinement iteration 1: PASS; bounded-surface audit
+and final repository qualification required.
+
+## Iteration 2 — bounded-surface closure
+
+- Found that the first full-generation reader trusted manifest counts but used
+  unrestricted set selects, contradicting the change's explicit bounded-result
+  requirement.
+- Added positive `ProjectionLimits` for nodes, relations, and serialized bytes;
+  defaults match the ratified large qualification graph and canonical
+  `GraphDocument` reader byte cap.
+- Enforced the limits before opening activation transactions and before reads,
+  added query-side `LIMIT` clauses to every identity and record set query, and
+  required materialized counts and bytes to match the immutable manifest.
+- Added a real Mem regression proving an over-limit plan fails before any active
+  generation is published, plus pure default/invalid-limit tests and static query
+  surface assertions.
+- Re-ran all targeted engine profiles and the complete repository baseline. The
+  final graph refresh published the current graph while retaining its explicit
+  68-edge partial warning.
+
+Overall after deterministic refinement iteration 2: PASS; isolated adversarial
+review required.
+
+## Iteration 3 — first adversarial findings
+
+- The first full packet was contaminated by cumulative, already accepted C-004,
+  C-005, and C-010 hunks in shared workspace files; its sole critical finding
+  concerns review scope rather than C-014 code. The corrected packet isolates
+  exact C-014 additions and shared-file evidence without discarding those user
+  changes.
+- Hardened idempotent reactivation to compare schema/source digests and re-read
+  the complete candidate identity sets before moving the active pointer.
+- Added composite repository/generation/identity indexes so query result limits
+  also have an indexed access path across retained generations.
+- Defined `InterruptAfter(0)` as a pre-mutation interruption and added a real Mem
+  regression for the zero-mutation outcome.
+- Removed a vacuous byte-comparison claim from the feature-isolation script. The
+  authoritative proof is the complete default dependency closure; `--binary`
+  now builds the default binary from that already verified closure.
+- Clarified that the projection's 1 GiB default is the canonical `GraphDocument`
+  reader bound, distinct from the separately configurable store publication cap.
+
+Overall after deterministic refinement iteration 3: PASS; fresh scoped
+adversarial review required.
+
+## Iteration 4 — PASS-review follow-up
+
+- Preserved the original staging failure and the transaction-cancellation
+  failure together in a dedicated typed error instead of masking the actionable
+  root cause.
+- Added a real Mem activation/read round trip using a repository identity that
+  contains SurrealQL metacharacters, proving end-to-end that the identity remains
+  bound data.
+- Moved the cumulative `docs/README.md` hunk into the same exact shared-file
+  evidence boundary as the workspace manifest, lockfile, and changelog; the
+  adjacent MCP row remains attributed to its already reviewed C-010 change.
+
+Overall after refinement iteration 4: PASS; final fresh-context review required.
+
+## Iteration 5 — final PASS-review closure
+
+- Corrected the limits documentation: node count, relation count, and serialized
+  bytes are independent ceilings, and C-015—not C-014 prose—determines which
+  ceiling binds for each ratified corpus.
+- Expanded the default dependency-tree exclusion to every `surrealdb-*` package,
+  including collections, protocol, strand, and types-derive.
+- Restored `check_product_boundary.sh` to its focused Graphify boundary; the
+  Surreal isolation gate remains a separately invoked blocking qualification.
+- Made the optional binary-build gate accept the portable `compass.exe` artifact
+  path as well as `compass`.
+- Retained the final external PASS review and its strict anti-sycophancy score;
+  the remaining artifact-refiner fallback and dirty-tree packet observations are
+  explicitly disclosed non-blocking tooling limitations.
+
+Overall after refinement iteration 5: PASS; ready for final verification and
+archive after the repository baseline is re-run.
diff --git a/.refiner/artifacts/C-015/artifact_manifest.json b/.refiner/artifacts/C-015/artifact_manifest.json
new file mode 100644
index 000000000..75ec9449d
--- /dev/null
+++ b/.refiner/artifacts/C-015/artifact_manifest.json
@@ -0,0 +1,20 @@
+{
+  "schemaVersion": "1",
+  "artifactName": "C-015",
+  "artifactType": "integration",
+  "contentType": "rust:library",
+  "status": "rejected",
+  "sourceArtifacts": [
+    "benchmarks/qualification/surreal-dual-engine-decision-v1.json",
+    "crates/compass-graphdb-surreal",
+    "crates/compass-model/src/query_contract.rs",
+    "crates/compass-query/src/code_query.rs",
+    "crates/compass-query/tests/query_contract.rs",
+    "docs/implementation/surreal-graph-projection.md",
+    "openspec/changes/surreal-dual-engine-equivalence"
+  ],
+  "distFiles": [
+    "dist/refinement-receipt.md"
+  ],
+  "validatedAt": "2026-08-29"
+}
diff --git a/.refiner/artifacts/C-015/constraints.json b/.refiner/artifacts/C-015/constraints.json
new file mode 100644
index 000000000..a29ca331d
--- /dev/null
+++ b/.refiner/artifacts/C-015/constraints.json
@@ -0,0 +1,36 @@
+{
+  "schemaVersion": "1",
+  "artifact": "C-015",
+  "blocking": [
+    {
+      "id": "semantic-equivalence",
+      "status": "PASS",
+      "evidence": "The medium and large scale samples and the exact 100000-node/250000-edge medium run produced zero structural semantic mismatches"
+    },
+    {
+      "id": "bounded-publication",
+      "status": "PASS",
+      "evidence": "Activation uses resumable idempotent 512-record staging commits, an incomplete manifest claim, exact identity validation, and pointer-last visibility; the corrected exact medium run completed with 3646308352 bytes maximum RSS"
+    },
+    {
+      "id": "query-regression-budget",
+      "status": "FAIL",
+      "evidence": "Warm in-process callers and callees p95 were 10226.12x and 8132.06x current, exceeding the pre-ratified maximum 1.10x"
+    },
+    {
+      "id": "native-value-budget",
+      "status": "FAIL",
+      "evidence": "Depth-3 impact and path p95 were 14800.04x and 38903.71x current instead of at least 10% lower, and canonical response-byte reduction was 0% instead of at least 15%"
+    },
+    {
+      "id": "falsifier-integrity",
+      "status": "PASS",
+      "evidence": "The retained decision invokes REJECT without changing any threshold after results were visible and leaves uncompleted post-falsifier measurements explicit"
+    },
+    {
+      "id": "repository-integration",
+      "status": "PASS",
+      "evidence": "The complete workspace integration suite, Mem/SurrealKV/RocksDB integration targets, feature isolation, formatting, Clippy, product boundary, qualification manifest, and strict OpenSpec validation passed"
+    }
+  ]
+}
diff --git a/.refiner/artifacts/C-015/decisions.md b/.refiner/artifacts/C-015/decisions.md
new file mode 100644
index 000000000..e7d3b5fa2
--- /dev/null
+++ b/.refiner/artifacts/C-015/decisions.md
@@ -0,0 +1,15 @@
+# Refinement decisions — C-015
+
+- Preserve the shared engine-neutral structural query contract and the optional
+  feature-isolated Surreal implementation as experimental evidence.
+- Replace graph-sized Surreal transactions with incomplete-manifest claims and
+  resumable 512-record autocommit batches; readers switch only through the final
+  repository pointer and never observe incomplete candidates.
+- Treat zero semantic mismatches as necessary but not sufficient for adoption.
+- Apply the C-013 thresholds exactly as ratified before Surreal results existed.
+  The query-regression and native-value failures invoke the recorded falsifier.
+- Do not add a CLI/MCP route, claim performance value, weaken thresholds, or
+  archive the OpenSpec change as accepted behavior after the `REJECT` result.
+- Stop cost-heavy release-artifact and exact-medium recovery measurements once
+  decisive numeric failures make adoption impossible; record them as not
+  completed rather than implying a pass.
diff --git a/.refiner/artifacts/C-015/dist/refinement-receipt.md b/.refiner/artifacts/C-015/dist/refinement-receipt.md
new file mode 100644
index 000000000..eeb126271
--- /dev/null
+++ b/.refiner/artifacts/C-015/dist/refinement-receipt.md
@@ -0,0 +1,14 @@
+# C-015 refinement receipt
+
+Status: **REJECT**
+Date: 2026-08-29
+
+The implementation is bounded and semantically equivalent, and its functional
+integration suites pass. The pre-ratified query-regression and native-value
+budgets do not pass. This receipt intentionally does not certify adoption,
+archive eligibility, a CLI/MCP route, or completion of the rejected OpenSpec
+change. Exact evidence is retained in
+`benchmarks/qualification/surreal-dual-engine-decision-v1.json`.
+
+The installed artifact-refiner adapter lacks its declared canonical controllers
+and schemas, so this is the deterministic repository fallback receipt.
diff --git a/.refiner/artifacts/C-015/refinement_log.md b/.refiner/artifacts/C-015/refinement_log.md
new file mode 100644
index 000000000..66dc7508e
--- /dev/null
+++ b/.refiner/artifacts/C-015/refinement_log.md
@@ -0,0 +1,38 @@
+# Refinement log — C-015
+
+## Iteration 1 — implementation closure
+
+- Added the versioned engine-neutral structural query contract and current JSON
+  implementation, plus generation-pinned closed Surreal statements for callers,
+  callees, impact, directed path, subgraph, and stable relation pagination.
+- Added public integration coverage for bounds, ambiguity, negative results,
+  provenance, confidence, parallel/reverse/self-loop relations, cursor binding,
+  page concatenation, and dual-engine semantic equivalence.
+- Added deterministic medium/large samples and an explicit full-medium evidence
+  runner.
+
+## Iteration 2 — scale defect correction
+
+- The first exact medium activation exposed 87.6 GB peak physical footprint.
+  Sampling located repeated Surreal Mem B-tree cloning at transaction savepoints.
+- Replaced the graph-sized transaction with idempotent 512-record staging
+  commits, an immutable incomplete manifest claim, exact staged identity
+  validation, and pointer-last publication.
+- Re-ran the entire Mem integration surface and the exact medium measurement.
+  It completed in 253.18 seconds with 3,646,308,352 bytes maximum RSS and zero
+  semantic mismatches.
+
+## Iteration 3 — pre-ratified decision
+
+- Retained all raw samples, identities, limits, digests, commands, ratios, and
+  decisions in `surreal-dual-engine-decision-v1.json`; the qualification
+  manifest closes over the evidence.
+- The candidate failed the <=1.10x query-regression threshold and both native-
+  value conjuncts by several orders of magnitude. The threshold was not changed.
+- Strict OpenSpec and every functional integration gate pass, but the product
+  experiment is rejected under its own falsifier and is not eligible for archive
+  as a completed accepted change.
+
+The installed artifact-refiner adapter lacks its referenced canonical
+controllers, schemas, and validator. The repository's established deterministic
+fallback format was used. Overall result: **REJECT / BLOCKED BY RATIFIED GATES**.
diff --git a/.refiner/artifacts/C-017/artifact_manifest.json b/.refiner/artifacts/C-017/artifact_manifest.json
new file mode 100644
index 000000000..9d90240a9
--- /dev/null
+++ b/.refiner/artifacts/C-017/artifact_manifest.json
@@ -0,0 +1,19 @@
+{
+  "schemaVersion": "1",
+  "artifactName": "C-017",
+  "artifactType": "code",
+  "contentType": "direct:code",
+  "status": "refined",
+  "sourceArtifacts": [
+    "crates/compass-cli/src/agent_commands.rs",
+    "crates/compass-cli/src/install_commands.rs",
+    "crates/compass-cli/src/help.rs",
+    "crates/compass-cli/tests/agent_cli.rs",
+    "docs/reference/commands.md",
+    "COMPATIBILITY.md",
+    "CHANGELOG.md",
+    "openspec/changes/compass-agent-cli"
+  ],
+  "distFiles": ["dist/refinement-receipt.md"],
+  "validatedAt": "2026-08-28"
+}
diff --git a/.refiner/artifacts/C-017/constraints.json b/.refiner/artifacts/C-017/constraints.json
new file mode 100644
index 000000000..606f1a6b2
--- /dev/null
+++ b/.refiner/artifacts/C-017/constraints.json
@@ -0,0 +1,51 @@
+{
+  "schemaVersion": "1",
+  "artifact": "C-017",
+  "blocking": [
+    {
+      "id": "six-command-namespace",
+      "status": "PASS",
+      "evidence": "Nested help and public CLI tests cover list, install, doctor, export, validate, and mcp-config"
+    },
+    {
+      "id": "install-compatibility",
+      "status": "PASS",
+      "evidence": "Success and failure bytes, exit codes, and installed trees match the legacy install entry point"
+    },
+    {
+      "id": "deterministic-export",
+      "status": "PASS",
+      "evidence": "Repeated exports have identical bytes and the JSON result is the exact compass.agent-bundle/1 manifest"
+    },
+    {
+      "id": "bounded-validation",
+      "status": "PASS",
+      "evidence": "File and byte limits, symlink and traversal rejection, checksum verification, portability checks, and secret redaction pass"
+    },
+    {
+      "id": "doctor-evidence",
+      "status": "PASS",
+      "evidence": "Healthy, stale graph, missing config, modified file, and embedded-collection mismatch paths are covered"
+    },
+    {
+      "id": "native-mcp-schemas",
+      "status": "PASS",
+      "evidence": "Codex TOML, Claude JSON, OpenCode JSON, and generic versioned JSON are deterministic for stdio and HTTP"
+    },
+    {
+      "id": "workspace-baseline",
+      "status": "PASS",
+      "evidence": "Formatting, focused and workspace Clippy, focused CLI tests, workspace lib/bin tests, product boundary, and strict OpenSpec pass"
+    },
+    {
+      "id": "graph-refresh",
+      "status": "PASS",
+      "evidence": "713 files, 121261 nodes, 285681 edges, 3389 communities, 68 omitted edges, and zero identity collisions"
+    },
+    {
+      "id": "adversarial-review",
+      "status": "PASS",
+      "evidence": "Isolated K3 review passed with 0 critical findings; all 2 warnings and 3 suggestions were subsequently resolved"
+    }
+  ]
+}
diff --git a/.refiner/artifacts/C-017/decisions.md b/.refiner/artifacts/C-017/decisions.md
new file mode 100644
index 000000000..2f1949b09
--- /dev/null
+++ b/.refiner/artifacts/C-017/decisions.md
@@ -0,0 +1,15 @@
+# Refinement decisions — C-017
+
+- Kept `agent_commands` presentation-only and exposed narrow immutable helpers
+  from the installer rather than making registry internals public.
+- Limited MCP configuration rendering to the four hosts with an explicit
+  native schema: Codex, Claude, OpenCode, and generic Agent Skills.
+- Limited export to the current seven embedded skills; full cross-harness
+  packages remain owned by C-018.
+- Used the graph manifest and bounded detection for freshness rather than file
+  modification times.
+- Excluded checksum-owned installation metadata from portability scanning
+  because its root is intentionally machine-local, while still verifying its
+  checksums and current embedded collection bytes.
+- Returned the complete export manifest for JSON mode so one schema identifier
+  never describes two incompatible shapes.
diff --git a/.refiner/artifacts/C-017/dist/refinement-receipt.md b/.refiner/artifacts/C-017/dist/refinement-receipt.md
new file mode 100644
index 000000000..f366727e4
--- /dev/null
+++ b/.refiner/artifacts/C-017/dist/refinement-receipt.md
@@ -0,0 +1,11 @@
+# C-017 refinement receipt
+
+Result: PASS
+
+The final artifact implements the full `compass agent` contract, preserves the
+legacy installer, publishes deterministic bounded bundles, validates untrusted
+content without execution or secret disclosure, and diagnoses integrations
+offline. Refinement found and repaired two schema/checksum-strength issues.
+The final qualification also resolved every non-blocking adversarial finding;
+workspace Clippy/tests, strict OpenSpec validation, product boundary checks, and
+the refreshed 713-file graph all pass.
diff --git a/.refiner/artifacts/C-017/refinement_log.md b/.refiner/artifacts/C-017/refinement_log.md
new file mode 100644
index 000000000..f4bb01510
--- /dev/null
+++ b/.refiner/artifacts/C-017/refinement_log.md
@@ -0,0 +1,46 @@
+# Refinement log — C-017
+
+## Iteration 1 — 2026-08-28
+
+- Added the six-command namespace, deterministic registry inventory, native MCP
+  rendering, exact install delegation, offline doctor, atomic bundle export,
+  and bounded validation.
+- Added end-to-end evidence for help, schemas, install compatibility, export,
+  validation, and healthy/stale/corrupt doctor states.
+- Passed focused format, all-target/all-feature Clippy, CLI and installer tests,
+  product gates, strict OpenSpec, workspace Clippy/tests, and graph refresh.
+
+## Iteration 2 — 2026-08-28
+
+- Corrected export JSON to return the exact versioned bundle manifest rather
+  than a summary that reused the manifest schema identifier.
+- Strengthened managed skill verification to compare every installed file and
+  version marker with the current embedded seven-skill collection after first
+  verifying ownership checksums.
+- Confirmed focused unit tests remain green after refinement.
+
+## Iteration 3 — 2026-08-28
+
+- Hardened manifest ownership checks against forged self-consistent manifests,
+  matched embedded assets by explicit prefix, and centralized the MCP protocol
+  compatibility predicate.
+- Made doctor snapshot-aware and scope-aware, distinguished source detection
+  from manifest load failures, and added strict duplicate, conflict, and empty
+  option diagnostics.
+- Added global validation budgets, opened-file identity checks, nested secret
+  detection, transport/config cross-checks, exact Compass MCP entry validation,
+  and rejection of export-only platform filters during validation.
+- Reworked export staging around a same-filesystem random temporary directory,
+  preserving empty-directory permissions and retaining rollback diagnostics.
+- Strengthened installer compatibility coverage to compare manifest bytes after
+  replacing only the canonical root token.
+- Passed the final focused and workspace Rust baselines, product boundary,
+  strict OpenSpec validation, diff hygiene, graph refresh, and isolated K3
+  adversarial review. The review result was PASS (0 critical, 2 warnings, 3
+  suggestions), and every remaining non-blocking finding was resolved.
+
+The installed artifact-refiner adapter lacks its referenced canonical
+controllers, schemas, and validator. The repository's established deterministic
+fallback record format was used and its JSON documents are syntax-validated.
+
+Overall after refinement: PASS.
diff --git a/.refiner/artifacts/C-018/artifact_manifest.json b/.refiner/artifacts/C-018/artifact_manifest.json
new file mode 100644
index 000000000..db008398a
--- /dev/null
+++ b/.refiner/artifacts/C-018/artifact_manifest.json
@@ -0,0 +1,22 @@
+{
+  "schemaVersion": "1",
+  "artifactName": "C-018",
+  "artifactType": "distribution",
+  "contentType": "rust-and-typescript:package-generators",
+  "status": "refined",
+  "sourceArtifacts": [
+    "distribution.toml",
+    "crates/compass-cli/src/distribution.rs",
+    "crates/compass-cli/src/agent_commands.rs",
+    "crates/compass-cli/tests/agent_cli.rs",
+    "crates/compass-cli/assets/compass-focused-skills",
+    "packages/compass-opencode",
+    "tools/skillgen/mod.rs",
+    "docs/implementation/agent-distribution.md",
+    "openspec/changes/archive/2026-08-29-distribution-inventory-generators"
+  ],
+  "distFiles": [
+    "dist/refinement-receipt.md"
+  ],
+  "validatedAt": "2026-08-29"
+}
diff --git a/.refiner/artifacts/C-018/constraints.json b/.refiner/artifacts/C-018/constraints.json
new file mode 100644
index 000000000..790ab76fe
--- /dev/null
+++ b/.refiner/artifacts/C-018/constraints.json
@@ -0,0 +1,36 @@
+{
+  "schemaVersion": "1",
+  "artifact": "C-018",
+  "blocking": [
+    {
+      "id": "canonical-inventory",
+      "status": "PASS",
+      "evidence": "One versioned distribution.toml owns native Codex, Claude Code, and OpenCode package shapes and exact harness versions"
+    },
+    {
+      "id": "deterministic-atomic-generation",
+      "status": "PASS",
+      "evidence": "Repeated exports produce stable ordered paths, byte-identical content, closed checksums, and atomic destination replacement"
+    },
+    {
+      "id": "complete-native-packages",
+      "status": "PASS",
+      "evidence": "Generated packages contain each harness manifest, marketplace or npm metadata, credential-free MCP configuration, and complete copied skill trees"
+    },
+    {
+      "id": "bounded-validation",
+      "status": "PASS",
+      "evidence": "Validation rejects unsupported versions, unsafe paths, symlinks, credentials, missing artifacts, unexpected artifacts, and digest mismatches"
+    },
+    {
+      "id": "thin-opencode-bridge",
+      "status": "PASS",
+      "evidence": "The checked TypeScript plugin configures the native Compass MCP server and contains no graph persistence, traversal, ranking, or query engine"
+    },
+    {
+      "id": "phase-end-integration",
+      "status": "PASS",
+      "evidence": "Deterministic export, native validation, installed lifecycle, npm typecheck/integration, complete workspace integration, formatting, Clippy, product boundary, and strict OpenSpec gates passed"
+    }
+  ]
+}
diff --git a/.refiner/artifacts/C-018/decisions.md b/.refiner/artifacts/C-018/decisions.md
new file mode 100644
index 000000000..ad47aa184
--- /dev/null
+++ b/.refiner/artifacts/C-018/decisions.md
@@ -0,0 +1,12 @@
+# Refinement decisions — C-018
+
+- Make `distribution.toml` the only versioned source for supported harnesses,
+  package metadata, paths, skills, and exact tool versions.
+- Generate every host-native package from embedded checked inputs; do not rely
+  on a source checkout at install or validation time.
+- Preserve existing `compass install` and generic Agent Skills compatibility;
+  the new native package export is additive.
+- Keep the OpenCode bridge thin and delegate all graph behavior to the native
+  Compass MCP server.
+- Publish package trees atomically and validate a closed digest inventory before
+  a generated package is accepted.
diff --git a/.refiner/artifacts/C-018/dist/refinement-receipt.md b/.refiner/artifacts/C-018/dist/refinement-receipt.md
new file mode 100644
index 000000000..4ba9e5cc5
--- /dev/null
+++ b/.refiner/artifacts/C-018/dist/refinement-receipt.md
@@ -0,0 +1,14 @@
+# C-018 refinement receipt
+
+Status: **PASS**
+Date: 2026-08-29
+
+The canonical inventory produces deterministic, complete, bounded, credential-
+free native packages for Codex, Claude Code, and OpenCode. The OpenCode bridge
+remains presentation/configuration-only. Phase-end Rust, JavaScript, export,
+validation, lifecycle, and strict OpenSpec gates pass.
+
+Final adversarial review: **PASS** (0 critical, 4 warnings, 2 suggestions).
+
+The installed artifact-refiner adapter lacks its declared canonical controllers
+and schemas, so this is the deterministic repository fallback receipt.
diff --git a/.refiner/artifacts/C-018/refinement_log.md b/.refiner/artifacts/C-018/refinement_log.md
new file mode 100644
index 000000000..3bfbe979d
--- /dev/null
+++ b/.refiner/artifacts/C-018/refinement_log.md
@@ -0,0 +1,22 @@
+# Refinement log — C-018
+
+## Iteration 1 — 2026-08-29
+
+- Added the canonical distribution inventory and deterministic native generators
+  for Codex, Claude Code, and OpenCode.
+- Added complete skill copying, host-native manifest/MCP generation, exact
+  harness-version declarations, closed checksums, and atomic output publication.
+- Added the workspace OpenCode TypeScript plugin and deterministic checked
+  JavaScript package artifact without graph/query implementation.
+- Added bounded native validation and public integration coverage for repeated
+  export, unsafe input rejection, credentials, paths, symlinks, missing/extra
+  files, checksums, and host-version mismatch.
+- Passed the post-phase native export/validator, installed lifecycle, JavaScript,
+  workspace integration, formatting, Clippy, product-boundary, viewer-asset,
+  and strict OpenSpec gates.
+- Passed the final independent K3 adversarial review with 0 critical findings,
+  4 warnings, and 2 suggestions after all blocking findings were repaired.
+
+The installed artifact-refiner adapter lacks its referenced canonical
+controllers, schemas, and validator. The repository's deterministic fallback
+state contract was used. Overall result: **PASS**.
diff --git a/.refiner/artifacts/C-019/artifact_manifest.json b/.refiner/artifacts/C-019/artifact_manifest.json
new file mode 100644
index 000000000..e1a0671cd
--- /dev/null
+++ b/.refiner/artifacts/C-019/artifact_manifest.json
@@ -0,0 +1,20 @@
+{
+  "schemaVersion": "1",
+  "artifactName": "C-019",
+  "artifactType": "integration",
+  "contentType": "shell-and-typescript:harness-lifecycle",
+  "status": "refined",
+  "sourceArtifacts": [
+    "distribution.toml",
+    "scripts/qualify_harness_packages.sh",
+    "scripts/bounded_redacted_log.mjs",
+    ".github/workflows/compass-ci.yml",
+    "packages/compass-opencode",
+    "docs/implementation/agent-distribution.md",
+    "openspec/changes/archive/2026-08-29-harness-install-validation"
+  ],
+  "distFiles": [
+    "dist/refinement-receipt.md"
+  ],
+  "validatedAt": "2026-08-29"
+}
diff --git a/.refiner/artifacts/C-019/constraints.json b/.refiner/artifacts/C-019/constraints.json
new file mode 100644
index 000000000..5a7b1ade9
--- /dev/null
+++ b/.refiner/artifacts/C-019/constraints.json
@@ -0,0 +1,36 @@
+{
+  "schemaVersion": "1",
+  "artifact": "C-019",
+  "blocking": [
+    {
+      "id": "installed-artifact-only",
+      "status": "PASS",
+      "evidence": "Lifecycle qualification exports a package and exercises the installed artifact without reading source templates"
+    },
+    {
+      "id": "named-current-harnesses",
+      "status": "PASS",
+      "evidence": "Codex 0.146.0, Claude Code 2.1.251, and OpenCode 1.18.23 are matched against the exact distribution inventory"
+    },
+    {
+      "id": "complete-lifecycle",
+      "status": "PASS",
+      "evidence": "Isolated discovery, skill loading, MCP configuration, upgrade, and uninstall pass for all three harnesses"
+    },
+    {
+      "id": "ownership-preservation",
+      "status": "PASS",
+      "evidence": "User-owned sentinel instructions and unrelated package state remain byte-identical across install, upgrade, and uninstall"
+    },
+    {
+      "id": "bounded-secret-free-evidence",
+      "status": "PASS",
+      "evidence": "Temporary roots, local credential-free MCP fixtures, bounded logs, redaction checks, and deterministic cleanup prevent external credentials or source-state dependence"
+    },
+    {
+      "id": "ci-and-phase-gates",
+      "status": "PASS",
+      "evidence": "CI runs installed lifecycle and OpenCode integration gates after production implementation; the local lifecycle, npm, workspace integration, formatting, Clippy, viewer, product, and strict OpenSpec gates passed"
+    }
+  ]
+}
diff --git a/.refiner/artifacts/C-019/decisions.md b/.refiner/artifacts/C-019/decisions.md
new file mode 100644
index 000000000..35b313537
--- /dev/null
+++ b/.refiner/artifacts/C-019/decisions.md
@@ -0,0 +1,12 @@
+# Refinement decisions — C-019
+
+- Qualify only exported/installed package content, never the source template
+  that generated it.
+- Pin exact harness versions in the canonical inventory and fail explicitly on
+  absence or mismatch rather than silently weakening the lifecycle matrix.
+- Use isolated temporary configuration roots, credential-free local MCP
+  fixtures, bounded output capture, and deterministic redaction.
+- Treat user-authored instructions and unrelated plugins as immutable sentinels
+  through installation, upgrade, and uninstall.
+- Keep lifecycle and OpenCode integration as phase-end CI gates after production
+  implementation, consistent with the immutable phase-first doctrine.
diff --git a/.refiner/artifacts/C-019/dist/refinement-receipt.md b/.refiner/artifacts/C-019/dist/refinement-receipt.md
new file mode 100644
index 000000000..ae7587c4c
--- /dev/null
+++ b/.refiner/artifacts/C-019/dist/refinement-receipt.md
@@ -0,0 +1,14 @@
+# C-019 refinement receipt
+
+Status: **PASS**
+Date: 2026-08-29
+
+Exact-version installed packages complete discovery, skill, MCP, upgrade, and
+uninstall lifecycles in isolated credential-free roots while preserving user-
+owned content. Phase-end lifecycle, JavaScript, Rust integration, formatting,
+lint, viewer, product, and strict OpenSpec gates pass.
+
+Final adversarial review: **PASS** (0 critical, 4 warnings, 2 suggestions).
+
+The installed artifact-refiner adapter lacks its declared canonical controllers
+and schemas, so this is the deterministic repository fallback receipt.
diff --git a/.refiner/artifacts/C-019/refinement_log.md b/.refiner/artifacts/C-019/refinement_log.md
new file mode 100644
index 000000000..6bdb69f83
--- /dev/null
+++ b/.refiner/artifacts/C-019/refinement_log.md
@@ -0,0 +1,23 @@
+# Refinement log — C-019
+
+## Iteration 1 — 2026-08-29
+
+- Added isolated installed-artifact lifecycle qualification for exact current
+  Codex, Claude Code, and OpenCode versions.
+- Exercised native discovery, complete skill loading, credential-free MCP
+  configuration/load, upgrade, uninstall, and user-owned sentinel preservation
+  using only generated package content.
+- Added bounded redacted logs, temporary configuration roots, deterministic
+  cleanup, explicit version mismatch failures, and CI wiring.
+- Passed all three exact harness lifecycles, the OpenCode npm typecheck and 78
+  browser/integration checks, the complete Rust workspace integration suite,
+  formatting, Clippy, viewer assets, product boundary, and strict OpenSpec.
+- Passed the final independent K3 adversarial review with 0 critical findings,
+  4 warnings, and 2 suggestions after all blocking findings were repaired.
+- `npm audit` reported ten dependency advisories (one low, one moderate, eight
+  high); no automatic dependency mutation was performed because this change
+  does not authorize an unrelated upgrade and the lifecycle gates are offline.
+
+The installed artifact-refiner adapter lacks its referenced canonical
+controllers, schemas, and validator. The repository's deterministic fallback
+state contract was used. Overall result: **PASS**.
diff --git a/AGENTS.md b/AGENTS.md
index f099466ad..8b6416806 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -4,12 +4,64 @@ This file is the repository-level operating guide for AI coding agents. It
 applies to the entire tree unless a more specific `AGENTS.md` exists below the
 directory being changed.
 
+## Immutable phase-first development doctrine
+
+This section is an invariant. It overrides any later instruction, checklist,
+skill, workflow, or tool default that suggests test-driven development,
+per-task compilation, per-change compilation, unit-test evidence, or an
+incrementally green build during an active implementation phase.
+
+1. **Implement the complete phase first.** Finish production code, migrations,
+   schemas, generated-source inputs, configuration, and documentation for every
+   planned change in the active phase before invoking a command that compiles,
+   links, lints compiled code, or runs tests. Do not use `cargo check`, `cargo
+   build`, `cargo clippy`, `cargo test`, `cargo bench`, `cargo doc`, build-bearing
+   Make targets, or equivalent language build/test commands as an incremental
+   implementation loop.
+2. **A partially implemented specification is not a meaningful test target.**
+   Do not contort production code, add temporary compatibility paths, or create
+   intermediate assertions merely to keep an incomplete phase green. Source
+   inspection, contract reasoning, dependency/impact analysis, and mechanical
+   formatting are allowed during implementation because they do not claim that
+   incomplete behavior is verified. During this stage, correctness comes from
+   the repository's typed contracts, ownership boundaries, deterministic-state
+   rules, bounded-work invariants, and prohibition on unsafe/panic shortcuts—not
+   from isolated unit assertions against unfinished behavior.
+3. **Test only after the phase implementation is complete.** Run one coordinated
+   verification wave after every production-code task in the phase is finished.
+   Compile failures and integration failures are repaired in batches; rerun the
+   affected full integration suite, not a filtered test or a unit-test shortcut.
+4. **Only full integration tests count as correctness evidence.** Do not add,
+   expand, run, or cite inline/unit tests (`#[cfg(test)]`, `#[test]` beside the
+   implementation, library test harnesses, mocked single-function tests, or
+   test-name filters). Exercise behavior through public crate interfaces,
+   persisted artifacts, subprocess/CLI boundaries, protocol transports, or
+   other real integration seams under `crates/<crate>/tests/` and repository
+   integration suites. Existing unit tests may remain in the tree but are not a
+   completion gate or evidence source.
+5. **One build owner per checkout and host.** Before the verification wave,
+   ensure no competing Compass Cargo process is using the checkout. Run Cargo
+   commands serially. Every checkout/worktree owns its local `target/`; never
+   share a Cargo target directory between worktrees. This prevents feature-set,
+   build-script, and file-lock collisions.
+
+The authoritative Rust integration-only selector is:
+
+```bash
+cargo test --workspace --test '*' --locked
+```
+
+Do not substitute `cargo test`, `--lib`, `--bins`, `--tests`, or
+`--all-targets`: Cargo documents that those selections include unit-test
+harnesses. Feature-gated surfaces run their complete integration target set with
+the required feature profile after the default workspace integration suite.
+
 ## Start here
 
 Before editing:
 
 1. Read the affected crate's `src/lib.rs`, its `Cargo.toml`, and the nearest
-   tests.
+   public integration tests. Do not use inline unit tests as the design oracle.
 2. Find the closest existing implementation and follow its ownership boundary.
 3. Read `COMPATIBILITY.md` for any public command, format, schema, storage, or
    integration change.
@@ -23,21 +75,34 @@ behind this file live in `docs/design/principles.md`.
 
 ## Build artifacts and external checkouts
 
-Compass build artifacts are large. Where they live is a per-contributor
-environment choice, not a repository rule — this guide does not mandate any
-specific path or volume.
-
-- If you redirect Cargo output with `CARGO_TARGET_DIR`, give every repository
-  checkout and worktree its own directory. Never share one target directory
-  between different repositories or concurrent worktrees: feature sets, build
-  scripts, and locks can collide.
-- `CARGO_TARGET_DIR` does not persist between shell or tool invocations. Set it
-  on each command that can compile (`build`, `check`, `test`, `clippy`, `bench`,
-  `doc`, `install`, `package`, or a Make target that invokes one).
+Compass build artifacts are large. Repository configuration keeps development
+and test output in this worktree's local `target/`, caps Cargo at four compiler
+processes, disables incremental artifacts, and reduces debug information. These
+settings trade repeated micro-build speed for a smaller, less contentious
+phase-level build.
+
+- Do not override `CARGO_TARGET_DIR` with a shared directory. If an external
+  environment sets it, replace it with an explicit directory unique to this
+  checkout before the phase verification wave. Never share a target directory
+  between repositories or concurrent worktrees: feature sets, build scripts,
+  final artifacts, and locks can collide.
+- Do not launch concurrent Cargo commands for Compass, even with distinct
+  profiles. One coordinated process owns compilation and integration testing at
+  a time.
+- The default `dev` and `test` profiles use `debug = "line-tables-only"`, no
+  dependency debug info, 256 codegen units, and `incremental = false`. Use the
+  opt-in `debugging` profile only for an explicit debugger session after the
+  phase integration gate identifies a problem that requires it.
+- `sccache` is optional across worktrees. When it is installed, the phase build
+  may set `RUSTC_WRAPPER=sccache`, `CARGO_INCREMENTAL=0`, and
+  `SCCACHE_CACHE_SIZE=5G`. Do not commit an unconditional wrapper path: missing
+  tools would break contributors and CI, and sccache does not cache incremental
+  Rust crates.
 - Verify the chosen directory exists and is writable before a long build.
-- Run `cargo clean` only with the intended `CARGO_TARGET_DIR` explicitly set,
-  and only when the task actually requires reclaiming or invalidating those
-  artifacts. Never clean another repository's target directory.
+- Avoid broad `cargo clean`. When disk reclamation is required, confirm the
+  checkout-local target first, use `cargo clean --dry-run`, then prefer
+  `--profile`, `--release`, `--doc`, or `-p` selection. Never clean another
+  repository's target directory.
 - Treat external repositories used to qualify Compass code graphs as read-only
   inputs. Do not modify, update, reset, or clean an existing checkout unless the
   task explicitly requires it. Keep generated Compass artifacts outside their
@@ -160,12 +225,12 @@ resolution, and qualification in the same change.
   assume UTF-8 paths, Unix separators, or Unix-only process behavior without a
   guarded platform implementation and test.
 
-## Tests and fixtures
+## Integration tests and fixtures
 
-Behavior changes require a regression test at the lowest useful layer plus an
-interface/contract test when user-visible behavior changes.
+Behavior changes require full integration coverage through the lowest public
+boundary that owns the behavior. Unit tests are not accepted as evidence and
+must not be added for new work.
 
-- Unit tests normally live beside implementation in `#[cfg(test)]` modules.
 - Cross-module and public-contract tests live in `crates/<crate>/tests/`.
 - CLI behavior is tested by executing the binary under
   `crates/compass-cli/tests/`; assert streams, exit status, files, and machine
@@ -181,20 +246,20 @@ interface/contract test when user-visible behavior changes.
   deterministic. Update snapshots/fixtures only when the semantic change is
   intentional and explain the contract change.
 
-Run the narrowest useful checks while iterating:
+Do not build or test while implementation is in progress. After the whole phase
+is implemented, run the workspace integration suite once:
 
 ```bash
-cargo test -p <crate> --locked
-cargo test -p <crate> --test <integration_test> --locked
-cargo clippy -p <crate> --all-targets --all-features --locked -- -D warnings
+cargo test --workspace --test '*' --locked
 ```
 
-Before finishing a Rust change, run the repository's native baseline:
+Then run compilation/lint and the complete integration suites matching the
+phase's feature surfaces. Do not run library or binary unit-test harnesses:
 
 ```bash
 cargo fmt --all -- --check
 cargo clippy --workspace --lib --bins --locked -- -D warnings
-cargo test --workspace --lib --bins --locked
+cargo test -p <affected-package> --test '*' --all-features --locked
 ```
 
 Also run the gates matching the changed surface:
@@ -220,10 +285,11 @@ node scripts/check_viewer_assets.mjs
 ```
 
 `make test`, `make lint`, `make test-js`, and
-`make qualify-code-graph-v1` are convenient wrappers. CI also exercises
-nextest, packaging/install, dependency policy, integration tests, and native
-platform matrices; consult `.github/workflows/compass-ci.yml` when touching
-those surfaces. Report any relevant check not run and why.
+`make qualify-code-graph-v1` are phase-end wrappers only; none is an authorized
+incremental implementation loop. CI also exercises
+packaging/install, dependency policy, integration tests, and native platform
+matrices; consult `.github/workflows/compass-ci.yml` when touching those
+surfaces. Report any relevant check not run and why.
 
 ## Public contracts and documentation
 
@@ -268,7 +334,36 @@ Before handing off:
 - inspect `git diff` and `git status --short` for unrelated or generated noise;
 - confirm the change lives at the correct ownership boundary;
 - confirm failure paths, limits, cleanup, determinism, and platform behavior;
-- add/update tests and user documentation for changed behavior;
-- run targeted checks and the applicable baseline/gates;
+- add/update full integration coverage and user documentation for changed behavior;
+- confirm the entire phase implementation was complete before the single
+  coordinated build/integration verification wave;
+- run the workspace integration-only suite and applicable full surface gates;
 - summarize the behavior change, compatibility effect, and exact verification
   performed, including checks not run.
+
+<!-- compass:managed:start -->
+## compass
+
+When `compass-out/graph.json` exists, use the Compass knowledge graph as the
+first navigation layer. If it is absent and the task needs repository-wide
+architecture, dependency, history, or impact evidence, run `compass update .`
+once and continue. Skip the build for a narrow task that already identifies the
+files to edit or when the user asked not to create generated files.
+
+Rules:
+
+- Run `compass query "<question>"` before broad source searches
+- Set `--budget N` to fit available context; when query or explain reports
+  `next=N`, repeat the unchanged command with `--page N` and reach `next=none`
+  before exhaustive claims
+- Use `compass path "<source>" "<target>"` for dependency paths
+- Use `compass explain "<concept>"` for one concept and its neighbors
+- Use `compass affected "<symbol>"` for change-review scope
+- Read `compass-out/GRAPH_REPORT.md` for broad architecture
+- Navigate `compass-out/wiki/index.md` when the wiki exists
+- Run `compass update .` after code changes unless the user prohibited generated files
+- Verify important graph conclusions in the cited source
+- Treat missing paths and inferred edges as uncertain evidence, not proof
+- Keep explicit `--graph`, `--at`, provider, and output selections unchanged
+- Report failed refreshes; an older graph file does not make a failed update current
+<!-- compass:managed:end -->
diff --git a/CHANGELOG.md b/CHANGELOG.md
index a6b2ece60..b3e4f4759 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,98 @@
 
 ## Unreleased
 
+- Add one deterministic `distribution.toml` inventory and native package
+  generators for Codex, Claude Code, and OpenCode. Exports now include the
+  harness manifests, credential-free MCP configuration, complete copied skill
+  trees, recorded qualification versions, Codex and Claude marketplace
+  catalogs, and a thin OpenCode TypeScript plugin pinned to
+  `@opencode-ai/plugin` 1.18.25. Installed-artifact lifecycle qualification
+  covers discovery, MCP loading, upgrade, ownership preservation, and
+  uninstall. Native exports now use the harness-owned configuration paths and
+  require the recorded harness version and complete native artifact inventory;
+  regenerate older portable bundles before validating or installing them.
+
+- Add generation-pinned Surreal native reads for callers, callees, impact,
+  directed trails, connected structural subgraphs, and deterministic relation
+  pagination. Static parameter-bound statements preserve canonical identities,
+  direction, multiplicity, provenance, confidence, ordering, independent
+  bounds, and opaque repository/generation-bound cursors while exposing no raw
+  SurrealQL surface.
+- Bound Surreal projection publication to idempotent 512-record staging commits
+  with an incomplete-manifest claim and pointer-last activation, preventing the
+  Mem engine from retaining graph-sized transaction savepoints while keeping
+  interrupted candidates invisible and safely resumable.
+
+- Add the optional `compass-graphdb-surreal` library crate for deterministic,
+  schemafull projection of one immutable `compass.graph/1` generation. Candidate
+  nodes and typed relations are validated and activated in one transaction;
+  parallel edges, direction, self-loops, provenance, confidence, and stable IDs
+  round-trip through the Mem profile. SurrealDB remains pinned to 3.2.4 behind
+  non-default Mem, SurrealKV, and RocksDB features and does not reach default
+  Compass binaries. Surreal-enabled artifacts are subject to the recorded BSL
+  1.1 notice and redistribution conditions.
+
+- Add the public `compass agent list|install|doctor|export|validate|mcp-config`
+  namespace. It provides deterministic `compass.agent-list/1`,
+  `compass.agent-doctor/1`, `compass.agent-bundle/1`, and
+  `compass.agent-validation/1` contracts; offline graph, protocol, config, and
+  skill health checks; atomically published seven-skill exports; bounded
+  credential-redacting validation; and credential-free native MCP
+  configuration for Codex, Claude, OpenCode, and generic Agent Skills clients.
+  `compass agent install` delegates unchanged to the managed installer, while
+  `compass install` retains its existing bytes, side effects, and exit codes.
+
+- Add six focused, portable Agent Skills for navigation, debugging, change
+  impact, architecture, index maintenance, and MCP setup. `compass install`
+  places them as checksum-owned sibling trees while preserving the canonical
+  `compass` umbrella skill byte-for-byte, idempotent reinstall, shared-consumer
+  ownership, rollback, and unowned-file safety.
+
+- Add the versioned `compass.code_context.v1` MCP result envelope and advertised
+  output schemas to `search_symbols`, `get_callers`, `get_callees`, and
+  `get_impact`. Existing `compass.query/1` records remain unchanged under
+  `data`; MCP `resultType` remains the separate protocol discriminator. Mark
+  remaining legacy text results deprecated in discovery without renaming or
+  removing them. Reject typed graph artifacts with empty source-tree or
+  generation identities before an MCP result can violate its advertised schema.
+
+- Make stdio and Streamable HTTP require the MCP 2026-07-28 discovery and
+  per-request metadata contract, with HTTP remaining stateless and without
+  `Mcp-Session-Id`. Older protocol revisions are rejected on both transports.
+  The compatibility
+  spelling `--stateless` remains accepted. `--session-timeout` is accepted with
+  a warning and ignored through 0.4.x, then removed in 0.5.0; no legacy
+  MCP-2025 transport mode ships.
+
+- Upgrade the native MCP SDK from rmcp 2.2.0 to exactly 3.1.4 while preserving
+  stdio operation, server identity, tool names and input schemas, and resource
+  inventory. Add `server/discover` compatibility coverage against the
+  pre-migration golden contract.
+
+- Extract storage-neutral partition records, stable typed-key construction, and
+  canonical JSON encoding into a dependency-light `compass-partition` crate.
+  Existing history APIs, encoded bytes, persisted formats, and round trips
+  remain compatible.
+
+- Honor `COMPASS_MAX_GRAPH_BYTES` consistently across canonical graph
+  preflight, snapshot publication, validation, and reads while retaining the
+  2 GiB default and failing closed on invalid override values.
+
+- Add a deterministic, bounded canonical graph-size preflight after discovery,
+  so inputs estimated above the snapshot limit fail before project-wide
+  extraction with the existing actionable scope-reduction guidance.
+
+- Make oversized canonical graph failures actionable by naming `--exclude`
+  and `.compassignore` as safe ways to reduce publication scope. The CLI keeps
+  runtime exit code 1 and does not advertise the graph-byte override until the
+  snapshot publication path supports it. Oversized manifests now surface as
+  resource-limit failures rather than corruption failures.
+
+- Add manifest-only and bounded chunk-streaming reads for SQLite graph
+  snapshots. Production validation and reference generation now verify chunks
+  without retaining the canonical payload in one allocation, while the public
+  full-read API and store formats remain compatible.
+
 - Add a digest-pinned 500-question, AI-reviewed synthetic relevance matrix
   covering all query classes, execute it in CI with strict ranking, recall,
   intent, structural, no-answer, and work bounds, and keep its generated JSON
diff --git a/CLAUDE.md b/CLAUDE.md
index f1c70e2c5..aab564d2e 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -10,15 +10,36 @@ conventions, test/fixture policy, public-contract rules, and the completion
 checklist. Read it before editing. This file only adds the mechanics AGENTS.md
 does not spell out.
 
+## Immutable implementation order
+
+Complete the entire active phase's production implementation before compiling,
+linting compiled code, or testing. Do not use incremental `cargo check`,
+per-crate builds, filtered tests, or per-change green gates. Tests run only after
+the phase fully covers its specification, and only full integration tests count;
+never add, run, or cite unit tests as correctness evidence. This rule overrides
+workflow/skill defaults that request per-task or per-change compilation and QA.
+
+After implementation, one process owns the verification wave. Run the complete
+workspace integration target set with
+`cargo test --workspace --test '*' --locked`; Cargo's `--tests`, `--lib`,
+`--bins`, and default selections include unit-test harnesses and are prohibited
+here. Run complete feature-gated integration target sets afterward where the
+phase requires them.
+
 ## Build artifacts
 
-Compass build artifacts are large. Where they live is a per-contributor
-environment choice — this repository mandates no specific path or volume.
+Compass build artifacts are large. `.cargo/config.toml` and the root profiles
+place artifacts in the checkout-local `target/`, cap compilation at four jobs,
+disable incremental artifact growth, retain only line-table debug information
+for workspace code, and omit dependency debuginfo. Never point
+`CARGO_TARGET_DIR` at a shared repository/worktree cache. Run only one Compass
+Cargo command at a time on the host.
 
-If you redirect Cargo output with `CARGO_TARGET_DIR`, set it on every invocation
-that can compile (it does not persist between tool calls), and give each
-checkout and worktree its own directory — never share one across repositories or
-concurrent worktrees, since feature sets, build scripts, and locks can collide.
+If `sccache` is installed, a phase-level build may opt in with
+`RUSTC_WRAPPER=sccache CARGO_INCREMENTAL=0 SCCACHE_CACHE_SIZE=5G`. Do not make
+the wrapper unconditional: it is not portable when absent, and its Rust cache
+does not support incremental crates. Use `--profile debugging` only when the
+post-implementation integration wave proves that a debugger is necessary.
 
 Note a related Makefile wrinkle: several targets (`install`, `dist`,
 `release-check`) look up binaries through a literal `target/` path after Cargo
@@ -31,15 +52,11 @@ running it so it does not silently trigger a second build.
 Rust (Edition 2024, pinned toolchain 1.97.1, always `--locked`):
 
 ```bash
-cargo test -p <crate> --locked                              # narrowest loop
-cargo test -p <crate> --test <integration_test> --locked    # one integration file
-cargo test -p compass-cli --test compass_product --locked   # CLI product contract
-cargo clippy -p <crate> --all-targets --all-features --locked -- -D warnings
-
-# Repository baseline before finishing a Rust change
+# Run only after every production-code task in the active phase is complete.
+cargo test --workspace --test '*' --locked                  # integration targets only
+cargo test -p <affected-package> --test '*' --all-features --locked
 cargo fmt --all -- --check
 cargo clippy --workspace --lib --bins --locked -- -D warnings
-cargo test --workspace --lib --bins --locked
 ```
 
 Surface-specific gates (run the ones matching what changed):
@@ -62,13 +79,23 @@ npm run test:js
 node scripts/check_viewer_assets.mjs   # generated viewer assets match source
 ```
 
-`make help` lists wrappers. `make test`, `make lint`, `make test-js`,
-`make qualify-code-graph-v1`, and `make ci-fast` cover the common paths.
-`make test` is workspace `--lib --bins` only; `make test-all` adds
-`--all-targets --all-features` and needs the Python oracle setup.
+`make help` lists wrappers. `make test`, `make test-all`, `make test-release`,
+and `make ci-fast` select integration targets only and remain phase-end commands;
+they are never an incremental implementation loop. `make watch` is deliberately
+disabled. `make lint`, `make test-js`, and `make qualify-code-graph-v1` remain
+post-implementation surface gates.
+
+The build policy follows Cargo's official build-performance, profile,
+integration-target selection, and cache guidance:
 
-CI (`.github/workflows/compass-ci.yml`) additionally runs nextest, isolated
-native tests, crate-archive publishing checks, `cargo install` launch
+- <https://doc.rust-lang.org/cargo/guide/build-performance.html>
+- <https://doc.rust-lang.org/cargo/reference/profiles.html>
+- <https://doc.rust-lang.org/cargo/commands/cargo-test.html>
+- <https://doc.rust-lang.org/cargo/reference/build-cache.html>
+- <https://github.com/mozilla/sccache/blob/main/docs/Rust.md>
+
+CI (`.github/workflows/compass-ci.yml`) additionally runs isolated native
+integration tests, crate-archive publishing checks, `cargo install` launch
 verification, query-relevance qualification, dependency audit/policy, and a
 native platform matrix. Consult it before touching those surfaces.
 
@@ -203,3 +230,30 @@ a `CHANGELOG.md` entry when release-visible. See `COMPATIBILITY.md`.
   aesthetic, VS Code theme tokens, evidence over implication).
 - Docs distinguish shipped behavior from plans; never cite anything under
   `docs/superpowers/` as shipped evidence.
+
+<!-- compass:managed:start -->
+## compass
+
+When `compass-out/graph.json` exists, use the Compass knowledge graph as the
+first navigation layer. If it is absent and the task needs repository-wide
+architecture, dependency, history, or impact evidence, run `compass update .`
+once and continue. Skip the build for a narrow task that already identifies the
+files to edit or when the user asked not to create generated files.
+
+Rules:
+
+- Run `compass query "<question>"` before broad source searches
+- Set `--budget N` to fit available context; when query or explain reports
+  `next=N`, repeat the unchanged command with `--page N` and reach `next=none`
+  before exhaustive claims
+- Use `compass path "<source>" "<target>"` for dependency paths
+- Use `compass explain "<concept>"` for one concept and its neighbors
+- Use `compass affected "<symbol>"` for change-review scope
+- Read `compass-out/GRAPH_REPORT.md` for broad architecture
+- Navigate `compass-out/wiki/index.md` when the wiki exists
+- Run `compass update .` after code changes unless the user prohibited generated files
+- Verify important graph conclusions in the cited source
+- Treat missing paths and inferred edges as uncertain evidence, not proof
+- Keep explicit `--graph`, `--at`, provider, and output selections unchanged
+- Report failed refreshes; an older graph file does not make a failed update current
+<!-- compass:managed:end -->
diff --git a/COMPATIBILITY.md b/COMPATIBILITY.md
index a833fb817..8921420da 100644
--- a/COMPATIBILITY.md
+++ b/COMPATIBILITY.md
@@ -62,6 +62,68 @@ A user-visible incompatible change requires:
 Versioned formats use Compass-owned identifiers. Consumers should reject
 unknown major versions instead of attempting legacy fallback behavior.
 
+## Agent Skill compatibility
+
+The portable `compass` Agent Skill remains the canonical compatibility entry
+point and is installed unchanged. Compass also installs six additive sibling
+skills: `compass-navigate`, `compass-debug`, `compass-change-impact`,
+`compass-architecture`, `compass-index-maintenance`, and `compass-mcp-setup`.
+Their lower-kebab directory names match their `SKILL.md` names.
+
+Each skill tree has an independent checksum ownership manifest. Equivalent
+reinstall is idempotent, shared platform consumers are retained until the last
+consumer uninstalls, and unowned or modified trees are preserved. Older clients
+that activate only the `compass` umbrella remain compatible and require no
+migration.
+
+The additive `compass agent` namespace does not replace the installer.
+`compass agent install` delegates its remaining argument vector unchanged to
+`compass install`; equivalent invocations retain byte-identical output, exit
+status, and managed files. Inventory, doctor, bundle, and validation machine
+outputs use explicit `compass.agent-list/1`, `compass.agent-doctor/1`,
+`compass.agent-bundle/1`, and `compass.agent-validation/1` identifiers.
+Unknown major versions must be rejected. Portable exports contain only the
+current seven-skill collection and native MCP configuration; cross-harness
+plugin packages are a separate contract.
+
+## MCP transport compatibility
+
+Both stdio and Streamable HTTP require MCP 2026-07-28. Older protocol revisions
+are rejected rather than negotiated. Current clients begin with
+`server/discover`; subsequent requests carry the protocol's per-request
+metadata. HTTP requests additionally carry `Mcp-Protocol-Version`,
+`Mcp-Method`, and applicable parameter headers, and Compass neither issues nor
+requires `Mcp-Session-Id`.
+
+Compass does not ship a legacy MCP-2025 transport mode. `--stateless` remains an
+accepted compatibility spelling for the HTTP default. `--session-timeout`
+remains accepted in 0.4.x, validates its existing numeric grammar, emits a
+deprecation warning, and is ignored because no HTTP session exists. It is
+scheduled for removal in Compass 0.5.0. The warning does not change success,
+usage-error, or runtime-error exit codes.
+
+## MCP structured result compatibility
+
+`search_symbols`, `get_callers`, `get_callees`, and `get_impact` advertise a
+closed output schema and return `compass.code_context.v1`. The envelope carries
+repository and generation identity, evidence-scoped freshness, evidence and
+confidence summaries, truncation state, and warnings. Its `data` field is the
+unchanged `compass.query/1` response. MCP `resultType: "complete"` remains the
+protocol-level discriminator and is not overloaded with a Compass schema name.
+Strict `compass.graph/1` validation requires non-empty `sourceTreeDigest` and
+`generationId` build identities, so a successful envelope always satisfies its
+advertised non-empty identity fields.
+
+This top-level shape is compatibility-sensitive. Consumers must reject an
+unknown `compass.code_context` major version and must not infer freshness when
+the envelope reports `unknown`. Other typed and legacy text tools retain their
+existing result shapes until separately versioned. The text-result tools
+`get_neighbors`, `get_community`, `god_nodes`, `graph_stats`, `shortest_path`,
+`list_prs`, `get_pr_impact`, and `triage_prs`, plus explicit traversal text mode
+on `query_graph`, are deprecated from 0.4.0. They remain callable with unchanged
+names and output; no removal release is scheduled before typed replacements
+ship and receive a separate compatibility review.
+
 The release workflow publishes `compass-release.json` with schema
 `compass.release/1`. `compass upgrade` retrieves that bounded static manifest
 through the GitHub release-download path, requires one exact artifact for each
diff --git a/Cargo.lock b/Cargo.lock
index d25e2f3ec..4bee47852 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2,6 +2,15 @@
 # It is not intended for manual editing.
 version = 4
 
+[[package]]
+name = "addr"
+version = "0.15.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a93b8a41dbe230ad5087cc721f8d41611de654542180586b315d9f4cf6b72bef"
+dependencies = [
+ "psl-types",
+]
+
 [[package]]
 name = "adler2"
 version = "2.0.1"
@@ -19,6 +28,34 @@ dependencies = [
  "cpufeatures 0.2.17",
 ]
 
+[[package]]
+name = "affinitypool"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4a46f56d354df11b6bcd8ca4f84fa03ac816cc41c72568a1b337d8f7e5af90e"
+dependencies = [
+ "arc-swap",
+ "async-task",
+ "crossbeam-deque",
+ "crossbeam-utils",
+ "libc",
+ "num_cpus",
+ "parking_lot",
+ "thiserror 2.0.20",
+ "winapi",
+]
+
+[[package]]
+name = "ahash"
+version = "0.7.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "891477e0c6a8957309ee5c45a6368af3ae14bb510732d2684ffa19af310920f9"
+dependencies = [
+ "getrandom 0.2.17",
+ "once_cell",
+ "version_check",
+]
+
 [[package]]
 name = "ahash"
 version = "0.8.12"
@@ -35,9 +72,9 @@ dependencies = [
 
 [[package]]
 name = "aho-corasick"
-version = "1.1.4"
+version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
+checksum = "c982642fa9e8606056828ee9a8505737230110bb1099153c79efe865c59d12ba"
 dependencies = [
  "memchr",
 ]
@@ -48,11 +85,23 @@ version = "0.2.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
 
+[[package]]
+name = "ammonia"
+version = "4.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc6d763210e2eb7670d1a5183a08bebefa3f97db2a738a684f2ce00bd49f681d"
+dependencies = [
+ "cssparser",
+ "html5ever",
+ "maplit",
+ "url",
+]
+
 [[package]]
 name = "android_system_properties"
-version = "0.1.5"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+checksum = "ae221649c9976a6f6c56ae1facf410f3ddb33cc661c4b7b61020a912d4237fbc"
 dependencies = [
  "libc",
 ]
@@ -63,6 +112,15 @@ version = "1.0.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
 
+[[package]]
+name = "approx"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cab112f0a86d568ea0e627cc1d6be74a1e9cd55214684db5561995f6dad897c6"
+dependencies = [
+ "num-traits",
+]
+
 [[package]]
 name = "arbitrary"
 version = "1.4.2"
@@ -81,21 +139,100 @@ dependencies = [
  "rustversion",
 ]
 
+[[package]]
+name = "argon2"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c3610892ee6e0cbce8ae2700349fcf8f98adb0dbfbee85aec3c9179d29cc072"
+dependencies = [
+ "base64ct",
+ "blake2",
+ "cpufeatures 0.2.17",
+ "password-hash",
+]
+
 [[package]]
 name = "array-init"
 version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3d62b7694a562cdf5a74227903507c56ab2cc8bdd1f781ed5cb4cf9c9f810bfc"
 
+[[package]]
+name = "arrayvec"
+version = "0.7.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3fb67a6e08acf24fdeccbac2cb6ac4305825bd1f117462e0e6f2f193345ad56"
+
+[[package]]
+name = "as-slice"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "45403b49e3954a4b8428a0ac21a4b7afadccf92bfd96273f1a58cd4812496ae0"
+dependencies = [
+ "generic-array 0.12.4",
+ "generic-array 0.13.3",
+ "generic-array 0.14.7",
+ "stable_deref_trait",
+]
+
+[[package]]
+name = "async-channel"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "924ed96dd52d1b75e9c1a3e6275715fd320f5f9439fb5a4a11fa51f4221158d2"
+dependencies = [
+ "concurrent-queue",
+ "event-listener-strategy",
+ "futures-core",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "async-stream"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b5a71a6f37880a80d1d7f19efd781e4b5de42c88f0722cc13bcb6cc2cfe8476"
+dependencies = [
+ "async-stream-impl",
+ "futures-core",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "async-stream-impl"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7c24de15d275a1ecfd47a380fb4d5ec9bfe0933f309ed5e705b775596a3574d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "async-task"
+version = "4.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b75356056920673b02621b35afd0f7dda9306d03c79a30f5c56c44cf256e3de"
+
 [[package]]
 name = "async-trait"
-version = "0.1.91"
+version = "0.1.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae36dc4177970ef04fde5178d3e2429882def40e57a451f919c098f72baa6cec"
+checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.2",
+ "syn 3.0.4",
+]
+
+[[package]]
+name = "atomic-polyfill"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8cf2bce30dfe09ef0bfaef228b9d414faaf7e563035494d7fe092dba54b300f4"
+dependencies = [
+ "critical-section",
 ]
 
 [[package]]
@@ -145,9 +282,9 @@ dependencies = [
  "bytes",
  "fastrand",
  "hex",
- "http 1.4.2",
+ "http 1.5.0",
  "p256",
- "rand 0.8.7",
+ "rand 0.8.8",
  "sha1",
  "sha2 0.10.9",
  "time",
@@ -170,11 +307,35 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "aws-lc-rs"
+version = "1.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce2b2dcc879c3bae0d371e77c99f2238400ef24ec001394befa67b6e543add9e"
+dependencies = [
+ "aws-lc-sys",
+ "untrusted 0.7.1",
+ "zeroize",
+]
+
+[[package]]
+name = "aws-lc-sys"
+version = "0.44.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f09fae7be8bb3174e05c6afdb34199e6dc0c7c04ba9fa237b1967adfbde27483"
+dependencies = [
+ "cc",
+ "cmake",
+ "dunce",
+ "fs_extra",
+ "pkg-config",
+]
+
 [[package]]
 name = "aws-runtime"
-version = "1.8.1"
+version = "1.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7816e98ee912159f45d307e5ee6bfea4a335a55aee15f7f3e32f81a6f3000f1d"
+checksum = "c9007227e10b5fed2f3e0a2beff489211e2b5604c400b7a9d5d81ca9d64c24bb"
 dependencies = [
  "aws-credential-types",
  "aws-sigv4",
@@ -188,7 +349,7 @@ dependencies = [
  "bytes",
  "bytes-utils",
  "fastrand",
- "http 1.4.2",
+ "http 1.5.0",
  "http-body 1.1.0",
  "percent-encoding",
  "pin-project-lite",
@@ -219,7 +380,7 @@ dependencies = [
  "bytes",
  "fastrand",
  "http 0.2.12",
- "http 1.4.2",
+ "http 1.5.0",
  "http-body-util",
  "regex-lite",
  "tracing",
@@ -246,7 +407,7 @@ dependencies = [
  "bytes",
  "fastrand",
  "http 0.2.12",
- "http 1.4.2",
+ "http 1.5.0",
  "regex-lite",
  "tracing",
 ]
@@ -272,7 +433,7 @@ dependencies = [
  "bytes",
  "fastrand",
  "http 0.2.12",
- "http 1.4.2",
+ "http 1.5.0",
  "regex-lite",
  "tracing",
 ]
@@ -298,16 +459,16 @@ dependencies = [
  "bytes",
  "fastrand",
  "http 0.2.12",
- "http 1.4.2",
+ "http 1.5.0",
  "regex-lite",
  "tracing",
 ]
 
 [[package]]
 name = "aws-sdk-sts"
-version = "1.108.0"
+version = "1.112.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c72b08911d8128dd360fe1b22a9fec0fa8b552dde8ec828dcf20ef5ec974e9f"
+checksum = "3f582002918346a3e685be1b391c7bea155073088cea6bd4e4b7663df9e43b6c"
 dependencies = [
  "arc-swap",
  "aws-credential-types",
@@ -325,7 +486,7 @@ dependencies = [
  "aws-types",
  "fastrand",
  "http 0.2.12",
- "http 1.4.2",
+ "http 1.5.0",
  "regex-lite",
  "tracing",
 ]
@@ -346,7 +507,7 @@ dependencies = [
  "hex",
  "hmac 0.13.0",
  "http 0.2.12",
- "http 1.4.2",
+ "http 1.5.0",
  "percent-encoding",
  "sha2 0.11.0",
  "time",
@@ -388,7 +549,7 @@ dependencies = [
  "bytes-utils",
  "futures-core",
  "futures-util",
- "http 1.4.2",
+ "http 1.5.0",
  "http-body 1.1.0",
  "http-body-util",
  "percent-encoding",
@@ -407,7 +568,7 @@ dependencies = [
  "aws-smithy-runtime-api",
  "aws-smithy-types",
  "h2",
- "http 1.4.2",
+ "http 1.5.0",
  "hyper",
  "hyper-rustls",
  "hyper-util",
@@ -443,19 +604,22 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-query"
-version = "0.61.1"
+version = "0.62.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd22a6ba36e3f113cb8d5b3d1fe0ed31c76ee608ef63322d753bb8d2c9479e77"
+checksum = "512346c7212ab7436df2d77a16d976a468ae44a418835511d2a69269810aaf62"
 dependencies = [
+ "aws-smithy-runtime-api",
+ "aws-smithy-schema",
  "aws-smithy-types",
+ "aws-smithy-xml",
  "urlencoding",
 ]
 
 [[package]]
 name = "aws-smithy-runtime"
-version = "1.12.0"
+version = "1.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bea94a9ff8464016338c851e24b472d7131c388c88898a502e781815b2ee6045"
+checksum = "b82e438d30e02a825d363bd639a9efaed68a8089d86101054b0081e7e0d3e606"
 dependencies = [
  "aws-smithy-async",
  "aws-smithy-http",
@@ -466,7 +630,7 @@ dependencies = [
  "bytes",
  "fastrand",
  "http 0.2.12",
- "http 1.4.2",
+ "http 1.5.0",
  "http-body 0.4.6",
  "http-body 1.1.0",
  "http-body-util",
@@ -478,16 +642,16 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-runtime-api"
-version = "1.13.0"
+version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22ed1ebe6e0a95ea84570225f5a8208dec4b8f77e61a9b0d6f51773fcb4612f0"
+checksum = "954c563ce84507722d2679f07a35d21b9c6466b3872d513020d0281fc8112ac9"
 dependencies = [
  "aws-smithy-async",
  "aws-smithy-runtime-api-macros",
  "aws-smithy-types",
  "bytes",
  "http 0.2.12",
- "http 1.4.2",
+ "http 1.5.0",
  "pin-project-lite",
  "tokio",
  "tracing",
@@ -513,21 +677,21 @@ checksum = "7d56e0a4e53127a632224e43633b0fe045fa9e1e3cfc68b9830f1115e103f910"
 dependencies = [
  "aws-smithy-runtime-api",
  "aws-smithy-types",
- "http 1.4.2",
+ "http 1.5.0",
 ]
 
 [[package]]
 name = "aws-smithy-types"
-version = "1.6.1"
+version = "1.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6dc683efb34b9e755675b37fedbe0103141e5b6df7bdc9eb6967756a8c167d8"
+checksum = "fce83ce9abbb198d25bc7131e468d0f9fe1257125e58c39f3f9fc9f5098c9647"
 dependencies = [
  "base64-simd",
  "bytes",
  "bytes-utils",
  "futures-core",
  "http 0.2.12",
- "http 1.4.2",
+ "http 1.5.0",
  "http-body 0.4.6",
  "http-body 1.1.0",
  "http-body-util",
@@ -544,9 +708,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-xml"
-version = "0.61.1"
+version = "0.62.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea3f68eec3607f02acd24067969ce2abc6ba16aa7d5ce59ca450ed2fb5f78957"
+checksum = "ce84f71c72fee2cbbadde6e7d082f5fb466e3a84733855295fa7aafd1b31b7d8"
 dependencies = [
  "aws-smithy-runtime-api",
  "aws-smithy-schema",
@@ -556,9 +720,9 @@ dependencies = [
 
 [[package]]
 name = "aws-types"
-version = "1.4.0"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e957a6c6dbce82b7a91f44231c09273159703769f447cbe85e854dfe9cf67f86"
+checksum = "eec1cd5469f328c782dc3e33d4153cf118a54e33cbb3356d60d16f89883e1f94"
 dependencies = [
  "aws-credential-types",
  "aws-smithy-async",
@@ -579,7 +743,7 @@ dependencies = [
  "bytes",
  "form_urlencoded",
  "futures-util",
- "http 1.4.2",
+ "http 1.5.0",
  "http-body 1.1.0",
  "http-body-util",
  "hyper",
@@ -610,7 +774,7 @@ checksum = "08c78f31d7b1291f7ee735c1c6780ccde7785daae9a9206026862dab7d8792d1"
 dependencies = [
  "bytes",
  "futures-core",
- "http 1.4.2",
+ "http 1.5.0",
  "http-body 1.1.0",
  "http-body-util",
  "mime",
@@ -633,6 +797,12 @@ version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
+[[package]]
+name = "base64"
+version = "0.23.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"
+
 [[package]]
 name = "base64-simd"
 version = "0.8.0"
@@ -649,6 +819,57 @@ version = "1.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
 
+[[package]]
+name = "bcrypt"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a0f5948f30df5f43ac29d310b7476793be97c50787e6ef4a63d960a0d0be827"
+dependencies = [
+ "base64 0.22.1",
+ "blowfish",
+ "getrandom 0.3.4",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "bincode"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "36eaf5d7b090263e8150820482d5d93cd964a81e4019913c972f4edcc6edb740"
+dependencies = [
+ "bincode_derive",
+ "serde",
+ "unty",
+]
+
+[[package]]
+name = "bincode_derive"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf95709a440f45e986983918d0e8a1f30a9b1df04918fc828670606804ac3c09"
+dependencies = [
+ "virtue",
+]
+
+[[package]]
+name = "bindgen"
+version = "0.72.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "993776b509cfb49c750f11b8f07a46fa23e0a1386ffc01fb1e7d343efc387895"
+dependencies = [
+ "bitflags",
+ "cexpr",
+ "clang-sys",
+ "itertools 0.13.0",
+ "proc-macro2",
+ "quote",
+ "regex",
+ "rustc-hash 2.1.3",
+ "shlex 1.3.0",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "bit-set"
 version = "0.5.3"
@@ -685,13 +906,47 @@ version = "2.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
 
+[[package]]
+name = "bitvec"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddcec3d12c579d40898fe0a9a358a803c23e9c52ca3c425707f81c9436211837"
+dependencies = [
+ "funty",
+ "radium",
+ "tap",
+ "wyz",
+]
+
+[[package]]
+name = "blake2"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe"
+dependencies = [
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "blake3"
+version = "1.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d9e454fc11f76977dc803893aff6304ed33d6a26efae8696573bea74baa27ae"
+dependencies = [
+ "arrayvec",
+ "cc",
+ "cfg-if",
+ "constant_time_eq",
+ "cpufeatures 0.3.1",
+]
+
 [[package]]
 name = "block-buffer"
 version = "0.10.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
 dependencies = [
- "generic-array",
+ "generic-array 0.14.7",
 ]
 
 [[package]]
@@ -709,7 +964,7 @@ version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a8894febbff9f758034a5b8e12d87918f56dfc64a8e1fe757d65e29041538d93"
 dependencies = [
- "generic-array",
+ "generic-array 0.14.7",
 ]
 
 [[package]]
@@ -721,11 +976,57 @@ dependencies = [
  "objc2",
 ]
 
+[[package]]
+name = "blowfish"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e412e2cd0f2b2d93e02543ceae7917b3c70331573df19ee046bcbc35e45e87d7"
+dependencies = [
+ "byteorder",
+ "cipher",
+]
+
+[[package]]
+name = "bnum"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f781dba93de3a5ef6dc5b17c9958b208f6f3f021623b360fb605ea51ce443f10"
+
+[[package]]
+name = "borsh"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "553c5d846a6ba5150c65e3b1b8ec073bcf1abc20f9b7220de384a4443ea4e20a"
+dependencies = [
+ "borsh-derive",
+ "bytes",
+ "cfg_aliases",
+]
+
+[[package]]
+name = "borsh-derive"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12cdfe656708a01f89b451a7d36466e6fe6c414de0aa18fc54f864f6f9ca9f56"
+dependencies = [
+ "once_cell",
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.4",
+]
+
+[[package]]
+name = "boxcar"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "36f64beae40a84da1b4b26ff2761a5b895c12adc41dc25aaee1c4f2bbfe97a6e"
+
 [[package]]
 name = "bstr"
-version = "1.13.0"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f7dc094d718f2e1c1559ad110e27eeaae14a5465d3d56dd6dbd793079fbd530"
+checksum = "6bb31b46c14244e20ee9984b11bf5c992b91fb6939fea616e3512c8baecdbe5f"
 dependencies = [
  "memchr",
  "regex-automata",
@@ -738,6 +1039,28 @@ version = "3.20.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
 
+[[package]]
+name = "bytecheck"
+version = "0.6.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23cdc57ce23ac53c931e88a43d06d070a6fd142f2617be5855eb75efc9beb1c2"
+dependencies = [
+ "bytecheck_derive",
+ "ptr_meta",
+ "simdutf8",
+]
+
+[[package]]
+name = "bytecheck_derive"
+version = "0.6.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3db406d29fbcd95542e92559bed4d8ad92636d1ca8b3b72ede10b4bcc010e659"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
 [[package]]
 name = "bytemuck"
 version = "1.25.2"
@@ -749,13 +1072,13 @@ dependencies = [
 
 [[package]]
 name = "bytemuck_derive"
-version = "1.11.0"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f65693059b6b9c588b9f62fed1cedbf0a8b805631457ea162d68f0de186f3de5"
+checksum = "fc0e56a716f1e132ff6bf4bdac1c944a3fcdc1cae65f70a4a2a1ac3b401d2d1f"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.4",
 ]
 
 [[package]]
@@ -769,6 +1092,9 @@ name = "bytes"
 version = "1.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
+dependencies = [
+ "serde",
+]
 
 [[package]]
 name = "bytes-utils"
@@ -780,6 +1106,16 @@ dependencies = [
  "either",
 ]
 
+[[package]]
+name = "bzip2-sys"
+version = "0.1.13+1.0.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "225bff33b2141874fe80d71e07d6eec4f85c5c216453dd96388240f96e1acc14"
+dependencies = [
+ "cc",
+ "pkg-config",
+]
+
 [[package]]
 name = "candle-core"
 version = "0.9.2"
@@ -798,7 +1134,7 @@ dependencies = [
  "rand_distr",
  "rayon",
  "safetensors",
- "thiserror 2.0.19",
+ "thiserror 2.0.20",
  "yoke",
  "zip 7.2.0",
 ]
@@ -816,7 +1152,7 @@ dependencies = [
  "rayon",
  "safetensors",
  "serde",
- "thiserror 2.0.19",
+ "thiserror 2.0.20",
 ]
 
 [[package]]
@@ -838,6 +1174,15 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "castaway"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dec551ab6e7578819132c713a93c022a05d60159dc86e7a7050223577484c55a"
+dependencies = [
+ "rustversion",
+]
+
 [[package]]
 name = "cbc"
 version = "0.1.2"
@@ -849,14 +1194,14 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.3.0"
+version = "1.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c89588d05638b5b4594a3348a2d6c20277e43a7f5c5202b05cc56888475a47b8"
+checksum = "0ad534f4357a5264cce5019c989cf66a4f0dc4e0d1b1d15f8aacec0ff7360273"
 dependencies = [
  "find-msvc-tools",
  "jobserver",
  "libc",
- "shlex",
+ "shlex 2.0.1",
 ]
 
 [[package]]
@@ -865,6 +1210,15 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6d43a04d8753f35258c91f8ec639f792891f748a1edbd759cf1dcea3382ad83c"
 
+[[package]]
+name = "cexpr"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6fac387a98bb7c37292057cffc56d62ecb629900026402633ae9160df93a8766"
+dependencies = [
+ "nom",
+]
+
 [[package]]
 name = "cfg-if"
 version = "1.0.4"
@@ -879,12 +1233,12 @@ checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
 
 [[package]]
 name = "chacha20"
-version = "0.10.1"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
 dependencies = [
  "cfg-if",
- "cpufeatures 0.3.0",
+ "cpufeatures 0.3.1",
  "rand_core 0.10.1",
 ]
 
@@ -899,17 +1253,64 @@ dependencies = [
  "num-traits",
  "serde",
  "wasm-bindgen",
- "windows-link",
+ "windows-link 0.2.1",
 ]
 
 [[package]]
-name = "cipher"
-version = "0.4.4"
+name = "ciborium"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
+checksum = "42e69ffd6f0917f5c029256a24d0161db17cea3997d185db0d35926308770f0e"
 dependencies = [
- "crypto-common 0.1.7",
- "inout",
+ "ciborium-io",
+ "ciborium-ll",
+ "serde",
+]
+
+[[package]]
+name = "ciborium-io"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05afea1e0a06c9be33d539b876f1ce3692f4afea2cb41f740e7743225ed1c757"
+
+[[package]]
+name = "ciborium-ll"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57663b653d948a338bfb3eeba9bb2fd5fcfaecb9e199e87e1eda4d9e8b240fd9"
+dependencies = [
+ "ciborium-io",
+ "half 2.7.1",
+]
+
+[[package]]
+name = "cipher"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
+dependencies = [
+ "crypto-common 0.1.7",
+ "inout",
+]
+
+[[package]]
+name = "clang-sys"
+version = "1.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "157a8ba7b480713b56f4c09fd13fc3e0a22a5dfab8097ba61cbc5feef950788a"
+dependencies = [
+ "glob",
+ "libc",
+ "libloading",
+]
+
+[[package]]
+name = "cmake"
+version = "0.1.58"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0f78a02292a74a88ac736019ab962ece0bc380e3f977bf72e376c5d78ff0678"
+dependencies = [
+ "cc",
 ]
 
 [[package]]
@@ -920,9 +1321,9 @@ checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a"
 
 [[package]]
 name = "combine"
-version = "4.6.7"
+version = "4.6.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba5a308b75df32fe02788e748662718f03fde005016435c444eea572398219fd"
+checksum = "cfc320937d09e6de266b31b9afb480f197d7a861be86be7cb2ea7e5d1bfffc5e"
 dependencies = [
  "bytes",
  "memchr",
@@ -938,7 +1339,7 @@ dependencies = [
  "serde",
  "serde_json",
  "sha2 0.10.9",
- "thiserror 2.0.19",
+ "thiserror 2.0.20",
 ]
 
 [[package]]
@@ -949,8 +1350,8 @@ dependencies = [
  "glob",
  "serde_json",
  "tempfile",
- "thiserror 2.0.19",
- "toml 1.1.3+spec-1.1.0",
+ "thiserror 2.0.20",
+ "toml 1.1.4+spec-1.1.0",
 ]
 
 [[package]]
@@ -994,7 +1395,7 @@ dependencies = [
  "tempfile",
  "time",
  "tokio",
- "toml 1.1.3+spec-1.1.0",
+ "toml 1.1.4+spec-1.1.0",
  "ureq",
  "url",
 ]
@@ -1003,7 +1404,7 @@ dependencies = [
 name = "compass-core"
 version = "0.3.7"
 dependencies = [
- "ahash",
+ "ahash 0.8.12",
  "compass-analysis",
  "compass-files",
  "compass-google-workspace",
@@ -1026,7 +1427,7 @@ dependencies = [
  "serde_json",
  "sha2 0.10.9",
  "tempfile",
- "thiserror 2.0.19",
+ "thiserror 2.0.20",
  "time",
 ]
 
@@ -1039,8 +1440,8 @@ dependencies = [
  "serde",
  "serde_json",
  "sha2 0.10.9",
- "thiserror 2.0.19",
- "toml 1.1.3+spec-1.1.0",
+ "thiserror 2.0.20",
+ "toml 1.1.4+spec-1.1.0",
 ]
 
 [[package]]
@@ -1057,8 +1458,8 @@ dependencies = [
  "serde_json",
  "sha2 0.10.9",
  "tempfile",
- "thiserror 2.0.19",
- "toml 1.1.3+spec-1.1.0",
+ "thiserror 2.0.20",
+ "toml 1.1.4+spec-1.1.0",
  "zstd",
 ]
 
@@ -1071,7 +1472,7 @@ dependencies = [
  "serde_json",
  "sha2 0.10.9",
  "tempfile",
- "thiserror 2.0.19",
+ "thiserror 2.0.20",
  "time",
 ]
 
@@ -1083,7 +1484,7 @@ dependencies = [
  "serde_json",
  "sha2 0.10.9",
  "tempfile",
- "thiserror 2.0.19",
+ "thiserror 2.0.20",
  "url",
  "wait-timeout",
 ]
@@ -1092,9 +1493,10 @@ dependencies = [
 name = "compass-graph"
 version = "0.3.7"
 dependencies = [
- "ahash",
+ "ahash 0.8.12",
  "compass-languages",
  "compass-model",
+ "compass-resolve",
  "compass-store",
  "rayon",
  "rmp-serde",
@@ -1104,7 +1506,7 @@ dependencies = [
  "sha2 0.10.9",
  "strsim",
  "tempfile",
- "thiserror 2.0.19",
+ "thiserror 2.0.20",
  "unicode-casefold",
  "unicode-normalization",
  "zstd",
@@ -1116,12 +1518,27 @@ version = "0.3.7"
 dependencies = [
  "compass-model",
  "rustls",
- "rustls-platform-verifier",
+ "rustls-platform-verifier 0.6.2",
  "serde_json",
- "thiserror 2.0.19",
+ "thiserror 2.0.20",
  "url",
 ]
 
+[[package]]
+name = "compass-graphdb-surreal"
+version = "0.3.7"
+dependencies = [
+ "compass-model",
+ "compass-query",
+ "serde",
+ "serde_json",
+ "sha2 0.10.9",
+ "surrealdb",
+ "tempfile",
+ "thiserror 2.0.20",
+ "tokio",
+]
+
 [[package]]
 name = "compass-history"
 version = "0.3.7"
@@ -1131,15 +1548,16 @@ dependencies = [
  "compass-files",
  "compass-ir",
  "compass-model",
+ "compass-partition",
  "prolly-map",
  "prolly-store-sqlite",
- "rand 0.8.7",
+ "rand 0.8.8",
  "rayon",
  "serde",
  "serde_json",
  "sha2 0.10.9",
  "tempfile",
- "thiserror 2.0.19",
+ "thiserror 2.0.20",
 ]
 
 [[package]]
@@ -1153,7 +1571,7 @@ dependencies = [
  "sha1",
  "sha2 0.10.9",
  "tempfile",
- "thiserror 2.0.19",
+ "thiserror 2.0.20",
  "time",
  "ureq",
  "url",
@@ -1167,14 +1585,14 @@ dependencies = [
  "serde",
  "serde_json",
  "sha2 0.10.9",
- "thiserror 2.0.19",
+ "thiserror 2.0.20",
 ]
 
 [[package]]
 name = "compass-languages"
 version = "0.3.7"
 dependencies = [
- "ahash",
+ "ahash 0.8.12",
  "compass-files",
  "compass-ir",
  "compass-program",
@@ -1188,8 +1606,8 @@ dependencies = [
  "sha1",
  "sha2 0.10.9",
  "tempfile",
- "thiserror 2.0.19",
- "toml 1.1.3+spec-1.1.0",
+ "thiserror 2.0.20",
+ "toml 1.1.4+spec-1.1.0",
  "tree-sitter",
  "tree-sitter-dm",
  "tree-sitter-html",
@@ -1211,8 +1629,10 @@ dependencies = [
  "compass-model",
  "compass-prs",
  "compass-query",
+ "http-body-util",
  "rmcp",
  "serde_json",
+ "sha2 0.10.9",
  "tempfile",
  "time",
  "tokio",
@@ -1227,7 +1647,7 @@ dependencies = [
  "oxidize-pdf",
  "roxmltree",
  "tempfile",
- "thiserror 2.0.19",
+ "thiserror 2.0.20",
  "zip 6.0.0",
 ]
 
@@ -1241,14 +1661,14 @@ dependencies = [
  "serde_json",
  "sha2 0.10.9",
  "tempfile",
- "thiserror 2.0.19",
+ "thiserror 2.0.20",
 ]
 
 [[package]]
 name = "compass-output"
 version = "0.3.7"
 dependencies = [
- "ahash",
+ "ahash 0.8.12",
  "compass-cypher",
  "compass-files",
  "compass-graph",
@@ -1261,11 +1681,19 @@ dependencies = [
  "sha1",
  "sha2 0.10.9",
  "tempfile",
- "thiserror 2.0.19",
+ "thiserror 2.0.20",
  "time",
  "unicode-normalization",
 ]
 
+[[package]]
+name = "compass-partition"
+version = "0.3.7"
+dependencies = [
+ "serde_json",
+ "thiserror 2.0.20",
+]
+
 [[package]]
 name = "compass-postgres"
 version = "0.3.7"
@@ -1275,7 +1703,7 @@ dependencies = [
  "serde",
  "serde_json",
  "tempfile",
- "thiserror 2.0.19",
+ "thiserror 2.0.20",
  "tokio",
  "tokio-postgres",
  "tokio-postgres-rustls",
@@ -1285,8 +1713,8 @@ dependencies = [
 name = "compass-program"
 version = "0.3.7"
 dependencies = [
- "ahash",
- "base64",
+ "ahash 0.8.12",
+ "base64 0.22.1",
  "compass-ir",
  "protobuf",
  "rayon",
@@ -1294,7 +1722,7 @@ dependencies = [
  "serde",
  "serde_json",
  "sha2 0.10.9",
- "thiserror 2.0.19",
+ "thiserror 2.0.20",
 ]
 
 [[package]]
@@ -1306,7 +1734,7 @@ dependencies = [
  "regex",
  "serde_json",
  "tempfile",
- "thiserror 2.0.19",
+ "thiserror 2.0.20",
  "time",
  "wait-timeout",
 ]
@@ -1332,7 +1760,7 @@ dependencies = [
  "serde_json",
  "sha2 0.10.9",
  "tempfile",
- "thiserror 2.0.19",
+ "thiserror 2.0.20",
  "unicode-normalization",
 ]
 
@@ -1347,7 +1775,7 @@ dependencies = [
  "serde_json",
  "sha2 0.10.9",
  "tempfile",
- "thiserror 2.0.19",
+ "thiserror 2.0.20",
  "time",
 ]
 
@@ -1355,7 +1783,7 @@ dependencies = [
 name = "compass-resolve"
 version = "0.3.7"
 dependencies = [
- "ahash",
+ "ahash 0.8.12",
  "compass-files",
  "compass-graph",
  "compass-ir",
@@ -1368,7 +1796,7 @@ dependencies = [
  "serde_json",
  "sha1",
  "tempfile",
- "thiserror 2.0.19",
+ "thiserror 2.0.20",
 ]
 
 [[package]]
@@ -1378,14 +1806,14 @@ dependencies = [
  "aws-config",
  "aws-sdk-bedrockruntime",
  "aws-smithy-http-client",
- "base64",
+ "base64 0.22.1",
  "compass-files",
  "compass-media",
  "regex",
  "serde_json",
  "sha2 0.10.9",
  "tempfile",
- "thiserror 2.0.19",
+ "thiserror 2.0.20",
  "time",
  "tokio",
  "ureq",
@@ -1406,7 +1834,7 @@ dependencies = [
  "serde",
  "serde_json",
  "sha2 0.10.9",
- "thiserror 2.0.19",
+ "thiserror 2.0.20",
 ]
 
 [[package]]
@@ -1418,7 +1846,7 @@ dependencies = [
  "serde_json",
  "sha2 0.10.9",
  "tempfile",
- "thiserror 2.0.19",
+ "thiserror 2.0.20",
 ]
 
 [[package]]
@@ -1462,7 +1890,7 @@ dependencies = [
  "sha2 0.10.9",
  "symphonia",
  "tempfile",
- "thiserror 2.0.19",
+ "thiserror 2.0.20",
  "ureq",
  "url",
  "wait-timeout",
@@ -1472,14 +1900,14 @@ dependencies = [
 name = "compass-tree-sitter-language-pack"
 version = "1.13.1"
 dependencies = [
- "ahash",
+ "ahash 0.8.12",
  "cc",
  "memchr",
  "serde",
  "serde_json",
  "sha2 0.11.0",
  "tar",
- "thiserror 2.0.19",
+ "thiserror 2.0.20",
  "tree-sitter",
  "ureq",
  "zstd",
@@ -1494,14 +1922,23 @@ dependencies = [
  "candle-nn",
  "candle-transformers",
  "flate2",
- "rand 0.8.7",
+ "rand 0.8.8",
  "realfft",
- "rustc-hash",
+ "rustc-hash 1.1.0",
  "serde",
  "serde_json",
  "tiktoken-rs",
 ]
 
+[[package]]
+name = "concurrent-queue"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973"
+dependencies = [
+ "crossbeam-utils",
+]
+
 [[package]]
 name = "const-oid"
 version = "0.9.6"
@@ -1534,11 +1971,17 @@ dependencies = [
  "tiny-keccak",
 ]
 
+[[package]]
+name = "constant_time_eq"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d52eff69cd5e647efe296129160853a42795992097e8af39800e1060caeea9b"
+
 [[package]]
 name = "cookie"
-version = "0.18.1"
+version = "0.18.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ddef33a339a91ea89fb53151bd0a4689cfce27055c291dfa69945475d22c747"
+checksum = "1a373e3602691c3cdea496d2f0ee5935151e6168fe87739483c463db1b2f2f87"
 dependencies = [
  "percent-encoding",
  "time",
@@ -1590,22 +2033,28 @@ dependencies = [
 
 [[package]]
 name = "cpufeatures"
-version = "0.3.0"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
+checksum = "5ca28b0ae3115b884660db4118d803791fd6756b6e88f39c0f3f7859060d7566"
 dependencies = [
  "libc",
 ]
 
 [[package]]
 name = "crc32fast"
-version = "1.5.0"
+version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511"
+checksum = "8498c871161e1742aaa9d52551b2d6ebdd4c3d45a3be423e3728f33b955be550"
 dependencies = [
  "cfg-if",
 ]
 
+[[package]]
+name = "critical-section"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "790eea4361631c5e7d22598ecd5723ff611904e3344ce8720784c93e3d83d40b"
+
 [[package]]
 name = "crossbeam-deque"
 version = "0.8.7"
@@ -1625,6 +2074,25 @@ dependencies = [
  "crossbeam-utils",
 ]
 
+[[package]]
+name = "crossbeam-queue"
+version = "0.3.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "803d13fb3b09d88be9f4dbc29062c66b19bf7170867ceb746d2a8689bf6c7a26"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-skiplist"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df29de440c58ca2cc6e587ec3d22347551a32435fbde9d2bff64e78a9ffa151b"
+dependencies = [
+ "crossbeam-epoch",
+ "crossbeam-utils",
+]
+
 [[package]]
 name = "crossbeam-utils"
 version = "0.8.22"
@@ -1643,7 +2111,7 @@ version = "0.5.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"
 dependencies = [
- "generic-array",
+ "generic-array 0.14.7",
  "rand_core 0.6.4",
  "subtle",
  "zeroize",
@@ -1655,7 +2123,7 @@ version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
 dependencies = [
- "generic-array",
+ "generic-array 0.14.7",
  "typenum",
 ]
 
@@ -1668,6 +2136,17 @@ dependencies = [
  "hybrid-array",
 ]
 
+[[package]]
+name = "cssparser"
+version = "0.37.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8c9cdaae01d5ed7882b04d795e7f752f46ff52d2fa3b50a20d28c464510bba98"
+dependencies = [
+ "dtoa-short",
+ "itoa",
+ "smallvec",
+]
+
 [[package]]
 name = "ctrlc"
 version = "3.5.2"
@@ -1688,6 +2167,53 @@ dependencies = [
  "cmov",
 ]
 
+[[package]]
+name = "curve25519-dalek"
+version = "4.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "curve25519-dalek-derive",
+ "digest 0.10.7",
+ "fiat-crypto",
+ "rustc_version",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "curve25519-dalek-derive"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "dashmap"
+version = "6.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6361d5c062261c78a176addb82d4c821ae42bed6089de0e12603cd25de2059c"
+dependencies = [
+ "cfg-if",
+ "crossbeam-utils",
+ "hashbrown 0.14.5",
+ "lock_api",
+ "once_cell",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "data-encoding"
+version = "2.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4583a4551df46e2792f82ceeac45e850d2e2d5debba0b91f102385cda5b11f06"
+
 [[package]]
 name = "der"
 version = "0.7.10"
@@ -1729,6 +2255,12 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "deunicode"
+version = "1.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "abd57806937c9cc163efc8ea3910e00a62e2aeb0b8119f1793a978088f8f6b04"
+
 [[package]]
 name = "digest"
 version = "0.10.7"
@@ -1753,6 +2285,64 @@ dependencies = [
  "ctutils",
 ]
 
+[[package]]
+name = "diskann"
+version = "0.54.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "421c6cf955c6cb1451d36c8a3740ab2a22880265d0fa93d8ea22cbc425c90479"
+dependencies = [
+ "anyhow",
+ "bytemuck",
+ "diskann-utils",
+ "diskann-vector",
+ "diskann-wide",
+ "futures-util",
+ "half 2.7.1",
+ "hashbrown 0.16.1",
+ "num-traits",
+ "rand 0.9.5",
+ "thiserror 2.0.20",
+ "tokio",
+]
+
+[[package]]
+name = "diskann-utils"
+version = "0.54.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cdf7d491910fbff13338e07460c9197a3c172268cfd4d8f8e69e5cec5a256d9"
+dependencies = [
+ "bytemuck",
+ "cfg-if",
+ "diskann-vector",
+ "diskann-wide",
+ "half 2.7.1",
+ "rand 0.9.5",
+ "rand_distr",
+ "rayon",
+ "thiserror 2.0.20",
+]
+
+[[package]]
+name = "diskann-vector"
+version = "0.54.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de1643bbece645f03527ef120bc7dd5e4e40557980dbe52ee51129adfb58a851"
+dependencies = [
+ "cfg-if",
+ "diskann-wide",
+ "half 2.7.1",
+]
+
+[[package]]
+name = "diskann-wide"
+version = "0.54.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "421f02c42e57a2153dc65b66b4b95fe2be56e14bf9f95253b663abcac8521166"
+dependencies = [
+ "cfg-if",
+ "half 2.7.1",
+]
+
 [[package]]
 name = "dispatch2"
 version = "0.3.1"
@@ -1767,13 +2357,23 @@ dependencies = [
 
 [[package]]
 name = "displaydoc"
-version = "0.2.6"
+version = "0.2.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ac70aa55017e108007fbaf5aa0f54b021c98f92ff8af59d42eda9da96e3dd4f"
+checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.4",
+]
+
+[[package]]
+name = "dmp"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb2dfc7a18dffd3ef60a442b72a827126f1557d914620f8fc4d1049916da43c1"
+dependencies = [
+ "trice",
+ "urlencoding",
 ]
 
 [[package]]
@@ -1785,6 +2385,27 @@ dependencies = [
  "litrs",
 ]
 
+[[package]]
+name = "dtoa"
+version = "1.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c3cf4824e2d5f025c7b531afcb2325364084a16806f6d47fbc1f5fbd9960590"
+
+[[package]]
+name = "dtoa-short"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd1511a7b6a56299bd043a9c167a6d2bfb37bf84a6dfceaba651168adfb43c87"
+dependencies = [
+ "dtoa",
+]
+
+[[package]]
+name = "dunce"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
+
 [[package]]
 name = "dyn-clone"
 version = "1.0.20"
@@ -1807,6 +2428,16 @@ version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e1d926b4d407d372f141f93bb444696142c29d32962ccbd3531117cf3aa0bfa9"
 
+[[package]]
+name = "earcutr"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "79127ed59a85d7687c409e9978547cffb7dc79675355ed22da6b66fd5f6ead01"
+dependencies = [
+ "itertools 0.11.0",
+ "num-traits",
+]
+
 [[package]]
 name = "ecdsa"
 version = "0.16.9"
@@ -1821,11 +2452,35 @@ dependencies = [
  "spki",
 ]
 
+[[package]]
+name = "ed25519"
+version = "2.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
+dependencies = [
+ "pkcs8",
+ "signature",
+]
+
+[[package]]
+name = "ed25519-dalek"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70e796c081cee67dc755e1a36a0a172b897fab85fc3f6bc48307991f64e4eca9"
+dependencies = [
+ "curve25519-dalek",
+ "ed25519",
+ "serde",
+ "sha2 0.10.9",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "either"
-version = "1.16.0"
+version = "1.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91622ff5e7162018101f2fea40d6ebf4a78bbe5a49736a2020649edf9693679e"
+checksum = "252afb9ae5eaa683babdc6a068b3f5726eb19e05070c731f9b2a23a7c3e8ed34"
 
 [[package]]
 name = "elliptic-curve"
@@ -1837,8 +2492,9 @@ dependencies = [
  "crypto-bigint",
  "digest 0.10.7",
  "ff",
- "generic-array",
+ "generic-array 0.14.7",
  "group",
+ "hkdf",
  "pem-rfc7468",
  "pkcs8",
  "rand_core 0.6.4",
@@ -1853,7 +2509,7 @@ version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a1e6a265c649f3f5979b601d26f1d05ada116434c87741c9493cb56218f76cbc"
 dependencies = [
- "heck",
+ "heck 0.5.0",
  "proc-macro2",
  "quote",
  "syn 2.0.119",
@@ -1875,6 +2531,39 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "event-listener"
+version = "5.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a23add41df1562121a9393cb065eab5146a1242410f23a644851e90cfd669d2"
+dependencies = [
+ "parking",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "event-listener-strategy"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8be9f3dfaaffdae2972880079a491a1a8bb7cbed0b8dd7a347f668b4150a3b93"
+dependencies = [
+ "event-listener",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "ext-sort"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf5d3b056bcc471d38082b8c453acb6670f7327fd44219b3c411e40834883569"
+dependencies = [
+ "log",
+ "rayon",
+ "rmp-serde",
+ "serde",
+ "tempfile",
+]
+
 [[package]]
 name = "extended"
 version = "0.1.0"
@@ -1921,6 +2610,17 @@ dependencies = [
  "regex-syntax",
 ]
 
+[[package]]
+name = "fastnum"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "020d1b59a944bc239d79903fbac2eda2365138b44890c27979562f6592059dcd"
+dependencies = [
+ "bnum",
+ "num-integer",
+ "num-traits",
+]
+
 [[package]]
 name = "fastrand"
 version = "2.5.0"
@@ -1937,6 +2637,12 @@ dependencies = [
  "subtle",
 ]
 
+[[package]]
+name = "fiat-crypto"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
+
 [[package]]
 name = "filetime"
 version = "0.2.29"
@@ -1949,9 +2655,9 @@ dependencies = [
 
 [[package]]
 name = "find-msvc-tools"
-version = "0.1.9"
+version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
+checksum = "d45db016d36b838f563236e9193d0ee6ce38f3f68b6c94e914b4929c96bbb890"
 
 [[package]]
 name = "flagset"
@@ -1960,14 +2666,25 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b7ac824320a75a52197e8f2d787f6a38b6718bb6897a35142d749af3c0e8f4fe"
 
 [[package]]
-name = "flate2"
-version = "1.1.9"
+name = "flatbuffers"
+version = "25.12.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
+checksum = "35f6839d7b3b98adde531effaf34f0c2badc6f4735d26fe74709d8e513a96ef3"
 dependencies = [
- "crc32fast",
- "miniz_oxide",
- "zlib-rs",
+ "bitflags",
+ "rustc_version",
+ "serde",
+]
+
+[[package]]
+name = "flate2"
+version = "1.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e634e2e0ebac1ee034020da1ca582e17ffe4e0f5e985823721e168928136dcb"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide",
+ "zlib-rs",
 ]
 
 [[package]]
@@ -1982,6 +2699,12 @@ dependencies = [
  "rand_distr",
 ]
 
+[[package]]
+name = "float_next_after"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8bf7cc16383c4b8d58b9905a8509f02926ce3058053c056376248d958c9df1e8"
+
 [[package]]
 name = "fnv"
 version = "1.0.7"
@@ -2003,6 +2726,22 @@ dependencies = [
  "percent-encoding",
 ]
 
+[[package]]
+name = "fs2"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9564fc758e15025b46aa6643b1b77d047d1a56a1aea6e01002ac0c7026876213"
+dependencies = [
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "fs_extra"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
+
 [[package]]
 name = "fsevent-sys"
 version = "4.1.0"
@@ -2012,11 +2751,23 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "fst"
+version = "0.4.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ab85b9b05e3978cc9a9cf8fea7f01b494e1a09ed3037e16ba39edc7a29eb61a"
+
+[[package]]
+name = "funty"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6d5a32815ae3f33302d95fdcb2ce17862f8c65363dcfd29360480ba1001fc9c"
+
 [[package]]
 name = "futures"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a88cf1f829d945f548cf8fec32c61b1f202b6d93b45848602fc02af4b12ad218"
+checksum = "9a31d2a3fbaaeb2af2368bbdd904aa8e812d3c04a1ee10d3171f52d556e5d0a3"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -2029,9 +2780,9 @@ dependencies = [
 
 [[package]]
 name = "futures-channel"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "262590f4fe6afeb0bc83be1daa64e52657fe185690a958af7f3ad0e92085c5ae"
+checksum = "b1f9e3d69d39e4862ffed03ed071a76f9a13ba1d9109d355b0f0aa6b15e393c4"
 dependencies = [
  "futures-core",
  "futures-sink",
@@ -2039,15 +2790,15 @@ dependencies = [
 
 [[package]]
 name = "futures-core"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2cd50c473c80f6d7c3670a752354b8e569b1a7cbfdc0419ec88e5edad85e0dc7"
+checksum = "92d699e522242e69e3003b94ecc1f960f3a5e015aa7c5d7486e65ad01dd94f5e"
 
 [[package]]
 name = "futures-executor"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6754879cc9f2c66f88c6e5c35344bb0bdb0708b0352b1201815667c7eabc7458"
+checksum = "031b47cf1a3c6cc8bc2fc76cd437f521619387907d469316e7c0bc278f1f5432"
 dependencies = [
  "futures-core",
  "futures-task",
@@ -2056,38 +2807,38 @@ dependencies = [
 
 [[package]]
 name = "futures-io"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4577ecaa3c4f96589d473f679a71b596316f6641bc350038b962a5daf0085d7a"
+checksum = "53c0fa8157de1303bfffdaa1cc2a673bfffb60102f76b0ef4441659124373fed"
 
 [[package]]
 name = "futures-macro"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d6d3cde68c518367be28956066ddfef33813991b77a55005a69dae04bf3b10b"
+checksum = "9fb9654ba8355388abeb8dcb4fc62f511300867002afc858860463bdd9fe0c44"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.4",
 ]
 
 [[package]]
 name = "futures-sink"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e34418ac499d6305c2fb5ad0ed2f6ac998c5f8ca209b4510f7f94242c647e307"
+checksum = "1944426bf7d03f1d14f708785e4b33efd750b36d48a157b836b3efc15ede8e1d"
 
 [[package]]
 name = "futures-task"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b231ed28831efb4a61a08580c4bc233ec56bc009f4cd8f52da2c3cb97df0c109"
+checksum = "cd417de3d1d015fc3bfd2b1ea46dfc7bab72ef86f1cc7cc9c78e728b34a6d1fd"
 
 [[package]]
 name = "futures-util"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a77a90a256fce34da66415271e30f94ee91c57b04b8a2c042d9cf3220179deaa"
+checksum = "0d50a92467f8ba5dd6e3ee5d4bd04d73ab2e4e1c44474a0674821dfce14b79bc"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -2100,6 +2851,15 @@ dependencies = [
  "slab",
 ]
 
+[[package]]
+name = "fuzzy-matcher"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "54614a3312934d066701a80f20f15fa3b56d67ac7722b39eea5b4c9dd1d66c94"
+dependencies = [
+ "thread_local",
+]
+
 [[package]]
 name = "gemm"
 version = "0.19.0"
@@ -2217,6 +2977,24 @@ dependencies = [
  "seq-macro",
 ]
 
+[[package]]
+name = "generic-array"
+version = "0.12.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ffdf9f34f1447443d37393cc6c2b8313aebddcd96906caf34e54c68d8e57d7bd"
+dependencies = [
+ "typenum",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f797e67af32588215eaaab8327027ee8e71b9dd0b2b26996aedf20c030fce309"
+dependencies = [
+ "typenum",
+]
+
 [[package]]
 name = "generic-array"
 version = "0.14.7"
@@ -2228,6 +3006,55 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "geo"
+version = "0.32.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f3901269ec6d4f6068d3f09e5f02f995bd076398dcd1dfec407cd230b02d11b"
+dependencies = [
+ "earcutr",
+ "float_next_after",
+ "geo-types",
+ "geographiclib-rs",
+ "i_overlay",
+ "log",
+ "num-traits",
+ "rand 0.8.8",
+ "robust",
+ "rstar 0.12.2",
+ "serde",
+ "sif-itree",
+ "spade",
+]
+
+[[package]]
+name = "geo-types"
+version = "0.7.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "777d18aa0f12f8b285331cd867133ee14422b3f023f6d388034c47d43e28786a"
+dependencies = [
+ "approx",
+ "num-traits",
+ "rayon",
+ "rstar 0.10.0",
+ "rstar 0.11.0",
+ "rstar 0.12.2",
+ "rstar 0.13.0",
+ "rstar 0.8.4",
+ "rstar 0.9.3",
+ "serde",
+ "thiserror 2.0.20",
+]
+
+[[package]]
+name = "geographiclib-rs"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c5a7f08910fd98737a6eda7568e7c5e645093e073328eeef49758cfe8b0489c7"
+dependencies = [
+ "libm",
+]
+
 [[package]]
 name = "getrandom"
 version = "0.2.17"
@@ -2235,8 +3062,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
 dependencies = [
  "cfg-if",
+ "js-sys",
  "libc",
  "wasi 0.11.1+wasi-snapshot-preview1",
+ "wasm-bindgen",
 ]
 
 [[package]]
@@ -2246,9 +3075,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
 dependencies = [
  "cfg-if",
+ "js-sys",
  "libc",
  "r-efi 5.3.0",
  "wasip2",
+ "wasm-bindgen",
 ]
 
 [[package]]
@@ -2265,9 +3096,9 @@ dependencies = [
 
 [[package]]
 name = "glob"
-version = "0.3.3"
+version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"
+checksum = "e4eba85ea1d0a966a983acd07deee566e67395d2d96b6fb39e62b5a833f1eb0b"
 
 [[package]]
 name = "group"
@@ -2280,18 +3111,24 @@ dependencies = [
  "subtle",
 ]
 
+[[package]]
+name = "guardian"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "17e2ac29387b1aa07a1e448f7bb4f35b500787971e965b02842b900afa5c8f6f"
+
 [[package]]
 name = "h2"
-version = "0.4.15"
+version = "0.4.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6cb093c84e8bd9b188d4c4a8cb6579fc016968d14c99882163cd3ff402a4f155"
+checksum = "ef8e5e5a340588f4452631496976cf8636d4a7ecf600239fdc27615d2530bc16"
 dependencies = [
  "atomic-waker",
  "bytes",
  "fnv",
  "futures-core",
  "futures-sink",
- "http 1.4.2",
+ "http 1.5.0",
  "indexmap",
  "slab",
  "tokio",
@@ -2320,13 +3157,49 @@ dependencies = [
  "zerocopy",
 ]
 
+[[package]]
+name = "hash32"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4041af86e63ac4298ce40e5cca669066e75b6f1aa3390fe2561ffa5e1d9f4cc"
+dependencies = [
+ "byteorder",
+]
+
+[[package]]
+name = "hash32"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b0c35f58762feb77d74ebe43bdbc3210f09be9fe6742234d573bacc26ed92b67"
+dependencies = [
+ "byteorder",
+]
+
+[[package]]
+name = "hash32"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47d60b12902ba28e2730cd37e95b8c9223af2808df9e902d4df49588d1470606"
+dependencies = [
+ "byteorder",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+dependencies = [
+ "ahash 0.7.8",
+]
+
 [[package]]
 name = "hashbrown"
 version = "0.14.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
 dependencies = [
- "ahash",
+ "ahash 0.8.12",
 ]
 
 [[package]]
@@ -2357,6 +3230,71 @@ dependencies = [
  "hashbrown 0.14.5",
 ]
 
+[[package]]
+name = "headers"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b3314d5adb5d94bcdf56771f2e50dbbc80bb4bdf88967526706205ac9eff24eb"
+dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "headers-core",
+ "http 1.5.0",
+ "httpdate",
+ "mime",
+ "sha1",
+]
+
+[[package]]
+name = "headers-core"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "54b4a22553d4242c49fddb9ba998a99962b5cc6f22cb5a3482bec22522403ce4"
+dependencies = [
+ "http 1.5.0",
+]
+
+[[package]]
+name = "heapless"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "634bd4d29cbf24424d0a4bfcbf80c6960129dc24424752a7d1d1390607023422"
+dependencies = [
+ "as-slice",
+ "generic-array 0.14.7",
+ "hash32 0.1.1",
+ "stable_deref_trait",
+]
+
+[[package]]
+name = "heapless"
+version = "0.7.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdc6457c0eb62c71aac4bc17216026d8410337c4126773b9c5daba343f17964f"
+dependencies = [
+ "atomic-polyfill",
+ "hash32 0.2.1",
+ "rustc_version",
+ "spin",
+ "stable_deref_trait",
+]
+
+[[package]]
+name = "heapless"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bfb9eb618601c89945a70e254898da93b13be0388091d42117462b265bb3fad"
+dependencies = [
+ "hash32 0.3.1",
+ "stable_deref_trait",
+]
+
+[[package]]
+name = "heck"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
+
 [[package]]
 name = "heck"
 version = "0.5.0"
@@ -2375,6 +3313,15 @@ version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
+[[package]]
+name = "hkdf"
+version = "0.12.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
+dependencies = [
+ "hmac 0.12.1",
+]
+
 [[package]]
 name = "hmac"
 version = "0.12.1"
@@ -2393,6 +3340,16 @@ dependencies = [
  "digest 0.11.3",
 ]
 
+[[package]]
+name = "html5ever"
+version = "0.39.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46a1761807faccc9a19e86944bbf40610014066306f96edcdedc2fb714bcb7b8"
+dependencies = [
+ "log",
+ "markup5ever",
+]
+
 [[package]]
 name = "http"
 version = "0.2.12"
@@ -2406,9 +3363,9 @@ dependencies = [
 
 [[package]]
 name = "http"
-version = "1.4.2"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6970f50e31d6fc17d3fa27329444bfa74e196cf62e95052a3f6fee181dba6425"
+checksum = "918d3568bebf352712bc2ef3d46a8bcf1a75b373be6539de198e9105cbbf9ce0"
 dependencies = [
  "bytes",
  "itoa",
@@ -2432,20 +3389,21 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ca2a8f2913ee65f60facd6a5905613afaa448497a0230cc41ce022d93290bc2c"
 dependencies = [
  "bytes",
- "http 1.4.2",
+ "http 1.5.0",
 ]
 
 [[package]]
 name = "http-body-util"
-version = "0.1.4"
+version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e9f41fd6a08e4d4ec69df65976da761afd5ad5e58a9d4acb46bd1c953a9e3ff2"
+checksum = "23169fe34a5fbcdd3f3862e78fb9b6fccd5f02a6dc6f732547005d45631ce71c"
 dependencies = [
  "bytes",
  "futures-core",
- "http 1.4.2",
+ "http 1.5.0",
  "http-body 1.1.0",
  "pin-project-lite",
+ "tokio",
 ]
 
 [[package]]
@@ -2460,27 +3418,33 @@ version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
+[[package]]
+name = "humantime"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15cdd26707701c53297e2fa6afb323d55fbc1d0810c3aec078ae3ef0424c3c15"
+
 [[package]]
 name = "hybrid-array"
-version = "0.4.13"
+version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "818356c5132c1fede50f837ca96afbe78ff42413047f4abb886217845e1b6c8c"
+checksum = "707114b52a152fa7bdb290cd7cd5912d9467273b6d74e21b8d81aca1f8533f6b"
 dependencies = [
  "typenum",
 ]
 
 [[package]]
 name = "hyper"
-version = "1.11.0"
+version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d22053281f852e11534f5198498373cbb59295120a20771d90f7ed1897490a72"
+checksum = "27b501faa50e7a26c3d3560ca625132f4078a17771f4810baf70475ae48cbe43"
 dependencies = [
  "atomic-waker",
  "bytes",
  "futures-channel",
  "futures-core",
  "h2",
- "http 1.4.2",
+ "http 1.5.0",
  "http-body 1.1.0",
  "httparse",
  "httpdate",
@@ -2497,7 +3461,7 @@ version = "0.27.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
 dependencies = [
- "http 1.4.2",
+ "http 1.5.0",
  "hyper",
  "hyper-util",
  "rustls",
@@ -2507,17 +3471,30 @@ dependencies = [
  "tower-service",
 ]
 
+[[package]]
+name = "hyper-timeout"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b90d566bffbce6a75bd8b09a05aa8c2cb1fabb6cb348f8840c9e4c90a0d83b0"
+dependencies = [
+ "hyper",
+ "hyper-util",
+ "pin-project-lite",
+ "tokio",
+ "tower-service",
+]
+
 [[package]]
 name = "hyper-util"
 version = "0.1.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "bytes",
  "futures-channel",
  "futures-util",
- "http 1.4.2",
+ "http 1.5.0",
  "http-body 1.1.0",
  "hyper",
  "ipnet",
@@ -2530,6 +3507,49 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "i_float"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "010025c2c532c8d82e42d0b8bb5184afa449fa6f06c709ea9adcb16c49ae405b"
+dependencies = [
+ "libm",
+]
+
+[[package]]
+name = "i_key_sort"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9190f86706ca38ac8add223b2aed8b1330002b5cdbbce28fb58b10914d38fc27"
+
+[[package]]
+name = "i_overlay"
+version = "4.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "413183068e6e0289e18d7d0a1f661b81546e6918d5453a44570b9ab30cbed1b3"
+dependencies = [
+ "i_float",
+ "i_key_sort",
+ "i_shape",
+ "i_tree",
+ "rayon",
+]
+
+[[package]]
+name = "i_shape"
+version = "1.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ea154b742f7d43dae2897fcd5ead86bc7b5eefcedd305a7ebf9f69d44d61082"
+dependencies = [
+ "i_float",
+]
+
+[[package]]
+name = "i_tree"
+version = "0.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35e6d558e6d4c7b82bc51d9c771e7a927862a161a7d87bf2b0541450e0e20915"
+
 [[package]]
 name = "iana-time-zone"
 version = "0.1.65"
@@ -2542,7 +3562,7 @@ dependencies = [
  "js-sys",
  "log",
  "wasm-bindgen",
- "windows-core",
+ "windows-core 0.62.2",
 ]
 
 [[package]]
@@ -2556,9 +3576,9 @@ dependencies = [
 
 [[package]]
 name = "icu_collections"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c"
+checksum = "fa68d21081c4a05d5a901a1c62add574c77048b6a1c67be3b50ce0b60d4ca513"
 dependencies = [
  "displaydoc",
  "potential_utf",
@@ -2570,9 +3590,9 @@ dependencies = [
 
 [[package]]
 name = "icu_locale_core"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
+checksum = "d56e28588da92eee5c3201a6eff33fabdd49b62269c8938d4ff050ce4d900deb"
 dependencies = [
  "displaydoc",
  "litemap",
@@ -2583,9 +3603,9 @@ dependencies = [
 
 [[package]]
 name = "icu_normalizer"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4"
+checksum = "12f9cf5f235641ed274641dd81c3f28d870e276763d0797aeeab72317b1c646f"
 dependencies = [
  "icu_collections",
  "icu_normalizer_data",
@@ -2597,16 +3617,17 @@ dependencies = [
 
 [[package]]
 name = "icu_normalizer_data"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"
+checksum = "1563da1ed3e0b3bf3d74c9b85917ac9c56464d2f57242270c09c9e752f8021a0"
 
 [[package]]
 name = "icu_properties"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de"
+checksum = "7e7ca276ad3145661a65914e6daf131ca5120cd3dcee8f8f3214b8875184a148"
 dependencies = [
+ "displaydoc",
  "icu_collections",
  "icu_locale_core",
  "icu_properties_data",
@@ -2617,15 +3638,15 @@ dependencies = [
 
 [[package]]
 name = "icu_properties_data"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14"
+checksum = "e590f038c1464a96894fd6d10127e90a8be4509f56ff7ecef851b15cee0b7caa"
 
 [[package]]
 name = "icu_provider"
-version = "2.2.0"
+version = "2.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
+checksum = "d27bbb9d3abbefac45d55f647c9de1d44aafcd1186eb91879afef17c396c3e73"
 dependencies = [
  "displaydoc",
  "icu_locale_core",
@@ -2659,19 +3680,21 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.14.0"
+version = "2.14.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
+checksum = "07aa2048142242915a31d35844fb311e0e53fcca590c3a0a40dcf1b841fa09eb"
 dependencies = [
  "equivalent",
  "hashbrown 0.17.1",
+ "serde",
+ "serde_core",
 ]
 
 [[package]]
 name = "inotify"
-version = "0.11.4"
+version = "0.11.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "153be1941a183ec9ccd095ddbe17a8b8d435ef6c76e9e02451b933c3999af2c8"
+checksum = "4cc00ea907cab49550b7da656f80ebb97be1b997d931fbcd28d39734e17ce592"
 dependencies = [
  "bitflags",
  "inotify-sys",
@@ -2694,14 +3717,47 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
 dependencies = [
  "block-padding",
- "generic-array",
+ "generic-array 0.14.7",
 ]
 
+[[package]]
+name = "integer-encoding"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "14c00403deb17c3221a1fe4fb571b9ed0370b3dcd116553c77fa294a3d918699"
+
 [[package]]
 name = "ipnet"
-version = "2.12.0"
+version = "2.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a756c3fac73139e83f14c2d742155dd2b78d3ee56597b419a0579b7bdd6dd78"
+
+[[package]]
+name = "itertools"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1c173a5686ce8bfa551b3563d0c2170bf24ca44da99c7ca4bfdab5418c3fe57"
+dependencies = [
+ "either",
+]
+
+[[package]]
+name = "itertools"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "413ee7dfc52ee1a4949ceeb7dbc8a33f2d6c088194d9f922fb8318faf1f01186"
+dependencies = [
+ "either",
+]
+
+[[package]]
+name = "itertools"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
+checksum = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285"
+dependencies = [
+ "either",
+]
 
 [[package]]
 name = "itoa"
@@ -2726,10 +3782,40 @@ dependencies = [
 ]
 
 [[package]]
-name = "jni-sys"
-version = "0.3.1"
+name = "jni"
+version = "0.22.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41a652e1f9b6e0275df1f15b32661cf0d4b78d4d87ddec5e0c3c20f097433258"
+checksum = "5efd9a482cf3a427f00d6b35f14332adc7902ce91efb778580e180ff90fa3498"
+dependencies = [
+ "cfg-if",
+ "combine",
+ "jni-macros",
+ "jni-sys 0.4.1",
+ "log",
+ "simd_cesu8",
+ "thiserror 2.0.20",
+ "walkdir",
+ "windows-link 0.2.1",
+]
+
+[[package]]
+name = "jni-macros"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a00109accc170f0bdb141fed3e393c565b6f5e072365c3bd58f5b062591560a3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "rustc_version",
+ "simd_cesu8",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "jni-sys"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41a652e1f9b6e0275df1f15b32661cf0d4b78d4d87ddec5e0c3c20f097433258"
 dependencies = [
  "jni-sys 0.4.1",
 ]
@@ -2765,20 +3851,45 @@ dependencies = [
 
 [[package]]
 name = "js-sys"
-version = "0.3.103"
+version = "0.3.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53b44bfcdb3f8d5837a46dae1ca9660a837176eee74a28b229bc626816589102"
+checksum = "0e0c1080212aad755ea003d18543e8768dd432c48819efd73a7bf1e39b7a5a3a"
 dependencies = [
  "cfg-if",
  "futures-util",
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "jsonwebtoken"
+version = "10.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eba32bfb4ffdeaca3e34431072faf01745c9b26d25504aa7a6cf5684334fc4fc"
+dependencies = [
+ "aws-lc-rs",
+ "base64 0.22.1",
+ "ed25519-dalek",
+ "getrandom 0.2.17",
+ "hmac 0.12.1",
+ "js-sys",
+ "p256",
+ "p384",
+ "pem",
+ "rand 0.8.8",
+ "rsa",
+ "serde",
+ "serde_json",
+ "sha2 0.10.9",
+ "signature",
+ "simple_asn1",
+ "zeroize",
+]
+
 [[package]]
 name = "kqueue"
-version = "1.2.0"
+version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "273c0752728918e0ac4976f2b275b6fefb9ecd400585dec929419f3844cd87b5"
+checksum = "8d763e5b24120b4ddf50de6c92308156765aabfbbccebf401da7cff2d70a41ea"
 dependencies = [
  "kqueue-sys",
  "libc",
@@ -2799,12 +3910,34 @@ name = "lazy_static"
 version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+dependencies = [
+ "spin",
+]
+
+[[package]]
+name = "lexicmp"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e8f89da8fd95c4eb6274e914694bea90c7826523b26f2a2fd863d44b9d42c43"
+dependencies = [
+ "deunicode",
+]
 
 [[package]]
 name = "libc"
-version = "0.2.186"
+version = "0.2.189"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
+
+[[package]]
+name = "libloading"
+version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
+checksum = "d7c4b02199fee7c5d21a5ae7d8cfa79a6ef5bb2fc834d6e9058e89c825efdc55"
+dependencies = [
+ "cfg-if",
+ "windows-link 0.2.1",
+]
 
 [[package]]
 name = "libm"
@@ -2823,9 +3956,9 @@ dependencies = [
 
 [[package]]
 name = "libredox"
-version = "0.1.18"
+version = "0.1.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c943259e342f1e06ff2da7a83eabdfe7f92ce10262688dbf1895ff0b3e6e4652"
+checksum = "d7955dfc218a8afb29dfeffd540e3a6e96baeb94fe7138228dd7cc6937fbbf96"
 dependencies = [
  "libc",
 ]
@@ -2841,6 +3974,17 @@ dependencies = [
  "vcpkg",
 ]
 
+[[package]]
+name = "libz-sys"
+version = "1.1.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85bc9657773828b90eeb625adff10eeac83cc21bbfd8e23a03eaa8a33c9e28d9"
+dependencies = [
+ "cc",
+ "pkg-config",
+ "vcpkg",
+]
+
 [[package]]
 name = "linux-raw-sys"
 version = "0.4.15"
@@ -2855,9 +3999,9 @@ checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
 
 [[package]]
 name = "litemap"
-version = "0.8.2"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
+checksum = "47d9d19d1d6efa0109d2f65ff4c85cddd50bd572e5a00127ab10987290bcefae"
 
 [[package]]
 name = "litrs"
@@ -2876,9 +4020,54 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.33"
+version = "0.4.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
+checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
+
+[[package]]
+name = "lz4"
+version = "1.28.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a20b523e860d03443e98350ceaac5e71c6ba89aea7d960769ec3ce37f4de5af4"
+dependencies = [
+ "lz4-sys",
+]
+
+[[package]]
+name = "lz4-sys"
+version = "1.11.1+lz4-1.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6bd8c0d6c6ed0cd30b3652886bb8711dc4bb01d637a68105a3d5158039b418e6"
+dependencies = [
+ "cc",
+ "libc",
+]
+
+[[package]]
+name = "lz4_flex"
+version = "0.12.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90071f8077f8e40adfc4b7fe9cd495ce316263f19e75c2211eeff3fdf475a3d9"
+dependencies = [
+ "twox-hash",
+]
+
+[[package]]
+name = "maplit"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e2e65a1a2e43cfcb47a895c4c8b10d1f4a61097f9f254f183aee60cad9c651d"
+
+[[package]]
+name = "markup5ever"
+version = "0.39.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7122d987ec5f704ee56f6e5b41a7d93722e9aae27ae07cafa4036c4d3f9757de"
+dependencies = [
+ "log",
+ "tendril",
+ "web_atoms",
+]
 
 [[package]]
 name = "matchit"
@@ -2886,6 +4075,16 @@ version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
 
+[[package]]
+name = "matrixmultiply"
+version = "0.3.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f607c237553f086e7043417a51df26b2eb899d3caff94e6a67592ff992fedc7"
+dependencies = [
+ "autocfg",
+ "rawpointer",
+]
+
 [[package]]
 name = "md-5"
 version = "0.10.6"
@@ -2943,11 +4142,17 @@ version = "0.3.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
 
+[[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
 [[package]]
 name = "miniz_oxide"
-version = "0.8.9"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
+checksum = "b63fbc4a50860e98e7b2aa7804ded1db5cbc3aff9193adaff57a6931bf7c4b4c"
 dependencies = [
  "adler2",
  "simd-adler32",
@@ -2965,6 +4170,42 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "ndarray"
+version = "0.17.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "520080814a7a6b4a6e9070823bb24b4531daac8c4627e08ba5de8c5ef2f2752d"
+dependencies = [
+ "matrixmultiply",
+ "num-complex",
+ "num-integer",
+ "num-traits",
+ "portable-atomic",
+ "portable-atomic-util",
+ "rawpointer",
+]
+
+[[package]]
+name = "ndarray-stats"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b6e54a8b65764f71827a90ca1d56965ec0c67f069f996477bd493402a901d1f"
+dependencies = [
+ "indexmap",
+ "itertools 0.13.0",
+ "ndarray",
+ "noisy_float",
+ "num-integer",
+ "num-traits",
+ "rand 0.8.8",
+]
+
+[[package]]
+name = "new_debug_unreachable"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086"
+
 [[package]]
 name = "nix"
 version = "0.31.3"
@@ -2977,6 +4218,25 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "noisy_float"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c16843be85dd410c6a12251c4eca0dd1d3ee8c5725f746c4d5e0fdcec0a864b2"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "nom"
+version = "7.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
 [[package]]
 name = "notify"
 version = "8.2.0"
@@ -3004,6 +4264,41 @@ dependencies = [
  "bitflags",
 ]
 
+[[package]]
+name = "ntapi"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3b335231dfd352ffb0f8017f3b6027a4917f7df785ea2143d8af2adc66980ae"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "num-bigint"
+version = "0.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c89e69e7e0f03bea5ef08013795c25018e101932225a656383bd384495ecc367"
+dependencies = [
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-bigint-dig"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e661dda6640fad38e827a6d4a310ff4763082116fe217f279885c97f511bb0b7"
+dependencies = [
+ "lazy_static",
+ "libm",
+ "num-integer",
+ "num-iter",
+ "num-traits",
+ "rand 0.8.8",
+ "smallvec",
+ "zeroize",
+]
+
 [[package]]
 name = "num-complex"
 version = "0.4.6"
@@ -3022,10 +4317,20 @@ checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
 
 [[package]]
 name = "num-integer"
+version = "0.1.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ce2d95d4b3734dc35aa2f45e1aa22cd416814592a4f9d9205e11affd5b8e10b"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-iter"
 version = "0.1.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
+checksum = "c92800bd69a1eac91786bcfe9da64a897eb72911b8dc3095decbd07429e8048b"
 dependencies = [
+ "num-integer",
  "num-traits",
 ]
 
@@ -3082,6 +4387,16 @@ version = "4.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ef25abbcd74fb2609453eb695bd2f860d389e457f67dc17cafc8b8cbc89d0c33"
 
+[[package]]
+name = "objc2-io-kit"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33fafba39597d6dc1fb709123dfa8289d39406734be322956a69f0931c73bb15"
+dependencies = [
+ "libc",
+ "objc2-core-foundation",
+]
+
 [[package]]
 name = "objc2-system-configuration"
 version = "0.3.2"
@@ -3091,6 +4406,32 @@ dependencies = [
  "objc2-core-foundation",
 ]
 
+[[package]]
+name = "object_store"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "622acbc9100d3c10e2ee15804b0caa40e55c933d5aa53814cd520805b7958a49"
+dependencies = [
+ "async-trait",
+ "bytes",
+ "chrono",
+ "futures-channel",
+ "futures-core",
+ "futures-util",
+ "http 1.5.0",
+ "humantime",
+ "itertools 0.14.0",
+ "parking_lot",
+ "percent-encoding",
+ "thiserror 2.0.20",
+ "tokio",
+ "tracing",
+ "url",
+ "walkdir",
+ "wasm-bindgen-futures",
+ "web-time",
+]
+
 [[package]]
 name = "once_cell"
 version = "1.21.4"
@@ -3132,7 +4473,7 @@ dependencies = [
  "sha2 0.10.9",
  "subtle",
  "tempfile",
- "thiserror 2.0.19",
+ "thiserror 2.0.20",
  "toml 0.9.12+spec-1.1.0",
  "tracing",
  "unicode-normalization",
@@ -3152,6 +4493,34 @@ dependencies = [
  "sha2 0.10.9",
 ]
 
+[[package]]
+name = "p384"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe42f1670a52a47d448f14b6a5c61dd78fce51856e68edaa38f7ae3a46b8d6b6"
+dependencies = [
+ "ecdsa",
+ "elliptic-curve",
+ "primeorder",
+ "sha2 0.10.9",
+]
+
+[[package]]
+name = "papaya"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da2442474a9404698c42509b8967f437249dbc7b50493e83020333d3943ec0ae"
+dependencies = [
+ "equivalent",
+ "seize",
+]
+
+[[package]]
+name = "parking"
+version = "2.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f38d5652c16fde515bb1ecef450ab0f6a219d619a7274976324d5e377f7dceba"
+
 [[package]]
 name = "parking_lot"
 version = "0.12.5"
@@ -3172,7 +4541,18 @@ dependencies = [
  "libc",
  "redox_syscall",
  "smallvec",
- "windows-link",
+ "windows-link 0.2.1",
+]
+
+[[package]]
+name = "password-hash"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "346f04948ba92c43e8469c1ee6736c7563d71012b17d40745260fe106aac2166"
+dependencies = [
+ "base64ct",
+ "rand_core 0.6.4",
+ "subtle",
 ]
 
 [[package]]
@@ -3187,6 +4567,40 @@ version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2ee67f1008b1ba2321834326597b8e186293b049a023cdef258527550b9935b4"
 
+[[package]]
+name = "path-clean"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "17359afc20d7ab31fdb42bb844c8b3bb1dabd7dcf7e68428492da7f16966fcef"
+
+[[package]]
+name = "pbkdf2"
+version = "0.12.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8ed6a7761f76e3b9f92dfb0a60a6a6477c61024b775147ff0973a02653abaf2"
+dependencies = [
+ "digest 0.10.7",
+ "hmac 0.12.1",
+ "password-hash",
+ "sha2 0.10.9",
+]
+
+[[package]]
+name = "pdqselect"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ec91767ecc0a0bbe558ce8c9da33c068066c57ecc8bb8477ef8c1ad3ef77c27"
+
+[[package]]
+name = "pem"
+version = "3.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d30c53c26bc5b31a98cd02d20f25a7c8567146caf63ed593a9d87b2775291be"
+dependencies = [
+ "base64 0.22.1",
+ "serde_core",
+]
+
 [[package]]
 name = "pem-rfc7468"
 version = "0.7.0"
@@ -3208,31 +4622,98 @@ version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c1562dc717473dbaa4c1f85a36410e03c047b2e7df7f45ee938fbef64ae7fadf"
 dependencies = [
+ "phf_macros",
  "phf_shared",
  "serde",
 ]
 
 [[package]]
-name = "phf_shared"
+name = "phf_codegen"
 version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e57fef6bc5981e38c2ce2d63bfa546861309f875b8a75f092d1d54ae2d64f266"
+checksum = "49aa7f9d80421bca176ca8dbfebe668cc7a2684708594ec9f3c0db0805d5d6e1"
 dependencies = [
- "siphasher",
+ "phf_generator",
+ "phf_shared",
 ]
 
 [[package]]
-name = "pin-project-lite"
-version = "0.2.17"
+name = "phf_generator"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
-
-[[package]]
-name = "pin-utils"
+checksum = "135ace3a761e564ec88c03a77317a7c6b80bb7f7135ef2544dbe054243b89737"
+dependencies = [
+ "fastrand",
+ "phf_shared",
+]
+
+[[package]]
+name = "phf_macros"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "812f032b54b1e759ccd5f8b6677695d5268c588701effba24601f6932f8269ef"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "unicase",
+]
+
+[[package]]
+name = "phf_shared"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e57fef6bc5981e38c2ce2d63bfa546861309f875b8a75f092d1d54ae2d64f266"
+dependencies = [
+ "siphasher",
+ "unicase",
+]
+
+[[package]]
+name = "pin-project"
+version = "1.1.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2466b2336ed02bcdca6b294417127b90ec92038d1d5c4fbeac971a922e0e0924"
+dependencies = [
+ "pin-project-internal",
+]
+
+[[package]]
+name = "pin-project-internal"
+version = "1.1.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c96395f0a926bc13b1c17622aaddda1ecb55d49c8f1bf9777e4d877800a43f8b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+
+[[package]]
+name = "pin-utils"
 version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
 
+[[package]]
+name = "pkcs1"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f"
+dependencies = [
+ "der",
+ "pkcs8",
+ "spki",
+]
+
 [[package]]
 name = "pkcs8"
 version = "0.10.2"
@@ -3245,9 +4726,24 @@ dependencies = [
 
 [[package]]
 name = "pkg-config"
-version = "0.3.33"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548"
+
+[[package]]
+name = "portable-atomic"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05c8b63e8d9609db387f0324918f81d68fe27748f084ef092fb35954d0539a85"
+
+[[package]]
+name = "portable-atomic-util"
+version = "0.2.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
+checksum = "c2a106d1259c23fac8e543272398ae0e3c0b8d33c88ed73d0cc71b0f1d902618"
+dependencies = [
+ "portable-atomic",
+]
 
 [[package]]
 name = "postgres-protocol"
@@ -3255,7 +4751,7 @@ version = "0.6.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "08808e3c483c46e999108051c78334f473d5adb59d78bb80a1268c7e6aa6c514"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "byteorder",
  "bytes",
  "fallible-iterator 0.2.0",
@@ -3281,9 +4777,9 @@ dependencies = [
 
 [[package]]
 name = "potential_utf"
-version = "0.1.5"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564"
+checksum = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661"
 dependencies = [
  "zerovec",
 ]
@@ -3303,6 +4799,12 @@ dependencies = [
  "zerocopy",
 ]
 
+[[package]]
+name = "precomputed-hash"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c"
+
 [[package]]
 name = "primal-check"
 version = "0.3.4"
@@ -3321,6 +4823,15 @@ dependencies = [
  "elliptic-curve",
 ]
 
+[[package]]
+name = "proc-macro-crate"
+version = "3.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f"
+dependencies = [
+ "toml_edit",
+]
+
 [[package]]
 name = "proc-macro2"
 version = "1.0.107"
@@ -3357,6 +4868,38 @@ dependencies = [
  "rusqlite",
 ]
 
+[[package]]
+name = "prost"
+version = "0.14.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "528ac67416ff8646872a3c02cad9cc4ee5dc9f9540c9b10771855c95cb2e5ae1"
+dependencies = [
+ "bytes",
+ "prost-derive",
+]
+
+[[package]]
+name = "prost-derive"
+version = "0.14.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b570b25f7617e43d59005d0990ccb79e950a423952cea19671b7a876da390adf"
+dependencies = [
+ "anyhow",
+ "itertools 0.14.0",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "prost-types"
+version = "0.14.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f94967dc7688f3054c7fac87473ffae4cc4c3904800e2d9f5b857246d8963b0a"
+dependencies = [
+ "prost",
+]
+
 [[package]]
 name = "protobuf"
 version = "3.7.2"
@@ -3377,6 +4920,32 @@ dependencies = [
  "thiserror 1.0.69",
 ]
 
+[[package]]
+name = "psl-types"
+version = "2.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33cb294fe86a74cbcf50d4445b37da762029549ebeea341421c7c70370f86cac"
+
+[[package]]
+name = "ptr_meta"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0738ccf7ea06b608c10564b31debd4f5bc5e197fc8bfe088f68ae5ce81e7a4f1"
+dependencies = [
+ "ptr_meta_derive",
+]
+
+[[package]]
+name = "ptr_meta_derive"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "16b845dbfca988fa33db069c0e230574d15a3088f147a87b64c7589eb662c9ac"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
 [[package]]
 name = "pulp"
 version = "0.22.3"
@@ -3409,6 +4978,18 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "quick_cache"
+version = "0.6.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9c6658afe513a3b484e3abfdaa0d03ef3c0bbf017542c178dd55f94eb3051f9"
+dependencies = [
+ "ahash 0.8.12",
+ "equivalent",
+ "hashbrown 0.16.1",
+ "parking_lot",
+]
+
 [[package]]
 name = "quote"
 version = "1.0.47"
@@ -3430,11 +5011,17 @@ version = "6.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
 
+[[package]]
+name = "radium"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc33ff2d4973d518d823d61aa239014831e521c75da58e3df4840d3f47749d09"
+
 [[package]]
 name = "rand"
-version = "0.8.7"
+version = "0.8.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22f6172bdec972074665ed81ed53b71da00bfc44b65a753cfde883ec4c702a1a"
+checksum = "e058c7de0b26af77780c769414d6257830bb240f3c38477dbc2c16e5f54d6d4c"
 dependencies = [
  "libc",
  "rand_chacha 0.3.1",
@@ -3525,6 +5112,12 @@ dependencies = [
  "bitflags",
 ]
 
+[[package]]
+name = "rawpointer"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "60a357793950651c4ed0f3f52338f53b2f809f32d83a07f72909fa13e4c6c1e3"
+
 [[package]]
 name = "rayon"
 version = "1.12.0"
@@ -3554,6 +5147,12 @@ dependencies = [
  "rustfft",
 ]
 
+[[package]]
+name = "reblessive"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbc4a4ea2a66a41a1152c4b3d86e8954dc087bdf33af35446e6e176db4e73c8c"
+
 [[package]]
 name = "reborrow"
 version = "0.5.5"
@@ -3580,22 +5179,22 @@ dependencies = [
 
 [[package]]
 name = "ref-cast"
-version = "1.0.26"
+version = "1.0.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "216e8f773d7923bcba9ceb86a86c93cabb3903a11872fc3f138c49630e50b96d"
+checksum = "7e440fb4e4b4147295338efb76001ab9e4efc0e5839df2c47fc5ac2381d365c3"
 dependencies = [
  "ref-cast-impl",
 ]
 
 [[package]]
 name = "ref-cast-impl"
-version = "1.0.26"
+version = "1.0.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c9283685feec7d69af75fb0e858d5e7378f33fe4fc699383b2916ab9273e03c"
+checksum = "92ecd8964f8453721699a1ed72037b0db49ce2f5a5138486ee89bed6f67cdf3a"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.2",
+ "syn 3.0.4",
 ]
 
 [[package]]
@@ -3612,9 +5211,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.16"
+version = "0.4.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fcfdb36bda0c880c5931cdc7a2bcdc8ba4556847b9d912bca70bc94708711ad"
+checksum = "ad8553b9b26413251cbf30e620595c7a41b3887f03da04579c0e6b0d6a06b4b2"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -3633,6 +5232,42 @@ version = "0.8.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
 
+[[package]]
+name = "rend"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "71fe3824f5629716b1589be05dacd749f6aa084c87e00e016714a8cdfccc997c"
+dependencies = [
+ "bytecheck",
+]
+
+[[package]]
+name = "revision"
+version = "0.30.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13b48b66c1cd4bf814516ea48f727d4b3697e3fa8841be99a7d9cbb8c9ac1666"
+dependencies = [
+ "bytes",
+ "chrono",
+ "geo",
+ "regex",
+ "revision-derive",
+ "roaring",
+ "rust_decimal",
+ "uuid",
+]
+
+[[package]]
+name = "revision-derive"
+version = "0.30.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d266d798eaaa2921e14188dfe998bb7cc0528ec26e894b4be0e35fe2b19c89d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "rfc6979"
 version = "0.4.0"
@@ -3653,23 +5288,54 @@ dependencies = [
  "cfg-if",
  "getrandom 0.2.17",
  "libc",
- "untrusted",
+ "untrusted 0.9.0",
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "rkyv"
+version = "0.7.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2297bf9c81a3f0dc96bc9521370b88f054168c29826a75e89c55ff196e7ed6a1"
+dependencies = [
+ "bitvec",
+ "bytecheck",
+ "bytes",
+ "hashbrown 0.12.3",
+ "ptr_meta",
+ "rend",
+ "rkyv_derive",
+ "seahash",
+ "tinyvec",
+ "uuid",
+]
+
+[[package]]
+name = "rkyv_derive"
+version = "0.7.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "84d7b42d4b8d06048d3ac8db0eb31bcb942cbeb709f0b5f2b2ebde398d3038f5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
 [[package]]
 name = "rmcp"
-version = "2.2.0"
+version = "3.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "14db48ee17a9ba61810ab1a9c1beb7d06d8136ae39ac25a1137f10d357af01af"
+checksum = "1a15bc53261a9dc37e105df006e4656c598379a8f9581f8950debb130f27a7cf"
 dependencies = [
  "async-trait",
+ "base64 0.23.1",
  "bytes",
  "chrono",
  "futures",
- "http 1.4.2",
+ "http 1.5.0",
  "http-body 1.1.0",
  "http-body-util",
+ "indexmap",
  "pastey",
  "pin-project-lite",
  "rand 0.10.2",
@@ -3677,7 +5343,7 @@ dependencies = [
  "serde",
  "serde_json",
  "sse-stream",
- "thiserror 2.0.19",
+ "thiserror 2.0.20",
  "tokio",
  "tokio-stream",
  "tokio-util",
@@ -3705,6 +5371,23 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "roaring"
+version = "0.11.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "18bd8a37d17a58532776dcdf6041ce64929adca78e8489d5cacbafe99229d3e1"
+dependencies = [
+ "bytemuck",
+ "byteorder",
+ "serde",
+]
+
+[[package]]
+name = "robust"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e27ee8bb91ca0adcf0ecb116293afa12d393f9c2b9b9cd54d33e8078fe19839"
+
 [[package]]
 name = "roxmltree"
 version = "0.21.1"
@@ -3715,91 +5398,217 @@ dependencies = [
 ]
 
 [[package]]
-name = "rubato"
-version = "0.16.2"
+name = "rsa"
+version = "0.9.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5258099699851cfd0082aeb645feb9c084d9a5e1f1b8d5372086b989fc5e56a1"
+checksum = "b8573f03f5883dcaebdfcf4725caa1ecb9c15b2ef50c43a07b816e06799bb12d"
 dependencies = [
- "num-complex",
+ "const-oid 0.9.6",
+ "digest 0.10.7",
+ "num-bigint-dig",
  "num-integer",
  "num-traits",
- "realfft",
+ "pkcs1",
+ "pkcs8",
+ "rand_core 0.6.4",
+ "signature",
+ "spki",
+ "subtle",
+ "zeroize",
 ]
 
 [[package]]
-name = "rusqlite"
-version = "0.31.0"
+name = "rstar"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b838eba278d213a8beaf485bd313fd580ca4505a00d5871caeb1457c55322cae"
+checksum = "3a45c0e8804d37e4d97e55c6f258bc9ad9c5ee7b07437009dd152d764949a27c"
 dependencies = [
- "bitflags",
- "fallible-iterator 0.3.0",
- "fallible-streaming-iterator",
- "hashlink",
- "libsqlite3-sys",
+ "heapless 0.6.1",
+ "num-traits",
+ "pdqselect",
+ "serde",
  "smallvec",
 ]
 
 [[package]]
-name = "rustc-hash"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
-
-[[package]]
-name = "rustc_version"
-version = "0.4.1"
+name = "rstar"
+version = "0.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
+checksum = "b40f1bfe5acdab44bc63e6699c28b74f75ec43afb59f3eda01e145aff86a25fa"
 dependencies = [
- "semver",
+ "heapless 0.7.17",
+ "num-traits",
+ "serde",
+ "smallvec",
 ]
 
 [[package]]
-name = "rustfft"
-version = "6.4.1"
+name = "rstar"
+version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21db5f9893e91f41798c88680037dba611ca6674703c1a18601b01a72c8adb89"
+checksum = "1f39465655a1e3d8ae79c6d9e007f4953bfc5d55297602df9dc38f9ae9f1359a"
 dependencies = [
- "num-complex",
- "num-integer",
+ "heapless 0.7.17",
  "num-traits",
- "primal-check",
- "strength_reduce",
- "transpose",
+ "serde",
+ "smallvec",
 ]
 
 [[package]]
-name = "rustix"
-version = "0.38.44"
+name = "rstar"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fdb5bc1ae2baa591800df16c9ca78619bf65c0488b41b96ccec5d11220d8c154"
+checksum = "73111312eb7a2287d229f06c00ff35b51ddee180f017ab6dec1f69d62ac098d6"
 dependencies = [
- "bitflags",
- "errno",
- "libc",
- "linux-raw-sys 0.4.15",
- "windows-sys 0.52.0",
+ "heapless 0.7.17",
+ "num-traits",
+ "serde",
+ "smallvec",
 ]
 
 [[package]]
-name = "rustix"
-version = "1.1.4"
+name = "rstar"
+version = "0.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
+checksum = "421400d13ccfd26dfa5858199c30a5d76f9c54e0dba7575273025b43c5175dbb"
 dependencies = [
- "bitflags",
- "errno",
- "libc",
- "linux-raw-sys 0.12.1",
- "windows-sys 0.61.2",
+ "heapless 0.8.0",
+ "num-traits",
+ "serde",
+ "smallvec",
 ]
 
 [[package]]
-name = "rustls"
-version = "0.23.42"
+name = "rstar"
+version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c54fcab019b409d04215d3a17cb438fd7fbf192ee61461f20f4fe18704bc138"
+checksum = "5912b862fa5ffb462607bfd1e35036c458c537921f508c8235a83d5f3987edfe"
+dependencies = [
+ "heapless 0.8.0",
+ "num-traits",
+ "serde",
+ "smallvec",
+]
+
+[[package]]
+name = "rubato"
+version = "0.16.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5258099699851cfd0082aeb645feb9c084d9a5e1f1b8d5372086b989fc5e56a1"
+dependencies = [
+ "num-complex",
+ "num-integer",
+ "num-traits",
+ "realfft",
+]
+
+[[package]]
+name = "rusqlite"
+version = "0.31.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b838eba278d213a8beaf485bd313fd580ca4505a00d5871caeb1457c55322cae"
+dependencies = [
+ "bitflags",
+ "fallible-iterator 0.3.0",
+ "fallible-streaming-iterator",
+ "hashlink",
+ "libsqlite3-sys",
+ "smallvec",
+]
+
+[[package]]
+name = "rust-stemmers"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e46a2036019fdb888131db7a4c847a1063a7493f971ed94ea82c67eada63ca54"
+dependencies = [
+ "serde",
+ "serde_derive",
+]
+
+[[package]]
+name = "rust_decimal"
+version = "1.42.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be2a24f50780bc85f09cc6ac299bdf1424302742d77221106859c9d8b102126a"
+dependencies = [
+ "arrayvec",
+ "borsh",
+ "bytes",
+ "num-traits",
+ "rand 0.8.8",
+ "rkyv",
+ "serde",
+ "serde_json",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "rustc-hash"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
+
+[[package]]
+name = "rustc-hash"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"
+
+[[package]]
+name = "rustc_version"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "rustfft"
+version = "6.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "21db5f9893e91f41798c88680037dba611ca6674703c1a18601b01a72c8adb89"
+dependencies = [
+ "num-complex",
+ "num-integer",
+ "num-traits",
+ "primal-check",
+ "strength_reduce",
+ "transpose",
+]
+
+[[package]]
+name = "rustix"
+version = "0.38.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fdb5bc1ae2baa591800df16c9ca78619bf65c0488b41b96ccec5d11220d8c154"
+dependencies = [
+ "bitflags",
+ "errno",
+ "libc",
+ "linux-raw-sys 0.4.15",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "rustix"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
+dependencies = [
+ "bitflags",
+ "errno",
+ "libc",
+ "linux-raw-sys 0.12.1",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustls"
+version = "0.23.43"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06"
 dependencies = [
  "log",
  "once_cell",
@@ -3824,10 +5633,11 @@ dependencies = [
 
 [[package]]
 name = "rustls-pki-types"
-version = "1.15.0"
+version = "1.15.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "764899a24af3980067ee14bc143654f297b22eaebfe3c7b6b211920a5a59b046"
+checksum = "2f4925028c7eb5d1fcdaf196971378ed9d2c1c4efc7dc5d011256f76c99c0a96"
 dependencies = [
+ "web-time",
  "zeroize",
 ]
 
@@ -3839,7 +5649,28 @@ checksum = "1d99feebc72bae7ab76ba994bb5e121b8d83d910ca40b36e0921f53becc41784"
 dependencies = [
  "core-foundation",
  "core-foundation-sys",
- "jni",
+ "jni 0.21.1",
+ "log",
+ "once_cell",
+ "rustls",
+ "rustls-native-certs",
+ "rustls-platform-verifier-android",
+ "rustls-webpki",
+ "security-framework",
+ "security-framework-sys",
+ "webpki-root-certs",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustls-platform-verifier"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26d1e2536ce4f35f4846aa13bff16bd0ff40157cdb14cc056c7b14ba41233ba0"
+dependencies = [
+ "core-foundation",
+ "core-foundation-sys",
+ "jni 0.22.4",
  "log",
  "once_cell",
  "rustls",
@@ -3860,13 +5691,13 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.13"
+version = "0.103.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
+checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
 dependencies = [
  "ring",
  "rustls-pki-types",
- "untrusted",
+ "untrusted 0.9.0",
 ]
 
 [[package]]
@@ -3892,6 +5723,15 @@ dependencies = [
  "serde_json",
 ]
 
+[[package]]
+name = "salsa20"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97a22f5af31f73a954c10289c93e8a50cc23d971e80ee446f1f6f7137a088213"
+dependencies = [
+ "cipher",
+]
+
 [[package]]
 name = "same-file"
 version = "1.0.6"
@@ -3912,9 +5752,9 @@ dependencies = [
 
 [[package]]
 name = "schemars"
-version = "1.2.1"
+version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2b42f36aa1cd011945615b92222f6bf73c599a102a300334cd7f8dbeec726cc"
+checksum = "687274d293b6cdc6e73e0fee520bf2049650090d7164f87672d212a3c530cf4a"
 dependencies = [
  "chrono",
  "dyn-clone",
@@ -3926,14 +5766,14 @@ dependencies = [
 
 [[package]]
 name = "schemars_derive"
-version = "1.2.1"
+version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d115b50f4aaeea07e79c1912f645c7513d81715d0420f8bc77a18c6260b307f"
+checksum = "d98c67716b46af2f0b8cf752abc930f6f9aecfbf671ecfb531db8a31dbe4e2ba"
 dependencies = [
  "proc-macro2",
  "quote",
  "serde_derive_internals",
- "syn 2.0.119",
+ "syn 3.0.4",
 ]
 
 [[package]]
@@ -3951,6 +5791,24 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
+[[package]]
+name = "scrypt"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0516a385866c09368f0b5bcd1caff3366aace790fcd46e2bb032697bb172fd1f"
+dependencies = [
+ "password-hash",
+ "pbkdf2",
+ "salsa20",
+ "sha2 0.10.9",
+]
+
+[[package]]
+name = "seahash"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c107b6f4780854c8b126e228ea8869f4d7b71260f962fefb57b996b8959ba6b"
+
 [[package]]
 name = "sec1"
 version = "0.7.3"
@@ -3959,7 +5817,7 @@ checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
 dependencies = [
  "base16ct",
  "der",
- "generic-array",
+ "generic-array 0.14.7",
  "pkcs8",
  "subtle",
  "zeroize",
@@ -3988,6 +5846,16 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "seize"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b55fb86dfd3a2f5f76ea78310a88f96c4ea21a3031f8d212443d56123fd0521"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "self-replace"
 version = "1.5.0"
@@ -4004,6 +5872,10 @@ name = "semver"
 version = "1.0.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
+dependencies = [
+ "serde",
+ "serde_core",
+]
 
 [[package]]
 name = "seq-macro"
@@ -4048,25 +5920,25 @@ checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.2",
+ "syn 3.0.4",
 ]
 
 [[package]]
 name = "serde_derive_internals"
-version = "0.29.1"
+version = "0.30.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18d26a20a969b9e3fdf2fc2d9f21eda6c40e2de84c9408bb5d3b05d499aae711"
+checksum = "f852137cce035d6a4df67ccce505ff6b3e9fd3a10e3e52b24dc71e650bb1a9bd"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.4",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.150"
+version = "1.0.151"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9"
+checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
 dependencies = [
  "indexmap",
  "itoa",
@@ -4160,7 +6032,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
 dependencies = [
  "cfg-if",
- "cpufeatures 0.3.0",
+ "cpufeatures 0.3.1",
  "digest 0.11.3",
 ]
 
@@ -4173,12 +6045,24 @@ dependencies = [
  "cc",
 ]
 
+[[package]]
+name = "shlex"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+
 [[package]]
 name = "shlex"
 version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
 
+[[package]]
+name = "sif-itree"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7f45b8998ced5134fb1d75732c77842a3e888f19c1ff98481822e8fbfbf930b"
+
 [[package]]
 name = "signal-hook-registry"
 version = "1.4.8"
@@ -4205,6 +6089,34 @@ version = "0.3.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3a219298ac11a56ea9a6d2120044824d6f01aeb034955e7af7bc16858527deea"
 
+[[package]]
+name = "simd_cesu8"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11031e251abf8611c80f460e19dbdeb54a66db918e49c65a7065b46ac7aec520"
+dependencies = [
+ "rustc_version",
+ "simdutf8",
+]
+
+[[package]]
+name = "simdutf8"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
+
+[[package]]
+name = "simple_asn1"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d585997b0ac10be3c5ee635f1bab02d512760d14b7c468801ac8a01d9ae5f1d"
+dependencies = [
+ "num-bigint",
+ "num-traits",
+ "thiserror 2.0.20",
+ "time",
+]
+
 [[package]]
 name = "siphasher"
 version = "1.0.3"
@@ -4222,6 +6134,15 @@ name = "smallvec"
 version = "1.15.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "snap"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "199905e6153d6405f9728fe44daace35f8f837bbf830bb6e85fbd5828709a886"
 
 [[package]]
 name = "socket2"
@@ -4244,6 +6165,27 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "spade"
+version = "2.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9699399fd9349b00b184f5635b074f9ec93afffef30c853f8c875b32c0f8c7fa"
+dependencies = [
+ "hashbrown 0.16.1",
+ "num-traits",
+ "robust",
+ "smallvec",
+]
+
+[[package]]
+name = "spin"
+version = "0.9.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3763264f6b73151db08c50ff20d7d8a0b8796e021cdea7ceedad07b80155fa0e"
+dependencies = [
+ "lock_api",
+]
+
 [[package]]
 name = "spki"
 version = "0.7.3"
@@ -4256,9 +6198,9 @@ dependencies = [
 
 [[package]]
 name = "sse-stream"
-version = "0.2.4"
+version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39f24a9b78c40b90817bbcd1821c74ddfd74916aadd29403d001532a9195532d"
+checksum = "c123f296ade4ec4b8b0f6162116e6629f5146922ca5ab40ca9d3c2e73ab4761e"
 dependencies = [
  "bytes",
  "futures-util",
@@ -4273,6 +6215,28 @@ version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 
+[[package]]
+name = "storekey"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd9a94571bde7369ecaac47cec2e6844642d99166bd452fbd8def74b5b917b2f"
+dependencies = [
+ "bytes",
+ "storekey-derive",
+ "uuid",
+]
+
+[[package]]
+name = "storekey-derive"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6079d53242246522ec982de613c5c952cc7b1380ef2f8622fcdab9bfe73c0098"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "streaming-iterator"
 version = "0.1.9"
@@ -4285,6 +6249,30 @@ version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fe895eb47f22e2ddd4dabc02bce419d2e643c8e3b585c78158b349195bc24d82"
 
+[[package]]
+name = "string_cache"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a18596f8c785a729f2819c0f6a7eae6ebeebdfffbfe4214ae6b087f690e31901"
+dependencies = [
+ "new_debug_unreachable",
+ "parking_lot",
+ "phf_shared",
+ "precomputed-hash",
+]
+
+[[package]]
+name = "string_cache_codegen"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "585635e46db231059f76c5849798146164652513eb9e8ab2685939dd90f29b69"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+ "proc-macro2",
+ "quote",
+]
+
 [[package]]
 name = "stringprep"
 version = "0.1.5"
@@ -4308,6 +6296,302 @@ version = "2.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
 
+[[package]]
+name = "surrealdb"
+version = "3.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "01fef5cc04dd6cb042391d48c0f78a586c56042e999f8cb17f0b97b0a147e2c0"
+dependencies = [
+ "anyhow",
+ "async-channel",
+ "boxcar",
+ "chrono",
+ "futures",
+ "getrandom 0.3.4",
+ "indexmap",
+ "js-sys",
+ "path-clean",
+ "ring",
+ "rustls-pki-types",
+ "semver",
+ "serde",
+ "serde_json",
+ "surrealdb-core",
+ "surrealdb-types",
+ "surrealdb-types-derive",
+ "tokio",
+ "tokio-tungstenite-wasm",
+ "tokio-util",
+ "tracing",
+ "url",
+ "uuid",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "wasmtimer",
+ "web-sys",
+]
+
+[[package]]
+name = "surrealdb-collections"
+version = "3.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca3472955f9692427583e78476d5b03c6f750bf11dc8a04383e0d365d7bd5d99"
+dependencies = [
+ "revision",
+ "storekey",
+]
+
+[[package]]
+name = "surrealdb-core"
+version = "3.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8cd76c36f8b545a9371eec050bb2ae83750a6f60bae8c6d92d06956943348f4c"
+dependencies = [
+ "addr",
+ "affinitypool",
+ "ahash 0.8.12",
+ "ammonia",
+ "anyhow",
+ "argon2",
+ "async-channel",
+ "async-stream",
+ "base64 0.22.1",
+ "bcrypt",
+ "blake3",
+ "bytes",
+ "chrono",
+ "ciborium",
+ "dashmap",
+ "deunicode",
+ "diskann",
+ "diskann-utils",
+ "diskann-vector",
+ "dmp",
+ "ext-sort",
+ "fastnum",
+ "fst",
+ "futures",
+ "fuzzy-matcher",
+ "geo",
+ "geo-types",
+ "getrandom 0.3.4",
+ "half 2.7.1",
+ "headers",
+ "hex",
+ "http 1.5.0",
+ "humantime",
+ "ipnet",
+ "jsonwebtoken",
+ "lexicmp",
+ "md-5 0.10.6",
+ "memchr",
+ "mime",
+ "ndarray",
+ "ndarray-stats",
+ "num-traits",
+ "num_cpus",
+ "object_store",
+ "parking_lot",
+ "path-clean",
+ "pbkdf2",
+ "phf",
+ "pin-project-lite",
+ "quick_cache",
+ "rand 0.9.5",
+ "rand_core 0.6.4",
+ "rayon",
+ "reblessive",
+ "regex",
+ "revision",
+ "ring",
+ "roaring",
+ "rust-stemmers",
+ "rust_decimal",
+ "scrypt",
+ "semver",
+ "serde",
+ "serde_json",
+ "sha1",
+ "sha2 0.10.9",
+ "storekey",
+ "strsim",
+ "subtle",
+ "surrealdb-collections",
+ "surrealdb-protocol",
+ "surrealdb-rocksdb",
+ "surrealdb-strand",
+ "surrealdb-types",
+ "surrealkv",
+ "surrealmx",
+ "sysinfo",
+ "tempfile",
+ "thiserror 2.0.20",
+ "tokio",
+ "tokio-util",
+ "tracing",
+ "ulid",
+ "unicase",
+ "url",
+ "uuid",
+ "vart",
+ "wasm-bindgen-futures",
+ "wasmtimer",
+ "web-time",
+]
+
+[[package]]
+name = "surrealdb-librocksdb-sys"
+version = "0.18.3+11.0.0-4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "25b82a18c7fa4b57206784a1a31e7b942ae1d3e24493e0c733019a409b2b4bea"
+dependencies = [
+ "bindgen",
+ "bzip2-sys",
+ "cc",
+ "libc",
+ "libz-sys",
+ "lz4-sys",
+ "zstd-sys",
+]
+
+[[package]]
+name = "surrealdb-protocol"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f4e06f586c9179a02349b88b0c18e3a0850c55431aa513e0cd66529c00da1af"
+dependencies = [
+ "anyhow",
+ "async-trait",
+ "bytes",
+ "chrono",
+ "flatbuffers",
+ "futures",
+ "geo",
+ "prost",
+ "prost-types",
+ "rust_decimal",
+ "semver",
+ "serde",
+ "serde_json",
+ "tonic",
+ "tonic-prost",
+ "uuid",
+]
+
+[[package]]
+name = "surrealdb-rocksdb"
+version = "0.24.0-surreal.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02e8c3a004982458af159bcbf369e41663d538cd4a291a49c0d4a2fb373cbb7e"
+dependencies = [
+ "libc",
+ "surrealdb-librocksdb-sys",
+]
+
+[[package]]
+name = "surrealdb-strand"
+version = "3.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a86f53e307b6b8275b15eaff2b718add63605cb804395d156589770c3bf38e56"
+dependencies = [
+ "revision",
+ "serde",
+ "storekey",
+]
+
+[[package]]
+name = "surrealdb-types"
+version = "3.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e0d70c7f4dbf1198521282a171a03f2f77f38a1225a149f7c0175e758f773b8a"
+dependencies = [
+ "anyhow",
+ "async-channel",
+ "bytes",
+ "castaway",
+ "chrono",
+ "flatbuffers",
+ "geo",
+ "hex",
+ "http 1.5.0",
+ "papaya",
+ "rand 0.9.5",
+ "regex",
+ "rust_decimal",
+ "semver",
+ "serde",
+ "serde_json",
+ "surrealdb-protocol",
+ "surrealdb-types-derive",
+ "tracing",
+ "ulid",
+ "url",
+ "uuid",
+]
+
+[[package]]
+name = "surrealdb-types-derive"
+version = "3.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc11310bfc0ae3e546cd14788f8d36e7616dbe41fa68b4b265b29fea34a7d7e1"
+dependencies = [
+ "heck 0.4.1",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "surrealkv"
+version = "0.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e57275d2ec60b2b73294d5b3de12efd9f84ff5ce6f738866a35d52301918ce7"
+dependencies = [
+ "arc-swap",
+ "async-trait",
+ "byteorder",
+ "bytes",
+ "chrono",
+ "crc32fast",
+ "crossbeam-skiplist",
+ "fs2",
+ "getrandom 0.3.4",
+ "guardian",
+ "integer-encoding",
+ "log",
+ "lz4_flex",
+ "parking_lot",
+ "quick_cache",
+ "rand 0.9.5",
+ "scopeguard",
+ "sha2 0.10.9",
+ "snap",
+ "tokio",
+ "xxhash-rust",
+]
+
+[[package]]
+name = "surrealmx"
+version = "0.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e8a87f050a4860832ccf4a53e43ea264e98d27618983602b5c575e6df296054"
+dependencies = [
+ "arc-swap",
+ "bincode",
+ "bytes",
+ "crossbeam-deque",
+ "crossbeam-queue",
+ "crossbeam-skiplist",
+ "lz4",
+ "papaya",
+ "parking_lot",
+ "serde",
+ "smallvec",
+ "thiserror 2.0.20",
+ "tracing",
+ "web-time",
+]
+
 [[package]]
 name = "symphonia"
 version = "0.6.0"
@@ -4505,6 +6789,17 @@ dependencies = [
  "symphonia-core",
 ]
 
+[[package]]
+name = "syn"
+version = "1.0.109"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
 [[package]]
 name = "syn"
 version = "2.0.119"
@@ -4518,9 +6813,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "3.0.2"
+version = "3.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a207d6d6a2b7fc470b80443726053f18a2481b7e1eee970597051596567987a3"
+checksum = "e6275cddf4610d1775e6d1fe9469b2e77d0f39fd98fb7450901b821e0c53649f"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4558,6 +6853,26 @@ dependencies = [
  "walkdir",
 ]
 
+[[package]]
+name = "sysinfo"
+version = "0.37.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "16607d5caffd1c07ce073528f9ed972d88db15dd44023fa57142963be3feb11f"
+dependencies = [
+ "libc",
+ "memchr",
+ "ntapi",
+ "objc2-core-foundation",
+ "objc2-io-kit",
+ "windows",
+]
+
+[[package]]
+name = "tap"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "55937e1799185b12863d447f42597ed69d9928686b8d88a1df17376a097d8369"
+
 [[package]]
 name = "tar"
 version = "0.4.46"
@@ -4582,6 +6897,15 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "tendril"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5fed54709c5b3a53d09bb1c113ea4f5ceafd1e772ddcb0030a82e1d56c087b08"
+dependencies = [
+ "new_debug_unreachable",
+]
+
 [[package]]
 name = "thiserror"
 version = "1.0.69"
@@ -4593,11 +6917,11 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "2.0.19"
+version = "2.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09a43598840e33d5b0331f38c5e30d13bb11c11210a4b58f0d9b18a5a5eefcd9"
+checksum = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f"
 dependencies = [
- "thiserror-impl 2.0.19",
+ "thiserror-impl 2.0.20",
 ]
 
 [[package]]
@@ -4613,13 +6937,22 @@ dependencies = [
 
 [[package]]
 name = "thiserror-impl"
-version = "2.0.19"
+version = "2.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43cbfe0cf76104d42a574802844187e84a305e531ed54455f11fbde0f10541cd"
+checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.2",
+ "syn 3.0.4",
+]
+
+[[package]]
+name = "thread_local"
+version = "1.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ad99c4c6d32803332c548b1af0540b357b3f5fc0be8f6c6bfe8b2e6ae784070"
+dependencies = [
+ "cfg-if",
 ]
 
 [[package]]
@@ -4629,12 +6962,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "25563eeba904d770acf527e8b370fe9a5547bacd20ff84a0b6c3bc41288e5625"
 dependencies = [
  "anyhow",
- "base64",
+ "base64 0.22.1",
  "bstr",
  "fancy-regex 0.13.0",
  "lazy_static",
  "regex",
- "rustc-hash",
+ "rustc-hash 1.1.0",
 ]
 
 [[package]]
@@ -4680,9 +7013,9 @@ dependencies = [
 
 [[package]]
 name = "tinystr"
-version = "0.8.3"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d"
+checksum = "b1e27c91459209c2986af3dcf603a5a74a4368754ce37414f59acc971167f643"
 dependencies = [
  "displaydoc",
  "zerovec",
@@ -4726,9 +7059,9 @@ dependencies = [
 
 [[package]]
 name = "tokio"
-version = "1.53.0"
+version = "1.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d988bcd52dbe076d3d46903332f58c912b87a2c49b1428419a5845154762ffee"
+checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
 dependencies = [
  "bytes",
  "libc",
@@ -4742,13 +7075,13 @@ dependencies = [
 
 [[package]]
 name = "tokio-macros"
-version = "2.7.1"
+version = "2.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6328af13490e73a9b4694030fafd93f8c8c6a9dede33e821c3fc63eddf8042ba"
+checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.4",
 ]
 
 [[package]]
@@ -4805,24 +7138,57 @@ dependencies = [
 
 [[package]]
 name = "tokio-stream"
-version = "0.1.18"
+version = "0.1.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32da49809aab5c3bc678af03902d4ccddea2a87d028d86392a4b1560c6906c70"
+checksum = "a3d06f0b082ba57c26b79407372e57cf2a1e28124f78e9479fe80322cf53420b"
 dependencies = [
  "futures-core",
  "pin-project-lite",
  "tokio",
 ]
 
+[[package]]
+name = "tokio-tungstenite"
+version = "0.28.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d25a406cddcc431a75d3d9afc6a7c0f7428d4891dd973e4d54c56b46127bf857"
+dependencies = [
+ "futures-util",
+ "log",
+ "tokio",
+ "tungstenite",
+]
+
+[[package]]
+name = "tokio-tungstenite-wasm"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccecee909c02b8863f9bda87253127eb4da0e7e1342330b2583fbc4d1795c2f8"
+dependencies = [
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "http 1.5.0",
+ "httparse",
+ "js-sys",
+ "thiserror 2.0.20",
+ "tokio",
+ "tokio-tungstenite",
+ "wasm-bindgen",
+ "web-sys",
+]
+
 [[package]]
 name = "tokio-util"
-version = "0.7.18"
+version = "0.7.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ae9cec805b01e8fc3fd2fe289f89149a9b66dd16786abd8b19cfa7b48cb0098"
+checksum = "494815d09bf52b5548659851081238f0ca39ff638363907596da739561c62c52"
 dependencies = [
  "bytes",
  "futures-core",
+ "futures-io",
  "futures-sink",
+ "libc",
  "pin-project-lite",
  "tokio",
 ]
@@ -4844,9 +7210,9 @@ dependencies = [
 
 [[package]]
 name = "toml"
-version = "1.1.3+spec-1.1.0"
+version = "1.1.4+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53c96ecdfa941c8fc4fcaed14f99ada8ebed502eef533015095a07e3301d4c3c"
+checksum = "3aace63f4bbcdfc2c965b059de67119c89c4017a70d633be6c104910f67056f5"
 dependencies = [
  "indexmap",
  "serde_core",
@@ -4875,11 +7241,23 @@ dependencies = [
  "serde_core",
 ]
 
+[[package]]
+name = "toml_edit"
+version = "0.25.13+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6975367e4d2ef766d86af01ffad14b622fecc8d4357a998fbc4deb6e9bacaf9b"
+dependencies = [
+ "indexmap",
+ "toml_datetime 1.1.1+spec-1.1.0",
+ "toml_parser",
+ "winnow 1.0.4",
+]
+
 [[package]]
 name = "toml_parser"
-version = "1.1.2+spec-1.1.0"
+version = "1.1.3+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2abe9b86193656635d2411dc43050282ca48aa31c2451210f4202550afb7526"
+checksum = "1d38ac1cf9b95face32296c0a3ede1fdc270627c9d9c02a7274dd6d960dc4d56"
 dependencies = [
  "winnow 1.0.4",
 ]
@@ -4890,6 +7268,46 @@ version = "1.1.2+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7d56353a2a665ad0f41a421187180aab746c8c325620617ad883a99a1cbe66d2"
 
+[[package]]
+name = "tonic"
+version = "0.14.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac2a5518c70fa84342385732db33fb3f44bc4cc748936eb5833d2df34d6445ef"
+dependencies = [
+ "async-trait",
+ "axum",
+ "base64 0.22.1",
+ "bytes",
+ "h2",
+ "http 1.5.0",
+ "http-body 1.1.0",
+ "http-body-util",
+ "hyper",
+ "hyper-timeout",
+ "hyper-util",
+ "percent-encoding",
+ "pin-project",
+ "socket2",
+ "sync_wrapper",
+ "tokio",
+ "tokio-stream",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tonic-prost"
+version = "0.14.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50849f68853be452acf590cde0b146665b8d507b3b8af17261df47e02c209ea0"
+dependencies = [
+ "bytes",
+ "prost",
+ "tonic",
+]
+
 [[package]]
 name = "tower"
 version = "0.5.3"
@@ -4898,9 +7316,12 @@ checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
 dependencies = [
  "futures-core",
  "futures-util",
+ "indexmap",
  "pin-project-lite",
+ "slab",
  "sync_wrapper",
  "tokio",
+ "tokio-util",
  "tower-layer",
  "tower-service",
  "tracing",
@@ -4914,7 +7335,7 @@ checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
 dependencies = [
  "bitflags",
  "bytes",
- "http 1.4.2",
+ "http 1.5.0",
  "http-body 1.1.0",
  "http-body-util",
  "pin-project-lite",
@@ -5026,12 +7447,46 @@ dependencies = [
  "tree-sitter-language",
 ]
 
+[[package]]
+name = "trice"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3aaab10ae9fac0b10f392752bf56f0fd20845f39037fec931e8537b105b515a"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+ "web-sys",
+]
+
 [[package]]
 name = "try-lock"
 version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
+[[package]]
+name = "tungstenite"
+version = "0.28.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8628dcc84e5a09eb3d8423d6cb682965dea9133204e8fb3efee74c2a0c259442"
+dependencies = [
+ "bytes",
+ "data-encoding",
+ "http 1.5.0",
+ "httparse",
+ "log",
+ "rand 0.9.5",
+ "sha1",
+ "thiserror 2.0.20",
+ "utf-8",
+]
+
+[[package]]
+name = "twox-hash"
+version = "2.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5283634e518fe9e82c7b20520bb4bc209009fd16c82077c802f8111ecbb0117a"
+
 [[package]]
 name = "typed-path"
 version = "0.12.3"
@@ -5044,6 +7499,23 @@ version = "1.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
 
+[[package]]
+name = "ulid"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "470dbf6591da1b39d43c14523b2b469c86879a53e8b758c8e090a470fe7b1fbe"
+dependencies = [
+ "rand 0.9.5",
+ "serde",
+ "web-time",
+]
+
+[[package]]
+name = "unicase"
+version = "2.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dbc4bc3a9f746d862c45cb89d705aa10f187bb96c76001afab07a0d35ce60142"
+
 [[package]]
 name = "unicode-bidi"
 version = "0.3.18"
@@ -5083,26 +7555,38 @@ version = "0.2.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "673aac59facbab8a9007c7f6108d11f63b603f7cabff99fabf650fea5c32b861"
 
+[[package]]
+name = "untrusted"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a"
+
 [[package]]
 name = "untrusted"
 version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
 
+[[package]]
+name = "unty"
+version = "0.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d49784317cd0d1ee7ec5c716dd598ec5b4483ea832a2dced265471cc0f690ae"
+
 [[package]]
 name = "ureq"
-version = "3.3.0"
+version = "3.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dea7109cdcd5864d4eeb1b58a1648dc9bf520360d7af16ec26d0a9354bafcfc0"
+checksum = "972d7902c8735f2695410b8aed7df6ed12a47394aa1c8d7af49f0497b731a94d"
 dependencies = [
- "base64",
+ "base64 0.23.1",
  "cookie_store",
  "flate2",
  "log",
  "percent-encoding",
  "rustls",
  "rustls-pki-types",
- "rustls-platform-verifier",
+ "rustls-platform-verifier 0.7.0",
  "serde",
  "serde_json",
  "socks",
@@ -5113,12 +7597,12 @@ dependencies = [
 
 [[package]]
 name = "ureq-proto"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e994ba84b0bd1b1b0cf92878b7ef898a5c1760108fe7b6010327e274917a808c"
+checksum = "da5f78b09e6941e1a0f2e30e695e4b120377b54d5e0aec11b594bb57b3971613"
 dependencies = [
- "base64",
- "http 1.4.2",
+ "base64 0.23.1",
+ "http 1.5.0",
  "httparse",
  "log",
 ]
@@ -5141,6 +7625,12 @@ version = "2.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da"
 
+[[package]]
+name = "utf-8"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9"
+
 [[package]]
 name = "utf8-zero"
 version = "0.8.1"
@@ -5155,15 +7645,22 @@ checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
 
 [[package]]
 name = "uuid"
-version = "1.24.0"
+version = "1.26.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf3923a6f5c4c6382e0b653c4117f48d631ea17f38ed86e2a828e6f7412f5239"
+checksum = "b5772d71c9be8a8a6ac2117d949c5b224c1b72241bb611d9a3012edcf8af7812"
 dependencies = [
  "getrandom 0.4.3",
  "js-sys",
+ "serde_core",
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "vart"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1982d899e57d646498709735f16e9224cf1e8680676ad687f930cf8b5b555ae"
+
 [[package]]
 name = "vcpkg"
 version = "0.2.15"
@@ -5176,6 +7673,12 @@ version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
 
+[[package]]
+name = "virtue"
+version = "0.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "051eb1abcf10076295e815102942cc58f9d5e3b4560e46e53c21e8ff6f3af7b1"
+
 [[package]]
 name = "vsimd"
 version = "0.8.0"
@@ -5245,22 +7748,33 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.126"
+version = "0.2.127"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b067c0c11094aef6b7a801c1e34a26affafdf3d051dba08456b868789aaf9a4"
+checksum = "1b70935747edd64d89de3efa29d73789b806c15798f8e7dca4d8ac356b50ce70"
 dependencies = [
  "cfg-if",
  "once_cell",
  "rustversion",
+ "serde",
  "wasm-bindgen-macro",
  "wasm-bindgen-shared",
 ]
 
+[[package]]
+name = "wasm-bindgen-futures"
+version = "0.4.77"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b7777d5cc23d0e91404e53ce2d5e8ec7acae3026b16233dba62cd3246457950"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.126"
+version = "0.2.127"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "167ce5e579f6bcf889c4f7175a8a5a585de84e8ff93976ce393efa5f2837aab1"
+checksum = "77775f8f3f7217702089053b94958f8f54061a3f663417df76e19cbdcca29bc1"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -5268,9 +7782,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.126"
+version = "0.2.127"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3997c7839262f4ef12cf90b818d6340c18e80f263f1a94bf157d0ec4420380e"
+checksum = "e11d33f857dc2fb11b8bc75aee111aa9cbeb12cd9f25efd3d4c2a3dd4e235284"
 dependencies = [
  "bumpalo",
  "proc-macro2",
@@ -5281,23 +7795,58 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.126"
+version = "0.2.127"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc1b4cb0cc549fcf58d7dfc081778139b3d283a081644e833e84682ad71cea24"
+checksum = "7ef64dbcc55df09c7e5a46182d181c2cfa3e925f3da937ea764728b4bbb9dcbf"
 dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "wasmtimer"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c598d6b99ea013e35844697fc4670d08339d5cda15588f193c6beedd12f644b"
+dependencies = [
+ "futures",
+ "js-sys",
+ "parking_lot",
+ "pin-utils",
+ "wasm-bindgen",
+]
+
 [[package]]
 name = "web-sys"
-version = "0.3.103"
+version = "0.3.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8622dcb61c0bcc9fffa6938bed81210af2da9a7e4a1a834b2e37a59b6dfb6141"
+checksum = "c435338968042f4f59a557f690a253676d47ce13ceb55d70100e7facf6620a30"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "web-time"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "web_atoms"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba8b815c1b593dc0baf78dd0f4fc8fdb2de53198fb1163738093e9a311c33fb3"
+dependencies = [
+ "phf",
+ "phf_codegen",
+ "string_cache",
+ "string_cache_codegen",
+]
+
 [[package]]
 name = "webpki-root-certs"
 version = "1.0.9"
@@ -5360,6 +7909,41 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
+[[package]]
+name = "windows"
+version = "0.61.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9babd3a767a4c1aef6900409f85f5d53ce2544ccdfaa86dad48c91782c6d6893"
+dependencies = [
+ "windows-collections",
+ "windows-core 0.61.2",
+ "windows-future",
+ "windows-link 0.1.3",
+ "windows-numerics",
+]
+
+[[package]]
+name = "windows-collections"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3beeceb5e5cfd9eb1d76b381630e82c4241ccd0d27f1a39ed41b2760b255c5e8"
+dependencies = [
+ "windows-core 0.61.2",
+]
+
+[[package]]
+name = "windows-core"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0fdd3ddb90610c7638aa2b3a3ab2904fb9e5cdbecc643ddb3647212781c4ae3"
+dependencies = [
+ "windows-implement",
+ "windows-interface",
+ "windows-link 0.1.3",
+ "windows-result 0.3.4",
+ "windows-strings 0.4.2",
+]
+
 [[package]]
 name = "windows-core"
 version = "0.62.2"
@@ -5368,9 +7952,20 @@ checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
 dependencies = [
  "windows-implement",
  "windows-interface",
- "windows-link",
- "windows-result",
- "windows-strings",
+ "windows-link 0.2.1",
+ "windows-result 0.4.1",
+ "windows-strings 0.5.1",
+]
+
+[[package]]
+name = "windows-future"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc6a41e98427b19fe4b73c550f060b59fa592d7d686537eebf9385621bfbad8e"
+dependencies = [
+ "windows-core 0.61.2",
+ "windows-link 0.1.3",
+ "windows-threading",
 ]
 
 [[package]]
@@ -5395,19 +7990,53 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "windows-link"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e6ad25900d524eaabdbbb96d20b4311e1e7ae1699af4fb28c17ae66c80d798a"
+
 [[package]]
 name = "windows-link"
 version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
 
+[[package]]
+name = "windows-numerics"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9150af68066c4c5c07ddc0ce30421554771e528bde427614c61038bc2c92c2b1"
+dependencies = [
+ "windows-core 0.61.2",
+ "windows-link 0.1.3",
+]
+
+[[package]]
+name = "windows-result"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56f42bd332cc6c8eac5af113fc0c1fd6a8fd2aa08a0119358686e5160d0586c6"
+dependencies = [
+ "windows-link 0.1.3",
+]
+
 [[package]]
 name = "windows-result"
 version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
 dependencies = [
- "windows-link",
+ "windows-link 0.2.1",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56e6c93f3a0c3b36176cb1327a4958a0353d5d166c2a35cb268ace15e91d3b57"
+dependencies = [
+ "windows-link 0.1.3",
 ]
 
 [[package]]
@@ -5416,7 +8045,7 @@ version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
 dependencies = [
- "windows-link",
+ "windows-link 0.2.1",
 ]
 
 [[package]]
@@ -5437,6 +8066,15 @@ dependencies = [
  "windows-targets 0.52.6",
 ]
 
+[[package]]
+name = "windows-sys"
+version = "0.59.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
 [[package]]
 name = "windows-sys"
 version = "0.60.2"
@@ -5452,7 +8090,7 @@ version = "0.61.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
 dependencies = [
- "windows-link",
+ "windows-link 0.2.1",
 ]
 
 [[package]]
@@ -5492,7 +8130,7 @@ version = "0.53.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3"
 dependencies = [
- "windows-link",
+ "windows-link 0.2.1",
  "windows_aarch64_gnullvm 0.53.1",
  "windows_aarch64_msvc 0.53.1",
  "windows_i686_gnu 0.53.1",
@@ -5503,6 +8141,15 @@ dependencies = [
  "windows_x86_64_msvc 0.53.1",
 ]
 
+[[package]]
+name = "windows-threading"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b66463ad2e0ea3bbf808b7f1d371311c80e115c0b71d60efc142cafbcfb057a6"
+dependencies = [
+ "windows-link 0.1.3",
+]
+
 [[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.42.2"
@@ -5652,6 +8299,9 @@ name = "winnow"
 version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "23b97319f7b8343df12cc98938e5c3eb436064524c8d2b4e30a1d3a36eecdf81"
+dependencies = [
+ "memchr",
+]
 
 [[package]]
 name = "wit-bindgen"
@@ -5661,9 +8311,18 @@ checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
 
 [[package]]
 name = "writeable"
-version = "0.6.3"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"
+
+[[package]]
+name = "wyz"
+version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
+checksum = "05f360fc0b24296329c78fda852a1e9ae82de9cf7b27dae4b7f62f118f77b9ed"
+dependencies = [
+ "tap",
+]
 
 [[package]]
 name = "x509-cert"
@@ -5724,18 +8383,18 @@ dependencies = [
 
 [[package]]
 name = "zerocopy"
-version = "0.8.54"
+version = "0.8.56"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7cbbc0a705a0fd05cc3676525980d2bf5a9bc4adac6d6475209a7887cf59d19"
+checksum = "556764e583adb45a9f8d413c2a147fa7e8d821e48e12b14fd560b607998b75eb"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.54"
+version = "0.8.56"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2e817b7b52d0c7358d3246da9d69935ebb18116b2b102b4230dac079b4862f5"
+checksum = "f2ab42fc20575779bd240faa45f94a74256f755c0fa9e89f0ede20d91d0cdfc1"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -5785,9 +8444,9 @@ dependencies = [
 
 [[package]]
 name = "zerotrie"
-version = "0.2.4"
+version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
+checksum = "4ea269c3bd32f0a32c321907a2ae912ba6f4649bb0fc764a15627e99a7095a3f"
 dependencies = [
  "displaydoc",
  "yoke",
@@ -5796,9 +8455,9 @@ dependencies = [
 
 [[package]]
 name = "zerovec"
-version = "0.11.6"
+version = "0.11.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
+checksum = "bb0464e17806c1d976d5cba29399c7f08e516e279e2ba493f63123b5fca67dd8"
 dependencies = [
  "yoke",
  "zerofrom",
@@ -5807,13 +8466,13 @@ dependencies = [
 
 [[package]]
 name = "zerovec-derive"
-version = "0.11.3"
+version = "0.11.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
+checksum = "34df6fc39dbd26ddc9c10e6a2984476e13acce22e64e4487636ef494369225da"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.4",
 ]
 
 [[package]]
@@ -5844,9 +8503,9 @@ dependencies = [
 
 [[package]]
 name = "zlib-rs"
-version = "0.6.6"
+version = "0.6.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b142a20ec14a91d5bc708c1dc21b080c550113d8aa77afa29635673a65dd02c5"
+checksum = "34b31d188d9d685a4f9c7b46d6e36631b07058d2cfe190267adce54dc230bf12"
 
 [[package]]
 name = "zmij"
diff --git a/Cargo.toml b/Cargo.toml
index be09be205..5b75eacd8 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -8,6 +8,7 @@ members = [
     "crates/compass-files",
     "crates/compass-graph",
     "crates/compass-graphdb",
+    "crates/compass-graphdb-surreal",
     "crates/compass-global",
     "crates/compass-google-workspace",
     "crates/compass-ingest",
@@ -17,6 +18,7 @@ members = [
     "crates/compass-mcp",
     "crates/compass-model",
     "crates/compass-output",
+    "crates/compass-partition",
     "crates/compass-postgres",
     "crates/compass-prs",
     "crates/compass-program",
@@ -83,7 +85,8 @@ realfft = "3.5.0"
 regex = "1"
 semver = "1"
 self-replace = "1.5"
-rmcp = { version = "2.2.0", default-features = false, features = ["server", "transport-io", "transport-streamable-http-server"] }
+rmcp = { version = "=3.1.4", default-features = false, features = ["server", "transport-io", "transport-streamable-http-server"] }
+surrealdb = { version = "=3.2.4", default-features = false }
 rubato = "0.16.2"
 flate2 = "1.1.9"
 glob = "0.3.3"
@@ -118,7 +121,9 @@ ureq = { version = "3.3.0", default-features = false, features = ["json", "rustl
 wait-timeout = "0.2.1"
 zip = { version = "6.0.0", default-features = false, features = ["deflate"] }
 axum = "0.8.8"
+http-body-util = "0.1.3"
 tower-http = { version = "0.6.8", features = ["limit"] }
+compass-partition = { path = "crates/compass-partition", version = "0.3.7" }
 
 [workspace.lints.rust]
 unsafe_code = "forbid"
@@ -135,5 +140,29 @@ lto = "thin"
 panic = "abort"
 strip = "symbols"
 
+# Phase-first development favors one compact, coordinated build after the
+# implementation is complete. Preserve line-level backtraces while avoiding
+# full dependency debug info and incremental artifact growth.
+[profile.dev]
+debug = "line-tables-only"
+incremental = false
+codegen-units = 256
+
+[profile.dev.package."*"]
+debug = false
+
+[profile.test]
+debug = "line-tables-only"
+incremental = false
+codegen-units = 256
+
+[profile.test.package."*"]
+debug = false
+
+[profile.debugging]
+inherits = "dev"
+debug = "full"
+incremental = true
+
 [patch.crates-io]
 gemm-common = { path = "vendor/gemm-common" }
diff --git a/MIGRATION.md b/MIGRATION.md
index 188e6e98f..e8dc432da 100644
--- a/MIGRATION.md
+++ b/MIGRATION.md
@@ -27,6 +27,30 @@ compass update .
 
 Set `COMPASS_OUT` before running Compass when you need a custom output directory.
 
+Standalone `compass.graph/1` files used by MCP clients must carry non-empty
+`graph.build.sourceTreeDigest` and `graph.build.generationId` values. Regenerate
+older or hand-authored files with `compass update` instead of substituting
+placeholder-empty identities.
+
+## Regenerate portable agent bundles
+
+Portable bundles exported before the native distribution inventory do not
+carry the recorded harness version or the complete harness-native manifests.
+They also used legacy `mcp/` configuration paths. The current validator rejects
+those bundles instead of guessing their platform contract. Regenerate them with
+the current binary:
+
+```bash
+compass agent export --platform codex --out ./compass-codex
+compass agent export --platform claude --out ./compass-claude
+compass agent export --platform opencode --out ./compass-opencode
+```
+
+The regenerated layouts use `.mcp.json` for Codex and Claude Code,
+`opencode.json` for OpenCode, and `.agents/mcp.json` for the generic Agent
+Skills package. Replace old generated bundles as whole directories; do not mix
+files from the old and new layouts.
+
 The new directory exposes the main artifacts directly:
 
 ```text
@@ -197,4 +221,43 @@ Compass exposes its Model Context Protocol server through `compass serve`. Reins
 compass install --platform codex --project
 ```
 
+### Migrate MCP clients to MCP 2026-07-28
+
+Compass stdio and HTTP now reject protocol revisions older than 2026-07-28.
+Upgrade clients to begin with `server/discover` and send the protocol's
+per-request `_meta` fields. HTTP no longer creates MCP sessions and additionally
+requires `Mcp-Protocol-Version: 2026-07-28`, the matching `Mcp-Method`, and any
+applicable parameter headers. Authentication, endpoint paths, size limits, and
+`project_path` selection are unchanged.
+
+There is no legacy MCP-2025 HTTP mode or compatibility flag. `--stateless` may
+remain in existing scripts but is now redundant. Remove `--session-timeout`
+from scripts: Compass 0.4.x accepts and ignores it with a warning, and Compass
+0.5.0 removes it. An obsolete `Mcp-Session-Id` header is ignored on an otherwise
+valid current request and never creates or restores state; clients should stop
+sending it. Stdio clients that previously negotiated a 2025 revision must
+upgrade; there is no legacy stdio compatibility flag.
+
+### Read core navigation results through the MCP envelope
+
+The structured content returned by `search_symbols`, `get_callers`,
+`get_callees`, and `get_impact` now uses `compass.code_context.v1`. If a client
+previously read `schema`, `operation`, `nodes`, `edges`, `paths`, `diagnostics`,
+`limits`, or `truncated` directly from `structuredContent`, read the same fields
+from `structuredContent.data` instead. The nested object remains
+`compass.query/1`; no query record or ordering changed.
+
+Use `structuredContent.schema` to select the Compass decoder. Do not treat MCP
+`resultType` as that schema: for these synchronous MCP 2026 results it is the
+separate protocol value `complete`. A `truncation.next` value of null means this
+envelope version exposes no continuation token; reduce or adjust the request
+bounds rather than inventing a page cursor.
+
+Legacy text results remain callable, but discovery marks `get_neighbors`,
+`get_community`, `god_nodes`, `graph_stats`, `shortest_path`, `list_prs`,
+`get_pr_impact`, `triage_prs`, and explicit `query_graph` traversal text mode
+deprecated from 0.4.0. Migrate automation to typed navigation tools where an
+equivalent exists. Compass has not scheduled removal before typed replacements
+are available and separately reviewed.
+
 Keep the old Graphify installation and `graphify-out/` directory until the new `compass-out/` graph has passed your project checks. The two tools don't share runtime output paths.
diff --git a/Makefile b/Makefile
index 92ab36ed1..1da56d7a4 100644
--- a/Makefile
+++ b/Makefile
@@ -86,18 +86,18 @@ all: build test ## Build and run the self-contained test suite
 
 .PHONY: check
 check: ## Fast workspace compile check
-	$(CARGO) check --workspace --locked $(TARGET_ARG) $(BUILD_FLAGS)
+	$(CARGO) test --workspace --test '*' --locked --no-run $(TARGET_ARG) $(BUILD_FLAGS)
 
 .PHONY: check-release
 check-release: ## Fast release-mode workspace compile check
-	$(CARGO) check --workspace --release --locked $(TARGET_ARG) $(BUILD_FLAGS)
+	$(CARGO) test --workspace --test '*' --release --locked --no-run $(TARGET_ARG) $(BUILD_FLAGS)
 
 # ── Test ───────────────────────────────────────────────────────────
 
 .PHONY: test
-test: ## Run self-contained workspace tests
-	@printf "$(BOLD)Running native workspace tests...$(RESET)\n"
-	$(CARGO) test --workspace --lib --bins --locked $(TEST_FLAGS)
+test: ## Run the full phase-end workspace integration suite
+	@printf "$(BOLD)Running workspace integration tests...$(RESET)\n"
+	$(CARGO) test --workspace --test '*' --locked
 
 .PHONY: test-js
 test-js: ## Typecheck and test the shared viewer and editor integrations
@@ -114,12 +114,12 @@ test-vscode: ## Build and package-check the Compass VS Code extension
 	npm run smoke:vsix -w editors/vscode
 
 .PHONY: test-all
-test-all: ## Run all tests (requires the documented Python oracle setup)
-	$(CARGO) test --workspace --all-targets --all-features --locked $(TEST_FLAGS)
+test-all: ## Run all feature-enabled integration targets after phase implementation
+	$(CARGO) test --workspace --test '*' --all-features --locked
 
 .PHONY: test-release
-test-release: ## Run self-contained tests in release mode
-	$(CARGO) test --workspace --lib --bins --release --locked $(TEST_FLAGS)
+test-release: ## Run workspace integration targets in release mode
+	$(CARGO) test --workspace --test '*' --release --locked
 
 .PHONY: test-product
 test-product: ## Run the Compass CLI product contract
@@ -145,7 +145,7 @@ fmt-check: ## Check Rust formatting
 
 .PHONY: clippy
 clippy: ## Run Clippy across the complete workspace
-	$(CARGO) clippy --workspace --all-targets --all-features --locked -- -D warnings
+	$(CARGO) clippy --workspace --lib --bins --locked -- -D warnings
 
 .PHONY: lint
 lint: fmt-check clippy ## Run formatting and Clippy checks
@@ -265,9 +265,9 @@ build-windows-arm: ## Build release for ARM64 Windows
 # ── Dev Workflow ───────────────────────────────────────────────────
 
 .PHONY: watch
-watch: ## Recheck and retest on source changes (requires cargo-watch)
-	$(CARGO) watch -x "check --workspace --locked" \
-	  -x "test --workspace --lib --bins --locked"
+watch: ## Disabled: phase-first development forbids incremental compile/test loops
+	@printf "$(BOLD)Cargo watch is disabled by the phase-first development doctrine.$(RESET)\n" >&2
+	@exit 2
 
 .PHONY: run
 run: ## Build and run Compass (override with ARGS="...")
diff --git a/README.md b/README.md
index b04912eab..e36f4102d 100644
--- a/README.md
+++ b/README.md
@@ -311,13 +311,17 @@ Read the [versioned history guide](docs/guides/versioned-history.md) and
 
 ```bash
 compass install
+compass update .
+compass agent doctor --platform codex
 ```
 
 Inside a Git repository, Compass detects installed coding agents and configures
 them at the repository root. Codex, Gemini CLI, OpenCode, Copilot, and generic
-Agent Skills clients share one portable `.agents/skills/compass` package;
-Claude Code, Kiro, and Cline use their native skill roots. Use repeatable
-`--platform` flags when you want explicit selection:
+Agent Skills clients share the portable `.agents/skills/compass` umbrella plus
+focused sibling skills for navigation, debugging, change impact, architecture,
+index maintenance, and MCP setup. The umbrella remains the canonical fallback.
+Claude Code, Kiro, and Cline use the same collection in their native skill
+roots. Use repeatable `--platform` flags when you want explicit selection:
 
 ```bash
 compass install --platform codex
@@ -326,17 +330,35 @@ compass install --all --dry-run
 compass install --user --format json
 ```
 
+Use `compass agent list` to inspect the full registry, `compass agent export`
+and `compass agent validate` for deterministic, checksum-verified native Codex,
+Claude, and OpenCode packages (or a generic seven-skill bundle), and
+`compass agent mcp-config` to render credential-free native Codex, Claude,
+OpenCode, or generic Agent Skills MCP configuration. The namespaced
+`compass agent install` form delegates to `compass install` unchanged.
+Run a graph build before project-scoped doctor checks; user-scoped checks skip
+graph presence and freshness. Project diagnostics honor `COMPASS_OUT` and the
+current immutable output snapshot. The doctor, export, validation-platform,
+and MCP-config commands support the four platforms with native MCP schemas:
+`agents`, `claude`, `codex`, and `opencode`.
+
+The three native exports are generated from the repository's single
+`distribution.toml` inventory. Codex exports include plugin and local
+marketplace manifests, Claude exports include the required marketplace
+manifest, and OpenCode exports include a thin TypeScript/npm plugin that
+delegates graph behavior to the `compass` binary.
+
 Check `Selected` in the command output. If it lists only `agents`, Compass did
 not detect a host-specific adapter. An explicit `--platform` selection bypasses
 detection. Start a new assistant session after installation. In Codex, review
 and trust the hook under `/hooks`; in Gemini CLI, run `/skills reload`.
 
-The skill teaches assistants to refresh an existing graph when it is stale,
-run a focused Compass query before broad source searches, and open only the
-source files needed to verify an answer. It reads `compass-out/GRAPH_REPORT.md`
-when repository-wide architecture context is useful. Installation does not
-build a graph; on the first architecture, dependency, history, or impact
-question, the assistant can run the local deterministic build and continue.
+The umbrella skill teaches the complete Compass workflow. Six additive focused
+skills let compatible clients activate a smaller task boundary without
+changing explicit `/compass` requests or broad multi-operation fallback.
+Installation does not build a graph; on the first architecture, dependency,
+history, or impact question, the assistant can run the local deterministic
+build and continue.
 
 ```text
 coding question
diff --git a/SECURITY.md b/SECURITY.md
index d59b9e620..b87f9294b 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -39,13 +39,22 @@ Maintainers will use the private advisory to coordinate questions, credit, affec
 Compass parses untrusted project content and graph files. Its default structural build and query workflow stays local, but these opt-in features cross process or network boundaries:
 
 - Semantic extraction sends selected content to the configured model provider
-- Streamable HTTP exposes the Model Context Protocol server on the configured interface
+- Stateless MCP 2026-07-28 Streamable HTTP exposes the server on the configured
+  interface; every request remains independently subject to host validation,
+  authentication when configured, and body limits
 - Neo4j and FalkorDB pushes connect to external databases
 - URL acquisition and Google Workspace extraction access configured external services
 - PostgreSQL extraction connects to the supplied database server
 - Assistant setup can register local command hooks. Review generated hook files
   before trusting them in the host, and reinstall after moving the Compass
   executable so the managed command path remains accurate.
+- `compass agent export` publishes only the embedded seven-skill collection and
+  credential-free native MCP configuration. `compass agent validate` treats
+  bundles and managed installations as untrusted: it bounds files and bytes,
+  rejects symlinks, escaping paths and common machine-specific roots, verifies
+  manifests and
+  checksums, accepts only the documented Compass stdio command or loopback HTTP
+  endpoint, and reports likely literal credentials without echoing their values.
 - `compass upgrade` downloads the bounded `compass.release/1` manifest and the
   selected archive from official GitHub release URLs. It validates the schema,
   stable tag/version binding, bounded unique targets, selected archive name and
diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md
index 4bad3cbeb..60f851ffb 100644
--- a/THIRD_PARTY_NOTICES.md
+++ b/THIRD_PARTY_NOTICES.md
@@ -1,5 +1,21 @@
 # Third-party notices
 
+## Optional SurrealDB 3.2.4 integration
+
+The non-default `mem`, `surrealkv`, and `rocksdb` features of
+`compass-graphdb-surreal` resolve SurrealDB 3.2.4 and its core components.
+Those components are licensed under Business Source License 1.1 before
+conversion, with SurrealDB Ltd. as licensor, a Database Service restriction,
+Change Date 2030-01-01, and Apache License 2.0 as the Change License.
+
+Surreal-enabled artifacts must preserve the applicable exact license and
+notices and comply with its redistribution terms. The reviewed tagged license
+is retained at
+`scripts/fixtures/surreal-persistent-probes/SURREALDB-3.2.4-LICENSE.txt`; its
+SHA-256 is
+`98a94ac615f88370865016487b436fa404560910bd329794ed7502277a94b805`.
+The default Compass binary does not link these components.
+
 ## openCypher Technology Compatibility Kit feature files
 
 Compass includes selected unmodified Gherkin feature files from the
diff --git a/benchmarks/qualification/README.md b/benchmarks/qualification/README.md
new file mode 100644
index 000000000..ebd505cc0
--- /dev/null
+++ b/benchmarks/qualification/README.md
@@ -0,0 +1,113 @@
+# Compass qualification corpora
+
+This directory is the versioned, deterministic comparison surface for C-013.
+The checked-in files are inputs, schemas, digests, tests, and summarized raw
+measurements. Generated graphs, indexes, binaries, and raw logs are disposable
+and belong under `target/` or an explicit temporary directory.
+
+`manifest-v1.json` is the closed checksum inventory for the retained benchmark
+sources and evidence. The test suite verifies every listed byte digest and
+rejects missing or unlisted retained benchmark artifacts.
+`raw-traversal-oracle-v1.json` retains the timing-free output of the exact medium
+30-task run; tests continuously apply every versioned expectation to that output.
+`surreal-dual-engine-decision-v1.json` retains the C-015 medium dual-engine raw
+samples, source and graph identities, peak memory, threshold decisions, and the
+pre-ratified `REJECT` falsifier outcome. The candidate achieved zero semantic
+mismatches but failed the query-regression and native-value gates; omitted
+post-falsifier measurements are explicit and must not be interpreted as passes.
+
+## Validate the corpora
+
+```bash
+PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover \
+  -s benchmarks/qualification/tests -v
+```
+
+## Generate scale profiles
+
+Plan-only validation is cheap and does not iterate every record:
+
+```bash
+python3 benchmarks/qualification/generate_graph.py \
+  --profile qualification-large --plan-only
+```
+
+Metadata-only validation iterates every logical record and recomputes the
+digests in `scale-profile-digests-v1.json` without writing a graph:
+
+```bash
+python3 benchmarks/qualification/generate_graph.py \
+  --profile qualification-medium --metadata-only
+python3 benchmarks/qualification/generate_graph.py \
+  --profile qualification-large --metadata-only
+```
+
+Materialize the exact medium graph only in a disposable location:
+
+```bash
+python3 benchmarks/qualification/generate_graph.py \
+  --profile qualification-medium \
+  --output target/qualification-c013/medium/graph.json \
+  --metadata-output target/qualification-c013/medium/generation.json
+```
+
+## Reproduce the current-engine baseline
+
+```bash
+cargo build -p compass-cli --release --locked
+python3 benchmarks/qualification/run_current_baseline.py \
+  --binary target/release/compass \
+  --graph target/qualification-c013/medium/graph.json \
+  --output target/qualification-c013/current-engine-baseline-v1.json \
+  --work-dir target/qualification-c013/run-fixed \
+  --samples 5 \
+  --timeout-seconds 120
+```
+
+The runner measures the bounded 30-task raw denominator itself and emits the
+complete retained schema, including source provenance and repository-relative
+paths. It computes the source patch SHA-256 from a fixed default path set and
+hashes the existing tracked files plus non-ignored untracked files in that
+scope; ignored ambient files are excluded. Use repeatable
+`--workspace-patch-path` arguments when a later comparison has a different
+implementation scope. The legacy `compass path` command has no depth
+flag, so its workload uses
+fixture endpoints whose deterministic shortest path is exactly three hops; the
+finite graph profile and process timeout remain explicit independent bounds.
+
+Reproduction always writes to `target/`. Promoting later evidence is a separate
+dated update: review the fresh samples, add a new versioned retained JSON artifact
+(for example `current-engine-baseline-v2.json`), preserve every prior baseline,
+extend `manifest-v1.json`, and rerun the complete qualification test suite. A
+routine reproduction run must not mutate the pinned manifest closure.
+
+The retained baseline is host-specific evidence, not a universal performance
+claim. A future engine comparison must run the same generator, commands, sample
+count, warmup condition, and p95 method on the same runner. `gzip9Bytes` is tied
+to the recorded Python and zlib runtime as well as the input binary; comparisons
+must not treat it as runtime-independent.
+
+The current-engine runner intentionally accepts only `qualification-medium`, the
+profile ratified for current-engine footprint and query baselines. It fails before
+measurement if another pinned or custom profile is supplied.
+
+## Run the bounded raw denominator
+
+```bash
+python3 benchmarks/qualification/raw_traversal.py \
+  --graph target/qualification-c013/medium/graph.json \
+  --tasks benchmarks/qualification/agent-tasks-v1.json \
+  --output target/qualification-c013/raw-traversal-v1.json \
+  --max-graph-bytes 268435456 --max-nodes 100000 --max-edges 250000 \
+  --max-depth 32 --max-results 10000 --timeout-seconds 120
+```
+
+Exit status 2 is a limit or input failure; it must never be interpreted as an
+empty result. Every task must provide an `expected` evidence object; the runner
+applies each contract and fails instead of publishing absent or mismatched oracle
+evidence. All operations emit an explicit `complete` or `empty` status. When a
+task document declares limits, they must exactly match the effective CLI limits;
+the task input is itself capped at 1 MiB and 100 tasks. JSON output files are
+published atomically. The portable retained command label `python3` is normalized;
+`rawTraversal.commandInterpreter.measuredExecutableName` records the executable
+name actually used and `host.python` records its measured version.
diff --git a/benchmarks/qualification/agent-tasks-v1.json b/benchmarks/qualification/agent-tasks-v1.json
new file mode 100644
index 000000000..53b58bf50
--- /dev/null
+++ b/benchmarks/qualification/agent-tasks-v1.json
@@ -0,0 +1,47 @@
+{
+  "schema": "compass.qualification-agent-tasks/1",
+  "profile": "qualification-medium",
+  "limits": {
+    "maxDepth": 32,
+    "maxEdges": 250000,
+    "maxNodes": 100000,
+    "maxResultsPerTask": 10000,
+    "timeoutSeconds": 120
+  },
+  "tasks": [
+    {"id":"search-01","operation":"search","prompt":"Find the first qualification symbol.","query":"qualification::Node0000000","expected":{"containsNodeIds":["n:qualification:0000000"],"status":"complete"}},
+    {"id":"search-02","operation":"search","prompt":"Find qualification node 1 by qualified name.","query":"qualification::Node0000001","expected":{"containsNodeIds":["n:qualification:0000001"],"status":"complete"}},
+    {"id":"search-03","operation":"search","prompt":"Locate qualification node 97.","query":"qualification::Node0000097","expected":{"containsNodeIds":["n:qualification:0000097"],"status":"complete"}},
+    {"id":"search-04","operation":"search","prompt":"Locate the midpoint qualification function.","query":"qualification::Node0050000","expected":{"containsNodeIds":["n:qualification:0050000"],"status":"complete"}},
+    {"id":"search-05","operation":"search","prompt":"Find the penultimate qualification function.","query":"qualification::Node0099998","expected":{"containsNodeIds":["n:qualification:0099998"],"status":"complete"}},
+    {"id":"search-06","operation":"search","prompt":"Find the last qualification function.","query":"qualification::Node0099999","expected":{"containsNodeIds":["n:qualification:0099999"],"status":"complete"}},
+
+    {"id":"callers-01","operation":"callers","prompt":"Show every caller occurrence of node 1, preserving parallel edges.","source":"qualification::Node0000001","expected":{"containsNodeIds":["n:qualification:0000000"],"minimumEdgeCount":2,"status":"complete"}},
+    {"id":"callers-02","operation":"callers","prompt":"Who calls qualification node 2?","source":"qualification::Node0000002","expected":{"containsNodeIds":["n:qualification:0000001"],"minimumEdgeCount":1,"status":"complete"}},
+    {"id":"callers-03","operation":"callers","prompt":"Find callers of qualification node 97.","source":"qualification::Node0000097","expected":{"containsNodeIds":["n:qualification:0000096"],"minimumEdgeCount":1,"status":"complete"}},
+    {"id":"callers-04","operation":"callers","prompt":"Find callers at the medium fixture midpoint.","source":"qualification::Node0050000","expected":{"containsNodeIds":["n:qualification:0049999"],"minimumEdgeCount":1,"status":"complete"}},
+    {"id":"callers-05","operation":"callers","prompt":"Find callers of qualification node 99998.","source":"qualification::Node0099998","expected":{"containsNodeIds":["n:qualification:0099997"],"minimumEdgeCount":1,"status":"complete"}},
+    {"id":"callers-06","operation":"callers","prompt":"Find callers of the last qualification function.","source":"qualification::Node0099999","expected":{"containsNodeIds":["n:qualification:0099998"],"minimumEdgeCount":1,"status":"complete"}},
+
+    {"id":"callees-01","operation":"callees","prompt":"Show every callee occurrence from node 0, preserving parallel edges.","source":"qualification::Node0000000","expected":{"containsNodeIds":["n:qualification:0000001"],"minimumEdgeCount":2,"status":"complete"}},
+    {"id":"callees-02","operation":"callees","prompt":"What does qualification node 1 call?","source":"qualification::Node0000001","expected":{"containsNodeIds":["n:qualification:0000002"],"minimumEdgeCount":1,"status":"complete"}},
+    {"id":"callees-03","operation":"callees","prompt":"Find callees of qualification node 96.","source":"qualification::Node0000096","expected":{"containsNodeIds":["n:qualification:0000097"],"minimumEdgeCount":1,"status":"complete"}},
+    {"id":"callees-04","operation":"callees","prompt":"Find callees immediately before the fixture midpoint.","source":"qualification::Node0049999","expected":{"containsNodeIds":["n:qualification:0050000"],"minimumEdgeCount":1,"status":"complete"}},
+    {"id":"callees-05","operation":"callees","prompt":"Find callees of qualification node 99997.","source":"qualification::Node0099997","expected":{"containsNodeIds":["n:qualification:0099998"],"minimumEdgeCount":1,"status":"complete"}},
+    {"id":"callees-06","operation":"callees","prompt":"Find callees of the penultimate qualification function.","source":"qualification::Node0099998","expected":{"containsNodeIds":["n:qualification:0099999"],"minimumEdgeCount":1,"status":"complete"}},
+
+    {"id":"impact-01","operation":"impact","prompt":"Assess the depth-3 blast radius of node 3.","source":"qualification::Node0000003","maxDepth":3,"expected":{"containsNodeIds":["n:qualification:0000000","n:qualification:0000003"],"minimumEdgeCount":3,"status":"complete"}},
+    {"id":"impact-02","operation":"impact","prompt":"Assess depth-3 impact for node 97.","source":"qualification::Node0000097","maxDepth":3,"expected":{"containsNodeIds":["n:qualification:0000094","n:qualification:0000097"],"minimumEdgeCount":3,"status":"complete"}},
+    {"id":"impact-03","operation":"impact","prompt":"Assess depth-4 impact for node 100.","source":"qualification::Node0000100","maxDepth":4,"expected":{"containsNodeIds":["n:qualification:0000096","n:qualification:0000100"],"minimumEdgeCount":4,"status":"complete"}},
+    {"id":"impact-04","operation":"impact","prompt":"Assess depth-5 impact for node 1000.","source":"qualification::Node0001000","maxDepth":5,"expected":{"containsNodeIds":["n:qualification:0000995","n:qualification:0001000"],"minimumEdgeCount":5,"status":"complete"}},
+    {"id":"impact-05","operation":"impact","prompt":"Assess depth-3 impact at the fixture midpoint.","source":"qualification::Node0050000","maxDepth":3,"expected":{"containsNodeIds":["n:qualification:0049997","n:qualification:0050000"],"minimumEdgeCount":3,"status":"complete"}},
+    {"id":"impact-06","operation":"impact","prompt":"Assess depth-3 impact of the final qualification function.","source":"qualification::Node0099999","maxDepth":3,"expected":{"containsNodeIds":["n:qualification:0099996","n:qualification:0099999"],"minimumEdgeCount":3,"status":"complete"}},
+
+    {"id":"path-01","operation":"path","prompt":"Trace a path from qualification node 0 to node 3.","source":"qualification::Node0000000","target":"qualification::Node0000003","expected":{"firstNodeId":"n:qualification:0000000","lastNodeId":"n:qualification:0000003","status":"complete"}},
+    {"id":"path-02","operation":"path","prompt":"Trace a path from qualification node 10 to node 15.","source":"qualification::Node0000010","target":"qualification::Node0000015","expected":{"firstNodeId":"n:qualification:0000010","lastNodeId":"n:qualification:0000015","status":"complete"}},
+    {"id":"path-03","operation":"path","prompt":"Trace a path from qualification node 90 to node 97.","source":"qualification::Node0000090","target":"qualification::Node0000097","expected":{"firstNodeId":"n:qualification:0000090","lastNodeId":"n:qualification:0000097","status":"complete"}},
+    {"id":"path-04","operation":"path","prompt":"Trace a path near the medium fixture midpoint.","source":"qualification::Node0049990","target":"qualification::Node0049995","expected":{"firstNodeId":"n:qualification:0049990","lastNodeId":"n:qualification:0049995","status":"complete"}},
+    {"id":"path-05","operation":"path","prompt":"Trace a path across the final ten qualification nodes.","source":"qualification::Node0099990","target":"qualification::Node0099999","expected":{"firstNodeId":"n:qualification:0099990","lastNodeId":"n:qualification:0099999","status":"complete"}},
+    {"id":"path-06","operation":"path","prompt":"Trace the direct first qualification call.","source":"qualification::Node0000000","target":"qualification::Node0000001","expected":{"firstNodeId":"n:qualification:0000000","lastNodeId":"n:qualification:0000001","minimumEdgeCount":1,"status":"complete"}}
+  ]
+}
diff --git a/benchmarks/qualification/current-engine-baseline-v1.json b/benchmarks/qualification/current-engine-baseline-v1.json
new file mode 100644
index 000000000..e417cf873
--- /dev/null
+++ b/benchmarks/qualification/current-engine-baseline-v1.json
@@ -0,0 +1,481 @@
+{
+  "binary": {
+    "buildCommand": "cargo build -p compass-cli --release --locked",
+    "bytes": 146726928,
+    "gzip9Bytes": 25945073,
+    "path": "target/release/compass",
+    "sha256": "b0f5bd6d1e052e702e7ea9bb0d821b64f79deb8759a3360f9228b0f19e432c2a",
+    "version": "compass 0.3.7"
+  },
+  "graph": {
+    "bytes": 220023199,
+    "edges": 250000,
+    "nodes": 100000,
+    "path": "target/qualification-c013/medium/graph.json",
+    "profile": "qualification-medium",
+    "sha256": "aca4e6a1a836780f4baa352c37469787be9815db19f8bf48e858cc87eeb4f054"
+  },
+  "host": {
+    "architecture": "arm64",
+    "cargo": "cargo 1.97.1 (c980f4866 2026-06-30)",
+    "operatingSystem": "macOS-26.7-arm64-arm-64bit",
+    "python": "3.12.8",
+    "rustc": "rustc 1.97.1 (8bab26f4f 2026-07-14)",
+    "zlib": "1.2.12"
+  },
+  "measurement": {
+    "condition": "separate CLI processes after one unmeasured cache warmup per query; cold-start is --version",
+    "p95Method": "nearest-rank",
+    "pathBound": "the legacy path command has no depth flag; the selected deterministic endpoints have an exact three-hop shortest path, the graph is capped at 100000 nodes/250000 edges/268435456 bytes, and the subprocess has an explicit timeout",
+    "samplesPerWorkload": 5,
+    "workloads": {
+      "callees": {
+        "command": [
+          "target/release/compass",
+          "callees",
+          "qualification::Node0000000",
+          "--graph",
+          "target/qualification-c013/medium/graph.json",
+          "--cache",
+          "target/qualification-c013/run-final11/query-cache",
+          "--engine",
+          "json",
+          "--format",
+          "json",
+          "--max-nodes",
+          "512",
+          "--max-edges",
+          "1024"
+        ],
+        "maximumPeakRssBytes": 897449984,
+        "p95WallMicroseconds": 11374780,
+        "samples": [
+          {
+            "iteration": 1,
+            "peakRssBytes": 897204224,
+            "stderrSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+            "stdoutSha256": "386a95d1c6fabdd332173c8cfc9341cf45aff0da92879766372784974a712037",
+            "systemMicroseconds": 3979114,
+            "userMicroseconds": 6877559,
+            "wallMicroseconds": 11374780
+          },
+          {
+            "iteration": 2,
+            "peakRssBytes": 897105920,
+            "stderrSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+            "stdoutSha256": "386a95d1c6fabdd332173c8cfc9341cf45aff0da92879766372784974a712037",
+            "systemMicroseconds": 3802237,
+            "userMicroseconds": 6836380,
+            "wallMicroseconds": 10758559
+          },
+          {
+            "iteration": 3,
+            "peakRssBytes": 897073152,
+            "stderrSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+            "stdoutSha256": "386a95d1c6fabdd332173c8cfc9341cf45aff0da92879766372784974a712037",
+            "systemMicroseconds": 3893896,
+            "userMicroseconds": 6848335,
+            "wallMicroseconds": 10966376
+          },
+          {
+            "iteration": 4,
+            "peakRssBytes": 897449984,
+            "stderrSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+            "stdoutSha256": "386a95d1c6fabdd332173c8cfc9341cf45aff0da92879766372784974a712037",
+            "systemMicroseconds": 3812524,
+            "userMicroseconds": 6794614,
+            "wallMicroseconds": 10779300
+          },
+          {
+            "iteration": 5,
+            "peakRssBytes": 897040384,
+            "stderrSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+            "stdoutSha256": "386a95d1c6fabdd332173c8cfc9341cf45aff0da92879766372784974a712037",
+            "systemMicroseconds": 3848105,
+            "userMicroseconds": 6862297,
+            "wallMicroseconds": 10823158
+          }
+        ]
+      },
+      "callers": {
+        "command": [
+          "target/release/compass",
+          "callers",
+          "qualification::Node0099999",
+          "--graph",
+          "target/qualification-c013/medium/graph.json",
+          "--cache",
+          "target/qualification-c013/run-final11/query-cache",
+          "--engine",
+          "json",
+          "--format",
+          "json",
+          "--max-nodes",
+          "512",
+          "--max-edges",
+          "1024"
+        ],
+        "maximumPeakRssBytes": 897433600,
+        "p95WallMicroseconds": 11360993,
+        "samples": [
+          {
+            "iteration": 1,
+            "peakRssBytes": 897400832,
+            "stderrSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+            "stdoutSha256": "b06dc3eb69e942fb436734dbd5fffd3ba273cf05197e7b0000de4f3abb9ea4c8",
+            "systemMicroseconds": 3967178,
+            "userMicroseconds": 6905359,
+            "wallMicroseconds": 11360993
+          },
+          {
+            "iteration": 2,
+            "peakRssBytes": 897236992,
+            "stderrSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+            "stdoutSha256": "b06dc3eb69e942fb436734dbd5fffd3ba273cf05197e7b0000de4f3abb9ea4c8",
+            "systemMicroseconds": 3893752,
+            "userMicroseconds": 6836360,
+            "wallMicroseconds": 10939130
+          },
+          {
+            "iteration": 3,
+            "peakRssBytes": 897433600,
+            "stderrSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+            "stdoutSha256": "b06dc3eb69e942fb436734dbd5fffd3ba273cf05197e7b0000de4f3abb9ea4c8",
+            "systemMicroseconds": 3844462,
+            "userMicroseconds": 6847208,
+            "wallMicroseconds": 10788777
+          },
+          {
+            "iteration": 4,
+            "peakRssBytes": 897302528,
+            "stderrSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+            "stdoutSha256": "b06dc3eb69e942fb436734dbd5fffd3ba273cf05197e7b0000de4f3abb9ea4c8",
+            "systemMicroseconds": 3986471,
+            "userMicroseconds": 6900156,
+            "wallMicroseconds": 11129216
+          },
+          {
+            "iteration": 5,
+            "peakRssBytes": 896909312,
+            "stderrSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+            "stdoutSha256": "b06dc3eb69e942fb436734dbd5fffd3ba273cf05197e7b0000de4f3abb9ea4c8",
+            "systemMicroseconds": 3942395,
+            "userMicroseconds": 6843136,
+            "wallMicroseconds": 11106294
+          }
+        ]
+      },
+      "cold-start": {
+        "command": [
+          "target/release/compass",
+          "--version"
+        ],
+        "maximumPeakRssBytes": 7897088,
+        "p95WallMicroseconds": 24687,
+        "samples": [
+          {
+            "iteration": 1,
+            "peakRssBytes": 7880704,
+            "stderrSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+            "stdoutSha256": "93d259f6847db2c79c9b3ac519e720695f787780addaf603ac1947b3e87e8b8a",
+            "systemMicroseconds": 5441,
+            "userMicroseconds": 4119,
+            "wallMicroseconds": 12864
+          },
+          {
+            "iteration": 2,
+            "peakRssBytes": 7897088,
+            "stderrSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+            "stdoutSha256": "93d259f6847db2c79c9b3ac519e720695f787780addaf603ac1947b3e87e8b8a",
+            "systemMicroseconds": 4993,
+            "userMicroseconds": 3929,
+            "wallMicroseconds": 12551
+          },
+          {
+            "iteration": 3,
+            "peakRssBytes": 7880704,
+            "stderrSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+            "stdoutSha256": "93d259f6847db2c79c9b3ac519e720695f787780addaf603ac1947b3e87e8b8a",
+            "systemMicroseconds": 5808,
+            "userMicroseconds": 4058,
+            "wallMicroseconds": 12733
+          },
+          {
+            "iteration": 4,
+            "peakRssBytes": 7880704,
+            "stderrSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+            "stdoutSha256": "93d259f6847db2c79c9b3ac519e720695f787780addaf603ac1947b3e87e8b8a",
+            "systemMicroseconds": 5298,
+            "userMicroseconds": 4394,
+            "wallMicroseconds": 24687
+          },
+          {
+            "iteration": 5,
+            "peakRssBytes": 7880704,
+            "stderrSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+            "stdoutSha256": "93d259f6847db2c79c9b3ac519e720695f787780addaf603ac1947b3e87e8b8a",
+            "systemMicroseconds": 5722,
+            "userMicroseconds": 4106,
+            "wallMicroseconds": 12512
+          }
+        ]
+      },
+      "impact-depth-3": {
+        "command": [
+          "target/release/compass",
+          "impact",
+          "qualification::Node0099999",
+          "--graph",
+          "target/qualification-c013/medium/graph.json",
+          "--cache",
+          "target/qualification-c013/run-final11/query-cache",
+          "--engine",
+          "json",
+          "--format",
+          "json",
+          "--max-depth",
+          "3",
+          "--max-nodes",
+          "512",
+          "--max-edges",
+          "1024"
+        ],
+        "maximumPeakRssBytes": 912834560,
+        "p95WallMicroseconds": 11238889,
+        "samples": [
+          {
+            "iteration": 1,
+            "peakRssBytes": 912556032,
+            "stderrSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+            "stdoutSha256": "44d8681bef2b77822534a765c746726721770a75ee301877533433f6bf4d733c",
+            "systemMicroseconds": 3775483,
+            "userMicroseconds": 6871869,
+            "wallMicroseconds": 10820324
+          },
+          {
+            "iteration": 2,
+            "peakRssBytes": 912326656,
+            "stderrSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+            "stdoutSha256": "44d8681bef2b77822534a765c746726721770a75ee301877533433f6bf4d733c",
+            "systemMicroseconds": 4085465,
+            "userMicroseconds": 6916774,
+            "wallMicroseconds": 11238889
+          },
+          {
+            "iteration": 3,
+            "peakRssBytes": 912834560,
+            "stderrSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+            "stdoutSha256": "44d8681bef2b77822534a765c746726721770a75ee301877533433f6bf4d733c",
+            "systemMicroseconds": 3803499,
+            "userMicroseconds": 6862434,
+            "wallMicroseconds": 10796899
+          },
+          {
+            "iteration": 4,
+            "peakRssBytes": 912310272,
+            "stderrSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+            "stdoutSha256": "44d8681bef2b77822534a765c746726721770a75ee301877533433f6bf4d733c",
+            "systemMicroseconds": 3715056,
+            "userMicroseconds": 6814713,
+            "wallMicroseconds": 10551383
+          },
+          {
+            "iteration": 5,
+            "peakRssBytes": 912179200,
+            "stderrSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+            "stdoutSha256": "44d8681bef2b77822534a765c746726721770a75ee301877533433f6bf4d733c",
+            "systemMicroseconds": 3823347,
+            "userMicroseconds": 6860237,
+            "wallMicroseconds": 10821145
+          }
+        ]
+      },
+      "path-depth-3": {
+        "command": [
+          "target/release/compass",
+          "path",
+          "qualification::Node0000000",
+          "qualification::Node0000009",
+          "--graph",
+          "target/qualification-c013/medium/graph.json"
+        ],
+        "maximumPeakRssBytes": 1990197248,
+        "p95WallMicroseconds": 3959473,
+        "samples": [
+          {
+            "iteration": 1,
+            "peakRssBytes": 1990197248,
+            "stderrSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+            "stdoutSha256": "7032c055af0cac1e830ba4c90931329ac08cfacbbfbd63448dbf8b8be7522c03",
+            "systemMicroseconds": 322885,
+            "userMicroseconds": 3675599,
+            "wallMicroseconds": 3819238
+          },
+          {
+            "iteration": 2,
+            "peakRssBytes": 1989869568,
+            "stderrSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+            "stdoutSha256": "7032c055af0cac1e830ba4c90931329ac08cfacbbfbd63448dbf8b8be7522c03",
+            "systemMicroseconds": 388227,
+            "userMicroseconds": 3633393,
+            "wallMicroseconds": 3959473
+          },
+          {
+            "iteration": 3,
+            "peakRssBytes": 1990000640,
+            "stderrSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+            "stdoutSha256": "7032c055af0cac1e830ba4c90931329ac08cfacbbfbd63448dbf8b8be7522c03",
+            "systemMicroseconds": 304893,
+            "userMicroseconds": 3658255,
+            "wallMicroseconds": 3826153
+          },
+          {
+            "iteration": 4,
+            "peakRssBytes": 1989984256,
+            "stderrSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+            "stdoutSha256": "7032c055af0cac1e830ba4c90931329ac08cfacbbfbd63448dbf8b8be7522c03",
+            "systemMicroseconds": 311894,
+            "userMicroseconds": 3641915,
+            "wallMicroseconds": 3788033
+          },
+          {
+            "iteration": 5,
+            "peakRssBytes": 1989984256,
+            "stderrSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+            "stdoutSha256": "7032c055af0cac1e830ba4c90931329ac08cfacbbfbd63448dbf8b8be7522c03",
+            "systemMicroseconds": 333078,
+            "userMicroseconds": 3631688,
+            "wallMicroseconds": 3953292
+          }
+        ]
+      },
+      "search": {
+        "command": [
+          "target/release/compass",
+          "search",
+          "qualification::Node0099999",
+          "--graph",
+          "target/qualification-c013/medium/graph.json",
+          "--cache",
+          "target/qualification-c013/run-final11/query-cache",
+          "--engine",
+          "json",
+          "--format",
+          "json",
+          "--max-candidates",
+          "256"
+        ],
+        "maximumPeakRssBytes": 898514944,
+        "p95WallMicroseconds": 11290305,
+        "samples": [
+          {
+            "iteration": 1,
+            "peakRssBytes": 897794048,
+            "stderrSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+            "stdoutSha256": "269d3ab3d4702e10a2f547b49225f9ae0675a5876b88fa14a956107573f4e3d5",
+            "systemMicroseconds": 3782533,
+            "userMicroseconds": 6851435,
+            "wallMicroseconds": 10751384
+          },
+          {
+            "iteration": 2,
+            "peakRssBytes": 898383872,
+            "stderrSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+            "stdoutSha256": "269d3ab3d4702e10a2f547b49225f9ae0675a5876b88fa14a956107573f4e3d5",
+            "systemMicroseconds": 3939847,
+            "userMicroseconds": 6877961,
+            "wallMicroseconds": 11144639
+          },
+          {
+            "iteration": 3,
+            "peakRssBytes": 898514944,
+            "stderrSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+            "stdoutSha256": "269d3ab3d4702e10a2f547b49225f9ae0675a5876b88fa14a956107573f4e3d5",
+            "systemMicroseconds": 4024556,
+            "userMicroseconds": 6914940,
+            "wallMicroseconds": 11290305
+          },
+          {
+            "iteration": 4,
+            "peakRssBytes": 898498560,
+            "stderrSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+            "stdoutSha256": "269d3ab3d4702e10a2f547b49225f9ae0675a5876b88fa14a956107573f4e3d5",
+            "systemMicroseconds": 3913710,
+            "userMicroseconds": 6882770,
+            "wallMicroseconds": 10854602
+          },
+          {
+            "iteration": 5,
+            "peakRssBytes": 897794048,
+            "stderrSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+            "stdoutSha256": "269d3ab3d4702e10a2f547b49225f9ae0675a5876b88fa14a956107573f4e3d5",
+            "systemMicroseconds": 3821390,
+            "userMicroseconds": 6870260,
+            "wallMicroseconds": 10780232
+          }
+        ]
+      }
+    }
+  },
+  "rawTraversal": {
+    "command": [
+      "python3",
+      "benchmarks/qualification/raw_traversal.py",
+      "--graph",
+      "target/qualification-c013/medium/graph.json",
+      "--tasks",
+      "benchmarks/qualification/agent-tasks-v1.json",
+      "--max-graph-bytes",
+      "268435456",
+      "--max-nodes",
+      "100000",
+      "--max-edges",
+      "250000",
+      "--max-depth",
+      "32",
+      "--max-results",
+      "10000",
+      "--timeout-seconds",
+      "120.0"
+    ],
+    "commandInterpreter": {
+      "measuredExecutableName": "python3",
+      "recordedLabel": "python3",
+      "versionField": "host.python"
+    },
+    "limits": {
+      "maxDepth": 32,
+      "maxEdges": 250000,
+      "maxGraphBytes": 268435456,
+      "maxNodes": 100000,
+      "maxResults": 10000,
+      "timeoutSeconds": 120.0
+    },
+    "oracleStatus": "PASS",
+    "peakRssBytes": 245694464,
+    "reportedElapsedMicroseconds": 35403471,
+    "schema": "compass.qualification-raw-traversal/1",
+    "taskCount": 30,
+    "taskMaximumMicroseconds": 14424,
+    "taskP95Microseconds": 14376,
+    "taskSuite": "agent-tasks-v1.json",
+    "wallMicroseconds": 35491798
+  },
+  "recordedAt": "2026-08-29T06:59:57.020677+00:00",
+  "schema": "compass.qualification-current-engine-baseline/1",
+  "source": {
+    "gitHead": "5ca57f2441b90a516eb2a4e78e1fb4e2d2d8269a",
+    "workspacePatchScope": ".cargo/config.toml Cargo.toml Cargo.lock rust-toolchain.toml crates vendor/compass-tree-sitter-language-pack vendor/gemm-common; SHA-256 of git diff --binary HEAD -- listed paths",
+    "workspacePatchSha256": "36b7ee3fee86566bcdade8c5ceabc8d6c87777751a388a53b223bf60646d7a42",
+    "workspaceTrackedBytes": 15797633,
+    "workspaceTrackedFiles": 612,
+    "workspaceTrackedSha256": "1aef77cf56564a7204cb40a5565defdf2c14e98fe3035b0254b372d9f66d291f",
+    "workspaceTreeBytes": 15944424,
+    "workspaceTreeFiles": 638,
+    "workspaceTreePolicy": "existing tracked plus non-ignored untracked files in scope",
+    "workspaceTreeSha256": "7ca61bcf300f16476cd09ee95918b5280dca5396d9b36ee64d5afb771a5843d2",
+    "workspaceUntrackedBytes": 146791,
+    "workspaceUntrackedFiles": 26,
+    "workspaceUntrackedSha256": "0c9a47f6eb5a82c7ea67dd6471cf57b0dda615a8b0f8a25a3d18602334530d32"
+  }
+}
diff --git a/benchmarks/qualification/generate_graph.py b/benchmarks/qualification/generate_graph.py
new file mode 100644
index 000000000..ec1a1c463
--- /dev/null
+++ b/benchmarks/qualification/generate_graph.py
@@ -0,0 +1,319 @@
+#!/usr/bin/env python3
+"""Generate deterministic, bounded Compass qualification graphs."""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+import json
+from pathlib import Path
+import sys
+from typing import BinaryIO, Iterable
+
+if __package__ in {None, ""}:
+    sys.path.insert(0, str(Path(__file__).resolve().parents[2]))
+
+from benchmarks.qualification.io import atomic_binary_writer, atomic_write_text
+
+SCHEMA = "compass.qualification-graph-generator/1"
+GRAPH_SCHEMA = "compass.graph/1"
+SOURCE_PATH = "qualification/generated.rs"
+EXTRACTOR = "compass.qualification.generator"
+MAX_NODES = 1_000_000
+MAX_EDGES = 2_500_000
+
+
+def _json_bytes(value: object) -> bytes:
+    return json.dumps(
+        value, ensure_ascii=False, separators=(",", ":"), sort_keys=True
+    ).encode("utf-8")
+
+
+def _stable_id(domain: str, values: Iterable[str]) -> str:
+    digest = hashlib.sha256()
+    for value in (GRAPH_SCHEMA, domain, *values):
+        encoded = value.encode("utf-8")
+        digest.update(len(encoded).to_bytes(8, "big"))
+        digest.update(encoded)
+    return f"sha256:{digest.hexdigest()}"
+
+
+def _node_id(index: int) -> str:
+    return f"n:qualification:{index:07d}"
+
+
+def _anchor(index: int) -> dict[str, object]:
+    return {
+        "file": SOURCE_PATH,
+        "startByte": index,
+        "endByte": index + 1,
+        "startLine": index + 1,
+        "startColumn": 0,
+        "endLine": index + 1,
+        "endColumn": 1,
+    }
+
+
+def _evidence(index: int) -> list[dict[str, object]]:
+    return [
+        {
+            "anchors": [_anchor(index)],
+            "confidence": "exact",
+            "extractor": EXTRACTOR,
+            "origin": "artifact",
+        }
+    ]
+
+
+def node_record(index: int) -> dict[str, object]:
+    anchor = _anchor(index)
+    return {
+        "evidence": _evidence(index),
+        "id": _node_id(index),
+        "kind": "function",
+        "language": "rust",
+        "name": f"Node{index:07d}",
+        "qualifiedName": f"qualification::Node{index:07d}",
+        "source": anchor,
+    }
+
+
+def edge_endpoints(ordinal: int, nodes: int) -> tuple[int, int]:
+    chain_edges = nodes - 1
+    if ordinal < chain_edges:
+        return ordinal, ordinal + 1
+    chord = ordinal - chain_edges
+    if chord == 0:
+        return 0, 1
+    source = (chord - 1) % nodes
+    band = (chord - 1) // nodes
+    offset = 2 + (band % (nodes - 2))
+    target = (source + offset) % nodes
+    return source, target
+
+
+def edge_record(ordinal: int, nodes: int) -> dict[str, object]:
+    source_index, target_index = edge_endpoints(ordinal, nodes)
+    source = _node_id(source_index)
+    target = _node_id(target_index)
+    anchor = _anchor(ordinal)
+    canonical_anchor = (
+        f"{SOURCE_PATH}:{ordinal}:{ordinal + 1}:"
+        f"{ordinal + 1}:0:{ordinal + 1}:1"
+    )
+    edge_id = _stable_id(
+        "edge", (source, "calls", target, canonical_anchor, "")
+    )
+    return {
+        "evidence": _evidence(ordinal),
+        "id": edge_id,
+        "key": edge_id,
+        "kind": "calls",
+        "relationshipSite": anchor,
+        "source": source,
+        "target": target,
+        "weight": 1.0,
+    }
+
+
+def _profile(path: Path, name: str) -> dict[str, object]:
+    document = json.loads(path.read_text(encoding="utf-8"))
+    if document.get("schema") != "compass.qualification-profiles/1":
+        raise ValueError(f"unsupported profile schema in {path}")
+    profiles = document.get("profiles")
+    if not isinstance(profiles, list):
+        raise ValueError("profiles document requires a profiles array")
+    if any(not isinstance(item, dict) for item in profiles):
+        raise ValueError("profile entries must be objects")
+    matches = [item for item in profiles if item.get("name") == name]
+    if len(matches) != 1:
+        raise ValueError(f"profile {name!r} must resolve exactly once")
+    profile = matches[0]
+    profile_name = profile.get("name")
+    nodes_value = profile.get("nodes")
+    edges_value = profile.get("edges")
+    if not isinstance(profile_name, str) or not profile_name:
+        raise ValueError("profile name must be a non-empty string")
+    if isinstance(nodes_value, bool) or not isinstance(nodes_value, int):
+        raise ValueError(f"profile {profile_name!r} nodes must be an integer")
+    if isinstance(edges_value, bool) or not isinstance(edges_value, int):
+        raise ValueError(f"profile {profile_name!r} edges must be an integer")
+    nodes = nodes_value
+    edges = edges_value
+    if nodes < 3 or nodes > MAX_NODES:
+        raise ValueError(f"nodes must be in 3..={MAX_NODES}")
+    if edges < nodes or edges > MAX_EDGES:
+        raise ValueError(f"edges must be in nodes..={MAX_EDGES}")
+    sample_ordinals = profile.get("sampleOrdinals", [])
+    if not isinstance(sample_ordinals, list):
+        raise ValueError("sampleOrdinals must be an array")
+    for value in sample_ordinals:
+        if isinstance(value, bool) or not isinstance(value, int):
+            raise ValueError("sampleOrdinals must contain integers")
+        if value < 0 or value >= nodes:
+            raise ValueError(f"sample ordinal {value} must be in 0..{nodes - 1}")
+    return profile
+
+
+def _write_array(stream: BinaryIO, records: Iterable[dict[str, object]]) -> str:
+    digest = hashlib.sha256()
+    first = True
+    for record in records:
+        encoded = _json_bytes(record)
+        digest.update(len(encoded).to_bytes(8, "big"))
+        digest.update(encoded)
+        if not first:
+            stream.write(b",")
+        stream.write(encoded)
+        first = False
+    return digest.hexdigest()
+
+
+def _logical_digest(records: Iterable[dict[str, object]]) -> str:
+    digest = hashlib.sha256()
+    for record in records:
+        encoded = _json_bytes(record)
+        digest.update(len(encoded).to_bytes(8, "big"))
+        digest.update(encoded)
+    return digest.hexdigest()
+
+
+def _file_sha256(path: Path) -> str:
+    digest = hashlib.sha256()
+    with path.open("rb") as stream:
+        for chunk in iter(lambda: stream.read(1024 * 1024), b""):
+            digest.update(chunk)
+    return digest.hexdigest()
+
+
+def generation_metadata(profile: dict[str, object], *, complete: bool) -> dict[str, object]:
+    nodes = int(profile["nodes"])
+    edges = int(profile["edges"])
+    samples = [int(value) for value in profile.get("sampleOrdinals", [])]
+    metadata: dict[str, object] = {
+        "schema": SCHEMA,
+        "profile": profile["name"],
+        "nodes": nodes,
+        "edges": edges,
+        "topology": {
+            "chainEdges": nodes - 1,
+            "parallelEdge": {"ordinal": nodes - 1, "source": 0, "target": 1},
+            "chordFormula": "source=(chord-1)%nodes; offset=2+(((chord-1)//nodes)%(nodes-2)); target=(source+offset)%nodes",
+        },
+        "sampleNodes": [node_record(value) for value in samples],
+        "sampleEdges": [edge_record(value, nodes) for value in samples],
+        "completeLogicalDigests": complete,
+    }
+    if complete:
+        metadata["nodeRecordsSha256"] = _logical_digest(
+            node_record(index) for index in range(nodes)
+        )
+        metadata["edgeRecordsSha256"] = _logical_digest(
+            edge_record(index, nodes) for index in range(edges)
+        )
+    return metadata
+
+
+def write_graph(path: Path, profile: dict[str, object]) -> dict[str, object]:
+    nodes = int(profile["nodes"])
+    edges = int(profile["edges"])
+    file_size = max(nodes, edges) + 1
+    file_id = _stable_id("file", (SOURCE_PATH,))
+    metadata = {
+        "schema": GRAPH_SCHEMA,
+        "build": {
+            "builderVersion": SCHEMA,
+            "schemaFingerprint": _stable_id("qualification", ("schema-v1",)),
+            "sourceTreeDigest": _stable_id("qualification", (str(profile["name"]),)),
+            "configurationDigest": _stable_id("qualification", ("profiles-v1",)),
+            "generationId": _stable_id(
+                "qualification", (str(profile["name"]), str(nodes), str(edges))
+            ),
+        },
+        "files": [
+            {
+                "byteSize": file_size,
+                "contentDigest": _stable_id(
+                    "qualification",
+                    ("generated-source", str(profile["name"]), str(nodes), str(edges)),
+                ),
+                "extractionStatus": "generated",
+                "extractorVersions": [SCHEMA],
+                "generated": True,
+                "id": file_id,
+                "language": "rust",
+                "path": SOURCE_PATH,
+            }
+        ],
+    }
+    with atomic_binary_writer(path) as stream:
+        stream.write(b'{"directed":true,"graph":')
+        stream.write(_json_bytes(metadata))
+        stream.write(b',"links":[')
+        edge_digest = _write_array(
+            stream, (edge_record(index, nodes) for index in range(edges))
+        )
+        stream.write(b'],"multigraph":true,"nodes":[')
+        node_digest = _write_array(stream, (node_record(index) for index in range(nodes)))
+        stream.write(b"]}\n")
+    result = generation_metadata(profile, complete=False)
+    result.update(
+        {
+            "graphBytes": path.stat().st_size,
+            "graphSha256": _file_sha256(path),
+            "nodeRecordsSha256": node_digest,
+            "edgeRecordsSha256": edge_digest,
+            "completeLogicalDigests": True,
+        }
+    )
+    return result
+
+
+def parse_args(argv: list[str]) -> argparse.Namespace:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--profile", required=True)
+    parser.add_argument(
+        "--profiles",
+        type=Path,
+        default=Path(__file__).with_name("profiles-v1.json"),
+    )
+    parser.add_argument("--output", type=Path)
+    parser.add_argument("--metadata-output", type=Path)
+    parser.add_argument(
+        "--plan-only",
+        action="store_true",
+        help="Validate counts/topology and emit samples without iterating every record",
+    )
+    parser.add_argument(
+        "--metadata-only",
+        action="store_true",
+        help="Iterate every record and emit logical digests without a graph file",
+    )
+    args = parser.parse_args(argv)
+    modes = sum((args.output is not None, args.plan_only, args.metadata_only))
+    if modes != 1:
+        parser.error("choose exactly one of --output, --plan-only, or --metadata-only")
+    return args
+
+
+def main(argv: list[str] | None = None) -> int:
+    args = parse_args(sys.argv[1:] if argv is None else argv)
+    profile = _profile(args.profiles, args.profile)
+    if args.output is not None:
+        metadata = write_graph(args.output, profile)
+    else:
+        metadata = generation_metadata(profile, complete=args.metadata_only)
+    payload = json.dumps(metadata, indent=2, sort_keys=True) + "\n"
+    if args.metadata_output is None:
+        sys.stdout.write(payload)
+    else:
+        atomic_write_text(args.metadata_output, payload)
+    return 0
+
+
+if __name__ == "__main__":
+    try:
+        raise SystemExit(main())
+    except (KeyError, OSError, TypeError, ValueError, json.JSONDecodeError) as error:
+        print(f"graph generation failed: {error}", file=sys.stderr)
+        raise SystemExit(2) from error
diff --git a/benchmarks/qualification/io.py b/benchmarks/qualification/io.py
new file mode 100644
index 000000000..9203948e3
--- /dev/null
+++ b/benchmarks/qualification/io.py
@@ -0,0 +1,45 @@
+"""Crash-safe publication helpers for qualification evidence."""
+
+from __future__ import annotations
+
+from contextlib import contextmanager
+import os
+from pathlib import Path
+import tempfile
+from typing import BinaryIO, Iterator
+
+
+def _sync_directory(path: Path) -> None:
+    if os.name == "nt":
+        return
+    directory_descriptor = os.open(path, os.O_RDONLY)
+    try:
+        os.fsync(directory_descriptor)
+    finally:
+        os.close(directory_descriptor)
+
+
+@contextmanager
+def atomic_binary_writer(path: Path) -> Iterator[BinaryIO]:
+    """Yield a binary stream and publish it atomically only after success."""
+    path.parent.mkdir(parents=True, exist_ok=True)
+    descriptor, temporary_name = tempfile.mkstemp(
+        prefix=f".{path.name}.", suffix=".tmp", dir=path.parent
+    )
+    temporary = Path(temporary_name)
+    try:
+        with os.fdopen(descriptor, "wb") as stream:
+            yield stream
+            stream.flush()
+            os.fsync(stream.fileno())
+        os.replace(temporary, path)
+        _sync_directory(path.parent)
+    finally:
+        if temporary.exists():
+            temporary.unlink()
+
+
+def atomic_write_text(path: Path, content: str) -> None:
+    """Publish UTF-8 text atomically after flushing file and directory state."""
+    with atomic_binary_writer(path) as stream:
+        stream.write(content.encode("utf-8"))
diff --git a/benchmarks/qualification/manifest-v1.json b/benchmarks/qualification/manifest-v1.json
new file mode 100644
index 000000000..c60b02b8b
--- /dev/null
+++ b/benchmarks/qualification/manifest-v1.json
@@ -0,0 +1,92 @@
+{
+  "schema": "compass.qualification-manifest/1",
+  "artifacts": [
+    {
+      "bytes": 5291,
+      "path": "benchmarks/qualification/README.md",
+      "sha256": "75099e812e2b9879f41fa74c30dcdbd5e79b221cdfa4d16e2daaa78144fdeb67"
+    },
+    {
+      "bytes": 7866,
+      "path": "benchmarks/qualification/agent-tasks-v1.json",
+      "sha256": "54d2a83f3979dfaa1faa3ec32cb492ef9f9d4e6f24d3ab0407b62515848449d4"
+    },
+    {
+      "bytes": 18737,
+      "path": "benchmarks/qualification/current-engine-baseline-v1.json",
+      "sha256": "cde033262bbe29f62199553ad16c6b626048befcd22d8d62abb7f2a0d64708e6"
+    },
+    {
+      "bytes": 11092,
+      "path": "benchmarks/qualification/generate_graph.py",
+      "sha256": "2f40402f2f7d22cdb03ce32b79763db103a02414edb701904f7fe86c954caaa7"
+    },
+    {
+      "bytes": 1362,
+      "path": "benchmarks/qualification/io.py",
+      "sha256": "f6f1afca74a76886c05ed01c6a9ec815f24a163bcbcf49aa2cc7ae09a64643c6"
+    },
+    {
+      "bytes": 366,
+      "path": "benchmarks/qualification/profiles-v1.json",
+      "sha256": "c8e1ffe0fe8ba3cdac2153915f112c64e66094629de3eefcd582dad3fee0da99"
+    },
+    {
+      "bytes": 24693,
+      "path": "benchmarks/qualification/raw-traversal-oracle-v1.json",
+      "sha256": "42b3c959da80cefdc4db25c4ef6409234152aba490b1a8955ce0fe2af3dec843"
+    },
+    {
+      "bytes": 17473,
+      "path": "benchmarks/qualification/raw_traversal.py",
+      "sha256": "2d96d30eaa7d9a19bb8b1674569cd9b529f1e1989dc7617dcbf6fdba542ac407"
+    },
+    {
+      "bytes": 25307,
+      "path": "benchmarks/qualification/run_current_baseline.py",
+      "sha256": "a88e6a970ba6afc3afcd3f6ef769e66ba5436b0a4c34a612bc0e9c3da2176b88"
+    },
+    {
+      "bytes": 808,
+      "path": "benchmarks/qualification/scale-profile-digests-v1.json",
+      "sha256": "5629ecf406b893460868fe2fd0f1f8fc2b04796d74e70b1dee51e6c84649da7f"
+    },
+    {
+      "bytes": 863,
+      "path": "benchmarks/qualification/semantic-corpus-v1.json",
+      "sha256": "7427792156d310efde773c92a5b11a51058be45e9f2aa3dab3ea2061b43929c4"
+    },
+    {
+      "bytes": 997,
+      "path": "benchmarks/qualification/skill-corpora-v1.json",
+      "sha256": "38b50957f87a6d8d27d3ac4a0a929b6a53382cb42f15311dfa24229526c7deae"
+    },
+    {
+      "bytes": 5745,
+      "path": "benchmarks/qualification/surreal-dual-engine-decision-v1.json",
+      "sha256": "294c46930b7dde2803b2124e18ae0db29a7b96e9ccaab98c882882b26b276c97"
+    },
+    {
+      "bytes": 5492,
+      "path": "benchmarks/qualification/tests/test_corpora.py",
+      "sha256": "8feebde294cc2a9e9aea7b638181a2e9b54a5c79296baedcd2faedb759075dd3"
+    },
+    {
+      "bytes": 12333,
+      "path": "benchmarks/qualification/tests/test_current_baseline.py",
+      "sha256": "529da0bdba1ddc1ff950b1b219712f3ed887450454c1f7839aa3c7a9dda4c82b"
+    },
+    {
+      "bytes": 7411,
+      "path": "benchmarks/qualification/tests/test_generate_graph.py",
+      "sha256": "220359eb4b57335474a28a74d057150372cebf3aebd7c4078d6a30cfd0b22619"
+    },
+    {
+      "bytes": 12098,
+      "path": "benchmarks/qualification/tests/test_raw_traversal.py",
+      "sha256": "d92848d6c9ccbf40e9b6f3a8324caced451b7c8681d8be3d5e82edd15bba3332"
+    }
+  ],
+  "decisionDate": "2026-08-28",
+  "profileSchema": "compass.qualification-profiles/1"
+}
diff --git a/benchmarks/qualification/profiles-v1.json b/benchmarks/qualification/profiles-v1.json
new file mode 100644
index 000000000..718832858
--- /dev/null
+++ b/benchmarks/qualification/profiles-v1.json
@@ -0,0 +1,17 @@
+{
+  "schema": "compass.qualification-profiles/1",
+  "profiles": [
+    {
+      "name": "qualification-medium",
+      "nodes": 100000,
+      "edges": 250000,
+      "sampleOrdinals": [0, 1, 97, 50000, 99999]
+    },
+    {
+      "name": "qualification-large",
+      "nodes": 1000000,
+      "edges": 2500000,
+      "sampleOrdinals": [0, 1, 97, 500000, 999999]
+    }
+  ]
+}
diff --git a/benchmarks/qualification/raw-traversal-oracle-v1.json b/benchmarks/qualification/raw-traversal-oracle-v1.json
new file mode 100644
index 000000000..62b5f7dff
--- /dev/null
+++ b/benchmarks/qualification/raw-traversal-oracle-v1.json
@@ -0,0 +1,605 @@
+{
+  "schema": "compass.qualification-raw-oracle/1",
+  "graph": {
+    "profile": "qualification-medium",
+    "sha256": "aca4e6a1a836780f4baa352c37469787be9815db19f8bf48e858cc87eeb4f054",
+    "nodes": 100000,
+    "edges": 250000
+  },
+  "taskSuite": {
+    "path": "benchmarks/qualification/agent-tasks-v1.json",
+    "sha256": "54d2a83f3979dfaa1faa3ec32cb492ef9f9d4e6f24d3ab0407b62515848449d4"
+  },
+  "results": [
+    {
+      "id": "search-01",
+      "result": {
+        "nodeIds": [
+          "n:qualification:0000000"
+        ],
+        "status": "complete"
+      }
+    },
+    {
+      "id": "search-02",
+      "result": {
+        "nodeIds": [
+          "n:qualification:0000001"
+        ],
+        "status": "complete"
+      }
+    },
+    {
+      "id": "search-03",
+      "result": {
+        "nodeIds": [
+          "n:qualification:0000097"
+        ],
+        "status": "complete"
+      }
+    },
+    {
+      "id": "search-04",
+      "result": {
+        "nodeIds": [
+          "n:qualification:0050000"
+        ],
+        "status": "complete"
+      }
+    },
+    {
+      "id": "search-05",
+      "result": {
+        "nodeIds": [
+          "n:qualification:0099998"
+        ],
+        "status": "complete"
+      }
+    },
+    {
+      "id": "search-06",
+      "result": {
+        "nodeIds": [
+          "n:qualification:0099999"
+        ],
+        "status": "complete"
+      }
+    },
+    {
+      "id": "callers-01",
+      "result": {
+        "edgeIds": [
+          "sha256:a875937233352d8c57a2f3ff438530622e2f7a65ccdedc23e0f74f504d33c09c",
+          "sha256:e88c926623f6e55b58d7269127cab9c6d96d16d53141cc89696a55feb4d0b4e6",
+          "sha256:2543ed3e6c133a4528b0618f74ba10b26a93db4e5dfbf8ec57552c5be0d22642"
+        ],
+        "nodeIds": [
+          "n:qualification:0000000",
+          "n:qualification:0000000",
+          "n:qualification:0099999"
+        ],
+        "status": "complete"
+      }
+    },
+    {
+      "id": "callers-02",
+      "result": {
+        "edgeIds": [
+          "sha256:7f387af32a581fea4fa0a97b50a6c826db78b28941525ada1e79563e16517aae",
+          "sha256:6725a8f34f774b50e4a032d8afc149518c0500a67ea696a1af2d9554863c09c4"
+        ],
+        "nodeIds": [
+          "n:qualification:0000000",
+          "n:qualification:0000001"
+        ],
+        "status": "complete"
+      }
+    },
+    {
+      "id": "callers-03",
+      "result": {
+        "edgeIds": [
+          "sha256:af9235a444d55c8c2101833c01e0ff342ef87c7c4c303b340c97c339a9d44884",
+          "sha256:4e18bcf0c92fbcd38b065232ae95b16740da2496f8c318427f7561497aacf7b5",
+          "sha256:0a0cb1b3c5cc213872441c5a49dda35563f550a854cdc22215430af43e367578"
+        ],
+        "nodeIds": [
+          "n:qualification:0000094",
+          "n:qualification:0000095",
+          "n:qualification:0000096"
+        ],
+        "status": "complete"
+      }
+    },
+    {
+      "id": "callers-04",
+      "result": {
+        "edgeIds": [
+          "sha256:0d380588928648c6380bd63e2c6ec62642eec3817139a612cf56142dda58cfce",
+          "sha256:35515707f80bf14aa5fe633883a2d535277b742b242bcc4d567f04a06b600961",
+          "sha256:e0c791fbabfc36fca0d296976c5c465db7f0788d30d99772f82f9d116bf78552"
+        ],
+        "nodeIds": [
+          "n:qualification:0049997",
+          "n:qualification:0049998",
+          "n:qualification:0049999"
+        ],
+        "status": "complete"
+      }
+    },
+    {
+      "id": "callers-05",
+      "result": {
+        "edgeIds": [
+          "sha256:1fabc2f3c65562f1a18b03a4bfee98ee741ad87f7f80603ee7dde1140d79ec46",
+          "sha256:960f0b53a679dfbf1b1996f7526d2af02f3d36774031ff0b3bdf413494baf8fc"
+        ],
+        "nodeIds": [
+          "n:qualification:0099996",
+          "n:qualification:0099997"
+        ],
+        "status": "complete"
+      }
+    },
+    {
+      "id": "callers-06",
+      "result": {
+        "edgeIds": [
+          "sha256:96941b406d0b5890f112c41cdab0134f24ec5df923780532123bcda09769e1e9",
+          "sha256:acc63a4c678e8d2f2209b708fc04663be8f658fd5a0a88020fc97a0531dc8b88"
+        ],
+        "nodeIds": [
+          "n:qualification:0099997",
+          "n:qualification:0099998"
+        ],
+        "status": "complete"
+      }
+    },
+    {
+      "id": "callees-01",
+      "result": {
+        "edgeIds": [
+          "sha256:a875937233352d8c57a2f3ff438530622e2f7a65ccdedc23e0f74f504d33c09c",
+          "sha256:e88c926623f6e55b58d7269127cab9c6d96d16d53141cc89696a55feb4d0b4e6",
+          "sha256:7f387af32a581fea4fa0a97b50a6c826db78b28941525ada1e79563e16517aae",
+          "sha256:70cefbebf854f4b4b3dc86f3d2c4c5441deab9bd5be08dbdaed089f41ba20a27"
+        ],
+        "nodeIds": [
+          "n:qualification:0000001",
+          "n:qualification:0000001",
+          "n:qualification:0000002",
+          "n:qualification:0000003"
+        ],
+        "status": "complete"
+      }
+    },
+    {
+      "id": "callees-02",
+      "result": {
+        "edgeIds": [
+          "sha256:6725a8f34f774b50e4a032d8afc149518c0500a67ea696a1af2d9554863c09c4",
+          "sha256:4ace0cd2e83b7afb711979f628c12212d284dd1e9af04678115d49fc9c8d71a0",
+          "sha256:cd38be0869060fe63385163ddb9875dadd2e496d874c62dbf41433b10d907e32"
+        ],
+        "nodeIds": [
+          "n:qualification:0000002",
+          "n:qualification:0000003",
+          "n:qualification:0000004"
+        ],
+        "status": "complete"
+      }
+    },
+    {
+      "id": "callees-03",
+      "result": {
+        "edgeIds": [
+          "sha256:0a0cb1b3c5cc213872441c5a49dda35563f550a854cdc22215430af43e367578",
+          "sha256:c7131e58591ca44e62f354134064449981420e945b636714b31834b2001c34de",
+          "sha256:d8e4d9a97414afae9cd7952fbed903a4b58d8ca8ea4eedeffa886f4683764f9c"
+        ],
+        "nodeIds": [
+          "n:qualification:0000097",
+          "n:qualification:0000098",
+          "n:qualification:0000099"
+        ],
+        "status": "complete"
+      }
+    },
+    {
+      "id": "callees-04",
+      "result": {
+        "edgeIds": [
+          "sha256:e0c791fbabfc36fca0d296976c5c465db7f0788d30d99772f82f9d116bf78552",
+          "sha256:f8683f274486ab84c62a24900546f8f9f4410382144eb982e2fc3ea179284cb7",
+          "sha256:0f0eb7565fdab59b017647fd621a9cccdd6b1be12519936252cb951c0f494efe"
+        ],
+        "nodeIds": [
+          "n:qualification:0050000",
+          "n:qualification:0050001",
+          "n:qualification:0050002"
+        ],
+        "status": "complete"
+      }
+    },
+    {
+      "id": "callees-05",
+      "result": {
+        "edgeIds": [
+          "sha256:960f0b53a679dfbf1b1996f7526d2af02f3d36774031ff0b3bdf413494baf8fc",
+          "sha256:96941b406d0b5890f112c41cdab0134f24ec5df923780532123bcda09769e1e9"
+        ],
+        "nodeIds": [
+          "n:qualification:0099998",
+          "n:qualification:0099999"
+        ],
+        "status": "complete"
+      }
+    },
+    {
+      "id": "callees-06",
+      "result": {
+        "edgeIds": [
+          "sha256:cc7505fc2658e46c31281a938c401592da290466d5d3a1145ac5d55b1174d985",
+          "sha256:acc63a4c678e8d2f2209b708fc04663be8f658fd5a0a88020fc97a0531dc8b88"
+        ],
+        "nodeIds": [
+          "n:qualification:0000000",
+          "n:qualification:0099999"
+        ],
+        "status": "complete"
+      }
+    },
+    {
+      "id": "impact-01",
+      "result": {
+        "edgeIds": [
+          "sha256:1fabc2f3c65562f1a18b03a4bfee98ee741ad87f7f80603ee7dde1140d79ec46",
+          "sha256:2543ed3e6c133a4528b0618f74ba10b26a93db4e5dfbf8ec57552c5be0d22642",
+          "sha256:4ace0cd2e83b7afb711979f628c12212d284dd1e9af04678115d49fc9c8d71a0",
+          "sha256:6725a8f34f774b50e4a032d8afc149518c0500a67ea696a1af2d9554863c09c4",
+          "sha256:70cefbebf854f4b4b3dc86f3d2c4c5441deab9bd5be08dbdaed089f41ba20a27",
+          "sha256:7f387af32a581fea4fa0a97b50a6c826db78b28941525ada1e79563e16517aae",
+          "sha256:960f0b53a679dfbf1b1996f7526d2af02f3d36774031ff0b3bdf413494baf8fc",
+          "sha256:96941b406d0b5890f112c41cdab0134f24ec5df923780532123bcda09769e1e9",
+          "sha256:a875937233352d8c57a2f3ff438530622e2f7a65ccdedc23e0f74f504d33c09c",
+          "sha256:acc63a4c678e8d2f2209b708fc04663be8f658fd5a0a88020fc97a0531dc8b88",
+          "sha256:cc7505fc2658e46c31281a938c401592da290466d5d3a1145ac5d55b1174d985",
+          "sha256:e18c7bedf2ef5f2972e554093f6644252d430cb06d4848ed6e9bdf8a464c0f36",
+          "sha256:e88c926623f6e55b58d7269127cab9c6d96d16d53141cc89696a55feb4d0b4e6"
+        ],
+        "nodeIds": [
+          "n:qualification:0000000",
+          "n:qualification:0000001",
+          "n:qualification:0000002",
+          "n:qualification:0000003",
+          "n:qualification:0099996",
+          "n:qualification:0099997",
+          "n:qualification:0099998",
+          "n:qualification:0099999"
+        ],
+        "status": "complete"
+      }
+    },
+    {
+      "id": "impact-02",
+      "result": {
+        "edgeIds": [
+          "sha256:0a0cb1b3c5cc213872441c5a49dda35563f550a854cdc22215430af43e367578",
+          "sha256:12dbdc27bfa9ce8532855b4756ec0f0ae2a25b2b47afc2d6228527765f9a3b1b",
+          "sha256:29e4f810711486085360a2868e13dd5aa197cae8c2bcd868091f99a101c41d62",
+          "sha256:349e8b5c1ffd3a5363e5e387bea9f59a9afa981821b0b93fb4a7eab9c8058983",
+          "sha256:43f4ef1f1c196bc0a77a5491f161574e76cb01639df0f84b6ab71afa0e866c0b",
+          "sha256:4e18bcf0c92fbcd38b065232ae95b16740da2496f8c318427f7561497aacf7b5",
+          "sha256:50cb646b00a621a15b51ec5bb8bdcfb43fc872662b9700df3bf156a682ac9abe",
+          "sha256:531847d742b0a64dcc744f44949676f290d106569fe49afb4b008dafe938543e",
+          "sha256:57d88332bf703025e589b8111c0302997dbfa2a9383eb63a5f5afdcb0b1cde2a",
+          "sha256:68271ccfb4c1feea4ec760487d6f778c57fe9620b626863ddf0eabc51fc631c7",
+          "sha256:6b2ff3b2b28ef677b7f150ba97496ac867e42b9a78cd0a8fae977f1bc179bfb4",
+          "sha256:79589f4702ccd11c274fd88c05063d828e9955834d2c9c3e1c56ef3d551c7ec3",
+          "sha256:842550fd2dea271fc19f4ec71171daf4dbd2af668910d9492dac49e887f4316a",
+          "sha256:91e15f9b6d6b1c0b88e4fe094f6f324c4e66f4541432c103498002995e7929c9",
+          "sha256:af9235a444d55c8c2101833c01e0ff342ef87c7c4c303b340c97c339a9d44884",
+          "sha256:c0e08b0a12e3ce16f7734c74e7a12d666158502fb1b9343d8ed2481ee4e39bd9",
+          "sha256:c4224c4d6f01bb9b63f6251dbec8652e8249f3da5e3fd93e6c33792f7ccc7907",
+          "sha256:d1086e61017ad346e9e3866f55d8e555a2ea49f827cfc9d85726373ddd379840",
+          "sha256:d5903676044b79744c8d30d5679ca704a4f4b41b3347e55e01400c684d12a8fe",
+          "sha256:e326564d0f08c0a4ed97a5932872af68be46b25d778883e2d3cb11ed2564ace6",
+          "sha256:f0646203ab0eacf035241ca32d43e1509627ec2d9538c057a4df512695e9398e"
+        ],
+        "nodeIds": [
+          "n:qualification:0000088",
+          "n:qualification:0000089",
+          "n:qualification:0000090",
+          "n:qualification:0000091",
+          "n:qualification:0000092",
+          "n:qualification:0000093",
+          "n:qualification:0000094",
+          "n:qualification:0000095",
+          "n:qualification:0000096",
+          "n:qualification:0000097"
+        ],
+        "status": "complete"
+      }
+    },
+    {
+      "id": "impact-03",
+      "result": {
+        "edgeIds": [
+          "sha256:0305635a3225a6c850d3b30ca0bae11058d11123b72a5cb5eae141518f927847",
+          "sha256:041e9ca382b783636651ed03d6454e8aa6b3a879c6c017dce06a8d6c1bdbb987",
+          "sha256:0a0cb1b3c5cc213872441c5a49dda35563f550a854cdc22215430af43e367578",
+          "sha256:12dbdc27bfa9ce8532855b4756ec0f0ae2a25b2b47afc2d6228527765f9a3b1b",
+          "sha256:23831304f7b5e78adfed0b70598ab18ab473173be652c0fc2d371a98408aeb2d",
+          "sha256:29e4f810711486085360a2868e13dd5aa197cae8c2bcd868091f99a101c41d62",
+          "sha256:349e8b5c1ffd3a5363e5e387bea9f59a9afa981821b0b93fb4a7eab9c8058983",
+          "sha256:43f4ef1f1c196bc0a77a5491f161574e76cb01639df0f84b6ab71afa0e866c0b",
+          "sha256:4e18bcf0c92fbcd38b065232ae95b16740da2496f8c318427f7561497aacf7b5",
+          "sha256:50cb646b00a621a15b51ec5bb8bdcfb43fc872662b9700df3bf156a682ac9abe",
+          "sha256:531847d742b0a64dcc744f44949676f290d106569fe49afb4b008dafe938543e",
+          "sha256:57d88332bf703025e589b8111c0302997dbfa2a9383eb63a5f5afdcb0b1cde2a",
+          "sha256:68271ccfb4c1feea4ec760487d6f778c57fe9620b626863ddf0eabc51fc631c7",
+          "sha256:6b22c24e2556bf5032a63fe33ee3a07b05f64a8362df9118d209897fa3697e7a",
+          "sha256:6b2ff3b2b28ef677b7f150ba97496ac867e42b9a78cd0a8fae977f1bc179bfb4",
+          "sha256:79589f4702ccd11c274fd88c05063d828e9955834d2c9c3e1c56ef3d551c7ec3",
+          "sha256:842550fd2dea271fc19f4ec71171daf4dbd2af668910d9492dac49e887f4316a",
+          "sha256:91e15f9b6d6b1c0b88e4fe094f6f324c4e66f4541432c103498002995e7929c9",
+          "sha256:a61cbc1bb7f46a5fc53acc3e3586f71a7f08de2bde04c792a5a982708eece9b1",
+          "sha256:af9235a444d55c8c2101833c01e0ff342ef87c7c4c303b340c97c339a9d44884",
+          "sha256:b6d2a5332e7242efa01bfaacfe6e3b2e32e1e549048c027b761d6032a552b885",
+          "sha256:c0e08b0a12e3ce16f7734c74e7a12d666158502fb1b9343d8ed2481ee4e39bd9",
+          "sha256:c4224c4d6f01bb9b63f6251dbec8652e8249f3da5e3fd93e6c33792f7ccc7907",
+          "sha256:c7131e58591ca44e62f354134064449981420e945b636714b31834b2001c34de",
+          "sha256:d1086e61017ad346e9e3866f55d8e555a2ea49f827cfc9d85726373ddd379840",
+          "sha256:d5903676044b79744c8d30d5679ca704a4f4b41b3347e55e01400c684d12a8fe",
+          "sha256:d8e4d9a97414afae9cd7952fbed903a4b58d8ca8ea4eedeffa886f4683764f9c",
+          "sha256:e326564d0f08c0a4ed97a5932872af68be46b25d778883e2d3cb11ed2564ace6",
+          "sha256:f0646203ab0eacf035241ca32d43e1509627ec2d9538c057a4df512695e9398e",
+          "sha256:fa5b6fc02681bc24eaa4b431b0ccc6a88b8459aab96050170bef3201aee4235b"
+        ],
+        "nodeIds": [
+          "n:qualification:0000088",
+          "n:qualification:0000089",
+          "n:qualification:0000090",
+          "n:qualification:0000091",
+          "n:qualification:0000092",
+          "n:qualification:0000093",
+          "n:qualification:0000094",
+          "n:qualification:0000095",
+          "n:qualification:0000096",
+          "n:qualification:0000097",
+          "n:qualification:0000098",
+          "n:qualification:0000099",
+          "n:qualification:0000100"
+        ],
+        "status": "complete"
+      }
+    },
+    {
+      "id": "impact-04",
+      "result": {
+        "edgeIds": [
+          "sha256:08b9d756dea5c400a928c7ff2ac2bb80673e44ec5eb32b0f63faaa018dec2c33",
+          "sha256:143b102a6c1f973f183b6b86364e5512263a2567ca3dbdf50e8e780a24f43114",
+          "sha256:163fe0771a91f4ea2e1dd892d10965f06093a651f1d1ba3737e71d20b382c780",
+          "sha256:1da20d9a10ea99f372f76236f0ff1ef165365d0e8c230107554c4cb706483140",
+          "sha256:2a76a0ecf948da6c62e8f358bb64de32bfd565be9125b5b212a1bf5e54ca2a56",
+          "sha256:3708ca7ddd6fa6f5fb1cdc3ae4290434a5bdc2ea0211dab6fd3389e2117c114d",
+          "sha256:3812d1359e2e44219696497238db377b5607e2bb696284790e09c8dd9eccd4b8",
+          "sha256:384cd182bf16c10124dbace73852cb34b66140f493e3cb5ab6c75af7291c38da",
+          "sha256:38d3dc46f119daf78d58328d80bd761cda7f90adc6f4d0fcf6f8e2794558b73b",
+          "sha256:397985db2c79fd51c76fa0cada63235efc6b541450fcf2e4b152b687145d94de",
+          "sha256:3abd7871a91be64f0313c7da0b34a8b41a2e9d1513807c543ffae66987d06ea9",
+          "sha256:3e9af06d85c26e412cac1330ddb7e33df613a8409d4ee22c5baa753e93ae946f",
+          "sha256:446649ab243e487844685ae8a990f62f5b6d98b1007ffe6e3bf13c8115862d48",
+          "sha256:48eaab2ec1bec2f929bf2f49ded11554b3eb4434f48a6e272e3c488730019a6d",
+          "sha256:50502b92a1d1c6e4ac6287f7b1ee36a4070caa87170560b009a4efc1f332eb32",
+          "sha256:5cc1b29a992f2276330620b65f870803d7d9bada2f940aa6e8272982e05e0539",
+          "sha256:6466657f023057f398dcb951c19c0513bd138002c7562cf16d56a3f6250d2162",
+          "sha256:82617ef8ae58e5654a6431542db909759c43686559bc4bf8fc25f5595083286c",
+          "sha256:8338de71c74ac312464334cb5fbedcec68117a723bc4b15bde9b2a363193445c",
+          "sha256:8a3c504c33f7243c563d83614ce79b9f69d781a02b4f4bf16c7f46bbae1790df",
+          "sha256:8e70d4e0119ab78ebb26b23012322bc6c4560d08cd324af98212e3ada630dad4",
+          "sha256:90385a70a73d639c15340f0d0314cf6554ca5d83a02c67f8a4da292c2eac9339",
+          "sha256:9d2ef94c24caeb814957cba1ce69d49a326fa55b49ea2951d5722f518e92fe44",
+          "sha256:a70472d889429912a1b949c8a6bae7dc09606359cd96d9fda9a52d4946418fdf",
+          "sha256:a761e73d527ff8b301269cf2eacf0a23202e99eebe234d43874ab3353c512c35",
+          "sha256:a91622cf5ea93aebffcd216447f916a458ddd6f2123959c7ff8ecd8f5da8611b",
+          "sha256:aa3ee1c739dfccec6b532f499b736f4b4b5d88735d2a02189da395c0329f1862",
+          "sha256:aadc9321af01b634bc98cde08c224869e5581b8ec55dc3da2abe6d4d3cdc4222",
+          "sha256:abaaabe35fb4597df83e553ecd32782377c9f5afe2d7ee0e1d445d56e9e1a80b",
+          "sha256:b584d0b402d6de257be920bde26e94e19d858cb22e0038f6bcd0c044a33dfadd",
+          "sha256:b634c2eeab72abfd78f651ff0d65ae40ee90a1cc0ae5af9562ba007401179814",
+          "sha256:b68611f9c4989d41fcf77fc8397b4bd7aa1fd60b0001884b0f1f7344e1b7ad7d",
+          "sha256:b712a91fa8fc9cec7c563959e51e122d809c4d02efbde41e42f410c18975f0c5",
+          "sha256:c98b266c6bff2c4b99c6fd93791a9f9eedb9eca34bf9ba380ed5ee0563b273d4",
+          "sha256:cb686f55a0aa81ed8270d90d48c25cf12c3933794a93b635e1cfdd2ec4dae14e",
+          "sha256:d34db64242c7515a767d80b672a88664c32a9db5613144789a5bdb68513d154b",
+          "sha256:dfc1c03e82c4ffe3a0b836fa072100b04c04092b2fa30740b048330b6154dd43",
+          "sha256:ea94c8db09481bdcad44086d43c090c65cb4d202ec2ad4b35b2aa07531d9cb7e",
+          "sha256:f239b43a21af7dc7ed3645af5a27a5dd2badc8e3dd7920ef0ce4d05dc4c82ef5"
+        ],
+        "nodeIds": [
+          "n:qualification:0000985",
+          "n:qualification:0000986",
+          "n:qualification:0000987",
+          "n:qualification:0000988",
+          "n:qualification:0000989",
+          "n:qualification:0000990",
+          "n:qualification:0000991",
+          "n:qualification:0000992",
+          "n:qualification:0000993",
+          "n:qualification:0000994",
+          "n:qualification:0000995",
+          "n:qualification:0000996",
+          "n:qualification:0000997",
+          "n:qualification:0000998",
+          "n:qualification:0000999",
+          "n:qualification:0001000"
+        ],
+        "status": "complete"
+      }
+    },
+    {
+      "id": "impact-05",
+      "result": {
+        "edgeIds": [
+          "sha256:0d380588928648c6380bd63e2c6ec62642eec3817139a612cf56142dda58cfce",
+          "sha256:0f59636bfc55c1054cf5c292ded503a3856db43a9c454e3c4b95bfbf1de31acf",
+          "sha256:20081b3a00c028dc2371615193899118952617cc257664d6989f48ae6bd95980",
+          "sha256:20a5771e5ce5c71f333df9c5239f13aab856a9fa03f104dacdde234d49ec2dee",
+          "sha256:25af5d2c6111ff89d10c792c92e8342656d43633cb37336b14d3b12f76278714",
+          "sha256:28160d0d3284518051daf7f1ded9826bc48573742cf7be7fd1480aeaf56a4e2c",
+          "sha256:2bb78564aa51b016b264ac1135d86c6509d1889db91f74e81ed354f7ffac6d1f",
+          "sha256:2e5bb9e9760f3aaca228e148efda2579e25fbbf3c627e031f2ddcad22885fd70",
+          "sha256:33b43317a15816fb02e7330132e19bb372d1308806bb089fe67f78e7b6b90185",
+          "sha256:35515707f80bf14aa5fe633883a2d535277b742b242bcc4d567f04a06b600961",
+          "sha256:38f550546f378b26be91cf8d838a8fe42f10f3281c137a5f5451eb274ad520a6",
+          "sha256:434046428d8441ffa6c86e6d13d953024d9d611abecadcabc7acc78dfa8eac1c",
+          "sha256:767edd4dda3ca4663ef798e10a684e02af8aea34ed97c0716c169b3a0caa8c4b",
+          "sha256:878d12229d0cab2fc26fb17719f6ea86c7eb203e9d100bb3f17eebbb2639a9db",
+          "sha256:a5b7a5f1f591f006c3ec63dd1a4f50a6858c6796906781c337d3a5385f8ac66a",
+          "sha256:a5c65d761c2ecda0fc869920d29a0146784a8a68837e4c8262c5ae15591bcd82",
+          "sha256:aafe7857e4293dc71d1d338b7438e1c89c41684826320735c18c3b750ccc108b",
+          "sha256:cd1a48eebb2396a2aa207bf7f7007a7ba2b4a8565839a3987ead771ffa561448",
+          "sha256:d30f27f2e245a844111e5d4f04300f545b61618174592bd15dbbef0bf0b992bd",
+          "sha256:e0c791fbabfc36fca0d296976c5c465db7f0788d30d99772f82f9d116bf78552",
+          "sha256:e9813d03f89aae1c96206750980ef6c0fa0e388202c8530322a9ab2a6b11cc36"
+        ],
+        "nodeIds": [
+          "n:qualification:0049991",
+          "n:qualification:0049992",
+          "n:qualification:0049993",
+          "n:qualification:0049994",
+          "n:qualification:0049995",
+          "n:qualification:0049996",
+          "n:qualification:0049997",
+          "n:qualification:0049998",
+          "n:qualification:0049999",
+          "n:qualification:0050000"
+        ],
+        "status": "complete"
+      }
+    },
+    {
+      "id": "impact-06",
+      "result": {
+        "edgeIds": [
+          "sha256:16f1e748e937f002c6e2e9c0da0a98d6083fd66b615f46ed66a3782045df881b",
+          "sha256:1fabc2f3c65562f1a18b03a4bfee98ee741ad87f7f80603ee7dde1140d79ec46",
+          "sha256:508cd294c38be245b92c2a5d4a6e768e512641d5223eac2970a2164099f92b5f",
+          "sha256:960f0b53a679dfbf1b1996f7526d2af02f3d36774031ff0b3bdf413494baf8fc",
+          "sha256:96941b406d0b5890f112c41cdab0134f24ec5df923780532123bcda09769e1e9",
+          "sha256:a855e14c160c7fcb7567f56f3001d02ede3932c99ef556f1d2741f5897c12c2b",
+          "sha256:acc63a4c678e8d2f2209b708fc04663be8f658fd5a0a88020fc97a0531dc8b88",
+          "sha256:b46884460b211b58a97eb90ae4b77574ee2d69f6885a6dd5be988d34110c89c8",
+          "sha256:e7faa2cbd81f20c0a356fbeb3e935bb8d9b94d2b8f6ebbd482d910df8f4df2fd",
+          "sha256:f1c7acfc52f19cfaf9821874ffb9f25bc4b67cc416e87e2682968c5cd264e1fd"
+        ],
+        "nodeIds": [
+          "n:qualification:0099993",
+          "n:qualification:0099994",
+          "n:qualification:0099995",
+          "n:qualification:0099996",
+          "n:qualification:0099997",
+          "n:qualification:0099998",
+          "n:qualification:0099999"
+        ],
+        "status": "complete"
+      }
+    },
+    {
+      "id": "path-01",
+      "result": {
+        "edgeIds": [
+          "sha256:70cefbebf854f4b4b3dc86f3d2c4c5441deab9bd5be08dbdaed089f41ba20a27"
+        ],
+        "nodeIds": [
+          "n:qualification:0000000",
+          "n:qualification:0000003"
+        ],
+        "status": "complete"
+      }
+    },
+    {
+      "id": "path-02",
+      "result": {
+        "edgeIds": [
+          "sha256:3dfa8fd907adaf9be184bd31b06f7ed7b4a78c8f2dc7a501cdf3d1fc41776c76",
+          "sha256:1f4d355c6f3a59fa5ed18f796486dc9e8d3c437507d5a397818752758e20f6b2"
+        ],
+        "nodeIds": [
+          "n:qualification:0000010",
+          "n:qualification:0000012",
+          "n:qualification:0000015"
+        ],
+        "status": "complete"
+      }
+    },
+    {
+      "id": "path-03",
+      "result": {
+        "edgeIds": [
+          "sha256:d1086e61017ad346e9e3866f55d8e555a2ea49f827cfc9d85726373ddd379840",
+          "sha256:531847d742b0a64dcc744f44949676f290d106569fe49afb4b008dafe938543e",
+          "sha256:af9235a444d55c8c2101833c01e0ff342ef87c7c4c303b340c97c339a9d44884"
+        ],
+        "nodeIds": [
+          "n:qualification:0000090",
+          "n:qualification:0000091",
+          "n:qualification:0000094",
+          "n:qualification:0000097"
+        ],
+        "status": "complete"
+      }
+    },
+    {
+      "id": "path-04",
+      "result": {
+        "edgeIds": [
+          "sha256:54ec1a5629f3310b393aed1abd08fc2969e11e4b8318b21cdbc1495d4dfad819",
+          "sha256:878d12229d0cab2fc26fb17719f6ea86c7eb203e9d100bb3f17eebbb2639a9db"
+        ],
+        "nodeIds": [
+          "n:qualification:0049990",
+          "n:qualification:0049992",
+          "n:qualification:0049995"
+        ],
+        "status": "complete"
+      }
+    },
+    {
+      "id": "path-05",
+      "result": {
+        "edgeIds": [
+          "sha256:cc319c4fb5e01ff9be3ba03ec7eaee5441719fc33f8b3f9e7656141fabf94329",
+          "sha256:db6aa23e47071431b8341396dfb8f754fb7850142d5c02c15a9bc48dd8413446",
+          "sha256:e7faa2cbd81f20c0a356fbeb3e935bb8d9b94d2b8f6ebbd482d910df8f4df2fd",
+          "sha256:f1c7acfc52f19cfaf9821874ffb9f25bc4b67cc416e87e2682968c5cd264e1fd",
+          "sha256:96941b406d0b5890f112c41cdab0134f24ec5df923780532123bcda09769e1e9"
+        ],
+        "nodeIds": [
+          "n:qualification:0099990",
+          "n:qualification:0099991",
+          "n:qualification:0099993",
+          "n:qualification:0099995",
+          "n:qualification:0099997",
+          "n:qualification:0099999"
+        ],
+        "status": "complete"
+      }
+    },
+    {
+      "id": "path-06",
+      "result": {
+        "edgeIds": [
+          "sha256:a875937233352d8c57a2f3ff438530622e2f7a65ccdedc23e0f74f504d33c09c"
+        ],
+        "nodeIds": [
+          "n:qualification:0000000",
+          "n:qualification:0000001"
+        ],
+        "status": "complete"
+      }
+    }
+  ]
+}
diff --git a/benchmarks/qualification/raw_traversal.py b/benchmarks/qualification/raw_traversal.py
new file mode 100644
index 000000000..93dc032a3
--- /dev/null
+++ b/benchmarks/qualification/raw_traversal.py
@@ -0,0 +1,443 @@
+#!/usr/bin/env python3
+"""Run a bounded raw-JSON traversal baseline over qualification tasks."""
+
+from __future__ import annotations
+
+import argparse
+from collections import deque
+import json
+from pathlib import Path
+import sys
+import time
+
+if __package__ in {None, ""}:
+    sys.path.insert(0, str(Path(__file__).resolve().parents[2]))
+
+from benchmarks.performance.compass.jsonstream import iter_top_level_array
+from benchmarks.qualification.io import atomic_write_text
+
+SCHEMA = "compass.qualification-raw-traversal/1"
+MAX_TASK_BYTES = 1024 * 1024
+MAX_TASKS = 100
+TASK_LIMIT_KEYS = {
+    "maxDepth",
+    "maxEdges",
+    "maxNodes",
+    "maxResultsPerTask",
+    "timeoutSeconds",
+}
+EXPECTED_KEYS = {
+    "status",
+    "containsNodeIds",
+    "minimumEdgeCount",
+    "firstNodeId",
+    "lastNodeId",
+}
+
+
+class LimitExceeded(RuntimeError):
+    pass
+
+
+def _required_text(record: dict[str, object], key: str, *, label: str) -> str:
+    value = record.get(key)
+    if not isinstance(value, str) or not value:
+        raise ValueError(f"{label} {key} must be a non-empty string")
+    return value
+
+
+def _deadline(timeout_seconds: float) -> float:
+    if timeout_seconds <= 0:
+        raise ValueError("timeout must be positive")
+    return time.monotonic() + timeout_seconds
+
+
+def _check_time(deadline: float) -> None:
+    if time.monotonic() > deadline:
+        raise LimitExceeded("raw traversal time limit exceeded")
+
+
+def load_graph(
+    path: Path,
+    *,
+    max_graph_bytes: int,
+    max_nodes: int,
+    max_edges: int,
+    deadline: float,
+) -> tuple[
+    dict[str, tuple[str, str]],
+    dict[str, list[tuple[str, str]]],
+    dict[str, list[tuple[str, str]]],
+]:
+    size = path.stat().st_size
+    if size > max_graph_bytes:
+        raise LimitExceeded(f"graph is {size} bytes; maximum is {max_graph_bytes}")
+    nodes: dict[str, tuple[str, str]] = {}
+    for record in iter_top_level_array(path, "nodes"):
+        _check_time(deadline)
+        if not isinstance(record, dict):
+            raise ValueError("node records must be objects")
+        if len(nodes) >= max_nodes:
+            raise LimitExceeded(f"node count exceeds maximum {max_nodes}")
+        node_id = _required_text(record, "id", label="node")
+        if node_id in nodes:
+            raise ValueError(f"duplicate node ID {node_id!r}")
+        nodes[node_id] = (
+            _required_text(record, "name", label=f"node {node_id!r}"),
+            _required_text(record, "qualifiedName", label=f"node {node_id!r}"),
+        )
+    outgoing: dict[str, list[tuple[str, str]]] = {}
+    incoming: dict[str, list[tuple[str, str]]] = {}
+    edge_ids: set[str] = set()
+    edge_count = 0
+    for record in iter_top_level_array(path, "links"):
+        _check_time(deadline)
+        if not isinstance(record, dict):
+            raise ValueError("edge records must be objects")
+        if edge_count >= max_edges:
+            raise LimitExceeded(f"edge count exceeds maximum {max_edges}")
+        edge_id = _required_text(record, "id", label="edge")
+        source = _required_text(record, "source", label=f"edge {edge_id!r}")
+        target = _required_text(record, "target", label=f"edge {edge_id!r}")
+        if source not in nodes or target not in nodes:
+            raise ValueError(f"edge {edge_id!r} has invalid endpoints")
+        if edge_id in edge_ids:
+            raise ValueError(f"duplicate edge ID {edge_id!r}")
+        edge_ids.add(edge_id)
+        outgoing.setdefault(source, []).append((target, edge_id))
+        incoming.setdefault(target, []).append((source, edge_id))
+        edge_count += 1
+    for adjacency in (outgoing, incoming):
+        for values in adjacency.values():
+            values.sort()
+    return nodes, outgoing, incoming
+
+
+def _resolve(
+    nodes: dict[str, tuple[str, str]], value: str, *, deadline: float
+) -> str:
+    if value in nodes:
+        return value
+    matches = []
+    for index, (node_id, (name, qualified_name)) in enumerate(nodes.items()):
+        if index % 1024 == 0:
+            _check_time(deadline)
+        if value == name or value == qualified_name:
+            matches.append(node_id)
+    matches.sort()
+    if len(matches) != 1:
+        state = "missing" if not matches else "ambiguous"
+        raise ValueError(f"symbol {value!r} is {state}")
+    return matches[0]
+
+
+def validate_task(task: object, *, index: int) -> dict[str, object]:
+    if not isinstance(task, dict):
+        raise ValueError(f"task at index {index} must be an object")
+    task_id = task.get("id")
+    if not isinstance(task_id, str) or not task_id:
+        raise ValueError(f"task at index {index} requires a non-empty string id")
+    operation = task.get("operation")
+    if operation not in {"search", "callers", "callees", "impact", "path"}:
+        raise ValueError(f"task {task_id!r} has unsupported operation {operation!r}")
+    required = ("query",) if operation == "search" else ("source",)
+    if operation == "path":
+        required = ("source", "target")
+    for key in required:
+        value = task.get(key)
+        if not isinstance(value, str) or not value:
+            raise ValueError(f"task {task_id!r} requires a non-empty string {key}")
+    if "maxDepth" in task:
+        value = task["maxDepth"]
+        if isinstance(value, bool) or not isinstance(value, int):
+            raise ValueError(f"task {task_id!r} maxDepth must be an integer")
+    expected = task.get("expected")
+    if not isinstance(expected, dict):
+        raise ValueError(f"task {task_id!r} requires an expected evidence object")
+    unknown_expected = sorted(set(expected) - EXPECTED_KEYS)
+    if unknown_expected:
+        raise ValueError(
+            f"task {task_id!r} has unsupported expected fields: "
+            + ", ".join(unknown_expected)
+        )
+    if isinstance(expected, dict):
+        status = expected.get("status")
+        if status not in {"complete", "empty"}:
+            raise ValueError(
+                f"task {task_id!r} expected status must be 'complete' or 'empty'"
+            )
+        contains = expected.get("containsNodeIds", [])
+        if not isinstance(contains, list) or any(
+            not isinstance(value, str) or not value for value in contains
+        ):
+            raise ValueError(
+                f"task {task_id!r} expected containsNodeIds must contain non-empty strings"
+            )
+        minimum_edges = expected.get("minimumEdgeCount")
+        if minimum_edges is not None and (
+            isinstance(minimum_edges, bool)
+            or not isinstance(minimum_edges, int)
+            or minimum_edges < 0
+        ):
+            raise ValueError(
+                f"task {task_id!r} expected minimumEdgeCount must be a non-negative integer"
+            )
+        for key in ("firstNodeId", "lastNodeId"):
+            value = expected.get(key)
+            if value is not None and (not isinstance(value, str) or not value):
+                raise ValueError(
+                    f"task {task_id!r} expected {key} must be a non-empty string"
+                )
+    return task
+
+
+def validate_declared_limits(value: object, args: argparse.Namespace) -> None:
+    if value is None:
+        return
+    if not isinstance(value, dict) or set(value) != TASK_LIMIT_KEYS:
+        raise ValueError(
+            "tasks limits must contain exactly maxDepth, maxEdges, maxNodes, "
+            "maxResultsPerTask, and timeoutSeconds"
+        )
+    effective: dict[str, int | float] = {
+        "maxDepth": args.max_depth,
+        "maxEdges": args.max_edges,
+        "maxNodes": args.max_nodes,
+        "maxResultsPerTask": args.max_results,
+        "timeoutSeconds": args.timeout_seconds,
+    }
+    for key, actual in value.items():
+        if key == "timeoutSeconds":
+            valid_type = not isinstance(actual, bool) and isinstance(
+                actual, (int, float)
+            )
+        else:
+            valid_type = not isinstance(actual, bool) and isinstance(actual, int)
+        if not valid_type:
+            expected_type = "numeric" if key == "timeoutSeconds" else "an integer"
+            raise ValueError(f"tasks limit {key} must be {expected_type}")
+        if actual <= 0:
+            raise ValueError(f"tasks limit {key} must be positive")
+        if actual != effective[key]:
+            raise ValueError(
+                f"tasks limit {key}={actual} does not match effective "
+                f"value {effective[key]}"
+            )
+
+
+def verify_expected(task: dict[str, object], result: dict[str, object]) -> None:
+    expected = task.get("expected")
+    if not isinstance(expected, dict):
+        return
+    task_id = str(task["id"])
+    actual_status = result.get("status")
+    if actual_status not in {"complete", "empty"}:
+        raise ValueError(f"task {task_id!r} result requires an explicit status")
+    if actual_status != expected.get("status"):
+        raise ValueError(
+            f"task {task_id!r} status {actual_status!r} does not match expected "
+            f"{expected.get('status')!r}"
+        )
+    node_ids = result.get("nodeIds", [])
+    edge_ids = result.get("edgeIds", [])
+    if not isinstance(node_ids, list) or not isinstance(edge_ids, list):
+        raise ValueError(f"task {task_id!r} result arrays are malformed")
+    required_nodes = expected.get("containsNodeIds", [])
+    if not isinstance(required_nodes, list) or not set(required_nodes).issubset(node_ids):
+        raise ValueError(f"task {task_id!r} is missing expected node evidence")
+    minimum_edges = expected.get("minimumEdgeCount")
+    if minimum_edges is not None and len(edge_ids) < minimum_edges:
+        raise ValueError(f"task {task_id!r} has fewer edges than expected")
+    first = expected.get("firstNodeId")
+    if first is not None and (not node_ids or node_ids[0] != first):
+        raise ValueError(f"task {task_id!r} has the wrong first path node")
+    last = expected.get("lastNodeId")
+    if last is not None and (not node_ids or node_ids[-1] != last):
+        raise ValueError(f"task {task_id!r} has the wrong last path node")
+
+
+def execute_task(
+    task: dict[str, object],
+    nodes: dict[str, tuple[str, str]],
+    outgoing: dict[str, list[tuple[str, str]]],
+    incoming: dict[str, list[tuple[str, str]]],
+    *,
+    max_depth: int,
+    max_results: int,
+    deadline: float,
+) -> dict[str, object]:
+    operation = str(task.get("operation", ""))
+    if operation == "search":
+        query = str(task["query"]).casefold()
+        matches = []
+        for index, (node_id, values) in enumerate(nodes.items()):
+            if index % 1024 == 0:
+                _check_time(deadline)
+            if query in values[0].casefold() or query in values[1].casefold():
+                matches.append(node_id)
+        matches.sort()
+        if len(matches) > max_results:
+            raise LimitExceeded(f"search results exceed maximum {max_results}")
+        return {"status": "complete" if matches else "empty", "nodeIds": matches}
+    source = _resolve(nodes, str(task["source"]), deadline=deadline)
+    if operation in {"callers", "callees"}:
+        adjacency = incoming if operation == "callers" else outgoing
+        pairs = adjacency.get(source, [])
+        if len(pairs) > max_results:
+            raise LimitExceeded(f"{operation} results exceed maximum {max_results}")
+        return {
+            "status": "complete" if pairs else "empty",
+            "nodeIds": [node for node, _ in pairs],
+            "edgeIds": [edge for _, edge in pairs],
+        }
+    if operation == "impact":
+        requested_depth = int(task.get("maxDepth", max_depth))
+        if requested_depth < 0 or requested_depth > max_depth:
+            raise LimitExceeded(f"impact depth exceeds maximum {max_depth}")
+        seen = {source}
+        queue = deque([(source, 0)])
+        edge_ids: list[str] = []
+        while queue:
+            _check_time(deadline)
+            current, depth = queue.popleft()
+            if depth >= requested_depth:
+                continue
+            for target, edge_id in incoming.get(current, []):
+                edge_ids.append(edge_id)
+                if target not in seen:
+                    seen.add(target)
+                    queue.append((target, depth + 1))
+                if len(seen) > max_results or len(edge_ids) > max_results:
+                    raise LimitExceeded(f"impact results exceed maximum {max_results}")
+        return {
+            "status": "complete",
+            "nodeIds": sorted(seen),
+            "edgeIds": sorted(set(edge_ids)),
+        }
+    if operation == "path":
+        target = _resolve(nodes, str(task["target"]), deadline=deadline)
+        queue = deque([(source, 0)])
+        previous: dict[str, tuple[str, str] | None] = {source: None}
+        while queue:
+            _check_time(deadline)
+            current, depth = queue.popleft()
+            if current == target:
+                break
+            if depth >= max_depth:
+                continue
+            for next_node, edge_id in outgoing.get(current, []):
+                if next_node in previous:
+                    continue
+                previous[next_node] = (current, edge_id)
+                queue.append((next_node, depth + 1))
+                if len(previous) > max_results:
+                    raise LimitExceeded(f"path expansion exceeds maximum {max_results}")
+        if target not in previous:
+            return {"status": "empty", "nodeIds": [], "edgeIds": []}
+        node_ids = [target]
+        edge_ids = []
+        cursor = target
+        while previous[cursor] is not None:
+            parent, edge_id = previous[cursor]
+            edge_ids.append(edge_id)
+            node_ids.append(parent)
+            cursor = parent
+        node_ids.reverse()
+        edge_ids.reverse()
+        return {"status": "complete", "nodeIds": node_ids, "edgeIds": edge_ids}
+    raise ValueError(f"unsupported operation {operation!r}")
+
+
+def parse_args(argv: list[str]) -> argparse.Namespace:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--graph", type=Path, required=True)
+    parser.add_argument("--tasks", type=Path, required=True)
+    parser.add_argument("--output", type=Path)
+    parser.add_argument("--max-graph-bytes", type=int, default=2 * 1024**3)
+    parser.add_argument("--max-nodes", type=int, default=1_000_000)
+    parser.add_argument("--max-edges", type=int, default=2_500_000)
+    parser.add_argument("--max-depth", type=int, default=32)
+    parser.add_argument("--max-results", type=int, default=10_000)
+    parser.add_argument("--timeout-seconds", type=float, default=120.0)
+    return parser.parse_args(argv)
+
+
+def main(argv: list[str] | None = None) -> int:
+    args = parse_args(sys.argv[1:] if argv is None else argv)
+    deadline = _deadline(args.timeout_seconds)
+    with args.tasks.open("rb") as task_stream:
+        task_contents = task_stream.read(MAX_TASK_BYTES + 1)
+    if len(task_contents) > MAX_TASK_BYTES:
+        raise LimitExceeded(
+            f"tasks document exceeds maximum {MAX_TASK_BYTES} bytes"
+        )
+    tasks_document = json.loads(task_contents.decode("utf-8"))
+    if not isinstance(tasks_document, dict):
+        raise ValueError("tasks document must be an object")
+    validate_declared_limits(tasks_document.get("limits"), args)
+    tasks = tasks_document.get("tasks")
+    if not isinstance(tasks, list):
+        raise ValueError("tasks document requires a tasks array")
+    if not tasks or len(tasks) > MAX_TASKS:
+        raise LimitExceeded(f"task count must be in 1..={MAX_TASKS}")
+    validated_tasks = [validate_task(task, index=index) for index, task in enumerate(tasks)]
+    started = time.monotonic_ns()
+    nodes, outgoing, incoming = load_graph(
+        args.graph,
+        max_graph_bytes=args.max_graph_bytes,
+        max_nodes=args.max_nodes,
+        max_edges=args.max_edges,
+        deadline=deadline,
+    )
+    results = []
+    for task in validated_tasks:
+        _check_time(deadline)
+        task_started = time.monotonic_ns()
+        result = execute_task(
+            task,
+            nodes,
+            outgoing,
+            incoming,
+            max_depth=args.max_depth,
+            max_results=args.max_results,
+            deadline=deadline,
+        )
+        verify_expected(task, result)
+        results.append(
+            {
+                "id": task.get("id"),
+                "elapsedMicroseconds": (time.monotonic_ns() - task_started) // 1_000,
+                "result": result,
+            }
+        )
+    payload = {
+        "schema": SCHEMA,
+        "oracleStatus": "PASS",
+        "graph": str(args.graph),
+        "nodeCount": len(nodes),
+        "edgeCount": sum(len(items) for items in outgoing.values()),
+        "elapsedMicroseconds": (time.monotonic_ns() - started) // 1_000,
+        "limits": {
+            "maxDepth": args.max_depth,
+            "maxEdges": args.max_edges,
+            "maxGraphBytes": args.max_graph_bytes,
+            "maxNodes": args.max_nodes,
+            "maxResults": args.max_results,
+            "timeoutSeconds": args.timeout_seconds,
+        },
+        "results": results,
+    }
+    encoded = json.dumps(payload, indent=2, sort_keys=True) + "\n"
+    if args.output is None:
+        sys.stdout.write(encoded)
+    else:
+        atomic_write_text(args.output, encoded)
+    return 0
+
+
+if __name__ == "__main__":
+    try:
+        raise SystemExit(main())
+    except (LimitExceeded, OSError, TypeError, ValueError) as error:
+        print(f"raw traversal failed: {error}", file=sys.stderr)
+        raise SystemExit(2) from error
diff --git a/benchmarks/qualification/run_current_baseline.py b/benchmarks/qualification/run_current_baseline.py
new file mode 100644
index 000000000..18c6ac104
--- /dev/null
+++ b/benchmarks/qualification/run_current_baseline.py
@@ -0,0 +1,707 @@
+#!/usr/bin/env python3
+"""Measure the current Compass CLI against a materialized qualification graph."""
+
+from __future__ import annotations
+
+import argparse
+from datetime import datetime, timezone
+import gzip
+import hashlib
+import json
+import math
+import os
+from pathlib import Path
+import platform
+import re
+import subprocess
+import sys
+import zlib
+
+if __package__ in {None, ""}:
+    sys.path.insert(0, str(Path(__file__).resolve().parents[2]))
+
+from benchmarks.performance.compass.process import ProcessSpec, run_measured
+from benchmarks.qualification.io import atomic_write_text
+
+SCHEMA = "compass.qualification-current-engine-baseline/1"
+RAW_TRAVERSAL_SCHEMA = "compass.qualification-raw-traversal/1"
+MAX_BINARY_BYTES = 512 * 1024 * 1024
+SHA256_PATTERN = re.compile(r"^[0-9a-f]{64}$")
+GIT_OID_PATTERN = re.compile(r"^(?:[0-9a-f]{40}|[0-9a-f]{64})$")
+MAX_PATCH_BYTES = 64 * 1024 * 1024
+PATCH_TIMEOUT_SECONDS = 30.0
+MAX_METADATA_OUTPUT_BYTES = 16 * 1024
+MAX_WORKLOAD_OUTPUT_BYTES = 64 * 1024 * 1024
+MAX_SOURCE_FILES = 100_000
+MAX_SOURCE_BYTES = 512 * 1024 * 1024
+MAX_SOURCE_FILE_BYTES = 64 * 1024 * 1024
+DEFAULT_PATCH_PATHS = (
+    ".cargo/config.toml",
+    "Cargo.toml",
+    "Cargo.lock",
+    "rust-toolchain.toml",
+    "crates",
+    "vendor/compass-tree-sitter-language-pack",
+    "vendor/gemm-common",
+)
+
+
+def file_sha256(path: Path) -> str:
+    digest = hashlib.sha256()
+    with path.open("rb") as stream:
+        for chunk in iter(lambda: stream.read(1024 * 1024), b""):
+            digest.update(chunk)
+    return digest.hexdigest()
+
+
+def compressed_size(path: Path) -> int:
+    if path.stat().st_size > MAX_BINARY_BYTES:
+        raise ValueError(f"binary exceeds compression limit {MAX_BINARY_BYTES}")
+    sink = _CountingSink()
+    with path.open("rb") as source, gzip.GzipFile(
+        filename="", mode="wb", compresslevel=9, fileobj=sink, mtime=0
+    ) as compressor:
+        for chunk in iter(lambda: source.read(1024 * 1024), b""):
+            compressor.write(chunk)
+    return sink.bytes_written
+
+
+class _CountingSink:
+    def __init__(self) -> None:
+        self.bytes_written = 0
+
+    def write(self, value: bytes) -> int:
+        self.bytes_written += len(value)
+        return len(value)
+
+    def flush(self) -> None:
+        return None
+
+
+def percentile95(values: list[int]) -> int:
+    if len(values) < 5:
+        raise ValueError("p95 requires at least five samples")
+    ordered = sorted(values)
+    return ordered[max(0, math.ceil(0.95 * len(ordered)) - 1)]
+
+
+def repository_relative(path: Path, repository_root: Path, *, label: str) -> Path:
+    try:
+        return path.relative_to(repository_root)
+    except ValueError as error:
+        raise ValueError(f"{label} must be inside repository root {repository_root}") from error
+
+
+def validated_sha256(value: str, *, label: str) -> str:
+    if not SHA256_PATTERN.fullmatch(value):
+        raise ValueError(f"{label} must be a lowercase SHA-256 digest")
+    return value
+
+
+def validated_git_oid(value: str) -> str:
+    if not GIT_OID_PATTERN.fullmatch(value):
+        raise ValueError("git HEAD must be a lowercase 40- or 64-hex object ID")
+    return value
+
+
+def bounded_capture(
+    command: tuple[str, ...],
+    *,
+    repository_root: Path,
+    work_dir: Path,
+    name: str,
+    timeout_seconds: float,
+    max_output_bytes: int,
+) -> Path:
+    stdout_path = work_dir / "metadata" / f"{name}.out"
+    stderr_path = work_dir / "metadata" / f"{name}.err"
+    stdout_path.parent.mkdir(parents=True, exist_ok=True)
+    metrics = run_measured(
+        ProcessSpec(
+            command=command,
+            cwd=repository_root,
+            stdout_path=stdout_path,
+            stderr_path=stderr_path,
+            timeout_seconds=timeout_seconds,
+        )
+    )
+    if metrics.return_code != 0 or metrics.timed_out or metrics.signal is not None:
+        raise RuntimeError(
+            f"{name} failed: return={metrics.return_code} "
+            f"signal={metrics.signal} timed_out={metrics.timed_out}"
+        )
+    for label, path in (("stdout", stdout_path), ("stderr", stderr_path)):
+        size = path.stat().st_size
+        if size > max_output_bytes:
+            raise ValueError(
+                f"{name} {label} is {size} bytes; maximum is {max_output_bytes}"
+            )
+    return stdout_path
+
+
+def bounded_text_command(
+    command: tuple[str, ...],
+    *,
+    repository_root: Path,
+    work_dir: Path,
+    name: str,
+    timeout_seconds: float,
+) -> str:
+    stdout_path = bounded_capture(
+        command,
+        repository_root=repository_root,
+        work_dir=work_dir,
+        name=name,
+        timeout_seconds=timeout_seconds,
+        max_output_bytes=MAX_METADATA_OUTPUT_BYTES,
+    )
+    return stdout_path.read_text(encoding="utf-8").strip()
+
+
+def workspace_patch_metadata(
+    repository_root: Path,
+    paths: tuple[str, ...],
+    *,
+    work_dir: Path,
+) -> dict[str, str]:
+    if not paths:
+        raise ValueError("workspace patch paths cannot be empty")
+    for value in paths:
+        path = Path(value)
+        if path.is_absolute() or ".." in path.parts:
+            raise ValueError(f"workspace patch path must be repository-relative: {value}")
+    patch_path = bounded_capture(
+        ("git", "diff", "--binary", "HEAD", "--", *paths),
+        repository_root=repository_root,
+        work_dir=work_dir,
+        name="workspace-patch",
+        timeout_seconds=PATCH_TIMEOUT_SECONDS,
+        max_output_bytes=MAX_PATCH_BYTES,
+    )
+    return {
+        "workspacePatchScope": " ".join(paths)
+        + "; SHA-256 of git diff --binary HEAD -- listed paths",
+        "workspacePatchSha256": file_sha256(patch_path),
+    }
+
+
+def _digest_source_files(
+    repository_root: Path,
+    paths: list[Path],
+    *,
+    domain: bytes,
+) -> dict[str, object]:
+    files: dict[bytes, Path] = {}
+    for path in paths:
+        relative = path.relative_to(repository_root)
+        encoded = os.fsencode(relative.as_posix())
+        files[encoded] = path
+    if len(files) > MAX_SOURCE_FILES:
+        raise ValueError(f"source file count exceeds {MAX_SOURCE_FILES}")
+    digest = hashlib.sha256(domain)
+    total_bytes = 0
+    for encoded_path in sorted(files):
+        path = files[encoded_path]
+        digest.update(len(encoded_path).to_bytes(8, "big"))
+        digest.update(encoded_path)
+        if path.is_symlink():
+            target = os.fsencode(os.readlink(path))
+            size = len(target)
+            digest.update(b"L")
+            digest.update(size.to_bytes(8, "big"))
+            digest.update(target)
+        else:
+            size = path.stat().st_size
+            if size > MAX_SOURCE_FILE_BYTES:
+                raise ValueError(
+                    f"source file {path} is {size} bytes; maximum is "
+                    f"{MAX_SOURCE_FILE_BYTES}"
+                )
+            digest.update(b"F")
+            digest.update(size.to_bytes(8, "big"))
+            with path.open("rb") as stream:
+                for chunk in iter(lambda: stream.read(1024 * 1024), b""):
+                    digest.update(chunk)
+        total_bytes += size
+        if total_bytes > MAX_SOURCE_BYTES:
+            raise ValueError(f"source bytes exceed {MAX_SOURCE_BYTES}")
+    return {
+        "files": len(files),
+        "bytes": total_bytes,
+        "sha256": digest.hexdigest(),
+    }
+
+
+def _git_file_inventory(
+    repository_root: Path,
+    paths: tuple[str, ...],
+    *,
+    work_dir: Path,
+    name: str,
+    arguments: tuple[str, ...],
+) -> list[Path]:
+    inventory_path = bounded_capture(
+        ("git", "ls-files", *arguments, "-z", "--", *paths),
+        repository_root=repository_root,
+        work_dir=work_dir,
+        name=name,
+        timeout_seconds=PATCH_TIMEOUT_SECONDS,
+        max_output_bytes=MAX_PATCH_BYTES,
+    )
+    raw_inventory = inventory_path.read_bytes()
+    if raw_inventory and not raw_inventory.endswith(b"\0"):
+        raise ValueError(f"git {name} inventory is not NUL-terminated")
+    files = [
+        repository_root / Path(os.fsdecode(value))
+        for value in raw_inventory.split(b"\0")
+        if value
+    ]
+    return [path for path in files if path.exists() or path.is_symlink()]
+
+
+def workspace_source_metadata(
+    repository_root: Path,
+    paths: tuple[str, ...],
+    *,
+    work_dir: Path,
+) -> dict[str, object]:
+    patch = workspace_patch_metadata(repository_root, paths, work_dir=work_dir)
+    for value in paths:
+        candidate = repository_root / value
+        if not candidate.exists() and not candidate.is_symlink():
+            raise ValueError(f"workspace source path does not exist: {value}")
+    tracked_files = _git_file_inventory(
+        repository_root,
+        paths,
+        work_dir=work_dir,
+        name="workspace-tracked",
+        arguments=("--cached",),
+    )
+    untracked_files = _git_file_inventory(
+        repository_root,
+        paths,
+        work_dir=work_dir,
+        name="workspace-untracked",
+        arguments=("--others", "--exclude-standard"),
+    )
+    tracked = _digest_source_files(
+        repository_root,
+        tracked_files,
+        domain=b"compass.qualification-workspace-tracked/1",
+    )
+    untracked = _digest_source_files(
+        repository_root,
+        untracked_files,
+        domain=b"compass.qualification-workspace-untracked/1",
+    )
+    tree = _digest_source_files(
+        repository_root,
+        [*tracked_files, *untracked_files],
+        domain=b"compass.qualification-workspace-tree/1",
+    )
+    return {
+        **patch,
+        "workspaceTreePolicy": "existing tracked plus non-ignored untracked files in scope",
+        "workspaceTreeFiles": tree["files"],
+        "workspaceTreeBytes": tree["bytes"],
+        "workspaceTreeSha256": tree["sha256"],
+        "workspaceTrackedFiles": tracked["files"],
+        "workspaceTrackedBytes": tracked["bytes"],
+        "workspaceTrackedSha256": tracked["sha256"],
+        "workspaceUntrackedFiles": untracked["files"],
+        "workspaceUntrackedBytes": untracked["bytes"],
+        "workspaceUntrackedSha256": untracked["sha256"],
+    }
+
+
+def raw_traversal_summary(
+    path: Path,
+    *,
+    measurement: dict[str, object],
+    command: tuple[str, ...],
+) -> dict[str, object]:
+    document = json.loads(path.read_text(encoding="utf-8"))
+    if document.get("schema") != RAW_TRAVERSAL_SCHEMA:
+        raise ValueError(f"unsupported raw traversal schema in {path}")
+    results = document.get("results")
+    limits = document.get("limits")
+    if not isinstance(results, list) or len(results) != 30 or not isinstance(limits, dict):
+        raise ValueError("raw traversal evidence must contain 30 results and a limits object")
+    if document.get("oracleStatus") != "PASS":
+        raise ValueError("raw traversal evidence must have oracleStatus PASS")
+    total_elapsed = document.get("elapsedMicroseconds")
+    if isinstance(total_elapsed, bool) or not isinstance(total_elapsed, int):
+        raise ValueError("raw traversal evidence requires integer elapsedMicroseconds")
+    elapsed = []
+    for index, item in enumerate(results):
+        if not isinstance(item, dict):
+            raise ValueError(f"raw traversal result {index} must be an object")
+        value = item.get("elapsedMicroseconds")
+        if isinstance(value, bool) or not isinstance(value, int) or value < 0:
+            raise ValueError(
+                f"raw traversal result {index} requires non-negative integer "
+                "elapsedMicroseconds"
+            )
+        elapsed.append(value)
+    return {
+        "schema": RAW_TRAVERSAL_SCHEMA,
+        "taskSuite": "agent-tasks-v1.json",
+        "taskCount": len(results),
+        "oracleStatus": "PASS",
+        "command": ["python3", *command[1:]],
+        "commandInterpreter": {
+            "recordedLabel": "python3",
+            "measuredExecutableName": Path(command[0]).name,
+            "versionField": "host.python",
+        },
+        "wallMicroseconds": int(measurement["wallMicroseconds"]),
+        "reportedElapsedMicroseconds": total_elapsed,
+        "peakRssBytes": int(measurement["peakRssBytes"]),
+        "taskP95Microseconds": percentile95(elapsed),
+        "taskMaximumMicroseconds": max(elapsed),
+        "limits": limits,
+    }
+
+
+def validated_graph_contract(
+    graph: Path,
+    *,
+    metadata_path: Path,
+    scale_digests_path: Path,
+) -> dict[str, object]:
+    metadata = json.loads(metadata_path.read_text(encoding="utf-8"))
+    if metadata.get("schema") != "compass.qualification-graph-generator/1":
+        raise ValueError(f"unsupported graph metadata schema in {metadata_path}")
+    digests = json.loads(scale_digests_path.read_text(encoding="utf-8"))
+    if digests.get("schema") != "compass.qualification-profile-digests/1":
+        raise ValueError(f"unsupported scale digest schema in {scale_digests_path}")
+    profile = metadata.get("profile")
+    matches = [item for item in digests.get("profiles", []) if item.get("name") == profile]
+    if len(matches) != 1:
+        raise ValueError(f"graph profile {profile!r} must resolve exactly once")
+    expected = matches[0]
+    actual_bytes = graph.stat().st_size
+    actual_sha256 = file_sha256(graph)
+    checks = {
+        "nodes": (metadata.get("nodes"), expected.get("nodes")),
+        "edges": (metadata.get("edges"), expected.get("edges")),
+        "nodeRecordsSha256": (
+            metadata.get("nodeRecordsSha256"),
+            expected.get("nodeRecordsSha256"),
+        ),
+        "edgeRecordsSha256": (
+            metadata.get("edgeRecordsSha256"),
+            expected.get("edgeRecordsSha256"),
+        ),
+        "graphBytes": (metadata.get("graphBytes"), actual_bytes),
+        "graphSha256": (metadata.get("graphSha256"), actual_sha256),
+    }
+    mismatches = [name for name, (actual, wanted) in checks.items() if actual != wanted]
+    if mismatches:
+        raise ValueError(
+            "graph metadata does not match the pinned profile/input: "
+            + ", ".join(mismatches)
+        )
+    return {
+        "profile": profile,
+        "bytes": actual_bytes,
+        "sha256": actual_sha256,
+        "nodes": int(expected["nodes"]),
+        "edges": int(expected["edges"]),
+    }
+
+
+def require_medium_baseline_profile(graph_contract: dict[str, object]) -> None:
+    if graph_contract.get("profile") != "qualification-medium":
+        raise ValueError(
+            "current-engine baseline requires the qualification-medium profile"
+        )
+
+
+def query_commands(binary: Path, graph: Path, cache: Path) -> dict[str, tuple[str, ...]]:
+    common = ("--graph", str(graph), "--cache", str(cache), "--engine", "json", "--format", "json")
+    return {
+        "search": (
+            str(binary),
+            "search",
+            "qualification::Node0099999",
+            *common,
+            "--max-candidates",
+            "256",
+        ),
+        "callers": (str(binary), "callers", "qualification::Node0099999", *common, "--max-nodes", "512", "--max-edges", "1024"),
+        "callees": (str(binary), "callees", "qualification::Node0000000", *common, "--max-nodes", "512", "--max-edges", "1024"),
+        "impact-depth-3": (str(binary), "impact", "qualification::Node0099999", *common, "--max-depth", "3", "--max-nodes", "512", "--max-edges", "1024"),
+        # The legacy `path` command exposes no traversal-limit flags. Node 9 has
+        # an exact three-hop shortest path in this finite, versioned fixture;
+        # ProcessSpec supplies the independent wall-time/output bounds.
+        "path-depth-3": (
+            str(binary),
+            "path",
+            "qualification::Node0000000",
+            "qualification::Node0000009",
+            "--graph",
+            str(graph),
+        ),
+    }
+
+
+def _measure(
+    command: tuple[str, ...],
+    *,
+    name: str,
+    iteration: int,
+    work_dir: Path,
+    repository_root: Path,
+    timeout_seconds: float,
+    max_output_bytes: int = MAX_WORKLOAD_OUTPUT_BYTES,
+) -> dict[str, object]:
+    stdout_path = work_dir / "logs" / f"{name}-{iteration}.out"
+    stderr_path = work_dir / "logs" / f"{name}-{iteration}.err"
+    metrics = run_measured(
+        ProcessSpec(
+            command=command,
+            cwd=repository_root,
+            stdout_path=stdout_path,
+            stderr_path=stderr_path,
+            timeout_seconds=timeout_seconds,
+        )
+    )
+    if metrics.return_code != 0 or metrics.timed_out or metrics.signal is not None:
+        raise RuntimeError(
+            f"{name}[{iteration}] failed: return={metrics.return_code} "
+            f"signal={metrics.signal} timed_out={metrics.timed_out}"
+        )
+    for label, path in (("stdout", stdout_path), ("stderr", stderr_path)):
+        size = path.stat().st_size
+        if size > max_output_bytes:
+            raise ValueError(
+                f"{name}[{iteration}] {label} is {size} bytes; "
+                f"maximum is {max_output_bytes}"
+            )
+    return {
+        "iteration": iteration,
+        "wallMicroseconds": round(metrics.wall_seconds * 1_000_000),
+        "userMicroseconds": round(metrics.user_seconds * 1_000_000),
+        "systemMicroseconds": round(metrics.system_seconds * 1_000_000),
+        "peakRssBytes": metrics.peak_rss_kib * 1024,
+        "stdoutSha256": metrics.stdout_sha256,
+        "stderrSha256": metrics.stderr_sha256,
+    }
+
+
+def parse_args(argv: list[str]) -> argparse.Namespace:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--binary", type=Path, required=True)
+    parser.add_argument("--graph", type=Path, required=True)
+    parser.add_argument(
+        "--graph-metadata",
+        type=Path,
+        help="Generator metadata; defaults to generation.json beside --graph",
+    )
+    parser.add_argument(
+        "--scale-digests",
+        type=Path,
+        default=Path(__file__).with_name("scale-profile-digests-v1.json"),
+    )
+    parser.add_argument("--output", type=Path, required=True)
+    parser.add_argument("--work-dir", type=Path, required=True)
+    parser.add_argument(
+        "--raw-traversal-script",
+        type=Path,
+        default=Path(__file__).with_name("raw_traversal.py"),
+    )
+    parser.add_argument(
+        "--task-suite",
+        type=Path,
+        default=Path(__file__).with_name("agent-tasks-v1.json"),
+    )
+    parser.add_argument("--repository-root", type=Path, default=Path.cwd())
+    parser.add_argument(
+        "--workspace-patch-path",
+        action="append",
+        help="Repository-relative path included in source-state hashing; repeatable",
+    )
+    parser.add_argument("--samples", type=int, default=5)
+    parser.add_argument("--timeout-seconds", type=float, default=120.0)
+    return parser.parse_args(argv)
+
+
+def main(argv: list[str] | None = None) -> int:
+    args = parse_args(sys.argv[1:] if argv is None else argv)
+    if args.samples < 5:
+        raise ValueError("at least five samples are required")
+    repository_root = args.repository_root.resolve(strict=True)
+    binary = args.binary.resolve(strict=True)
+    graph = args.graph.resolve(strict=True)
+    graph_metadata_path = (
+        args.graph_metadata.resolve(strict=True)
+        if args.graph_metadata is not None
+        else graph.with_name("generation.json").resolve(strict=True)
+    )
+    scale_digests_path = args.scale_digests.resolve(strict=True)
+    work_dir = args.work_dir.resolve(strict=False)
+    work_dir.mkdir(parents=True, exist_ok=True)
+    (work_dir / "logs").mkdir(parents=True, exist_ok=True)
+    binary_relative = repository_relative(binary, repository_root, label="binary")
+    graph_relative = repository_relative(graph, repository_root, label="graph")
+    graph_contract = validated_graph_contract(
+        graph,
+        metadata_path=graph_metadata_path,
+        scale_digests_path=scale_digests_path,
+    )
+    require_medium_baseline_profile(graph_contract)
+    raw_script = args.raw_traversal_script.resolve(strict=True)
+    task_suite = args.task_suite.resolve(strict=True)
+    raw_script_relative = repository_relative(
+        raw_script, repository_root, label="raw traversal script"
+    )
+    task_suite_relative = repository_relative(task_suite, repository_root, label="task suite")
+    patch_paths = tuple(args.workspace_patch_path or DEFAULT_PATCH_PATHS)
+    patch_metadata = workspace_source_metadata(
+        repository_root, patch_paths, work_dir=work_dir
+    )
+    git_head = bounded_text_command(
+        ("git", "rev-parse", "HEAD"),
+        repository_root=repository_root,
+        work_dir=work_dir,
+        name="git-head",
+        timeout_seconds=PATCH_TIMEOUT_SECONDS,
+    )
+    validated_git_oid(git_head)
+    cache = work_dir / "query-cache"
+    version = bounded_text_command(
+        (str(binary_relative), "--version"),
+        repository_root=repository_root,
+        work_dir=work_dir,
+        name="binary-version",
+        timeout_seconds=args.timeout_seconds,
+    )
+    rustc_version = bounded_text_command(
+        ("rustc", "--version"),
+        repository_root=repository_root,
+        work_dir=work_dir,
+        name="rustc-version",
+        timeout_seconds=args.timeout_seconds,
+    )
+    cargo_version = bounded_text_command(
+        ("cargo", "--version"),
+        repository_root=repository_root,
+        work_dir=work_dir,
+        name="cargo-version",
+        timeout_seconds=args.timeout_seconds,
+    )
+    cache_relative = repository_relative(cache, repository_root, label="cache")
+    commands = query_commands(binary_relative, graph_relative, cache_relative)
+    for name, command in commands.items():
+        _measure(
+            command,
+            name=f"warmup-{name}",
+            iteration=0,
+            work_dir=work_dir,
+            repository_root=repository_root,
+            timeout_seconds=args.timeout_seconds,
+        )
+    workloads: dict[str, object] = {}
+    cold_command = (str(binary_relative), "--version")
+    all_commands = {"cold-start": cold_command, **commands}
+    for name, command in all_commands.items():
+        samples = [
+            _measure(
+                command,
+                name=name,
+                iteration=iteration,
+                work_dir=work_dir,
+                repository_root=repository_root,
+                timeout_seconds=args.timeout_seconds,
+            )
+            for iteration in range(1, args.samples + 1)
+        ]
+        wall = [int(item["wallMicroseconds"]) for item in samples]
+        rss = [int(item["peakRssBytes"]) for item in samples]
+        workloads[name] = {
+            "command": list(command),
+            "samples": samples,
+            "p95WallMicroseconds": percentile95(wall),
+            "maximumPeakRssBytes": max(rss),
+        }
+    raw_command = (
+        sys.executable,
+        str(raw_script_relative),
+        "--graph",
+        str(graph_relative),
+        "--tasks",
+        str(task_suite_relative),
+        "--max-graph-bytes",
+        "268435456",
+        "--max-nodes",
+        "100000",
+        "--max-edges",
+        "250000",
+        "--max-depth",
+        "32",
+        "--max-results",
+        "10000",
+        "--timeout-seconds",
+        str(args.timeout_seconds),
+    )
+    raw_measurement = _measure(
+        raw_command,
+        name="raw-traversal",
+        iteration=1,
+        work_dir=work_dir,
+        repository_root=repository_root,
+        timeout_seconds=args.timeout_seconds,
+    )
+    raw_traversal = raw_traversal_summary(
+        work_dir / "logs" / "raw-traversal-1.out",
+        measurement=raw_measurement,
+        command=raw_command,
+    )
+    payload = {
+        "schema": SCHEMA,
+        "recordedAt": datetime.now(timezone.utc).isoformat(),
+        "host": {
+            "architecture": platform.machine(),
+            "operatingSystem": platform.platform(),
+            "python": platform.python_version(),
+            "zlib": zlib.ZLIB_RUNTIME_VERSION,
+            "rustc": rustc_version,
+            "cargo": cargo_version,
+        },
+        "binary": {
+            "path": binary_relative.as_posix(),
+            "version": version,
+            "bytes": binary.stat().st_size,
+            "gzip9Bytes": compressed_size(binary),
+            "sha256": file_sha256(binary),
+            "buildCommand": "cargo build -p compass-cli --release --locked",
+        },
+        "graph": {
+            "path": graph_relative.as_posix(),
+            **graph_contract,
+        },
+        "measurement": {
+            "samplesPerWorkload": args.samples,
+            "p95Method": "nearest-rank",
+            "condition": "separate CLI processes after one unmeasured cache warmup per query; cold-start is --version",
+            "pathBound": "the legacy path command has no depth flag; the selected deterministic endpoints have an exact three-hop shortest path, the graph is capped at 100000 nodes/250000 edges/268435456 bytes, and the subprocess has an explicit timeout",
+            "workloads": workloads,
+        },
+        "rawTraversal": raw_traversal,
+        "source": {
+            "gitHead": git_head,
+            **patch_metadata,
+        },
+    }
+    atomic_write_text(args.output, json.dumps(payload, indent=2, sort_keys=True) + "\n")
+    print(args.output)
+    return 0
+
+
+if __name__ == "__main__":
+    try:
+        raise SystemExit(main())
+    except (KeyError, OSError, RuntimeError, TypeError, ValueError, subprocess.SubprocessError) as error:
+        print(f"baseline failed: {error}", file=sys.stderr)
+        raise SystemExit(2) from error
diff --git a/benchmarks/qualification/scale-profile-digests-v1.json b/benchmarks/qualification/scale-profile-digests-v1.json
new file mode 100644
index 000000000..ce13e86c7
--- /dev/null
+++ b/benchmarks/qualification/scale-profile-digests-v1.json
@@ -0,0 +1,20 @@
+{
+  "schema": "compass.qualification-profile-digests/1",
+  "canonicalization": "Each canonical compact sorted-key JSON record is prefixed by its unsigned 64-bit big-endian byte length before SHA-256 accumulation",
+  "profiles": [
+    {
+      "name": "qualification-medium",
+      "nodes": 100000,
+      "edges": 250000,
+      "nodeRecordsSha256": "f167e9b711d1846966e9217ff1635fd8bcf06f94751bd2935475a6ec5c794740",
+      "edgeRecordsSha256": "86cd281fa741be786de2639989a7e70abdb2e846042f5e5225f1ad1c417139fd"
+    },
+    {
+      "name": "qualification-large",
+      "nodes": 1000000,
+      "edges": 2500000,
+      "nodeRecordsSha256": "f15fb4c062cfa90ab39df507c70980d56642ca122dbb8a63d2359225ae7e193f",
+      "edgeRecordsSha256": "d6a49817fbb7a553bbdea1cbb546812ded1a49b6dc6f704cab40eb7a9b6ff404"
+    }
+  ]
+}
diff --git a/benchmarks/qualification/semantic-corpus-v1.json b/benchmarks/qualification/semantic-corpus-v1.json
new file mode 100644
index 000000000..7492d88c6
--- /dev/null
+++ b/benchmarks/qualification/semantic-corpus-v1.json
@@ -0,0 +1,33 @@
+{
+  "schema": "compass.qualification-semantic-corpus/1",
+  "sources": [
+    {
+      "path": "tests/qualification/code-graph-v1-corpus.json",
+      "schema": "compass.code-graph-qualification-corpus/1",
+      "sha256": "d46a0388eb8fcf5be7d0fd6ddde25ac2c8f9129fd4e2f49b466d47d376cd68ca"
+    },
+    {
+      "path": "tests/qualification/code-graph-v1-semantic.json",
+      "schema": "compass.code-graph-qualification/2",
+      "sha256": "d57d16cdd5c236c6af83c775773828bd9041236b92f335ca68040748b7836a6f"
+    }
+  ],
+  "requiredDimensions": [
+    "stable_identity",
+    "direction",
+    "parallel_multiplicity",
+    "confidence",
+    "source_evidence",
+    "ambiguity",
+    "negative_cases",
+    "bounds",
+    "deterministic_ordering",
+    "pagination"
+  ],
+  "counts": {
+    "edgeProducers": 28,
+    "flows": 27,
+    "negativeCases": 24,
+    "nodeProducers": 45
+  }
+}
diff --git a/benchmarks/qualification/skill-corpora-v1.json b/benchmarks/qualification/skill-corpora-v1.json
new file mode 100644
index 000000000..51e78d707
--- /dev/null
+++ b/benchmarks/qualification/skill-corpora-v1.json
@@ -0,0 +1,38 @@
+{
+  "schema": "compass.qualification-skill-corpora/1",
+  "source": {
+    "path": "crates/compass-cli/assets/compass-focused-skills/trigger-corpus.json",
+    "schema": 1,
+    "sha256": "62b7208aeac2e81f3919924fc8604de1be79d9b3d66569ec882cf1ffcf94f877"
+  },
+  "umbrellaInvocations": {
+    "caseIds": ["broad-umbrella", "explicit-umbrella"],
+    "allowedRegressions": 0
+  },
+  "focusedSkillBoundaries": {
+    "caseIds": [
+      "architecture-boundaries",
+      "architecture-hubs",
+      "debug-failure",
+      "debug-regression",
+      "impact-blast-radius",
+      "impact-review",
+      "index-invalid",
+      "index-stale",
+      "mcp-http",
+      "mcp-stdio",
+      "navigate-callers",
+      "navigate-path"
+    ],
+    "expectedSkills": [
+      "compass-architecture",
+      "compass-change-impact",
+      "compass-debug",
+      "compass-index-maintenance",
+      "compass-mcp-setup",
+      "compass-navigate"
+    ],
+    "allowedAmbiguousSelections": 0,
+    "allowedIncorrectSelections": 0
+  }
+}
diff --git a/benchmarks/qualification/surreal-dual-engine-decision-v1.json b/benchmarks/qualification/surreal-dual-engine-decision-v1.json
new file mode 100644
index 000000000..3e1a0a243
--- /dev/null
+++ b/benchmarks/qualification/surreal-dual-engine-decision-v1.json
@@ -0,0 +1,146 @@
+{
+  "schema": "compass.surreal-dual-engine-decision/1",
+  "recordedAt": "2026-08-29",
+  "decision": "REJECT",
+  "falsifierInvoked": true,
+  "reason": "The pre-ratified query-regression and native-value gates failed on qualification-medium. Thresholds were not changed after results were visible.",
+  "source": {
+    "gitHead": "5ca57f2441b90a516eb2a4e78e1fb4e2d2d8269a",
+    "surrealImplementationScope": "Cargo.toml Cargo.lock crates/compass-graphdb-surreal",
+    "surrealImplementationTreeSha256": "428bf4a3fc51372949e0ec8d092cddf6b8a5da4dc3a0b567439b5a731c1b2b31",
+    "currentEngineBaseline": "benchmarks/qualification/current-engine-baseline-v1.json"
+  },
+  "host": {
+    "architecture": "arm64",
+    "operatingSystem": "macOS 26.7",
+    "rustc": "rustc 1.97.1 (8bab26f4f 2026-07-14)",
+    "cargo": "cargo 1.97.1 (c980f4866 2026-06-30)",
+    "python": "3.12.8"
+  },
+  "graph": {
+    "profile": "qualification-medium",
+    "nodes": 100000,
+    "edges": 250000,
+    "bytes": 220023199,
+    "sha256": "aca4e6a1a836780f4baa352c37469787be9815db19f8bf48e858cc87eeb4f054",
+    "generationId": "sha256:b38e80567ca428440218af3548b7724e83d7f86317cecb77b266cbe16adb51b5"
+  },
+  "engineProfile": {
+    "current": "compass-query JSON engine, in process",
+    "candidate": "compass-graphdb-surreal 0.3.7, SurrealDB 3.2.4, kv-mem",
+    "condition": "Both engines were warm in one integration-test process; one unmeasured caller warmup preceded five nearest-rank samples per workload."
+  },
+  "command": [
+    "/usr/bin/time",
+    "-l",
+    "env",
+    "COMPASS_SURREAL_QUALIFICATION_GRAPH=target/qualification-c015/medium/graph.json",
+    "COMPASS_SURREAL_QUALIFICATION_OUTPUT=target/qualification-c015/surreal-raw-v1.json",
+    "COMPASS_SURREAL_QUALIFICATION_SAMPLES=5",
+    "cargo",
+    "test",
+    "-p",
+    "compass-graphdb-surreal",
+    "--test",
+    "scale_qualification",
+    "--features",
+    "mem",
+    "--locked",
+    "full_medium_dual_engine_measurement_emits_raw_evidence",
+    "--",
+    "--ignored",
+    "--exact",
+    "--nocapture",
+    "--test-threads=1"
+  ],
+  "limits": {
+    "maxDepth": 8,
+    "maxNodes": 128,
+    "maxEdges": 256,
+    "maxPaths": 64,
+    "maxCandidates": 32,
+    "maxSourceBytes": 1024,
+    "maxResponseBytes": 2097152,
+    "projectionWriteBatch": 512
+  },
+  "projection": {
+    "planMicroseconds": 11031898,
+    "activationMicroseconds": 73801538,
+    "testWallMicroseconds": 253180000,
+    "maximumResidentSetBytes": 3646308352,
+    "rawEvidenceSha256": "cba8c5a466d5f1e5e0b1b72f988c2d0348c4228f1b381634563ea4ebe54af616"
+  },
+  "semanticMismatchCount": 0,
+  "workloads": {
+    "callers": {
+      "currentMicroseconds": [152, 192, 145, 145, 148],
+      "surrealMicroseconds": [1956105, 1941921, 1946998, 1952921, 1963415],
+      "currentP95Microseconds": 192,
+      "surrealP95Microseconds": 1963415,
+      "surrealToCurrentP95Ratio": 10226.119792,
+      "responseBytes": 3562
+    },
+    "callees": {
+      "currentMicroseconds": [231, 203, 211, 245, 205],
+      "surrealMicroseconds": [1965892, 1959661, 1953232, 1985443, 1992355],
+      "currentP95Microseconds": 245,
+      "surrealP95Microseconds": 1992355,
+      "surrealToCurrentP95Ratio": 8132.061224,
+      "responseBytes": 5380
+    },
+    "impactDepth3": {
+      "currentMicroseconds": [497, 519, 506, 543, 552],
+      "surrealMicroseconds": [8169621, 8154410, 7955917, 7856388, 7937700],
+      "currentP95Microseconds": 552,
+      "surrealP95Microseconds": 8169621,
+      "surrealToCurrentP95Ratio": 14800.038043,
+      "responseBytes": 14256
+    },
+    "pathDepth3": {
+      "currentMicroseconds": [323, 307, 316, 332, 369],
+      "surrealMicroseconds": [14340535, 14129502, 14201450, 14355470, 14347371],
+      "currentP95Microseconds": 369,
+      "surrealP95Microseconds": 14355470,
+      "surrealToCurrentP95Ratio": 38903.712737,
+      "responseBytes": 5397
+    }
+  },
+  "gates": {
+    "semanticEquivalence": {
+      "threshold": "zero mismatches",
+      "observed": 0,
+      "decision": "PASS"
+    },
+    "queryRegression": {
+      "threshold": "search, callers, and callees p95 no greater than 1.10x current",
+      "observed": "callers 10226.12x and callees 8132.06x in the same warm process",
+      "decision": "FAIL"
+    },
+    "nativeValueLatency": {
+      "threshold": "at least 10% lower p95 on both depth-3-or-greater impact and path",
+      "observed": "impact 14800.04x and path 38903.71x current p95",
+      "decision": "FAIL"
+    },
+    "nativeValueTraffic": {
+      "threshold": "at least 15% fewer query calls or response tokens with no recall or success loss",
+      "observed": "0% canonical response-byte reduction",
+      "decision": "FAIL"
+    },
+    "footprint": {
+      "threshold": "enabled compressed artifact and peak RSS no greater than 2x current baseline",
+      "observed": "debug integration peak RSS 3646308352 bytes; no released Surreal-enabled artifact exists",
+      "decision": "NOT_COMPLETED_AFTER_FALSIFIER"
+    },
+    "mediumRecovery": {
+      "threshold": "last active generation queryable within 30 seconds after a killed writer",
+      "observed": "small persistent recovery probes passed under C-012; exact medium recovery was not run after the decisive query and native-value failures",
+      "decision": "NOT_COMPLETED_AFTER_FALSIFIER"
+    },
+    "agentValue": {
+      "threshold": "task-level improvement on the ratified agent corpus",
+      "observed": "C-015 exposes no CLI or MCP engine-selection route",
+      "decision": "NOT_APPLICABLE"
+    }
+  },
+  "stoppedMeasurements": "The pre-ratified falsifier stops further adoption-oriented qualification after any numeric query or native-value failure. Costly release-artifact and medium-recovery measurements were not used to override the decisive failures."
+}
diff --git a/crates/compass-cli/Cargo.toml b/crates/compass-cli/Cargo.toml
index 182098ddb..25d6b511c 100644
--- a/crates/compass-cli/Cargo.toml
+++ b/crates/compass-cli/Cargo.toml
@@ -60,5 +60,8 @@ compass-semantic = { path = "../compass-semantic", version = "0.3.7" }
 compass-semantic-diff = { path = "../compass-semantic-diff", version = "0.3.7" }
 url.workspace = true
 
+[build-dependencies]
+sha2.workspace = true
+
 [lints]
 workspace = true
diff --git a/crates/compass-cli/assets/compass-focused-skills/compass-architecture/SKILL.md b/crates/compass-cli/assets/compass-focused-skills/compass-architecture/SKILL.md
new file mode 100644
index 000000000..385447ff9
--- /dev/null
+++ b/crates/compass-cli/assets/compass-focused-skills/compass-architecture/SKILL.md
@@ -0,0 +1,44 @@
+---
+name: compass-architecture
+description: "Explain software architecture with Compass: map crates, modules, ownership boundaries, dependency layers, hubs, communities, and cross-system routes. Use for broad repository structure or design questions; use compass-navigate for locating one symbol or path."
+compatibility: "Requires the Compass CLI and an Agent Skills-compatible coding agent."
+metadata:
+  version: "1"
+  product: "compass"
+---
+
+# Compass Architecture
+
+Use the Compass graph for broad structural questions about modules, crates,
+layers, ownership, hubs, and cross-component dependencies. Combine the graph
+report with focused queries, then verify the important boundaries in source and
+repository documentation.
+
+## Workflow
+
+1. Resolve the selected graph and read `compass-out/GRAPH_REPORT.md` when the
+   request genuinely needs repository-wide context.
+2. Run `compass query "<architecture question>"` with a budget sized to the
+   available context. Use `compass explain "<concept>"` for a component and its
+   neighborhood or `compass path` for a claimed inter-layer dependency.
+3. If `compass-out/wiki/index.md` exists, navigate from the index rather than
+   opening wiki pages indiscriminately.
+4. Identify stable ownership boundaries, dependency direction, high-degree
+   nodes, communities, and explicit unresolved or inferred relationships.
+5. Verify the decisive crate entry points, manifests, public types, and design
+   documents in source.
+6. Present the smallest architecture view that answers the question. Separate
+   observed graph facts from design inference.
+
+## Boundaries
+
+- Do not treat community clustering as a normative module boundary.
+- Do not claim a missing path proves two components are independent.
+- Do not flatten parallel edges or reverse relationship direction.
+- Keep repository origin when reasoning across merged or global graphs.
+- Reach `next=none` before making exhaustive inventory claims.
+- Use `compass-navigate` when the request is a focused symbol search and
+  `compass-change-impact` when the question is review scope for an edit.
+
+Return the graph path or revision, the architectural boundaries, supporting
+source locations, and explicit uncertainties.
diff --git a/crates/compass-cli/assets/compass-focused-skills/compass-change-impact/SKILL.md b/crates/compass-cli/assets/compass-focused-skills/compass-change-impact/SKILL.md
new file mode 100644
index 000000000..f69df80fc
--- /dev/null
+++ b/crates/compass-cli/assets/compass-focused-skills/compass-change-impact/SKILL.md
@@ -0,0 +1,44 @@
+---
+name: compass-change-impact
+description: "Assess change impact with Compass: map callers, dependents, affected tests, public contracts, and review scope before or after an edit. Use for blast-radius analysis, regression planning, or code-review scope; use compass-debug when investigating an existing failure."
+compatibility: "Requires the Compass CLI and an Agent Skills-compatible coding agent."
+metadata:
+  version: "1"
+  product: "compass"
+---
+
+# Compass Change Impact
+
+Use Compass to identify bounded review and regression scope for a proposed or
+completed code change. Graph impact is a conservative review aid; verify public
+contracts and decisive relationships in source and tests.
+
+## Workflow
+
+1. Name the symbol, file, command, schema, or behavior that may change. Resolve
+   ambiguity before expanding the scope.
+2. Run `compass affected "<symbol>" --depth N` for bounded downstream review.
+   Use `compass callers`, `compass callees`, or `compass impact` when a typed
+   one-hop or transitive operation better matches the question.
+3. Use `compass path` to verify any claimed dependency chain and `compass
+   explain` to inspect nearby ownership or tests.
+4. Classify results into implementation dependents, tests and fixtures, public
+   contracts, generated artifacts, and documentation. Read the relevant source
+   before deciding that a result requires a change.
+5. Check repository compatibility guidance for public commands, formats,
+   schemas, storage, integrations, and stable identifiers.
+6. After authorized edits, refresh the graph and repeat the same bounded query
+   when confirming the final review scope.
+
+## Boundaries
+
+- Treat `affected` output as candidates, not mandatory edits.
+- Preserve relationship direction, multiplicity, provenance, and pagination.
+- Reach `next=none` before calling the impact inventory exhaustive.
+- Do not omit ambiguity, unresolved targets, negative cases, or failure paths.
+- Do not broaden a narrow change into unrelated cleanup.
+- Use `compass-debug` for root-cause investigation and `compass-architecture`
+  for repository-wide design explanations.
+
+Return the proposed review set, why each item is included, the verification
+commands, and any relevant graph gaps.
diff --git a/crates/compass-cli/assets/compass-focused-skills/compass-debug/SKILL.md b/crates/compass-cli/assets/compass-focused-skills/compass-debug/SKILL.md
new file mode 100644
index 000000000..89b2ed228
--- /dev/null
+++ b/crates/compass-cli/assets/compass-focused-skills/compass-debug/SKILL.md
@@ -0,0 +1,45 @@
+---
+name: compass-debug
+description: "Debug failures with Compass graph evidence: trace stack symbols, suspicious callers, regressions, error propagation, and nearby tests. Use when diagnosing a bug, crash, failing test, or unexpected behavior; use compass-change-impact for pre-edit blast-radius review."
+compatibility: "Requires the Compass CLI and an Agent Skills-compatible coding agent."
+metadata:
+  version: "1"
+  product: "compass"
+---
+
+# Compass Debug
+
+Use the Compass graph to turn a failure symptom into a small, testable source
+hypothesis. A graph relationship is evidence for where to inspect; it does not
+replace reproducing the failure or reading the implementation.
+
+## Workflow
+
+1. Capture the exact symptom: failing command or test, error text, stack symbol,
+   affected input, and the last known good behavior.
+2. Resolve the selected graph. If it is absent or stale, use
+   `compass-index-maintenance` before drawing conclusions.
+3. Locate the symptom with `compass search`, then use `compass callers`,
+   `compass callees`, `compass call-graph`, or `compass explain` to inspect the
+   nearest propagation path.
+4. Use `compass path` when the hypothesis depends on a specific route between
+   two symbols. Preserve direction; a reverse-only path is not the requested
+   path.
+5. Inspect the returned implementation and its closest tests. Form one concrete
+   hypothesis and run the narrowest reproduction that can falsify it.
+6. If a fix is authorized, implement it at the owning boundary and add the
+   lowest useful regression test. Refresh the graph once after final code edits.
+
+## Boundaries
+
+- Do not infer a root cause from name similarity or graph proximity alone.
+- Do not select one of several exact-name matches without disambiguating it.
+- Keep failure handling, limits, cleanup, and platform behavior in the
+  hypothesis when they are relevant.
+- Distinguish directly observed calls from inferred or unresolved edges.
+- Do not mutate code when the request is diagnosis-only.
+- Use `compass-change-impact` when the main question is what a proposed change
+  could affect rather than why current behavior fails.
+
+Report the reproduction, the evidence path, the verified source cause, and any
+remaining uncertainty.
diff --git a/crates/compass-cli/assets/compass-focused-skills/compass-index-maintenance/SKILL.md b/crates/compass-cli/assets/compass-focused-skills/compass-index-maintenance/SKILL.md
new file mode 100644
index 000000000..ae75a4ad3
--- /dev/null
+++ b/crates/compass-cli/assets/compass-focused-skills/compass-index-maintenance/SKILL.md
@@ -0,0 +1,43 @@
+---
+name: compass-index-maintenance
+description: "Maintain Compass graph artifacts: initialize, update, refresh, watch, diagnose, and recover a missing, stale, oversized, or invalid index. Use for graph freshness, build failures, output health, and index lifecycle; use compass-navigate after the graph is ready."
+compatibility: "Requires the Compass CLI and an Agent Skills-compatible coding agent."
+metadata:
+  version: "1"
+  product: "compass"
+---
+
+# Compass Index Maintenance
+
+Use this skill when Compass graph artifacts are absent, stale, invalid, or
+failing to build. Keep graph generation local and deterministic unless the user
+explicitly selects a semantic provider or another external integration.
+
+## Workflow
+
+1. Identify the selected source root, output root, graph path, and any explicit
+   revision. Never repair one graph and report a different graph as current.
+2. Run `compass capabilities --format json` before relying on a machine
+   contract, and reject an unknown major version.
+3. Use `compass init` when repository scope must be selected and persisted.
+   Otherwise use `compass update .` for a structural refresh.
+4. Use `compass diagnose multigraph` or the relevant local diagnostic when an
+   existing graph is invalid or suspicious. Treat limit errors as failures, not
+   empty results, and follow their actionable scope or size guidance.
+5. Use `compass watch .` only when continuous refresh is requested. Report the
+   running process and watched root.
+6. After a successful build, confirm the expected graph and report artifacts
+   exist. A stale file surviving a failed build is not evidence of success.
+
+## Boundaries
+
+- Do not invoke a semantic provider, network source, database push, or HTTP
+  server merely to repair a local structural graph.
+- Preserve explicit `--graph`, `--out`, `--at`, provider, and storage choices.
+- Do not delete graph output unless the user authorizes destructive recovery.
+- Do not describe a failed refresh as current.
+- Keep generated Compass artifacts outside tracked external source checkouts.
+- Use `compass-navigate` after the graph is ready for focused code questions.
+
+Return what was checked, the exact maintenance command, the artifact paths, and
+any warning or failure that still limits freshness.
diff --git a/crates/compass-cli/assets/compass-focused-skills/compass-mcp-setup/SKILL.md b/crates/compass-cli/assets/compass-focused-skills/compass-mcp-setup/SKILL.md
new file mode 100644
index 000000000..aa5b71479
--- /dev/null
+++ b/crates/compass-cli/assets/compass-focused-skills/compass-mcp-setup/SKILL.md
@@ -0,0 +1,45 @@
+---
+name: compass-mcp-setup
+description: "Configure and verify the Compass MCP server for coding clients over stdio or stateless HTTP. Use for MCP client configuration, discovery, capability negotiation, transport headers, authentication, or tool invocation setup; not for ordinary graph queries."
+compatibility: "Requires the Compass CLI and an MCP-capable client."
+metadata:
+  version: "1"
+  product: "compass"
+---
+
+# Compass MCP Setup
+
+Use this skill to configure and verify a coding client against the native
+Compass MCP server. Keep the selected transport explicit and test discovery
+plus one real invocation rather than treating process startup as success.
+
+## Workflow
+
+1. Run `compass capabilities --format json` and verify the supported machine
+   contract before generating client configuration.
+2. Run `compass mcp --help` before selecting transport options.
+3. For stdio, configure the client to launch the installed `compass` binary
+   with the MCP subcommand and explicit graph or project selection required by
+   the client workflow.
+4. For HTTP, use the documented stateless MCP endpoint, protocol-version
+   metadata, content negotiation, host policy, and authentication settings.
+   Do not invent a legacy session or fallback transport.
+5. Verify server discovery, list the advertised tools and resources, invoke one
+   bounded navigation tool, read one resource when supported, and shut down the
+   client cleanly.
+6. Keep credentials out of committed configuration and command output. Tests
+   must use local fixtures or mocks rather than real credentials or services.
+
+## Boundaries
+
+- Do not expose the server on an untrusted interface without explicit host and
+  authentication policy.
+- Do not downgrade an HTTP protocol contract to accommodate a client silently.
+- Treat unknown protocol or result-envelope majors as explicit errors.
+- Bound request bodies, captured output, response sizes, and subprocess time.
+- Distinguish stdio process success from HTTP interoperability; verify each
+  requested transport independently.
+- Use `compass-navigate` for normal codebase questions after MCP is configured.
+
+Return the client and version, transport, non-secret configuration shape,
+discovery result, invocation evidence, and any unsupported matrix cell.
diff --git a/crates/compass-cli/assets/compass-focused-skills/compass-navigate/SKILL.md b/crates/compass-cli/assets/compass-focused-skills/compass-navigate/SKILL.md
new file mode 100644
index 000000000..5e2cefb5c
--- /dev/null
+++ b/crates/compass-cli/assets/compass-focused-skills/compass-navigate/SKILL.md
@@ -0,0 +1,48 @@
+---
+name: compass-navigate
+description: "Locate code with the Compass graph: find symbols, callers, callees, dependency paths, related source, and exact graph evidence. Use for focused codebase navigation or repository search before opening files; use compass-architecture for broad system structure."
+compatibility: "Requires the Compass CLI and an Agent Skills-compatible coding agent."
+metadata:
+  version: "1"
+  product: "compass"
+---
+
+# Compass Navigate
+
+Use Compass as the first navigation layer when the request is to locate code,
+trace a dependency, find callers or callees, or identify the smallest relevant
+source set. The graph is an evidence index; verify decisive facts in cited
+source before changing code.
+
+## Workflow
+
+1. Resolve the selected graph. Keep an explicit `--graph` or `--at` selector
+   unchanged throughout the task; otherwise use `compass-out/graph.json`.
+2. If the current graph is absent and repository guidance permits generation,
+   run `compass update .` once. If generation fails, report the failure and do
+   not treat an older surviving graph as current.
+3. Choose the narrowest command:
+   - `compass search "<symbol>"` for exact or fuzzy symbol lookup.
+   - `compass callers "<symbol>"` or `compass callees "<symbol>"` for one-hop
+     call evidence.
+   - `compass path "<source>" "<target>"` for a known dependency path.
+   - `compass affected "<symbol>" --depth N` for bounded downstream scope.
+   - `compass explain "<concept>"` for a concept and its neighborhood.
+   - `compass query "<question>"` for focused natural-language traversal.
+4. When output reports `next=N`, repeat the unchanged command with `--page N`.
+   Reach `next=none` before making an exhaustive claim.
+5. Open only the returned source needed to verify identity, direction,
+   provenance, ambiguity, and the requested relationship.
+
+## Boundaries
+
+- Treat an absent path as evidence that this graph does not encode the route,
+  not proof that no route exists.
+- Preserve ambiguous matches instead of selecting the first candidate.
+- Treat `affected` as review scope, not proof that every result must change.
+- Do not silently switch graphs, revisions, output roots, or repositories.
+- For a broad module map or ownership explanation, use `compass-architecture`.
+- For stale or missing graph artifacts, use `compass-index-maintenance`.
+
+Return concise results with the graph or revision used and the source locations
+that support the conclusion.
diff --git a/crates/compass-cli/assets/compass-focused-skills/trigger-corpus.json b/crates/compass-cli/assets/compass-focused-skills/trigger-corpus.json
new file mode 100644
index 000000000..6eb441877
--- /dev/null
+++ b/crates/compass-cli/assets/compass-focused-skills/trigger-corpus.json
@@ -0,0 +1,75 @@
+{
+  "schema": 1,
+  "cases": [
+    {
+      "id": "explicit-umbrella",
+      "prompt": "Use /compass to help with this repository.",
+      "expected": "compass"
+    },
+    {
+      "id": "broad-umbrella",
+      "prompt": "Use Compass to navigate, refresh the graph, inspect architecture, and configure MCP.",
+      "expected": "compass"
+    },
+    {
+      "id": "navigate-callers",
+      "prompt": "Find this symbol and show its callers and callees before I open files.",
+      "expected": "compass-navigate"
+    },
+    {
+      "id": "navigate-path",
+      "prompt": "Trace the dependency path between these two functions.",
+      "expected": "compass-navigate"
+    },
+    {
+      "id": "debug-failure",
+      "prompt": "Diagnose this failing test and trace the stack symbol to the root cause.",
+      "expected": "compass-debug"
+    },
+    {
+      "id": "debug-regression",
+      "prompt": "Investigate this crash and unexpected regression using nearby callers and tests.",
+      "expected": "compass-debug"
+    },
+    {
+      "id": "impact-blast-radius",
+      "prompt": "Assess the blast radius and affected tests before I change this public function.",
+      "expected": "compass-change-impact"
+    },
+    {
+      "id": "impact-review",
+      "prompt": "What dependents and review scope are affected by this edit?",
+      "expected": "compass-change-impact"
+    },
+    {
+      "id": "architecture-boundaries",
+      "prompt": "Explain the repository architecture, crate ownership boundaries, and dependency layers.",
+      "expected": "compass-architecture"
+    },
+    {
+      "id": "architecture-hubs",
+      "prompt": "Map the major modules, communities, and architectural hubs in this system.",
+      "expected": "compass-architecture"
+    },
+    {
+      "id": "index-stale",
+      "prompt": "The Compass graph is stale; refresh the index and verify the output artifacts.",
+      "expected": "compass-index-maintenance"
+    },
+    {
+      "id": "index-invalid",
+      "prompt": "Diagnose a missing or invalid graph build and recover its freshness.",
+      "expected": "compass-index-maintenance"
+    },
+    {
+      "id": "mcp-stdio",
+      "prompt": "Configure the Compass MCP server for a client over stdio and verify discovery.",
+      "expected": "compass-mcp-setup"
+    },
+    {
+      "id": "mcp-http",
+      "prompt": "Set up stateless HTTP MCP transport, protocol headers, authentication, and a tool invocation.",
+      "expected": "compass-mcp-setup"
+    }
+  ]
+}
diff --git a/crates/compass-cli/assets/compass-skill/references/command-reference.md b/crates/compass-cli/assets/compass-skill/references/command-reference.md
index ff66b6b9d..0517ea8ea 100644
--- a/crates/compass-cli/assets/compass-skill/references/command-reference.md
+++ b/crates/compass-cli/assets/compass-skill/references/command-reference.md
@@ -98,6 +98,8 @@ tools and must not replace normal extraction without a reason.
 
 ## Installation and hooks
 
+- `compass agent`: list, install, diagnose, export, validate, or render MCP
+  configuration for a supported coding-agent integration.
 - `compass install`: install the canonical skill and platform integration.
 - `compass uninstall`: remove managed integrations; `--purge` additionally
   removes Compass output and requires explicit user intent.
diff --git a/crates/compass-cli/assets/compass-skill/references/hooks.md b/crates/compass-cli/assets/compass-skill/references/hooks.md
index d741737cd..ddf965603 100644
--- a/crates/compass-cli/assets/compass-skill/references/hooks.md
+++ b/crates/compass-cli/assets/compass-skill/references/hooks.md
@@ -6,6 +6,8 @@ registration.
 ## Install the Compass skill
 
 ```bash
+compass agent list
+compass agent install --platform codex --project
 compass install --platform codex --project
 compass install --platform PLATFORM
 compass PLATFORM install --project
@@ -28,7 +30,9 @@ use the platform name reported by `compass install --help`; do not infer a
 destination directory and copy files by hand.
 
 Direct platform syntax, such as `compass codex install`, and
-`compass install --platform codex` install the same canonical skill but may also
+`compass install --platform codex` install the same canonical skill. The
+`compass agent install --platform codex` namespace delegates to that managed
+installer without changing its arguments or output. Direct platform syntax may also
 wire platform-specific instructions or hooks. `--project` is not supported
 identically by every host, so inspect the command result and report the concrete
 files it names.
diff --git a/crates/compass-cli/build.rs b/crates/compass-cli/build.rs
index 858ecb402..b107d4835 100644
--- a/crates/compass-cli/build.rs
+++ b/crates/compass-cli/build.rs
@@ -46,7 +46,11 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
         &manifest.join("src/help.rs"),
     )?;
     let mut files = Vec::new();
-    for directory in ["compass-skill", "compass-integrations"] {
+    for directory in [
+        "compass-skill",
+        "compass-focused-skills",
+        "compass-integrations",
+    ] {
         collect(&root, &root.join(directory), &mut files)?;
     }
     let output = PathBuf::from(env::var("OUT_DIR")?);
diff --git a/crates/compass-cli/src/agent_commands.rs b/crates/compass-cli/src/agent_commands.rs
new file mode 100644
index 000000000..f5fb37929
--- /dev/null
+++ b/crates/compass-cli/src/agent_commands.rs
@@ -0,0 +1,1629 @@
+use std::collections::{BTreeMap, BTreeSet};
+use std::fs;
+use std::io::Read;
+use std::path::{Component, Path, PathBuf};
+
+use compass_files::{DetectOptions, Manifest, ManifestKind, detect, write_bytes_atomic};
+use serde::{Deserialize, Serialize};
+use serde_json::{Value, json};
+use sha2::{Digest, Sha256};
+
+use crate::distribution::{native_package, verified_harness_version};
+use crate::install_commands::{
+    agent_inventory, command_install, embedded_skill_files, managed_skill_collection_directories,
+    managed_skill_directory, verify_managed_skill_collection,
+};
+use crate::{Frontend, Outcome};
+
+const BUNDLE_SCHEMA: &str = "compass.agent-bundle/1";
+const INVENTORY_SCHEMA: &str = "compass.agent-list/1";
+const DOCTOR_SCHEMA: &str = "compass.agent-doctor/1";
+const VALIDATION_SCHEMA: &str = "compass.agent-validation/1";
+const GENERIC_MCP_SCHEMA: &str = "compass.agent-mcp-config/1";
+const MCP_HTTP_URL: &str = "http://127.0.0.1:8080/mcp";
+const MAX_FILES: usize = 512;
+const MAX_FILE_BYTES: u64 = 2 * 1024 * 1024;
+const MAX_TOTAL_BYTES: u64 = 16 * 1024 * 1024;
+const SKILL_NAMES: &[&str] = &[
+    "compass",
+    "compass-architecture",
+    "compass-change-impact",
+    "compass-debug",
+    "compass-index-maintenance",
+    "compass-mcp-setup",
+    "compass-navigate",
+];
+const MCP_PLATFORMS: &[&str] = &["agents", "claude", "codex", "opencode"];
+
+#[derive(Clone, Copy, Debug, Default, Eq, PartialEq)]
+enum OutputFormat {
+    #[default]
+    Text,
+    Json,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+enum Transport {
+    Stdio,
+    Http,
+}
+
+#[derive(Debug, Deserialize, Serialize)]
+struct BundleManifest {
+    schema: String,
+    compass_version: String,
+    platform: String,
+    transport: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    harness_version: Option<String>,
+    files: BTreeMap<String, String>,
+}
+
+#[derive(Clone, Debug, Eq, Ord, PartialEq, PartialOrd, Serialize)]
+struct ValidationFinding {
+    path: String,
+    rule: String,
+}
+
+#[derive(Debug, Serialize)]
+struct ValidationReport {
+    schema: &'static str,
+    valid: bool,
+    findings: Vec<ValidationFinding>,
+}
+
+#[derive(Clone, Debug, Serialize)]
+struct DoctorCheck {
+    id: &'static str,
+    status: &'static str,
+    detail: String,
+}
+
+#[derive(Debug, Serialize)]
+struct DoctorReport {
+    schema: &'static str,
+    platform: String,
+    healthy: bool,
+    checks: Vec<DoctorCheck>,
+}
+
+pub(crate) fn command(frontend: Frontend, args: &[String]) -> Outcome {
+    let Some(subcommand) = args.first().map(String::as_str) else {
+        return usage_error("error: missing agent subcommand");
+    };
+    match subcommand {
+        "list" => command_list(&args[1..]),
+        "install" => command_install(frontend, &args[1..]),
+        "doctor" => command_doctor(&args[1..]),
+        "export" => command_export(&args[1..]),
+        "validate" => command_validate(&args[1..]),
+        "mcp-config" => command_mcp_config(&args[1..]),
+        unknown => usage_error(&format!("error: unknown agent subcommand '{unknown}'")),
+    }
+}
+
+fn command_list(args: &[String]) -> Outcome {
+    let format = match parse_format_only(args) {
+        Ok(format) => format,
+        Err(error) => return usage_error(&error),
+    };
+    let inventory = match agent_inventory() {
+        Ok(inventory) => inventory,
+        Err(error) => return Outcome::failure(error),
+    };
+    match format {
+        OutputFormat::Text => {
+            let lines = inventory
+                .iter()
+                .map(|agent| {
+                    format!(
+                        "{}\t{}\t{}",
+                        agent.id,
+                        agent.support,
+                        agent.config_paths.join(",")
+                    )
+                })
+                .collect::<Vec<_>>();
+            Outcome::success(lines.join("\n"))
+        }
+        OutputFormat::Json => {
+            let agents = inventory
+                .iter()
+                .map(|agent| {
+                    json!({
+                        "id": agent.id,
+                        "aliases": agent.aliases,
+                        "support": agent.support,
+                        "commands": agent.commands,
+                        "config_paths": agent.config_paths,
+                        "project_skill": agent.project_skill,
+                        "user_skill": agent.user_skill,
+                        "documentation_url": agent.documentation_url,
+                        "verified_on": agent.verified_on,
+                    })
+                })
+                .collect::<Vec<_>>();
+            json_success(&json!({"schema": INVENTORY_SCHEMA, "agents": agents}))
+        }
+    }
+}
+
+fn command_mcp_config(args: &[String]) -> Outcome {
+    let (platform, transport) = match parse_mcp_options(args) {
+        Ok(options) => options,
+        Err(error) => return usage_error(&error),
+    };
+    match render_mcp_config(&platform, transport) {
+        Ok(config) => Outcome::success(config),
+        Err(error) => usage_error(&error),
+    }
+}
+
+fn command_export(args: &[String]) -> Outcome {
+    let (platform, output, transport, format) = match parse_export_options(args) {
+        Ok(options) => options,
+        Err(error) => return usage_error(&error),
+    };
+    match export_bundle(&platform, transport, &output) {
+        Ok(manifest) => match format {
+            OutputFormat::Text => Outcome::success(format!(
+                "exported {} files for {} to {}",
+                manifest.files.len(),
+                platform,
+                output.display()
+            )),
+            OutputFormat::Json => match serde_json::to_value(&manifest) {
+                Ok(value) => json_success(&value),
+                Err(error) => {
+                    Outcome::failure(format!("error: could not encode export report: {error}"))
+                }
+            },
+        },
+        Err(error) => Outcome::failure(error),
+    }
+}
+
+fn command_validate(args: &[String]) -> Outcome {
+    let (path, platform, format) = match parse_validate_options(args) {
+        Ok(options) => options,
+        Err(error) => return usage_error(&error),
+    };
+    let report = validate_path(&path, platform.as_deref());
+    let code = u8::from(!report.valid);
+    match format {
+        OutputFormat::Text => {
+            let stdout = if report.valid {
+                format!("valid agent bundle: {}", path.display())
+            } else {
+                report
+                    .findings
+                    .iter()
+                    .map(|finding| format!("{}: {}", finding.path, finding.rule))
+                    .collect::<Vec<_>>()
+                    .join("\n")
+            };
+            outcome(code, stdout, String::new())
+        }
+        OutputFormat::Json => match serde_json::to_string_pretty(&report) {
+            Ok(stdout) => outcome(code, stdout, String::new()),
+            Err(error) => Outcome::failure(format!("error: could not encode validation: {error}")),
+        },
+    }
+}
+
+fn command_doctor(args: &[String]) -> Outcome {
+    let (platform, root, user, format) = match parse_doctor_options(args) {
+        Ok(options) => options,
+        Err(error) => return usage_error(&error),
+    };
+    let report = doctor(&platform, &root, user);
+    let code = u8::from(!report.healthy);
+    match format {
+        OutputFormat::Text => {
+            let stdout = report
+                .checks
+                .iter()
+                .map(|check| format!("{}\t{}\t{}", check.status, check.id, check.detail))
+                .collect::<Vec<_>>()
+                .join("\n");
+            outcome(code, stdout, String::new())
+        }
+        OutputFormat::Json => match serde_json::to_string_pretty(&report) {
+            Ok(stdout) => outcome(code, stdout, String::new()),
+            Err(error) => {
+                Outcome::failure(format!("error: could not encode doctor report: {error}"))
+            }
+        },
+    }
+}
+
+fn parse_format_only(args: &[String]) -> Result<OutputFormat, String> {
+    let mut format = OutputFormat::Text;
+    let mut index = 0;
+    while index < args.len() {
+        match args[index].as_str() {
+            "--format" => {
+                index += 1;
+                format = parse_format(required_value(args, index, "--format")?)?;
+            }
+            value if value.starts_with("--format=") => format = parse_format(&value[9..])?,
+            value => return Err(format!("error: unknown agent list option '{value}'")),
+        }
+        index += 1;
+    }
+    Ok(format)
+}
+
+fn parse_mcp_options(args: &[String]) -> Result<(String, Transport), String> {
+    let mut platform = None;
+    let mut transport = Transport::Stdio;
+    let mut index = 0;
+    while index < args.len() {
+        match args[index].as_str() {
+            "--platform" => {
+                index += 1;
+                platform = Some(required_value(args, index, "--platform")?.to_owned());
+            }
+            "--transport" => {
+                index += 1;
+                transport = parse_transport(required_value(args, index, "--transport")?)?;
+            }
+            value if value.starts_with("--platform=") => platform = Some(value[11..].to_owned()),
+            value if value.starts_with("--transport=") => {
+                transport = parse_transport(&value[12..])?;
+            }
+            value => return Err(format!("error: unknown agent mcp-config option '{value}'")),
+        }
+        index += 1;
+    }
+    let platform = platform.ok_or_else(|| "error: --platform is required".to_owned())?;
+    validate_mcp_platform(&platform)?;
+    Ok((platform, transport))
+}
+
+fn parse_export_options(
+    args: &[String],
+) -> Result<(String, PathBuf, Transport, OutputFormat), String> {
+    let mut platform = None;
+    let mut output = None;
+    let mut transport = Transport::Stdio;
+    let mut format = OutputFormat::Text;
+    let mut index = 0;
+    while index < args.len() {
+        match args[index].as_str() {
+            "--platform" => {
+                index += 1;
+                platform = Some(required_value(args, index, "--platform")?.to_owned());
+            }
+            "--out" => {
+                index += 1;
+                output = Some(PathBuf::from(required_value(args, index, "--out")?));
+            }
+            "--transport" => {
+                index += 1;
+                transport = parse_transport(required_value(args, index, "--transport")?)?;
+            }
+            "--format" => {
+                index += 1;
+                format = parse_format(required_value(args, index, "--format")?)?;
+            }
+            value if value.starts_with("--platform=") => platform = Some(value[11..].to_owned()),
+            value if value.starts_with("--out=") => output = Some(PathBuf::from(&value[6..])),
+            value if value.starts_with("--transport=") => {
+                transport = parse_transport(&value[12..])?;
+            }
+            value if value.starts_with("--format=") => format = parse_format(&value[9..])?,
+            value => return Err(format!("error: unknown agent export option '{value}'")),
+        }
+        index += 1;
+    }
+    let platform = platform.ok_or_else(|| "error: --platform is required".to_owned())?;
+    validate_mcp_platform(&platform)?;
+    let output = output.ok_or_else(|| "error: --out is required".to_owned())?;
+    Ok((platform, output, transport, format))
+}
+
+fn parse_validate_options(
+    args: &[String],
+) -> Result<(PathBuf, Option<String>, OutputFormat), String> {
+    let mut path = None;
+    let mut platform = None;
+    let mut format = OutputFormat::Text;
+    let mut index = 0;
+    while index < args.len() {
+        match args[index].as_str() {
+            "--path" => {
+                index += 1;
+                path = Some(PathBuf::from(required_value(args, index, "--path")?));
+            }
+            "--platform" => {
+                index += 1;
+                platform = Some(required_value(args, index, "--platform")?.to_owned());
+            }
+            "--format" => {
+                index += 1;
+                format = parse_format(required_value(args, index, "--format")?)?;
+            }
+            value if value.starts_with("--path=") => path = Some(PathBuf::from(&value[7..])),
+            value if value.starts_with("--platform=") => platform = Some(value[11..].to_owned()),
+            value if value.starts_with("--format=") => format = parse_format(&value[9..])?,
+            value => return Err(format!("error: unknown agent validate option '{value}'")),
+        }
+        index += 1;
+    }
+    if let Some(platform) = platform.as_deref() {
+        validate_mcp_platform(platform)?;
+    }
+    Ok((
+        path.ok_or_else(|| "error: --path is required".to_owned())?,
+        platform,
+        format,
+    ))
+}
+
+fn parse_doctor_options(args: &[String]) -> Result<(String, PathBuf, bool, OutputFormat), String> {
+    let mut platform = None;
+    let mut root = PathBuf::from(".");
+    let mut user = false;
+    let mut selected_scope = None;
+    let mut format = OutputFormat::Text;
+    let mut index = 0;
+    while index < args.len() {
+        match args[index].as_str() {
+            "--platform" => {
+                index += 1;
+                platform = Some(required_value(args, index, "--platform")?.to_owned());
+            }
+            "--project" | "--project-root" => {
+                if let Some(selected) = selected_scope {
+                    return Err(if selected == "project" {
+                        "error: duplicate project root option".to_owned()
+                    } else {
+                        "error: project and user roots cannot be used together".to_owned()
+                    });
+                }
+                index += 1;
+                root = PathBuf::from(required_value(args, index, args[index - 1].as_str())?);
+                selected_scope = Some("project");
+            }
+            "--user" | "--user-root" => {
+                if let Some(selected) = selected_scope {
+                    return Err(if selected == "user" {
+                        "error: duplicate user root option".to_owned()
+                    } else {
+                        "error: project and user roots cannot be used together".to_owned()
+                    });
+                }
+                index += 1;
+                root = PathBuf::from(required_value(args, index, args[index - 1].as_str())?);
+                user = true;
+                selected_scope = Some("user");
+            }
+            "--format" => {
+                index += 1;
+                format = parse_format(required_value(args, index, "--format")?)?;
+            }
+            value if value.starts_with("--platform=") => platform = Some(value[11..].to_owned()),
+            value if value.starts_with("--project=") || value.starts_with("--project-root=") => {
+                if let Some(selected) = selected_scope {
+                    return Err(if selected == "project" {
+                        "error: duplicate project root option".to_owned()
+                    } else {
+                        "error: project and user roots cannot be used together".to_owned()
+                    });
+                }
+                root = PathBuf::from(inline_option_value(value)?);
+                selected_scope = Some("project");
+            }
+            value if value.starts_with("--user=") || value.starts_with("--user-root=") => {
+                if let Some(selected) = selected_scope {
+                    return Err(if selected == "user" {
+                        "error: duplicate user root option".to_owned()
+                    } else {
+                        "error: project and user roots cannot be used together".to_owned()
+                    });
+                }
+                root = PathBuf::from(inline_option_value(value)?);
+                user = true;
+                selected_scope = Some("user");
+            }
+            value if value.starts_with("--format=") => format = parse_format(&value[9..])?,
+            value => return Err(format!("error: unknown agent doctor option '{value}'")),
+        }
+        index += 1;
+    }
+    let platform = platform.ok_or_else(|| "error: --platform is required".to_owned())?;
+    validate_mcp_platform(&platform)?;
+    Ok((platform, root, user, format))
+}
+
+fn required_value<'a>(args: &'a [String], index: usize, option: &str) -> Result<&'a str, String> {
+    args.get(index)
+        .map(String::as_str)
+        .ok_or_else(|| format!("error: {option} requires a value"))
+}
+
+fn inline_option_value(value: &str) -> Result<&str, String> {
+    let (option, value) = value
+        .split_once('=')
+        .ok_or_else(|| "error: invalid inline option".to_owned())?;
+    if value.is_empty() {
+        Err(format!("error: {option} requires a value"))
+    } else {
+        Ok(value)
+    }
+}
+
+fn parse_format(value: &str) -> Result<OutputFormat, String> {
+    match value {
+        "text" => Ok(OutputFormat::Text),
+        "json" => Ok(OutputFormat::Json),
+        _ => Err(format!(
+            "error: unknown output format '{value}'; use text or json"
+        )),
+    }
+}
+
+fn parse_transport(value: &str) -> Result<Transport, String> {
+    match value {
+        "stdio" => Ok(Transport::Stdio),
+        "http" => Ok(Transport::Http),
+        _ => Err(format!(
+            "error: unsupported transport '{value}'; use stdio or http"
+        )),
+    }
+}
+
+fn validate_mcp_platform(platform: &str) -> Result<(), String> {
+    if MCP_PLATFORMS.contains(&platform) {
+        Ok(())
+    } else {
+        Err(format!(
+            "error: unsupported MCP platform '{platform}'; choose from {}",
+            MCP_PLATFORMS.join(", ")
+        ))
+    }
+}
+
+fn render_mcp_config(platform: &str, transport: Transport) -> Result<String, String> {
+    validate_mcp_platform(platform)?;
+    let value = match (platform, transport) {
+        ("codex", Transport::Stdio) => {
+            return Ok("[mcp_servers.compass]\ncommand = \"compass\"\nargs = [\"serve\", \"--transport\", \"stdio\"]".to_owned());
+        }
+        ("codex", Transport::Http) => {
+            return Ok(format!("[mcp_servers.compass]\nurl = \"{MCP_HTTP_URL}\""));
+        }
+        ("claude", Transport::Stdio) => json!({
+            "mcpServers": {"compass": {"command": "compass", "args": ["serve", "--transport", "stdio"]}}
+        }),
+        ("claude", Transport::Http) => json!({
+            "mcpServers": {"compass": {"type": "http", "url": MCP_HTTP_URL}}
+        }),
+        ("opencode", Transport::Stdio) => json!({
+            "mcp": {"compass": {"type": "local", "command": ["compass", "serve", "--transport", "stdio"], "enabled": true}}
+        }),
+        ("opencode", Transport::Http) => json!({
+            "mcp": {"compass": {"type": "remote", "url": MCP_HTTP_URL, "enabled": true}}
+        }),
+        ("agents", Transport::Stdio) => json!({
+            "schema": GENERIC_MCP_SCHEMA,
+            "mcpServers": {"compass": {"command": "compass", "args": ["serve", "--transport", "stdio"]}}
+        }),
+        ("agents", Transport::Http) => json!({
+            "schema": GENERIC_MCP_SCHEMA,
+            "mcpServers": {"compass": {"transport": "http", "url": MCP_HTTP_URL}}
+        }),
+        _ => return Err(format!("error: unsupported MCP platform '{platform}'")),
+    };
+    serde_json::to_string_pretty(&value)
+        .map_err(|error| format!("error: could not encode MCP configuration: {error}"))
+}
+
+fn export_bundle(
+    platform: &str,
+    transport: Transport,
+    destination: &Path,
+) -> Result<BundleManifest, String> {
+    let destination_permissions = if destination.exists() {
+        let metadata = fs::symlink_metadata(destination).map_err(|error| {
+            format!(
+                "error: could not inspect export destination {}: {error}",
+                destination.display()
+            )
+        })?;
+        if metadata.file_type().is_symlink() || !metadata.is_dir() {
+            return Err(format!(
+                "error: export destination {} must be a directory and not a symbolic link",
+                destination.display()
+            ));
+        }
+        let mut entries = fs::read_dir(destination).map_err(|error| {
+            format!(
+                "error: could not inspect export destination {}: {error}",
+                destination.display()
+            )
+        })?;
+        if entries
+            .next()
+            .transpose()
+            .map_err(|error| {
+                format!(
+                    "error: could not inspect export destination {}: {error}",
+                    destination.display()
+                )
+            })?
+            .is_some()
+        {
+            return Err(format!(
+                "error: export destination {} is not empty",
+                destination.display()
+            ));
+        }
+        Some(metadata.permissions())
+    } else {
+        None
+    };
+    let parent = destination.parent().unwrap_or_else(|| Path::new("."));
+    fs::create_dir_all(parent).map_err(|error| {
+        format!(
+            "error: could not create export parent {}: {error}",
+            parent.display()
+        )
+    })?;
+    let stage_directory = tempfile::Builder::new()
+        .prefix(".compass-agent-stage-")
+        .tempdir_in(parent)
+        .map_err(|error| format!("error: could not create export staging directory: {error}"))?;
+    let stage = stage_directory.path();
+    let result = (|| {
+        let mut files = BTreeMap::new();
+        for asset in embedded_skill_files() {
+            write_bundle_file(stage, &asset.path, asset.bytes)?;
+            files.insert(asset.path, digest_bytes(asset.bytes));
+        }
+        let harness_version = if matches!(platform, "codex" | "claude" | "opencode") {
+            let package = native_package(platform, transport_name(transport))?;
+            for (path, bytes) in package.files {
+                write_bundle_file(stage, &path, &bytes)?;
+                files.insert(path, digest_bytes(&bytes));
+            }
+            Some(verified_harness_version(platform)?)
+        } else {
+            let config_path = bundle_config_path(platform).to_owned();
+            let config = render_mcp_config(platform, transport)?;
+            write_bundle_file(stage, &config_path, config.as_bytes())?;
+            files.insert(config_path.clone(), digest_bytes(config.as_bytes()));
+            None
+        };
+        let manifest = BundleManifest {
+            schema: BUNDLE_SCHEMA.to_owned(),
+            compass_version: env!("CARGO_PKG_VERSION").to_owned(),
+            platform: platform.to_owned(),
+            transport: transport_name(transport).to_owned(),
+            harness_version,
+            files,
+        };
+        let mut encoded = serde_json::to_vec_pretty(&manifest)
+            .map_err(|error| format!("error: could not encode export manifest: {error}"))?;
+        encoded.push(b'\n');
+        write_bundle_file(stage, "manifest.json", &encoded)?;
+        let validation = validate_export_bundle(stage, Some(platform));
+        if !validation.valid {
+            let rules = validation
+                .findings
+                .iter()
+                .map(|finding| format!("{}: {}", finding.path, finding.rule))
+                .collect::<Vec<_>>()
+                .join("; ");
+            return Err(format!(
+                "error: staged agent bundle failed validation: {rules}"
+            ));
+        }
+        Ok(manifest)
+    })();
+    let manifest = match result {
+        Ok(manifest) => manifest,
+        Err(error) => {
+            return Err(error);
+        }
+    };
+    if let Some(permissions) = &destination_permissions {
+        fs::set_permissions(stage, permissions.clone()).map_err(|error| {
+            format!(
+                "error: could not preserve export destination permissions for {}: {error}",
+                destination.display()
+            )
+        })?;
+    }
+    let destination_was_empty = destination_permissions.is_some();
+    if destination_was_empty {
+        fs::remove_dir(destination).map_err(|error| {
+            format!(
+                "error: could not prepare empty export destination {}: {error}",
+                destination.display()
+            )
+        })?;
+    }
+    let stage = stage_directory.keep();
+    if let Err(error) = fs::rename(&stage, destination) {
+        let _cleanup = fs::remove_dir_all(&stage);
+        let restore_error = destination_permissions.and_then(|permissions| {
+            fs::create_dir(destination)
+                .and_then(|()| fs::set_permissions(destination, permissions))
+                .err()
+        });
+        let restore_detail = restore_error.map_or_else(String::new, |restore| {
+            format!("; could not restore the original empty destination: {restore}")
+        });
+        return Err(format!(
+            "error: could not publish export {}: {error}{restore_detail}",
+            destination.display()
+        ));
+    }
+    Ok(manifest)
+}
+
+fn write_bundle_file(root: &Path, relative: &str, bytes: &[u8]) -> Result<(), String> {
+    let path = safe_relative_path(root, relative)?;
+    if let Some(parent) = path.parent() {
+        fs::create_dir_all(parent)
+            .map_err(|error| format!("error: could not create {}: {error}", parent.display()))?;
+    }
+    write_bytes_atomic(&path, bytes)
+        .map_err(|error| format!("error: could not write {}: {error}", path.display()))
+}
+
+fn validate_path(root: &Path, expected_platform: Option<&str>) -> ValidationReport {
+    let mut report = if root.join("manifest.json").is_file() {
+        validate_export_bundle(root, expected_platform)
+    } else if root.join(".compass-install.json").is_file() {
+        if expected_platform.is_some() {
+            validation_report(vec![ValidationFinding {
+                path: display_relative(root, root),
+                rule: "--platform applies only to exported bundles".to_owned(),
+            }])
+        } else {
+            validate_managed_bundle(root)
+        }
+    } else {
+        ValidationReport {
+            schema: VALIDATION_SCHEMA,
+            valid: false,
+            findings: vec![ValidationFinding {
+                path: display_relative(root, root),
+                rule: "missing bundle or managed install manifest".to_owned(),
+            }],
+        }
+    };
+    report.findings.sort();
+    report.findings.dedup();
+    report.valid = report.findings.is_empty();
+    report
+}
+
+fn validate_export_bundle(root: &Path, expected_platform: Option<&str>) -> ValidationReport {
+    let mut findings = Vec::new();
+    let files = match collect_files_bounded(root) {
+        Ok(files) => files,
+        Err(rule) => {
+            findings.push(ValidationFinding {
+                path: display_relative(root, root),
+                rule,
+            });
+            return validation_report(findings);
+        }
+    };
+    let manifest_bytes = match files.get("manifest.json") {
+        Some(bytes) => bytes,
+        None => {
+            findings.push(ValidationFinding {
+                path: "manifest.json".to_owned(),
+                rule: "missing bundle manifest".to_owned(),
+            });
+            return validation_report(findings);
+        }
+    };
+    let manifest = match serde_json::from_slice::<BundleManifest>(manifest_bytes) {
+        Ok(manifest) => manifest,
+        Err(error) => {
+            findings.push(ValidationFinding {
+                path: "manifest.json".to_owned(),
+                rule: format!("invalid bundle manifest: {error}"),
+            });
+            return validation_report(findings);
+        }
+    };
+    if manifest.schema != BUNDLE_SCHEMA {
+        findings.push(ValidationFinding {
+            path: "manifest.json".to_owned(),
+            rule: format!("unsupported bundle schema '{}'", manifest.schema),
+        });
+    }
+    let declared_transport = match parse_transport(&manifest.transport) {
+        Ok(transport) => Some(transport),
+        Err(_) => {
+            findings.push(ValidationFinding {
+                path: "manifest.json".to_owned(),
+                rule: format!("unsupported bundle transport '{}'", manifest.transport),
+            });
+            None
+        }
+    };
+    if validate_mcp_platform(&manifest.platform).is_err() {
+        findings.push(ValidationFinding {
+            path: "manifest.json".to_owned(),
+            rule: format!("unsupported bundle platform '{}'", manifest.platform),
+        });
+    }
+    if expected_platform.is_some_and(|expected| expected != manifest.platform) {
+        findings.push(ValidationFinding {
+            path: "manifest.json".to_owned(),
+            rule: format!(
+                "bundle platform '{}' does not match requested platform",
+                manifest.platform
+            ),
+        });
+    }
+    for name in SKILL_NAMES {
+        let path = format!("skills/{name}/SKILL.md");
+        if !files.contains_key(&path) {
+            findings.push(ValidationFinding {
+                path,
+                rule: "missing required skill entry point".to_owned(),
+            });
+        }
+    }
+    let actual_paths = files
+        .keys()
+        .filter(|path| path.as_str() != "manifest.json")
+        .cloned()
+        .collect::<BTreeSet<_>>();
+    let expected_paths = manifest.files.keys().cloned().collect::<BTreeSet<_>>();
+    if actual_paths != expected_paths {
+        findings.push(ValidationFinding {
+            path: "manifest.json".to_owned(),
+            rule: "manifest file inventory does not match bundle contents".to_owned(),
+        });
+    }
+    for (path, expected) in &manifest.files {
+        if safe_relative_path(root, path).is_err() {
+            findings.push(ValidationFinding {
+                path: "manifest.json".to_owned(),
+                rule: format!("unsafe manifest path '{path}'"),
+            });
+            continue;
+        }
+        match files.get(path) {
+            Some(bytes) if digest_bytes(bytes) == *expected => {}
+            Some(_) => findings.push(ValidationFinding {
+                path: path.clone(),
+                rule: "checksum mismatch".to_owned(),
+            }),
+            None => findings.push(ValidationFinding {
+                path: path.clone(),
+                rule: "manifest file is missing".to_owned(),
+            }),
+        }
+    }
+    let config_path = bundle_config_path(&manifest.platform);
+    match files.get(config_path) {
+        Some(bytes) => {
+            let validation =
+                if matches!(manifest.platform.as_str(), "codex" | "claude" | "opencode") {
+                    validate_native_mcp_config_bytes(&manifest.platform, bytes, declared_transport)
+                } else {
+                    validate_mcp_config_bytes(&manifest.platform, bytes, declared_transport)
+                };
+            if let Err(rule) = validation {
+                findings.push(ValidationFinding {
+                    path: config_path.to_owned(),
+                    rule,
+                });
+            }
+        }
+        None => findings.push(ValidationFinding {
+            path: config_path.to_owned(),
+            rule: "missing platform MCP configuration".to_owned(),
+        }),
+    }
+    validate_native_package_files(&manifest, &files, &mut findings);
+    scan_portability(&files, &mut findings);
+    validation_report(findings)
+}
+
+fn validate_managed_bundle(primary: &Path) -> ValidationReport {
+    let mut findings = Vec::new();
+    let directories = match managed_skill_collection_directories(primary) {
+        Ok(directories) => directories,
+        Err(error) => {
+            findings.push(ValidationFinding {
+                path: display_relative(primary, primary),
+                rule: strip_error_prefix(&error),
+            });
+            return validation_report(findings);
+        }
+    };
+    let container = primary.parent().unwrap_or(primary);
+    let mut files = BTreeMap::new();
+    let mut total_files = 0_usize;
+    let mut total_bytes = 0_u64;
+    for directory in directories {
+        let remaining_files = MAX_FILES.saturating_sub(total_files);
+        let remaining_bytes = MAX_TOTAL_BYTES.saturating_sub(total_bytes);
+        match collect_files_bounded_with_limits(&directory, remaining_files, remaining_bytes) {
+            Ok(collected) => {
+                total_files = total_files.saturating_add(collected.len());
+                for (relative, bytes) in collected {
+                    total_bytes = total_bytes.saturating_add(bytes.len() as u64);
+                    let prefix = directory
+                        .strip_prefix(container)
+                        .unwrap_or(&directory)
+                        .to_string_lossy()
+                        .replace('\\', "/");
+                    files.insert(format!("{prefix}/{relative}"), bytes);
+                }
+            }
+            Err(rule) => {
+                findings.push(ValidationFinding {
+                    path: display_relative(container, &directory),
+                    rule,
+                });
+                return validation_report(findings);
+            }
+        }
+    }
+    if let Err(error) = verify_managed_skill_collection(primary) {
+        findings.push(ValidationFinding {
+            path: display_relative(primary, primary),
+            rule: strip_error_prefix(&error),
+        });
+        return validation_report(findings);
+    }
+    files.retain(|path, _| {
+        !path.ends_with("/.compass-install.json")
+            && !path.ends_with("/.compass_version")
+            && path != ".compass-install.json"
+            && path != ".compass_version"
+    });
+    scan_portability(&files, &mut findings);
+    validation_report(findings)
+}
+
+fn validation_report(mut findings: Vec<ValidationFinding>) -> ValidationReport {
+    findings.sort();
+    findings.dedup();
+    ValidationReport {
+        schema: VALIDATION_SCHEMA,
+        valid: findings.is_empty(),
+        findings,
+    }
+}
+
+fn collect_files_bounded(root: &Path) -> Result<BTreeMap<String, Vec<u8>>, String> {
+    collect_files_bounded_with_limits(root, MAX_FILES, MAX_TOTAL_BYTES)
+}
+
+fn collect_files_bounded_with_limits(
+    root: &Path,
+    max_files: usize,
+    max_total_bytes: u64,
+) -> Result<BTreeMap<String, Vec<u8>>, String> {
+    let metadata =
+        fs::symlink_metadata(root).map_err(|error| format!("could not inspect bundle: {error}"))?;
+    if metadata.file_type().is_symlink() || !metadata.is_dir() {
+        return Err("bundle root must be a directory and not a symbolic link".to_owned());
+    }
+    let canonical = fs::canonicalize(root)
+        .map_err(|error| format!("could not resolve bundle root: {error}"))?;
+    let mut pending = vec![root.to_path_buf()];
+    let mut files = BTreeMap::new();
+    let mut total = 0_u64;
+    while let Some(directory) = pending.pop() {
+        let mut entries = fs::read_dir(&directory)
+            .map_err(|error| format!("could not inspect bundle directory: {error}"))?
+            .collect::<Result<Vec<_>, _>>()
+            .map_err(|error| format!("could not inspect bundle entry: {error}"))?;
+        entries.sort_by_key(fs::DirEntry::file_name);
+        for entry in entries.into_iter().rev() {
+            let path = entry.path();
+            let file_type = entry
+                .file_type()
+                .map_err(|error| format!("could not inspect bundle entry: {error}"))?;
+            if file_type.is_symlink() {
+                return Err(format!(
+                    "symbolic links are not allowed: {}",
+                    display_relative(root, &path)
+                ));
+            }
+            if file_type.is_dir() {
+                let resolved = fs::canonicalize(&path)
+                    .map_err(|error| format!("could not resolve bundle directory: {error}"))?;
+                if !resolved.starts_with(&canonical) {
+                    return Err(format!(
+                        "path escapes bundle root: {}",
+                        display_relative(root, &path)
+                    ));
+                }
+                pending.push(path);
+                continue;
+            }
+            if !file_type.is_file() {
+                return Err(format!(
+                    "unsupported file type: {}",
+                    display_relative(root, &path)
+                ));
+            }
+            if files.len() >= max_files {
+                return Err(format!("bundle exceeds file limit of {max_files}"));
+            }
+            let remaining = max_total_bytes.saturating_sub(total);
+            let limit = remaining.min(MAX_FILE_BYTES);
+            let bytes = read_file_with_limit(&path, limit).map_err(|error| {
+                if remaining < MAX_FILE_BYTES {
+                    format!("bundle exceeds byte limit of {max_total_bytes}: {error}")
+                } else {
+                    format!(
+                        "file exceeds byte limit: {}: {error}",
+                        display_relative(root, &path)
+                    )
+                }
+            })?;
+            total = total.saturating_add(bytes.len() as u64);
+            files.insert(display_relative(root, &path), bytes);
+        }
+    }
+    Ok(files)
+}
+
+fn scan_portability(files: &BTreeMap<String, Vec<u8>>, findings: &mut Vec<ValidationFinding>) {
+    for (path, bytes) in files {
+        let Ok(text) = std::str::from_utf8(bytes) else {
+            continue;
+        };
+        if contains_absolute_path(text) {
+            findings.push(ValidationFinding {
+                path: path.clone(),
+                rule: "contains an absolute path or file URL".to_owned(),
+            });
+        }
+        if contains_literal_credential(text) {
+            findings.push(ValidationFinding {
+                path: path.clone(),
+                rule: "contains a likely literal credential".to_owned(),
+            });
+        }
+    }
+}
+
+fn contains_absolute_path(text: &str) -> bool {
+    if text.to_ascii_lowercase().contains("file://") {
+        return true;
+    }
+    let bytes = text.as_bytes();
+    for index in 0..bytes.len().saturating_sub(2) {
+        let boundary = index == 0 || !bytes[index - 1].is_ascii_alphanumeric();
+        if !boundary {
+            continue;
+        }
+        if bytes[index].is_ascii_alphabetic()
+            && bytes[index + 1] == b':'
+            && matches!(bytes[index + 2], b'/' | b'\\')
+        {
+            return true;
+        }
+        if bytes[index] == b'\\' && bytes[index + 1] == b'\\' {
+            return true;
+        }
+    }
+    const UNIX_ROOTS: &[&str] = &[
+        "/Applications",
+        "/Library",
+        "/Users",
+        "/Volumes",
+        "/bin",
+        "/etc",
+        "/home",
+        "/mnt",
+        "/nix",
+        "/opt",
+        "/private",
+        "/root",
+        "/sbin",
+        "/snap",
+        "/srv",
+        "/tmp",
+        "/usr",
+        "/var",
+    ];
+    UNIX_ROOTS.iter().any(|root| {
+        text.match_indices(root).any(|(index, _)| {
+            let before = index == 0
+                || !text.as_bytes()[index - 1].is_ascii_alphanumeric()
+                    && text.as_bytes()[index - 1] != b':';
+            let end = index.saturating_add(root.len());
+            let after = text.as_bytes().get(end).is_none_or(|byte| {
+                *byte == b'/'
+                    || byte.is_ascii_whitespace()
+                    || matches!(byte, b'"' | b'\'' | b',' | b')' | b']' | b'}')
+            });
+            before && after
+        })
+    })
+}
+
+fn contains_literal_credential(text: &str) -> bool {
+    const KEYS: &[&str] = &[
+        "api_key",
+        "apikey",
+        "access_token",
+        "auth_token",
+        "password",
+        "client_secret",
+        "authorization",
+    ];
+    fn sensitive_key(key: &str) -> bool {
+        let key = key
+            .trim()
+            .trim_matches(|character: char| matches!(character, '"' | '\'' | '-' | ' '))
+            .to_ascii_lowercase();
+        KEYS.iter().any(|candidate| key.ends_with(candidate))
+    }
+
+    fn json_contains(value: &Value) -> bool {
+        match value {
+            Value::Object(values) => values.iter().any(|(key, value)| {
+                if sensitive_key(key) {
+                    return match value {
+                        Value::Null => false,
+                        Value::String(value) => !is_credential_placeholder(value),
+                        _ => true,
+                    };
+                }
+                json_contains(value)
+            }),
+            Value::Array(values) => values.iter().any(json_contains),
+            _ => false,
+        }
+    }
+
+    fn toml_contains(value: &toml::Value) -> bool {
+        match value {
+            toml::Value::Table(values) => values.iter().any(|(key, value)| {
+                if sensitive_key(key) {
+                    return value
+                        .as_str()
+                        .is_none_or(|value| !is_credential_placeholder(value));
+                }
+                toml_contains(value)
+            }),
+            toml::Value::Array(values) => values.iter().any(toml_contains),
+            _ => false,
+        }
+    }
+
+    if let Ok(value) = serde_json::from_str::<Value>(text) {
+        return json_contains(&value);
+    }
+    if let Ok(value) = toml::from_str::<toml::Value>(text) {
+        return toml_contains(&value);
+    }
+    text.lines().any(|line| {
+        let Some((key, value)) = line.split_once('=').or_else(|| line.split_once(':')) else {
+            return false;
+        };
+        if !sensitive_key(key) {
+            return false;
+        }
+        let value = value
+            .trim()
+            .trim_end_matches(',')
+            .trim()
+            .trim_matches(|character| matches!(character, '"' | '\''));
+        if value.is_empty() {
+            return false;
+        }
+        !is_credential_placeholder(value)
+    })
+}
+
+fn is_credential_placeholder(value: &str) -> bool {
+    let lower = value.to_ascii_lowercase();
+    if matches!(lower.as_str(), "null" | "placeholder" | "<secret>")
+        || lower.starts_with("your_")
+        || lower.starts_with("your-")
+        || lower.starts_with("env:")
+    {
+        return true;
+    }
+    let variable = value
+        .strip_prefix("${")
+        .and_then(|value| value.strip_suffix('}'))
+        .or_else(|| value.strip_prefix('$'));
+    if variable.is_some_and(|name| {
+        !name.is_empty()
+            && name
+                .bytes()
+                .all(|byte| byte.is_ascii_uppercase() || byte.is_ascii_digit() || byte == b'_')
+    }) {
+        return true;
+    }
+    let placeholder = value
+        .strip_prefix("Bearer ")
+        .or_else(|| value.strip_prefix("bearer "))
+        .unwrap_or(value)
+        .trim();
+    placeholder
+        .strip_prefix('<')
+        .and_then(|placeholder| placeholder.strip_suffix('>'))
+        .is_some_and(|placeholder| {
+            !placeholder.is_empty()
+                && placeholder
+                    .bytes()
+                    .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'_' | b'-'))
+        })
+        || matches!(lower.as_str(), "redacted" | "[redacted]" | "***")
+        || lower.starts_with("see ")
+}
+
+fn doctor(platform: &str, root: &Path, user: bool) -> DoctorReport {
+    let mut checks = Vec::new();
+    checks.push(pass_check(
+        "binary_version",
+        format!("compass {}", env!("CARGO_PKG_VERSION")),
+    ));
+    checks.push(if compass_mcp::supports_protocol("2026-07-28") {
+        pass_check(
+            "mcp_protocol",
+            compass_mcp::SUPPORTED_PROTOCOL_VERSION.to_owned(),
+        )
+    } else {
+        fail_check(
+            "mcp_protocol",
+            format!(
+                "compiled server accepts {} instead of required 2026-07-28",
+                compass_mcp::SUPPORTED_PROTOCOL_VERSION
+            ),
+        )
+    });
+    if user {
+        checks.push(skip_check(
+            "graph_presence",
+            "not applicable to a user-scoped integration".to_owned(),
+        ));
+        checks.push(skip_check(
+            "graph_freshness",
+            "not applicable to a user-scoped integration".to_owned(),
+        ));
+    } else {
+        let output_name = std::env::var("COMPASS_OUT").unwrap_or_else(|_| "compass-out".to_owned());
+        let output = root.join(&output_name);
+        let graph =
+            compass_files::BuildGuard::resolve_requested_artifact(&output.join("graph.json"));
+        let manifest_path =
+            compass_files::BuildGuard::resolve_requested_artifact(&output.join("manifest.json"));
+        match (graph, manifest_path) {
+            (Ok(graph), Ok(manifest_path)) if graph.is_file() => {
+                checks.push(pass_check("graph_presence", graph.display().to_string()));
+                let manifest_bytes = read_file_with_limit(&manifest_path, MAX_TOTAL_BYTES);
+                let manifest_valid = manifest_bytes.and_then(|bytes| {
+                    serde_json::from_slice::<Value>(&bytes)
+                        .map_err(|error| error.to_string())
+                        .and_then(|value| {
+                            value
+                                .as_object()
+                                .map(|_| ())
+                                .ok_or_else(|| "graph manifest root must be an object".to_owned())
+                        })
+                });
+                if let Err(error) = manifest_valid {
+                    checks.push(fail_check(
+                        "graph_freshness",
+                        format!("could not load graph manifest: {error}"),
+                    ));
+                } else {
+                    let freshness = detect(
+                        root,
+                        &DetectOptions {
+                            output_name,
+                            ..DetectOptions::default()
+                        },
+                    )
+                    .map(|detection| {
+                        Manifest::load(&manifest_path, Some(root))
+                            .is_unchanged(&detection.files, ManifestKind::Ast)
+                    });
+                    checks.push(match freshness {
+                        Ok(true) => {
+                            pass_check("graph_freshness", "manifest matches sources".to_owned())
+                        }
+                        Ok(false) => {
+                            fail_check("graph_freshness", "graph manifest is stale".to_owned())
+                        }
+                        Err(error) => fail_check(
+                            "graph_freshness",
+                            format!("source detection failed: {error}"),
+                        ),
+                    });
+                }
+            }
+            (Ok(graph), Ok(_)) => {
+                checks.push(fail_check(
+                    "graph_presence",
+                    format!("missing {}", graph.display()),
+                ));
+                checks.push(fail_check(
+                    "graph_freshness",
+                    "cannot assess freshness without graph".to_owned(),
+                ));
+            }
+            (Err(error), _) | (_, Err(error)) => {
+                checks.push(fail_check(
+                    "graph_presence",
+                    format!("could not resolve immutable graph snapshot: {error}"),
+                ));
+                checks.push(fail_check(
+                    "graph_freshness",
+                    "cannot assess freshness with an invalid snapshot selector".to_owned(),
+                ));
+            }
+        }
+    }
+    match managed_skill_directory(platform, root, user) {
+        Ok(directory) => {
+            let validation = validate_managed_bundle(&directory);
+            checks.push(if validation.valid {
+                pass_check("skill_checksums", directory.display().to_string())
+            } else {
+                fail_check(
+                    "skill_checksums",
+                    validation
+                        .findings
+                        .first()
+                        .map(|finding| finding.rule.clone())
+                        .unwrap_or_else(|| "managed skill validation failed".to_owned()),
+                )
+            });
+        }
+        Err(error) => checks.push(fail_check("skill_checksums", strip_error_prefix(&error))),
+    }
+    checks.push(match locate_mcp_config(platform, root) {
+        Some(path) => match read_bounded_file(&path) {
+            Ok(bytes) => match validate_mcp_config_bytes(platform, &bytes, None) {
+                Ok(()) => pass_check("mcp_config", path.display().to_string()),
+                Err(error) => fail_check("mcp_config", error),
+            },
+            Err(error) => fail_check("mcp_config", error),
+        },
+        None => fail_check(
+            "mcp_config",
+            format!("no {} MCP configuration found", platform),
+        ),
+    });
+    let healthy = checks.iter().all(|check| check.status != "fail");
+    DoctorReport {
+        schema: DOCTOR_SCHEMA,
+        platform: platform.to_owned(),
+        healthy,
+        checks,
+    }
+}
+
+fn locate_mcp_config(platform: &str, root: &Path) -> Option<PathBuf> {
+    let candidates: &[&str] = match platform {
+        "codex" => &[".codex/config.toml"],
+        "claude" => &[".mcp.json"],
+        "opencode" => &["opencode.json", ".opencode/opencode.json"],
+        "agents" => &[".agents/mcp.json"],
+        _ => &[],
+    };
+    candidates
+        .iter()
+        .map(|relative| root.join(relative))
+        .find(|path| path.is_file())
+}
+
+fn validate_mcp_config_bytes(
+    platform: &str,
+    bytes: &[u8],
+    expected_transport: Option<Transport>,
+) -> Result<(), String> {
+    let text =
+        std::str::from_utf8(bytes).map_err(|_| "MCP configuration must be UTF-8".to_owned())?;
+    if contains_literal_credential(text) {
+        return Err("MCP configuration contains a likely literal credential".to_owned());
+    }
+    if platform == "codex" {
+        let value = toml::from_str::<toml::Value>(text)
+            .map_err(|error| format!("invalid Codex TOML: {error}"))?;
+        let compass = value
+            .get("mcp_servers")
+            .and_then(|servers| servers.get("compass"))
+            .ok_or_else(|| "Codex configuration is missing mcp_servers.compass".to_owned())?;
+        let command_is_compass = compass.get("command").and_then(toml::Value::as_str)
+            == Some("compass")
+            && compass.get("args").is_some_and(|args| {
+                args.as_array().is_some_and(|args| {
+                    args.iter().filter_map(toml::Value::as_str).eq([
+                        "serve",
+                        "--transport",
+                        "stdio",
+                    ]) && args.len() == 3
+                })
+            });
+        let url_is_compass = compass.get("url").and_then(toml::Value::as_str) == Some(MCP_HTTP_URL);
+        let valid = match expected_transport {
+            Some(Transport::Stdio) => command_is_compass,
+            Some(Transport::Http) => url_is_compass,
+            None => command_is_compass || url_is_compass,
+        };
+        if !valid {
+            return Err(
+                "Codex MCP entry does not invoke Compass serve or its loopback endpoint".to_owned(),
+            );
+        }
+        return Ok(());
+    }
+    let value = serde_json::from_slice::<Value>(bytes)
+        .map_err(|error| format!("invalid {platform} JSON: {error}"))?;
+    let entry = match platform {
+        "claude" | "agents" => value.pointer("/mcpServers/compass"),
+        "opencode" => value.pointer("/mcp/compass"),
+        _ => None,
+    };
+    let entry = entry
+        .filter(|entry| entry.is_object())
+        .ok_or_else(|| format!("{platform} configuration is missing the Compass MCP entry"))?;
+    if platform == "agents"
+        && value.get("schema").and_then(Value::as_str) != Some(GENERIC_MCP_SCHEMA)
+    {
+        return Err(format!(
+            "agents configuration requires schema {GENERIC_MCP_SCHEMA}"
+        ));
+    }
+    let url_is_compass = entry.get("url").and_then(Value::as_str) == Some(MCP_HTTP_URL);
+    let command_is_compass = if platform == "opencode" {
+        entry
+            .get("command")
+            .and_then(Value::as_array)
+            .is_some_and(|command| {
+                command.iter().filter_map(Value::as_str).eq([
+                    "compass",
+                    "serve",
+                    "--transport",
+                    "stdio",
+                ]) && command.len() == 4
+            })
+    } else {
+        entry.get("command").and_then(Value::as_str) == Some("compass")
+            && entry
+                .get("args")
+                .and_then(Value::as_array)
+                .is_some_and(|args| {
+                    args.iter()
+                        .filter_map(Value::as_str)
+                        .eq(["serve", "--transport", "stdio"])
+                        && args.len() == 3
+                })
+    };
+    let valid = match expected_transport {
+        Some(Transport::Stdio) => command_is_compass,
+        Some(Transport::Http) => url_is_compass,
+        None => command_is_compass || url_is_compass,
+    };
+    if valid {
+        Ok(())
+    } else {
+        Err(format!(
+            "{platform} MCP entry does not invoke Compass serve or its loopback endpoint"
+        ))
+    }
+}
+
+fn validate_native_mcp_config_bytes(
+    platform: &str,
+    bytes: &[u8],
+    expected_transport: Option<Transport>,
+) -> Result<(), String> {
+    if platform == "opencode" {
+        return validate_mcp_config_bytes(platform, bytes, expected_transport);
+    }
+    validate_mcp_config_bytes("claude", bytes, expected_transport)
+}
+
+fn validate_native_package_files(
+    manifest: &BundleManifest,
+    files: &BTreeMap<String, Vec<u8>>,
+    findings: &mut Vec<ValidationFinding>,
+) {
+    let required: &[&str] = match manifest.platform.as_str() {
+        "codex" => &[
+            ".agents/plugins/marketplace.json",
+            ".codex-plugin/plugin.json",
+            ".mcp.json",
+        ],
+        "claude" => &[
+            ".claude-plugin/plugin.json",
+            ".claude-plugin/marketplace.json",
+            ".mcp.json",
+        ],
+        "opencode" => &["package.json", "opencode.json", "src/index.js"],
+        _ => return,
+    };
+    if manifest
+        .harness_version
+        .as_deref()
+        .is_none_or(str::is_empty)
+    {
+        findings.push(ValidationFinding {
+            path: "manifest.json".to_owned(),
+            rule: "native package does not record its verified harness version".to_owned(),
+        });
+    }
+    for path in required {
+        if !files.contains_key(*path) {
+            findings.push(ValidationFinding {
+                path: (*path).to_owned(),
+                rule: "missing native package artifact".to_owned(),
+            });
+        }
+    }
+    let plugin_manifest = match manifest.platform.as_str() {
+        "codex" => Some(".codex-plugin/plugin.json"),
+        "claude" => Some(".claude-plugin/plugin.json"),
+        "opencode" => Some("package.json"),
+        _ => None,
+    };
+    if let Some(path) = plugin_manifest
+        && let Some(bytes) = files.get(path)
+    {
+        match serde_json::from_slice::<Value>(bytes) {
+            Ok(value) if value.get("name").and_then(Value::as_str).is_some() => {}
+            Ok(_) => findings.push(ValidationFinding {
+                path: path.to_owned(),
+                rule: "native package manifest is missing its name".to_owned(),
+            }),
+            Err(error) => findings.push(ValidationFinding {
+                path: path.to_owned(),
+                rule: format!("invalid native package manifest: {error}"),
+            }),
+        }
+    }
+}
+
+fn read_bounded_file(path: &Path) -> Result<Vec<u8>, String> {
+    let metadata = fs::symlink_metadata(path)
+        .map_err(|error| format!("could not inspect {}: {error}", path.display()))?;
+    if metadata.file_type().is_symlink() || !metadata.is_file() {
+        return Err(format!(
+            "{} must be a regular file and not a symbolic link",
+            path.display()
+        ));
+    }
+    read_file_with_limit(path, MAX_FILE_BYTES)
+        .map_err(|error| format!("could not read {}: {error}", path.display()))
+}
+
+fn read_file_with_limit(path: &Path, limit: u64) -> Result<Vec<u8>, String> {
+    let file = fs::File::open(path).map_err(|error| error.to_string())?;
+    let opened = file.metadata().map_err(|error| error.to_string())?;
+    let current = fs::symlink_metadata(path).map_err(|error| error.to_string())?;
+    if current.file_type().is_symlink() || !opened_file_matches_path(&opened, &current) {
+        return Err("path changed or became a symbolic link while it was opened".to_owned());
+    }
+    let mut bytes = Vec::new();
+    file.take(limit.saturating_add(1))
+        .read_to_end(&mut bytes)
+        .map_err(|error| error.to_string())?;
+    if bytes.len() as u64 > limit {
+        return Err(format!("content exceeds byte limit of {limit}"));
+    }
+    Ok(bytes)
+}
+
+#[cfg(unix)]
+fn opened_file_matches_path(opened: &fs::Metadata, current: &fs::Metadata) -> bool {
+    use std::os::unix::fs::MetadataExt;
+
+    opened.dev() == current.dev() && opened.ino() == current.ino()
+}
+
+#[cfg(not(unix))]
+fn opened_file_matches_path(opened: &fs::Metadata, current: &fs::Metadata) -> bool {
+    opened.file_type() == current.file_type()
+        && opened.len() == current.len()
+        && opened.modified().ok() == current.modified().ok()
+}
+
+fn pass_check(id: &'static str, detail: String) -> DoctorCheck {
+    DoctorCheck {
+        id,
+        status: "pass",
+        detail,
+    }
+}
+
+fn fail_check(id: &'static str, detail: String) -> DoctorCheck {
+    DoctorCheck {
+        id,
+        status: "fail",
+        detail,
+    }
+}
+
+fn skip_check(id: &'static str, detail: String) -> DoctorCheck {
+    DoctorCheck {
+        id,
+        status: "skip",
+        detail,
+    }
+}
+
+fn bundle_config_path(platform: &str) -> &'static str {
+    match platform {
+        "codex" | "claude" => ".mcp.json",
+        "opencode" => "opencode.json",
+        _ => ".agents/mcp.json",
+    }
+}
+
+fn transport_name(transport: Transport) -> &'static str {
+    match transport {
+        Transport::Stdio => "stdio",
+        Transport::Http => "http",
+    }
+}
+
+fn safe_relative_path(root: &Path, relative: &str) -> Result<PathBuf, String> {
+    let path = Path::new(relative);
+    if path.is_absolute()
+        || path.components().any(|component| {
+            matches!(
+                component,
+                Component::ParentDir | Component::RootDir | Component::Prefix(_)
+            )
+        })
+    {
+        return Err(format!("error: unsafe bundle path '{relative}'"));
+    }
+    Ok(root.join(path))
+}
+
+fn digest_bytes(bytes: &[u8]) -> String {
+    format!("{:x}", Sha256::digest(bytes))
+}
+
+fn display_relative(root: &Path, path: &Path) -> String {
+    path.strip_prefix(root)
+        .ok()
+        .filter(|relative| !relative.as_os_str().is_empty())
+        .unwrap_or_else(|| Path::new("."))
+        .to_string_lossy()
+        .replace('\\', "/")
+}
+
+fn strip_error_prefix(error: &str) -> String {
+    error.strip_prefix("error: ").unwrap_or(error).to_owned()
+}
+
+fn json_success(value: &Value) -> Outcome {
+    match serde_json::to_string_pretty(value) {
+        Ok(stdout) => Outcome::success(stdout),
+        Err(error) => Outcome::failure(format!("error: could not encode agent output: {error}")),
+    }
+}
+
+fn usage_error(message: &str) -> Outcome {
+    Outcome::failure_with_code(message.to_owned(), 2)
+}
+
+fn outcome(code: u8, stdout: String, stderr: String) -> Outcome {
+    Outcome {
+        code,
+        stdout,
+        stderr,
+        stdout_trailing_newline: true,
+        stderr_trailing_newline: true,
+        html_output: None,
+    }
+}
diff --git a/crates/compass-cli/src/distribution.rs b/crates/compass-cli/src/distribution.rs
new file mode 100644
index 000000000..e27b36cd0
--- /dev/null
+++ b/crates/compass-cli/src/distribution.rs
@@ -0,0 +1,316 @@
+use std::collections::BTreeMap;
+
+use serde::Deserialize;
+use serde_json::{Value, json};
+
+const DISTRIBUTION_SCHEMA: &str = "compass.distribution/1";
+const INVENTORY: &str = include_str!(concat!(
+    env!("CARGO_MANIFEST_DIR"),
+    "/../../distribution.toml"
+));
+const OPENCODE_RUNTIME: &str = include_str!(concat!(
+    env!("CARGO_MANIFEST_DIR"),
+    "/../../packages/compass-opencode/src/index.js"
+));
+
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct DistributionInventory {
+    schema: String,
+    package: PackageInventory,
+    harness: BTreeMap<String, HarnessInventory>,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct PackageInventory {
+    name: String,
+    version: String,
+    description: String,
+    author: String,
+    homepage: String,
+    repository: String,
+    license: String,
+    keywords: Vec<String>,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct HarnessInventory {
+    verified_version: String,
+    manifest: String,
+    mcp: String,
+    marketplace: Option<String>,
+    npm_name: Option<String>,
+    plugin_api_version: Option<String>,
+}
+
+pub(crate) struct NativePackage {
+    pub files: BTreeMap<String, Vec<u8>>,
+}
+
+pub(crate) fn native_package(platform: &str, transport: &str) -> Result<NativePackage, String> {
+    let inventory = load_inventory()?;
+    let harness = inventory
+        .harness
+        .get(platform)
+        .ok_or_else(|| format!("error: distribution inventory has no '{platform}' harness"))?;
+    let mut files = BTreeMap::new();
+    let mcp = mcp_config(platform, transport, harness.npm_name.as_deref())?;
+    insert_json(&mut files, &harness.mcp, &mcp)?;
+    match platform {
+        "codex" => {
+            insert_json(
+                &mut files,
+                &harness.manifest,
+                &plugin_manifest(&inventory.package, harness, true),
+            )?;
+            let marketplace = harness.marketplace.as_deref().ok_or_else(|| {
+                "error: Codex distribution is missing its marketplace path".to_owned()
+            })?;
+            insert_json(
+                &mut files,
+                marketplace,
+                &codex_marketplace_manifest(&inventory.package),
+            )?;
+        }
+        "claude" => {
+            insert_json(
+                &mut files,
+                &harness.manifest,
+                &plugin_manifest(&inventory.package, harness, false),
+            )?;
+            let marketplace = harness.marketplace.as_deref().ok_or_else(|| {
+                "error: Claude distribution is missing its marketplace path".to_owned()
+            })?;
+            insert_json(
+                &mut files,
+                marketplace,
+                &marketplace_manifest(&inventory.package),
+            )?;
+        }
+        "opencode" => {
+            insert_json(
+                &mut files,
+                &harness.manifest,
+                &opencode_manifest(&inventory.package, harness)?,
+            )?;
+            files.insert(
+                "src/index.js".to_owned(),
+                OPENCODE_RUNTIME.as_bytes().to_vec(),
+            );
+            files.insert(
+                "README.md".to_owned(),
+                opencode_readme(&inventory.package, harness).into_bytes(),
+            );
+        }
+        _ => {
+            return Err(format!(
+                "error: platform '{platform}' does not have a native package generator"
+            ));
+        }
+    }
+    Ok(NativePackage { files })
+}
+
+pub(crate) fn verified_harness_version(platform: &str) -> Result<String, String> {
+    load_inventory()?
+        .harness
+        .get(platform)
+        .map(|harness| harness.verified_version.clone())
+        .ok_or_else(|| format!("error: distribution inventory has no '{platform}' harness"))
+}
+
+fn load_inventory() -> Result<DistributionInventory, String> {
+    let inventory = toml::from_str::<DistributionInventory>(INVENTORY)
+        .map_err(|error| format!("error: invalid distribution.toml: {error}"))?;
+    if inventory.schema != DISTRIBUTION_SCHEMA {
+        return Err(format!(
+            "error: unsupported distribution schema '{}'",
+            inventory.schema
+        ));
+    }
+    if inventory.package.name != "compass" || inventory.package.version != env!("CARGO_PKG_VERSION")
+    {
+        return Err(format!(
+            "error: distribution package identity must be compass {}",
+            env!("CARGO_PKG_VERSION")
+        ));
+    }
+    for required in ["codex", "claude", "opencode"] {
+        let harness = inventory.harness.get(required).ok_or_else(|| {
+            format!("error: distribution inventory is missing harness '{required}'")
+        })?;
+        for (field, path) in [("manifest", &harness.manifest), ("mcp", &harness.mcp)] {
+            validate_relative_path(field, path)?;
+        }
+        if let Some(path) = &harness.marketplace {
+            validate_relative_path("marketplace", path)?;
+        }
+    }
+    Ok(inventory)
+}
+
+fn validate_relative_path(field: &str, path: &str) -> Result<(), String> {
+    let parsed = std::path::Path::new(path);
+    if path.is_empty()
+        || parsed.is_absolute()
+        || parsed.components().any(|component| {
+            matches!(
+                component,
+                std::path::Component::ParentDir
+                    | std::path::Component::RootDir
+                    | std::path::Component::Prefix(_)
+            )
+        })
+    {
+        return Err(format!(
+            "error: distribution {field} path '{path}' is not portable"
+        ));
+    }
+    Ok(())
+}
+
+fn plugin_manifest(
+    package: &PackageInventory,
+    harness: &HarnessInventory,
+    codex_interface: bool,
+) -> Value {
+    let mut value = json!({
+        "name": package.name,
+        "version": package.version,
+        "description": package.description,
+        "author": {"name": package.author},
+        "homepage": package.homepage,
+        "repository": package.repository,
+        "license": package.license,
+        "keywords": package.keywords,
+        "skills": "./skills/",
+        "mcpServers": format!("./{}", harness.mcp),
+    });
+    if codex_interface {
+        value["interface"] = json!({
+            "displayName": "Compass",
+            "shortDescription": "Local-first structural code intelligence",
+            "longDescription": package.description,
+            "developerName": package.author,
+            "category": "Developer Tools",
+            "capabilities": ["Read"],
+            "websiteURL": package.homepage,
+            "defaultPrompt": [
+                "Map this repository before making a cross-cutting change.",
+                "Trace the callers and impact of this symbol."
+            ]
+        });
+    }
+    value
+}
+
+fn marketplace_manifest(package: &PackageInventory) -> Value {
+    json!({
+        "$schema": "https://json.schemastore.org/claude-code-marketplace.json",
+        "name": "compass-plugins",
+        "version": package.version,
+        "description": package.description,
+        "owner": {"name": package.author},
+        "plugins": [{
+            "name": package.name,
+            "description": package.description,
+            "version": package.version,
+            "source": "./",
+            "category": "development"
+        }]
+    })
+}
+
+fn codex_marketplace_manifest(package: &PackageInventory) -> Value {
+    json!({
+        "name": "compass-plugins",
+        "interface": {"displayName": "Compass Plugins"},
+        "plugins": [{
+            "name": package.name,
+            "source": {"source": "local", "path": "./"},
+            "policy": {
+                "installation": "AVAILABLE",
+                "authentication": "ON_USE"
+            },
+            "category": "Developer Tools"
+        }]
+    })
+}
+
+fn opencode_manifest(
+    package: &PackageInventory,
+    harness: &HarnessInventory,
+) -> Result<Value, String> {
+    let name = harness
+        .npm_name
+        .as_deref()
+        .ok_or_else(|| "error: OpenCode distribution is missing npm_name".to_owned())?;
+    let api_version = harness
+        .plugin_api_version
+        .as_deref()
+        .ok_or_else(|| "error: OpenCode distribution is missing plugin_api_version".to_owned())?;
+    Ok(json!({
+        "name": name,
+        "version": package.version,
+        "description": package.description,
+        "license": package.license,
+        "type": "module",
+        "exports": "./src/index.js",
+        "files": ["src/index.js", "skills", "opencode.json"],
+        "dependencies": {"@opencode-ai/plugin": api_version}
+    }))
+}
+
+fn mcp_config(
+    platform: &str,
+    transport: &str,
+    opencode_plugin_name: Option<&str>,
+) -> Result<Value, String> {
+    let server = match transport {
+        "stdio" => json!({"command": "compass", "args": ["serve", "--transport", "stdio"]}),
+        "http" => json!({"type": "http", "url": "http://127.0.0.1:8080/mcp"}),
+        _ => {
+            return Err(format!(
+                "error: unsupported distribution transport '{transport}'"
+            ));
+        }
+    };
+    Ok(if platform == "opencode" {
+        let plugin_name = opencode_plugin_name
+            .ok_or_else(|| "error: OpenCode distribution is missing npm_name".to_owned())?;
+        let server = if transport == "stdio" {
+            json!({"type": "local", "command": ["compass", "serve", "--transport", "stdio"], "enabled": true})
+        } else {
+            json!({"type": "remote", "url": "http://127.0.0.1:8080/mcp", "enabled": true})
+        };
+        json!({
+            "$schema": "https://opencode.ai/config.json",
+            "plugin": [plugin_name],
+            "skills": {"paths": [format!("./node_modules/{plugin_name}/skills")]},
+            "mcp": {"compass": server}
+        })
+    } else {
+        json!({"mcpServers": {"compass": server}})
+    })
+}
+
+fn insert_json(
+    files: &mut BTreeMap<String, Vec<u8>>,
+    path: &str,
+    value: &Value,
+) -> Result<(), String> {
+    let mut encoded = serde_json::to_vec_pretty(value)
+        .map_err(|error| format!("error: could not encode {path}: {error}"))?;
+    encoded.push(b'\n');
+    files.insert(path.to_owned(), encoded);
+    Ok(())
+}
+
+fn opencode_readme(package: &PackageInventory, harness: &HarnessInventory) -> String {
+    format!(
+        "# Compass for OpenCode\n\n{}\n\nVerified with OpenCode {}. The plugin registers a thin MCP configuration tool; graph logic remains in the `compass` binary.\n",
+        package.description, harness.verified_version
+    )
+}
diff --git a/crates/compass-cli/src/help.rs b/crates/compass-cli/src/help.rs
index 275382ea0..4a7488f8c 100644
--- a/crates/compass-cli/src/help.rs
+++ b/crates/compass-cli/src/help.rs
@@ -121,6 +121,7 @@ const GROUPS: &[Group] = &[
             "add",
             "prs",
             "hook",
+            "agent",
             "install",
             "uninstall",
             "upgrade",
@@ -479,7 +480,7 @@ const PAGES: &[Page] = &[
         "serve",
         "Serve the knowledge graph through the Model Context Protocol",
         ["compass serve [GRAPH_PATH] [OPTIONS]"],
-        "Arguments:\n  [GRAPH_PATH]                   Graph JSON [default: compass-out/graph.json]\n\nOptions:\n  --graph <PATH>                 Graph JSON; conflicts with GRAPH_PATH\n  --transport <stdio|http>       Transport [default: stdio]\n  --host <HOST>                  HTTP bind host [default: 127.0.0.1]\n  --port <PORT>                  HTTP bind port [default: 8080]\n  --api-key <KEY>                HTTP bearer token [env: COMPASS_API_KEY]\n  --path <PATH>                  HTTP endpoint [default: /mcp]\n  --json-response                Use JSON responses for HTTP\n  --stateless                    Disable HTTP sessions\n  --session-timeout <SECONDS>    Session timeout [default: 3600]\n\nExamples:\n  compass serve\n  compass serve --transport http --port 9000\n\nNotes:\n  HTTP transport requires an API key when binding outside a trusted local environment."
+        "Arguments:\n  [GRAPH_PATH]                   Graph JSON [default: compass-out/graph.json]\n\nOptions:\n  --graph <PATH>                 Graph JSON; conflicts with GRAPH_PATH\n  --transport <stdio|http>       Transport [default: stdio]\n  --host <HOST>                  HTTP bind host [default: 127.0.0.1]\n  --port <PORT>                  HTTP bind port [default: 8080]\n  --api-key <KEY>                HTTP bearer token [env: COMPASS_API_KEY]\n  --path <PATH>                  HTTP endpoint [default: /mcp]\n  --json-response                Use JSON responses for HTTP\n  --stateless                    Use stateless HTTP (default; compatibility spelling)\n  --session-timeout <SECONDS>    Deprecated and ignored; removed in 0.5.0\n\nExamples:\n  compass serve\n  compass serve --transport http --port 9000\n\nNotes:\n  HTTP uses stateless MCP 2026-07-28 and requires an API key when binding outside a trusted local environment."
     ),
     page!(
         "global",
@@ -553,6 +554,48 @@ const PAGES: &[Page] = &[
         ["compass hook status"],
         "Examples:\n  compass hook status"
     ),
+    page!(
+        "agent",
+        "Manage Compass integrations for coding agents",
+        ["compass agent <COMMAND>"],
+        "Commands:\n  list        List supported agent platforms\n  install     Install the managed Compass skill collection\n  doctor      Diagnose a local agent integration\n  export      Export a portable seven-skill bundle\n  validate    Validate an exported or managed bundle\n  mcp-config  Render platform-native MCP configuration\n\nExamples:\n  compass agent list\n  compass agent install --platform codex\n  compass agent doctor --platform codex\n  compass agent export --platform claude --out ./compass-agent\n  compass agent validate --path ./compass-agent\n  compass agent mcp-config --platform opencode --transport stdio"
+    ),
+    page!(
+        "agent list",
+        "List supported Compass agent platforms",
+        ["compass agent list [--format text|json]"],
+        "Options:\n  --format <text|json>     Output format [default: text]\n\nExamples:\n  compass agent list\n  compass agent list --format json"
+    ),
+    page!(
+        "agent install",
+        "Install Compass guidance through the managed installer",
+        ["compass agent install [PLATFORM] [OPTIONS]"],
+        "Arguments and options are identical to `compass install`.\n\nExamples:\n  compass agent install --platform codex\n  compass agent install --all --dry-run\n\nNotes:\n  This command delegates to `compass install` without translating arguments."
+    ),
+    page!(
+        "agent doctor",
+        "Diagnose a local Compass agent integration",
+        ["compass agent doctor --platform <NAME> [OPTIONS]"],
+        "Options:\n  --platform <NAME>        MCP platform: codex, claude, opencode, or agents\n  --project-root <PATH>    Project root [default: .]\n  --user-root <PATH>       User configuration root; skips project graph checks\n  --format <text|json>     Output format [default: text]\n\nExamples:\n  compass agent doctor --platform codex\n  compass agent doctor --platform claude --project-root ./repo --format json\n\nNotes:\n  --project and --user remain accepted as compatibility aliases that take a path. Project diagnostics honor COMPASS_OUT and resolve artifacts through the current immutable snapshot. Agent list reports every installable platform; doctor is limited to platforms with a supported MCP configuration schema."
+    ),
+    page!(
+        "agent export",
+        "Export a deterministic portable Compass agent bundle",
+        ["compass agent export --platform <NAME> --out <DIR>"],
+        "Options:\n  --platform <NAME>        codex, claude, opencode, or agents\n  --out <DIR>              Missing or empty destination directory\n  --transport <stdio|http> MCP transport [default: stdio]\n  --format <text|json>     Output format [default: text]\n\nExamples:\n  compass agent export --platform codex --out ./compass-agent"
+    ),
+    page!(
+        "agent validate",
+        "Validate a portable or managed Compass agent bundle",
+        ["compass agent validate --path <DIR> [OPTIONS]"],
+        "Options:\n  --path <DIR>             Exported bundle or managed skill directory\n  --platform <NAME>        Require a matching exported platform\n  --format <text|json>     Output format [default: text]\n\nExamples:\n  compass agent validate --path ./compass-agent\n  compass agent validate --path .agents/skills/compass --platform codex"
+    ),
+    page!(
+        "agent mcp-config",
+        "Render credential-free native MCP configuration",
+        ["compass agent mcp-config --platform <NAME> --transport <stdio|http>"],
+        "Options:\n  --platform <NAME>        codex, claude, opencode, or agents\n  --transport <stdio|http> MCP transport [default: stdio]\n\nExamples:\n  compass agent mcp-config --platform codex --transport stdio\n  compass agent mcp-config --platform opencode --transport http"
+    ),
     page!(
         "install",
         "Install Compass guidance for coding assistants",
diff --git a/crates/compass-cli/src/install_commands.rs b/crates/compass-cli/src/install_commands.rs
index fb6772de7..b97ac2ed6 100644
--- a/crates/compass-cli/src/install_commands.rs
+++ b/crates/compass-cli/src/install_commands.rs
@@ -27,6 +27,15 @@ use crate::{Frontend, Outcome};
 const SKILL_VERSION: &str = env!("CARGO_PKG_VERSION");
 const SKILL_ASSET: &str = "compass-skill/SKILL.md";
 const REFERENCE_BUNDLE: &str = "compass-skill";
+const FOCUSED_SKILL_ASSET_ROOT: &str = "compass-focused-skills";
+const FOCUSED_SKILLS: &[&str] = &[
+    "compass-architecture",
+    "compass-change-impact",
+    "compass-debug",
+    "compass-index-maintenance",
+    "compass-mcp-setup",
+    "compass-navigate",
+];
 const PLATFORM_NAMES: &[&str] = &[
     "claude",
     "cline",
@@ -82,6 +91,25 @@ struct EmbeddedAsset {
     bytes: &'static [u8],
 }
 
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub(crate) struct AgentInventoryEntry {
+    pub id: &'static str,
+    pub aliases: &'static [&'static str],
+    pub support: &'static str,
+    pub commands: &'static [&'static str],
+    pub config_paths: &'static [&'static str],
+    pub project_skill: Option<&'static str>,
+    pub user_skill: Option<&'static str>,
+    pub documentation_url: &'static str,
+    pub verified_on: &'static str,
+}
+
+#[derive(Clone)]
+pub(crate) struct EmbeddedSkillFile {
+    pub path: String,
+    pub bytes: &'static [u8],
+}
+
 include!(concat!(env!("OUT_DIR"), "/install_assets.rs"));
 
 #[derive(Clone, Copy)]
@@ -101,6 +129,144 @@ pub(crate) fn command_install(frontend: Frontend, args: &[String]) -> Outcome {
     command_install_legacy(frontend, args)
 }
 
+pub(crate) fn agent_inventory() -> Result<Vec<AgentInventoryEntry>, String> {
+    let registry = AgentRegistry::new()?;
+    let mut entries = registry
+        .iter()
+        .map(|agent| AgentInventoryEntry {
+            id: agent.id,
+            aliases: agent.aliases,
+            support: match agent.tier {
+                SupportTier::SharedSkill => "shared_skill",
+                SupportTier::NativeSkill => "native_skill",
+                SupportTier::AdapterOnly => "adapter_only",
+            },
+            commands: agent.commands,
+            config_paths: agent.config_paths,
+            project_skill: agent.project_skill,
+            user_skill: agent.user_skill,
+            documentation_url: agent.documentation_url,
+            verified_on: agent.verified_on,
+        })
+        .collect::<Vec<_>>();
+    entries.sort_by_key(|entry| entry.id);
+    Ok(entries)
+}
+
+pub(crate) fn embedded_skill_files() -> Vec<EmbeddedSkillFile> {
+    let mut files = Vec::new();
+    for asset in EMBEDDED_ASSETS {
+        let target = if let Some(relative) = asset.path.strip_prefix("compass-skill/") {
+            Some(format!("skills/compass/{relative}"))
+        } else if let Some(relative) = asset.path.strip_prefix("compass-focused-skills/") {
+            let mut parts = relative.splitn(2, '/');
+            let name = parts.next();
+            let child = parts.next();
+            match (name, child) {
+                (Some(name), Some(child)) if FOCUSED_SKILLS.contains(&name) => {
+                    Some(format!("skills/{name}/{child}"))
+                }
+                _ => None,
+            }
+        } else {
+            None
+        };
+        if let Some(path) = target {
+            files.push(EmbeddedSkillFile {
+                path,
+                bytes: asset.bytes,
+            });
+        }
+    }
+    files.sort_by(|left, right| left.path.cmp(&right.path));
+    files
+}
+
+pub(crate) fn managed_skill_directory(
+    platform: &str,
+    root: &Path,
+    user: bool,
+) -> Result<PathBuf, String> {
+    let registry = AgentRegistry::new()?;
+    let agent = registry.resolve(platform).ok_or_else(|| {
+        format!(
+            "error: unknown platform '{platform}'. Choose from: {}",
+            registry.ids()
+        )
+    })?;
+    let scope = if user {
+        InstallScope::User(root.to_path_buf())
+    } else {
+        InstallScope::Project(root.to_path_buf())
+    };
+    let destination = agent
+        .skill_destination(&scope)
+        .ok_or_else(|| format!("error: platform '{platform}' has no managed skill destination"))?;
+    destination
+        .parent()
+        .map(Path::to_path_buf)
+        .ok_or_else(|| "error: invalid managed skill destination".to_owned())
+}
+
+pub(crate) fn verify_managed_skill_collection(primary: &Path) -> Result<(), String> {
+    let directories = managed_skill_collection_directories(primary)?;
+    let container = primary
+        .parent()
+        .ok_or_else(|| "error: invalid managed skill collection path".to_owned())?;
+    let mut expected = BTreeMap::from([(primary.to_path_buf(), format!("{REFERENCE_BUNDLE}/"))]);
+    for name in FOCUSED_SKILLS {
+        expected.insert(
+            container.join(name),
+            format!("{FOCUSED_SKILL_ASSET_ROOT}/{name}/"),
+        );
+    }
+    let actual_paths = directories.into_iter().collect::<BTreeSet<_>>();
+    let expected_paths = expected.keys().cloned().collect::<BTreeSet<_>>();
+    if actual_paths != expected_paths {
+        return Err(
+            "error: managed skill collection does not contain the expected seven skill directories"
+                .to_owned(),
+        );
+    }
+    for (directory, prefix) in expected {
+        let manifest = verify_manifest(&directory)?;
+        if manifest.compass_version != SKILL_VERSION {
+            return Err(format!(
+                "error: managed skill {} was installed by Compass {} instead of {}",
+                directory.display(),
+                manifest.compass_version,
+                SKILL_VERSION
+            ));
+        }
+        let mut expected_files = expected_package_digests(&prefix);
+        expected_files.insert(
+            ".compass_version".to_owned(),
+            digest_bytes(SKILL_VERSION.as_bytes()),
+        );
+        if manifest.files != expected_files {
+            return Err(format!(
+                "error: managed skill {} does not match the embedded Compass {} collection",
+                directory.display(),
+                SKILL_VERSION
+            ));
+        }
+    }
+    Ok(())
+}
+
+pub(crate) fn managed_skill_collection_directories(primary: &Path) -> Result<Vec<PathBuf>, String> {
+    let destination = primary.join("SKILL.md");
+    skill_collection_destinations(&destination)?
+        .into_iter()
+        .map(|skill| {
+            skill
+                .parent()
+                .map(Path::to_path_buf)
+                .ok_or_else(|| "error: invalid managed skill destination".to_owned())
+        })
+        .collect()
+}
+
 fn command_install_legacy(frontend: Frontend, args: &[String]) -> Outcome {
     let prefix = command_prefix(frontend);
     if args
@@ -446,13 +612,11 @@ fn execute_skill_target(
     };
     if request.dry_run {
         let paths = planned_target_paths(scope, Some(&destination), &consumers);
-        let preflight = validate_skill_destination(&destination, scope.root())
-            .and_then(|()| require_owned_or_absent(&destination))
-            .and_then(|()| {
-                consumers
-                    .iter()
-                    .try_for_each(|consumer| preflight_agent_adapter(scope, consumer))
-            });
+        let preflight = preflight_skill_collection(&destination, scope.root()).and_then(|()| {
+            consumers
+                .iter()
+                .try_for_each(|consumer| preflight_agent_adapter(scope, consumer))
+        });
         return TargetResult {
             id,
             consumers,
@@ -471,17 +635,7 @@ fn execute_skill_target(
         };
     }
     let existed = destination.exists();
-    if let Err(error) = validate_skill_destination(&destination, scope.root()) {
-        return TargetResult {
-            id,
-            consumers,
-            status: InstallStatus::Failed,
-            paths: vec![destination],
-            reason: Some(error),
-            rollback: None,
-        };
-    }
-    if let Err(error) = require_owned_or_absent(&destination) {
+    if let Err(error) = preflight_skill_collection(&destination, scope.root()) {
         return TargetResult {
             id,
             consumers,
@@ -503,6 +657,8 @@ fn execute_skill_target(
             };
         }
     }
+    let skill_paths =
+        skill_collection_destinations(&destination).unwrap_or_else(|_| vec![destination.clone()]);
     let adapter_snapshots = match snapshot_files(&adapter_paths_for(scope, &consumers)) {
         Ok(snapshots) => snapshots,
         Err(error) => {
@@ -516,7 +672,7 @@ fn execute_skill_target(
             };
         }
     };
-    let skill_snapshot = match SkillSnapshot::capture(&destination) {
+    let skill_snapshot = match SkillCollectionSnapshot::capture(&destination) {
         Ok(snapshot) => snapshot,
         Err(error) => {
             return TargetResult {
@@ -541,17 +697,12 @@ fn execute_skill_target(
     ) {
         Ok(skill) => skill,
         Err(error) => {
-            let rollback = if error.contains("could not restore previous package") {
-                restore_transaction(&skill_snapshot, &adapter_snapshots)
-            } else {
-                "package staging or activation failed before changing the installed package"
-                    .to_owned()
-            };
+            let rollback = restore_transaction(&skill_snapshot, &adapter_snapshots);
             return TargetResult {
                 id,
                 consumers,
                 status: InstallStatus::Failed,
-                paths: vec![destination],
+                paths: skill_paths,
                 reason: Some(error),
                 rollback: Some(rollback),
             };
@@ -567,7 +718,7 @@ fn execute_skill_target(
                     id,
                     consumers,
                     status: InstallStatus::Failed,
-                    paths: std::iter::once(destination).chain(adapter_paths).collect(),
+                    paths: skill_paths.into_iter().chain(adapter_paths).collect(),
                     reason: Some(error),
                     rollback: Some(rollback),
                 };
@@ -585,7 +736,7 @@ fn execute_skill_target(
         } else {
             InstallStatus::Installed
         },
-        paths: std::iter::once(destination).chain(adapter_paths).collect(),
+        paths: skill_paths.into_iter().chain(adapter_paths).collect(),
         reason: None,
         rollback: None,
     }
@@ -650,6 +801,34 @@ impl SkillSnapshot {
     }
 }
 
+struct SkillCollectionSnapshot {
+    skills: Vec<SkillSnapshot>,
+}
+
+impl SkillCollectionSnapshot {
+    fn capture(destination: &Path) -> Result<Self, String> {
+        let skills = skill_collection_destinations(destination)?
+            .iter()
+            .map(|path| SkillSnapshot::capture(path))
+            .collect::<Result<Vec<_>, _>>()?;
+        Ok(Self { skills })
+    }
+
+    fn restore(&self) -> Result<(), String> {
+        let mut errors = Vec::new();
+        for skill in self.skills.iter().rev() {
+            if let Err(error) = skill.restore() {
+                errors.push(error);
+            }
+        }
+        if errors.is_empty() {
+            Ok(())
+        } else {
+            Err(errors.join("; "))
+        }
+    }
+}
+
 fn snapshot_directory(directory: &Path) -> Result<Vec<FileSnapshot>, String> {
     fn visit(directory: &Path, snapshots: &mut Vec<FileSnapshot>) -> Result<(), String> {
         for entry in fs::read_dir(directory)
@@ -739,7 +918,7 @@ fn restore_files(snapshots: &[FileSnapshot]) -> String {
     }
 }
 
-fn restore_transaction(skill: &SkillSnapshot, adapters: &[FileSnapshot]) -> String {
+fn restore_transaction(skill: &SkillCollectionSnapshot, adapters: &[FileSnapshot]) -> String {
     let adapter_result = restore_files(adapters);
     match skill.restore() {
         Ok(()) if !adapter_result.starts_with("rollback incomplete") => {
@@ -811,7 +990,10 @@ fn planned_target_paths(
 ) -> Vec<PathBuf> {
     skill_destination
         .into_iter()
-        .map(Path::to_path_buf)
+        .flat_map(|destination| {
+            skill_collection_destinations(destination)
+                .unwrap_or_else(|_| vec![destination.to_path_buf()])
+        })
         .chain(adapter_paths_for(scope, consumers))
         .collect::<BTreeSet<_>>()
         .into_iter()
@@ -1307,7 +1489,7 @@ fn command_uninstall_compass(args: &[String]) -> Outcome {
             .resolve(&platform)
             .and_then(|agent| agent.skill_destination(&scope))
             .filter(|destination| is_managed_skill(destination))
-            .map(|destination| SkillSnapshot::capture(&destination))
+            .map(|destination| SkillCollectionSnapshot::capture(&destination))
             .transpose();
         let skill_snapshot = match skill_snapshot {
             Ok(snapshot) => snapshot,
@@ -2032,6 +2214,34 @@ fn is_managed_skill(path: &Path) -> bool {
     parent.join(".compass_version").is_file() && legacy_skill_is_unmodified(parent)
 }
 
+fn focused_skill_destination(destination: &Path, name: &str) -> Result<PathBuf, String> {
+    let skill_directory = destination
+        .parent()
+        .ok_or_else(|| "error: invalid skill destination".to_owned())?;
+    let container = skill_directory
+        .parent()
+        .ok_or_else(|| "error: invalid skill destination".to_owned())?;
+    Ok(container.join(name).join("SKILL.md"))
+}
+
+fn skill_collection_destinations(destination: &Path) -> Result<Vec<PathBuf>, String> {
+    std::iter::once(Ok(destination.to_path_buf()))
+        .chain(
+            FOCUSED_SKILLS
+                .iter()
+                .map(|name| focused_skill_destination(destination, name)),
+        )
+        .collect()
+}
+
+fn preflight_skill_collection(destination: &Path, root: &Path) -> Result<(), String> {
+    for path in skill_collection_destinations(destination)? {
+        validate_skill_destination(&path, root)?;
+        require_owned_or_absent(&path)?;
+    }
+    Ok(())
+}
+
 fn install_skill(
     config: Platform,
     project: bool,
@@ -2198,7 +2408,7 @@ fn install_skill_at_scoped(
     scope: &str,
     root: &Path,
 ) -> Result<SkillInstall, String> {
-    require_owned_or_absent(&destination)?;
+    preflight_skill_collection(&destination, root)?;
     let parent = destination
         .parent()
         .ok_or_else(|| "error: invalid skill destination".to_owned())?
@@ -2213,13 +2423,64 @@ fn install_skill_at_scoped(
         )
     })?;
     let _lock = InstallLock::acquire(container)?;
+
+    let mut installs = vec![install_skill_package_at_scoped(
+        destination.clone(),
+        consumers.clone(),
+        scope,
+        root,
+        &format!("{REFERENCE_BUNDLE}/"),
+        SKILL_ASSET,
+    )?];
+    for name in FOCUSED_SKILLS {
+        let focused_destination = focused_skill_destination(&destination, name)?;
+        let asset_prefix = format!("{FOCUSED_SKILL_ASSET_ROOT}/{name}/");
+        let skill_asset = format!("{asset_prefix}SKILL.md");
+        installs.push(install_skill_package_at_scoped(
+            focused_destination,
+            consumers.clone(),
+            scope,
+            root,
+            &asset_prefix,
+            &skill_asset,
+        )?);
+    }
+
+    let changed = installs.iter().any(|install| install.changed);
+    let messages = installs
+        .into_iter()
+        .flat_map(|install| install.messages)
+        .collect();
+    Ok(SkillInstall {
+        path: destination,
+        messages,
+        changed,
+    })
+}
+
+fn install_skill_package_at_scoped(
+    destination: PathBuf,
+    consumers: BTreeSet<String>,
+    scope: &str,
+    root: &Path,
+    asset_prefix: &str,
+    skill_asset: &str,
+) -> Result<SkillInstall, String> {
+    require_owned_or_absent(&destination)?;
+    let parent = destination
+        .parent()
+        .ok_or_else(|| "error: invalid skill destination".to_owned())?
+        .to_path_buf();
+    let container = parent
+        .parent()
+        .ok_or_else(|| "error: invalid skill destination".to_owned())?;
     let mut merged_consumers = consumers;
     if let Ok(Some(existing)) = read_manifest(&parent) {
         merged_consumers.extend(existing.consumers);
     }
-    let body = asset_text(SKILL_ASSET)
-        .ok_or_else(|| format!("error: {SKILL_ASSET} not found in package - reinstall compass"))?;
-    if manifest_is_current(&parent, body, &merged_consumers)? {
+    let _body = asset_text(skill_asset)
+        .ok_or_else(|| format!("error: {skill_asset} not found in package - reinstall compass"))?;
+    if manifest_is_current(&parent, asset_prefix, &merged_consumers)? {
         return Ok(SkillInstall {
             path: destination,
             messages: vec![format!("  skill current    ->  {}", parent.display())],
@@ -2233,15 +2494,7 @@ fn install_skill_at_scoped(
     fs::create_dir(&stage)
         .map_err(|error| format!("error: could not stage {}: {error}", stage.display()))?;
     let staged_result = (|| {
-        install_asset_tree(
-            &format!("{REFERENCE_BUNDLE}/references/"),
-            &stage.join("references"),
-        )?;
-        install_asset_tree(
-            &format!("{REFERENCE_BUNDLE}/agents/"),
-            &stage.join("agents"),
-        )?;
-        write_owned(stage.join("SKILL.md"), body)?;
+        install_asset_tree(asset_prefix, &stage)?;
         write_owned(stage.join(".compass_version"), SKILL_VERSION)?;
         let manifest = build_manifest(&stage, scope, root, merged_consumers)?;
         let text = serde_json::to_string_pretty(&manifest)
@@ -2284,16 +2537,10 @@ fn install_skill_at_scoped(
     }
     Ok(SkillInstall {
         path: destination,
-        messages: vec![
-            format!(
-                "  references       ->  {}",
-                parent.join("references").display()
-            ),
-            format!(
-                "  skill installed  ->  {}",
-                parent.join("SKILL.md").display()
-            ),
-        ],
+        messages: vec![format!(
+            "  skill installed  ->  {}",
+            parent.join("SKILL.md").display()
+        )],
         changed: true,
     })
 }
@@ -2779,10 +3026,13 @@ fn remove_skill(
                 .map_err(|error| format!("error: could not encode ownership manifest: {error}"))
                 .and_then(|text| write_owned(parent.join(".compass-install.json"), &text))
             {
-                Ok(()) => lines.push(format!(
-                    "  {consumer} removed from shared skill consumers -> {}",
-                    parent.display()
-                )),
+                Ok(()) => {
+                    update_focused_skill_consumers(&path, &manifest.consumers, lines);
+                    lines.push(format!(
+                        "  {consumer} removed from shared skill consumers -> {}",
+                        parent.display()
+                    ));
+                }
                 Err(error) => {
                     lines.push(error);
                     return original_consumers;
@@ -2791,6 +3041,7 @@ fn remove_skill(
             return manifest.consumers;
         }
     }
+    remove_managed_focused_skills(&path, project, project_dir, lines);
     if path.exists() {
         match fs::remove_file(&path) {
             Ok(()) => lines.push(format!(
@@ -2834,6 +3085,75 @@ fn remove_skill(
     BTreeSet::new()
 }
 
+fn update_focused_skill_consumers(
+    primary: &Path,
+    consumers: &BTreeSet<String>,
+    lines: &mut Vec<String>,
+) {
+    let Ok(destinations) = skill_collection_destinations(primary) else {
+        return;
+    };
+    for destination in destinations.into_iter().skip(1) {
+        let Some(directory) = destination.parent() else {
+            continue;
+        };
+        if !directory.exists() {
+            continue;
+        }
+        let Ok(mut manifest) = verify_manifest(directory) else {
+            lines.push(format!(
+                "  preserved modified focused skill -> {}",
+                directory.display()
+            ));
+            continue;
+        };
+        manifest.consumers = consumers.clone();
+        let result = serde_json::to_string_pretty(&manifest)
+            .map_err(|error| format!("error: could not encode ownership manifest: {error}"))
+            .and_then(|text| write_owned(directory.join(".compass-install.json"), &text));
+        if let Err(error) = result {
+            lines.push(error);
+        }
+    }
+}
+
+fn remove_managed_focused_skills(
+    primary: &Path,
+    project: bool,
+    project_dir: &Path,
+    lines: &mut Vec<String>,
+) {
+    let Ok(destinations) = skill_collection_destinations(primary) else {
+        return;
+    };
+    for (destination, name) in destinations.into_iter().skip(1).zip(FOCUSED_SKILLS) {
+        let Some(directory) = destination.parent() else {
+            continue;
+        };
+        if !directory.exists() {
+            continue;
+        }
+        let asset_prefix = format!("{FOCUSED_SKILL_ASSET_ROOT}/{name}/");
+        if !managed_package_is_unmodified(directory, &asset_prefix) {
+            lines.push(format!(
+                "  preserved unowned or modified focused skill -> {}",
+                directory.display()
+            ));
+            continue;
+        }
+        match fs::remove_dir_all(directory) {
+            Ok(()) => lines.push(format!(
+                "  skill removed    ->  {}",
+                display_path(&destination, project, project_dir)
+            )),
+            Err(error) => lines.push(format!(
+                "error: could not remove {}: {error}",
+                directory.display()
+            )),
+        }
+    }
+}
+
 fn uninstall_vscode(project_dir: &Path) -> Outcome {
     let mut lines = Vec::new();
     if let Some(home) = home_directory() {
@@ -3480,7 +3800,7 @@ fn verify_manifest(directory: &Path) -> Result<OwnershipManifest, String> {
 
 fn manifest_is_current(
     directory: &Path,
-    skill_body: &str,
+    asset_prefix: &str,
     consumers: &BTreeSet<String>,
 ) -> Result<bool, String> {
     let Some(manifest) = read_manifest(directory)? else {
@@ -3490,7 +3810,7 @@ fn manifest_is_current(
     if verified.compass_version != SKILL_VERSION || &verified.consumers != consumers {
         return Ok(false);
     }
-    let mut expected = expected_package_digests(skill_body);
+    let mut expected = expected_package_digests(asset_prefix);
     expected.insert(
         ".compass_version".to_owned(),
         digest_bytes(SKILL_VERSION.as_bytes()),
@@ -3498,13 +3818,10 @@ fn manifest_is_current(
     Ok(manifest.files == expected)
 }
 
-fn expected_package_digests(skill_body: &str) -> BTreeMap<String, String> {
-    let mut files = BTreeMap::from([("SKILL.md".to_owned(), digest_bytes(skill_body.as_bytes()))]);
-    let prefix = format!("{REFERENCE_BUNDLE}/");
+fn expected_package_digests(asset_prefix: &str) -> BTreeMap<String, String> {
+    let mut files = BTreeMap::new();
     for asset in EMBEDDED_ASSETS {
-        if let Some(relative) = asset.path.strip_prefix(&prefix)
-            && (relative.starts_with("references/") || relative.starts_with("agents/"))
-        {
+        if let Some(relative) = asset.path.strip_prefix(asset_prefix) {
             files.insert(relative.to_owned(), digest_bytes(asset.bytes));
         }
     }
@@ -3599,15 +3916,25 @@ fn digest_bytes(bytes: &[u8]) -> String {
 }
 
 fn legacy_skill_is_unmodified(directory: &Path) -> bool {
-    let Some(body) = asset_text(SKILL_ASSET) else {
+    if asset_text(SKILL_ASSET).is_none() {
         return false;
-    };
-    let mut expected = expected_package_digests(body);
+    }
+    managed_package_is_unmodified(directory, &format!("{REFERENCE_BUNDLE}/"))
+}
+
+fn managed_package_is_unmodified(directory: &Path, asset_prefix: &str) -> bool {
+    let mut expected = expected_package_digests(asset_prefix);
     expected.insert(
         ".compass_version".to_owned(),
         digest_bytes(SKILL_VERSION.as_bytes()),
     );
-    collect_managed_files(directory).is_ok_and(|actual| actual == expected)
+    if directory.join(".compass-install.json").is_file() {
+        return verify_manifest(directory).is_ok_and(|manifest| {
+            manifest.compass_version == SKILL_VERSION && manifest.files == expected
+        });
+    }
+    directory.join(".compass_version").is_file()
+        && collect_managed_files(directory).is_ok_and(|actual| actual == expected)
 }
 
 struct InstallLock {
diff --git a/crates/compass-cli/src/lib.rs b/crates/compass-cli/src/lib.rs
index 5f484a253..d232e66d0 100644
--- a/crates/compass-cli/src/lib.rs
+++ b/crates/compass-cli/src/lib.rs
@@ -1,9 +1,11 @@
 //! Command implementation for the native Compass CLI.
 
+mod agent_commands;
 mod call_graph_commands;
 mod capability_commands;
 mod code_query_commands;
 mod dedup_commands;
+mod distribution;
 mod help;
 mod history_batch;
 mod history_build;
@@ -75,6 +77,7 @@ pub use init_commands::{run_init, run_init_jsonl};
 
 static PROCESS_CANCELLED: AtomicBool = AtomicBool::new(false);
 static SIGNAL_HANDLER: OnceLock<Result<(), String>> = OnceLock::new();
+const SESSION_TIMEOUT_DEPRECATION: &str = "warning: --session-timeout is deprecated and ignored because MCP HTTP is stateless; it will be removed in Compass 0.5.0";
 
 pub(crate) fn process_cancellation() -> Result<&'static AtomicBool, String> {
     let installed = SIGNAL_HANDLER.get_or_init(|| {
@@ -346,6 +349,7 @@ pub fn run(frontend: Frontend, arguments: impl IntoIterator<Item = OsString>) ->
         command.clone()
     };
     let outcome = match command.as_str() {
+        "agent" => agent_commands::command(frontend, &args),
         "history" => history_commands::command(frontend, &args),
         "call-graph" => call_graph_commands::command(frontend, &args),
         "capabilities" => capability_commands::command(frontend, &args),
@@ -510,6 +514,9 @@ pub fn run_mcp(arguments: &[OsString], stdout: &mut impl Write, stderr: &mut imp
             return 2;
         }
     };
+    if options.session_timeout_used && options.transport == "http" {
+        let _result = writeln!(stderr, "{SESSION_TIMEOUT_DEPRECATION}");
+    }
     let runtime = match tokio::runtime::Builder::new_multi_thread()
         .enable_all()
         .build()
@@ -554,6 +561,7 @@ struct McpOptions {
     json_response: bool,
     stateless: bool,
     session_timeout: Option<Duration>,
+    session_timeout_used: bool,
 }
 
 fn parse_mcp_options(args: &[String]) -> Result<Option<McpOptions>, String> {
@@ -571,8 +579,9 @@ fn parse_mcp_options(args: &[String]) -> Result<Option<McpOptions>, String> {
     let mut api_key = std::env::var("COMPASS_API_KEY").ok();
     let mut path = "/mcp".to_owned();
     let mut json_response = false;
-    let mut stateless = false;
-    let mut session_timeout = Some(Duration::from_secs(3600));
+    let mut stateless = true;
+    let session_timeout = None;
+    let mut session_timeout_used = false;
     let mut index = 0_usize;
     while index < args.len() {
         let value = &args[index];
@@ -599,7 +608,8 @@ fn parse_mcp_options(args: &[String]) -> Result<Option<McpOptions>, String> {
             "--stateless" => stateless = true,
             "--session-timeout" => {
                 let raw = mcp_value(args, &mut index, "--session-timeout")?;
-                session_timeout = parse_session_timeout(raw)?;
+                let _validated = parse_session_timeout(raw)?;
+                session_timeout_used = true;
             }
             _ if value.starts_with("--graph=") => {
                 graph_flag = Some(PathBuf::from(&value[8..]));
@@ -623,7 +633,8 @@ fn parse_mcp_options(args: &[String]) -> Result<Option<McpOptions>, String> {
             _ if value.starts_with("--path=") => path = value[7..].to_owned(),
             _ if value.starts_with("--session-timeout=") => {
                 let raw = &value[18..];
-                session_timeout = parse_session_timeout(raw)?;
+                let _validated = parse_session_timeout(raw)?;
+                session_timeout_used = true;
             }
             _ if value.starts_with('-') => {
                 return Err(format!("error: unrecognized arguments: {value}"));
@@ -650,6 +661,7 @@ fn parse_mcp_options(args: &[String]) -> Result<Option<McpOptions>, String> {
         json_response,
         stateless,
         session_timeout,
+        session_timeout_used,
     }))
 }
 
@@ -676,7 +688,7 @@ fn parse_session_timeout(raw: &str) -> Result<Option<Duration>, String> {
 }
 
 fn mcp_help() -> String {
-    "Usage: compass serve [GRAPH_PATH] [--graph PATH] [--transport stdio|http] [--host HOST] [--port PORT] [--api-key KEY] [--path PATH] [--json-response] [--stateless] [--session-timeout SECONDS]".to_owned()
+    "Usage: compass serve [GRAPH_PATH] [--graph PATH] [--transport stdio|http] [--host HOST] [--port PORT] [--api-key KEY] [--path PATH] [--json-response] [--stateless] [--session-timeout SECONDS]\n\nHTTP uses stateless MCP 2026-07-28. --stateless is retained as a compatibility spelling. --session-timeout is deprecated, ignored, and will be removed in Compass 0.5.0.".to_owned()
 }
 
 /// Run Compass's long-lived native watcher, streaming status as changes arrive.
@@ -3028,6 +3040,9 @@ fn command_export(frontend: Frontend, args: &[String]) -> Outcome {
             _ => index += 1,
         }
     }
+    if format == "neo4j" && push_uri.is_some() && push_password.is_none() {
+        return Outcome::failure("error: --password required for --push".to_owned());
+    }
     graph_path = match compass_files::BuildGuard::resolve_requested_artifact(&graph_path) {
         Ok(path) => path,
         Err(error) => {
diff --git a/crates/compass-cli/tests/agent_cli.rs b/crates/compass-cli/tests/agent_cli.rs
new file mode 100644
index 000000000..0d91cf333
--- /dev/null
+++ b/crates/compass-cli/tests/agent_cli.rs
@@ -0,0 +1,464 @@
+use std::error::Error;
+use std::fs;
+use std::path::Path;
+use std::process::{Command, Output};
+
+use serde_json::Value;
+
+#[test]
+fn agent_namespace_help_inventory_and_errors_are_public() -> Result<(), Box<dyn Error>> {
+    for child in [
+        "list",
+        "install",
+        "doctor",
+        "export",
+        "validate",
+        "mcp-config",
+    ] {
+        let output = run(Path::new("."), &["agent", child, "--help"])?;
+        assert!(output.status.success(), "help failed for {child}");
+        assert!(String::from_utf8(output.stdout)?.contains("Usage:"));
+    }
+
+    let output = run(Path::new("."), &["agent", "list", "--format", "json"])?;
+    assert!(output.status.success());
+    let inventory = serde_json::from_slice::<Value>(&output.stdout)?;
+    assert_eq!(inventory["schema"], "compass.agent-list/1");
+    let ids = inventory["agents"]
+        .as_array()
+        .ok_or("agents must be an array")?
+        .iter()
+        .filter_map(|agent| agent["id"].as_str())
+        .collect::<Vec<_>>();
+    let mut sorted = ids.clone();
+    sorted.sort_unstable();
+    assert_eq!(ids, sorted);
+
+    let unknown = run(Path::new("."), &["agent", "not-a-command"])?;
+    assert_eq!(unknown.status.code(), Some(2));
+    assert!(String::from_utf8(unknown.stderr)?.contains("unknown agent subcommand"));
+    Ok(())
+}
+
+#[test]
+fn mcp_config_renders_each_native_schema() -> Result<(), Box<dyn Error>> {
+    let codex = run(
+        Path::new("."),
+        &[
+            "agent",
+            "mcp-config",
+            "--platform",
+            "codex",
+            "--transport",
+            "stdio",
+        ],
+    )?;
+    assert!(codex.status.success());
+    let codex = String::from_utf8(codex.stdout)?;
+    assert!(codex.contains("[mcp_servers.compass]"));
+    assert!(codex.contains("args = [\"serve\", \"--transport\", \"stdio\"]"));
+
+    for (platform, pointer) in [
+        ("claude", "/mcpServers/compass/url"),
+        ("opencode", "/mcp/compass/url"),
+        ("agents", "/mcpServers/compass/url"),
+    ] {
+        let output = run(
+            Path::new("."),
+            &[
+                "agent",
+                "mcp-config",
+                "--platform",
+                platform,
+                "--transport",
+                "http",
+            ],
+        )?;
+        assert!(output.status.success(), "MCP config failed for {platform}");
+        let value = serde_json::from_slice::<Value>(&output.stdout)?;
+        assert_eq!(
+            value.pointer(pointer).and_then(Value::as_str),
+            Some("http://127.0.0.1:8080/mcp")
+        );
+    }
+    Ok(())
+}
+
+#[test]
+fn generic_agents_export_uses_the_doctor_configuration_path() -> Result<(), Box<dyn Error>> {
+    let directory = tempfile::tempdir()?;
+    let bundle = directory.path().join("agents-bundle");
+    let bundle_arg = bundle.to_string_lossy().into_owned();
+    let export = run(
+        directory.path(),
+        &[
+            "agent",
+            "export",
+            "--platform",
+            "agents",
+            "--out",
+            &bundle_arg,
+        ],
+    )?;
+    assert!(
+        export.status.success(),
+        "{}",
+        String::from_utf8_lossy(&export.stderr)
+    );
+    assert!(bundle.join(".agents/mcp.json").is_file());
+    assert!(!bundle.join("mcp/agents.json").exists());
+
+    let validate = run(
+        directory.path(),
+        &[
+            "agent",
+            "validate",
+            "--path",
+            &bundle_arg,
+            "--platform",
+            "agents",
+        ],
+    )?;
+    assert!(
+        validate.status.success(),
+        "{}",
+        String::from_utf8_lossy(&validate.stderr)
+    );
+    Ok(())
+}
+
+#[test]
+fn exported_bundle_round_trips_and_redacts_unsafe_content() -> Result<(), Box<dyn Error>> {
+    let directory = tempfile::tempdir()?;
+    let bundle = directory.path().join("bundle");
+    let bundle_arg = bundle.to_string_lossy().into_owned();
+    let export = run(
+        directory.path(),
+        &[
+            "agent",
+            "export",
+            "--platform",
+            "claude",
+            "--out",
+            &bundle_arg,
+            "--format",
+            "json",
+        ],
+    )?;
+    assert!(
+        export.status.success(),
+        "{}",
+        String::from_utf8_lossy(&export.stderr)
+    );
+    let report = serde_json::from_slice::<Value>(&export.stdout)?;
+    assert_eq!(report["schema"], "compass.agent-bundle/1");
+    for skill in [
+        "compass",
+        "compass-architecture",
+        "compass-change-impact",
+        "compass-debug",
+        "compass-index-maintenance",
+        "compass-mcp-setup",
+        "compass-navigate",
+    ] {
+        assert!(bundle.join("skills").join(skill).join("SKILL.md").is_file());
+    }
+
+    let valid = run(
+        directory.path(),
+        &[
+            "agent",
+            "validate",
+            "--path",
+            &bundle_arg,
+            "--platform",
+            "claude",
+            "--format",
+            "json",
+        ],
+    )?;
+    assert!(valid.status.success());
+    assert_eq!(
+        serde_json::from_slice::<Value>(&valid.stdout)?["schema"],
+        "compass.agent-validation/1"
+    );
+
+    fs::write(
+        bundle.join(".mcp.json"),
+        r#"{"mcpServers":{"compass":{"command":"compass","args":["serve","--transport","stdio"],"api_key":"never-print-this"}}}"#,
+    )?;
+    let invalid = run(
+        directory.path(),
+        &[
+            "agent",
+            "validate",
+            "--path",
+            &bundle_arg,
+            "--format",
+            "json",
+        ],
+    )?;
+    assert_eq!(invalid.status.code(), Some(1));
+    let rendered = String::from_utf8(invalid.stdout)?;
+    assert!(rendered.contains("literal credential"));
+    assert!(!rendered.contains("never-print-this"));
+
+    let protected = directory.path().join("protected");
+    fs::create_dir(&protected)?;
+    fs::write(protected.join("user.txt"), "keep")?;
+    let protected_arg = protected.to_string_lossy().into_owned();
+    let rejected = run(
+        directory.path(),
+        &[
+            "agent",
+            "export",
+            "--platform",
+            "claude",
+            "--out",
+            &protected_arg,
+        ],
+    )?;
+    assert_eq!(rejected.status.code(), Some(1));
+    assert_eq!(fs::read_to_string(protected.join("user.txt"))?, "keep");
+    Ok(())
+}
+
+#[test]
+fn public_validation_rejects_transport_manifest_and_managed_scope_mismatches()
+-> Result<(), Box<dyn Error>> {
+    let directory = tempfile::tempdir()?;
+    let bundle = directory.path().join("agents-bundle");
+    let bundle_arg = bundle.to_string_lossy().into_owned();
+    let export = run(
+        directory.path(),
+        &[
+            "agent",
+            "export",
+            "--platform",
+            "agents",
+            "--transport",
+            "stdio",
+            "--out",
+            &bundle_arg,
+        ],
+    )?;
+    assert!(export.status.success());
+
+    let manifest_path = bundle.join("manifest.json");
+    let mut manifest = serde_json::from_slice::<Value>(&fs::read(&manifest_path)?)?;
+    manifest["transport"] = Value::String("http".to_owned());
+    manifest["files"]["../escape"] = Value::String("00".repeat(32));
+    fs::write(&manifest_path, serde_json::to_vec_pretty(&manifest)?)?;
+    let invalid = run(
+        directory.path(),
+        &[
+            "agent",
+            "validate",
+            "--path",
+            &bundle_arg,
+            "--format",
+            "json",
+        ],
+    )?;
+    assert_eq!(invalid.status.code(), Some(1));
+    let report = String::from_utf8(invalid.stdout)?;
+    assert!(report.contains("loopback endpoint"));
+    assert!(report.contains("unsafe manifest path '../escape'"));
+
+    let project = directory.path().join("managed-project");
+    fs::create_dir_all(project.join(".git"))?;
+    let install = run(
+        &project,
+        &["agent", "install", "--platform", "codex", "--project"],
+    )?;
+    assert!(install.status.success());
+    let managed = project.join(".agents/skills/compass");
+    let managed_arg = managed.to_string_lossy().into_owned();
+    let scoped = run(
+        &project,
+        &[
+            "agent",
+            "validate",
+            "--path",
+            &managed_arg,
+            "--platform",
+            "codex",
+            "--format",
+            "json",
+        ],
+    )?;
+    assert_eq!(scoped.status.code(), Some(1));
+    assert!(String::from_utf8(scoped.stdout)?.contains("applies only to exported bundles"));
+    Ok(())
+}
+
+#[cfg(unix)]
+#[test]
+fn public_validation_rejects_a_symlinked_bundle_file() -> Result<(), Box<dyn Error>> {
+    use std::os::unix::fs::symlink;
+
+    let directory = tempfile::tempdir()?;
+    let bundle = directory.path().join("agents-bundle");
+    let bundle_arg = bundle.to_string_lossy().into_owned();
+    let export = run(
+        directory.path(),
+        &[
+            "agent",
+            "export",
+            "--platform",
+            "agents",
+            "--out",
+            &bundle_arg,
+        ],
+    )?;
+    assert!(export.status.success());
+
+    let outside = directory.path().join("outside.json");
+    fs::write(&outside, b"{}")?;
+    let config = bundle.join(".agents/mcp.json");
+    fs::remove_file(&config)?;
+    symlink(&outside, &config)?;
+    let invalid = run(
+        directory.path(),
+        &[
+            "agent",
+            "validate",
+            "--path",
+            &bundle_arg,
+            "--format",
+            "json",
+        ],
+    )?;
+    assert_eq!(invalid.status.code(), Some(1));
+    assert!(String::from_utf8(invalid.stdout)?.contains("symbolic links are not allowed"));
+    Ok(())
+}
+
+#[test]
+fn doctor_reports_healthy_stale_and_corrupt_states() -> Result<(), Box<dyn Error>> {
+    let directory = tempfile::tempdir()?;
+    let project = directory.path().join("project");
+    fs::create_dir_all(project.join(".git"))?;
+    fs::create_dir_all(project.join("src"))?;
+    fs::write(project.join("src/main.rs"), "fn main() {}")?;
+
+    let install = run(
+        &project,
+        &["agent", "install", "--platform", "codex", "--project"],
+    )?;
+    assert!(
+        install.status.success(),
+        "{}",
+        String::from_utf8_lossy(&install.stderr)
+    );
+    fs::create_dir_all(project.join(".codex"))?;
+    let config = run(
+        &project,
+        &[
+            "agent",
+            "mcp-config",
+            "--platform",
+            "codex",
+            "--transport",
+            "stdio",
+        ],
+    )?;
+    assert!(config.status.success());
+    fs::write(project.join(".codex/config.toml"), config.stdout)?;
+
+    let update = run_with_output(
+        &project,
+        &["update", ".", "--no-viz", "--no-cluster"],
+        "custom-agent-out",
+    )?;
+    assert!(
+        update.status.success(),
+        "{}",
+        String::from_utf8_lossy(&update.stderr)
+    );
+    let project_arg = project.to_string_lossy().into_owned();
+    let healthy = run_with_output(
+        &project,
+        &[
+            "agent",
+            "doctor",
+            "--platform",
+            "codex",
+            "--project-root",
+            &project_arg,
+            "--format",
+            "json",
+        ],
+        "custom-agent-out",
+    )?;
+    assert!(
+        healthy.status.success(),
+        "{}",
+        String::from_utf8_lossy(&healthy.stdout)
+    );
+    let report = serde_json::from_slice::<Value>(&healthy.stdout)?;
+    assert_eq!(report["schema"], "compass.agent-doctor/1");
+    assert_eq!(report["healthy"], true);
+
+    fs::write(
+        project.join("src/main.rs"),
+        "fn main() { println!(\"stale\"); }",
+    )?;
+    let stale = run_with_output(
+        &project,
+        &[
+            "agent",
+            "doctor",
+            "--platform",
+            "codex",
+            "--project-root",
+            &project_arg,
+            "--format",
+            "json",
+        ],
+        "custom-agent-out",
+    )?;
+    assert_eq!(stale.status.code(), Some(1));
+    assert!(String::from_utf8_lossy(&stale.stdout).contains("graph manifest is stale"));
+
+    fs::write(project.join(".agents/skills/compass/SKILL.md"), "corrupt")?;
+    let corrupt = run_with_output(
+        &project,
+        &[
+            "agent",
+            "doctor",
+            "--platform",
+            "codex",
+            "--project-root",
+            &project_arg,
+            "--format",
+            "json",
+        ],
+        "custom-agent-out",
+    )?;
+    assert_eq!(corrupt.status.code(), Some(1));
+    assert!(String::from_utf8_lossy(&corrupt.stdout).contains("modified"));
+    Ok(())
+}
+
+fn run(current: &Path, arguments: &[&str]) -> Result<Output, Box<dyn Error>> {
+    Ok(Command::new(env!("CARGO_BIN_EXE_compass"))
+        .args(arguments)
+        .current_dir(current)
+        .env_remove("COMPASS_OUT")
+        .env_remove("COMPASS_API_KEY")
+        .output()?)
+}
+
+fn run_with_output(
+    current: &Path,
+    arguments: &[&str],
+    output_name: &str,
+) -> Result<Output, Box<dyn Error>> {
+    Ok(Command::new(env!("CARGO_BIN_EXE_compass"))
+        .args(arguments)
+        .current_dir(current)
+        .env("COMPASS_OUT", output_name)
+        .env_remove("COMPASS_API_KEY")
+        .output()?)
+}
diff --git a/crates/compass-cli/tests/history_cli.rs b/crates/compass-cli/tests/history_cli.rs
index 774766b5e..25275a305 100644
--- a/crates/compass-cli/tests/history_cli.rs
+++ b/crates/compass-cli/tests/history_cli.rs
@@ -392,7 +392,11 @@ fn worker_drains_fifo_after_an_earlier_job_fails() -> Result<(), Box<dyn std::er
     git(directory.path(), &["commit", "--quiet", "-m", "fixture"])?;
 
     let compass = env!("CARGO_BIN_EXE_compass");
-    let enabled = run(compass, directory.path(), &["history", "enable"])?;
+    let enabled = run(
+        compass,
+        directory.path(),
+        &["history", "enable", "--code-only"],
+    )?;
     assert!(enabled.status.success());
     let repository = Repository::discover(directory.path())?;
     let profile = HistoryConfig::load(&repository)?
@@ -453,9 +457,13 @@ fn worker_drains_fifo_after_an_earlier_job_fails() -> Result<(), Box<dyn std::er
         JobState::Failed
     );
     for job_id in invalid_profile_jobs {
+        let job = queue.get(&job_id)?.ok_or("invalid profile job")?;
         assert_eq!(
-            queue.get(&job_id)?.ok_or("invalid profile job")?.state,
-            JobState::Failed
+            job.state,
+            JobState::Failed,
+            "profile {:?} finished with diagnostic {:?}",
+            job.profile.entries().collect::<Vec<_>>(),
+            job.diagnostic
         );
     }
     assert_eq!(
diff --git a/crates/compass-cli/tests/install_cli.rs b/crates/compass-cli/tests/install_cli.rs
index 79ee7044f..7e4d223da 100644
--- a/crates/compass-cli/tests/install_cli.rs
+++ b/crates/compass-cli/tests/install_cli.rs
@@ -4,6 +4,7 @@ use std::fs;
 use std::path::{Path, PathBuf};
 use std::process::{Command, Output};
 
+use sha2::{Digest, Sha256};
 use tempfile::TempDir;
 
 const PROJECT_PLATFORMS: &[&str] = &[
@@ -58,6 +59,15 @@ const GLOBAL_PLATFORMS: &[&str] = &[
     "gemini",
 ];
 
+const FOCUSED_SKILLS: &[&str] = &[
+    "compass-architecture",
+    "compass-change-impact",
+    "compass-debug",
+    "compass-index-maintenance",
+    "compass-mcp-setup",
+    "compass-navigate",
+];
+
 #[test]
 fn project_codex_install_creates_native_compass_skill() -> Result<(), Box<dyn Error>> {
     let fixture = InstallFixture::new()?;
@@ -115,6 +125,7 @@ fn project_codex_install_creates_native_compass_skill() -> Result<(), Box<dyn Er
     assert!(!String::from_utf8_lossy(&output.stdout).contains("hook-check"));
     assert!(String::from_utf8_lossy(&output.stdout).contains("/hooks"));
     assert!(String::from_utf8_lossy(&output.stdout).contains("new coding-agent session"));
+    assert_focused_skill_collection(&fixture.project.join(".agents/skills"), &["codex"])?;
     Ok(())
 }
 
@@ -133,6 +144,10 @@ fn every_project_platform_installs_native_content() -> Result<(), Box<dyn Error>
             !tree_contains_compass_skill(&fixture.project)?,
             "{platform} left a project Compass skill after uninstall"
         );
+        assert!(
+            !tree_contains_focused_skill(&fixture.project)?,
+            "{platform} left a focused Compass skill after uninstall"
+        );
     }
     Ok(())
 }
@@ -163,12 +178,38 @@ fn direct_and_generic_codex_installs_match() -> Result<(), Box<dyn Error>> {
     );
     let mut generic_tree = directory_tree(&generic.project)?;
     let mut direct_tree = directory_tree(&direct.project)?;
-    generic_tree.remove(Path::new(".agents/skills/compass/.compass-install.json"));
-    direct_tree.remove(Path::new(".agents/skills/compass/.compass-install.json"));
+    normalize_manifest_roots(&mut generic_tree, &generic.project)?;
+    normalize_manifest_roots(&mut direct_tree, &direct.project)?;
     assert_eq!(generic_tree, direct_tree);
     Ok(())
 }
 
+#[test]
+fn agent_install_alias_is_byte_compatible_with_legacy_install() -> Result<(), Box<dyn Error>> {
+    let fixture = InstallFixture::new()?;
+    let legacy = fixture.run(&["install", "--platform", "codex", "--project"])?;
+    assert_success("legacy managed install", &legacy);
+    let legacy_tree = directory_tree(&fixture.project)?;
+
+    fs::remove_dir_all(&fixture.project)?;
+    fs::create_dir_all(&fixture.project)?;
+    fs::create_dir(fixture.project.join(".git"))?;
+
+    let alias = fixture.run(&["agent", "install", "--platform", "codex", "--project"])?;
+    assert_success("agent managed install", &alias);
+    assert_eq!(alias.status.code(), legacy.status.code());
+    assert_eq!(alias.stdout, legacy.stdout);
+    assert_eq!(alias.stderr, legacy.stderr);
+    assert_eq!(directory_tree(&fixture.project)?, legacy_tree);
+
+    let legacy_error = fixture.run(&["install", "--platform"])?;
+    let alias_error = fixture.run(&["agent", "install", "--platform"])?;
+    assert_eq!(alias_error.status.code(), legacy_error.status.code());
+    assert_eq!(alias_error.stdout, legacy_error.stdout);
+    assert_eq!(alias_error.stderr, legacy_error.stderr);
+    Ok(())
+}
+
 #[test]
 fn compass_lifecycle_preserves_adjacent_graphify_install() -> Result<(), Box<dyn Error>> {
     let fixture = InstallFixture::new()?;
@@ -199,9 +240,20 @@ fn reinstall_is_idempotent_and_parser_errors_do_not_mutate() -> Result<(), Box<d
         &fixture.run(&["install", "--platform", "codex", "--project"])?,
     );
     let first = directory_tree(&fixture.project)?;
-    assert_success(
-        "second install",
-        &fixture.run(&["install", "--platform", "codex", "--project"])?,
+    let second = fixture.run(&[
+        "install",
+        "--platform",
+        "codex",
+        "--project",
+        "--format",
+        "json",
+    ])?;
+    assert_success("second install", &second);
+    let report: serde_json::Value = serde_json::from_slice(&second.stdout)?;
+    assert!(
+        report["results"]
+            .as_array()
+            .is_some_and(|results| { results.iter().any(|result| result["status"] == "current") })
     );
     assert_eq!(directory_tree(&fixture.project)?, first);
 
@@ -228,6 +280,64 @@ fn install_does_not_overwrite_an_unowned_compass_skill() -> Result<(), Box<dyn E
     Ok(())
 }
 
+#[test]
+fn install_preflights_unowned_focused_skill_before_mutation() -> Result<(), Box<dyn Error>> {
+    let fixture = InstallFixture::new()?;
+    let focused = fixture
+        .project
+        .join(".agents/skills/compass-debug/SKILL.md");
+    fs::create_dir_all(focused.parent().ok_or("focused parent")?)?;
+    fs::write(&focused, "user-owned focused skill")?;
+
+    let output = fixture.run(&["install", "--platform", "codex", "--project"])?;
+    assert!(!output.status.success());
+    assert_eq!(fs::read_to_string(&focused)?, "user-owned focused skill");
+    assert!(
+        !fixture
+            .project
+            .join(".agents/skills/compass/SKILL.md")
+            .exists()
+    );
+    assert!(!fixture.project.join(".codex/hooks.json").exists());
+    Ok(())
+}
+
+#[test]
+fn uninstall_preserves_a_modified_focused_skill_even_with_a_rewritten_manifest()
+-> Result<(), Box<dyn Error>> {
+    let fixture = InstallFixture::new()?;
+    assert_success(
+        "initial install",
+        &fixture.run(&["install", "--platform", "codex", "--project"])?,
+    );
+    let focused = fixture
+        .project
+        .join(".agents/skills/compass-debug/SKILL.md");
+    let modified = b"user-modified focused skill";
+    fs::write(&focused, modified)?;
+    let manifest_path = focused
+        .parent()
+        .ok_or("focused parent")?
+        .join(".compass-install.json");
+    let mut manifest: serde_json::Value = serde_json::from_slice(&fs::read(&manifest_path)?)?;
+    manifest["files"]["SKILL.md"] =
+        serde_json::Value::String(format!("{:x}", Sha256::digest(modified)));
+    fs::write(&manifest_path, serde_json::to_vec_pretty(&manifest)?)?;
+
+    assert_success(
+        "safe uninstall",
+        &fixture.run(&["uninstall", "--platform", "codex", "--project"])?,
+    );
+    assert_eq!(fs::read_to_string(&focused)?, "user-modified focused skill");
+    assert!(
+        !fixture
+            .project
+            .join(".agents/skills/compass/SKILL.md")
+            .exists()
+    );
+    Ok(())
+}
+
 #[test]
 fn purge_removes_only_compass_output() -> Result<(), Box<dyn Error>> {
     let fixture = InstallFixture::new()?;
@@ -484,6 +594,13 @@ fn repeated_platforms_share_one_package_and_dry_run_is_read_only() -> Result<(),
             "dry run omitted {expected}: {planned:?}"
         );
     }
+    for name in FOCUSED_SKILLS {
+        let expected = format!(".agents/skills/{name}/SKILL.md");
+        assert!(
+            planned.iter().any(|path| path.ends_with(&expected)),
+            "dry run omitted {expected}: {planned:?}"
+        );
+    }
 
     let output = fixture.run(&[
         "install",
@@ -649,12 +766,16 @@ fn uninstall_removes_one_shared_consumer_without_breaking_another() -> Result<()
     let manifest: serde_json::Value =
         serde_json::from_slice(&fs::read(skill.with_file_name(".compass-install.json"))?)?;
     assert_eq!(manifest["consumers"], serde_json::json!(["gemini"]));
+    assert_focused_skill_collection(&fixture.project.join(".agents/skills"), &["gemini"])?;
 
     assert_success(
         "remove gemini consumer",
         &fixture.run(&["uninstall", "--platform", "gemini", "--project"])?,
     );
     assert!(!skill.exists());
+    for name in FOCUSED_SKILLS {
+        assert!(!fixture.project.join(".agents/skills").join(name).exists());
+    }
     Ok(())
 }
 
@@ -740,8 +861,13 @@ fn assert_native_tree(root: &Path) -> Result<(), Box<dyn Error>> {
         };
         assert_native(&text);
         if path.ends_with("SKILL.md") {
+            let expected_name = path
+                .parent()
+                .and_then(Path::file_name)
+                .and_then(|name| name.to_str())
+                .ok_or("skill directory name")?;
             assert!(
-                text.starts_with("---\nname: compass\n"),
+                text.starts_with(&format!("---\nname: {expected_name}\n")),
                 "{} is not a Compass skill",
                 path.display()
             );
@@ -750,6 +876,35 @@ fn assert_native_tree(root: &Path) -> Result<(), Box<dyn Error>> {
     Ok(())
 }
 
+fn assert_focused_skill_collection(
+    container: &Path,
+    consumers: &[&str],
+) -> Result<(), Box<dyn Error>> {
+    for name in FOCUSED_SKILLS {
+        let directory = container.join(name);
+        let skill = directory.join("SKILL.md");
+        let body = fs::read_to_string(&skill)?;
+        assert!(body.starts_with(&format!("---\nname: {name}\n")));
+        assert!(!body.contains("/Users/"));
+        assert!(!body.contains("/home/"));
+        let manifest: serde_json::Value =
+            serde_json::from_slice(&fs::read(directory.join(".compass-install.json"))?)?;
+        assert_eq!(manifest["schema"], 1);
+        assert!(manifest["files"]["SKILL.md"].is_string());
+        assert!(manifest["files"][".compass_version"].is_string());
+        assert_eq!(
+            manifest["consumers"],
+            serde_json::Value::Array(
+                consumers
+                    .iter()
+                    .map(|consumer| serde_json::Value::String((*consumer).to_owned()))
+                    .collect()
+            )
+        );
+    }
+    Ok(())
+}
+
 fn assert_native(value: &str) {
     let normalized = value.replace(env!("CARGO_BIN_EXE_compass"), "compass");
     let lowercase = normalized.to_ascii_lowercase();
@@ -770,6 +925,17 @@ fn tree_contains_compass_skill(root: &Path) -> Result<bool, Box<dyn Error>> {
     }))
 }
 
+fn tree_contains_focused_skill(root: &Path) -> Result<bool, Box<dyn Error>> {
+    Ok(directory_tree(root)?.into_iter().any(|(path, bytes)| {
+        path.ends_with("SKILL.md")
+            && String::from_utf8(bytes).is_ok_and(|text| {
+                FOCUSED_SKILLS
+                    .iter()
+                    .any(|name| text.starts_with(&format!("---\nname: {name}\n")))
+            })
+    }))
+}
+
 fn directory_tree(root: &Path) -> Result<BTreeMap<PathBuf, Vec<u8>>, Box<dyn Error>> {
     fn visit(
         root: &Path,
@@ -793,3 +959,25 @@ fn directory_tree(root: &Path) -> Result<BTreeMap<PathBuf, Vec<u8>>, Box<dyn Err
     visit(root, root, &mut output)?;
     Ok(output)
 }
+
+fn normalize_manifest_roots(
+    tree: &mut BTreeMap<PathBuf, Vec<u8>>,
+    root: &Path,
+) -> Result<(), Box<dyn Error>> {
+    let canonical_root = fs::canonicalize(root)?;
+    let encoded_root = serde_json::to_string(&canonical_root)?;
+    for (path, bytes) in tree {
+        if path
+            .file_name()
+            .is_some_and(|name| name == ".compass-install.json")
+        {
+            let text = std::str::from_utf8(bytes)?;
+            let normalized = text.replace(&encoded_root, "\"<normalized-root>\"");
+            if normalized == text {
+                return Err(format!("manifest {} did not contain its root", path.display()).into());
+            }
+            *bytes = normalized.into_bytes();
+        }
+    }
+    Ok(())
+}
diff --git a/crates/compass-cli/tests/mcp_http_cli.rs b/crates/compass-cli/tests/mcp_http_cli.rs
new file mode 100644
index 000000000..8755cdfc5
--- /dev/null
+++ b/crates/compass-cli/tests/mcp_http_cli.rs
@@ -0,0 +1,30 @@
+use std::error::Error;
+use std::process::Command;
+
+const WARNING: &str = "warning: --session-timeout is deprecated and ignored because MCP HTTP is stateless; it will be removed in Compass 0.5.0";
+
+#[test]
+fn deprecated_session_timeout_warns_and_preserves_cli_exit_taxonomy() -> Result<(), Box<dyn Error>>
+{
+    let runtime_failure = Command::new(env!("CARGO_BIN_EXE_compass"))
+        .args([
+            "serve",
+            "--transport=http",
+            "--path=invalid",
+            "--session-timeout=12.5",
+        ])
+        .output()?;
+    assert_eq!(runtime_failure.status.code(), Some(1));
+    let stderr = String::from_utf8(runtime_failure.stderr)?;
+    assert!(stderr.contains(WARNING));
+    assert!(stderr.contains("HTTP mount path must start with '/'"));
+
+    let usage_failure = Command::new(env!("CARGO_BIN_EXE_compass"))
+        .args(["serve", "--session-timeout=not-a-number"])
+        .output()?;
+    assert_eq!(usage_failure.status.code(), Some(2));
+    let stderr = String::from_utf8(usage_failure.stderr)?;
+    assert!(stderr.contains("invalid float value"));
+    assert!(!stderr.contains(WARNING));
+    Ok(())
+}
diff --git a/crates/compass-cli/tests/snapshot_limit_cli.rs b/crates/compass-cli/tests/snapshot_limit_cli.rs
new file mode 100644
index 000000000..cbb1576de
--- /dev/null
+++ b/crates/compass-cli/tests/snapshot_limit_cli.rs
@@ -0,0 +1,94 @@
+use std::error::Error;
+use std::fs;
+use std::process::Command;
+
+use compass_files::BuildGuard;
+use compass_graph::{
+    GRAPH_SNAPSHOT_ACTIVE_KEY, GRAPH_SNAPSHOT_CATALOG_PARTITION, GRAPH_SNAPSHOT_OBJECT_PARTITION,
+    GraphSnapshotReader, SnapshotSelector, graph_snapshot_manifest_key,
+};
+use compass_store::{
+    Key, MAX_GRAPH_BYTES, NamespaceId, PartitionKey, SqliteStore, Store, StoreRef, WriteCondition,
+    local_sqlite_store_path,
+};
+use sha2::{Digest, Sha256};
+
+#[test]
+fn oversized_snapshot_limit_error_names_scope_remedies_and_exits_one() -> Result<(), Box<dyn Error>>
+{
+    let root = tempfile::tempdir()?;
+    fs::write(root.path().join("sample.rs"), "pub fn sample() {}\n")?;
+    let built = Command::new(env!("CARGO_BIN_EXE_compass"))
+        .args(["update", ".", "--code-only", "--no-viz"])
+        .current_dir(root.path())
+        .env_remove("COMPASS_OUT")
+        .output()?;
+    assert!(
+        built.status.success(),
+        "initial build failed: {}",
+        String::from_utf8_lossy(&built.stderr)
+    );
+
+    let output_root = root.path().join("compass-out");
+    let graph_path = BuildGuard::resolve_artifact(&output_root, "graph.json")?;
+    let store_path = local_sqlite_store_path(&graph_path);
+    let store = SqliteStore::open(&store_path)?;
+    let namespace = NamespaceId::graph();
+    let catalog = PartitionKey::new(GRAPH_SNAPSHOT_CATALOG_PARTITION)?;
+    let objects = PartitionKey::new(GRAPH_SNAPSHOT_OBJECT_PARTITION)?;
+    let active = Key::new(GRAPH_SNAPSHOT_ACTIVE_KEY)?;
+    let active_entry = store
+        .get(&namespace, &catalog, &active)?
+        .ok_or("store has no active graph snapshot")?;
+    let mut selector: SnapshotSelector = serde_json::from_slice(&active_entry.value)?;
+    let reader = GraphSnapshotReader::open_selector(&store, selector.clone())?;
+    let mut manifest = reader.manifest().clone();
+    manifest.graph_bytes = MAX_GRAPH_BYTES as u64 + 1;
+    drop(reader);
+    let manifest_bytes = serde_json::to_vec(&manifest)?;
+    let manifest_digest = format!("{:x}", Sha256::digest(&manifest_bytes));
+    let manifest_key = graph_snapshot_manifest_key(&manifest_digest)?;
+    store.put(
+        &namespace,
+        &objects,
+        &manifest_key,
+        &manifest_bytes,
+        WriteCondition::Missing,
+    )?;
+
+    selector.manifest_digest = manifest_digest;
+    let selector_bytes = serde_json::to_vec(&selector)?;
+    store.put(
+        &namespace,
+        &catalog,
+        &active,
+        &selector_bytes,
+        WriteCondition::Version(active_entry.version),
+    )?;
+    store.checkpoint()?;
+    drop(store);
+
+    let reference_path = graph_path
+        .parent()
+        .ok_or("resolved graph has no parent directory")?
+        .join("store.ref");
+    let mut reference: StoreRef = serde_json::from_slice(&fs::read(&reference_path)?)?;
+    reference.manifest_digest = selector.manifest_digest;
+    fs::write(&reference_path, serde_json::to_vec_pretty(&reference)?)?;
+
+    let queried = Command::new(env!("CARGO_BIN_EXE_compass"))
+        .args(["search", "sample", "--graph"])
+        .arg(&graph_path)
+        .args(["--engine", "store"])
+        .current_dir(root.path())
+        .env_remove("COMPASS_OUT")
+        .output()?;
+    assert_eq!(queried.status.code(), Some(1));
+    assert!(queried.stdout.is_empty());
+    let stderr = String::from_utf8(queried.stderr)?;
+    assert!(stderr.contains("snapshot limit exceeded"), "{stderr}");
+    assert!(stderr.contains("--exclude <pattern>"), "{stderr}");
+    assert!(stderr.contains(".compassignore"), "{stderr}");
+    assert!(stderr.contains("COMPASS_MAX_GRAPH_BYTES"), "{stderr}");
+    Ok(())
+}
diff --git a/crates/compass-core/src/lib.rs b/crates/compass-core/src/lib.rs
index f017458ee..0fe80d824 100644
--- a/crates/compass-core/src/lib.rs
+++ b/crates/compass-core/src/lib.rs
@@ -168,7 +168,7 @@ impl LoadedGraph {
     }
 
     pub fn load_directed(path: &Path) -> Result<Self, GraphError> {
-        let graph = Graph::load_traversal_directed(path)?;
+        let graph = Graph::load_directed(path)?;
         let overlay = load_learning_overlay(path);
         Ok(Self { graph, overlay })
     }
diff --git a/crates/compass-core/src/pipeline.rs b/crates/compass-core/src/pipeline.rs
index 99f59789e..065ea3993 100644
--- a/crates/compass-core/src/pipeline.rs
+++ b/crates/compass-core/src/pipeline.rs
@@ -17,10 +17,10 @@ use compass_graph::{
     BuildEvidence, ClusterOptions, EntityTiebreaker, GRAPH_DIAGNOSTICS_EXTENSION,
     GRAPH_JSON_DELTA_MAX_SOURCE_BYTES, GRAPH_SNAPSHOT_MAX_OBJECTS,
     GRAPH_SNAPSHOT_SELECTOR_SCHEMA_V1, GraphSnapshotBuilder, GraphSnapshotGcStats,
-    InventoryEvidence, PublicationOmissions, SnapshotSelector, SourceDigest,
+    InventoryEvidence, PublicationOmissions, SnapshotError, SnapshotSelector, SourceDigest,
     build_owned_with_tiebreaker as build_document, canonical_edge_kind, canonical_raw_edge_sites,
     cluster, deduped_node_count, extraction_from_v1, garbage_collect_graph_snapshots,
-    graph_insights, graph_snapshot_needs_gc, label_communities_by_hub,
+    graph_insights, graph_snapshot_needs_gc, label_communities_by_hub, max_canonical_graph_bytes,
     normalize_document_v1_with_evidence_best_effort_owned,
     normalize_document_v1_with_inventory_and_source_digests_best_effort_owned,
     normalize_document_v1_with_inventory_best_effort, remap_communities_to_previous,
@@ -81,6 +81,12 @@ pub const DEFAULT_MAX_SOURCE_BYTES: u64 = 16 * 1024 * 1024;
 const SEMANTIC_MARKER_FILE: &str = "semantic-marker.json";
 const PIPELINE_RAYON_WORKER_CAP: usize = 12;
 const PARALLEL_AST_FACT_DIGEST_MIN_FILES: usize = 32;
+// Calibrated on the C-003 deterministic fixture: 112,893 source bytes produced
+// 6,843,452 canonical bytes (60.62x). Rounding down avoids claiming precision
+// the measurement does not provide. Sources rejected by max_source_bytes do
+// not use this expansion because Compass publishes inventory-only coverage.
+const PREFLIGHT_GRAPH_BYTES_PER_SOURCE_BYTE: u64 = 60;
+const PREFLIGHT_PARTIAL_FILE_BYTES: u64 = 512;
 const STORE_SNAPSHOT_EXCLUSIONS: [&str; 3] =
     [STORE_FILE_NAME, "store.sqlite3-wal", "store.sqlite3-shm"];
 const ROOT_ARTIFACTS: [&str; 6] = [
@@ -2556,6 +2562,13 @@ fn build_graph_inner_unscoped(
         ));
     }
 
+    enforce_preflight_graph_size(
+        &root,
+        &sources,
+        options.max_source_bytes,
+        max_canonical_graph_bytes(),
+    )?;
+
     let output_cache_root = (output_root != root).then_some(output_root.as_path());
     let cache_options = options.cache_root.as_deref().map_or_else(
         || CacheOptions::output_directory(output_cache_root),
@@ -4071,6 +4084,42 @@ fn build_graph_inner_unscoped(
     Ok((result, retained))
 }
 
+/// Estimate canonical payload growth from discovery metadata before any
+/// project-wide extraction begins. The calculation performs one bounded
+/// metadata lookup per admitted source and uses saturating arithmetic so an
+/// adversarial corpus cannot wrap the estimate into a successful result.
+fn enforce_preflight_graph_size(
+    root: &Path,
+    sources: &[PathBuf],
+    max_source_bytes: u64,
+    maximum: u64,
+) -> Result<u64, CoreError> {
+    let estimated = sources.iter().fold(0_u64, |total, source| {
+        let relative = source.strip_prefix(root).unwrap_or(source);
+        let path_bytes = u64::try_from(relative.as_os_str().len()).unwrap_or(u64::MAX);
+        let source_estimate =
+            fs::metadata(source).map_or(PREFLIGHT_PARTIAL_FILE_BYTES, |metadata| {
+                if metadata.is_file() && metadata.len() <= max_source_bytes {
+                    metadata
+                        .len()
+                        .saturating_mul(PREFLIGHT_GRAPH_BYTES_PER_SOURCE_BYTE)
+                        .max(PREFLIGHT_PARTIAL_FILE_BYTES)
+                } else {
+                    PREFLIGHT_PARTIAL_FILE_BYTES
+                }
+            });
+        total
+            .saturating_add(path_bytes)
+            .saturating_add(source_estimate)
+    });
+    if estimated > maximum {
+        return Err(CoreError::Snapshot(
+            SnapshotError::canonical_graph_too_large(maximum),
+        ));
+    }
+    Ok(estimated)
+}
+
 fn oversized_source_extraction(
     path: &Path,
     max_source_bytes: u64,
@@ -4438,6 +4487,17 @@ fn graph_delta_candidate(previous: &V1GraphDocument, current: &V1GraphDocument)
     if previous.directed != current.directed || previous.multigraph != current.multigraph {
         return false;
     }
+    // A valid externally supplied graph is not required to retain Compass's
+    // publication order. The merge walk below is correct only for sorted
+    // records, so fail closed to a full snapshot when either input was
+    // reordered instead of miscounting changes (or tripping debug builds).
+    if !records_are_sorted(&previous.nodes, |node| node.id.as_str())
+        || !records_are_sorted(&current.nodes, |node| node.id.as_str())
+        || !records_are_sorted(&previous.links, |edge| edge.id.as_str())
+        || !records_are_sorted(&current.links, |edge| edge.id.as_str())
+    {
+        return false;
+    }
     // V1 publication sorts both records by stable ID. A merge walk avoids
     // four BTreeMap allocations on every incremental build while preserving
     // the same changed-record count. The snapshot layer repeats its complete
@@ -4462,6 +4522,15 @@ fn graph_delta_candidate(previous: &V1GraphDocument, current: &V1GraphDocument)
     true
 }
 
+fn records_are_sorted<T, F>(records: &[T], key: F) -> bool
+where
+    F: Fn(&T) -> &str,
+{
+    records
+        .windows(2)
+        .all(|pair| key(&pair[0]) <= key(&pair[1]))
+}
+
 fn changed_record_count<T, F>(previous: &[T], current: &[T], key: F) -> usize
 where
     T: PartialEq,
diff --git a/crates/compass-core/tests/code_graph_v1_publication_resilience.rs b/crates/compass-core/tests/code_graph_v1_publication_resilience.rs
index c8662e04f..5fbe1b97b 100644
--- a/crates/compass-core/tests/code_graph_v1_publication_resilience.rs
+++ b/crates/compass-core/tests/code_graph_v1_publication_resilience.rs
@@ -306,19 +306,17 @@ fn typescript_type_star_reexport_keeps_barrel_file_exact() -> Result<(), Box<dyn
         .find(|file| file.path == "src/index.ts")
         .ok_or("missing TypeScript barrel input")?;
     assert_eq!(barrel.extraction_status, ExtractionStatus::Extracted);
-    assert_eq!(
-        graph
-            .links
-            .iter()
-            .filter(|edge| {
-                edge.kind.as_str() == "exports"
-                    && edge.relationship_site.as_ref().is_some_and(|site| {
-                        site.file == "src/index.ts" && matches!(site.start_line, 1 | 2)
-                    })
-            })
-            .count(),
-        2
-    );
+    let barrel_exports = graph
+        .links
+        .iter()
+        .filter(|edge| {
+            edge.kind.as_str() == "exports"
+                && edge.relationship_site.as_ref().is_some_and(|site| {
+                    site.file == "src/index.ts" && matches!(site.start_line, 1 | 2)
+                })
+        })
+        .collect::<Vec<_>>();
+    assert_eq!(barrel_exports.len(), 2, "{barrel_exports:#?}");
     Ok(())
 }
 
diff --git a/crates/compass-core/tests/loading_coverage.rs b/crates/compass-core/tests/loading_coverage.rs
index b6c35fad0..4753cd8ec 100644
--- a/crates/compass-core/tests/loading_coverage.rs
+++ b/crates/compass-core/tests/loading_coverage.rs
@@ -211,6 +211,28 @@ fn loaded_graph_learning_overlay_marks_current_missing_and_unfingerprinted_sourc
     Ok(())
 }
 
+#[test]
+fn loaded_graph_directed_builds_relationship_query_indexes() -> Result<(), Box<dyn Error>> {
+    let directory = tempfile::tempdir()?;
+    let graph = directory.path().join("graph.json");
+    fs::write(
+        &graph,
+        r#"{"directed":true,"multigraph":true,"graph":{},"nodes":[{"id":"a"},{"id":"b"}],"links":[{"source":"a","target":"b","relation":"calls"}]}"#,
+    )?;
+
+    let loaded = LoadedGraph::load_directed(&graph)?;
+    let source = loaded.graph.node_index("a").ok_or("missing source node")?;
+    assert_eq!(
+        loaded
+            .graph
+            .query_index()
+            .outgoing_with_type(source, "CALLS")
+            .len(),
+        1
+    );
+    Ok(())
+}
+
 #[test]
 fn build_pipeline_reports_missing_and_empty_roots_and_accepts_file_only_sources()
 -> Result<(), Box<dyn Error>> {
diff --git a/crates/compass-core/tests/pipeline_scale.rs b/crates/compass-core/tests/pipeline_scale.rs
index f7ef8cad4..d34a9cd65 100644
--- a/crates/compass-core/tests/pipeline_scale.rs
+++ b/crates/compass-core/tests/pipeline_scale.rs
@@ -1,14 +1,56 @@
 use std::error::Error;
 use std::fs::{self, OpenOptions};
+use std::sync::atomic::{AtomicUsize, Ordering};
 use std::time::{Duration, Instant};
 
-use compass_core::{BuildOptions, build_local_graph};
+use compass_core::{
+    BuildOptions, CoreError, build_graph_with_layers_and_progress, build_local_graph,
+};
+use compass_files::{DetectOptions, detect};
+use compass_graph::{MAX_CANONICAL_GRAPH_BYTES, SnapshotError};
 use compass_model::code_graph::{CoverageStatus, ExtractionStatus, GraphDocument};
 
 const SOURCE_FILES: usize = 300;
 const OVERSIZED_SOURCE_BYTES: u64 = 8 * 1024 * 1024;
 const COLD_CEILING: Duration = Duration::from_secs(60);
 const WARM_CEILING: Duration = Duration::from_secs(10);
+const PREFLIGHT_FIXTURE_BYTES: u64 = 40 * 1024 * 1024;
+const PREFLIGHT_CEILING: Duration = Duration::from_millis(322);
+
+#[test]
+fn oversized_estimate_fails_before_extraction_progress() -> Result<(), Box<dyn Error>> {
+    let directory = tempfile::tempdir()?;
+    OpenOptions::new()
+        .create_new(true)
+        .write(true)
+        .open(directory.path().join("estimated_oversized.rs"))?
+        .set_len(PREFLIGHT_FIXTURE_BYTES)?;
+
+    let mut options = BuildOptions::new(directory.path());
+    options.no_cluster = true;
+    options.no_viz = true;
+    options.max_source_bytes = 64 * 1024 * 1024;
+    options.precomputed_detection = Some(detect(directory.path(), &DetectOptions::default())?);
+    let progressed = AtomicUsize::new(0);
+    let started = Instant::now();
+    let Err(error) = build_graph_with_layers_and_progress(&options, None, &[], &|_| {
+        progressed.fetch_add(1, Ordering::Relaxed);
+    }) else {
+        return Err("calibrated preflight fixture did not exceed the graph bound".into());
+    };
+    let elapsed = started.elapsed();
+
+    assert!(matches!(
+        error,
+        CoreError::Snapshot(SnapshotError::Limit(_))
+    ));
+    assert_eq!(progressed.load(Ordering::Relaxed), 0);
+    assert!(error.to_string().contains("--exclude <pattern>"));
+    assert!(error.to_string().contains(".compassignore"));
+    assert!(elapsed < PREFLIGHT_CEILING);
+    assert_eq!(MAX_CANONICAL_GRAPH_BYTES, 2 * 1024 * 1024 * 1024);
+    Ok(())
+}
 
 #[test]
 fn cold_and_warm_in_process_builds_stay_within_enterprise_ceiling() -> Result<(), Box<dyn Error>> {
diff --git a/crates/compass-core/tests/vendor_policy.rs b/crates/compass-core/tests/vendor_policy.rs
new file mode 100644
index 000000000..6f26572be
--- /dev/null
+++ b/crates/compass-core/tests/vendor_policy.rs
@@ -0,0 +1,108 @@
+use std::collections::BTreeMap;
+use std::error::Error;
+use std::fs;
+use std::path::{Path, PathBuf};
+
+use compass_core::{BuildOptions, BuildPurpose, GraphStorage, build_local_graph};
+use compass_files::BuildScope;
+use compass_model::code_graph::GraphDocument;
+
+const VENDOR_SOURCES: [(&str, &str); 2] = [
+    ("vendor/parser-pack/src/lib.rs", "rust"),
+    ("vendor/go-dependency/tool.go", "go"),
+];
+
+fn build_document(
+    root: &Path,
+    output_root: PathBuf,
+    configure: impl FnOnce(&mut BuildOptions),
+) -> Result<GraphDocument, Box<dyn Error>> {
+    let mut options = BuildOptions::new(root);
+    options.output_root = Some(output_root);
+    options.no_cluster = true;
+    options.no_viz = true;
+    options.graph_storage = GraphStorage::Json;
+    options.purpose = BuildPurpose::Extract;
+    options.built_at_commit = Some("0123456789012345678901234567890123456789".to_owned());
+    configure(&mut options);
+    let result = build_local_graph(&options)?;
+    Ok(GraphDocument::load(&result.output_dir.join("graph.json"))?)
+}
+
+fn assert_vendor_publication(document: &GraphDocument, expected: bool) {
+    let inventory = document
+        .graph
+        .files
+        .iter()
+        .map(|file| (file.path.as_str(), file.language.as_deref()))
+        .collect::<BTreeMap<_, _>>();
+    for (source, language) in VENDOR_SOURCES {
+        assert_eq!(
+            inventory.get(source).copied(),
+            expected.then_some(Some(language)),
+            "unexpected inventory state for {source}"
+        );
+        assert_eq!(
+            document.nodes.iter().any(|node| node
+                .source
+                .as_ref()
+                .is_some_and(|anchor| anchor.file == source)),
+            expected,
+            "unexpected published node state for {source}"
+        );
+    }
+}
+
+#[test]
+fn vendor_sources_are_published_by_default_and_respect_explicit_exclusions()
+-> Result<(), Box<dyn Error>> {
+    let directory = tempfile::tempdir()?;
+    let root = directory.path().join("checkout");
+    fs::create_dir_all(root.join("src"))?;
+    fs::create_dir_all(root.join("vendor/parser-pack/src"))?;
+    fs::create_dir_all(root.join("vendor/go-dependency"))?;
+    fs::write(
+        root.join("Cargo.toml"),
+        "[workspace]\nmembers = [\"vendor/parser-pack\"]\nresolver = \"3\"\n",
+    )?;
+    fs::write(
+        root.join("vendor/parser-pack/Cargo.toml"),
+        "[package]\nname = \"parser-pack\"\nversion = \"0.1.0\"\nedition = \"2024\"\n",
+    )?;
+    fs::write(
+        root.join("vendor/parser-pack/src/lib.rs"),
+        "pub fn parse_vendor_source() -> usize { 1 }\n",
+    )?;
+    fs::write(
+        root.join("src/lib.rs"),
+        "pub fn keep_workspace_source() -> usize { 1 }\n",
+    )?;
+    fs::write(
+        root.join("vendor/go-dependency/tool.go"),
+        "package dependency\n\nfunc VendorTool() int { return 1 }\n",
+    )?;
+
+    let default = build_document(&root, directory.path().join("default-output"), |_| {})?;
+    assert_vendor_publication(&default, true);
+
+    fs::write(root.join(".compassignore"), "vendor/**\n")?;
+    let ignored = build_document(&root, directory.path().join("compassignore-output"), |_| {})?;
+    assert_vendor_publication(&ignored, false);
+    fs::remove_file(root.join(".compassignore"))?;
+
+    let excluded = build_document(&root, directory.path().join("exclude-output"), |options| {
+        options.extra_excludes = vec!["vendor/**".to_owned()]
+    })?;
+    assert_vendor_publication(&excluded, false);
+
+    let scope = BuildScope {
+        include: Vec::new(),
+        exclude: vec!["vendor/**".to_owned()],
+    }
+    .normalize(&root)?;
+    let scoped = build_document(&root, directory.path().join("scope-output"), |options| {
+        options.scope = scope
+    })?;
+    assert_vendor_publication(&scoped, false);
+    Ok(())
+}
diff --git a/crates/compass-files/tests/contracts.rs b/crates/compass-files/tests/contracts.rs
index d95e38747..6901ef8bf 100644
--- a/crates/compass-files/tests/contracts.rs
+++ b/crates/compass-files/tests/contracts.rs
@@ -4,11 +4,11 @@ use std::fs::{self, FileTimes};
 use std::time::{Duration, UNIX_EPOCH};
 
 use compass_files::{
-    AST_CACHE_VERSION, BuildGuard, CACHE_ENCODING_VERSION, Cache, CacheKind, CacheOptions,
-    DetectOptions, FileSlice, Manifest, ManifestKind, StatHashIndex, WatchPathFilter, bisect_slice,
-    body_content, classify_file, file_hash, md5_file, prompt_fingerprint, read_slice_text,
-    read_source_lossy, slice_boundaries, split_file, write_bytes_atomic, write_json_atomic,
-    write_text_atomic,
+    AST_CACHE_VERSION, BuildGuard, BuildScope, CACHE_ENCODING_VERSION, Cache, CacheKind,
+    CacheOptions, DetectOptions, FileSlice, Manifest, ManifestKind, StatHashIndex, WatchPathFilter,
+    bisect_slice, body_content, classify_file, file_hash, md5_file, prompt_fingerprint,
+    read_slice_text, read_source_lossy, slice_boundaries, split_file, write_bytes_atomic,
+    write_json_atomic, write_text_atomic,
 };
 use compass_files::{FileType, IgnorePolicy};
 use serde::Deserialize;
@@ -156,6 +156,69 @@ fn detection_ignores_compass_generated_output() -> Result<(), Box<dyn Error>> {
     Ok(())
 }
 
+#[test]
+fn vendor_source_remains_in_default_discovery_including_workspace_members()
+-> Result<(), Box<dyn Error>> {
+    let directory = tempfile::tempdir()?;
+    let root = directory.path();
+    fs::write(
+        root.join("Cargo.toml"),
+        "[workspace]\nmembers = [\"vendor/parser-pack\"]\n",
+    )?;
+    let workspace_source = root.join("vendor/parser-pack/src/lib.rs");
+    fs::create_dir_all(workspace_source.parent().ok_or("workspace source parent")?)?;
+    fs::write(
+        root.join("vendor/parser-pack/Cargo.toml"),
+        "[package]\nname = \"parser-pack\"\nversion = \"0.1.0\"\n",
+    )?;
+    fs::write(&workspace_source, "pub fn parser() {}\n")?;
+    let go_source = root.join("vendor/example.test/module/library.go");
+    fs::create_dir_all(go_source.parent().ok_or("Go vendor source parent")?)?;
+    fs::write(&go_source, "package module\n")?;
+
+    let detection = compass_files::detect(root, &DetectOptions::default())?;
+    let code = detection.files["code"].join("\n");
+    assert!(code.contains("vendor/parser-pack/src/lib.rs"));
+    assert!(code.contains("vendor/example.test/module/library.go"));
+
+    let watcher = WatchPathFilter::new(root, &DetectOptions::default())?;
+    assert!(watcher.allows(&workspace_source));
+    assert!(watcher.allows(&go_source));
+
+    fs::write(root.join(".compassignore"), "vendor/**\n")?;
+    let ignored = compass_files::detect(root, &DetectOptions::default())?;
+    assert!(ignored.files["code"].is_empty());
+    let ignored_watcher = WatchPathFilter::new(root, &DetectOptions::default())?;
+    assert!(!ignored_watcher.allows(&workspace_source));
+    assert!(!ignored_watcher.allows(&go_source));
+    fs::remove_file(root.join(".compassignore"))?;
+
+    let excluded_options = DetectOptions {
+        extra_excludes: vec!["vendor/**".to_owned()],
+        ..DetectOptions::default()
+    };
+    let excluded = compass_files::detect(root, &excluded_options)?;
+    assert!(excluded.files["code"].is_empty());
+    let excluded_watcher = WatchPathFilter::new(root, &excluded_options)?;
+    assert!(!excluded_watcher.allows(&workspace_source));
+    assert!(!excluded_watcher.allows(&go_source));
+
+    let scoped_options = DetectOptions {
+        scope: BuildScope {
+            include: Vec::new(),
+            exclude: vec!["vendor/**".to_owned()],
+        }
+        .normalize(root)?,
+        ..DetectOptions::default()
+    };
+    let scoped = compass_files::detect(root, &scoped_options)?;
+    assert!(scoped.files["code"].is_empty());
+    let scoped_watcher = WatchPathFilter::new(root, &scoped_options)?;
+    assert!(!scoped_watcher.allows(&workspace_source));
+    assert!(!scoped_watcher.allows(&go_source));
+    Ok(())
+}
+
 #[test]
 fn historical_detection_ignores_caller_local_excludes_but_keeps_committed_rules()
 -> Result<(), Box<dyn Error>> {
diff --git a/crates/compass-graph/Cargo.toml b/crates/compass-graph/Cargo.toml
index c3ef0bdb0..582d8d261 100644
--- a/crates/compass-graph/Cargo.toml
+++ b/crates/compass-graph/Cargo.toml
@@ -29,6 +29,7 @@ unicode-normalization.workspace = true
 zstd.workspace = true
 
 [dev-dependencies]
+compass-resolve = { path = "../compass-resolve", version = "0.3.7" }
 tempfile.workspace = true
 
 [lints]
diff --git a/crates/compass-graph/src/lib.rs b/crates/compass-graph/src/lib.rs
index 5f2660ae0..b18bb3014 100644
--- a/crates/compass-graph/src/lib.rs
+++ b/crates/compass-graph/src/lib.rs
@@ -24,14 +24,16 @@ pub use dedup::{
 };
 pub use quarantine::{MAX_QUARANTINE_EXAMPLES, PublicationOmissions, PublicationOutcome};
 pub use snapshot::{
-    CanonicalGraphDocument, GRAPH_JSON_DELTA_MAX_SOURCE_BYTES, GRAPH_SNAPSHOT_LAYOUT_V2,
-    GRAPH_SNAPSHOT_MAX_ITEMS, GRAPH_SNAPSHOT_MAX_OBJECTS, GRAPH_SNAPSHOT_SELECTOR_SCHEMA_V1,
+    CanonicalGraphDocument, GRAPH_JSON_DELTA_MAX_SOURCE_BYTES, GRAPH_SNAPSHOT_ACTIVE_KEY,
+    GRAPH_SNAPSHOT_CATALOG_PARTITION, GRAPH_SNAPSHOT_LAYOUT_V2, GRAPH_SNAPSHOT_MAX_ITEMS,
+    GRAPH_SNAPSHOT_MAX_OBJECTS, GRAPH_SNAPSHOT_OBJECT_PARTITION, GRAPH_SNAPSHOT_SELECTOR_SCHEMA_V1,
     GraphSnapshotBuilder, GraphSnapshotGcStats, GraphSnapshotManifest, GraphSnapshotMetadata,
-    GraphSnapshotReader, IndexKind, PreparedGraphSnapshot, PreparedGraphSnapshotContent,
-    SnapshotError, SnapshotReadLimits, SnapshotRoot, SnapshotSelector, activate_graph_snapshot,
-    active_graph_snapshot, canonical_graph_document, canonical_graph_document_presorted,
-    canonical_graph_json, encode_graph_index_key, garbage_collect_graph_snapshots,
-    graph_snapshot_needs_gc, prepare_graph_snapshot, write_canonical_graph_json,
+    GraphSnapshotReader, IndexKind, MAX_CANONICAL_GRAPH_BYTES, PreparedGraphSnapshot,
+    PreparedGraphSnapshotContent, SnapshotError, SnapshotReadLimits, SnapshotRoot,
+    SnapshotSelector, activate_graph_snapshot, active_graph_snapshot, canonical_graph_document,
+    canonical_graph_document_presorted, canonical_graph_json, encode_graph_index_key,
+    garbage_collect_graph_snapshots, graph_snapshot_manifest_key, graph_snapshot_needs_gc,
+    max_canonical_graph_bytes, prepare_graph_snapshot, write_canonical_graph_json,
     write_fact_neutral_graph_json_delta, write_fact_neutral_graph_json_delta_prevalidated,
 };
 pub use v1::{
@@ -1071,9 +1073,19 @@ fn normalize_source_file(value: &str, root: Option<&Path>) -> String {
     let path = Path::new(&portable);
     if path.is_absolute()
         && let Some(root) = root
-        && let Ok(relative) = path.strip_prefix(root)
     {
-        return path_text(relative);
+        if let Ok(relative) = path.strip_prefix(root) {
+            return path_text(relative);
+        }
+        // macOS commonly exposes the same temporary/worktree path through
+        // both `/var` and `/private/var`. Resolve those aliases before
+        // deciding that an absolute source is outside the repository root.
+        if let (Ok(canonical_path), Ok(canonical_root)) =
+            (std::fs::canonicalize(path), std::fs::canonicalize(root))
+            && let Ok(relative) = canonical_path.strip_prefix(canonical_root)
+        {
+            return path_text(relative);
+        }
     }
     portable
 }
diff --git a/crates/compass-graph/src/snapshot.rs b/crates/compass-graph/src/snapshot.rs
index 3ac722b96..c3aab53d4 100644
--- a/crates/compass-graph/src/snapshot.rs
+++ b/crates/compass-graph/src/snapshot.rs
@@ -15,11 +15,11 @@ use compass_model::code_graph::{
     CODE_GRAPH_SCHEMA_V1, EdgeRecord, FileRecord, GraphDiagnostic, GraphDocument, GraphMetadata,
     NodeDetails, NodeKind, NodeRecord,
 };
-use compass_model::validate_code_graph;
+use compass_model::{validate_build_metadata_identity, validate_code_graph};
 use compass_store::{
     ImmutableWrite, Key, MAX_GRAPH_BYTES, MAX_IMMUTABLE_BATCH_BYTES, MAX_IMMUTABLE_BATCH_ITEMS,
     MAX_SCAN_BYTES, MAX_SCAN_ITEMS, MAX_VALUE_BYTES, NamespaceId, PartitionKey, Store, StoreError,
-    WriteCondition, decode_key_segments, encode_key_segments,
+    WriteCondition, decode_key_segments, encode_key_segments, max_graph_bytes,
 };
 use rayon::prelude::*;
 use serde::{Deserialize, Serialize};
@@ -39,6 +39,14 @@ pub const GRAPH_SNAPSHOT_MAX_OBJECTS: usize = 100_000;
 pub const GRAPH_SNAPSHOT_MAX_ITEMS: usize = 5_000_000;
 pub const GRAPH_SNAPSHOT_MAX_FANOUT: usize = 32;
 pub const GRAPH_SNAPSHOT_MAX_LEAF_ENTRIES: usize = 128;
+/// Default maximum size of the canonical graph published by a snapshot.
+pub const MAX_CANONICAL_GRAPH_BYTES: u64 = MAX_GRAPH_BYTES as u64;
+/// Effective canonical publication bound, including the explicit opt-in
+/// `COMPASS_MAX_GRAPH_BYTES` override.
+#[must_use]
+pub fn max_canonical_graph_bytes() -> u64 {
+    max_graph_bytes() as u64
+}
 /// Maximum previous JSON artifact retained while attempting a byte-preserving
 /// fact-neutral publication. Larger artifacts use the bounded streaming
 /// serializer instead of adding another resident graph-sized buffer.
@@ -62,6 +70,17 @@ pub enum SnapshotError {
     Limit(String),
 }
 
+impl SnapshotError {
+    /// Construct the stable, actionable failure for canonical graph
+    /// publication above a byte limit.
+    #[must_use]
+    pub fn canonical_graph_too_large(maximum: u64) -> Self {
+        Self::Limit(format!(
+            "canonical graph exceeds the {maximum}-byte limit; retry or rebuild with a smaller scope using --exclude <pattern> or persistent patterns in .compassignore, or explicitly raise the bound with COMPASS_MAX_GRAPH_BYTES=<bytes|NMB|NGB>"
+        ))
+    }
+}
+
 #[derive(Clone, Copy, Debug, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize, Deserialize)]
 #[serde(rename_all = "snake_case")]
 pub enum IndexKind {
@@ -158,10 +177,14 @@ impl GraphSnapshotManifest {
                 SnapshotError::Corrupt(format!("{name} is not a SHA-256 digest: {error}"))
             })?;
         }
-        if self.graph_bytes == 0 || self.graph_bytes > MAX_GRAPH_BYTES as u64 {
-            return Err(SnapshotError::Corrupt(format!(
-                "graph byte count exceeds the {MAX_GRAPH_BYTES}-byte limit"
-            )));
+        if self.graph_bytes == 0 {
+            return Err(SnapshotError::Corrupt(
+                "graph byte count is empty".to_owned(),
+            ));
+        }
+        let maximum = max_canonical_graph_bytes();
+        if self.graph_bytes > maximum {
+            return Err(SnapshotError::canonical_graph_too_large(maximum));
         }
         if self.node_count > GRAPH_SNAPSHOT_MAX_ITEMS as u64
             || self.edge_count > GRAPH_SNAPSHOT_MAX_ITEMS as u64
@@ -881,7 +904,7 @@ fn write_fact_neutral_graph_json_delta_inner<W: Write + ?Sized>(
     writer: &mut W,
 ) -> io::Result<bool> {
     if previous_bytes.is_empty()
-        || previous_bytes.len() > MAX_GRAPH_BYTES
+        || previous_bytes.len() > max_graph_bytes()
         || previous_bytes.len() > GRAPH_JSON_DELTA_MAX_SOURCE_BYTES
     {
         return Ok(false);
@@ -1635,6 +1658,9 @@ impl<'a, S: Store + ?Sized> GraphSnapshotReader<'a, S> {
             .lookup(IndexKind::Metadata, &key)?
             .ok_or_else(|| SnapshotError::Corrupt("metadata index entry is missing".to_owned()))?;
         let record = decode_json::<MetadataRecord>(&value)?;
+        validate_build_metadata_identity(&record.graph.build).map_err(|error| {
+            SnapshotError::Corrupt(format!("graph build identity is invalid: {error}"))
+        })?;
         Ok(GraphSnapshotMetadata {
             directed: record.directed,
             multigraph: record.multigraph,
@@ -2125,9 +2151,9 @@ fn digest_canonical_graph(
     graph: &GraphDocument,
     clear_generation: bool,
 ) -> Result<(String, u64), SnapshotError> {
-    digest_json(
+    digest_canonical_graph_json(
         &canonical_graph_document_with_generation(graph, clear_generation),
-        MAX_GRAPH_BYTES,
+        max_graph_bytes(),
     )
 }
 
@@ -3130,13 +3156,14 @@ impl Write for DigestWriter {
     }
 }
 
-fn digest_json<T: Serialize>(value: &T, maximum: usize) -> Result<(String, u64), SnapshotError> {
+fn digest_canonical_graph_json<T: Serialize>(
+    value: &T,
+    maximum: usize,
+) -> Result<(String, u64), SnapshotError> {
     let mut writer = DigestWriter::new(maximum);
     if let Err(error) = serde_json::to_writer(&mut writer, value) {
         if writer.exceeded {
-            return Err(SnapshotError::Limit(format!(
-                "canonical graph exceeds the {maximum}-byte limit"
-            )));
+            return Err(SnapshotError::canonical_graph_too_large(maximum as u64));
         }
         return Err(SnapshotError::Encode(error.to_string()));
     }
@@ -3283,11 +3310,19 @@ fn object_key(digest: &str) -> Result<Key, SnapshotError> {
     Key::new(format!("object/{digest}").as_bytes()).map_err(SnapshotError::from)
 }
 
-fn manifest_key(digest: &str) -> Result<Key, SnapshotError> {
+/// Return the versioned store key for an immutable graph snapshot manifest.
+///
+/// Store adapters and contract tests use this helper instead of duplicating
+/// the snapshot layout's key encoding outside its owning crate.
+pub fn graph_snapshot_manifest_key(digest: &str) -> Result<Key, SnapshotError> {
     parse_digest(digest)?;
     Key::new(format!("manifest/{digest}").as_bytes()).map_err(SnapshotError::from)
 }
 
+fn manifest_key(digest: &str) -> Result<Key, SnapshotError> {
+    graph_snapshot_manifest_key(digest)
+}
+
 fn digest_bytes(value: &[u8]) -> [u8; 32] {
     Sha256::digest(value).into()
 }
diff --git a/crates/compass-graph/src/v1.rs b/crates/compass-graph/src/v1.rs
index 7d4d84d0a..99567c6bd 100644
--- a/crates/compass-graph/src/v1.rs
+++ b/crates/compass-graph/src/v1.rs
@@ -1501,11 +1501,15 @@ fn normalize_trusted_node(value: Value, raw_id: &str) -> Result<NodeRecord, Grap
         )
         && let Some(site) = node.source.as_ref()
     {
-        let positional_name = format!(
-            "{}@{}:{}",
-            node.qualified_name, site.start_byte, site.end_byte
-        );
-        node.id = domain_id(NodeKind::Resource, &site.file, &positional_name);
+        let identity_name = if semantic_document_resource(node.details.as_ref()) {
+            node.qualified_name.clone()
+        } else {
+            format!(
+                "{}@{}:{}",
+                node.qualified_name, site.start_byte, site.end_byte
+            )
+        };
+        node.id = domain_id(NodeKind::Resource, &site.file, &identity_name);
     }
     if node.source.is_none() {
         for evidence in &mut node.evidence {
@@ -4417,6 +4421,9 @@ fn node_identity(
                 }))
             ) =>
         {
+            if semantic_document_resource(details) {
+                return Ok(domain_id(kind, source_path, qualified_name));
+            }
             // Markdown/HTML blocks are occurrences, not global concepts. The
             // source anchor is part of their semantic identity so repeated
             // blocks in one file cannot quarantine one another.
@@ -4493,6 +4500,17 @@ fn node_identity(
     Ok(id)
 }
 
+fn semantic_document_resource(details: Option<&NodeDetails>) -> bool {
+    matches!(
+        details,
+        Some(NodeDetails::Resource(ResourceNodeDetails {
+            resource_kind: ResourceKind::Document,
+            uri: Some(uri),
+            ..
+        })) if uri.starts_with('#')
+    )
+}
+
 fn raw_anchor(
     attributes: &Map<String, Value>,
     root: &Path,
diff --git a/crates/compass-graph/tests/rust_method_identity.rs b/crates/compass-graph/tests/rust_method_identity.rs
index 0f2d97259..aad25dd4c 100644
--- a/crates/compass-graph/tests/rust_method_identity.rs
+++ b/crates/compass-graph/tests/rust_method_identity.rs
@@ -1,4 +1,4 @@
-use std::collections::BTreeSet;
+use std::collections::{BTreeSet, HashMap};
 use std::error::Error;
 use std::fs;
 
@@ -209,25 +209,25 @@ fn generic_methods_in_distinct_classes_publish_distinct_stable_nodes() -> Result
     let root = directory.path();
     let path = root.join("assets/bundle.js");
     fs::create_dir_all(path.parent().ok_or("missing source parent")?)?;
-    fs::write(
-        &path,
-        r#"
+    let source = r#"
 class First {
     constructor(e, t) { this.value = e + t; }
 }
 class Second {
     constructor(e, t) { this.value = e * t; }
 }
-"#,
-    )?;
+"#;
+    fs::write(&path, source)?;
 
     let extraction = Engine::default().extract(&path)?;
-    let flexible = build_from_extraction(&extraction, true, Some(root));
+    let sources = HashMap::from([(path.to_string_lossy().into_owned(), source.to_owned())]);
+    let resolved = compass_resolve::resolve_with_root(&[extraction], &sources, root);
+    let flexible = build_from_extraction(&resolved, true, Some(root));
     let graph = normalize_document_v1(&flexible, root, "sha256:test", None)?;
     let methods = graph
         .nodes
         .iter()
-        .filter(|node| node.kind == NodeKind::Method && node.name == ".constructor()")
+        .filter(|node| node.kind == NodeKind::Constructor && node.name == "constructor")
         .collect::<Vec<_>>();
 
     assert_eq!(methods.len(), 2, "nodes={:?}", graph.nodes);
@@ -236,7 +236,7 @@ class Second {
             .iter()
             .map(|node| node.qualified_name.as_str())
             .collect::<BTreeSet<_>>(),
-        ["First::constructor", "Second::constructor"]
+        ["bundle.First.constructor", "bundle.Second.constructor"]
             .into_iter()
             .collect()
     );
diff --git a/crates/compass-graphdb-surreal/Cargo.toml b/crates/compass-graphdb-surreal/Cargo.toml
new file mode 100644
index 000000000..50c0c4628
--- /dev/null
+++ b/crates/compass-graphdb-surreal/Cargo.toml
@@ -0,0 +1,41 @@
+[package]
+name = "compass-graphdb-surreal"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+repository.workspace = true
+homepage.workspace = true
+readme = "README.md"
+description = "Optional generation-atomic SurrealDB graph projection for Compass"
+keywords.workspace = true
+categories.workspace = true
+
+[features]
+default = []
+mem = ["dep:surrealdb", "surrealdb/kv-mem"]
+surrealkv = ["dep:surrealdb", "surrealdb/kv-surrealkv"]
+rocksdb = ["dep:surrealdb", "surrealdb/kv-rocksdb"]
+
+[dependencies]
+compass-model = { path = "../compass-model", version = "0.3.7" }
+serde.workspace = true
+serde_json.workspace = true
+sha2.workspace = true
+thiserror.workspace = true
+surrealdb = { workspace = true, optional = true }
+
+[dev-dependencies]
+compass-query = { path = "../compass-query", version = "0.3.7" }
+tempfile.workspace = true
+tokio.workspace = true
+
+[lints]
+workspace = true
+
+[package.metadata.compass.surrealdb]
+version = "3.2.4"
+license = "Business Source License 1.1"
+change-date = "2030-01-01"
+change-license = "Apache-2.0"
+restriction = "Database Service"
diff --git a/crates/compass-graphdb-surreal/README.md b/crates/compass-graphdb-surreal/README.md
new file mode 100644
index 000000000..bec301ce4
--- /dev/null
+++ b/crates/compass-graphdb-surreal/README.md
@@ -0,0 +1,39 @@
+# compass-graphdb-surreal
+
+This optional integration crate projects one validated, immutable
+`compass.graph/1` generation into schemafull SurrealDB node and relation
+records. It does not replace Compass's canonical JSON/SQLite realization and
+contains no CLI or MCP presentation logic.
+
+The crate has no default engine feature. Enable exactly the embedded profile
+you need:
+
+- `mem` for deterministic tests and ephemeral sessions;
+- `surrealkv` for an embedded SurrealKV database; or
+- `rocksdb` for an embedded RocksDB database.
+
+These features resolve exactly `surrealdb` 3.2.4. That dependency and its core
+are licensed under Business Source License 1.1 before conversion, with a
+Database Service restriction, Change Date 2030-01-01, and Apache-2.0 Change
+License. Surreal-enabled binaries, libraries, containers, and archives must
+preserve the applicable SurrealDB license and notices and must not be described
+as exclusively OSI-open-source. See
+[`docs/future/surrealdb-license-decision.md`](../../docs/future/surrealdb-license-decision.md)
+and the exact tagged license fixture under
+[`scripts/fixtures/surreal-persistent-probes/`](../../scripts/fixtures/surreal-persistent-probes/).
+
+No API in this crate accepts arbitrary SurrealQL. Values are parameter-bound
+through a closed internal statement set.
+
+Projection publication claims an incomplete generation, stages idempotent node
+and relation batches in bounded 512-record commits, validates the exact staged
+identity sets, completes the immutable manifest, and switches the active
+repository pointer last. Interrupted candidates remain invisible and can be
+resumed without retaining one graph-sized transaction or rewriting the prior
+active generation.
+
+With an engine feature enabled, `SurrealProjection` exposes generation-pinned,
+bounded native reads for callers, callees, impact, directed node trails,
+connected structural subgraphs, and relation pagination. These operations
+return the shared Compass structural query contract. Relation-page cursors are
+opaque, checksummed, and bound to one repository, generation, and operation.
diff --git a/crates/compass-graphdb-surreal/src/engine.rs b/crates/compass-graphdb-surreal/src/engine.rs
new file mode 100644
index 000000000..a25d55055
--- /dev/null
+++ b/crates/compass-graphdb-surreal/src/engine.rs
@@ -0,0 +1,911 @@
+//! Feature-gated SurrealDB execution layer.
+
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+use surrealdb::engine::local::Db;
+use surrealdb::types::{RecordId, SurrealValue as _, Value as DatabaseValue};
+use surrealdb::{IndexedResults, Surreal};
+
+use crate::projection::record_key;
+use crate::{
+    PROJECTION_SCHEMA_V1, ProjectedNode, ProjectedRelation, ProjectionError, ProjectionLimits,
+    ProjectionPlan, RelationFamily,
+};
+
+mod query;
+
+pub use query::{NATIVE_RELATION_PAGE_SCHEMA_V1, RelationPage, RelationPageRequest};
+
+const SCHEMA: &str = r#"
+DEFINE TABLE OVERWRITE generation_manifest SCHEMAFULL;
+DEFINE FIELD OVERWRITE repositoryId ON generation_manifest TYPE string;
+DEFINE FIELD OVERWRITE generationId ON generation_manifest TYPE string;
+DEFINE FIELD OVERWRITE schemaVersion ON generation_manifest TYPE string;
+DEFINE FIELD OVERWRITE projectionFingerprint ON generation_manifest TYPE string;
+DEFINE FIELD OVERWRITE sourceTreeDigest ON generation_manifest TYPE string;
+DEFINE FIELD OVERWRITE schemaFingerprint ON generation_manifest TYPE string;
+DEFINE FIELD OVERWRITE nodeCount ON generation_manifest TYPE int;
+DEFINE FIELD OVERWRITE relationCount ON generation_manifest TYPE int;
+DEFINE FIELD OVERWRITE projectedBytes ON generation_manifest TYPE int;
+DEFINE FIELD OVERWRITE complete ON generation_manifest TYPE bool;
+
+DEFINE TABLE OVERWRITE repository_pointer SCHEMAFULL;
+DEFINE FIELD OVERWRITE repositoryId ON repository_pointer TYPE string;
+DEFINE FIELD OVERWRITE generationId ON repository_pointer TYPE string;
+DEFINE FIELD OVERWRITE schemaVersion ON repository_pointer TYPE string;
+DEFINE FIELD OVERWRITE projectionFingerprint ON repository_pointer TYPE string;
+
+DEFINE TABLE OVERWRITE code_node SCHEMAFULL;
+DEFINE FIELD OVERWRITE recordKey ON code_node TYPE string;
+DEFINE FIELD OVERWRITE repositoryId ON code_node TYPE string;
+DEFINE FIELD OVERWRITE generationId ON code_node TYPE string;
+DEFINE FIELD OVERWRITE schemaVersion ON code_node TYPE string;
+DEFINE FIELD OVERWRITE compassNodeId ON code_node TYPE string;
+DEFINE FIELD OVERWRITE kind ON code_node TYPE string;
+DEFINE FIELD OVERWRITE name ON code_node TYPE string;
+DEFINE FIELD OVERWRITE qualifiedName ON code_node TYPE string;
+DEFINE FIELD OVERWRITE normalizedNames ON code_node TYPE array<string>;
+DEFINE FIELD OVERWRITE language ON code_node TYPE option<string>;
+DEFINE FIELD OVERWRITE sourcePath ON code_node TYPE option<string>;
+DEFINE FIELD OVERWRITE confidence ON code_node TYPE string;
+DEFINE FIELD OVERWRITE heuristic ON code_node TYPE bool;
+DEFINE FIELD OVERWRITE payloadJson ON code_node TYPE string;
+DEFINE INDEX OVERWRITE code_node_projection ON TABLE code_node FIELDS repositoryId, generationId, compassNodeId;
+DEFINE INDEX OVERWRITE code_node_normalized_names ON TABLE code_node FIELDS repositoryId, generationId, normalizedNames[*];
+
+DEFINE TABLE OVERWRITE structural_relation TYPE RELATION IN code_node OUT code_node SCHEMAFULL;
+DEFINE TABLE OVERWRITE dependency_relation TYPE RELATION IN code_node OUT code_node SCHEMAFULL;
+DEFINE TABLE OVERWRITE execution_relation TYPE RELATION IN code_node OUT code_node SCHEMAFULL;
+DEFINE TABLE OVERWRITE data_flow_relation TYPE RELATION IN code_node OUT code_node SCHEMAFULL;
+DEFINE TABLE OVERWRITE evidence_relation TYPE RELATION IN code_node OUT code_node SCHEMAFULL;
+
+DEFINE FIELD OVERWRITE recordKey ON structural_relation TYPE string;
+DEFINE FIELD OVERWRITE repositoryId ON structural_relation TYPE string;
+DEFINE FIELD OVERWRITE generationId ON structural_relation TYPE string;
+DEFINE FIELD OVERWRITE schemaVersion ON structural_relation TYPE string;
+DEFINE FIELD OVERWRITE compassEdgeId ON structural_relation TYPE string;
+DEFINE FIELD OVERWRITE family ON structural_relation TYPE string;
+DEFINE FIELD OVERWRITE kind ON structural_relation TYPE string;
+DEFINE FIELD OVERWRITE sourceNodeId ON structural_relation TYPE string;
+DEFINE FIELD OVERWRITE targetNodeId ON structural_relation TYPE string;
+DEFINE FIELD OVERWRITE sourceRecordKey ON structural_relation TYPE string;
+DEFINE FIELD OVERWRITE targetRecordKey ON structural_relation TYPE string;
+DEFINE FIELD OVERWRITE sourcePath ON structural_relation TYPE option<string>;
+DEFINE FIELD OVERWRITE confidence ON structural_relation TYPE string;
+DEFINE FIELD OVERWRITE heuristic ON structural_relation TYPE bool;
+DEFINE FIELD OVERWRITE payloadJson ON structural_relation TYPE string;
+
+DEFINE FIELD OVERWRITE recordKey ON dependency_relation TYPE string;
+DEFINE FIELD OVERWRITE repositoryId ON dependency_relation TYPE string;
+DEFINE FIELD OVERWRITE generationId ON dependency_relation TYPE string;
+DEFINE FIELD OVERWRITE schemaVersion ON dependency_relation TYPE string;
+DEFINE FIELD OVERWRITE compassEdgeId ON dependency_relation TYPE string;
+DEFINE FIELD OVERWRITE family ON dependency_relation TYPE string;
+DEFINE FIELD OVERWRITE kind ON dependency_relation TYPE string;
+DEFINE FIELD OVERWRITE sourceNodeId ON dependency_relation TYPE string;
+DEFINE FIELD OVERWRITE targetNodeId ON dependency_relation TYPE string;
+DEFINE FIELD OVERWRITE sourceRecordKey ON dependency_relation TYPE string;
+DEFINE FIELD OVERWRITE targetRecordKey ON dependency_relation TYPE string;
+DEFINE FIELD OVERWRITE sourcePath ON dependency_relation TYPE option<string>;
+DEFINE FIELD OVERWRITE confidence ON dependency_relation TYPE string;
+DEFINE FIELD OVERWRITE heuristic ON dependency_relation TYPE bool;
+DEFINE FIELD OVERWRITE payloadJson ON dependency_relation TYPE string;
+
+DEFINE FIELD OVERWRITE recordKey ON execution_relation TYPE string;
+DEFINE FIELD OVERWRITE repositoryId ON execution_relation TYPE string;
+DEFINE FIELD OVERWRITE generationId ON execution_relation TYPE string;
+DEFINE FIELD OVERWRITE schemaVersion ON execution_relation TYPE string;
+DEFINE FIELD OVERWRITE compassEdgeId ON execution_relation TYPE string;
+DEFINE FIELD OVERWRITE family ON execution_relation TYPE string;
+DEFINE FIELD OVERWRITE kind ON execution_relation TYPE string;
+DEFINE FIELD OVERWRITE sourceNodeId ON execution_relation TYPE string;
+DEFINE FIELD OVERWRITE targetNodeId ON execution_relation TYPE string;
+DEFINE FIELD OVERWRITE sourceRecordKey ON execution_relation TYPE string;
+DEFINE FIELD OVERWRITE targetRecordKey ON execution_relation TYPE string;
+DEFINE FIELD OVERWRITE sourcePath ON execution_relation TYPE option<string>;
+DEFINE FIELD OVERWRITE confidence ON execution_relation TYPE string;
+DEFINE FIELD OVERWRITE heuristic ON execution_relation TYPE bool;
+DEFINE FIELD OVERWRITE payloadJson ON execution_relation TYPE string;
+
+DEFINE FIELD OVERWRITE recordKey ON data_flow_relation TYPE string;
+DEFINE FIELD OVERWRITE repositoryId ON data_flow_relation TYPE string;
+DEFINE FIELD OVERWRITE generationId ON data_flow_relation TYPE string;
+DEFINE FIELD OVERWRITE schemaVersion ON data_flow_relation TYPE string;
+DEFINE FIELD OVERWRITE compassEdgeId ON data_flow_relation TYPE string;
+DEFINE FIELD OVERWRITE family ON data_flow_relation TYPE string;
+DEFINE FIELD OVERWRITE kind ON data_flow_relation TYPE string;
+DEFINE FIELD OVERWRITE sourceNodeId ON data_flow_relation TYPE string;
+DEFINE FIELD OVERWRITE targetNodeId ON data_flow_relation TYPE string;
+DEFINE FIELD OVERWRITE sourceRecordKey ON data_flow_relation TYPE string;
+DEFINE FIELD OVERWRITE targetRecordKey ON data_flow_relation TYPE string;
+DEFINE FIELD OVERWRITE sourcePath ON data_flow_relation TYPE option<string>;
+DEFINE FIELD OVERWRITE confidence ON data_flow_relation TYPE string;
+DEFINE FIELD OVERWRITE heuristic ON data_flow_relation TYPE bool;
+DEFINE FIELD OVERWRITE payloadJson ON data_flow_relation TYPE string;
+
+DEFINE FIELD OVERWRITE recordKey ON evidence_relation TYPE string;
+DEFINE FIELD OVERWRITE repositoryId ON evidence_relation TYPE string;
+DEFINE FIELD OVERWRITE generationId ON evidence_relation TYPE string;
+DEFINE FIELD OVERWRITE schemaVersion ON evidence_relation TYPE string;
+DEFINE FIELD OVERWRITE compassEdgeId ON evidence_relation TYPE string;
+DEFINE FIELD OVERWRITE family ON evidence_relation TYPE string;
+DEFINE FIELD OVERWRITE kind ON evidence_relation TYPE string;
+DEFINE FIELD OVERWRITE sourceNodeId ON evidence_relation TYPE string;
+DEFINE FIELD OVERWRITE targetNodeId ON evidence_relation TYPE string;
+DEFINE FIELD OVERWRITE sourceRecordKey ON evidence_relation TYPE string;
+DEFINE FIELD OVERWRITE targetRecordKey ON evidence_relation TYPE string;
+DEFINE FIELD OVERWRITE sourcePath ON evidence_relation TYPE option<string>;
+DEFINE FIELD OVERWRITE confidence ON evidence_relation TYPE string;
+DEFINE FIELD OVERWRITE heuristic ON evidence_relation TYPE bool;
+DEFINE FIELD OVERWRITE payloadJson ON evidence_relation TYPE string;
+
+DEFINE INDEX OVERWRITE structural_relation_projection ON TABLE structural_relation FIELDS repositoryId, generationId, compassEdgeId;
+DEFINE INDEX OVERWRITE dependency_relation_projection ON TABLE dependency_relation FIELDS repositoryId, generationId, compassEdgeId;
+DEFINE INDEX OVERWRITE execution_relation_projection ON TABLE execution_relation FIELDS repositoryId, generationId, compassEdgeId;
+DEFINE INDEX OVERWRITE data_flow_relation_projection ON TABLE data_flow_relation FIELDS repositoryId, generationId, compassEdgeId;
+DEFINE INDEX OVERWRITE evidence_relation_projection ON TABLE evidence_relation FIELDS repositoryId, generationId, compassEdgeId;
+"#;
+
+const UPSERT_RECORD: &str = "UPSERT $record CONTENT $payload";
+const CLAIM_GENERATION: &str = "INSERT INTO generation_manifest $payload ON DUPLICATE KEY UPDATE repositoryId = repositoryId RETURN NONE";
+const INSERT_NODE_BATCH: &str = r#"INSERT INTO code_node $payloads ON DUPLICATE KEY UPDATE
+recordKey = $input.recordKey, repositoryId = $input.repositoryId,
+generationId = $input.generationId, schemaVersion = $input.schemaVersion,
+compassNodeId = $input.compassNodeId, kind = $input.kind, name = $input.name,
+qualifiedName = $input.qualifiedName, normalizedNames = $input.normalizedNames,
+language = $input.language, sourcePath = $input.sourcePath,
+confidence = $input.confidence, heuristic = $input.heuristic,
+payloadJson = $input.payloadJson RETURN NONE"#;
+
+macro_rules! relation_insert_statement {
+    ($table:literal) => {
+        concat!(
+            "INSERT RELATION INTO ",
+            $table,
+            " $payloads ON DUPLICATE KEY UPDATE ",
+            "in = $input.in, out = $input.out, recordKey = $input.recordKey, ",
+            "repositoryId = $input.repositoryId, generationId = $input.generationId, ",
+            "schemaVersion = $input.schemaVersion, compassEdgeId = $input.compassEdgeId, ",
+            "family = $input.family, kind = $input.kind, sourceNodeId = $input.sourceNodeId, ",
+            "targetNodeId = $input.targetNodeId, sourceRecordKey = $input.sourceRecordKey, ",
+            "targetRecordKey = $input.targetRecordKey, sourcePath = $input.sourcePath, ",
+            "confidence = $input.confidence, heuristic = $input.heuristic, ",
+            "payloadJson = $input.payloadJson RETURN NONE"
+        )
+    };
+}
+
+const INSERT_STRUCTURAL_RELATION_BATCH: &str = relation_insert_statement!("structural_relation");
+const INSERT_DEPENDENCY_RELATION_BATCH: &str = relation_insert_statement!("dependency_relation");
+const INSERT_EXECUTION_RELATION_BATCH: &str = relation_insert_statement!("execution_relation");
+const INSERT_DATA_FLOW_RELATION_BATCH: &str = relation_insert_statement!("data_flow_relation");
+const INSERT_EVIDENCE_RELATION_BATCH: &str = relation_insert_statement!("evidence_relation");
+const PROJECTION_WRITE_BATCH: usize = 512;
+const SELECT_NODE_IDS: &str = "SELECT VALUE compassNodeId FROM code_node WHERE repositoryId = $repository AND generationId = $generation ORDER BY compassNodeId LIMIT $limit";
+const SELECT_RELATION_IDS: &str = "SELECT VALUE compassEdgeId FROM type::table($table) WHERE repositoryId = $repository AND generationId = $generation ORDER BY compassEdgeId LIMIT $limit";
+const SELECT_NODES: &str = "SELECT * OMIT id FROM code_node WHERE repositoryId = $repository AND generationId = $generation ORDER BY compassNodeId LIMIT $limit";
+const SELECT_RELATIONS: &str = "SELECT * OMIT id, in, out FROM type::table($table) WHERE repositoryId = $repository AND generationId = $generation ORDER BY compassEdgeId LIMIT $limit";
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct ActivationOutcome {
+    pub generation_id: String,
+    pub nodes: usize,
+    pub relations: usize,
+    pub already_present: bool,
+}
+
+/// Test fault-injection point counted across node and relation mutations.
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct InterruptAfter(pub usize);
+
+#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct GenerationManifest {
+    repository_id: String,
+    generation_id: String,
+    schema_version: String,
+    projection_fingerprint: String,
+    source_tree_digest: String,
+    schema_fingerprint: String,
+    node_count: usize,
+    relation_count: usize,
+    projected_bytes: u64,
+    complete: bool,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct ActivePointer {
+    repository_id: String,
+    generation_id: String,
+    schema_version: String,
+    projection_fingerprint: String,
+}
+
+/// A local SurrealDB projection client with a closed operation surface.
+pub struct SurrealProjection {
+    database: Surreal<Db>,
+    limits: ProjectionLimits,
+}
+
+impl SurrealProjection {
+    #[cfg(feature = "mem")]
+    pub async fn memory(namespace: &str, database: &str) -> Result<Self, ProjectionError> {
+        Self::memory_with_limits(namespace, database, ProjectionLimits::default()).await
+    }
+
+    #[cfg(feature = "mem")]
+    pub async fn memory_with_limits(
+        namespace: &str,
+        database: &str,
+        limits: ProjectionLimits,
+    ) -> Result<Self, ProjectionError> {
+        use surrealdb::engine::local::Mem;
+
+        let client = Surreal::new::<Mem>(())
+            .await
+            .map_err(|error| database_error("connect_mem", error))?;
+        Self::initialize(client, namespace, database, limits).await
+    }
+
+    #[cfg(feature = "surrealkv")]
+    pub async fn surrealkv(
+        path: &str,
+        namespace: &str,
+        database: &str,
+    ) -> Result<Self, ProjectionError> {
+        Self::surrealkv_with_limits(path, namespace, database, ProjectionLimits::default()).await
+    }
+
+    #[cfg(feature = "surrealkv")]
+    pub async fn surrealkv_with_limits(
+        path: &str,
+        namespace: &str,
+        database: &str,
+        limits: ProjectionLimits,
+    ) -> Result<Self, ProjectionError> {
+        use surrealdb::engine::local::SurrealKv;
+
+        let client = Surreal::new::<SurrealKv>(path)
+            .await
+            .map_err(|error| database_error("connect_surrealkv", error))?;
+        Self::initialize(client, namespace, database, limits).await
+    }
+
+    #[cfg(feature = "rocksdb")]
+    pub async fn rocksdb(
+        path: &str,
+        namespace: &str,
+        database: &str,
+    ) -> Result<Self, ProjectionError> {
+        Self::rocksdb_with_limits(path, namespace, database, ProjectionLimits::default()).await
+    }
+
+    #[cfg(feature = "rocksdb")]
+    pub async fn rocksdb_with_limits(
+        path: &str,
+        namespace: &str,
+        database: &str,
+        limits: ProjectionLimits,
+    ) -> Result<Self, ProjectionError> {
+        use surrealdb::engine::local::RocksDb;
+
+        let client = Surreal::new::<RocksDb>(path)
+            .await
+            .map_err(|error| database_error("connect_rocksdb", error))?;
+        Self::initialize(client, namespace, database, limits).await
+    }
+
+    async fn initialize(
+        client: Surreal<Db>,
+        namespace: &str,
+        database: &str,
+        limits: ProjectionLimits,
+    ) -> Result<Self, ProjectionError> {
+        if namespace.trim().is_empty() || database.trim().is_empty() {
+            return Err(ProjectionError::InvalidPlan(
+                "namespace and database must not be empty".to_owned(),
+            ));
+        }
+        client
+            .use_ns(namespace)
+            .use_db(database)
+            .await
+            .map_err(|error| database_error("select_namespace_database", error))?;
+        client
+            .query(SCHEMA)
+            .await
+            .and_then(IndexedResults::check)
+            .map_err(|error| database_error("define_schema", error))?;
+        Ok(Self {
+            database: client,
+            limits,
+        })
+    }
+
+    pub async fn activate(
+        &self,
+        plan: &ProjectionPlan,
+    ) -> Result<ActivationOutcome, ProjectionError> {
+        self.activate_with_interrupt(plan, None).await
+    }
+
+    pub async fn activate_with_interrupt(
+        &self,
+        plan: &ProjectionPlan,
+        interrupt: Option<InterruptAfter>,
+    ) -> Result<ActivationOutcome, ProjectionError> {
+        plan.validate()?;
+        let projected_bytes = self.limits.validate_plan(plan)?;
+        stage_generation(&self.database, plan, projected_bytes, interrupt).await
+    }
+
+    pub async fn active_generation(
+        &self,
+        repository_id: &str,
+    ) -> Result<Option<String>, ProjectionError> {
+        let pointer = select_record::<ActivePointer>(
+            &self.database,
+            RecordId::new("repository_pointer", pointer_key(repository_id)),
+            "read_active_pointer",
+        )
+        .await?;
+        Ok(pointer.map(|pointer| pointer.generation_id))
+    }
+
+    pub async fn read_active_projection(
+        &self,
+        repository_id: &str,
+    ) -> Result<Option<ProjectionPlan>, ProjectionError> {
+        let Some(pointer) = select_record::<ActivePointer>(
+            &self.database,
+            RecordId::new("repository_pointer", pointer_key(repository_id)),
+            "read_active_pointer",
+        )
+        .await?
+        else {
+            return Ok(None);
+        };
+        let manifest = select_record::<GenerationManifest>(
+            &self.database,
+            RecordId::new(
+                "generation_manifest",
+                manifest_key(repository_id, &pointer.generation_id),
+            ),
+            "read_generation_manifest",
+        )
+        .await?
+        .ok_or_else(|| {
+            ProjectionError::InvalidPlan("active generation manifest is missing".to_owned())
+        })?;
+        if !manifest.complete || manifest.schema_version != PROJECTION_SCHEMA_V1 {
+            return Err(ProjectionError::InvalidPlan(
+                "active generation manifest is incomplete or unsupported".to_owned(),
+            ));
+        }
+        validate_manifest_limits(&manifest, self.limits)?;
+        let nodes = read_nodes(
+            &self.database,
+            repository_id,
+            &pointer.generation_id,
+            self.limits.max_nodes(),
+        )
+        .await?;
+        let mut relations = Vec::new();
+        for family in RelationFamily::ALL {
+            let remaining = self.limits.max_relations().saturating_sub(relations.len());
+            relations.extend(
+                read_relations(
+                    &self.database,
+                    repository_id,
+                    &pointer.generation_id,
+                    family,
+                    remaining,
+                )
+                .await?,
+            );
+        }
+        relations.sort_by(|left, right| left.compass_edge_id.cmp(&right.compass_edge_id));
+        let plan = ProjectionPlan {
+            repository_id: repository_id.to_owned(),
+            generation_id: pointer.generation_id,
+            schema_version: manifest.schema_version,
+            source_tree_digest: manifest.source_tree_digest,
+            schema_fingerprint: manifest.schema_fingerprint,
+            projection_fingerprint: manifest.projection_fingerprint,
+            nodes,
+            relations,
+        };
+        plan.validate()?;
+        let projected_bytes = self.limits.validate_plan(&plan)?;
+        if plan.nodes.len() != manifest.node_count
+            || plan.relations.len() != manifest.relation_count
+            || projected_bytes != manifest.projected_bytes
+        {
+            return Err(ProjectionError::InvalidPlan(
+                "active generation records do not match the manifest".to_owned(),
+            ));
+        }
+        Ok(Some(plan))
+    }
+}
+
+async fn stage_generation(
+    database: &Surreal<Db>,
+    plan: &ProjectionPlan,
+    projected_bytes: u64,
+    interrupt: Option<InterruptAfter>,
+) -> Result<ActivationOutcome, ProjectionError> {
+    let manifest_id = RecordId::new(
+        "generation_manifest",
+        manifest_key(&plan.repository_id, &plan.generation_id),
+    );
+    let incomplete_manifest = GenerationManifest {
+        repository_id: plan.repository_id.clone(),
+        generation_id: plan.generation_id.clone(),
+        schema_version: plan.schema_version.clone(),
+        projection_fingerprint: plan.projection_fingerprint.clone(),
+        source_tree_digest: plan.source_tree_digest.clone(),
+        schema_fingerprint: plan.schema_fingerprint.clone(),
+        node_count: plan.nodes.len(),
+        relation_count: plan.relations.len(),
+        projected_bytes,
+        complete: false,
+    };
+    claim_generation(database, manifest_id.clone(), &incomplete_manifest).await?;
+    let existing = select_record::<GenerationManifest>(
+        database,
+        manifest_id.clone(),
+        "read_candidate_manifest",
+    )
+    .await?
+    .ok_or_else(|| ProjectionError::InvalidPlan("generation claim is missing".to_owned()))?;
+    if !manifest_matches(&existing, &incomplete_manifest) {
+        return Err(ProjectionError::InvalidPlan(
+            "immutable generation already exists with different content".to_owned(),
+        ));
+    }
+    if existing.complete {
+        validate_candidate(database, plan).await?;
+        upsert_pointer(database, plan).await?;
+        return Ok(ActivationOutcome {
+            generation_id: plan.generation_id.clone(),
+            nodes: plan.nodes.len(),
+            relations: plan.relations.len(),
+            already_present: true,
+        });
+    }
+
+    let mut mutations = 0_usize;
+    let mut node_offset = 0_usize;
+    while node_offset < plan.nodes.len() {
+        interrupt_if_requested(interrupt, mutations)?;
+        let batch_len = write_batch_len(interrupt, mutations, plan.nodes.len() - node_offset);
+        insert_node_batch(database, &plan.nodes[node_offset..node_offset + batch_len]).await?;
+        node_offset += batch_len;
+        mutations += batch_len;
+    }
+    let mut relation_offset = 0_usize;
+    while relation_offset < plan.relations.len() {
+        interrupt_if_requested(interrupt, mutations)?;
+        let family = plan.relations[relation_offset].family;
+        let family_remaining = plan.relations[relation_offset..]
+            .iter()
+            .take_while(|relation| relation.family == family)
+            .count();
+        let batch_len = write_batch_len(interrupt, mutations, family_remaining);
+        insert_relation_batch(
+            database,
+            &plan.relations[relation_offset..relation_offset + batch_len],
+        )
+        .await?;
+        relation_offset += batch_len;
+        mutations += batch_len;
+    }
+    interrupt_if_requested(interrupt, mutations)?;
+    validate_candidate(database, plan).await?;
+    let manifest = GenerationManifest {
+        complete: true,
+        ..incomplete_manifest
+    };
+    upsert_payload(
+        database,
+        manifest_id,
+        serde_json::to_value(manifest)?,
+        "write_generation_manifest",
+    )
+    .await?;
+    upsert_pointer(database, plan).await?;
+    Ok(ActivationOutcome {
+        generation_id: plan.generation_id.clone(),
+        nodes: plan.nodes.len(),
+        relations: plan.relations.len(),
+        already_present: false,
+    })
+}
+
+fn manifest_matches(left: &GenerationManifest, right: &GenerationManifest) -> bool {
+    left.repository_id == right.repository_id
+        && left.generation_id == right.generation_id
+        && left.schema_version == right.schema_version
+        && left.projection_fingerprint == right.projection_fingerprint
+        && left.source_tree_digest == right.source_tree_digest
+        && left.schema_fingerprint == right.schema_fingerprint
+        && left.node_count == right.node_count
+        && left.relation_count == right.relation_count
+        && left.projected_bytes == right.projected_bytes
+}
+
+async fn claim_generation(
+    database: &Surreal<Db>,
+    record: RecordId,
+    manifest: &GenerationManifest,
+) -> Result<(), ProjectionError> {
+    let payload = database_record_value(serde_json::to_value(manifest)?, record, None)?;
+    database
+        .query(CLAIM_GENERATION)
+        .bind(("payload", payload))
+        .await
+        .and_then(IndexedResults::check)
+        .map(|_response| ())
+        .map_err(|error| database_error("claim_generation", error))
+}
+
+fn interrupt_if_requested(
+    interrupt: Option<InterruptAfter>,
+    mutations: usize,
+) -> Result<(), ProjectionError> {
+    if interrupt.is_some_and(|interrupt| mutations >= interrupt.0) {
+        return Err(ProjectionError::Interrupted {
+            completed_mutations: mutations,
+        });
+    }
+    Ok(())
+}
+
+fn write_batch_len(
+    interrupt: Option<InterruptAfter>,
+    completed_mutations: usize,
+    remaining: usize,
+) -> usize {
+    let until_interrupt = interrupt
+        .map(|value| value.0.saturating_sub(completed_mutations))
+        .unwrap_or(PROJECTION_WRITE_BATCH);
+    remaining.min(PROJECTION_WRITE_BATCH).min(until_interrupt)
+}
+
+async fn insert_node_batch(
+    database: &Surreal<Db>,
+    nodes: &[ProjectedNode],
+) -> Result<(), ProjectionError> {
+    let payloads = nodes
+        .iter()
+        .map(|node| {
+            database_record_value(
+                serde_json::to_value(node)?,
+                RecordId::new("code_node", node.record_key.clone()),
+                None,
+            )
+        })
+        .collect::<Result<Vec<_>, ProjectionError>>()?;
+    insert_batch(database, INSERT_NODE_BATCH, payloads, "write_node_batch").await
+}
+
+async fn insert_relation_batch(
+    database: &Surreal<Db>,
+    relations: &[ProjectedRelation],
+) -> Result<(), ProjectionError> {
+    let Some(first) = relations.first() else {
+        return Ok(());
+    };
+    if relations
+        .iter()
+        .any(|relation| relation.family != first.family)
+    {
+        return Err(ProjectionError::InvalidPlan(
+            "one projection write batch crossed relation families".to_owned(),
+        ));
+    }
+    let statement = match first.family {
+        RelationFamily::Structural => INSERT_STRUCTURAL_RELATION_BATCH,
+        RelationFamily::Dependency => INSERT_DEPENDENCY_RELATION_BATCH,
+        RelationFamily::Execution => INSERT_EXECUTION_RELATION_BATCH,
+        RelationFamily::DataFlow => INSERT_DATA_FLOW_RELATION_BATCH,
+        RelationFamily::Evidence => INSERT_EVIDENCE_RELATION_BATCH,
+    };
+    let payloads = relations
+        .iter()
+        .map(|relation| {
+            database_record_value(
+                serde_json::to_value(relation)?,
+                RecordId::new(relation.family.as_str(), relation.record_key.clone()),
+                Some((
+                    RecordId::new("code_node", relation.source_record_key.clone()),
+                    RecordId::new("code_node", relation.target_record_key.clone()),
+                )),
+            )
+        })
+        .collect::<Result<Vec<_>, ProjectionError>>()?;
+    insert_batch(database, statement, payloads, "write_relation_batch").await
+}
+
+fn database_record_value(
+    payload: Value,
+    id: RecordId,
+    endpoints: Option<(RecordId, RecordId)>,
+) -> Result<DatabaseValue, ProjectionError> {
+    let mut value = payload.into_value();
+    let DatabaseValue::Object(object) = &mut value else {
+        return Err(ProjectionError::InvalidPlan(
+            "projected database payload is not an object".to_owned(),
+        ));
+    };
+    object.insert("id", id);
+    if let Some((source, target)) = endpoints {
+        object.insert("in", source);
+        object.insert("out", target);
+    }
+    Ok(value)
+}
+
+async fn insert_batch(
+    database: &Surreal<Db>,
+    statement: &'static str,
+    payloads: Vec<DatabaseValue>,
+    stage: &'static str,
+) -> Result<(), ProjectionError> {
+    database
+        .query(statement)
+        .bind(("payloads", payloads))
+        .await
+        .and_then(IndexedResults::check)
+        .map(|_response| ())
+        .map_err(|error| database_error(stage, error))
+}
+
+async fn upsert_pointer(
+    database: &Surreal<Db>,
+    plan: &ProjectionPlan,
+) -> Result<(), ProjectionError> {
+    let pointer = ActivePointer {
+        repository_id: plan.repository_id.clone(),
+        generation_id: plan.generation_id.clone(),
+        schema_version: plan.schema_version.clone(),
+        projection_fingerprint: plan.projection_fingerprint.clone(),
+    };
+    upsert_payload(
+        database,
+        RecordId::new("repository_pointer", pointer_key(&plan.repository_id)),
+        serde_json::to_value(pointer)?,
+        "activate_generation",
+    )
+    .await
+}
+
+async fn upsert_payload(
+    database: &Surreal<Db>,
+    record: RecordId,
+    payload: Value,
+    stage: &'static str,
+) -> Result<(), ProjectionError> {
+    database
+        .query(UPSERT_RECORD)
+        .bind(("record", record))
+        .bind(("payload", payload))
+        .await
+        .and_then(IndexedResults::check)
+        .map(|_response| ())
+        .map_err(|error| database_error(stage, error))
+}
+
+async fn validate_candidate(
+    database: &Surreal<Db>,
+    plan: &ProjectionPlan,
+) -> Result<(), ProjectionError> {
+    let node_ids = query_ids(
+        database,
+        SELECT_NODE_IDS,
+        &plan.repository_id,
+        &plan.generation_id,
+        None,
+        plan.nodes.len(),
+        "validate_node_ids",
+    )
+    .await?;
+    let expected_nodes = plan
+        .nodes
+        .iter()
+        .map(|node| node.compass_node_id.clone())
+        .collect::<Vec<_>>();
+    if node_ids != expected_nodes {
+        return Err(ProjectionError::InvalidPlan(
+            "staged node identities do not match the candidate".to_owned(),
+        ));
+    }
+    let mut relation_ids = Vec::new();
+    for family in RelationFamily::ALL {
+        let remaining = plan.relations.len().saturating_sub(relation_ids.len());
+        relation_ids.extend(
+            query_ids(
+                database,
+                SELECT_RELATION_IDS,
+                &plan.repository_id,
+                &plan.generation_id,
+                Some(family),
+                remaining,
+                "validate_relation_ids",
+            )
+            .await?,
+        );
+    }
+    relation_ids.sort();
+    let expected_relations = plan
+        .relations
+        .iter()
+        .map(|relation| relation.compass_edge_id.clone())
+        .collect::<Vec<_>>();
+    if relation_ids != expected_relations {
+        return Err(ProjectionError::InvalidPlan(
+            "staged relation identities do not match the candidate".to_owned(),
+        ));
+    }
+    Ok(())
+}
+
+async fn query_ids(
+    database: &Surreal<Db>,
+    statement: &'static str,
+    repository_id: &str,
+    generation_id: &str,
+    family: Option<RelationFamily>,
+    limit: usize,
+    stage: &'static str,
+) -> Result<Vec<String>, ProjectionError> {
+    let mut query = database
+        .query(statement)
+        .bind(("repository", repository_id))
+        .bind(("generation", generation_id))
+        .bind(("limit", plus_one(limit)?));
+    if let Some(family) = family {
+        query = query.bind(("table", family.as_str()));
+    }
+    let mut response = query.await.map_err(|error| database_error(stage, error))?;
+    response
+        .take(0)
+        .map_err(|error| database_error(stage, error))
+}
+
+async fn select_record<T>(
+    database: &Surreal<Db>,
+    record: RecordId,
+    stage: &'static str,
+) -> Result<Option<T>, ProjectionError>
+where
+    T: for<'de> Deserialize<'de>,
+{
+    let value: Option<Value> = database
+        .select(record)
+        .await
+        .map_err(|error| database_error(stage, error))?;
+    value
+        .map(serde_json::from_value)
+        .transpose()
+        .map_err(Into::into)
+}
+
+async fn read_nodes(
+    database: &Surreal<Db>,
+    repository_id: &str,
+    generation_id: &str,
+    limit: usize,
+) -> Result<Vec<ProjectedNode>, ProjectionError> {
+    query_projected(
+        database,
+        SELECT_NODES,
+        repository_id,
+        generation_id,
+        None,
+        limit,
+        "read_nodes",
+    )
+    .await
+}
+
+async fn read_relations(
+    database: &Surreal<Db>,
+    repository_id: &str,
+    generation_id: &str,
+    family: RelationFamily,
+    limit: usize,
+) -> Result<Vec<ProjectedRelation>, ProjectionError> {
+    query_projected(
+        database,
+        SELECT_RELATIONS,
+        repository_id,
+        generation_id,
+        Some(family),
+        limit,
+        "read_relations",
+    )
+    .await
+}
+
+async fn query_projected<T>(
+    database: &Surreal<Db>,
+    statement: &'static str,
+    repository_id: &str,
+    generation_id: &str,
+    family: Option<RelationFamily>,
+    limit: usize,
+    stage: &'static str,
+) -> Result<Vec<T>, ProjectionError>
+where
+    T: for<'de> Deserialize<'de>,
+{
+    let mut query = database
+        .query(statement)
+        .bind(("repository", repository_id))
+        .bind(("generation", generation_id))
+        .bind(("limit", plus_one(limit)?));
+    if let Some(family) = family {
+        query = query.bind(("table", family.as_str()));
+    }
+    let mut response = query.await.map_err(|error| database_error(stage, error))?;
+    let values: Vec<Value> = response
+        .take(0)
+        .map_err(|error| database_error(stage, error))?;
+    values
+        .into_iter()
+        .map(serde_json::from_value)
+        .collect::<Result<_, _>>()
+        .map_err(Into::into)
+}
+
+fn validate_manifest_limits(
+    manifest: &GenerationManifest,
+    limits: ProjectionLimits,
+) -> Result<(), ProjectionError> {
+    for (resource, actual, limit) in [
+        ("nodes", manifest.node_count, limits.max_nodes()),
+        ("relations", manifest.relation_count, limits.max_relations()),
+    ] {
+        if actual > limit {
+            return Err(ProjectionError::LimitExceeded {
+                resource,
+                actual: u64::try_from(actual).unwrap_or(u64::MAX),
+                limit: u64::try_from(limit).unwrap_or(u64::MAX),
+            });
+        }
+    }
+    if manifest.projected_bytes > limits.max_projected_bytes() {
+        return Err(ProjectionError::LimitExceeded {
+            resource: "projected bytes",
+            actual: manifest.projected_bytes,
+            limit: limits.max_projected_bytes(),
+        });
+    }
+    Ok(())
+}
+
+fn plus_one(limit: usize) -> Result<usize, ProjectionError> {
+    limit.checked_add(1).ok_or(ProjectionError::LimitExceeded {
+        resource: "query rows",
+        actual: u64::MAX,
+        limit: u64::try_from(limit).unwrap_or(u64::MAX),
+    })
+}
+
+fn pointer_key(repository_id: &str) -> String {
+    record_key("repository", &[repository_id])
+}
+
+fn manifest_key(repository_id: &str, generation_id: &str) -> String {
+    record_key("generation", &[repository_id, generation_id])
+}
+
+fn database_error(stage: &'static str, error: impl std::fmt::Display) -> ProjectionError {
+    ProjectionError::Database {
+        stage,
+        message: error.to_string(),
+    }
+}
diff --git a/crates/compass-graphdb-surreal/src/engine/query.rs b/crates/compass-graphdb-surreal/src/engine/query.rs
new file mode 100644
index 000000000..c47bef8f0
--- /dev/null
+++ b/crates/compass-graphdb-surreal/src/engine/query.rs
@@ -0,0 +1,1161 @@
+//! Closed generation-pinned native graph reads.
+
+use std::collections::{BTreeMap, BTreeSet, VecDeque};
+
+use compass_model::code_graph::{EdgeKind, EdgeRecord, NodeRecord};
+use compass_model::provenance::EvidenceConfidence;
+use compass_model::query_contract::{
+    CallRequest, CodeQueryLimits, CodeQueryOperation, CodeQueryResponse, ExploreRequest,
+    ImpactRequest, NodeTrailRequest, QueryDiagnostic, QueryDiagnosticCode, QueryEdge,
+    normalize_query_symbol, query_edge_from_record, query_node_from_record,
+    query_path_from_records,
+};
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+use sha2::{Digest, Sha256};
+
+use super::{
+    ActivePointer, GenerationManifest, SurrealProjection, database_error, manifest_key, plus_one,
+    pointer_key, select_record, validate_manifest_limits,
+};
+use crate::{
+    PROJECTION_SCHEMA_V1, ProjectedNode, ProjectedRelation, ProjectionError, RelationFamily,
+    relation_family,
+};
+
+pub const NATIVE_RELATION_PAGE_SCHEMA_V1: &str = "compass.surreal-relation-page/1";
+const CURSOR_SCHEMA_V1: &str = "compass.surreal-query-cursor/1";
+const CURSOR_OPERATION_RELATIONS: &str = "relations";
+const MAX_CODE_QUERY_CANDIDATES: u32 = 256;
+const MAX_CURSOR_BYTES: usize = 8 * 1024;
+
+const SELECT_NODE_BY_ID: &str = "SELECT * OMIT id FROM code_node WHERE repositoryId = $repository AND generationId = $generation AND compassNodeId = $symbol ORDER BY compassNodeId LIMIT 2";
+const SELECT_NODES_BY_EXACT_NAME: &str = "SELECT * OMIT id FROM code_node WHERE repositoryId = $repository AND generationId = $generation AND $symbol IN normalizedNames ORDER BY compassNodeId LIMIT $limit";
+
+#[derive(Clone, Copy)]
+struct FamilyStatements {
+    family: RelationFamily,
+    incoming: &'static str,
+    outgoing: &'static str,
+    page: &'static str,
+}
+
+const FAMILY_STATEMENTS: [FamilyStatements; 5] = [
+    FamilyStatements {
+        family: RelationFamily::Structural,
+        incoming: "SELECT * OMIT id, in, out FROM structural_relation WHERE repositoryId = $repository AND generationId = $generation AND targetNodeId = $node AND kind IN $kinds AND ($includeHeuristic OR heuristic = false) ORDER BY compassEdgeId LIMIT $limit",
+        outgoing: "SELECT * OMIT id, in, out FROM structural_relation WHERE repositoryId = $repository AND generationId = $generation AND sourceNodeId = $node AND kind IN $kinds AND ($includeHeuristic OR heuristic = false) ORDER BY compassEdgeId LIMIT $limit",
+        page: "SELECT * OMIT id, in, out FROM structural_relation WHERE repositoryId = $repository AND generationId = $generation AND compassEdgeId > $after AND ($includeHeuristic OR heuristic = false) ORDER BY compassEdgeId LIMIT $limit",
+    },
+    FamilyStatements {
+        family: RelationFamily::Dependency,
+        incoming: "SELECT * OMIT id, in, out FROM dependency_relation WHERE repositoryId = $repository AND generationId = $generation AND targetNodeId = $node AND kind IN $kinds AND ($includeHeuristic OR heuristic = false) ORDER BY compassEdgeId LIMIT $limit",
+        outgoing: "SELECT * OMIT id, in, out FROM dependency_relation WHERE repositoryId = $repository AND generationId = $generation AND sourceNodeId = $node AND kind IN $kinds AND ($includeHeuristic OR heuristic = false) ORDER BY compassEdgeId LIMIT $limit",
+        page: "SELECT * OMIT id, in, out FROM dependency_relation WHERE repositoryId = $repository AND generationId = $generation AND compassEdgeId > $after AND ($includeHeuristic OR heuristic = false) ORDER BY compassEdgeId LIMIT $limit",
+    },
+    FamilyStatements {
+        family: RelationFamily::Execution,
+        incoming: "SELECT * OMIT id, in, out FROM execution_relation WHERE repositoryId = $repository AND generationId = $generation AND targetNodeId = $node AND kind IN $kinds AND ($includeHeuristic OR heuristic = false) ORDER BY compassEdgeId LIMIT $limit",
+        outgoing: "SELECT * OMIT id, in, out FROM execution_relation WHERE repositoryId = $repository AND generationId = $generation AND sourceNodeId = $node AND kind IN $kinds AND ($includeHeuristic OR heuristic = false) ORDER BY compassEdgeId LIMIT $limit",
+        page: "SELECT * OMIT id, in, out FROM execution_relation WHERE repositoryId = $repository AND generationId = $generation AND compassEdgeId > $after AND ($includeHeuristic OR heuristic = false) ORDER BY compassEdgeId LIMIT $limit",
+    },
+    FamilyStatements {
+        family: RelationFamily::DataFlow,
+        incoming: "SELECT * OMIT id, in, out FROM data_flow_relation WHERE repositoryId = $repository AND generationId = $generation AND targetNodeId = $node AND kind IN $kinds AND ($includeHeuristic OR heuristic = false) ORDER BY compassEdgeId LIMIT $limit",
+        outgoing: "SELECT * OMIT id, in, out FROM data_flow_relation WHERE repositoryId = $repository AND generationId = $generation AND sourceNodeId = $node AND kind IN $kinds AND ($includeHeuristic OR heuristic = false) ORDER BY compassEdgeId LIMIT $limit",
+        page: "SELECT * OMIT id, in, out FROM data_flow_relation WHERE repositoryId = $repository AND generationId = $generation AND compassEdgeId > $after AND ($includeHeuristic OR heuristic = false) ORDER BY compassEdgeId LIMIT $limit",
+    },
+    FamilyStatements {
+        family: RelationFamily::Evidence,
+        incoming: "SELECT * OMIT id, in, out FROM evidence_relation WHERE repositoryId = $repository AND generationId = $generation AND targetNodeId = $node AND kind IN $kinds AND ($includeHeuristic OR heuristic = false) ORDER BY compassEdgeId LIMIT $limit",
+        outgoing: "SELECT * OMIT id, in, out FROM evidence_relation WHERE repositoryId = $repository AND generationId = $generation AND sourceNodeId = $node AND kind IN $kinds AND ($includeHeuristic OR heuristic = false) ORDER BY compassEdgeId LIMIT $limit",
+        page: "SELECT * OMIT id, in, out FROM evidence_relation WHERE repositoryId = $repository AND generationId = $generation AND compassEdgeId > $after AND ($includeHeuristic OR heuristic = false) ORDER BY compassEdgeId LIMIT $limit",
+    },
+];
+
+const ALL_EDGE_KINDS: &[EdgeKind] = &[
+    EdgeKind::Contains,
+    EdgeKind::Embeds,
+    EdgeKind::Calls,
+    EdgeKind::Imports,
+    EdgeKind::Exports,
+    EdgeKind::Extends,
+    EdgeKind::Implements,
+    EdgeKind::References,
+    EdgeKind::TypeOf,
+    EdgeKind::Returns,
+    EdgeKind::Instantiates,
+    EdgeKind::Overrides,
+    EdgeKind::Decorates,
+    EdgeKind::RoutesTo,
+    EdgeKind::Reads,
+    EdgeKind::Writes,
+    EdgeKind::Aliases,
+    EdgeKind::Registers,
+    EdgeKind::Handles,
+    EdgeKind::Publishes,
+    EdgeKind::Subscribes,
+    EdgeKind::Produces,
+    EdgeKind::Consumes,
+    EdgeKind::Schedules,
+    EdgeKind::Triggers,
+    EdgeKind::Tests,
+    EdgeKind::DependsOn,
+    EdgeKind::Documents,
+    EdgeKind::MapsTo,
+];
+
+const IMPACT_KINDS: &[EdgeKind] = &[
+    EdgeKind::Calls,
+    EdgeKind::RoutesTo,
+    EdgeKind::Imports,
+    EdgeKind::Exports,
+    EdgeKind::References,
+    EdgeKind::DependsOn,
+    EdgeKind::Reads,
+    EdgeKind::Writes,
+    EdgeKind::Publishes,
+    EdgeKind::Subscribes,
+    EdgeKind::Produces,
+    EdgeKind::Consumes,
+    EdgeKind::Schedules,
+    EdgeKind::Triggers,
+    EdgeKind::MapsTo,
+];
+
+#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct RelationPageRequest {
+    pub max_items: u32,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub cursor: Option<String>,
+    #[serde(default)]
+    pub include_heuristic: bool,
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct RelationPage {
+    pub schema: String,
+    pub repository_id: String,
+    pub generation_id: String,
+    pub relations: Vec<QueryEdge>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub next_cursor: Option<String>,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+struct QuerySelector {
+    repository_id: String,
+    pointer: ActivePointer,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct CursorPayload {
+    schema: String,
+    repository_digest: String,
+    generation_id: String,
+    operation: String,
+    last_identity: String,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct CursorEnvelope {
+    payload: CursorPayload,
+    checksum: String,
+}
+
+#[derive(Clone, Copy)]
+struct TraversalBudget {
+    remaining_nodes: usize,
+    remaining_edges: usize,
+}
+
+impl TraversalBudget {
+    fn new(limits: &CodeQueryLimits) -> Self {
+        Self {
+            remaining_nodes: usize::try_from(limits.max_nodes).unwrap_or(usize::MAX),
+            remaining_edges: usize::try_from(limits.max_edges).unwrap_or(usize::MAX),
+        }
+    }
+
+    fn consume_node(&mut self) -> bool {
+        if self.remaining_nodes == 0 {
+            false
+        } else {
+            self.remaining_nodes -= 1;
+            true
+        }
+    }
+
+    fn consume_edge(&mut self) -> bool {
+        if self.remaining_edges == 0 {
+            false
+        } else {
+            self.remaining_edges -= 1;
+            true
+        }
+    }
+}
+
+impl SurrealProjection {
+    pub async fn callers(
+        &self,
+        repository_id: &str,
+        request: CallRequest,
+    ) -> Result<CodeQueryResponse, ProjectionError> {
+        self.call_neighbors(repository_id, request, true).await
+    }
+
+    pub async fn callees(
+        &self,
+        repository_id: &str,
+        request: CallRequest,
+    ) -> Result<CodeQueryResponse, ProjectionError> {
+        self.call_neighbors(repository_id, request, false).await
+    }
+
+    async fn call_neighbors(
+        &self,
+        repository_id: &str,
+        request: CallRequest,
+        inbound: bool,
+    ) -> Result<CodeQueryResponse, ProjectionError> {
+        validate_query_limits(&request.limits)?;
+        let selector = self.pin_query_selector(repository_id).await?;
+        let operation = if inbound {
+            CodeQueryOperation::Callers
+        } else {
+            CodeQueryOperation::Callees
+        };
+        let mut response = CodeQueryResponse::empty(operation, request.limits.clone());
+        let Some(seed) = self
+            .resolve_symbol(&selector, &request.symbol, &mut response)
+            .await?
+        else {
+            return self.publish_response(&selector, response).await;
+        };
+        let kinds: &[EdgeKind] = if inbound {
+            &[EdgeKind::Calls, EdgeKind::RoutesTo]
+        } else {
+            &[EdgeKind::Calls]
+        };
+        let max_edges = usize::try_from(request.limits.max_edges).unwrap_or(usize::MAX);
+        let (edges, truncated) = self
+            .matching_relations(
+                &selector,
+                &seed,
+                inbound,
+                kinds,
+                request.include_heuristic,
+                max_edges,
+            )
+            .await?;
+        response.truncated |= truncated;
+        let mut node_ids = BTreeSet::from([seed]);
+        for edge in &edges {
+            node_ids.insert(edge.source.clone());
+            node_ids.insert(edge.target.clone());
+        }
+        response.edges = edges.iter().map(query_edge_from_record).collect();
+        response.nodes = self.load_query_nodes(&selector, &node_ids).await?;
+        self.publish_response(&selector, response).await
+    }
+
+    pub async fn impact(
+        &self,
+        repository_id: &str,
+        request: ImpactRequest,
+    ) -> Result<CodeQueryResponse, ProjectionError> {
+        validate_query_limits(&request.limits)?;
+        let selector = self.pin_query_selector(repository_id).await?;
+        let mut response =
+            CodeQueryResponse::empty(CodeQueryOperation::Impact, request.limits.clone());
+        let Some(seed) = self
+            .resolve_symbol(&selector, &request.symbol, &mut response)
+            .await?
+        else {
+            return self.publish_response(&selector, response).await;
+        };
+        let max_depth = usize::try_from(request.limits.max_depth).unwrap_or(usize::MAX);
+        let max_nodes = usize::try_from(request.limits.max_nodes).unwrap_or(usize::MAX);
+        let max_edges = usize::try_from(request.limits.max_edges).unwrap_or(usize::MAX);
+        let mut queue =
+            VecDeque::from([(seed.clone(), Vec::<String>::new(), Vec::<String>::new())]);
+        let mut visited = BTreeSet::from([seed.clone()]);
+        let mut selected = BTreeMap::<String, EdgeRecord>::new();
+        while let Some((node, path_nodes, path_edges)) = queue.pop_front() {
+            if path_edges.len() >= max_depth {
+                continue;
+            }
+            let remaining = max_edges.saturating_sub(selected.len());
+            if remaining == 0 {
+                response.truncated = true;
+                break;
+            }
+            let (incoming, truncated) = self
+                .matching_relations(
+                    &selector,
+                    &node,
+                    true,
+                    IMPACT_KINDS,
+                    request.include_heuristic,
+                    remaining,
+                )
+                .await?;
+            response.truncated |= truncated;
+            for edge in incoming {
+                if selected.len() >= max_edges {
+                    response.truncated = true;
+                    break;
+                }
+                let edge_id = edge.id.clone();
+                if visited.insert(edge.source.clone()) {
+                    if visited.len() > max_nodes {
+                        visited.remove(&edge.source);
+                        response.truncated = true;
+                        break;
+                    }
+                    let mut nodes = path_nodes.clone();
+                    if nodes.is_empty() {
+                        nodes.push(seed.clone());
+                    }
+                    nodes.push(edge.source.clone());
+                    let mut edges = path_edges.clone();
+                    edges.push(edge_id.clone());
+                    let mut path_records = edges
+                        .iter()
+                        .filter_map(|id| selected.get(id).cloned())
+                        .collect::<Vec<_>>();
+                    path_records.push(edge.clone());
+                    response
+                        .paths
+                        .push(query_path_from_records(&nodes, &edges, &path_records));
+                    queue.push_back((edge.source.clone(), nodes, edges));
+                }
+                selected.insert(edge_id, edge);
+            }
+            if response.truncated {
+                break;
+            }
+        }
+        response.nodes = self.load_query_nodes(&selector, &visited).await?;
+        response.edges = selected.values().map(query_edge_from_record).collect();
+        self.publish_response(&selector, response).await
+    }
+
+    pub async fn node_trail(
+        &self,
+        repository_id: &str,
+        request: NodeTrailRequest,
+    ) -> Result<CodeQueryResponse, ProjectionError> {
+        validate_query_limits(&request.limits)?;
+        let selector = self.pin_query_selector(repository_id).await?;
+        let mut response =
+            CodeQueryResponse::empty(CodeQueryOperation::NodeTrail, request.limits.clone());
+        let Some(source) = self
+            .resolve_symbol(&selector, &request.source, &mut response)
+            .await?
+        else {
+            return self.publish_response(&selector, response).await;
+        };
+        let Some(target) = self
+            .resolve_symbol(&selector, &request.target, &mut response)
+            .await?
+        else {
+            return self.publish_response(&selector, response).await;
+        };
+        let mut budget = TraversalBudget::new(&request.limits);
+        let (path, selected, truncated) = self
+            .shortest_path(
+                &selector,
+                &source,
+                &target,
+                request.include_heuristic,
+                &request.limits,
+                &mut budget,
+                true,
+            )
+            .await?;
+        response.truncated |= truncated;
+        if let Some((nodes, edges)) = path {
+            let node_ids = nodes.iter().cloned().collect::<BTreeSet<_>>();
+            response.nodes = self.load_query_nodes(&selector, &node_ids).await?;
+            response.edges = selected.values().map(query_edge_from_record).collect();
+            let path_records = edges
+                .iter()
+                .filter_map(|edge| selected.get(edge).cloned())
+                .collect::<Vec<_>>();
+            response
+                .paths
+                .push(query_path_from_records(&nodes, &edges, &path_records));
+        } else if !truncated {
+            let (undirected, _selected, mismatch_truncated) = self
+                .shortest_path(
+                    &selector,
+                    &source,
+                    &target,
+                    request.include_heuristic,
+                    &request.limits,
+                    &mut budget,
+                    false,
+                )
+                .await?;
+            response.truncated |= mismatch_truncated;
+            if undirected.is_some() {
+                response.diagnostics.push(QueryDiagnostic {
+                    code: QueryDiagnosticCode::DirectionMismatch,
+                    message: format!(
+                        "A trail connects {source} and {target}, but not in the requested source-to-target direction"
+                    ),
+                    node_id: Some(source),
+                    path: None,
+                });
+            } else if !mismatch_truncated {
+                response.diagnostics.push(QueryDiagnostic {
+                    code: QueryDiagnosticCode::NoMatch,
+                    message: format!("No bounded directed trail connects {source} to {target}"),
+                    node_id: Some(source),
+                    path: None,
+                });
+            }
+        }
+        self.publish_response(&selector, response).await
+    }
+
+    pub async fn structural_subgraph(
+        &self,
+        repository_id: &str,
+        request: ExploreRequest,
+    ) -> Result<CodeQueryResponse, ProjectionError> {
+        validate_query_limits(&request.limits)?;
+        if request.symbols.len()
+            > usize::try_from(request.limits.max_candidates).unwrap_or(usize::MAX)
+        {
+            return Err(ProjectionError::InvalidQuery(format!(
+                "subgraph requested {} symbols but maxCandidates is {}",
+                request.symbols.len(),
+                request.limits.max_candidates
+            )));
+        }
+        let selector = self.pin_query_selector(repository_id).await?;
+        let mut response =
+            CodeQueryResponse::empty(CodeQueryOperation::Explore, request.limits.clone());
+        let mut seeds = Vec::new();
+        for symbol in &request.symbols {
+            if let Some(seed) = self
+                .resolve_symbol(&selector, symbol, &mut response)
+                .await?
+            {
+                seeds.push(seed);
+            }
+        }
+        seeds.sort();
+        seeds.dedup();
+        let mut node_ids = seeds.iter().cloned().collect::<BTreeSet<_>>();
+        let mut selected = BTreeMap::<String, EdgeRecord>::new();
+        let mut budget = TraversalBudget::new(&request.limits);
+        for pair in seeds.windows(2) {
+            let [source, target] = pair else {
+                continue;
+            };
+            if budget.remaining_nodes == 0 || budget.remaining_edges == 0 {
+                response.truncated = true;
+                break;
+            }
+            let (path, path_edges, truncated) = self
+                .shortest_path(
+                    &selector,
+                    source,
+                    target,
+                    request.include_heuristic,
+                    &request.limits,
+                    &mut budget,
+                    false,
+                )
+                .await?;
+            response.truncated |= truncated;
+            if let Some((nodes, edges)) = path {
+                selected.extend(path_edges);
+                node_ids.extend(nodes.iter().cloned());
+                let records = edges
+                    .iter()
+                    .filter_map(|edge| selected.get(edge).cloned())
+                    .collect::<Vec<_>>();
+                response
+                    .paths
+                    .push(query_path_from_records(&nodes, &edges, &records));
+            }
+        }
+        response.nodes = self.load_query_nodes(&selector, &node_ids).await?;
+        response.edges = selected.values().map(query_edge_from_record).collect();
+        self.publish_response(&selector, response).await
+    }
+
+    pub async fn read_relation_page(
+        &self,
+        repository_id: &str,
+        request: RelationPageRequest,
+    ) -> Result<RelationPage, ProjectionError> {
+        if request.max_items == 0 {
+            return Err(ProjectionError::InvalidQuery(
+                "relation page maxItems must be greater than zero".to_owned(),
+            ));
+        }
+        let max_items = usize::try_from(request.max_items).unwrap_or(usize::MAX);
+        if max_items > self.limits.max_relations() {
+            return Err(ProjectionError::LimitExceeded {
+                resource: "relation page items",
+                actual: u64::from(request.max_items),
+                limit: u64::try_from(self.limits.max_relations()).unwrap_or(u64::MAX),
+            });
+        }
+        let selector = self.pin_query_selector(repository_id).await?;
+        let after = request
+            .cursor
+            .as_deref()
+            .map(|cursor| decode_cursor(cursor, &selector))
+            .transpose()?
+            .unwrap_or_default();
+        let (relations, truncated) = self
+            .page_relations(&selector, &after, request.include_heuristic, max_items)
+            .await?;
+        self.ensure_selector_current(&selector).await?;
+        let next_cursor = if truncated {
+            relations
+                .last()
+                .map(|relation| encode_cursor(&selector, &relation.id))
+                .transpose()?
+        } else {
+            None
+        };
+        Ok(RelationPage {
+            schema: NATIVE_RELATION_PAGE_SCHEMA_V1.to_owned(),
+            repository_id: selector.repository_id,
+            generation_id: selector.pointer.generation_id,
+            relations,
+            next_cursor,
+        })
+    }
+
+    async fn pin_query_selector(
+        &self,
+        repository_id: &str,
+    ) -> Result<QuerySelector, ProjectionError> {
+        if repository_id.trim().is_empty() {
+            return Err(ProjectionError::EmptyRepositoryId);
+        }
+        let pointer = select_record::<ActivePointer>(
+            &self.database,
+            surrealdb::types::RecordId::new("repository_pointer", pointer_key(repository_id)),
+            "pin_query_generation",
+        )
+        .await?
+        .ok_or_else(|| ProjectionError::ActiveGenerationUnavailable {
+            repository_id: repository_id.to_owned(),
+        })?;
+        if pointer.schema_version != PROJECTION_SCHEMA_V1 {
+            return Err(ProjectionError::UnsupportedProjectionSchema(
+                pointer.schema_version,
+            ));
+        }
+        let manifest = select_record::<GenerationManifest>(
+            &self.database,
+            surrealdb::types::RecordId::new(
+                "generation_manifest",
+                manifest_key(repository_id, &pointer.generation_id),
+            ),
+            "pin_query_manifest",
+        )
+        .await?
+        .ok_or_else(|| ProjectionError::ActiveGenerationUnavailable {
+            repository_id: repository_id.to_owned(),
+        })?;
+        if !manifest.complete
+            || manifest.schema_version != PROJECTION_SCHEMA_V1
+            || manifest.projection_fingerprint != pointer.projection_fingerprint
+        {
+            return Err(ProjectionError::ActiveGenerationUnavailable {
+                repository_id: repository_id.to_owned(),
+            });
+        }
+        validate_manifest_limits(&manifest, self.limits)?;
+        Ok(QuerySelector {
+            repository_id: repository_id.to_owned(),
+            pointer,
+        })
+    }
+
+    async fn ensure_selector_current(
+        &self,
+        selector: &QuerySelector,
+    ) -> Result<(), ProjectionError> {
+        let current = select_record::<ActivePointer>(
+            &self.database,
+            surrealdb::types::RecordId::new(
+                "repository_pointer",
+                pointer_key(&selector.repository_id),
+            ),
+            "revalidate_query_generation",
+        )
+        .await?;
+        if current.as_ref() != Some(&selector.pointer) {
+            return Err(ProjectionError::ActiveGenerationChanged {
+                repository_id: selector.repository_id.clone(),
+            });
+        }
+        Ok(())
+    }
+
+    async fn resolve_symbol(
+        &self,
+        selector: &QuerySelector,
+        symbol: &str,
+        response: &mut CodeQueryResponse,
+    ) -> Result<Option<String>, ProjectionError> {
+        let by_id = self
+            .query_nodes(selector, SELECT_NODE_BY_ID, symbol, 2, "query_node_by_id")
+            .await?;
+        if let [node] = by_id.as_slice() {
+            return Ok(Some(node.compass_node_id.clone()));
+        }
+        let candidate_limit = usize::try_from(response.limits.max_candidates).unwrap_or(usize::MAX);
+        let normalized = normalize_query_symbol(symbol);
+        let mut exact = self
+            .query_nodes(
+                selector,
+                SELECT_NODES_BY_EXACT_NAME,
+                &normalized,
+                plus_one(candidate_limit)?,
+                "query_nodes_by_name",
+            )
+            .await?;
+        let truncated = exact.len() > candidate_limit;
+        if truncated {
+            exact.truncate(candidate_limit);
+            response.truncated = true;
+        }
+        match exact.as_slice() {
+            [node] if !truncated => Ok(Some(node.compass_node_id.clone())),
+            [] => {
+                response.diagnostics.push(QueryDiagnostic {
+                    code: QueryDiagnosticCode::NoMatch,
+                    message: format!("No symbol matched {symbol:?}"),
+                    node_id: None,
+                    path: None,
+                });
+                Ok(None)
+            }
+            _ => {
+                response.diagnostics.push(QueryDiagnostic {
+                    code: QueryDiagnosticCode::AmbiguousMatch,
+                    message: if truncated {
+                        format!(
+                            "Symbol {symbol:?} exceeded the {}-candidate resolution bound",
+                            response.limits.max_candidates
+                        )
+                    } else {
+                        format!("Symbol {symbol:?} matched {} nodes", exact.len())
+                    },
+                    node_id: None,
+                    path: None,
+                });
+                Ok(None)
+            }
+        }
+    }
+
+    async fn query_nodes(
+        &self,
+        selector: &QuerySelector,
+        statement: &'static str,
+        symbol: &str,
+        limit: usize,
+        stage: &'static str,
+    ) -> Result<Vec<ProjectedNode>, ProjectionError> {
+        let mut response = self
+            .database
+            .query(statement)
+            .bind(("repository", selector.repository_id.as_str()))
+            .bind(("generation", selector.pointer.generation_id.as_str()))
+            .bind(("symbol", symbol))
+            .bind(("limit", limit))
+            .await
+            .map_err(|error| database_error(stage, error))?;
+        decode_values(&mut response, stage)
+    }
+
+    async fn load_query_nodes(
+        &self,
+        selector: &QuerySelector,
+        identities: &BTreeSet<String>,
+    ) -> Result<Vec<compass_model::query_contract::QueryNode>, ProjectionError> {
+        let mut nodes = Vec::with_capacity(identities.len());
+        for identity in identities {
+            let records = self
+                .query_nodes(selector, SELECT_NODE_BY_ID, identity, 2, "load_query_node")
+                .await?;
+            let [projected] = records.as_slice() else {
+                return Err(ProjectionError::InvalidQuery(format!(
+                    "active generation is missing node {identity}"
+                )));
+            };
+            let node: NodeRecord = projected.decode()?;
+            nodes.push(query_node_from_record(&node));
+        }
+        Ok(nodes)
+    }
+
+    async fn matching_relations(
+        &self,
+        selector: &QuerySelector,
+        node: &str,
+        inbound: bool,
+        kinds: &[EdgeKind],
+        include_heuristic: bool,
+        limit: usize,
+    ) -> Result<(Vec<EdgeRecord>, bool), ProjectionError> {
+        if limit == 0 {
+            return Ok((Vec::new(), true));
+        }
+        let requested_families = kinds
+            .iter()
+            .map(|kind| relation_family(*kind))
+            .collect::<BTreeSet<_>>();
+        let kind_names = kinds
+            .iter()
+            .map(|kind| kind.as_str().to_owned())
+            .collect::<Vec<_>>();
+        let mut projected = Vec::new();
+        for statements in FAMILY_STATEMENTS {
+            if !requested_families.contains(&statements.family) {
+                continue;
+            }
+            let statement = if inbound {
+                statements.incoming
+            } else {
+                statements.outgoing
+            };
+            let mut response = self
+                .database
+                .query(statement)
+                .bind(("repository", selector.repository_id.as_str()))
+                .bind(("generation", selector.pointer.generation_id.as_str()))
+                .bind(("node", node))
+                .bind(("kinds", kind_names.clone()))
+                .bind(("includeHeuristic", include_heuristic))
+                .bind(("limit", plus_one(limit)?))
+                .await
+                .map_err(|error| database_error("query_adjacency", error))?;
+            projected.extend(decode_values::<ProjectedRelation>(
+                &mut response,
+                "query_adjacency",
+            )?);
+        }
+        projected.sort_by(|left, right| left.compass_edge_id.cmp(&right.compass_edge_id));
+        let truncated = projected.len() > limit;
+        if truncated {
+            projected.truncate(limit);
+        }
+        projected
+            .into_iter()
+            .map(|relation| relation.decode())
+            .collect::<Result<Vec<_>, _>>()
+            .map(|relations| (relations, truncated))
+    }
+
+    async fn incident_relations(
+        &self,
+        selector: &QuerySelector,
+        node: &str,
+        include_heuristic: bool,
+        limit: usize,
+    ) -> Result<(Vec<EdgeRecord>, bool), ProjectionError> {
+        if limit == 0 {
+            return Ok((Vec::new(), true));
+        }
+        let (incoming, incoming_truncated) = self
+            .matching_relations(
+                selector,
+                node,
+                true,
+                ALL_EDGE_KINDS,
+                include_heuristic,
+                limit,
+            )
+            .await?;
+        let (outgoing, outgoing_truncated) = self
+            .matching_relations(
+                selector,
+                node,
+                false,
+                ALL_EDGE_KINDS,
+                include_heuristic,
+                limit,
+            )
+            .await?;
+        let mut merged = incoming
+            .into_iter()
+            .chain(outgoing)
+            .map(|edge| (edge.id.clone(), edge))
+            .collect::<BTreeMap<_, _>>()
+            .into_values()
+            .collect::<Vec<_>>();
+        let truncated = incoming_truncated || outgoing_truncated || merged.len() > limit;
+        if merged.len() > limit {
+            merged.truncate(limit);
+        }
+        Ok((merged, truncated))
+    }
+
+    async fn shortest_path(
+        &self,
+        selector: &QuerySelector,
+        source: &str,
+        target: &str,
+        include_heuristic: bool,
+        limits: &CodeQueryLimits,
+        budget: &mut TraversalBudget,
+        directed: bool,
+    ) -> Result<
+        (
+            Option<(Vec<String>, Vec<String>)>,
+            BTreeMap<String, EdgeRecord>,
+            bool,
+        ),
+        ProjectionError,
+    > {
+        if !budget.consume_node() {
+            return Ok((None, BTreeMap::new(), true));
+        }
+        let max_depth = usize::try_from(limits.max_depth).unwrap_or(usize::MAX);
+        let mut queue = VecDeque::from([(source.to_owned(), 0_usize)]);
+        let mut visited = BTreeSet::from([source.to_owned()]);
+        let mut predecessor = BTreeMap::<String, (String, String)>::new();
+        let mut selected = BTreeMap::<String, EdgeRecord>::new();
+        let mut truncated = false;
+        while let Some((node, depth)) = queue.pop_front() {
+            if node == target {
+                let mut nodes = vec![target.to_owned()];
+                let mut edges = Vec::new();
+                let mut cursor = target;
+                while cursor != source {
+                    let Some((previous, edge)) = predecessor.get(cursor) else {
+                        return Ok((None, selected, truncated));
+                    };
+                    edges.push(edge.clone());
+                    nodes.push(previous.clone());
+                    cursor = previous;
+                }
+                nodes.reverse();
+                edges.reverse();
+                selected.retain(|identity, _| edges.contains(identity));
+                return Ok((Some((nodes, edges)), selected, truncated));
+            }
+            if depth >= max_depth {
+                continue;
+            }
+            let (relations, relation_truncated) = if directed {
+                self.matching_relations(
+                    selector,
+                    &node,
+                    false,
+                    ALL_EDGE_KINDS,
+                    include_heuristic,
+                    budget.remaining_edges,
+                )
+                .await?
+            } else {
+                self.incident_relations(selector, &node, include_heuristic, budget.remaining_edges)
+                    .await?
+            };
+            truncated |= relation_truncated;
+            let mut adjacent = Vec::new();
+            for edge in relations {
+                if !budget.consume_edge() {
+                    truncated = true;
+                    break;
+                }
+                let next = if edge.source == node {
+                    Some(edge.target.clone())
+                } else if !directed && edge.target == node {
+                    Some(edge.source.clone())
+                } else {
+                    None
+                };
+                if let Some(next) = next {
+                    adjacent.push((next, edge));
+                }
+            }
+            adjacent.sort_by(|left, right| {
+                evidence_quality(&right.1)
+                    .cmp(&evidence_quality(&left.1))
+                    .then_with(|| left.1.id.cmp(&right.1.id))
+            });
+            for (next, edge) in adjacent {
+                if visited.contains(&next) {
+                    continue;
+                }
+                if !budget.consume_node() {
+                    truncated = true;
+                    continue;
+                }
+                visited.insert(next.clone());
+                predecessor.insert(next.clone(), (node.clone(), edge.id.clone()));
+                selected.insert(edge.id.clone(), edge);
+                queue.push_back((next, depth + 1));
+            }
+        }
+        Ok((None, selected, truncated))
+    }
+
+    async fn page_relations(
+        &self,
+        selector: &QuerySelector,
+        after: &str,
+        include_heuristic: bool,
+        limit: usize,
+    ) -> Result<(Vec<QueryEdge>, bool), ProjectionError> {
+        let mut projected = Vec::new();
+        for statements in FAMILY_STATEMENTS {
+            let mut response = self
+                .database
+                .query(statements.page)
+                .bind(("repository", selector.repository_id.as_str()))
+                .bind(("generation", selector.pointer.generation_id.as_str()))
+                .bind(("after", after))
+                .bind(("includeHeuristic", include_heuristic))
+                .bind(("limit", plus_one(limit)?))
+                .await
+                .map_err(|error| database_error("page_relations", error))?;
+            projected.extend(decode_values::<ProjectedRelation>(
+                &mut response,
+                "page_relations",
+            )?);
+        }
+        projected.sort_by(|left, right| left.compass_edge_id.cmp(&right.compass_edge_id));
+        let truncated = projected.len() > limit;
+        if truncated {
+            projected.truncate(limit);
+        }
+        projected
+            .into_iter()
+            .map(|relation| relation.decode().map(|edge| query_edge_from_record(&edge)))
+            .collect::<Result<Vec<_>, _>>()
+            .map(|relations| (relations, truncated))
+    }
+
+    async fn publish_response(
+        &self,
+        selector: &QuerySelector,
+        mut response: CodeQueryResponse,
+    ) -> Result<CodeQueryResponse, ProjectionError> {
+        apply_response_bounds(&mut response);
+        if response.truncated {
+            response.diagnostics.push(QueryDiagnostic {
+                code: QueryDiagnosticCode::BoundedTruncation,
+                message: "One or more query bounds truncated the response".to_owned(),
+                node_id: None,
+                path: None,
+            });
+        }
+        response.sort_stable();
+        let response_bytes = u64::try_from(serde_json::to_vec(&response)?.len()).map_err(|_| {
+            ProjectionError::LimitExceeded {
+                resource: "query response bytes",
+                actual: u64::MAX,
+                limit: response.limits.max_response_bytes,
+            }
+        })?;
+        if response_bytes > response.limits.max_response_bytes {
+            return Err(ProjectionError::LimitExceeded {
+                resource: "query response bytes",
+                actual: response_bytes,
+                limit: response.limits.max_response_bytes,
+            });
+        }
+        self.ensure_selector_current(selector).await?;
+        Ok(response)
+    }
+}
+
+fn validate_query_limits(limits: &CodeQueryLimits) -> Result<(), ProjectionError> {
+    if !limits.is_valid() {
+        return Err(ProjectionError::InvalidQuery(
+            "every native query limit must be greater than zero".to_owned(),
+        ));
+    }
+    if limits.max_candidates > MAX_CODE_QUERY_CANDIDATES {
+        return Err(ProjectionError::LimitExceeded {
+            resource: "query candidates",
+            actual: u64::from(limits.max_candidates),
+            limit: u64::from(MAX_CODE_QUERY_CANDIDATES),
+        });
+    }
+    Ok(())
+}
+
+fn apply_response_bounds(response: &mut CodeQueryResponse) {
+    response.sort_stable();
+    let max_nodes = usize::try_from(response.limits.max_nodes).unwrap_or(usize::MAX);
+    if response.nodes.len() > max_nodes {
+        response.nodes.truncate(max_nodes);
+        response.truncated = true;
+    }
+    let node_ids = response
+        .nodes
+        .iter()
+        .map(|node| node.id.as_str())
+        .collect::<BTreeSet<_>>();
+    let max_edges = usize::try_from(response.limits.max_edges).unwrap_or(usize::MAX);
+    let edge_count = response.edges.len();
+    response.edges.retain(|edge| {
+        node_ids.contains(edge.source.as_str()) && node_ids.contains(edge.target.as_str())
+    });
+    if response.edges.len() != edge_count {
+        response.truncated = true;
+    }
+    if response.edges.len() > max_edges {
+        response.edges.truncate(max_edges);
+        response.truncated = true;
+    }
+    let edge_ids = response
+        .edges
+        .iter()
+        .map(|edge| edge.id.as_str())
+        .collect::<BTreeSet<_>>();
+    let path_count = response.paths.len();
+    response.paths.retain(|path| {
+        path.node_ids
+            .iter()
+            .all(|node| node_ids.contains(node.as_str()))
+            && path
+                .edge_ids
+                .iter()
+                .all(|edge| edge_ids.contains(edge.as_str()))
+    });
+    if response.paths.len() != path_count {
+        response.truncated = true;
+    }
+    let max_paths = usize::try_from(response.limits.max_paths).unwrap_or(usize::MAX);
+    if response.paths.len() > max_paths {
+        response.paths.truncate(max_paths);
+        response.truncated = true;
+    }
+}
+
+fn evidence_quality(edge: &EdgeRecord) -> u8 {
+    edge.evidence
+        .iter()
+        .map(|evidence| match evidence.confidence {
+            EvidenceConfidence::Exact => 3,
+            EvidenceConfidence::Inferred => 2,
+            EvidenceConfidence::Ambiguous => 1,
+        })
+        .max()
+        .unwrap_or(0)
+}
+
+fn encode_cursor(selector: &QuerySelector, last_identity: &str) -> Result<String, ProjectionError> {
+    let payload = CursorPayload {
+        schema: CURSOR_SCHEMA_V1.to_owned(),
+        repository_digest: repository_digest(&selector.repository_id),
+        generation_id: selector.pointer.generation_id.clone(),
+        operation: CURSOR_OPERATION_RELATIONS.to_owned(),
+        last_identity: last_identity.to_owned(),
+    };
+    let checksum = digest_bytes(&serde_json::to_vec(&payload)?);
+    let encoded = serde_json::to_vec(&CursorEnvelope { payload, checksum })?;
+    Ok(hex_encode(&encoded))
+}
+
+fn decode_cursor(cursor: &str, selector: &QuerySelector) -> Result<String, ProjectionError> {
+    if cursor.len() > MAX_CURSOR_BYTES.saturating_mul(2) {
+        return Err(ProjectionError::InvalidCursor(
+            "cursor exceeds the encoded byte limit".to_owned(),
+        ));
+    }
+    let decoded = hex_decode(cursor)?;
+    let envelope = serde_json::from_slice::<CursorEnvelope>(&decoded)
+        .map_err(|error| ProjectionError::InvalidCursor(error.to_string()))?;
+    let expected_checksum = digest_bytes(&serde_json::to_vec(&envelope.payload)?);
+    if envelope.checksum != expected_checksum
+        || envelope.payload.schema != CURSOR_SCHEMA_V1
+        || envelope.payload.repository_digest != repository_digest(&selector.repository_id)
+        || envelope.payload.generation_id != selector.pointer.generation_id
+        || envelope.payload.operation != CURSOR_OPERATION_RELATIONS
+        || envelope.payload.last_identity.is_empty()
+    {
+        return Err(ProjectionError::InvalidCursor(
+            "cursor does not match the selected repository, generation, or operation".to_owned(),
+        ));
+    }
+    Ok(envelope.payload.last_identity)
+}
+
+fn repository_digest(repository_id: &str) -> String {
+    digest_bytes(repository_id.as_bytes())
+}
+
+fn digest_bytes(bytes: &[u8]) -> String {
+    let mut digest = Sha256::new();
+    digest.update(bytes);
+    format!("sha256:{}", hex_encode(&digest.finalize()))
+}
+
+fn hex_encode(bytes: &[u8]) -> String {
+    const HEX: &[u8; 16] = b"0123456789abcdef";
+    let mut encoded = String::with_capacity(bytes.len().saturating_mul(2));
+    for byte in bytes {
+        encoded.push(char::from(HEX[usize::from(byte >> 4)]));
+        encoded.push(char::from(HEX[usize::from(byte & 0x0f)]));
+    }
+    encoded
+}
+
+fn hex_decode(value: &str) -> Result<Vec<u8>, ProjectionError> {
+    if !value.len().is_multiple_of(2) {
+        return Err(ProjectionError::InvalidCursor(
+            "cursor hexadecimal length is invalid".to_owned(),
+        ));
+    }
+    value
+        .as_bytes()
+        .chunks_exact(2)
+        .map(|pair| {
+            let high = hex_nibble(pair[0])?;
+            let low = hex_nibble(pair[1])?;
+            Ok((high << 4) | low)
+        })
+        .collect()
+}
+
+fn hex_nibble(value: u8) -> Result<u8, ProjectionError> {
+    match value {
+        b'0'..=b'9' => Ok(value - b'0'),
+        b'a'..=b'f' => Ok(value - b'a' + 10),
+        b'A'..=b'F' => Ok(value - b'A' + 10),
+        _ => Err(ProjectionError::InvalidCursor(
+            "cursor contains a non-hexadecimal character".to_owned(),
+        )),
+    }
+}
+
+fn decode_values<T>(
+    response: &mut surrealdb::IndexedResults,
+    stage: &'static str,
+) -> Result<Vec<T>, ProjectionError>
+where
+    T: for<'de> Deserialize<'de>,
+{
+    let values: Vec<Value> = response
+        .take(0)
+        .map_err(|error| database_error(stage, error))?;
+    values
+        .into_iter()
+        .map(serde_json::from_value)
+        .collect::<Result<_, _>>()
+        .map_err(Into::into)
+}
diff --git a/crates/compass-graphdb-surreal/src/lib.rs b/crates/compass-graphdb-surreal/src/lib.rs
new file mode 100644
index 000000000..5a6801185
--- /dev/null
+++ b/crates/compass-graphdb-surreal/src/lib.rs
@@ -0,0 +1,28 @@
+#![forbid(unsafe_code)]
+
+//! Optional generation-atomic SurrealDB graph projection for Compass.
+//!
+//! Projection planning is available without an engine feature. The SurrealDB
+//! SDK is compiled only when `mem`, `surrealkv`, or `rocksdb` is selected.
+
+mod projection;
+
+pub use projection::{
+    ProjectedNode, ProjectedRelation, ProjectionError, ProjectionLimits, ProjectionPlan,
+    RelationFamily, relation_family,
+};
+
+#[cfg(any(feature = "mem", feature = "surrealkv", feature = "rocksdb"))]
+mod engine;
+
+#[cfg(any(feature = "mem", feature = "surrealkv", feature = "rocksdb"))]
+pub use engine::{
+    ActivationOutcome, InterruptAfter, NATIVE_RELATION_PAGE_SCHEMA_V1, RelationPage,
+    RelationPageRequest, SurrealProjection,
+};
+
+/// Version of the Compass-to-Surreal projection schema.
+pub const PROJECTION_SCHEMA_V1: &str = "compass.graph.surreal/1";
+
+/// Exact reviewed SurrealDB release selected by every engine feature.
+pub const SURREALDB_VERSION: &str = "3.2.4";
diff --git a/crates/compass-graphdb-surreal/src/projection.rs b/crates/compass-graphdb-surreal/src/projection.rs
new file mode 100644
index 000000000..221ad3714
--- /dev/null
+++ b/crates/compass-graphdb-surreal/src/projection.rs
@@ -0,0 +1,534 @@
+use std::collections::BTreeSet;
+
+use compass_model::code_graph::{EdgeKind, EdgeRecord, GraphDocument, NodeRecord};
+use compass_model::provenance::effective_confidence;
+use compass_model::validate_code_graph;
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+
+use crate::PROJECTION_SCHEMA_V1;
+
+/// Finite work limits applied before activation and before materializing reads.
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct ProjectionLimits {
+    max_nodes: usize,
+    max_relations: usize,
+    max_projected_bytes: u64,
+}
+
+impl ProjectionLimits {
+    pub fn new(
+        max_nodes: usize,
+        max_relations: usize,
+        max_projected_bytes: u64,
+    ) -> Result<Self, ProjectionError> {
+        if max_nodes == 0 || max_relations == 0 || max_projected_bytes == 0 {
+            return Err(ProjectionError::InvalidPlan(
+                "projection limits must all be greater than zero".to_owned(),
+            ));
+        }
+        Ok(Self {
+            max_nodes,
+            max_relations,
+            max_projected_bytes,
+        })
+    }
+
+    #[must_use]
+    pub const fn max_nodes(self) -> usize {
+        self.max_nodes
+    }
+
+    #[must_use]
+    pub const fn max_relations(self) -> usize {
+        self.max_relations
+    }
+
+    #[must_use]
+    pub const fn max_projected_bytes(self) -> u64 {
+        self.max_projected_bytes
+    }
+
+    #[cfg(any(feature = "mem", feature = "surrealkv", feature = "rocksdb"))]
+    pub(crate) fn validate_plan(self, plan: &ProjectionPlan) -> Result<u64, ProjectionError> {
+        enforce_limit("nodes", plan.nodes.len(), self.max_nodes)?;
+        enforce_limit("relations", plan.relations.len(), self.max_relations)?;
+        let projected_bytes = plan.projected_bytes()?;
+        if projected_bytes > self.max_projected_bytes {
+            return Err(ProjectionError::LimitExceeded {
+                resource: "projected bytes",
+                actual: projected_bytes,
+                limit: self.max_projected_bytes,
+            });
+        }
+        Ok(projected_bytes)
+    }
+}
+
+impl Default for ProjectionLimits {
+    fn default() -> Self {
+        Self {
+            max_nodes: 1_000_000,
+            max_relations: 2_500_000,
+            max_projected_bytes: compass_model::DEFAULT_GRAPH_SIZE_CAP_BYTES,
+        }
+    }
+}
+
+/// A closed set of schemafull relation tables.
+#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum RelationFamily {
+    Structural,
+    Dependency,
+    Execution,
+    DataFlow,
+    Evidence,
+}
+
+impl RelationFamily {
+    pub const ALL: [Self; 5] = [
+        Self::Structural,
+        Self::Dependency,
+        Self::Execution,
+        Self::DataFlow,
+        Self::Evidence,
+    ];
+
+    #[must_use]
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::Structural => "structural_relation",
+            Self::Dependency => "dependency_relation",
+            Self::Execution => "execution_relation",
+            Self::DataFlow => "data_flow_relation",
+            Self::Evidence => "evidence_relation",
+        }
+    }
+}
+
+/// Map every closed Compass edge kind to exactly one relation family.
+#[must_use]
+pub const fn relation_family(kind: EdgeKind) -> RelationFamily {
+    match kind {
+        EdgeKind::Contains
+        | EdgeKind::Embeds
+        | EdgeKind::Extends
+        | EdgeKind::Implements
+        | EdgeKind::TypeOf
+        | EdgeKind::Overrides
+        | EdgeKind::Decorates
+        | EdgeKind::Aliases => RelationFamily::Structural,
+        EdgeKind::Imports | EdgeKind::Exports | EdgeKind::References | EdgeKind::DependsOn => {
+            RelationFamily::Dependency
+        }
+        EdgeKind::Calls
+        | EdgeKind::Instantiates
+        | EdgeKind::RoutesTo
+        | EdgeKind::Registers
+        | EdgeKind::Handles
+        | EdgeKind::Schedules
+        | EdgeKind::Triggers
+        | EdgeKind::Tests => RelationFamily::Execution,
+        EdgeKind::Returns
+        | EdgeKind::Reads
+        | EdgeKind::Writes
+        | EdgeKind::Publishes
+        | EdgeKind::Subscribes
+        | EdgeKind::Produces
+        | EdgeKind::Consumes
+        | EdgeKind::MapsTo => RelationFamily::DataFlow,
+        EdgeKind::Documents => RelationFamily::Evidence,
+    }
+}
+
+#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct ProjectedNode {
+    pub record_key: String,
+    pub repository_id: String,
+    pub generation_id: String,
+    pub schema_version: String,
+    pub compass_node_id: String,
+    pub kind: String,
+    pub name: String,
+    pub qualified_name: String,
+    pub normalized_names: Vec<String>,
+    pub language: Option<String>,
+    pub source_path: Option<String>,
+    pub confidence: String,
+    pub heuristic: bool,
+    pub payload_json: String,
+}
+
+impl ProjectedNode {
+    pub fn decode(&self) -> Result<NodeRecord, ProjectionError> {
+        Ok(serde_json::from_str(&self.payload_json)?)
+    }
+}
+
+#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct ProjectedRelation {
+    pub record_key: String,
+    pub repository_id: String,
+    pub generation_id: String,
+    pub schema_version: String,
+    pub compass_edge_id: String,
+    pub family: RelationFamily,
+    pub kind: String,
+    pub source_node_id: String,
+    pub target_node_id: String,
+    pub source_record_key: String,
+    pub target_record_key: String,
+    pub source_path: Option<String>,
+    pub confidence: String,
+    pub heuristic: bool,
+    pub payload_json: String,
+}
+
+impl ProjectedRelation {
+    pub fn decode(&self) -> Result<EdgeRecord, ProjectionError> {
+        Ok(serde_json::from_str(&self.payload_json)?)
+    }
+}
+
+/// Deterministic database-independent plan for one immutable generation.
+#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct ProjectionPlan {
+    pub repository_id: String,
+    pub generation_id: String,
+    pub schema_version: String,
+    pub source_tree_digest: String,
+    pub schema_fingerprint: String,
+    pub projection_fingerprint: String,
+    pub nodes: Vec<ProjectedNode>,
+    pub relations: Vec<ProjectedRelation>,
+}
+
+impl ProjectionPlan {
+    pub fn from_graph(
+        repository_id: impl Into<String>,
+        graph: &GraphDocument,
+    ) -> Result<Self, ProjectionError> {
+        let repository_id = repository_id.into();
+        if repository_id.trim().is_empty() {
+            return Err(ProjectionError::EmptyRepositoryId);
+        }
+        validate_code_graph(graph)?;
+        let generation_id = graph.graph.build.generation_id.clone();
+        let mut nodes = graph
+            .nodes
+            .iter()
+            .map(|node| project_node(&repository_id, &generation_id, node))
+            .collect::<Result<Vec<_>, _>>()?;
+        nodes.sort_by(|left, right| left.compass_node_id.cmp(&right.compass_node_id));
+        let node_ids = nodes
+            .iter()
+            .map(|node| node.compass_node_id.as_str())
+            .collect::<BTreeSet<_>>();
+        let mut relations = graph
+            .links
+            .iter()
+            .map(|edge| {
+                for endpoint in [&edge.source, &edge.target] {
+                    if !node_ids.contains(endpoint.as_str()) {
+                        return Err(ProjectionError::MissingEndpoint {
+                            edge_id: edge.id.clone(),
+                            endpoint: endpoint.clone(),
+                        });
+                    }
+                }
+                project_relation(&repository_id, &generation_id, edge)
+            })
+            .collect::<Result<Vec<_>, _>>()?;
+        relations.sort_by(|left, right| left.compass_edge_id.cmp(&right.compass_edge_id));
+        let projection_fingerprint =
+            fingerprint(&repository_id, &generation_id, &nodes, &relations);
+        let plan = Self {
+            repository_id,
+            generation_id,
+            schema_version: PROJECTION_SCHEMA_V1.to_owned(),
+            source_tree_digest: graph.graph.build.source_tree_digest.clone(),
+            schema_fingerprint: graph.graph.build.schema_fingerprint.clone(),
+            projection_fingerprint,
+            nodes,
+            relations,
+        };
+        plan.validate()?;
+        Ok(plan)
+    }
+
+    pub fn validate(&self) -> Result<(), ProjectionError> {
+        if self.schema_version != PROJECTION_SCHEMA_V1 {
+            return Err(ProjectionError::UnsupportedProjectionSchema(
+                self.schema_version.clone(),
+            ));
+        }
+        if self.repository_id.trim().is_empty() {
+            return Err(ProjectionError::EmptyRepositoryId);
+        }
+        if self.generation_id.trim().is_empty() {
+            return Err(ProjectionError::EmptyGenerationId);
+        }
+        ensure_strict_order(
+            self.nodes.iter().map(|node| node.compass_node_id.as_str()),
+            "node",
+        )?;
+        ensure_strict_order(
+            self.relations
+                .iter()
+                .map(|relation| relation.compass_edge_id.as_str()),
+            "relation",
+        )?;
+        let node_ids = self
+            .nodes
+            .iter()
+            .map(|node| node.compass_node_id.as_str())
+            .collect::<BTreeSet<_>>();
+        for relation in &self.relations {
+            for endpoint in [&relation.source_node_id, &relation.target_node_id] {
+                if !node_ids.contains(endpoint.as_str()) {
+                    return Err(ProjectionError::MissingEndpoint {
+                        edge_id: relation.compass_edge_id.clone(),
+                        endpoint: endpoint.clone(),
+                    });
+                }
+            }
+        }
+        if fingerprint(
+            &self.repository_id,
+            &self.generation_id,
+            &self.nodes,
+            &self.relations,
+        ) != self.projection_fingerprint
+        {
+            return Err(ProjectionError::FingerprintMismatch);
+        }
+        Ok(())
+    }
+
+    #[cfg(any(feature = "mem", feature = "surrealkv", feature = "rocksdb"))]
+    pub(crate) fn projected_bytes(&self) -> Result<u64, ProjectionError> {
+        self.nodes
+            .iter()
+            .map(serialized_len)
+            .chain(self.relations.iter().map(serialized_len))
+            .try_fold(0_u64, |total, length| {
+                total
+                    .checked_add(length?)
+                    .ok_or(ProjectionError::LimitExceeded {
+                        resource: "projected bytes",
+                        actual: u64::MAX,
+                        limit: u64::MAX - 1,
+                    })
+            })
+    }
+}
+
+#[derive(Debug, thiserror::Error)]
+pub enum ProjectionError {
+    #[error("repository identity must not be empty")]
+    EmptyRepositoryId,
+    #[error("generation identity must not be empty")]
+    EmptyGenerationId,
+    #[error("unsupported projection schema {0}")]
+    UnsupportedProjectionSchema(String),
+    #[error("canonical graph validation failed: {0}")]
+    GraphValidation(#[from] compass_model::CodeGraphValidationError),
+    #[error("projection serialization failed: {0}")]
+    Serialization(#[from] serde_json::Error),
+    #[error("edge {edge_id} references missing endpoint {endpoint}")]
+    MissingEndpoint { edge_id: String, endpoint: String },
+    #[error("projection {record_class} identities are not strictly ordered and unique")]
+    NonDeterministicOrder { record_class: &'static str },
+    #[error("projection fingerprint does not match its records")]
+    FingerprintMismatch,
+    #[error("projection {resource} limit exceeded: actual {actual}, limit {limit}")]
+    LimitExceeded {
+        resource: &'static str,
+        actual: u64,
+        limit: u64,
+    },
+    #[error("invalid projection plan: {0}")]
+    InvalidPlan(String),
+    #[cfg(any(feature = "mem", feature = "surrealkv", feature = "rocksdb"))]
+    #[error("SurrealDB {stage} failed: {message}")]
+    Database {
+        stage: &'static str,
+        message: String,
+    },
+    #[cfg(any(feature = "mem", feature = "surrealkv", feature = "rocksdb"))]
+    #[error("projection staging failed ({cause}); transaction cancellation also failed: {message}")]
+    Cancellation {
+        cause: Box<ProjectionError>,
+        message: String,
+    },
+    #[cfg(any(feature = "mem", feature = "surrealkv", feature = "rocksdb"))]
+    #[error("projection was interrupted after {completed_mutations} mutations")]
+    Interrupted { completed_mutations: usize },
+    #[cfg(any(feature = "mem", feature = "surrealkv", feature = "rocksdb"))]
+    #[error("repository {repository_id:?} has no complete active Surreal generation")]
+    ActiveGenerationUnavailable { repository_id: String },
+    #[cfg(any(feature = "mem", feature = "surrealkv", feature = "rocksdb"))]
+    #[error("repository {repository_id:?} changed active generation during the query")]
+    ActiveGenerationChanged { repository_id: String },
+    #[cfg(any(feature = "mem", feature = "surrealkv", feature = "rocksdb"))]
+    #[error("invalid native-query cursor: {0}")]
+    InvalidCursor(String),
+    #[cfg(any(feature = "mem", feature = "surrealkv", feature = "rocksdb"))]
+    #[error("invalid native query: {0}")]
+    InvalidQuery(String),
+}
+
+#[cfg(any(feature = "mem", feature = "surrealkv", feature = "rocksdb"))]
+fn serialized_len<T: Serialize>(value: &T) -> Result<u64, ProjectionError> {
+    u64::try_from(serde_json::to_vec(value)?.len()).map_err(|_| ProjectionError::LimitExceeded {
+        resource: "projected bytes",
+        actual: u64::MAX,
+        limit: u64::MAX - 1,
+    })
+}
+
+#[cfg(any(feature = "mem", feature = "surrealkv", feature = "rocksdb"))]
+fn enforce_limit(
+    resource: &'static str,
+    actual: usize,
+    limit: usize,
+) -> Result<(), ProjectionError> {
+    if actual > limit {
+        return Err(ProjectionError::LimitExceeded {
+            resource,
+            actual: u64::try_from(actual).unwrap_or(u64::MAX),
+            limit: u64::try_from(limit).unwrap_or(u64::MAX),
+        });
+    }
+    Ok(())
+}
+
+fn project_node(
+    repository_id: &str,
+    generation_id: &str,
+    node: &NodeRecord,
+) -> Result<ProjectedNode, ProjectionError> {
+    let mut normalized_names = [&node.name, &node.qualified_name]
+        .into_iter()
+        .map(|name| compass_model::query_contract::normalize_query_symbol(name))
+        .collect::<Vec<_>>();
+    normalized_names.sort();
+    normalized_names.dedup();
+    Ok(ProjectedNode {
+        record_key: record_key("node", &[repository_id, generation_id, &node.id]),
+        repository_id: repository_id.to_owned(),
+        generation_id: generation_id.to_owned(),
+        schema_version: PROJECTION_SCHEMA_V1.to_owned(),
+        compass_node_id: node.id.clone(),
+        kind: node.kind.as_str().to_owned(),
+        name: node.name.clone(),
+        qualified_name: node.qualified_name.clone(),
+        normalized_names,
+        language: node.language.clone(),
+        source_path: node.source.as_ref().map(|source| source.file.clone()),
+        confidence: confidence(&node.evidence),
+        heuristic: node.evidence.iter().any(|evidence| {
+            evidence.origin == compass_model::provenance::EvidenceOrigin::Heuristic
+        }),
+        payload_json: serde_json::to_string(node)?,
+    })
+}
+
+fn project_relation(
+    repository_id: &str,
+    generation_id: &str,
+    edge: &EdgeRecord,
+) -> Result<ProjectedRelation, ProjectionError> {
+    Ok(ProjectedRelation {
+        record_key: record_key("edge", &[repository_id, generation_id, &edge.id]),
+        repository_id: repository_id.to_owned(),
+        generation_id: generation_id.to_owned(),
+        schema_version: PROJECTION_SCHEMA_V1.to_owned(),
+        compass_edge_id: edge.id.clone(),
+        family: relation_family(edge.kind),
+        kind: edge.kind.as_str().to_owned(),
+        source_node_id: edge.source.clone(),
+        target_node_id: edge.target.clone(),
+        source_record_key: record_key("node", &[repository_id, generation_id, &edge.source]),
+        target_record_key: record_key("node", &[repository_id, generation_id, &edge.target]),
+        source_path: edge
+            .relationship_site
+            .as_ref()
+            .map(|source| source.file.clone()),
+        confidence: confidence(&edge.evidence),
+        heuristic: edge.evidence.iter().any(|evidence| {
+            evidence.origin == compass_model::provenance::EvidenceOrigin::Heuristic
+        }),
+        payload_json: serde_json::to_string(edge)?,
+    })
+}
+
+fn confidence(evidence: &[compass_model::provenance::Provenance]) -> String {
+    effective_confidence(evidence)
+        .map_or("unknown", |value| value.as_str())
+        .to_owned()
+}
+
+pub(crate) fn record_key(class: &str, parts: &[&str]) -> String {
+    let mut hasher = Sha256::new();
+    write_part(&mut hasher, PROJECTION_SCHEMA_V1.as_bytes());
+    write_part(&mut hasher, class.as_bytes());
+    for part in parts {
+        write_part(&mut hasher, part.as_bytes());
+    }
+    hex_digest(hasher.finalize())
+}
+
+fn fingerprint(
+    repository_id: &str,
+    generation_id: &str,
+    nodes: &[ProjectedNode],
+    relations: &[ProjectedRelation],
+) -> String {
+    let mut hasher = Sha256::new();
+    for value in [PROJECTION_SCHEMA_V1, repository_id, generation_id] {
+        write_part(&mut hasher, value.as_bytes());
+    }
+    for node in nodes {
+        write_part(&mut hasher, node.record_key.as_bytes());
+        write_part(&mut hasher, node.payload_json.as_bytes());
+    }
+    for relation in relations {
+        write_part(&mut hasher, relation.family.as_str().as_bytes());
+        write_part(&mut hasher, relation.record_key.as_bytes());
+        write_part(&mut hasher, relation.payload_json.as_bytes());
+    }
+    format!("sha256:{}", hex_digest(hasher.finalize()))
+}
+
+fn write_part(hasher: &mut Sha256, value: &[u8]) {
+    hasher.update(u64::try_from(value.len()).unwrap_or(u64::MAX).to_be_bytes());
+    hasher.update(value);
+}
+
+fn hex_digest(digest: impl AsRef<[u8]>) -> String {
+    let mut encoded = String::with_capacity(digest.as_ref().len() * 2);
+    for byte in digest.as_ref() {
+        use std::fmt::Write as _;
+        let _ = write!(encoded, "{byte:02x}");
+    }
+    encoded
+}
+
+fn ensure_strict_order<'a>(
+    values: impl Iterator<Item = &'a str>,
+    record_class: &'static str,
+) -> Result<(), ProjectionError> {
+    let mut previous = None;
+    for value in values {
+        if previous.is_some_and(|previous| previous >= value) {
+            return Err(ProjectionError::NonDeterministicOrder { record_class });
+        }
+        previous = Some(value);
+    }
+    Ok(())
+}
diff --git a/crates/compass-graphdb-surreal/tests/mem_projection.rs b/crates/compass-graphdb-surreal/tests/mem_projection.rs
new file mode 100644
index 000000000..1256c31fe
--- /dev/null
+++ b/crates/compass-graphdb-surreal/tests/mem_projection.rs
@@ -0,0 +1,214 @@
+#![cfg(feature = "mem")]
+
+use compass_graphdb_surreal::{
+    InterruptAfter, ProjectionError, ProjectionLimits, ProjectionPlan, SurrealProjection,
+};
+use compass_model::code_graph::{BuildMetadata, EdgeKind, GraphDocument, NodeKind};
+use compass_model::identity::{edge_id, file_id, symbol_id};
+use compass_model::provenance::SourceAnchor;
+use serde_json::json;
+
+fn digest(byte: char) -> String {
+    format!("sha256:{}", byte.to_string().repeat(64))
+}
+
+fn semantic_graph(generation: char) -> Result<GraphDocument, serde_json::Error> {
+    let path = "src/lib.rs";
+    let source = symbol_id("rust", path, NodeKind::Function, "source", "");
+    let target = symbol_id("rust", path, NodeKind::Function, "target", "");
+    let anchor = SourceAnchor {
+        file: path.to_owned(),
+        start_byte: 0,
+        end_byte: 4,
+        start_line: 1,
+        start_column: 0,
+        end_line: 1,
+        end_column: 4,
+    };
+    let evidence = json!([{
+        "origin": "config",
+        "extractor": "projection-test",
+        "confidence": "exact",
+        "anchors": [anchor]
+    }]);
+    let mut graph = GraphDocument::empty_v1(BuildMetadata {
+        builder_version: "test".to_owned(),
+        schema_fingerprint: digest('1'),
+        source_tree_digest: digest('2'),
+        configuration_digest: digest('3'),
+        generation_id: digest(generation),
+        source_commit: Some("fixture".to_owned()),
+    });
+    graph.graph.files = serde_json::from_value(json!([{
+        "id": file_id(path),
+        "path": path,
+        "contentDigest": digest('5'),
+        "byteSize": 4,
+        "generated": false,
+        "extractionStatus": "extracted"
+    }]))?;
+    graph.nodes = serde_json::from_value(json!([
+        {
+            "id": source,
+            "kind": "function",
+            "name": "source",
+            "qualifiedName": "source",
+            "language": "rust",
+            "source": anchor,
+            "evidence": evidence
+        },
+        {
+            "id": target,
+            "kind": "function",
+            "name": "target",
+            "qualifiedName": "target",
+            "language": "rust",
+            "source": anchor,
+            "evidence": evidence
+        }
+    ]))?;
+    let edge = |rule: &str, edge_source: &str, edge_target: &str| {
+        let id = edge_id(
+            edge_source,
+            EdgeKind::Calls,
+            edge_target,
+            Some(&anchor),
+            Some(rule),
+        );
+        json!({
+            "id": id,
+            "key": id,
+            "source": edge_source,
+            "target": edge_target,
+            "kind": "calls",
+            "occurrenceRule": rule,
+            "relationshipSite": anchor,
+            "evidence": evidence
+        })
+    };
+    graph.links = serde_json::from_value(json!([
+        edge("parallel-a", &source, &target),
+        edge("parallel-b", &source, &target),
+        edge("reverse", &target, &source),
+        edge("self", &source, &source)
+    ]))?;
+    Ok(graph)
+}
+
+#[tokio::test(flavor = "multi_thread")]
+async fn activation_round_trips_and_interruption_keeps_previous_generation()
+-> Result<(), Box<dyn std::error::Error>> {
+    let projection = SurrealProjection::memory("compass_test", "projection_test").await?;
+    let first = ProjectionPlan::from_graph("repository", &semantic_graph('4')?)?;
+    let outcome = projection.activate(&first).await?;
+    assert!(!outcome.already_present);
+    assert_eq!(outcome.nodes, 2);
+    assert_eq!(outcome.relations, 4);
+    assert_eq!(
+        projection.read_active_projection("repository").await?,
+        Some(first.clone())
+    );
+
+    let repeated = projection.activate(&first).await?;
+    assert!(repeated.already_present);
+
+    let second = ProjectionPlan::from_graph("repository", &semantic_graph('6')?)?;
+    assert!(matches!(
+        projection
+            .activate_with_interrupt(&second, Some(InterruptAfter(1)))
+            .await,
+        Err(ProjectionError::Interrupted {
+            completed_mutations: 1
+        })
+    ));
+    assert_eq!(
+        projection.active_generation("repository").await?,
+        Some(first.generation_id.clone())
+    );
+    assert_eq!(
+        projection.read_active_projection("repository").await?,
+        Some(first)
+    );
+
+    projection.activate(&second).await?;
+    assert_eq!(
+        projection.read_active_projection("repository").await?,
+        Some(second)
+    );
+    Ok(())
+}
+
+#[tokio::test(flavor = "multi_thread")]
+async fn activation_rejects_a_plan_over_the_configured_bound()
+-> Result<(), Box<dyn std::error::Error>> {
+    let limits = ProjectionLimits::new(1, 8, compass_model::DEFAULT_GRAPH_SIZE_CAP_BYTES)?;
+    let projection = SurrealProjection::memory_with_limits(
+        "compass_limit_test",
+        "projection_limit_test",
+        limits,
+    )
+    .await?;
+    let plan = ProjectionPlan::from_graph("repository", &semantic_graph('8')?)?;
+    assert!(matches!(
+        projection.activate(&plan).await,
+        Err(ProjectionError::LimitExceeded {
+            resource: "nodes",
+            actual: 2,
+            limit: 1,
+        })
+    ));
+    assert_eq!(projection.active_generation("repository").await?, None);
+    Ok(())
+}
+
+#[tokio::test(flavor = "multi_thread")]
+async fn zero_interrupt_stops_before_the_first_mutation() -> Result<(), Box<dyn std::error::Error>>
+{
+    let projection = SurrealProjection::memory("compass_zero_interrupt", "projection_test").await?;
+    let plan = ProjectionPlan::from_graph("repository", &semantic_graph('9')?)?;
+    assert!(matches!(
+        projection
+            .activate_with_interrupt(&plan, Some(InterruptAfter(0)))
+            .await,
+        Err(ProjectionError::Interrupted {
+            completed_mutations: 0
+        })
+    ));
+    assert_eq!(projection.active_generation("repository").await?, None);
+    Ok(())
+}
+
+#[tokio::test(flavor = "multi_thread")]
+async fn idempotent_reactivation_rejects_changed_generation_metadata()
+-> Result<(), Box<dyn std::error::Error>> {
+    let projection = SurrealProjection::memory("compass_metadata_test", "projection_test").await?;
+    let plan = ProjectionPlan::from_graph("repository", &semantic_graph('a')?)?;
+    projection.activate(&plan).await?;
+
+    let mut changed = plan.clone();
+    changed.source_tree_digest = digest('b');
+    assert!(matches!(
+        projection.activate(&changed).await,
+        Err(ProjectionError::InvalidPlan(message))
+            if message.contains("immutable generation already exists")
+    ));
+    assert_eq!(
+        projection.read_active_projection("repository").await?,
+        Some(plan)
+    );
+    Ok(())
+}
+
+#[tokio::test(flavor = "multi_thread")]
+async fn injection_shaped_repository_identity_round_trips_as_bound_data()
+-> Result<(), Box<dyn std::error::Error>> {
+    let projection = SurrealProjection::memory("compass_injection_test", "projection_test").await?;
+    let repository = "repo:'; DELETE code_node; --";
+    let plan = ProjectionPlan::from_graph(repository, &semantic_graph('c')?)?;
+    projection.activate(&plan).await?;
+    assert_eq!(
+        projection.read_active_projection(repository).await?,
+        Some(plan)
+    );
+    Ok(())
+}
diff --git a/crates/compass-graphdb-surreal/tests/native_query.rs b/crates/compass-graphdb-surreal/tests/native_query.rs
new file mode 100644
index 000000000..be733aec5
--- /dev/null
+++ b/crates/compass-graphdb-surreal/tests/native_query.rs
@@ -0,0 +1,313 @@
+#![cfg(feature = "mem")]
+
+use std::fs;
+
+use compass_graphdb_surreal::{
+    ProjectionError, ProjectionPlan, RelationPageRequest, SurrealProjection,
+};
+use compass_model::code_graph::{BuildMetadata, EdgeKind, GraphDocument, NodeKind};
+use compass_model::identity::{edge_id, file_id, symbol_id};
+use compass_model::provenance::SourceAnchor;
+use compass_model::query_contract::{
+    CallRequest, CodeQueryLimits, ExploreRequest, ImpactRequest, NodeTrailRequest,
+};
+use compass_query::{EngineSelection, open_with_engine};
+use serde_json::json;
+
+fn digest(byte: char) -> String {
+    format!("sha256:{}", byte.to_string().repeat(64))
+}
+
+fn fixture(generation: char) -> Result<GraphDocument, serde_json::Error> {
+    let path = "src/lib.rs";
+    let source = symbol_id("rust", path, NodeKind::Function, "source", "");
+    let target = symbol_id("rust", path, NodeKind::Function, "target", "");
+    let anchor = SourceAnchor {
+        file: path.to_owned(),
+        start_byte: 0,
+        end_byte: 4,
+        start_line: 1,
+        start_column: 0,
+        end_line: 1,
+        end_column: 4,
+    };
+    let exact = json!([{
+        "origin": "config",
+        "extractor": "native-query-integration",
+        "confidence": "exact",
+        "anchors": [anchor]
+    }]);
+    let heuristic = json!([{
+        "origin": "heuristic",
+        "extractor": "native-query-integration",
+        "confidence": "inferred",
+        "anchors": [anchor],
+        "rule": "heuristic-fixture",
+        "wiringSite": anchor
+    }]);
+    let mut graph = GraphDocument::empty_v1(BuildMetadata {
+        builder_version: "integration".to_owned(),
+        schema_fingerprint: digest('1'),
+        source_tree_digest: digest('2'),
+        configuration_digest: digest('3'),
+        generation_id: digest(generation),
+        source_commit: Some("fixture".to_owned()),
+    });
+    graph.graph.files = serde_json::from_value(json!([{
+        "id": file_id(path),
+        "path": path,
+        "contentDigest": digest('5'),
+        "byteSize": 4,
+        "generated": false,
+        "extractionStatus": "extracted"
+    }]))?;
+    graph.nodes = serde_json::from_value(json!([
+        {
+            "id": source,
+            "kind": "function",
+            "name": "source",
+            "qualifiedName": "fixture::source",
+            "language": "rust",
+            "source": anchor,
+            "evidence": exact
+        },
+        {
+            "id": target,
+            "kind": "function",
+            "name": "target",
+            "qualifiedName": "fixture::target",
+            "language": "rust",
+            "source": anchor,
+            "evidence": exact
+        }
+    ]))?;
+    let relation = |kind: EdgeKind,
+                    rule: &str,
+                    edge_source: &str,
+                    edge_target: &str,
+                    evidence: &serde_json::Value| {
+        let id = edge_id(edge_source, kind, edge_target, Some(&anchor), Some(rule));
+        json!({
+            "id": id,
+            "key": id,
+            "source": edge_source,
+            "target": edge_target,
+            "kind": kind.as_str(),
+            "occurrenceRule": rule,
+            "relationshipSite": anchor,
+            "evidence": evidence
+        })
+    };
+    graph.links = serde_json::from_value(json!([
+        relation(EdgeKind::Calls, "parallel-a", &source, &target, &exact),
+        relation(EdgeKind::Calls, "parallel-b", &source, &target, &exact),
+        relation(EdgeKind::Calls, "reverse", &target, &source, &exact),
+        relation(EdgeKind::Calls, "self", &source, &source, &exact),
+        relation(EdgeKind::Calls, "heuristic", &source, &target, &heuristic)
+    ]))?;
+    Ok(graph)
+}
+
+fn limits() -> CodeQueryLimits {
+    CodeQueryLimits {
+        max_depth: 8,
+        max_nodes: 64,
+        max_edges: 64,
+        max_paths: 32,
+        max_candidates: 16,
+        max_source_bytes: 1_024,
+        max_response_bytes: 1_048_576,
+    }
+}
+
+#[tokio::test(flavor = "multi_thread")]
+async fn native_and_json_structural_operations_are_semantically_identical()
+-> Result<(), Box<dyn std::error::Error>> {
+    let repository = "repo:'; DELETE code_node; --";
+    let graph = fixture('4')?;
+    let generation = graph.graph.build.generation_id.clone();
+    let source = graph.nodes[0].id.clone();
+    let target = graph.nodes[1].id.clone();
+    let temporary = tempfile::tempdir()?;
+    let graph_path = temporary.path().join("graph.json");
+    fs::write(&graph_path, serde_json::to_vec_pretty(&graph)?)?;
+    let json = open_with_engine(
+        &graph_path,
+        None,
+        &temporary.path().join("cache"),
+        EngineSelection::Json,
+    )?;
+    let surreal = SurrealProjection::memory("native_equivalence", "native_equivalence").await?;
+    surreal
+        .activate(&ProjectionPlan::from_graph(repository, &graph)?)
+        .await?;
+
+    for include_heuristic in [false, true] {
+        let callers = CallRequest {
+            symbol: "TARGET()".to_owned(),
+            include_heuristic,
+            limits: limits(),
+        };
+        assert_eq!(
+            surreal
+                .callers(repository, callers.clone())
+                .await?
+                .structural_view(repository, &generation),
+            json.callers(callers)?
+                .structural_view(repository, &generation)
+        );
+
+        let callees = CallRequest {
+            symbol: source.clone(),
+            include_heuristic,
+            limits: limits(),
+        };
+        assert_eq!(
+            surreal
+                .callees(repository, callees.clone())
+                .await?
+                .structural_view(repository, &generation),
+            json.callees(callees)?
+                .structural_view(repository, &generation)
+        );
+
+        let impact = ImpactRequest {
+            symbol: target.clone(),
+            include_heuristic,
+            limits: limits(),
+        };
+        assert_eq!(
+            surreal
+                .impact(repository, impact.clone())
+                .await?
+                .structural_view(repository, &generation),
+            json.impact(impact)?
+                .structural_view(repository, &generation)
+        );
+
+        let trail = NodeTrailRequest {
+            source: source.clone(),
+            target: target.clone(),
+            include_heuristic,
+            limits: limits(),
+        };
+        assert_eq!(
+            surreal
+                .node_trail(repository, trail.clone())
+                .await?
+                .structural_view(repository, &generation),
+            json.node_trail(trail)?
+                .structural_view(repository, &generation)
+        );
+
+        let subgraph = ExploreRequest {
+            symbols: vec![source.clone(), target.clone()],
+            root: String::new(),
+            include_heuristic,
+            limits: limits(),
+        };
+        assert_eq!(
+            surreal
+                .structural_subgraph(repository, subgraph.clone())
+                .await?
+                .structural_view(repository, &generation),
+            json.structural_subgraph(subgraph)?
+                .structural_view(repository, &generation)
+        );
+    }
+    Ok(())
+}
+
+#[tokio::test(flavor = "multi_thread")]
+async fn relation_pages_are_complete_ordered_and_generation_bound()
+-> Result<(), Box<dyn std::error::Error>> {
+    let repository = "repository";
+    let first_graph = fixture('6')?;
+    let first_plan = ProjectionPlan::from_graph(repository, &first_graph)?;
+    let projection = SurrealProjection::memory("native_pages", "native_pages").await?;
+    projection.activate(&first_plan).await?;
+    let mut cursor = None;
+    let mut observed = Vec::new();
+    loop {
+        let page = projection
+            .read_relation_page(
+                repository,
+                RelationPageRequest {
+                    max_items: 2,
+                    cursor,
+                    include_heuristic: true,
+                },
+            )
+            .await?;
+        observed.extend(page.relations.into_iter().map(|relation| relation.id));
+        cursor = page.next_cursor;
+        if cursor.is_none() {
+            break;
+        }
+    }
+    assert_eq!(
+        observed,
+        first_plan
+            .relations
+            .iter()
+            .map(|relation| relation.compass_edge_id.clone())
+            .collect::<Vec<_>>()
+    );
+
+    let first_page = projection
+        .read_relation_page(
+            repository,
+            RelationPageRequest {
+                max_items: 1,
+                cursor: None,
+                include_heuristic: true,
+            },
+        )
+        .await?;
+    let old_cursor = first_page
+        .next_cursor
+        .ok_or("expected another relation page")?;
+    projection
+        .activate(&ProjectionPlan::from_graph(repository, &fixture('7')?)?)
+        .await?;
+    assert!(matches!(
+        projection
+            .read_relation_page(
+                repository,
+                RelationPageRequest {
+                    max_items: 1,
+                    cursor: Some(old_cursor),
+                    include_heuristic: true,
+                },
+            )
+            .await,
+        Err(ProjectionError::InvalidCursor(_))
+    ));
+    assert!(matches!(
+        projection
+            .read_relation_page(
+                repository,
+                RelationPageRequest {
+                    max_items: 1,
+                    cursor: Some("not-hex".to_owned()),
+                    include_heuristic: true,
+                },
+            )
+            .await,
+        Err(ProjectionError::InvalidCursor(_))
+    ));
+    assert!(matches!(
+        projection
+            .callers(
+                "missing",
+                CallRequest {
+                    symbol: "anything".to_owned(),
+                    include_heuristic: false,
+                    limits: limits(),
+                },
+            )
+            .await,
+        Err(ProjectionError::ActiveGenerationUnavailable { .. })
+    ));
+    Ok(())
+}
diff --git a/crates/compass-graphdb-surreal/tests/projection.rs b/crates/compass-graphdb-surreal/tests/projection.rs
new file mode 100644
index 000000000..43154fdc5
--- /dev/null
+++ b/crates/compass-graphdb-surreal/tests/projection.rs
@@ -0,0 +1,195 @@
+use std::collections::BTreeSet;
+
+use compass_graphdb_surreal::{
+    ProjectedRelation, ProjectionError, ProjectionLimits, ProjectionPlan, RelationFamily,
+    relation_family,
+};
+use compass_model::code_graph::{BuildMetadata, EdgeKind, EdgeRecord, GraphDocument, NodeKind};
+use compass_model::identity::{edge_id, file_id, symbol_id};
+use compass_model::provenance::SourceAnchor;
+use serde_json::json;
+
+fn digest(byte: char) -> String {
+    format!("sha256:{}", byte.to_string().repeat(64))
+}
+
+fn anchor() -> SourceAnchor {
+    SourceAnchor {
+        file: "src/lib.rs".to_owned(),
+        start_byte: 0,
+        end_byte: 4,
+        start_line: 1,
+        start_column: 0,
+        end_line: 1,
+        end_column: 4,
+    }
+}
+
+fn semantic_graph() -> Result<GraphDocument, serde_json::Error> {
+    let path = "src/lib.rs";
+    let source = symbol_id("rust", path, NodeKind::Function, "source", "");
+    let target = symbol_id("rust", path, NodeKind::Function, "target", "");
+    let source_anchor = anchor();
+    let evidence = json!([{
+        "origin": "config",
+        "extractor": "projection-test",
+        "confidence": "exact",
+        "anchors": [source_anchor]
+    }]);
+    let mut graph = GraphDocument::empty_v1(BuildMetadata {
+        builder_version: "test".to_owned(),
+        schema_fingerprint: digest('1'),
+        source_tree_digest: digest('2'),
+        configuration_digest: digest('3'),
+        generation_id: digest('4'),
+        source_commit: Some("fixture".to_owned()),
+    });
+    graph.graph.files = serde_json::from_value(json!([{
+        "id": file_id(path),
+        "path": path,
+        "contentDigest": digest('5'),
+        "byteSize": 4,
+        "generated": false,
+        "extractionStatus": "extracted"
+    }]))?;
+    graph.nodes = serde_json::from_value(json!([
+        {
+            "id": source,
+            "kind": "function",
+            "name": "source",
+            "qualifiedName": "source",
+            "language": "rust",
+            "source": source_anchor,
+            "evidence": evidence
+        },
+        {
+            "id": target,
+            "kind": "function",
+            "name": "target",
+            "qualifiedName": "target",
+            "language": "rust",
+            "source": source_anchor,
+            "evidence": evidence
+        }
+    ]))?;
+    let edge = |rule: &str, edge_source: &str, edge_target: &str| {
+        let id = edge_id(
+            edge_source,
+            EdgeKind::Calls,
+            edge_target,
+            Some(&source_anchor),
+            Some(rule),
+        );
+        json!({
+            "id": id,
+            "key": id,
+            "source": edge_source,
+            "target": edge_target,
+            "kind": "calls",
+            "occurrenceRule": rule,
+            "relationshipSite": source_anchor,
+            "evidence": evidence
+        })
+    };
+    graph.links = serde_json::from_value(json!([
+        edge("parallel-a", &source, &target),
+        edge("parallel-b", &source, &target),
+        edge("reverse", &target, &source),
+        edge("self", &source, &source)
+    ]))?;
+    Ok(graph)
+}
+
+#[test]
+fn empty_repository_is_rejected() -> Result<(), serde_json::Error> {
+    assert!(matches!(
+        ProjectionPlan::from_graph(" ", &semantic_graph()?),
+        Err(ProjectionError::EmptyRepositoryId)
+    ));
+    Ok(())
+}
+
+#[test]
+fn edge_mapping_is_total_and_uses_every_family() {
+    let families = EdgeKind::ALL
+        .into_iter()
+        .map(relation_family)
+        .collect::<BTreeSet<_>>();
+    assert_eq!(families, RelationFamily::ALL.into_iter().collect());
+}
+
+#[test]
+fn plan_is_deterministic_and_semantically_lossless() -> Result<(), Box<dyn std::error::Error>> {
+    let graph = semantic_graph()?;
+    let repository = "repo:'; DELETE code_node; --";
+    let first = ProjectionPlan::from_graph(repository, &graph)?;
+    let second = ProjectionPlan::from_graph(repository, &graph)?;
+    assert_eq!(first, second);
+    assert_eq!(first.nodes.len(), 2);
+    assert_eq!(first.relations.len(), 4);
+    for node in &first.nodes {
+        assert_eq!(node.decode()?.id, node.compass_node_id);
+        assert_eq!(node.confidence, "exact");
+    }
+    let decoded = first
+        .relations
+        .iter()
+        .map(ProjectedRelation::decode)
+        .collect::<Result<Vec<EdgeRecord>, _>>()?;
+    assert_eq!(decoded, {
+        let mut edges = graph.links.clone();
+        edges.sort_by(|left, right| left.id.cmp(&right.id));
+        edges
+    });
+    for relation in &first.relations {
+        assert_eq!(relation.confidence, "exact");
+        assert_eq!(relation.family, RelationFamily::Execution);
+    }
+    Ok(())
+}
+
+#[test]
+fn tampered_or_unsorted_plan_is_rejected() -> Result<(), Box<dyn std::error::Error>> {
+    let graph = semantic_graph()?;
+    let mut plan = ProjectionPlan::from_graph("repo", &graph)?;
+    plan.nodes.reverse();
+    assert!(matches!(
+        plan.validate(),
+        Err(ProjectionError::NonDeterministicOrder {
+            record_class: "node"
+        })
+    ));
+    let mut plan = ProjectionPlan::from_graph("repo", &graph)?;
+    plan.projection_fingerprint.push('0');
+    assert!(matches!(
+        plan.validate(),
+        Err(ProjectionError::FingerprintMismatch)
+    ));
+    Ok(())
+}
+
+#[test]
+fn invalid_graph_is_rejected() -> Result<(), Box<dyn std::error::Error>> {
+    let mut graph = semantic_graph()?;
+    graph.links[0].target = "missing".to_owned();
+    assert!(matches!(
+        ProjectionPlan::from_graph("repo", &graph),
+        Err(ProjectionError::GraphValidation(_))
+    ));
+    Ok(())
+}
+
+#[test]
+fn projection_limits_are_positive_and_match_qualification_defaults() {
+    assert!(matches!(
+        ProjectionLimits::new(0, 1, 1),
+        Err(ProjectionError::InvalidPlan(_))
+    ));
+    let limits = ProjectionLimits::default();
+    assert_eq!(limits.max_nodes(), 1_000_000);
+    assert_eq!(limits.max_relations(), 2_500_000);
+    assert_eq!(
+        limits.max_projected_bytes(),
+        compass_model::DEFAULT_GRAPH_SIZE_CAP_BYTES
+    );
+}
diff --git a/crates/compass-graphdb-surreal/tests/scale_qualification.rs b/crates/compass-graphdb-surreal/tests/scale_qualification.rs
new file mode 100644
index 000000000..18cda9d46
--- /dev/null
+++ b/crates/compass-graphdb-surreal/tests/scale_qualification.rs
@@ -0,0 +1,579 @@
+#![cfg(feature = "mem")]
+
+use std::collections::BTreeSet;
+use std::error::Error;
+use std::fs;
+use std::io::Write as _;
+use std::path::PathBuf;
+use std::time::Instant;
+
+use compass_graphdb_surreal::{ProjectionPlan, RelationPageRequest, SurrealProjection};
+use compass_model::code_graph::{BuildMetadata, EdgeKind, GraphDocument};
+use compass_model::identity::{edge_id, file_id};
+use compass_model::provenance::SourceAnchor;
+use compass_model::query_contract::{
+    CallRequest, CodeQueryLimits, ExploreRequest, ImpactRequest, NodeTrailRequest,
+};
+use compass_model::validate_code_graph;
+use compass_query::{EngineSelection, open_with_engine};
+use serde::{Deserialize, Serialize};
+use serde_json::json;
+
+const SOURCE_PATH: &str = "qualification/generated.rs";
+
+#[derive(Clone, Debug, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct QualificationProfile {
+    name: String,
+    nodes: u64,
+    edges: u64,
+    sample_ordinals: Vec<u64>,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct QualificationProfiles {
+    schema: String,
+    profiles: Vec<QualificationProfile>,
+}
+
+#[derive(Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+struct WorkloadMeasurement {
+    current_microseconds: Vec<u64>,
+    surreal_microseconds: Vec<u64>,
+    current_p95_microseconds: u64,
+    surreal_p95_microseconds: u64,
+    current_response_bytes: usize,
+    surreal_response_bytes: usize,
+}
+
+fn digest(byte: char) -> String {
+    format!("sha256:{}", byte.to_string().repeat(64))
+}
+
+fn node_id(ordinal: u64) -> String {
+    format!("n:qualification:{ordinal:07}")
+}
+
+fn anchor(ordinal: u64) -> Result<SourceAnchor, Box<dyn Error>> {
+    let line = u32::try_from(ordinal + 1)?;
+    Ok(SourceAnchor {
+        file: SOURCE_PATH.to_owned(),
+        start_byte: ordinal,
+        end_byte: ordinal + 1,
+        start_line: line,
+        start_column: 0,
+        end_line: line,
+        end_column: 1,
+    })
+}
+
+fn edge_endpoints(ordinal: u64, nodes: u64) -> (u64, u64) {
+    let chain_edges = nodes - 1;
+    if ordinal < chain_edges {
+        return (ordinal, ordinal + 1);
+    }
+    let chord = ordinal - chain_edges;
+    if chord == 0 {
+        return (0, 1);
+    }
+    let source = (chord - 1) % nodes;
+    let band = (chord - 1) / nodes;
+    let offset = 2 + (band % (nodes - 2));
+    (source, (source + offset) % nodes)
+}
+
+fn scale_sample(profile: &QualificationProfile) -> Result<GraphDocument, Box<dyn Error>> {
+    if profile.nodes < 3 || profile.edges < profile.nodes {
+        return Err(format!("invalid qualification profile {}", profile.name).into());
+    }
+    let mut edge_ordinals = BTreeSet::from([0, profile.nodes - 1, profile.edges - 1]);
+    for ordinal in &profile.sample_ordinals {
+        if *ordinal >= profile.nodes {
+            return Err(format!("sample ordinal {ordinal} exceeds {}", profile.nodes).into());
+        }
+        let first = ordinal.saturating_sub(3);
+        let last = (ordinal + 3).min(profile.nodes - 1);
+        for edge in first..last {
+            edge_ordinals.insert(edge);
+        }
+        if *ordinal < profile.edges {
+            edge_ordinals.insert(*ordinal);
+        }
+    }
+
+    let mut node_ordinals = BTreeSet::new();
+    for edge in &edge_ordinals {
+        let (source, target) = edge_endpoints(*edge, profile.nodes);
+        node_ordinals.insert(source);
+        node_ordinals.insert(target);
+    }
+    node_ordinals.extend(profile.sample_ordinals.iter().copied());
+
+    let mut graph = GraphDocument::empty_v1(BuildMetadata {
+        builder_version: "compass.qualification.scale-sample/1".to_owned(),
+        schema_fingerprint: digest('1'),
+        source_tree_digest: digest(if profile.name.ends_with("medium") {
+            '2'
+        } else {
+            '3'
+        }),
+        configuration_digest: digest('4'),
+        generation_id: digest(if profile.name.ends_with("medium") {
+            '5'
+        } else {
+            '6'
+        }),
+        source_commit: None,
+    });
+    graph.graph.files = serde_json::from_value(json!([{
+        "id": file_id(SOURCE_PATH),
+        "path": SOURCE_PATH,
+        "contentDigest": digest('7'),
+        "byteSize": profile.edges + 1,
+        "generated": true,
+        "extractionStatus": "generated",
+        "extractorVersions": ["compass.qualification.scale-sample/1"]
+    }]))?;
+
+    graph.nodes = node_ordinals
+        .iter()
+        .map(|ordinal| {
+            let source = anchor(*ordinal)?;
+            serde_json::from_value(json!({
+                "id": node_id(*ordinal),
+                "kind": "function",
+                "name": format!("Node{ordinal:07}"),
+                "qualifiedName": format!("qualification::Node{ordinal:07}"),
+                "language": "rust",
+                "source": source,
+                "evidence": [{
+                    "origin": "artifact",
+                    "extractor": "compass.qualification.scale-sample/1",
+                    "confidence": "exact",
+                    "anchors": [source]
+                }]
+            }))
+            .map_err(Into::into)
+        })
+        .collect::<Result<Vec<_>, Box<dyn Error>>>()?;
+
+    graph.links = edge_ordinals
+        .iter()
+        .map(|ordinal| {
+            let (source_ordinal, target_ordinal) = edge_endpoints(*ordinal, profile.nodes);
+            let source = node_id(source_ordinal);
+            let target = node_id(target_ordinal);
+            let site = anchor(*ordinal)?;
+            let id = edge_id(&source, EdgeKind::Calls, &target, Some(&site), None);
+            serde_json::from_value(json!({
+                "id": id,
+                "key": id,
+                "source": source,
+                "target": target,
+                "kind": "calls",
+                "relationshipSite": site,
+                "evidence": [{
+                    "origin": "artifact",
+                    "extractor": "compass.qualification.scale-sample/1",
+                    "confidence": "exact",
+                    "anchors": [site]
+                }],
+                "weight": 1.0
+            }))
+            .map_err(Into::into)
+        })
+        .collect::<Result<Vec<_>, Box<dyn Error>>>()?;
+    graph.nodes.sort_by(|left, right| left.id.cmp(&right.id));
+    graph.links.sort_by(|left, right| left.id.cmp(&right.id));
+    validate_code_graph(&graph)?;
+    Ok(graph)
+}
+
+fn limits() -> CodeQueryLimits {
+    CodeQueryLimits {
+        max_depth: 8,
+        max_nodes: 128,
+        max_edges: 256,
+        max_paths: 64,
+        max_candidates: 32,
+        max_source_bytes: 1_024,
+        max_response_bytes: 2_097_152,
+    }
+}
+
+fn elapsed_microseconds(started: Instant) -> Result<u64, Box<dyn Error>> {
+    Ok(u64::try_from(started.elapsed().as_micros())?)
+}
+
+fn p95(samples: &[u64]) -> Result<u64, Box<dyn Error>> {
+    if samples.is_empty() {
+        return Err("p95 requires at least one sample".into());
+    }
+    let mut ordered = samples.to_vec();
+    ordered.sort_unstable();
+    let rank = (ordered.len() * 95).div_ceil(100);
+    ordered
+        .get(rank.saturating_sub(1))
+        .copied()
+        .ok_or_else(|| "p95 rank exceeded the sample set".into())
+}
+
+fn measurement(
+    current_microseconds: Vec<u64>,
+    surreal_microseconds: Vec<u64>,
+    current_response: &impl Serialize,
+    surreal_response: &impl Serialize,
+) -> Result<WorkloadMeasurement, Box<dyn Error>> {
+    Ok(WorkloadMeasurement {
+        current_p95_microseconds: p95(&current_microseconds)?,
+        surreal_p95_microseconds: p95(&surreal_microseconds)?,
+        current_response_bytes: serde_json::to_vec(current_response)?.len(),
+        surreal_response_bytes: serde_json::to_vec(surreal_response)?.len(),
+        current_microseconds,
+        surreal_microseconds,
+    })
+}
+
+fn atomic_write_json(path: &PathBuf, value: &impl Serialize) -> Result<(), Box<dyn Error>> {
+    let parent = path
+        .parent()
+        .ok_or_else(|| format!("qualification output has no parent: {}", path.display()))?;
+    fs::create_dir_all(parent)?;
+    let mut temporary = tempfile::NamedTempFile::new_in(parent)?;
+    serde_json::to_writer_pretty(&mut temporary, value)?;
+    temporary.write_all(b"\n")?;
+    temporary.flush()?;
+    temporary.as_file().sync_all()?;
+    temporary
+        .persist(path)
+        .map_err(|error| error.error)
+        .map(|_file| ())
+        .map_err(Into::into)
+}
+
+#[tokio::test(flavor = "multi_thread")]
+async fn medium_and_large_scale_samples_are_dual_engine_equivalent() -> Result<(), Box<dyn Error>> {
+    let profiles: QualificationProfiles = serde_json::from_str(include_str!(
+        "../../../benchmarks/qualification/profiles-v1.json"
+    ))?;
+    if profiles.schema != "compass.qualification-profiles/1" || profiles.profiles.len() != 2 {
+        return Err(
+            "qualification profile inventory is not the ratified two-profile contract".into(),
+        );
+    }
+
+    for profile in profiles.profiles {
+        let repository = format!("qualification:{}", profile.name);
+        let graph = scale_sample(&profile)?;
+        let generation = graph.graph.build.generation_id.clone();
+        let temporary = tempfile::tempdir()?;
+        let graph_path = temporary.path().join("graph.json");
+        fs::write(&graph_path, serde_json::to_vec(&graph)?)?;
+        let current = open_with_engine(
+            &graph_path,
+            None,
+            &temporary.path().join("cache"),
+            EngineSelection::Json,
+        )?;
+        let database = profile.name.replace('-', "_");
+        let surreal = SurrealProjection::memory(&database, &database).await?;
+        let plan = ProjectionPlan::from_graph(&repository, &graph)?;
+        surreal.activate(&plan).await?;
+
+        for ordinal in &profile.sample_ordinals {
+            let symbol = node_id(*ordinal);
+            let callers = CallRequest {
+                symbol: symbol.clone(),
+                include_heuristic: false,
+                limits: limits(),
+            };
+            assert_eq!(
+                surreal
+                    .callers(&repository, callers.clone())
+                    .await?
+                    .structural_view(&repository, &generation),
+                current
+                    .callers(callers)?
+                    .structural_view(&repository, &generation)
+            );
+            let callees = CallRequest {
+                symbol: symbol.clone(),
+                include_heuristic: false,
+                limits: limits(),
+            };
+            assert_eq!(
+                surreal
+                    .callees(&repository, callees.clone())
+                    .await?
+                    .structural_view(&repository, &generation),
+                current
+                    .callees(callees)?
+                    .structural_view(&repository, &generation)
+            );
+            let impact = ImpactRequest {
+                symbol: symbol.clone(),
+                include_heuristic: false,
+                limits: limits(),
+            };
+            assert_eq!(
+                surreal
+                    .impact(&repository, impact.clone())
+                    .await?
+                    .structural_view(&repository, &generation),
+                current
+                    .impact(impact)?
+                    .structural_view(&repository, &generation)
+            );
+
+            let first = ordinal.saturating_sub(3);
+            let trail = NodeTrailRequest {
+                source: node_id(first),
+                target: symbol.clone(),
+                include_heuristic: false,
+                limits: limits(),
+            };
+            assert_eq!(
+                surreal
+                    .node_trail(&repository, trail.clone())
+                    .await?
+                    .structural_view(&repository, &generation),
+                current
+                    .node_trail(trail)?
+                    .structural_view(&repository, &generation)
+            );
+        }
+
+        let subgraph = ExploreRequest {
+            symbols: profile
+                .sample_ordinals
+                .iter()
+                .map(|value| node_id(*value))
+                .collect(),
+            root: String::new(),
+            include_heuristic: false,
+            limits: limits(),
+        };
+        assert_eq!(
+            surreal
+                .structural_subgraph(&repository, subgraph.clone())
+                .await?
+                .structural_view(&repository, &generation),
+            current
+                .structural_subgraph(subgraph)?
+                .structural_view(&repository, &generation)
+        );
+
+        let expected = plan
+            .relations
+            .iter()
+            .map(|relation| relation.compass_edge_id.clone())
+            .collect::<Vec<_>>();
+        let mut cursor = None;
+        let mut observed = Vec::new();
+        loop {
+            let page = surreal
+                .read_relation_page(
+                    &repository,
+                    RelationPageRequest {
+                        max_items: 3,
+                        cursor,
+                        include_heuristic: true,
+                    },
+                )
+                .await?;
+            observed.extend(page.relations.into_iter().map(|relation| relation.id));
+            let Some(next) = page.next_cursor else {
+                break;
+            };
+            cursor = Some(next);
+        }
+        assert_eq!(observed, expected);
+    }
+    Ok(())
+}
+
+#[tokio::test(flavor = "multi_thread")]
+#[ignore = "explicit full qualification-medium measurement"]
+async fn full_medium_dual_engine_measurement_emits_raw_evidence() -> Result<(), Box<dyn Error>> {
+    let graph_path = PathBuf::from(std::env::var("COMPASS_SURREAL_QUALIFICATION_GRAPH")?);
+    let output_path = PathBuf::from(std::env::var("COMPASS_SURREAL_QUALIFICATION_OUTPUT")?);
+    let samples = std::env::var("COMPASS_SURREAL_QUALIFICATION_SAMPLES")
+        .unwrap_or_else(|_| "5".to_owned())
+        .parse::<usize>()?;
+    if samples == 0 || samples > 20 {
+        return Err("qualification samples must be in 1..=20".into());
+    }
+
+    let graph = GraphDocument::load(&graph_path)?;
+    if graph.nodes.len() != 100_000 || graph.links.len() != 250_000 {
+        return Err(format!(
+            "qualification-medium requires 100000 nodes/250000 edges, found {}/{}",
+            graph.nodes.len(),
+            graph.links.len()
+        )
+        .into());
+    }
+    let repository = "qualification-medium";
+    let generation = graph.graph.build.generation_id.clone();
+    let plan_started = Instant::now();
+    let plan = ProjectionPlan::from_graph(repository, &graph)?;
+    let plan_microseconds = elapsed_microseconds(plan_started)?;
+    let surreal = SurrealProjection::memory("qualification_medium", "qualification_medium").await?;
+    let activation_started = Instant::now();
+    let activation = surreal.activate(&plan).await?;
+    let activation_microseconds = elapsed_microseconds(activation_started)?;
+    drop(plan);
+    drop(graph);
+
+    let temporary = tempfile::tempdir()?;
+    let current = open_with_engine(
+        &graph_path,
+        None,
+        &temporary.path().join("cache"),
+        EngineSelection::Json,
+    )?;
+    let query_limits = CodeQueryLimits {
+        max_depth: 8,
+        max_nodes: 512,
+        max_edges: 1_024,
+        max_paths: 128,
+        max_candidates: 256,
+        max_source_bytes: 1_048_576,
+        max_response_bytes: 8_388_608,
+    };
+    let callers = CallRequest {
+        symbol: "qualification::Node0099999".to_owned(),
+        include_heuristic: false,
+        limits: query_limits.clone(),
+    };
+    let callees = CallRequest {
+        symbol: "qualification::Node0000000".to_owned(),
+        include_heuristic: false,
+        limits: query_limits.clone(),
+    };
+    let impact = ImpactRequest {
+        symbol: "qualification::Node0099999".to_owned(),
+        include_heuristic: false,
+        limits: CodeQueryLimits {
+            max_depth: 3,
+            ..query_limits.clone()
+        },
+    };
+    let trail = NodeTrailRequest {
+        source: "qualification::Node0000000".to_owned(),
+        target: "qualification::Node0000009".to_owned(),
+        include_heuristic: false,
+        limits: query_limits,
+    };
+
+    let _warm_current = current.callers(callers.clone())?;
+    let _warm_surreal = surreal.callers(repository, callers.clone()).await?;
+
+    let mut caller_current = Vec::with_capacity(samples);
+    let mut caller_surreal = Vec::with_capacity(samples);
+    let mut caller_current_response = None;
+    let mut caller_surreal_response = None;
+    for _iteration in 0..samples {
+        let started = Instant::now();
+        caller_current_response = Some(current.callers(callers.clone())?);
+        caller_current.push(elapsed_microseconds(started)?);
+        let started = Instant::now();
+        caller_surreal_response = Some(surreal.callers(repository, callers.clone()).await?);
+        caller_surreal.push(elapsed_microseconds(started)?);
+    }
+    let caller_current_response = caller_current_response.ok_or("missing caller response")?;
+    let caller_surreal_response = caller_surreal_response.ok_or("missing caller response")?;
+    assert_eq!(
+        caller_current_response.structural_view(repository, &generation),
+        caller_surreal_response.structural_view(repository, &generation)
+    );
+
+    let mut callee_current = Vec::with_capacity(samples);
+    let mut callee_surreal = Vec::with_capacity(samples);
+    let mut callee_current_response = None;
+    let mut callee_surreal_response = None;
+    for _iteration in 0..samples {
+        let started = Instant::now();
+        callee_current_response = Some(current.callees(callees.clone())?);
+        callee_current.push(elapsed_microseconds(started)?);
+        let started = Instant::now();
+        callee_surreal_response = Some(surreal.callees(repository, callees.clone()).await?);
+        callee_surreal.push(elapsed_microseconds(started)?);
+    }
+    let callee_current_response = callee_current_response.ok_or("missing callee response")?;
+    let callee_surreal_response = callee_surreal_response.ok_or("missing callee response")?;
+    assert_eq!(
+        callee_current_response.structural_view(repository, &generation),
+        callee_surreal_response.structural_view(repository, &generation)
+    );
+
+    let mut impact_current = Vec::with_capacity(samples);
+    let mut impact_surreal = Vec::with_capacity(samples);
+    let mut impact_current_response = None;
+    let mut impact_surreal_response = None;
+    for _iteration in 0..samples {
+        let started = Instant::now();
+        impact_current_response = Some(current.impact(impact.clone())?);
+        impact_current.push(elapsed_microseconds(started)?);
+        let started = Instant::now();
+        impact_surreal_response = Some(surreal.impact(repository, impact.clone()).await?);
+        impact_surreal.push(elapsed_microseconds(started)?);
+    }
+    let impact_current_response = impact_current_response.ok_or("missing impact response")?;
+    let impact_surreal_response = impact_surreal_response.ok_or("missing impact response")?;
+    assert_eq!(
+        impact_current_response.structural_view(repository, &generation),
+        impact_surreal_response.structural_view(repository, &generation)
+    );
+
+    let mut trail_current = Vec::with_capacity(samples);
+    let mut trail_surreal = Vec::with_capacity(samples);
+    let mut trail_current_response = None;
+    let mut trail_surreal_response = None;
+    for _iteration in 0..samples {
+        let started = Instant::now();
+        trail_current_response = Some(current.node_trail(trail.clone())?);
+        trail_current.push(elapsed_microseconds(started)?);
+        let started = Instant::now();
+        trail_surreal_response = Some(surreal.node_trail(repository, trail.clone()).await?);
+        trail_surreal.push(elapsed_microseconds(started)?);
+    }
+    let trail_current_response = trail_current_response.ok_or("missing trail response")?;
+    let trail_surreal_response = trail_surreal_response.ok_or("missing trail response")?;
+    assert_eq!(
+        trail_current_response.structural_view(repository, &generation),
+        trail_surreal_response.structural_view(repository, &generation)
+    );
+
+    let evidence = json!({
+        "schema": "compass.surreal-qualification-raw/1",
+        "profile": "qualification-medium",
+        "graph": {
+            "path": graph_path,
+            "nodes": activation.nodes,
+            "edges": activation.relations,
+            "generationId": generation
+        },
+        "condition": "one in-process current-engine and Surreal Mem projection after one unmeasured caller warmup",
+        "samplesPerWorkload": samples,
+        "projection": {
+            "planMicroseconds": plan_microseconds,
+            "activationMicroseconds": activation_microseconds
+        },
+        "workloads": {
+            "callers": measurement(caller_current, caller_surreal, &caller_current_response, &caller_surreal_response)?,
+            "callees": measurement(callee_current, callee_surreal, &callee_current_response, &callee_surreal_response)?,
+            "impactDepth3": measurement(impact_current, impact_surreal, &impact_current_response, &impact_surreal_response)?,
+            "pathDepth3": measurement(trail_current, trail_surreal, &trail_current_response, &trail_surreal_response)?
+        },
+        "semanticMismatchCount": 0,
+        "responseReduction": {
+            "method": "canonical semantic response bytes",
+            "percent": 0
+        }
+    });
+    atomic_write_json(&output_path, &evidence)?;
+    Ok(())
+}
diff --git a/crates/compass-history/Cargo.toml b/crates/compass-history/Cargo.toml
index f0fee00af..2d2d2fbae 100644
--- a/crates/compass-history/Cargo.toml
+++ b/crates/compass-history/Cargo.toml
@@ -25,6 +25,7 @@ compass-files = { path = "../compass-files", version = "0.3.7" }
 compass-analysis = { path = "../compass-analysis", version = "0.3.7" }
 compass-ir = { path = "../compass-ir", version = "0.3.7" }
 compass-model = { path = "../compass-model", version = "0.3.7" }
+compass-partition.workspace = true
 
 [target.'cfg(windows)'.dependencies]
 # `replace_atomic` uses MoveFileExW(REPLACE_EXISTING | WRITE_THROUGH), providing the
diff --git a/crates/compass-history/src/artifacts.rs b/crates/compass-history/src/artifacts.rs
index 2b93bfd1b..b36b6a7d8 100644
--- a/crates/compass-history/src/artifacts.rs
+++ b/crates/compass-history/src/artifacts.rs
@@ -8,6 +8,7 @@ use compass_files::{write_bytes_atomic, write_json_atomic};
 use compass_ir::{EvidenceRecord, FunctionIr, ModuleIr, ProgramBundle, ProviderDescriptor};
 use compass_model::code_graph::GraphDocument as TrustedGraphDocument;
 use compass_model::{EdgeRecord, GraphDocument, NodeRecord};
+pub use compass_partition::PartitionedGraph;
 use prolly::{KeyBuilder, VersionedValue, decode_segments};
 use rayon::prelude::*;
 use serde::{Deserialize, Serialize};
@@ -71,18 +72,6 @@ pub struct CompletedGraphArtifacts {
     pub completion: CompletionEvidence,
 }
 
-/// Deterministic typed records used to construct the five Prolly trees.
-#[derive(Clone, Debug, Default, Eq, PartialEq)]
-pub struct PartitionedGraph {
-    pub nodes: Vec<(Vec<u8>, Vec<u8>)>,
-    pub edges: Vec<(Vec<u8>, Vec<u8>)>,
-    pub hyperedges: Vec<(Vec<u8>, Vec<u8>)>,
-    pub analysis: Vec<(Vec<u8>, Vec<u8>)>,
-    pub metadata: Vec<(Vec<u8>, Vec<u8>)>,
-    pub program_facts: Vec<(Vec<u8>, Vec<u8>)>,
-    pub program_summaries: Vec<(Vec<u8>, Vec<u8>)>,
-}
-
 #[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]
 struct ProgramHeader {
     program_schema: String,
@@ -204,7 +193,7 @@ impl GraphArtifacts {
         analysis: Option<Value>,
         manifest: Option<Value>,
     ) -> Result<Self, HistoryError> {
-        let trusted_bytes = canonical_json_bytes(&serde_json::to_value(&trusted)?)?;
+        let trusted_bytes = canonical_trusted_graph_bytes(&trusted)?;
         let graph = serde_json::to_value(&trusted.graph)?
             .as_object()
             .cloned()
@@ -891,7 +880,7 @@ impl GraphArtifacts {
             } else {
                 restore_order(&mut nodes, node_order, "node")?
             };
-            trusted.sort_by(|left, right| left.id.cmp(&right.id));
+            sort_trusted_nodes(&mut trusted);
             let compatible = trusted
                 .iter()
                 .map(compat_node)
@@ -908,20 +897,7 @@ impl GraphArtifacts {
             } else {
                 restore_order(&mut edges, edge_order, "edge")?
             };
-            trusted.sort_by(|left, right| {
-                (
-                    left.source.as_str(),
-                    left.kind.as_str(),
-                    left.target.as_str(),
-                    left.key.as_str(),
-                )
-                    .cmp(&(
-                        right.source.as_str(),
-                        right.kind.as_str(),
-                        right.target.as_str(),
-                        right.key.as_str(),
-                    ))
-            });
+            sort_trusted_edges(&mut trusted);
             let compatible = trusted
                 .iter()
                 .map(compat_edge)
@@ -1065,7 +1041,7 @@ impl GraphArtifacts {
 
 fn load_trusted_graph(path: &Path) -> Result<(GraphDocument, Vec<u8>), HistoryError> {
     let trusted = TrustedGraphDocument::load_for_recluster(path)?;
-    let trusted_bytes = canonical_json_bytes(&serde_json::to_value(&trusted)?)?;
+    let trusted_bytes = canonical_trusted_graph_bytes(&trusted)?;
     let graph = serde_json::to_value(&trusted.graph)?
         .as_object()
         .cloned()
@@ -1093,6 +1069,34 @@ fn load_trusted_graph(path: &Path) -> Result<(GraphDocument, Vec<u8>), HistoryEr
     ))
 }
 
+fn canonical_trusted_graph_bytes(trusted: &TrustedGraphDocument) -> Result<Vec<u8>, HistoryError> {
+    let mut canonical = trusted.clone();
+    sort_trusted_nodes(&mut canonical.nodes);
+    sort_trusted_edges(&mut canonical.links);
+    canonical_json_bytes(&serde_json::to_value(canonical)?)
+}
+
+fn sort_trusted_nodes(nodes: &mut [compass_model::code_graph::NodeRecord]) {
+    nodes.sort_by(|left, right| left.id.cmp(&right.id));
+}
+
+fn sort_trusted_edges(edges: &mut [compass_model::code_graph::EdgeRecord]) {
+    edges.sort_by(|left, right| {
+        (
+            left.source.as_str(),
+            left.kind.as_str(),
+            left.target.as_str(),
+            left.key.as_str(),
+        )
+            .cmp(&(
+                right.source.as_str(),
+                right.kind.as_str(),
+                right.target.as_str(),
+                right.key.as_str(),
+            ))
+    });
+}
+
 fn compat_node(node: &compass_model::code_graph::NodeRecord) -> Result<NodeRecord, HistoryError> {
     let mut object = serde_json::to_value(node)?
         .as_object()
diff --git a/crates/compass-history/src/canonical.rs b/crates/compass-history/src/canonical.rs
index 816e846e6..a5f65a94d 100644
--- a/crates/compass-history/src/canonical.rs
+++ b/crates/compass-history/src/canonical.rs
@@ -2,54 +2,9 @@ use serde_json::Value;
 
 use crate::HistoryError;
 
-/// Version of the byte-stable canonical JSON encoding.
-pub const CANONICAL_ENCODING_VERSION: u32 = 1;
+pub use compass_partition::CANONICAL_ENCODING_VERSION;
 
 /// Encode JSON into deterministic, whitespace-free UTF-8 bytes.
 pub fn canonical_json_bytes(value: &Value) -> Result<Vec<u8>, HistoryError> {
-    let mut output = Vec::new();
-    write_canonical_value(value, &mut output)?;
-    Ok(output)
-}
-
-fn write_canonical_value(value: &Value, output: &mut Vec<u8>) -> Result<(), HistoryError> {
-    match value {
-        Value::Null => output.extend_from_slice(b"null"),
-        Value::Bool(true) => output.extend_from_slice(b"true"),
-        Value::Bool(false) => output.extend_from_slice(b"false"),
-        Value::Number(number) => output.extend_from_slice(number.to_string().as_bytes()),
-        Value::String(text) => {
-            serde_json::to_writer(output, text)
-                .map_err(|error| HistoryError::Canonical(error.to_string()))?;
-        }
-        Value::Array(values) => {
-            output.push(b'[');
-            for (index, item) in values.iter().enumerate() {
-                if index != 0 {
-                    output.push(b',');
-                }
-                write_canonical_value(item, output)?;
-            }
-            output.push(b']');
-        }
-        Value::Object(values) => {
-            output.push(b'{');
-            let mut keys = values.keys().collect::<Vec<_>>();
-            keys.sort_unstable_by(|left, right| left.as_bytes().cmp(right.as_bytes()));
-            for (index, key) in keys.into_iter().enumerate() {
-                if index != 0 {
-                    output.push(b',');
-                }
-                serde_json::to_writer(&mut *output, key)
-                    .map_err(|error| HistoryError::Canonical(error.to_string()))?;
-                output.push(b':');
-                let item = values.get(key).ok_or_else(|| {
-                    HistoryError::Canonical("object key disappeared during encoding".to_owned())
-                })?;
-                write_canonical_value(item, output)?;
-            }
-            output.push(b'}');
-        }
-    }
-    Ok(())
+    compass_partition::canonical_json_bytes(value).map_err(HistoryError::from)
 }
diff --git a/crates/compass-history/src/error.rs b/crates/compass-history/src/error.rs
index fa6536a0c..d797a8ed1 100644
--- a/crates/compass-history/src/error.rs
+++ b/crates/compass-history/src/error.rs
@@ -63,6 +63,9 @@ pub enum HistoryError {
     /// A value could not be represented by the canonical encoding.
     #[error("canonical encoding failed: {0}")]
     Canonical(String),
+    /// A storage-neutral partition value could not be encoded.
+    #[error(transparent)]
+    Partition(#[from] compass_partition::PartitionError),
     /// A typed key was malformed.
     #[error("invalid typed key: {0}")]
     InvalidKey(String),
@@ -102,6 +105,7 @@ impl HistoryError {
             | Self::Program(_)
             | Self::Json(_)
             | Self::Canonical(_)
+            | Self::Partition(_)
             | Self::InvalidKey(_)
             | Self::InvalidFingerprint(_)
             | Self::InvalidCommit(_)
diff --git a/crates/compass-history/src/keys.rs b/crates/compass-history/src/keys.rs
index 62b11b679..8a281d3c2 100644
--- a/crates/compass-history/src/keys.rs
+++ b/crates/compass-history/src/keys.rs
@@ -1,59 +1,12 @@
 use prolly::KeyBuilder;
 
+pub use compass_partition::{edge_key, hyperedge_key, node_key};
+
 pub(crate) const KEY_SCHEMA_V1: &[u8] = &[1];
 pub(crate) const NODE_KIND: &[u8] = &[1];
 pub(crate) const EDGE_KIND: &[u8] = &[2];
 pub(crate) const HYPEREDGE_KIND: &[u8] = &[3];
 
-/// Construct a segment-safe node key.
-#[must_use]
-pub fn node_key(id: &str) -> Vec<u8> {
-    KeyBuilder::new()
-        .push_segment(KEY_SCHEMA_V1)
-        .push_segment(NODE_KIND)
-        .push_str(id)
-        .finish()
-}
-
-/// Construct a direction-aware, segment-safe edge key.
-#[must_use]
-pub fn edge_key(
-    source: &str,
-    target: &str,
-    relation: &str,
-    directed: bool,
-    discriminator: Option<&[u8]>,
-) -> Vec<u8> {
-    let (source, target) = if directed || source <= target {
-        (source, target)
-    } else {
-        (target, source)
-    };
-    let builder = KeyBuilder::new()
-        .push_segment(KEY_SCHEMA_V1)
-        .push_segment(EDGE_KIND)
-        .push_str(source)
-        .push_str(target)
-        .push_str(relation);
-    match discriminator {
-        Some(value) => builder.push_segment(value).finish(),
-        None => builder.finish(),
-    }
-}
-
-/// Construct a stable hyperedge key, optionally distinguishing an exact duplicate.
-#[must_use]
-pub fn hyperedge_key(identity: &[u8], occurrence: Option<u64>) -> Vec<u8> {
-    let builder = KeyBuilder::new()
-        .push_segment(KEY_SCHEMA_V1)
-        .push_segment(HYPEREDGE_KIND)
-        .push_segment(identity);
-    match occurrence {
-        Some(rank) => builder.push_segment(rank.to_be_bytes()).finish(),
-        None => builder.finish(),
-    }
-}
-
 pub(crate) fn root_name(parts: &[&[u8]]) -> Vec<u8> {
     parts
         .iter()
diff --git a/crates/compass-languages/src/engine.rs b/crates/compass-languages/src/engine.rs
index bcf30e830..80c79a8f2 100644
--- a/crates/compass-languages/src/engine.rs
+++ b/crates/compass-languages/src/engine.rs
@@ -826,12 +826,11 @@ fn portable_framework_source(path: &Path) -> String {
     {
         return source[index..].to_owned();
     }
-    let components = source
-        .split('/')
-        .filter(|component| !component.is_empty())
-        .collect::<Vec<_>>();
-    let start = components.len().saturating_sub(3);
-    components[start..].join("/")
+    // Outside a recognized route layout, use the same portable identity as
+    // universal evidence. Keeping two different fallbacks manufactured graph
+    // anchors such as `T/.tmp*/module.js` that could not match the published
+    // file inventory (`module.js`) during direct extraction.
+    portable_evidence_source(path)
 }
 
 struct FunctionBody<'tree> {
diff --git a/crates/compass-languages/src/evidence/typescript.rs b/crates/compass-languages/src/evidence/typescript.rs
index fa8f7ff4c..531b58953 100644
--- a/crates/compass-languages/src/evidence/typescript.rs
+++ b/crates/compass-languages/src/evidence/typescript.rs
@@ -4257,47 +4257,49 @@ impl<'source, 'tree> CandidateState<'source, 'tree> {
         ) {
             collect_import_bindings(self.source, clause, reexport, type_only, &mut bindings);
         }
-        let owner = self.owner_for_scope(scope_id);
-        let module_occurrence = self.builder.occur_with_context(
-            if reexport {
-                SemanticRole::Reexport
-            } else {
-                SemanticRole::Import
-            },
-            &owner,
-            &module,
-            None,
-            Some(scope_id),
-            Some(if type_only {
-                "type_only_module"
-            } else {
-                "module"
-            }),
-            range_for_node(self.source_file, module_node),
-        )?;
-        self.builder.relate(
-            if reexport {
-                CandidateRelation::Reexports
-            } else {
-                CandidateRelation::Imports
-            },
-            &owner,
-            Some(&module_occurrence),
-            None,
-            &module,
-            ResolutionConstraint {
-                exact_language: Some(self.language.to_owned()),
-                module_or_package: Some(module.clone()),
-                allowed_target_kinds: vec!["module".to_owned()],
-                allow_external: true,
-                ..ResolutionConstraint::default()
-            },
-        )?;
-        if reexport
+        let wildcard_reexport = reexport
             && bindings.is_empty()
             && (statement_text.trim_start().starts_with("export *")
-                || statement_text.trim_start().starts_with("export type *"))
-        {
+                || statement_text.trim_start().starts_with("export type *"));
+        let owner = self.owner_for_scope(scope_id);
+        if !wildcard_reexport {
+            let module_occurrence = self.builder.occur_with_context(
+                if reexport {
+                    SemanticRole::Reexport
+                } else {
+                    SemanticRole::Import
+                },
+                &owner,
+                &module,
+                None,
+                Some(scope_id),
+                Some(if type_only {
+                    "type_only_module"
+                } else {
+                    "module"
+                }),
+                range_for_node(self.source_file, module_node),
+            )?;
+            self.builder.relate(
+                if reexport {
+                    CandidateRelation::Reexports
+                } else {
+                    CandidateRelation::Imports
+                },
+                &owner,
+                Some(&module_occurrence),
+                None,
+                &module,
+                ResolutionConstraint {
+                    exact_language: Some(self.language.to_owned()),
+                    module_or_package: Some(module.clone()),
+                    allowed_target_kinds: vec!["module".to_owned()],
+                    allow_external: true,
+                    ..ResolutionConstraint::default()
+                },
+            )?;
+        }
+        if wildcard_reexport {
             // An export-star statement is represented as a wildcard
             // reexport binding. The resolver expands this bounded edge only
             // for a requested named export, preserving barrel cycles and
diff --git a/crates/compass-languages/src/frameworks/typescript.rs b/crates/compass-languages/src/frameworks/typescript.rs
index abc691198..208bec6c6 100644
--- a/crates/compass-languages/src/frameworks/typescript.rs
+++ b/crates/compass-languages/src/frameworks/typescript.rs
@@ -15,6 +15,19 @@ const HTTP_METHODS: &[&str] = &[
     "get", "post", "put", "patch", "delete", "options", "head", "all",
 ];
 
+#[derive(Clone, Debug, Eq, Ord, PartialEq, PartialOrd)]
+struct ImportAlias {
+    local: String,
+    imported: String,
+    module: String,
+    start_byte: u64,
+    end_byte: u64,
+    start_line: u64,
+    start_column: u64,
+    end_line: u64,
+    end_column: u64,
+}
+
 pub(super) fn detect_express(
     path: &Path,
     source: &[u8],
@@ -29,10 +42,10 @@ pub(super) fn detect_express(
     collect_import_aliases(root, source, &mut imports);
     attach_import_aliases(path, source, root, extraction, &imports);
     let imports_module = |expected: &str| {
-        imports.iter().any(|(_, _, module, _)| {
-            module == expected
-                || (expected.ends_with('/') && module.starts_with(expected))
-                || (expected == "react-router" && module.starts_with("react-router-"))
+        imports.iter().any(|import| {
+            import.module == expected
+                || (expected.ends_with('/') && import.module.starts_with(expected))
+                || (expected == "react-router" && import.module.starts_with("react-router-"))
         })
     };
     let mut facts = Vec::new();
@@ -140,9 +153,9 @@ fn detect_node_router(
     collect_import_aliases(root, source, &mut imports);
     attach_import_aliases(path, source, root, extraction, &imports);
     let module = kind.module();
-    let imported = imports.iter().any(|(_, _, imported_module, _)| {
-        imported_module == module || imported_module.starts_with(&format!("{module}/"))
-    });
+    let imported = imports
+        .iter()
+        .any(|import| import.module == module || import.module.starts_with(&format!("{module}/")));
     let direct = imported || source_has_module_require(root, source, module);
     if !direct {
         return Vec::new();
@@ -160,16 +173,17 @@ fn detect_node_router(
 fn node_router_receivers(
     root: Node<'_>,
     source: &[u8],
-    imports: &[(String, String, String, u64)],
+    imports: &[ImportAlias],
     kind: NodeRouterKind,
 ) -> HashSet<String> {
     let constructors = imports
         .iter()
-        .filter(|(_, imported, module, _)| {
-            (module == kind.module() || module.starts_with(&format!("{}/", kind.module())))
-                && kind.constructor_import(imported)
+        .filter(|import| {
+            (import.module == kind.module()
+                || import.module.starts_with(&format!("{}/", kind.module())))
+                && kind.constructor_import(&import.imported)
         })
-        .map(|(local, _, _, _)| local.clone())
+        .map(|import| import.local.clone())
         .collect::<HashSet<_>>();
     let body = std::str::from_utf8(source).unwrap_or_default();
     let mut receivers = HashSet::new();
@@ -648,10 +662,10 @@ pub(super) fn detect_non_express(
     collect_import_aliases(root, source, &mut imports);
     attach_import_aliases(path, source, root, extraction, &imports);
     let imports_module = |expected: &str| {
-        imports.iter().any(|(_, _, module, _)| {
-            module == expected
-                || (expected.ends_with('/') && module.starts_with(expected))
-                || (expected == "react-router" && module.starts_with("react-router-"))
+        imports.iter().any(|import| {
+            import.module == expected
+                || (expected.ends_with('/') && import.module.starts_with(expected))
+                || (expected == "react-router" && import.module.starts_with("react-router-"))
         })
     };
     let mut facts = Vec::new();
@@ -691,14 +705,25 @@ fn attach_import_aliases(
     source: &[u8],
     root: Node<'_>,
     extraction: &mut Extraction,
-    aliases: &[(String, String, String, u64)],
+    aliases: &[ImportAlias],
 ) {
     attach_default_export_identities(path, source, root, extraction);
     let mut aliases = aliases.to_vec();
     aliases.sort();
     aliases.dedup();
     let source_file = path.to_string_lossy().into_owned();
-    for (local, imported, module, line) in aliases {
+    for alias in aliases {
+        let ImportAlias {
+            local,
+            imported,
+            module,
+            start_byte,
+            end_byte,
+            start_line,
+            start_column,
+            end_line,
+            end_column,
+        } = alias;
         if extraction.nodes.iter().any(|node| {
             node.attributes.get("local_name").and_then(Value::as_str) == Some(local.as_str())
                 && node.attributes.get("imported_name").and_then(Value::as_str)
@@ -720,9 +745,16 @@ fn attach_import_aliases(
                 ("imported_name".into(), Value::String(imported)),
                 ("module".into(), Value::String(module)),
                 ("source_file".into(), Value::String(source_file.clone())),
-                ("source_location".into(), Value::String(format!("L{line}"))),
-                ("line_start".into(), Value::from(line)),
-                ("line_end".into(), Value::from(line)),
+                (
+                    "source_location".into(),
+                    Value::String(format!("L{start_line}")),
+                ),
+                ("start_byte".into(), Value::from(start_byte)),
+                ("end_byte".into(), Value::from(end_byte)),
+                ("line_start".into(), Value::from(start_line)),
+                ("line_end".into(), Value::from(end_line)),
+                ("column_start".into(), Value::from(start_column)),
+                ("column_end".into(), Value::from(end_column)),
                 ("file_type".into(), Value::String("code".into())),
                 ("language".into(), Value::String("typescript".into())),
                 ("_origin".into(), Value::String("ast".into())),
@@ -791,19 +823,26 @@ fn collect_default_export_identities(
     }
 }
 
-fn collect_import_aliases(
-    node: Node<'_>,
-    source: &[u8],
-    aliases: &mut Vec<(String, String, String, u64)>,
-) {
+fn collect_import_aliases(node: Node<'_>, source: &[u8], aliases: &mut Vec<ImportAlias>) {
     if node.kind() == "import_statement" {
         let text = node_text(node, source);
         if let Some(module) = import_module(text) {
-            let line = u64::try_from(node.start_position().row + 1).unwrap_or(u64::MAX);
+            let start = node.start_position();
+            let end = node.end_position();
             aliases.extend(
                 parse_import_bindings(text)
                     .into_iter()
-                    .map(|(local, imported)| (local, imported, module.clone(), line)),
+                    .map(|(local, imported)| ImportAlias {
+                        local,
+                        imported,
+                        module: module.clone(),
+                        start_byte: u64::try_from(node.start_byte()).unwrap_or(u64::MAX),
+                        end_byte: u64::try_from(node.end_byte()).unwrap_or(u64::MAX),
+                        start_line: u64::try_from(start.row + 1).unwrap_or(u64::MAX),
+                        start_column: u64::try_from(start.column).unwrap_or(u64::MAX),
+                        end_line: u64::try_from(end.row + 1).unwrap_or(u64::MAX),
+                        end_column: u64::try_from(end.column).unwrap_or(u64::MAX),
+                    }),
             );
         }
         return;
diff --git a/crates/compass-languages/src/markdown.rs b/crates/compass-languages/src/markdown.rs
index 826c94bbc..0803e1368 100644
--- a/crates/compass-languages/src/markdown.rs
+++ b/crates/compass-languages/src/markdown.rs
@@ -328,10 +328,13 @@ impl State<'_, '_> {
                 .to_owned(),
             ),
         );
-        extra.insert(
-            "anchor_slug".to_owned(),
-            Value::String(slugify(explicit_id.as_deref().unwrap_or(title))),
-        );
+        let anchor_slug = slugify(explicit_id.as_deref().unwrap_or(title));
+        extra.insert("anchor_slug".to_owned(), Value::String(anchor_slug.clone()));
+        // A fragment URI is the typed marker that this document resource is a
+        // semantic heading rather than an arbitrary repeated block. The v1
+        // identity layer can therefore use its hierarchical qualified name
+        // and remain stable when prose is inserted before the heading.
+        extra.insert("uri".to_owned(), Value::String(format!("#{anchor_slug}")));
         if let Some(explicit_id) = explicit_id.as_deref() {
             extra.insert(
                 "explicit_id".to_owned(),
diff --git a/crates/compass-mcp/Cargo.toml b/crates/compass-mcp/Cargo.toml
index f9c354403..728b6b96c 100644
--- a/crates/compass-mcp/Cargo.toml
+++ b/crates/compass-mcp/Cargo.toml
@@ -13,6 +13,7 @@ categories.workspace = true
 
 [dependencies]
 axum.workspace = true
+http-body-util.workspace = true
 rmcp.workspace = true
 serde_json.workspace = true
 time.workspace = true
@@ -27,7 +28,9 @@ compass-prs = { path = "../compass-prs", version = "0.3.7" }
 compass-query = { path = "../compass-query", version = "0.3.7" }
 
 [dev-dependencies]
+http-body-util = { workspace = true, features = ["channel"] }
 rmcp = { workspace = true, features = ["client"] }
+sha2.workspace = true
 tempfile.workspace = true
 
 [lints]
diff --git a/crates/compass-mcp/src/code_query.rs b/crates/compass-mcp/src/code_query.rs
index c1ba6fbc7..928905d29 100644
--- a/crates/compass-mcp/src/code_query.rs
+++ b/crates/compass-mcp/src/code_query.rs
@@ -1,8 +1,12 @@
 use std::path::Path;
 
 use compass_model::query_contract::{
-    CallRequest, CodeQueryLimits, CodeQueryResponse, ExploreRequest, ImpactRequest,
-    NodeTrailRequest, SearchRequest,
+    CallRequest, CodeQueryLimits, CodeQueryOperation, CodeQueryResponse, ExploreRequest,
+    ImpactRequest, NodeTrailRequest, QueryDiagnosticCode, SearchRequest,
+};
+use compass_model::{
+    code_graph::{BuildMetadata, EdgeKind, NodeKind, NodeRole},
+    provenance::EvidenceConfidence,
 };
 use compass_query::open;
 use compass_query::{NaturalQueryRequest, QueryErrorKind};
@@ -47,19 +51,472 @@ pub(super) fn schema(required: &[&str]) -> Value {
     })
 }
 
+pub(super) fn output_schema(operation: CodeQueryOperation) -> Value {
+    let operation = serde_json::to_value(operation).unwrap_or(Value::Null);
+    let node_kind = enum_schema(NodeKind::ALL.into_iter().map(NodeKind::as_str));
+    let node_role = enum_schema(NodeRole::ALL.into_iter().map(NodeRole::as_str));
+    let edge_kind = enum_schema(EdgeKind::ALL.into_iter().map(EdgeKind::as_str));
+    let node_details = json!({"oneOf": [
+        tagged_detail("file", "#/$defs/fileNodeDetails"),
+        tagged_detail("symbol", "#/$defs/symbolNodeDetails"),
+        tagged_detail("import_export", "#/$defs/importExportNodeDetails"),
+        tagged_detail("route", "#/$defs/routeNodeDetails"),
+        tagged_detail("component", "#/$defs/componentNodeDetails"),
+        tagged_detail("resource", "#/$defs/resourceNodeDetails"),
+        tagged_detail("messaging", "#/$defs/messagingNodeDetails"),
+        tagged_detail("job", "#/$defs/jobNodeDetails"),
+        tagged_detail("schema", "#/$defs/schemaNodeDetails"),
+        tagged_detail("query", "#/$defs/queryNodeDetails"),
+        tagged_detail("config", "#/$defs/configNodeDetails"),
+        tagged_detail("database", "#/$defs/databaseNodeDetails")
+    ]});
+    let edge_details = json!({"oneOf": [
+        tagged_detail("call", "#/$defs/callEdgeDetails"),
+        tagged_detail("route", "#/$defs/routeEdgeDetails"),
+        tagged_detail("messaging", "#/$defs/messagingEdgeDetails"),
+        tagged_detail("schedule", "#/$defs/scheduleEdgeDetails"),
+        tagged_detail("mapping", "#/$defs/mappingEdgeDetails")
+    ]});
+    json!({
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "additionalProperties": false,
+        "properties": {
+            "schema": {"const": "compass.code_context.v1"},
+            "repository": {"type": "string", "minLength": 1},
+            "generation": {"type": "string", "minLength": 1},
+            "freshness": {
+                "type": "object",
+                "additionalProperties": false,
+                "properties": {
+                    "status": {"enum": ["current", "stale", "unknown"]}
+                },
+                "required": ["status"]
+            },
+            "data": {
+                "type": "object",
+                "additionalProperties": false,
+                "properties": {
+                    "schema": {"const": "compass.query/1"},
+                    "operation": {"const": operation},
+                    "results": {"type": "array", "items": {"$ref": "#/$defs/searchHit"}},
+                    "nodes": {"type": "array", "items": {"$ref": "#/$defs/queryNode"}},
+                    "edges": {"type": "array", "items": {"$ref": "#/$defs/queryEdge"}},
+                    "files": {"type": "array", "items": {"$ref": "#/$defs/queryFile"}},
+                    "paths": {"type": "array", "items": {"$ref": "#/$defs/queryPath"}},
+                    "diagnostics": {"type": "array", "items": {"$ref": "#/$defs/queryDiagnostic"}},
+                    "limits": {"$ref": "#/$defs/limits"},
+                    "truncated": {"type": "boolean"}
+                },
+                "required": [
+                    "schema", "operation", "results", "nodes", "edges", "files",
+                    "paths", "diagnostics", "limits", "truncated"
+                ]
+            },
+            "evidence": {
+                "type": "object",
+                "additionalProperties": false,
+                "properties": {
+                    "records": {"type": "integer", "minimum": 0},
+                    "anchored": {"type": "integer", "minimum": 0}
+                },
+                "required": ["records", "anchored"]
+            },
+            "confidence": {
+                "type": "object",
+                "additionalProperties": false,
+                "properties": {
+                    "exact": {"type": "integer", "minimum": 0},
+                    "inferred": {"type": "integer", "minimum": 0},
+                    "ambiguous": {"type": "integer", "minimum": 0}
+                },
+                "required": ["exact", "inferred", "ambiguous"]
+            },
+            "truncation": {
+                "type": "object",
+                "additionalProperties": false,
+                "properties": {
+                    "truncated": {"type": "boolean"},
+                    "next": {"type": ["string", "null"]}
+                },
+                "required": ["truncated", "next"]
+            },
+            "warnings": {"type": "array", "items": {"$ref": "#/$defs/queryDiagnostic"}}
+        },
+        "required": [
+            "schema", "repository", "generation", "freshness", "data", "evidence",
+            "confidence", "truncation", "warnings"
+        ],
+        "$defs": {
+            "sourceAnchor": {
+                "type": "object",
+                "additionalProperties": false,
+                "properties": {
+                    "file": {"type": "string"},
+                    "startByte": {"type": "integer", "minimum": 0},
+                    "endByte": {"type": "integer", "minimum": 0},
+                    "startLine": {"type": "integer", "minimum": 0},
+                    "startColumn": {"type": "integer", "minimum": 0},
+                    "endLine": {"type": "integer", "minimum": 0},
+                    "endColumn": {"type": "integer", "minimum": 0}
+                },
+                "required": ["file", "startByte", "endByte", "startLine", "startColumn", "endLine", "endColumn"]
+            },
+            "resolutionCandidate": {
+                "type": "object",
+                "additionalProperties": false,
+                "properties": {
+                    "nodeId": {"type": "string"},
+                    "reason": {"type": "string"},
+                    "confidence": {"enum": ["exact", "inferred", "ambiguous"]},
+                    "score": {"type": ["number", "null"]},
+                    "anchor": {"anyOf": [{"$ref": "#/$defs/sourceAnchor"}, {"type": "null"}]}
+                },
+                "required": ["nodeId", "reason", "confidence"]
+            },
+            "queryEvidence": {
+                "type": "object",
+                "additionalProperties": false,
+                "properties": {
+                    "layer": {"enum": ["structural_graph", "program_ir"]},
+                    "origin": {"enum": ["ast", "config", "convention", "artifact", "heuristic"]},
+                    "extractor": {"type": "string"},
+                    "confidence": {"enum": ["exact", "inferred", "ambiguous"]},
+                    "anchor": {"anyOf": [{"$ref": "#/$defs/sourceAnchor"}, {"type": "null"}]},
+                    "rule": {"type": ["string", "null"]},
+                    "wiringSite": {"anyOf": [{"$ref": "#/$defs/sourceAnchor"}, {"type": "null"}]},
+                    "resolution": {"enum": ["exact", "ambiguous", "unresolved"]},
+                    "candidates": {"type": "array", "items": {"$ref": "#/$defs/resolutionCandidate"}}
+                },
+                "required": ["layer", "origin", "extractor", "confidence", "anchor", "rule", "wiringSite", "resolution"]
+            },
+            "searchHit": {
+                "type": "object",
+                "additionalProperties": false,
+                "properties": {
+                    "nodeId": {"type": "string"},
+                    "score": {"type": "number"},
+                    "matchedFields": {"type": "array", "items": {"type": "string"}}
+                },
+                "required": ["nodeId", "score", "matchedFields"]
+            },
+            "queryNode": {
+                "type": "object",
+                "additionalProperties": false,
+                "properties": {
+                    "id": {"type": "string"},
+                    "kind": node_kind,
+                    "roles": {"type": "array", "items": node_role},
+                    "name": {"type": "string"},
+                    "qualifiedName": {"type": "string"},
+                    "language": {"type": ["string", "null"]},
+                    "framework": {"type": ["string", "null"]},
+                    "source": {"anyOf": [{"$ref": "#/$defs/sourceAnchor"}, {"type": "null"}]},
+                    "details": {"anyOf": [node_details, {"type": "null"}]},
+                    "evidence": {"type": "array", "items": {"$ref": "#/$defs/queryEvidence"}}
+                },
+                "required": ["id", "kind", "roles", "name", "qualifiedName", "language", "framework", "source", "details", "evidence"]
+            },
+            "queryEdge": {
+                "type": "object",
+                "additionalProperties": false,
+                "properties": {
+                    "id": {"type": "string"},
+                    "source": {"type": "string"},
+                    "target": {"type": "string"},
+                    "kind": edge_kind,
+                    "relationshipSite": {"anyOf": [{"$ref": "#/$defs/sourceAnchor"}, {"type": "null"}]},
+                    "details": {"anyOf": [edge_details, {"type": "null"}]},
+                    "evidence": {"type": "array", "items": {"$ref": "#/$defs/queryEvidence"}}
+                },
+                "required": ["id", "source", "target", "kind", "relationshipSite", "details", "evidence"]
+            },
+            "queryFile": {
+                "type": "object",
+                "additionalProperties": false,
+                "properties": {
+                    "path": {"type": "string"},
+                    "contentDigest": {"type": "string"},
+                    "source": {"type": ["string", "null"]},
+                    "truncated": {"type": "boolean"}
+                },
+                "required": ["path", "contentDigest", "source", "truncated"]
+            },
+            "queryPath": {
+                "type": "object",
+                "additionalProperties": false,
+                "properties": {
+                    "id": {"type": "string"},
+                    "nodeIds": {"type": "array", "items": {"type": "string"}},
+                    "edgeIds": {"type": "array", "items": {"type": "string"}},
+                    "weakestResolution": {"enum": ["exact", "ambiguous", "unresolved"]},
+                    "weakestConfidence": {"enum": ["exact", "inferred", "ambiguous"]}
+                },
+                "required": ["id", "nodeIds", "edgeIds", "weakestResolution", "weakestConfidence"]
+            },
+            "queryDiagnostic": {
+                "type": "object",
+                "additionalProperties": false,
+                "properties": {
+                    "code": {"enum": ["no_match", "ambiguous_match", "direction_mismatch", "unresolved_handler", "incomplete_coverage", "stale_source_digest", "bounded_truncation", "program_orphan", "program_conflict", "program_unavailable"]},
+                    "message": {"type": "string"},
+                    "nodeId": {"type": ["string", "null"]},
+                    "path": {"type": ["string", "null"]}
+                },
+                "required": ["code", "message", "nodeId", "path"]
+            },
+            "limits": {
+                "type": "object",
+                "additionalProperties": false,
+                "properties": {
+                    "maxDepth": {"type": "integer", "minimum": 1},
+                    "maxNodes": {"type": "integer", "minimum": 1},
+                    "maxEdges": {"type": "integer", "minimum": 1},
+                    "maxPaths": {"type": "integer", "minimum": 1},
+                    "maxCandidates": {"type": "integer", "minimum": 1},
+                    "maxSourceBytes": {"type": "integer", "minimum": 1},
+                    "maxResponseBytes": {"type": "integer", "minimum": 1}
+                },
+                "required": ["maxDepth", "maxNodes", "maxEdges", "maxPaths", "maxCandidates", "maxSourceBytes", "maxResponseBytes"]
+            },
+            "fileNodeDetails": {
+                "type": "object", "additionalProperties": false,
+                "properties": {
+                    "contentDigest": {"type": "string"},
+                    "byteSize": {"type": "integer", "minimum": 0},
+                    "generated": {"type": "boolean"}
+                },
+                "required": ["contentDigest", "byteSize", "generated"]
+            },
+            "symbolNodeDetails": {
+                "type": "object", "additionalProperties": false,
+                "properties": {
+                    "signature": {"type": "string"},
+                    "modifiers": {"type": "array", "items": {"type": "string"}},
+                    "overloadDiscriminator": {"type": "string"},
+                    "declaringType": {"type": "string"},
+                    "signatureDigest": {"type": "string"},
+                    "implementationDigest": {"type": "string"},
+                    "sourceDigest": {"type": "string"}
+                }
+            },
+            "importExportNodeDetails": {
+                "type": "object", "additionalProperties": false,
+                "properties": {
+                    "specifier": {"type": "string"},
+                    "importedName": {"type": "string"},
+                    "localName": {"type": "string"},
+                    "typeOnly": {"type": "boolean"}
+                },
+                "required": ["specifier", "typeOnly"]
+            },
+            "routeStageDetails": {
+                "type": "object", "additionalProperties": false,
+                "properties": {
+                    "stage": {"enum": ["middleware", "handler"]},
+                    "position": {"type": "integer", "minimum": 0},
+                    "reference": {"type": "string"},
+                    "resolution": {"enum": ["exact", "ambiguous", "unresolved"]},
+                    "target": {"type": "string"},
+                    "candidates": {"type": "array", "items": {"$ref": "#/$defs/resolutionCandidate"}}
+                },
+                "required": ["stage", "position", "reference", "resolution"]
+            },
+            "routeNodeDetails": {
+                "type": "object", "additionalProperties": false,
+                "properties": {
+                    "operation": {"type": "string"},
+                    "path": {"type": "string"},
+                    "originalPath": {"type": "string"},
+                    "declaringScope": {"type": "string"},
+                    "resolution": {"enum": ["exact", "ambiguous", "unresolved"]},
+                    "middlewareCount": {"type": "integer", "minimum": 0},
+                    "stages": {"type": "array", "items": {"$ref": "#/$defs/routeStageDetails"}}
+                },
+                "required": ["operation", "path", "declaringScope", "resolution", "middlewareCount"]
+            },
+            "componentNodeDetails": {
+                "type": "object", "additionalProperties": false,
+                "properties": {"componentType": {"type": "string"}},
+                "required": ["componentType"]
+            },
+            "resourceNodeDetails": {
+                "type": "object", "additionalProperties": false,
+                "properties": {
+                    "resourceKind": {"enum": ["document", "paper", "image", "concept", "rationale"]},
+                    "uri": {"type": "string"},
+                    "mediaType": {"type": "string"}
+                },
+                "required": ["resourceKind"]
+            },
+            "messagingNodeDetails": {
+                "type": "object", "additionalProperties": false,
+                "properties": {
+                    "transport": {"type": "string"},
+                    "subject": {"type": "string"},
+                    "declaringScope": {"type": "string"}
+                },
+                "required": ["transport", "subject", "declaringScope"]
+            },
+            "jobNodeDetails": {
+                "type": "object", "additionalProperties": false,
+                "properties": {"schedule": {"type": "string"}, "queue": {"type": "string"}}
+            },
+            "schemaNodeDetails": {
+                "type": "object", "additionalProperties": false,
+                "properties": {
+                    "dialect": {"type": "string"},
+                    "logicalDatabase": {"type": "string"},
+                    "namespace": {"type": "string"}
+                }
+            },
+            "queryNodeDetails": {
+                "type": "object", "additionalProperties": false,
+                "properties": {
+                    "dialect": {"type": "string"},
+                    "operation": {"type": "string"},
+                    "textDigest": {"type": "string"}
+                }
+            },
+            "configNodeDetails": {
+                "type": "object", "additionalProperties": false,
+                "properties": {"format": {"type": "string"}, "keyPath": {"type": "string"}},
+                "required": ["format", "keyPath"]
+            },
+            "databaseNodeDetails": {
+                "type": "object", "additionalProperties": false,
+                "properties": {
+                    "logicalDatabase": {"type": "string"},
+                    "databaseSchema": {"type": "string"}
+                },
+                "required": ["logicalDatabase"]
+            },
+            "callEdgeDetails": {
+                "type": "object", "additionalProperties": false,
+                "properties": {
+                    "dispatch": {"enum": ["static", "virtual", "dynamic"]},
+                    "receiverType": {"type": "string"},
+                    "argumentCount": {"type": "integer", "minimum": 0}
+                },
+                "required": ["dispatch"]
+            },
+            "routeEdgeDetails": {
+                "type": "object", "additionalProperties": false,
+                "properties": {
+                    "stage": {"enum": ["middleware", "handler"]},
+                    "position": {"type": "integer", "minimum": 0},
+                    "operation": {"type": "string"}
+                },
+                "required": ["stage"]
+            },
+            "messagingEdgeDetails": {
+                "type": "object", "additionalProperties": false,
+                "properties": {"transport": {"type": "string"}, "subject": {"type": "string"}},
+                "required": ["transport", "subject"]
+            },
+            "scheduleEdgeDetails": {
+                "type": "object", "additionalProperties": false,
+                "properties": {"expression": {"type": "string"}}
+            },
+            "mappingEdgeDetails": {
+                "type": "object", "additionalProperties": false,
+                "properties": {"mappingKind": {"type": "string"}},
+                "required": ["mappingKind"]
+            }
+        }
+    })
+}
+
+fn tagged_detail(kind: &str, data_reference: &str) -> Value {
+    json!({
+        "type": "object",
+        "additionalProperties": false,
+        "properties": {
+            "type": {"const": kind},
+            "data": {"$ref": data_reference}
+        },
+        "required": ["type", "data"]
+    })
+}
+
+fn enum_schema<'a>(values: impl Iterator<Item = &'a str>) -> Value {
+    json!({"enum": values.collect::<Vec<_>>()})
+}
+
+pub(super) fn envelope(
+    response: &CodeQueryResponse,
+    build: &BuildMetadata,
+) -> Result<Value, serde_json::Error> {
+    let evidence = response
+        .nodes
+        .iter()
+        .flat_map(|node| node.evidence.iter())
+        .chain(response.edges.iter().flat_map(|edge| edge.evidence.iter()));
+    let mut records = 0_u64;
+    let mut anchored = 0_u64;
+    let mut exact = 0_u64;
+    let mut inferred = 0_u64;
+    let mut ambiguous = 0_u64;
+    for item in evidence {
+        records = records.saturating_add(1);
+        if item.anchor.is_some() || item.wiring_site.is_some() {
+            anchored = anchored.saturating_add(1);
+        }
+        match item.confidence {
+            EvidenceConfidence::Exact => exact = exact.saturating_add(1),
+            EvidenceConfidence::Inferred => inferred = inferred.saturating_add(1),
+            EvidenceConfidence::Ambiguous => ambiguous = ambiguous.saturating_add(1),
+        }
+    }
+    let freshness = if response
+        .diagnostics
+        .iter()
+        .any(|diagnostic| diagnostic.code == QueryDiagnosticCode::StaleSourceDigest)
+    {
+        "stale"
+    } else if response.files.is_empty() {
+        "unknown"
+    } else {
+        "current"
+    };
+    Ok(json!({
+        "schema": "compass.code_context.v1",
+        "repository": build.source_tree_digest,
+        "generation": build.generation_id,
+        "freshness": {"status": freshness},
+        "data": response,
+        "evidence": {"records": records, "anchored": anchored},
+        "confidence": {
+            "exact": exact,
+            "inferred": inferred,
+            "ambiguous": ambiguous
+        },
+        "truncation": {"truncated": response.truncated, "next": Value::Null},
+        "warnings": response.diagnostics
+    }))
+}
+
+pub(super) struct InvocationOutput {
+    pub response: CodeQueryResponse,
+    pub build: BuildMetadata,
+}
+
 pub(super) fn invoke(
     name: &str,
     arguments: &Map<String, Value>,
     graph_path: &Path,
-) -> Result<CodeQueryResponse, super::InvocationError> {
+) -> Result<InvocationOutput, super::InvocationError> {
     let cache = graph_path
         .parent()
         .unwrap_or_else(|| Path::new("."))
         .join("cache");
     let engine = open(graph_path, None, &cache)
         .map_err(|error| super::InvocationError::Internal(error.to_string()))?;
+    let build = engine
+        .build_metadata()
+        .map_err(|error| super::InvocationError::Internal(error.to_string()))?;
     let limits = limits(arguments)?;
-    match name {
+    let response = match name {
         "query_graph" => engine.query_natural(NaturalQueryRequest {
             question: required_string(arguments, "question")?,
             include_heuristic: false,
@@ -122,7 +579,8 @@ pub(super) fn invoke(
             super::InvocationError::InvalidParams(error.to_string())
         }
         _ => super::InvocationError::Internal(error.to_string()),
-    })
+    })?;
+    Ok(InvocationOutput { response, build })
 }
 
 fn limits(arguments: &Map<String, Value>) -> Result<CodeQueryLimits, String> {
diff --git a/crates/compass-mcp/src/lib.rs b/crates/compass-mcp/src/lib.rs
index 22ee36ecb..cbdba2214 100644
--- a/crates/compass-mcp/src/lib.rs
+++ b/crates/compass-mcp/src/lib.rs
@@ -5,6 +5,16 @@ mod transport;
 
 pub use transport::{HttpOptions, serve_http, serve_stdio};
 
+/// MCP protocol version accepted by the native Compass transports.
+pub const SUPPORTED_PROTOCOL_VERSION: &str = "2026-07-28";
+
+/// Return whether the native transports accept the supplied MCP protocol.
+#[must_use]
+pub fn supports_protocol(version: &str) -> bool {
+    version == SUPPORTED_PROTOCOL_VERSION
+}
+
+use std::borrow::Cow;
 use std::collections::{BTreeMap, HashMap, HashSet, VecDeque};
 use std::fs;
 use std::fs::OpenOptions;
@@ -16,6 +26,7 @@ use std::time::{Duration, Instant};
 
 use compass_core::LoadedGraph;
 use compass_graph::{Communities, god_nodes, suggest_questions, surprising_connections};
+use compass_model::query_contract::CodeQueryOperation;
 use compass_model::{Graph, GraphDocument, NodeIndex};
 use compass_prs::{
     ProcessRunner, SystemRunner, compute_pr_impact, detect_default_branch, fetch_pr_files,
@@ -26,9 +37,11 @@ use compass_query::{
     sanitize_label, score_nodes,
 };
 use rmcp::model::{
-    CallToolRequestParams, CallToolResult, ContentBlock, ErrorData, Implementation,
-    ListResourcesResult, ListToolsResult, PaginatedRequestParams, ReadResourceRequestParams,
-    ReadResourceResult, Resource, ResourceContents, ServerCapabilities, ServerInfo, Tool,
+    CacheScope, CallToolRequestParams, CallToolResponse, CallToolResult, ContentBlock, ErrorCode,
+    ErrorData, Implementation, InitializeRequestParams, InitializeResult, ListPromptsResult,
+    ListResourcesResult, ListToolsResult, MetaObject, PaginatedRequestParams, ProtocolVersion,
+    ReadResourceRequestParams, ReadResourceResponse, ReadResourceResult, Resource,
+    ResourceContents, ServerCapabilities, ServerInfo, Tool,
 };
 use rmcp::service::RequestContext;
 use rmcp::{RoleServer, ServerHandler};
@@ -88,7 +101,7 @@ struct GraphContext {
 impl GraphContext {
     fn load(path: &Path) -> Result<Self, String> {
         let loaded = LoadedGraph::load_directed(path).map_err(|error| error.to_string())?;
-        let typed_query_supported = GraphDocument::load(path).is_ok();
+        let typed_query_supported = compass_model::code_graph::GraphDocument::load(path).is_ok();
         let mut communities = BTreeMap::<usize, Vec<NodeIndex>>::new();
         for (index, node) in loaded.graph.nodes() {
             if let Some(community) = node
@@ -213,6 +226,13 @@ impl GraphStore {
 #[derive(Clone, Debug)]
 pub struct CompassMcp {
     store: GraphStore,
+    protocol_profile: ProtocolProfile,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+enum ProtocolProfile {
+    Stdio2026,
+    Http2026,
 }
 
 impl CompassMcp {
@@ -220,6 +240,14 @@ impl CompassMcp {
     pub fn new(graph_path: impl Into<PathBuf>) -> Self {
         Self {
             store: GraphStore::new(graph_path),
+            protocol_profile: ProtocolProfile::Stdio2026,
+        }
+    }
+
+    pub(crate) fn new_http(graph_path: impl Into<PathBuf>) -> Self {
+        Self {
+            store: GraphStore::new(graph_path),
+            protocol_profile: ProtocolProfile::Http2026,
         }
     }
 
@@ -253,6 +281,22 @@ impl CompassMcp {
 }
 
 impl ServerHandler for CompassMcp {
+    fn initialize(
+        &self,
+        _request: InitializeRequestParams,
+        _context: RequestContext<RoleServer>,
+    ) -> impl Future<Output = Result<InitializeResult, ErrorData>> + Send + '_ {
+        std::future::ready(Err(ErrorData::new(
+            ErrorCode::METHOD_NOT_FOUND,
+            "initialize is not available in MCP 2026-07-28; use server/discover",
+            None,
+        )))
+    }
+
+    fn supported_protocol_versions(&self) -> Cow<'static, [ProtocolVersion]> {
+        Cow::Borrowed(&[ProtocolVersion::V_2026_07_28])
+    }
+
     fn get_info(&self) -> ServerInfo {
         let mut capabilities = ServerCapabilities::builder()
             .enable_experimental()
@@ -266,6 +310,12 @@ impl ServerHandler for CompassMcp {
         if let Some(tools) = capabilities.tools.as_mut() {
             tools.list_changed = Some(false);
         }
+        if self.protocol_profile == ProtocolProfile::Http2026 {
+            capabilities.prompts = Some(Default::default());
+            if let Some(prompts) = capabilities.prompts.as_mut() {
+                prompts.list_changed = Some(false);
+            }
+        }
         ServerInfo::new(capabilities)
             .with_server_info(Implementation::new(SERVER_NAME, env!("CARGO_PKG_VERSION")))
     }
@@ -275,14 +325,19 @@ impl ServerHandler for CompassMcp {
         _request: Option<PaginatedRequestParams>,
         _context: RequestContext<RoleServer>,
     ) -> Result<ListToolsResult, ErrorData> {
-        Ok(ListToolsResult::with_all_items(tool_specs()))
+        let result = ListToolsResult::with_all_items(tool_specs());
+        Ok(if self.protocol_profile == ProtocolProfile::Http2026 {
+            result.with_ttl_ms(0).with_cache_scope(CacheScope::Private)
+        } else {
+            result
+        })
     }
 
     async fn call_tool(
         &self,
         request: CallToolRequestParams,
         _context: RequestContext<RoleServer>,
-    ) -> Result<CallToolResult, ErrorData> {
+    ) -> Result<CallToolResponse, ErrorData> {
         let mut arguments = request.arguments.unwrap_or_default();
         let result = self
             .invoke_result(&request.name, &mut arguments)
@@ -292,7 +347,7 @@ impl ServerHandler for CompassMcp {
             CallToolResult::structured,
         );
         response.content = vec![ContentBlock::text(result.text)];
-        Ok(response)
+        Ok(response.into())
     }
 
     async fn list_resources(
@@ -300,25 +355,51 @@ impl ServerHandler for CompassMcp {
         _request: Option<PaginatedRequestParams>,
         _context: RequestContext<RoleServer>,
     ) -> Result<ListResourcesResult, ErrorData> {
-        Ok(ListResourcesResult::with_all_items(resource_specs()))
+        let result = ListResourcesResult::with_all_items(resource_specs());
+        Ok(if self.protocol_profile == ProtocolProfile::Http2026 {
+            result.with_ttl_ms(0).with_cache_scope(CacheScope::Private)
+        } else {
+            result
+        })
+    }
+
+    async fn list_prompts(
+        &self,
+        _request: Option<PaginatedRequestParams>,
+        _context: RequestContext<RoleServer>,
+    ) -> Result<ListPromptsResult, ErrorData> {
+        let result = ListPromptsResult::with_all_items(Vec::new());
+        Ok(if self.protocol_profile == ProtocolProfile::Http2026 {
+            result.with_ttl_ms(0).with_cache_scope(CacheScope::Private)
+        } else {
+            result
+        })
     }
 
     async fn read_resource(
         &self,
         request: ReadResourceRequestParams,
         _context: RequestContext<RoleServer>,
-    ) -> Result<ReadResourceResult, ErrorData> {
+    ) -> Result<ReadResourceResponse, ErrorData> {
+        let uri = request.uri;
         let text = self
-            .read(&request.uri)
-            .map_err(|error| ErrorData::invalid_params(error, None))?;
-        let mime = if request.uri == "compass://report" {
+            .read(&uri)
+            .map_err(|error| ErrorData::invalid_params(error, Some(json!({"uri": uri.clone()}))))?;
+        let mime = if uri == "compass://report" {
             "text/markdown"
         } else {
             "text/plain"
         };
-        Ok(ReadResourceResult::new(vec![
-            ResourceContents::text(text, request.uri).with_mime_type(mime),
-        ]))
+        let result =
+            ReadResourceResult::new(vec![ResourceContents::text(text, uri).with_mime_type(mime)]);
+        Ok(if self.protocol_profile == ProtocolProfile::Http2026 {
+            result
+                .with_ttl_ms(0)
+                .with_cache_scope(CacheScope::Private)
+                .into()
+        } else {
+            result.into()
+        })
     }
 }
 
@@ -357,7 +438,8 @@ impl CompassMcp {
             && should_route_natural_query(arguments, &context)?);
         if typed_query {
             let started = Instant::now();
-            let response = code_query::invoke(name, arguments, &context.path)?;
+            let invoked = code_query::invoke(name, arguments, &context.path)?;
+            let response = invoked.response;
             let text = format!(
                 "{:?}: {} nodes, {} edges, {} paths{}",
                 response.operation,
@@ -375,12 +457,18 @@ impl CompassMcp {
             {
                 log_typed_mcp_query(question, &context.path, &response, started.elapsed());
             }
+            let structured_content = if core_navigation_tool(name) {
+                let envelope = code_query::envelope(&response, &invoked.build)
+                    .map_err(|error| InvocationError::Internal(error.to_string()))?;
+                enforce_structured_response_size(&envelope, response.limits.max_response_bytes)?;
+                envelope
+            } else {
+                serde_json::to_value(response)
+                    .map_err(|error| InvocationError::Internal(error.to_string()))?
+            };
             return Ok(ToolInvocation {
                 text,
-                structured_content: Some(
-                    serde_json::to_value(response)
-                        .map_err(|error| InvocationError::Internal(error.to_string()))?,
-                ),
+                structured_content: Some(structured_content),
             });
         }
         Ok(ToolInvocation {
@@ -421,25 +509,29 @@ fn tool_specs() -> Vec<Tool> {
         "description": "Absolute path to a project directory containing compass-out/graph.json. Optional — defaults to the graph this server was started with."
     });
     let mut specs = vec![
-        tool(
+        typed_navigation_tool(
             "search_symbols",
             "Search Compass code symbols with the trusted FTS5 index.",
             code_query::schema(&["query"]),
+            CodeQueryOperation::Search,
         ),
-        tool(
+        typed_navigation_tool(
             "get_callers",
             "Return one-hop callers and route bindings for a symbol.",
             code_query::schema(&["symbol"]),
+            CodeQueryOperation::Callers,
         ),
-        tool(
+        typed_navigation_tool(
             "get_callees",
             "Return one-hop callees for a symbol.",
             code_query::schema(&["symbol"]),
+            CodeQueryOperation::Callees,
         ),
-        tool(
+        typed_navigation_tool(
             "get_impact",
             "Return the bounded transitive impact radius for a symbol.",
             code_query::schema(&["symbol"]),
+            CodeQueryOperation::Impact,
         ),
         tool(
             "explore_code",
@@ -453,7 +545,7 @@ fn tool_specs() -> Vec<Tool> {
         ),
         tool(
             "query_graph",
-            "Route clear natural-language intents through bounded typed code queries; use explicit traversal controls for BFS/DFS text context.",
+            "Route clear natural-language intents through bounded typed code queries. DEPRECATED text mode: explicit BFS/DFS traversal controls return legacy text; use the typed navigation tools.",
             json!({"type":"object","properties":{
                 "question":{"type":"string","description":"Natural language question or keyword search"},
                 "mode":{"type":"string","enum":["bfs","dfs"],"default":"bfs","description":"bfs=broad context, dfs=trace a specific path"},
@@ -464,46 +556,67 @@ fn tool_specs() -> Vec<Tool> {
         ),
         tool(
             "get_neighbors",
-            "Get all direct neighbors of a node with edge details.",
+            "DEPRECATED text result: get direct neighbors of a node with edge details; use typed navigation tools for machine-readable evidence.",
             json!({"type":"object","properties":{"label":{"type":"string"},"relation_filter":{"type":"string","description":"Optional: filter by relation type"}},"required":["label"]}),
         ),
         tool(
             "get_community",
-            "Get all nodes in a community by community ID.",
+            "DEPRECATED text result: get nodes in a community; a typed replacement is pending.",
             json!({"type":"object","properties":{"community_id":{"type":"integer","description":"Community ID (0-indexed by size)"}},"required":["community_id"]}),
         ),
         tool(
             "god_nodes",
-            "Return the most connected nodes - the core abstractions of the knowledge graph.",
+            "DEPRECATED text result: return the most connected nodes; a typed replacement is pending.",
             json!({"type":"object","properties":{"top_n":{"type":"integer","default":10}}}),
         ),
         tool(
             "graph_stats",
-            "Return summary statistics: node count, edge count, communities, confidence breakdown.",
+            "DEPRECATED text result: return graph summary statistics; a typed replacement is pending.",
             json!({"type":"object","properties":{}}),
         ),
         tool(
             "shortest_path",
-            "Find the shortest path between two concepts in the knowledge graph.",
+            "DEPRECATED text result: find a shortest path; use get_node for typed directed evidence.",
             json!({"type":"object","properties":{"source":{"type":"string","description":"Source concept label or keyword"},"target":{"type":"string","description":"Target concept label or keyword"},"max_hops":{"type":"integer","default":8,"description":"Maximum hops to consider"}},"required":["source","target"]}),
         ),
         tool(
             "list_prs",
-            "List open GitHub PRs with CI status, review state, and graph impact (which communities each PR touches, blast radius). Use this before starting work to check if a PR already covers the area you're about to change.",
+            "DEPRECATED text result: list open GitHub PRs with CI, review, and graph-impact context; a typed replacement is pending.",
             json!({"type":"object","properties":{"base":{"type":"string","description":"Base branch to filter PRs by (auto-detected if omitted)"},"repo":{"type":"string","description":"GitHub repo (owner/repo). Defaults to current repo."}}}),
         ),
         tool(
             "get_pr_impact",
-            "Get detailed graph impact for a specific PR: which files it changes, which knowledge-graph communities are affected, and how many nodes are touched. Use this to assess merge risk or check for overlap with your current work.",
+            "DEPRECATED text result: get graph impact for a pull request; use get_impact for typed symbol impact or await the typed PR replacement.",
             json!({"type":"object","properties":{"pr_number":{"type":"integer","description":"PR number to analyse"},"repo":{"type":"string","description":"GitHub repo (owner/repo). Defaults to current repo."}},"required":["pr_number"]}),
         ),
         tool(
             "triage_prs",
-            "Return all actionable open PRs (correct base, not stale) with full graph impact data so you can reason about review priority, merge order, and conflict risk. Call this when the user asks 'what PRs should I review?' or 'what's ready to merge?'",
+            "DEPRECATED text result: triage actionable open pull requests; a typed replacement is pending.",
             json!({"type":"object","properties":{"base":{"type":"string","description":"Base branch to filter PRs by (auto-detected if omitted)"},"repo":{"type":"string","description":"GitHub repo (owner/repo). Defaults to current repo."}}}),
         ),
     ];
     for spec in &mut specs {
+        if legacy_text_tool(spec.name.as_ref()) {
+            spec.meta = Some(MetaObject(Map::from_iter([
+                ("compass/deprecated".to_owned(), Value::Bool(true)),
+                (
+                    "compass/deprecatedSince".to_owned(),
+                    Value::String("0.4.0".to_owned()),
+                ),
+                (
+                    "compass/deprecationReason".to_owned(),
+                    Value::String("legacy text result; use a typed navigation result".to_owned()),
+                ),
+            ])));
+        } else if spec.name == "query_graph" {
+            spec.meta = Some(MetaObject(Map::from_iter([
+                ("compass/deprecatedTextMode".to_owned(), Value::Bool(true)),
+                (
+                    "compass/deprecatedSince".to_owned(),
+                    Value::String("0.4.0".to_owned()),
+                ),
+            ])));
+        }
         Arc::make_mut(&mut spec.input_schema)
             .entry("properties".to_owned())
             .or_insert_with(|| Value::Object(Map::new()));
@@ -522,6 +635,53 @@ fn tool(name: &'static str, description: &'static str, schema: Value) -> Tool {
     Tool::new(name, description, object)
 }
 
+fn typed_navigation_tool(
+    name: &'static str,
+    description: &'static str,
+    input_schema: Value,
+    operation: CodeQueryOperation,
+) -> Tool {
+    let input = input_schema.as_object().cloned().unwrap_or_default();
+    let output = code_query::output_schema(operation)
+        .as_object()
+        .cloned()
+        .unwrap_or_default();
+    Tool::new(name, description, input).with_raw_output_schema(Arc::new(output))
+}
+
+fn core_navigation_tool(name: &str) -> bool {
+    matches!(
+        name,
+        "search_symbols" | "get_callers" | "get_callees" | "get_impact"
+    )
+}
+
+fn legacy_text_tool(name: &str) -> bool {
+    matches!(
+        name,
+        "get_neighbors"
+            | "get_community"
+            | "god_nodes"
+            | "graph_stats"
+            | "shortest_path"
+            | "list_prs"
+            | "get_pr_impact"
+            | "triage_prs"
+    )
+}
+
+fn enforce_structured_response_size(value: &Value, maximum: u64) -> Result<(), InvocationError> {
+    let actual = serde_json::to_vec(value)
+        .map_err(|error| InvocationError::Internal(error.to_string()))?
+        .len() as u64;
+    if actual > maximum {
+        return Err(InvocationError::Internal(format!(
+            "query_response_too_large: query response is {actual} bytes after MCP envelope encoding; limit is {maximum}"
+        )));
+    }
+    Ok(())
+}
+
 fn resource_specs() -> Vec<Resource> {
     [
         (
diff --git a/crates/compass-mcp/src/transport.rs b/crates/compass-mcp/src/transport.rs
index 5613d81e5..d0e4fc952 100644
--- a/crates/compass-mcp/src/transport.rs
+++ b/crates/compass-mcp/src/transport.rs
@@ -3,7 +3,7 @@ use std::sync::Arc;
 use std::time::Duration;
 
 use axum::Router;
-use axum::body::{Body, to_bytes};
+use axum::body::{Body, HttpBody};
 use axum::extract::{Request, State};
 use axum::http::{HeaderValue, Method, StatusCode, header};
 use axum::middleware::{self, Next};
@@ -16,7 +16,7 @@ use tokio::io::{AsyncBufReadExt, AsyncReadExt, AsyncWriteExt, BufReader};
 use tokio_util::sync::CancellationToken;
 use tower_http::limit::RequestBodyLimitLayer;
 
-use crate::CompassMcp;
+use crate::{CompassMcp, SUPPORTED_PROTOCOL_VERSION, supports_protocol};
 
 const MAX_HTTP_REQUEST_BYTES: usize = 16 * 1024 * 1024;
 const MAX_HTTP_RESPONSE_BYTES: usize = 64 * 1024 * 1024;
@@ -45,8 +45,8 @@ impl HttpOptions {
             api_key: None,
             path: "/mcp".to_owned(),
             json_response: false,
-            stateless: false,
-            session_timeout: Some(Duration::from_secs(3600)),
+            stateless: true,
+            session_timeout: None,
         }
     }
 }
@@ -54,7 +54,7 @@ impl HttpOptions {
 #[derive(Clone)]
 struct HttpGate {
     api_key: Option<Arc<[u8]>>,
-    convert_stateful_sse_to_json: bool,
+    allowed_hosts: Arc<[String]>,
 }
 
 /// Serve MCP over stdio while tolerating blank lines sent by desktop clients.
@@ -155,22 +155,23 @@ pub async fn serve_http(mut options: HttpOptions) -> Result<(), String> {
 }
 
 fn build_http_router(options: &HttpOptions, cancellation: &CancellationToken) -> Router {
-    let mut manager = LocalSessionManager::default();
-    manager.session_config.keep_alive = if options.stateless {
-        None
+    let manager = Arc::new(LocalSessionManager::default());
+    let factory_graph = CompassMcp::new_http(options.graph_path.clone());
+    let allowed_hosts = if is_wildcard_host(&options.host) {
+        Vec::new()
     } else {
-        options.session_timeout.filter(|timeout| !timeout.is_zero())
+        allowed_hosts(&options.host, options.port)
     };
-    let manager = Arc::new(manager);
-    let factory_graph = CompassMcp::new(options.graph_path.clone());
     let mut config = StreamableHttpServerConfig::default()
-        .with_stateful_mode(!options.stateless)
+        .with_legacy_session_mode(false)
+        .with_stateless_protocol_metadata_required(true)
         .with_json_response(options.json_response)
+        .with_max_request_body_bytes(MAX_HTTP_REQUEST_BYTES)
         .with_cancellation_token(cancellation.child_token());
     if is_wildcard_host(&options.host) {
         config = config.disable_allowed_hosts();
     } else {
-        config = config.with_allowed_hosts(allowed_hosts(&options.host, options.port));
+        config = config.with_allowed_hosts(allowed_hosts.clone());
     }
     let service = StreamableHttpService::new(move || Ok(factory_graph.clone()), manager, config);
     let gate = HttpGate {
@@ -178,17 +179,42 @@ fn build_http_router(options: &HttpOptions, cancellation: &CancellationToken) ->
             .api_key
             .as_ref()
             .map(|key| Arc::<[u8]>::from(key.as_bytes())),
-        // rmcp 2.2 emits SSE for stateful responses even when json_response is
-        // requested. The Python SDK returns plain JSON, so adapt that response.
-        convert_stateful_sse_to_json: options.json_response && !options.stateless,
+        allowed_hosts: allowed_hosts.into(),
     };
     Router::new()
         .route_service(&options.path, service)
         .layer(RequestBodyLimitLayer::new(MAX_HTTP_REQUEST_BYTES))
+        .layer(middleware::from_fn(bound_http_response))
         .layer(middleware::from_fn_with_state(gate, http_gate))
 }
 
-async fn http_gate(State(gate): State<HttpGate>, request: Request, next: Next) -> Response {
+async fn bound_http_response(request: Request, next: Next) -> Response {
+    enforce_response_limit(next.run(request).await, MAX_HTTP_RESPONSE_BYTES)
+}
+
+fn enforce_response_limit(response: Response, limit: usize) -> Response {
+    if response.body().size_hint().lower() > limit as u64 {
+        return (
+            StatusCode::INTERNAL_SERVER_ERROR,
+            [(header::CONTENT_TYPE, "application/json")],
+            serde_json::json!({
+                "jsonrpc": "2.0",
+                "id": serde_json::Value::Null,
+                "error": {
+                    "code": -32023,
+                    "message": "MCP HTTP response exceeds the configured limit"
+                }
+            })
+            .to_string(),
+        )
+            .into_response();
+    }
+    let (parts, body) = response.into_parts();
+    let limited = http_body_util::Limited::new(body, limit);
+    Response::from_parts(parts, Body::new(limited))
+}
+
+async fn http_gate(State(gate): State<HttpGate>, mut request: Request, next: Next) -> Response {
     if let Some(expected) = &gate.api_key {
         let provided = request
             .headers()
@@ -204,12 +230,170 @@ async fn http_gate(State(gate): State<HttpGate>, request: Request, next: Next) -
                 .into_response();
         }
     }
-    let method = request.method().clone();
-    let response = next.run(request).await;
-    if gate.convert_stateful_sse_to_json && method == Method::POST {
-        return sse_response_to_json(response).await;
+    if let Some(response) = host_rejection(&request, &gate.allowed_hosts) {
+        return response;
+    }
+    if request.method() == Method::POST {
+        normalize_header(&mut request, "mcp-protocol-version");
+        normalize_header(&mut request, "mcp-method");
+        normalize_header(&mut request, "mcp-name");
+        let protocol_version = request
+            .headers()
+            .get("mcp-protocol-version")
+            .and_then(|value| value.to_str().ok())
+            .map(str::to_owned);
+        if !protocol_version.as_deref().is_some_and(supports_protocol) {
+            let requested = protocol_version.map_or(serde_json::Value::Null, Into::into);
+            return protocol_gate_error(
+                request,
+                StatusCode::BAD_REQUEST,
+                -32022,
+                "Unsupported protocol version",
+                Some(serde_json::json!({
+                    "supported": [SUPPORTED_PROTOCOL_VERSION],
+                    "requested": requested,
+                })),
+            )
+            .await;
+        }
+        let method = request
+            .headers()
+            .get("mcp-method")
+            .and_then(|value| value.to_str().ok())
+            .map(str::to_owned);
+        if method.is_none() {
+            return protocol_gate_error(
+                request,
+                StatusCode::BAD_REQUEST,
+                -32020,
+                "missing required Mcp-Method header",
+                None,
+            )
+            .await;
+        }
+        if method.as_deref() == Some("initialize") {
+            return protocol_gate_error(
+                request,
+                StatusCode::NOT_FOUND,
+                -32601,
+                "initialize is not available on stateless HTTP; use server/discover",
+                None,
+            )
+            .await;
+        }
+    }
+    next.run(request).await
+}
+
+fn normalize_header(request: &mut Request, name: &'static str) {
+    let normalized = request
+        .headers()
+        .get(name)
+        .and_then(|value| value.to_str().ok())
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+        .and_then(|value| HeaderValue::from_str(value).ok());
+    if let Some(value) = normalized {
+        request.headers_mut().insert(name, value);
+    } else {
+        request.headers_mut().remove(name);
     }
-    response
+}
+
+fn host_rejection(request: &Request, allowed_hosts: &[String]) -> Option<Response> {
+    if allowed_hosts.is_empty() {
+        return None;
+    }
+    // Mirror rmcp's effective-authority policy: an explicit Host header wins
+    // over URI authority, and a portless allowlist entry permits every port for
+    // that normalized host. Keeping this gate identical ensures DNS-rebinding
+    // rejection happens before Compass emits protocol diagnostics; rmcp repeats
+    // the check inside the service as defense in depth.
+    let authority = if let Some(host) = request.headers().get(header::HOST) {
+        let Ok(host) = host.to_str() else {
+            return Some(
+                (
+                    StatusCode::BAD_REQUEST,
+                    "Bad Request: Invalid Host header encoding",
+                )
+                    .into_response(),
+            );
+        };
+        let Ok(authority) = axum::http::uri::Authority::try_from(host) else {
+            return Some(
+                (StatusCode::BAD_REQUEST, "Bad Request: Invalid Host header").into_response(),
+            );
+        };
+        authority
+    } else if let Some(authority) = request.uri().authority().cloned() {
+        authority
+    } else {
+        return Some((StatusCode::BAD_REQUEST, "Bad Request: missing Host header").into_response());
+    };
+    let host = normalize_host(authority.host());
+    let port = authority.port_u16();
+    let allowed = allowed_hosts.iter().any(|candidate| {
+        let candidate = candidate.trim();
+        if candidate.is_empty() {
+            return false;
+        }
+        if let Ok(authority) = axum::http::uri::Authority::try_from(candidate) {
+            normalize_host(authority.host()) == host
+                && authority
+                    .port_u16()
+                    .is_none_or(|allowed| Some(allowed) == port)
+        } else {
+            normalize_host(candidate) == host
+        }
+    });
+    if allowed {
+        None
+    } else {
+        Some(
+            (
+                StatusCode::FORBIDDEN,
+                "Forbidden: Host header is not allowed",
+            )
+                .into_response(),
+        )
+    }
+}
+
+fn normalize_host(host: &str) -> String {
+    host.trim_matches('[')
+        .trim_matches(']')
+        .to_ascii_lowercase()
+}
+
+async fn protocol_gate_error(
+    request: Request,
+    status: StatusCode,
+    code: i32,
+    message: &str,
+    data: Option<serde_json::Value>,
+) -> Response {
+    let (_, body) = request.into_parts();
+    let id = axum::body::to_bytes(body, MAX_HTTP_REQUEST_BYTES)
+        .await
+        .ok()
+        .and_then(|bytes| serde_json::from_slice::<serde_json::Value>(&bytes).ok())
+        .and_then(|value| value.get("id").cloned())
+        .unwrap_or(serde_json::Value::Null);
+    let mut error = serde_json::json!({"code": code, "message": message});
+    if let Some(data) = data {
+        error["data"] = data;
+    }
+    (
+        status,
+        [(header::CONTENT_TYPE, "application/json")],
+        serde_json::json!({
+            "jsonrpc": "2.0",
+            "id": id,
+            "error": error,
+        })
+        .to_string(),
+    )
+        .into_response()
 }
 
 fn bearer_token(value: Option<&HeaderValue>) -> Option<&[u8]> {
@@ -235,49 +419,6 @@ fn constant_time_eq(provided: &[u8], expected: &[u8]) -> bool {
     difference == 0
 }
 
-async fn sse_response_to_json(response: Response) -> Response {
-    let is_sse = response
-        .headers()
-        .get(header::CONTENT_TYPE)
-        .and_then(|value| value.to_str().ok())
-        .is_some_and(|value| value.starts_with("text/event-stream"));
-    if !is_sse {
-        return response;
-    }
-    let (mut parts, body) = response.into_parts();
-    let Ok(bytes) = to_bytes(body, MAX_HTTP_RESPONSE_BYTES).await else {
-        return (
-            StatusCode::INTERNAL_SERVER_ERROR,
-            "MCP response exceeded the server limit",
-        )
-            .into_response();
-    };
-    let payload = bytes
-        .split(|byte| *byte == b'\n')
-        .filter_map(|line| line.strip_prefix(b"data:"))
-        .map(trim_ascii)
-        .find(|line| serde_json::from_slice::<serde_json::Value>(line).is_ok());
-    let Some(payload) = payload else {
-        return Response::from_parts(parts, Body::from(bytes));
-    };
-    parts.headers.insert(
-        header::CONTENT_TYPE,
-        HeaderValue::from_static("application/json"),
-    );
-    parts.headers.remove(header::CONTENT_LENGTH);
-    Response::from_parts(parts, Body::from(payload.to_vec()))
-}
-
-fn trim_ascii(mut value: &[u8]) -> &[u8] {
-    while value.first().is_some_and(u8::is_ascii_whitespace) {
-        value = &value[1..];
-    }
-    while value.last().is_some_and(u8::is_ascii_whitespace) {
-        value = &value[..value.len().saturating_sub(1)];
-    }
-    value
-}
-
 fn is_wildcard_host(host: &str) -> bool {
     matches!(host, "" | "0.0.0.0" | "::")
 }
diff --git a/crates/compass-mcp/tests/code_query_tools.rs b/crates/compass-mcp/tests/code_query_tools.rs
index d06927f19..23eb662b0 100644
--- a/crates/compass-mcp/tests/code_query_tools.rs
+++ b/crates/compass-mcp/tests/code_query_tools.rs
@@ -4,13 +4,23 @@ use std::path::{Path, PathBuf};
 
 use compass_mcp::CompassMcp;
 use compass_model::code_graph::{
-    BuildMetadata, EdgeKind, EdgeRecord, ExtractionStatus, FileRecord, GraphDocument, NodeKind,
-    NodeRecord,
+    BuildMetadata, CallDispatch, CallEdgeDetails, ComponentNodeDetails, ConfigNodeDetails,
+    DatabaseNodeDetails, EdgeDetails, EdgeKind, EdgeRecord, ExtractionStatus, FileNodeDetails,
+    FileRecord, GraphDocument, ImportExportNodeDetails, JobNodeDetails, MappingEdgeDetails,
+    MessagingEdgeDetails, MessagingNodeDetails, NodeDetails, NodeKind, NodeRecord, NodeRole,
+    QueryNodeDetails, ResourceKind, ResourceNodeDetails, RouteEdgeDetails, RouteNodeDetails,
+    RouteStage, RouteStageDetails, ScheduleEdgeDetails, SchemaNodeDetails, SymbolNodeDetails,
 };
 use compass_model::identity::{edge_id, file_id};
-use compass_model::provenance::{EvidenceConfidence, EvidenceOrigin, Provenance, SourceAnchor};
-use rmcp::ServiceExt;
-use rmcp::model::CallToolRequestParams;
+use compass_model::provenance::{
+    EvidenceConfidence, EvidenceOrigin, Provenance, ResolutionCandidate, ResolutionState,
+    SourceAnchor,
+};
+use rmcp::model::{
+    CallToolRequestParams, ClientCapabilities, ClientInfo, Implementation, ProtocolVersion,
+    ResultType,
+};
+use rmcp::{ClientLifecycleMode, ClientServiceExt, ServiceExt};
 use serde_json::{Map, Value, json};
 
 fn write_typed_graph(root: &Path) -> Result<PathBuf, Box<dyn Error>> {
@@ -95,6 +105,58 @@ fn write_typed_graph(root: &Path) -> Result<PathBuf, Box<dyn Error>> {
     Ok(graph_path)
 }
 
+fn write_parallel_call_graph(root: &Path) -> Result<PathBuf, Box<dyn Error>> {
+    let graph_path = write_typed_graph(root)?;
+    let mut graph = GraphDocument::load(&graph_path)?;
+    let anchor = SourceAnchor {
+        file: "src/lib.rs".to_owned(),
+        start_byte: 1,
+        end_byte: 4,
+        start_line: 1,
+        start_column: 1,
+        end_line: 1,
+        end_column: 4,
+    };
+    let evidence = Provenance {
+        origin: EvidenceOrigin::Ast,
+        extractor: "mcp-test-parallel".to_owned(),
+        confidence: EvidenceConfidence::Exact,
+        rule: Some("second-call-site".to_owned()),
+        anchors: vec![anchor.clone()],
+        wiring_site: None,
+        score: None,
+        candidates: Vec::new(),
+    };
+    let id = edge_id(
+        "n:caller",
+        EdgeKind::Calls,
+        "n:target",
+        Some(&anchor),
+        Some("second-call-site"),
+    );
+    graph.links.push(EdgeRecord {
+        id: id.clone(),
+        key: id,
+        source: "n:caller".to_owned(),
+        target: "n:target".to_owned(),
+        kind: EdgeKind::Calls,
+        occurrence_rule: compass_model::provenance::OccurrenceRule::new("second-call-site"),
+        relationship_site: Some(anchor),
+        details: Some(EdgeDetails::Call(CallEdgeDetails {
+            dispatch: CallDispatch::Static,
+            receiver_type: Some("Fixture".to_owned()),
+            argument_count: Some(1),
+        })),
+        evidence: vec![evidence],
+        weight: None,
+        context: Some("parallel fixture".to_owned()),
+        deferred: false,
+        diagnostics: Vec::new(),
+    });
+    fs::write(&graph_path, serde_json::to_vec_pretty(&graph)?)?;
+    Ok(graph_path)
+}
+
 fn invoke(server: &CompassMcp, name: &str, arguments: Value) -> Result<Value, Box<dyn Error>> {
     let output = server.invoke(
         name,
@@ -103,6 +165,135 @@ fn invoke(server: &CompassMcp, name: &str, arguments: Value) -> Result<Value, Bo
     Ok(serde_json::from_str(&output)?)
 }
 
+fn golden_result(tool: &str) -> Result<Value, Box<dyn Error>> {
+    let contents = match tool {
+        "search_symbols" => include_str!("fixtures/search_symbols-result.json"),
+        "get_callers" => include_str!("fixtures/get_callers-result.json"),
+        "get_callees" => include_str!("fixtures/get_callees-result.json"),
+        "get_impact" => include_str!("fixtures/get_impact-result.json"),
+        _ => return Err(format!("no golden result for {tool}").into()),
+    };
+    Ok(serde_json::from_str(contents)?)
+}
+
+fn pre_envelope_golden(tool: &str) -> Result<Value, Box<dyn Error>> {
+    let contents = match tool {
+        "search_symbols" => include_str!("fixtures/search_symbols-query-v1.json"),
+        "get_callers" => include_str!("fixtures/get_callers-query-v1.json"),
+        "get_callees" => include_str!("fixtures/get_callees-query-v1.json"),
+        "get_impact" => include_str!("fixtures/get_impact-query-v1.json"),
+        _ => return Err(format!("no pre-envelope golden result for {tool}").into()),
+    };
+    Ok(serde_json::from_str(contents)?)
+}
+
+fn parallel_callers_golden() -> Result<Value, Box<dyn Error>> {
+    Ok(serde_json::from_str(include_str!(
+        "fixtures/get_callers-parallel-query-v1.json"
+    ))?)
+}
+
+fn validate_schema(value: &Value, schema: &Value, root: &Value, path: &str) -> Result<(), String> {
+    if let Some(reference) = schema.get("$ref").and_then(Value::as_str) {
+        let pointer = reference
+            .strip_prefix('#')
+            .ok_or_else(|| format!("{path}: external schema reference is unsupported"))?;
+        let resolved = root
+            .pointer(pointer)
+            .ok_or_else(|| format!("{path}: unresolved schema reference {reference}"))?;
+        return validate_schema(value, resolved, root, path);
+    }
+    if let Some(expected) = schema.get("const")
+        && value != expected
+    {
+        return Err(format!(
+            "{path}: expected constant {expected}, found {value}"
+        ));
+    }
+    if let Some(allowed) = schema.get("enum").and_then(Value::as_array)
+        && !allowed.contains(value)
+    {
+        return Err(format!("{path}: value {value} is outside the enum"));
+    }
+    if let Some(alternatives) = schema.get("anyOf").and_then(Value::as_array)
+        && !alternatives
+            .iter()
+            .any(|alternative| validate_schema(value, alternative, root, path).is_ok())
+    {
+        return Err(format!("{path}: no anyOf alternative matched"));
+    }
+    if let Some(alternatives) = schema.get("oneOf").and_then(Value::as_array) {
+        let matches = alternatives
+            .iter()
+            .filter(|alternative| validate_schema(value, alternative, root, path).is_ok())
+            .count();
+        if matches != 1 {
+            return Err(format!("{path}: expected one oneOf match, found {matches}"));
+        }
+    }
+    if let Some(expected) = schema.get("type") {
+        let matches_type = |name: &str| match name {
+            "object" => value.is_object(),
+            "array" => value.is_array(),
+            "string" => value.is_string(),
+            "integer" => value.as_i64().is_some() || value.as_u64().is_some(),
+            "number" => value.is_number(),
+            "boolean" => value.is_boolean(),
+            "null" => value.is_null(),
+            _ => false,
+        };
+        let valid = expected.as_str().is_some_and(matches_type)
+            || expected
+                .as_array()
+                .is_some_and(|names| names.iter().filter_map(Value::as_str).any(matches_type));
+        if !valid {
+            return Err(format!("{path}: value {value} has the wrong type"));
+        }
+    }
+    if let Some(minimum) = schema.get("minimum").and_then(Value::as_f64)
+        && value.as_f64().is_some_and(|number| number < minimum)
+    {
+        return Err(format!("{path}: numeric value is below {minimum}"));
+    }
+    if let Some(minimum) = schema.get("minLength").and_then(Value::as_u64)
+        && value
+            .as_str()
+            .is_some_and(|text| text.len() < minimum as usize)
+    {
+        return Err(format!("{path}: string is shorter than {minimum}"));
+    }
+    if let Some(object) = value.as_object() {
+        let properties = schema.get("properties").and_then(Value::as_object);
+        if let Some(required) = schema.get("required").and_then(Value::as_array) {
+            for name in required.iter().filter_map(Value::as_str) {
+                if !object.contains_key(name) {
+                    return Err(format!("{path}: required property {name} is absent"));
+                }
+            }
+        }
+        if schema.get("additionalProperties") == Some(&Value::Bool(false)) {
+            for name in object.keys() {
+                if !properties.is_some_and(|known| known.contains_key(name)) {
+                    return Err(format!("{path}: unexpected property {name}"));
+                }
+            }
+        }
+        if let Some(properties) = properties {
+            for (name, child_schema) in properties {
+                if let Some(child) = object.get(name) {
+                    validate_schema(child, child_schema, root, &format!("{path}.{name}"))?;
+                }
+            }
+        }
+    }
+    if let (Some(items), Some(values)) = (schema.get("items"), value.as_array()) {
+        for (index, item) in values.iter().enumerate() {
+            validate_schema(item, items, root, &format!("{path}[{index}]"))?;
+        }
+    }
+    Ok(())
+}
+
 #[test]
 fn code_query_tools_share_the_bounded_versioned_contract() -> Result<(), Box<dyn Error>> {
     let directory = tempfile::tempdir()?;
@@ -130,9 +321,29 @@ fn code_query_tools_share_the_bounded_versioned_contract() -> Result<(), Box<dyn
         ),
     ] {
         let response = invoke(&server, tool, arguments)?;
-        assert_eq!(response["schema"], "compass.query/1", "{tool}");
-        assert_eq!(response["operation"], operation, "{tool}");
-        assert!(response["limits"]["maxNodes"].as_u64().is_some(), "{tool}");
+        let data = if matches!(
+            tool,
+            "search_symbols" | "get_callers" | "get_callees" | "get_impact"
+        ) {
+            assert_eq!(response["schema"], "compass.code_context.v1", "{tool}");
+            assert_eq!(response["repository"], "sha256:test", "{tool}");
+            assert_eq!(response["generation"], "sha256:test", "{tool}");
+            assert_eq!(response["freshness"]["status"], "unknown", "{tool}");
+            assert_eq!(response["truncation"]["next"], Value::Null, "{tool}");
+            assert!(response.get("resultType").is_none(), "{tool}");
+            assert_eq!(response, golden_result(tool)?, "{tool} golden result");
+            assert_eq!(
+                response["data"],
+                pre_envelope_golden(tool)?,
+                "{tool} pre-envelope payload"
+            );
+            &response["data"]
+        } else {
+            &response
+        };
+        assert_eq!(data["schema"], "compass.query/1", "{tool}");
+        assert_eq!(data["operation"], operation, "{tool}");
+        assert!(data["limits"]["maxNodes"].as_u64().is_some(), "{tool}");
     }
 
     let reverse = invoke(
@@ -157,7 +368,7 @@ fn code_query_tools_share_the_bounded_versioned_contract() -> Result<(), Box<dyn
 }
 
 #[test]
-fn code_query_tool_schemas_are_closed_and_bounded() {
+fn code_query_tool_schemas_are_closed_and_bounded() -> Result<(), Box<dyn Error>> {
     for tool in CompassMcp::tools().into_iter().filter(|tool| {
         matches!(
             tool.name.as_ref(),
@@ -183,7 +394,507 @@ fn code_query_tool_schemas_are_closed_and_bounded() {
                 .and_then(Value::as_u64)
                 .is_some()
         );
+        if matches!(
+            tool.name.as_ref(),
+            "search_symbols" | "get_callers" | "get_callees" | "get_impact"
+        ) {
+            let output = tool.output_schema.as_ref().ok_or("missing output schema")?;
+            assert_eq!(
+                output.get("additionalProperties"),
+                Some(&Value::Bool(false))
+            );
+            assert_eq!(
+                output
+                    .get("properties")
+                    .and_then(Value::as_object)
+                    .and_then(|properties| properties.get("schema"))
+                    .and_then(Value::as_object)
+                    .and_then(|schema| schema.get("const")),
+                Some(&json!("compass.code_context.v1"))
+            );
+            let golden = golden_result(tool.name.as_ref())?;
+            validate_schema(
+                &golden,
+                &Value::Object(output.as_ref().clone()),
+                &Value::Object(output.as_ref().clone()),
+                "$",
+            )?;
+            let mut invalid = golden;
+            invalid["data"]["nodes"] = json!([17]);
+            assert!(
+                validate_schema(
+                    &invalid,
+                    &Value::Object(output.as_ref().clone()),
+                    &Value::Object(output.as_ref().clone()),
+                    "$"
+                )
+                .is_err()
+            );
+
+            let mut detailed = golden_result(tool.name.as_ref())?;
+            detailed["data"]["nodes"][0]["details"] = json!({
+                "type": "symbol",
+                "data": {"signature": "fn()", "modifiers": ["public"]}
+            });
+            if detailed["data"]["edges"]
+                .as_array()
+                .is_some_and(|edges| !edges.is_empty())
+            {
+                detailed["data"]["edges"][0]["details"] = json!({
+                    "type": "call",
+                    "data": {"dispatch": "static", "argumentCount": 0}
+                });
+            }
+            validate_schema(
+                &detailed,
+                &Value::Object(output.as_ref().clone()),
+                &Value::Object(output.as_ref().clone()),
+                "$",
+            )?;
+            for invalid_details in [
+                json!({"type":"unknown","data":{}}),
+                json!({"type":"symbol","data":{"unexpected":true}}),
+            ] {
+                detailed["data"]["nodes"][0]["details"] = invalid_details;
+                assert!(
+                    validate_schema(
+                        &detailed,
+                        &Value::Object(output.as_ref().clone()),
+                        &Value::Object(output.as_ref().clone()),
+                        "$"
+                    )
+                    .is_err()
+                );
+            }
+            detailed["data"]["nodes"][0]["details"] = Value::Null;
+            detailed["data"]["nodes"][0]["kind"] = json!("unknown");
+            assert!(
+                validate_schema(
+                    &detailed,
+                    &Value::Object(output.as_ref().clone()),
+                    &Value::Object(output.as_ref().clone()),
+                    "$"
+                )
+                .is_err()
+            );
+            detailed["data"]["nodes"][0]["kind"] = json!("function");
+            detailed["data"]["nodes"][0]["roles"] = json!(["unknown"]);
+            assert!(
+                validate_schema(
+                    &detailed,
+                    &Value::Object(output.as_ref().clone()),
+                    &Value::Object(output.as_ref().clone()),
+                    "$"
+                )
+                .is_err()
+            );
+            if detailed["data"]["edges"]
+                .as_array()
+                .is_some_and(|edges| !edges.is_empty())
+            {
+                detailed["data"]["nodes"][0]["roles"] = json!([]);
+                for invalid_details in [
+                    json!({"type":"unknown","data":{}}),
+                    json!({"type":"call","data":{"dispatch":"static","unexpected":true}}),
+                ] {
+                    detailed["data"]["edges"][0]["details"] = invalid_details;
+                    assert!(
+                        validate_schema(
+                            &detailed,
+                            &Value::Object(output.as_ref().clone()),
+                            &Value::Object(output.as_ref().clone()),
+                            "$"
+                        )
+                        .is_err()
+                    );
+                }
+                detailed["data"]["edges"][0]["details"] = Value::Null;
+                detailed["data"]["edges"][0]["kind"] = json!("unknown");
+                assert!(
+                    validate_schema(
+                        &detailed,
+                        &Value::Object(output.as_ref().clone()),
+                        &Value::Object(output.as_ref().clone()),
+                        "$"
+                    )
+                    .is_err()
+                );
+            }
+        } else {
+            assert!(tool.output_schema.is_none());
+        }
+    }
+    Ok(())
+}
+
+fn complete_node_details(anchor: &SourceAnchor) -> Vec<NodeDetails> {
+    vec![
+        NodeDetails::File(FileNodeDetails {
+            content_digest: "sha256:file".to_owned(),
+            byte_size: 42,
+            generated: true,
+        }),
+        NodeDetails::Symbol(SymbolNodeDetails {
+            signature: Some("fn example(value: usize)".to_owned()),
+            modifiers: vec!["public".to_owned()],
+            overload_discriminator: Some("usize".to_owned()),
+            declaring_type: Some("Fixture".to_owned()),
+            signature_digest: Some("sha256:signature".to_owned()),
+            implementation_digest: Some("sha256:implementation".to_owned()),
+            source_digest: Some("sha256:source".to_owned()),
+        }),
+        NodeDetails::ImportExport(ImportExportNodeDetails {
+            specifier: "crate::fixture".to_owned(),
+            imported_name: Some("Fixture".to_owned()),
+            local_name: Some("LocalFixture".to_owned()),
+            type_only: true,
+        }),
+        NodeDetails::Route(RouteNodeDetails {
+            operation: "GET".to_owned(),
+            path: "/fixture".to_owned(),
+            original_path: Some("/fixture/:id".to_owned()),
+            declaring_scope: "Fixture".to_owned(),
+            resolution: ResolutionState::Ambiguous,
+            middleware_count: 1,
+            stages: vec![RouteStageDetails {
+                stage: RouteStage::Middleware,
+                position: 0,
+                reference: "authenticate".to_owned(),
+                resolution: ResolutionState::Ambiguous,
+                target: Some("n:middleware".to_owned()),
+                candidates: vec![ResolutionCandidate {
+                    node_id: "n:middleware".to_owned(),
+                    reason: "fixture".to_owned(),
+                    confidence: EvidenceConfidence::Ambiguous,
+                    score: Some(0.5),
+                    anchor: Some(anchor.clone()),
+                }],
+            }],
+        }),
+        NodeDetails::Component(ComponentNodeDetails {
+            component_type: "view".to_owned(),
+        }),
+        NodeDetails::Resource(ResourceNodeDetails {
+            resource_kind: ResourceKind::Document,
+            uri: Some("https://example.invalid/fixture".to_owned()),
+            media_type: Some("text/plain".to_owned()),
+        }),
+        NodeDetails::Messaging(MessagingNodeDetails {
+            transport: "nats".to_owned(),
+            subject: "fixture.created".to_owned(),
+            declaring_scope: "Fixture".to_owned(),
+        }),
+        NodeDetails::Job(JobNodeDetails {
+            schedule: Some("0 * * * *".to_owned()),
+            queue: Some("fixture".to_owned()),
+        }),
+        NodeDetails::Schema(SchemaNodeDetails {
+            dialect: Some("postgres".to_owned()),
+            logical_database: Some("fixture".to_owned()),
+            namespace: Some("public".to_owned()),
+        }),
+        NodeDetails::Query(QueryNodeDetails {
+            dialect: Some("sql".to_owned()),
+            operation: Some("select".to_owned()),
+            text_digest: Some("sha256:query".to_owned()),
+        }),
+        NodeDetails::Config(ConfigNodeDetails {
+            format: "toml".to_owned(),
+            key_path: "fixture.enabled".to_owned(),
+        }),
+        NodeDetails::Database(DatabaseNodeDetails {
+            logical_database: "fixture".to_owned(),
+            database_schema: Some("public".to_owned()),
+        }),
+    ]
+}
+
+fn complete_edge_details() -> Vec<EdgeDetails> {
+    vec![
+        EdgeDetails::Call(CallEdgeDetails {
+            dispatch: CallDispatch::Virtual,
+            receiver_type: Some("Fixture".to_owned()),
+            argument_count: Some(2),
+        }),
+        EdgeDetails::Route(RouteEdgeDetails {
+            stage: RouteStage::Handler,
+            position: Some(1),
+            operation: Some("POST".to_owned()),
+        }),
+        EdgeDetails::Messaging(MessagingEdgeDetails {
+            transport: "nats".to_owned(),
+            subject: "fixture.created".to_owned(),
+        }),
+        EdgeDetails::Schedule(ScheduleEdgeDetails {
+            expression: Some("0 * * * *".to_owned()),
+        }),
+        EdgeDetails::Mapping(MappingEdgeDetails {
+            mapping_kind: "column".to_owned(),
+        }),
+    ]
+}
+
+#[test]
+fn output_schema_covers_every_graph_enum_and_detail_variant() -> Result<(), Box<dyn Error>> {
+    let tool = CompassMcp::tools()
+        .into_iter()
+        .find(|tool| tool.name == "get_callers")
+        .ok_or("get_callers missing")?;
+    let root = Value::Object(
+        tool.output_schema
+            .as_ref()
+            .ok_or("get_callers output schema missing")?
+            .as_ref()
+            .clone(),
+    );
+    let mut result = golden_result("get_callers")?;
+
+    for kind in NodeKind::ALL {
+        result["data"]["nodes"][0]["kind"] = serde_json::to_value(kind)?;
+        validate_schema(&result, &root, &root, "$")?;
+    }
+    result["data"]["nodes"][0]["kind"] = json!("function");
+    for role in NodeRole::ALL {
+        result["data"]["nodes"][0]["roles"] = json!([serde_json::to_value(role)?]);
+        validate_schema(&result, &root, &root, "$")?;
+    }
+    result["data"]["nodes"][0]["roles"] = json!([]);
+    for kind in EdgeKind::ALL {
+        result["data"]["edges"][0]["kind"] = serde_json::to_value(kind)?;
+        validate_schema(&result, &root, &root, "$")?;
+    }
+    result["data"]["edges"][0]["kind"] = json!("calls");
+
+    let anchor = SourceAnchor {
+        file: "src/lib.rs".to_owned(),
+        start_byte: 0,
+        end_byte: 4,
+        start_line: 1,
+        start_column: 0,
+        end_line: 1,
+        end_column: 4,
+    };
+    for details in complete_node_details(&anchor) {
+        let serialized = serde_json::to_value(details)?;
+        result["data"]["nodes"][0]["details"] = serialized.clone();
+        validate_schema(&result, &root, &root, "$")?;
+
+        let mut missing_data = serialized.clone();
+        missing_data
+            .as_object_mut()
+            .ok_or("serialized node details are not an object")?
+            .remove("data");
+        result["data"]["nodes"][0]["details"] = missing_data;
+        assert!(validate_schema(&result, &root, &root, "$").is_err());
+
+        let mut unknown_field = serialized.clone();
+        unknown_field["data"]["unexpected"] = Value::Bool(true);
+        result["data"]["nodes"][0]["details"] = unknown_field;
+        assert!(validate_schema(&result, &root, &root, "$").is_err());
+
+        let mut unknown_tag = serialized;
+        unknown_tag["type"] = json!("unknown");
+        result["data"]["nodes"][0]["details"] = unknown_tag;
+        assert!(validate_schema(&result, &root, &root, "$").is_err());
     }
+    result["data"]["nodes"][0]["details"] = Value::Null;
+    for details in complete_edge_details() {
+        let serialized = serde_json::to_value(details)?;
+        result["data"]["edges"][0]["details"] = serialized.clone();
+        validate_schema(&result, &root, &root, "$")?;
+
+        let mut missing_data = serialized.clone();
+        missing_data
+            .as_object_mut()
+            .ok_or("serialized edge details are not an object")?
+            .remove("data");
+        result["data"]["edges"][0]["details"] = missing_data;
+        assert!(validate_schema(&result, &root, &root, "$").is_err());
+
+        let mut unknown_field = serialized.clone();
+        unknown_field["data"]["unexpected"] = Value::Bool(true);
+        result["data"]["edges"][0]["details"] = unknown_field;
+        assert!(validate_schema(&result, &root, &root, "$").is_err());
+
+        let mut unknown_tag = serialized;
+        unknown_tag["type"] = json!("unknown");
+        result["data"]["edges"][0]["details"] = unknown_tag;
+        assert!(validate_schema(&result, &root, &root, "$").is_err());
+    }
+    Ok(())
+}
+
+#[test]
+fn envelope_preserves_bounds_warnings_and_deterministic_discovery() -> Result<(), Box<dyn Error>> {
+    let directory = tempfile::tempdir()?;
+    let graph = write_typed_graph(directory.path())?;
+    let server = CompassMcp::new(graph);
+    let bounded = invoke(
+        &server,
+        "get_impact",
+        json!({"symbol":"Target","max_nodes":1}),
+    )?;
+    assert_eq!(bounded["data"]["truncated"], true);
+    assert_eq!(bounded["truncation"]["truncated"], true);
+    assert_eq!(bounded["truncation"]["next"], Value::Null);
+    assert_eq!(bounded["warnings"], bounded["data"]["diagnostics"]);
+    assert!(bounded["warnings"].as_array().is_some_and(|items| {
+        items
+            .iter()
+            .any(|item| item["code"] == "bounded_truncation")
+    }));
+
+    let first = CompassMcp::tools();
+    let second = CompassMcp::tools();
+    assert_eq!(
+        first.iter().map(|tool| &tool.name).collect::<Vec<_>>(),
+        second.iter().map(|tool| &tool.name).collect::<Vec<_>>()
+    );
+    assert_eq!(
+        first
+            .iter()
+            .take(4)
+            .map(|tool| tool.name.as_ref())
+            .collect::<Vec<_>>(),
+        vec!["search_symbols", "get_callers", "get_callees", "get_impact"]
+    );
+    for tool in &first {
+        if matches!(
+            tool.name.as_ref(),
+            "get_neighbors"
+                | "get_community"
+                | "god_nodes"
+                | "graph_stats"
+                | "shortest_path"
+                | "list_prs"
+                | "get_pr_impact"
+                | "triage_prs"
+        ) {
+            assert!(
+                tool.description
+                    .as_deref()
+                    .is_some_and(|description| description.starts_with("DEPRECATED text result:"))
+            );
+            assert_eq!(
+                tool.meta
+                    .as_ref()
+                    .and_then(|meta| meta.0.get("compass/deprecated")),
+                Some(&Value::Bool(true))
+            );
+        }
+    }
+    let query_graph = first
+        .iter()
+        .find(|tool| tool.name == "query_graph")
+        .ok_or("query_graph missing")?;
+    assert_eq!(
+        query_graph
+            .meta
+            .as_ref()
+            .and_then(|meta| meta.0.get("compass/deprecatedTextMode")),
+        Some(&Value::Bool(true))
+    );
+
+    let oversized = server.invoke(
+        "search_symbols",
+        json!({"query":"Target","max_response_bytes":1000})
+            .as_object()
+            .cloned()
+            .ok_or("request is not an object")?,
+    );
+    assert!(
+        oversized.contains("after MCP envelope encoding"),
+        "{oversized}"
+    );
+    assert!(
+        oversized.contains("query_response_too_large"),
+        "{oversized}"
+    );
+    Ok(())
+}
+
+#[test]
+fn envelope_preserves_parallel_edge_occurrences_against_pre_envelope_golden()
+-> Result<(), Box<dyn Error>> {
+    let directory = tempfile::tempdir()?;
+    let graph = write_parallel_call_graph(directory.path())?;
+    let response = invoke(
+        &CompassMcp::new(graph),
+        "get_callers",
+        json!({"symbol":"Target"}),
+    )?;
+    assert_eq!(response["data"], parallel_callers_golden()?);
+    let edges = response["data"]["edges"]
+        .as_array()
+        .ok_or("parallel edge result is not an array")?;
+    assert_eq!(edges.len(), 2);
+    assert_ne!(edges[0]["id"], edges[1]["id"]);
+    assert_ne!(edges[0]["relationshipSite"], edges[1]["relationshipSite"]);
+    assert_ne!(edges[0]["evidence"], edges[1]["evidence"]);
+    Ok(())
+}
+
+#[test]
+fn envelope_preserves_ambiguity_without_inventing_a_target() -> Result<(), Box<dyn Error>> {
+    let directory = tempfile::tempdir()?;
+    let graph_path = write_typed_graph(directory.path())?;
+    let mut graph = GraphDocument::load(&graph_path)?;
+    let mut duplicate = graph
+        .nodes
+        .iter()
+        .find(|node| node.name == "Target")
+        .cloned()
+        .ok_or("fixture target missing")?;
+    duplicate.id = "n:other-target".to_owned();
+    duplicate.qualified_name = "Other.Target".to_owned();
+    graph.nodes.push(duplicate);
+    fs::write(&graph_path, serde_json::to_vec_pretty(&graph)?)?;
+
+    let response = invoke(
+        &CompassMcp::new(graph_path),
+        "get_callers",
+        json!({"symbol":"Target"}),
+    )?;
+    assert!(
+        response["data"]["nodes"]
+            .as_array()
+            .is_some_and(Vec::is_empty)
+    );
+    assert!(
+        response["data"]["edges"]
+            .as_array()
+            .is_some_and(Vec::is_empty)
+    );
+    assert_eq!(response["warnings"], response["data"]["diagnostics"]);
+    assert!(
+        response["warnings"]
+            .as_array()
+            .is_some_and(|items| { items.iter().any(|item| item["code"] == "ambiguous_match") })
+    );
+    Ok(())
+}
+
+#[test]
+fn envelope_rejects_an_empty_graph_identity() -> Result<(), Box<dyn Error>> {
+    let directory = tempfile::tempdir()?;
+    let graph_path = write_typed_graph(directory.path())?;
+    let mut graph = GraphDocument::load(&graph_path)?;
+    graph.graph.build.source_tree_digest.clear();
+    fs::write(&graph_path, serde_json::to_vec_pretty(&graph)?)?;
+
+    let output = CompassMcp::new(graph_path).invoke(
+        "search_symbols",
+        json!({"query":"Target"})
+            .as_object()
+            .cloned()
+            .ok_or("request is not an object")?,
+    );
+    assert!(
+        output.contains("graph.build.sourceTreeDigest must not be empty"),
+        "{output}"
+    );
+    assert!(serde_json::from_str::<Value>(&output).is_err(), "{output}");
+    Ok(())
 }
 
 #[tokio::test]
@@ -199,7 +910,19 @@ async fn mcp_code_queries_publish_structured_content_and_protocol_errors()
             .map_err(|error| error.to_string())?;
         running.waiting().await.map_err(|error| error.to_string())
     });
-    let client = ().serve(client_transport).await?;
+    let client_info = ClientInfo::new(
+        ClientCapabilities::default(),
+        Implementation::new("compass-code-query-test", env!("CARGO_PKG_VERSION")),
+    )
+    .with_protocol_version(ProtocolVersion::V_2026_07_28);
+    let client = client_info
+        .serve_with_lifecycle(
+            client_transport,
+            ClientLifecycleMode::Discover {
+                preferred_versions: vec![ProtocolVersion::V_2026_07_28],
+            },
+        )
+        .await?;
     let response = client
         .call_tool(
             CallToolRequestParams::new("search_symbols")
@@ -212,6 +935,16 @@ async fn mcp_code_queries_publish_structured_content_and_protocol_errors()
             .as_ref()
             .and_then(|value| value.get("schema"))
             .and_then(Value::as_str),
+        Some("compass.code_context.v1")
+    );
+    assert_eq!(response.result_type, Some(ResultType::COMPLETE));
+    assert_eq!(
+        response
+            .structured_content
+            .as_ref()
+            .and_then(|value| value.get("data"))
+            .and_then(|value| value.get("schema"))
+            .and_then(Value::as_str),
         Some("compass.query/1")
     );
     assert!(!response.content.is_empty());
@@ -221,6 +954,26 @@ async fn mcp_code_queries_publish_structured_content_and_protocol_errors()
             .await
             .is_err()
     );
+    let oversized = match client
+        .call_tool(
+            CallToolRequestParams::new("search_symbols").with_arguments(Map::from_iter([
+                ("query".to_owned(), json!("Target")),
+                ("max_response_bytes".to_owned(), json!(1000)),
+            ])),
+        )
+        .await
+    {
+        Ok(response) => {
+            return Err(
+                format!("final MCP envelope ignored max_response_bytes: {response:?}").into(),
+            );
+        }
+        Err(error) => error,
+    };
+    assert!(
+        oversized.to_string().contains("query_response_too_large"),
+        "{oversized}"
+    );
     client.cancel().await?;
     server_task.await?.map_err(std::io::Error::other)?;
     Ok(())
diff --git a/crates/compass-mcp/tests/coverage_paths.rs b/crates/compass-mcp/tests/coverage_paths.rs
index daca88402..77697920a 100644
--- a/crates/compass-mcp/tests/coverage_paths.rs
+++ b/crates/compass-mcp/tests/coverage_paths.rs
@@ -2,8 +2,11 @@ use std::error::Error;
 use std::fs;
 
 use compass_mcp::{CompassMcp, HttpOptions, serve_http};
-use rmcp::model::{CallToolRequestParams, ReadResourceRequestParams};
-use rmcp::{ServerHandler, ServiceExt};
+use rmcp::model::{
+    CallToolRequestParams, ClientCapabilities, ClientInfo, Implementation, ProtocolVersion,
+    ReadResourceRequestParams,
+};
+use rmcp::{ClientLifecycleMode, ClientServiceExt, ServerHandler, ServiceExt};
 use serde_json::{Map, Value, json};
 
 fn write_fixture(root: &std::path::Path) -> Result<std::path::PathBuf, Box<dyn Error>> {
@@ -292,7 +295,19 @@ async fn in_memory_protocol_exercises_tool_and_resource_server_handlers()
             .map_err(|error| error.to_string())?;
         running.waiting().await.map_err(|error| error.to_string())
     });
-    let client = ().serve(client_transport).await?;
+    let client_info = ClientInfo::new(
+        ClientCapabilities::default(),
+        Implementation::new("compass-handler-test", env!("CARGO_PKG_VERSION")),
+    )
+    .with_protocol_version(ProtocolVersion::V_2026_07_28);
+    let client = client_info
+        .serve_with_lifecycle(
+            client_transport,
+            ClientLifecycleMode::Discover {
+                preferred_versions: vec![ProtocolVersion::V_2026_07_28],
+            },
+        )
+        .await?;
 
     let tools = client.list_tools(None).await?;
     assert_eq!(tools.tools.len(), 15);
diff --git a/crates/compass-mcp/tests/discovery_compat.rs b/crates/compass-mcp/tests/discovery_compat.rs
new file mode 100644
index 000000000..414121023
--- /dev/null
+++ b/crates/compass-mcp/tests/discovery_compat.rs
@@ -0,0 +1,101 @@
+use compass_mcp::CompassMcp;
+use rmcp::model::{
+    ClientCapabilities, ClientInfo, Implementation, ProtocolVersion, Resource, ServerCapabilities,
+    Tool,
+};
+use rmcp::{ClientLifecycleMode, ClientServiceExt, ServerHandler, ServiceExt};
+use serde_json::{Value, json};
+use sha2::{Digest, Sha256};
+
+fn normalized_contract(
+    server_info: Implementation,
+    capabilities: ServerCapabilities,
+    tools: Vec<Tool>,
+    resources: Vec<Resource>,
+) -> Result<Value, serde_json::Error> {
+    let tools = tools
+        .into_iter()
+        .map(|tool| {
+            let output_schema_sha256 = tool
+                .output_schema
+                .as_ref()
+                .map(|schema| {
+                    serde_json::to_vec(schema).map(|bytes| format!("{:x}", Sha256::digest(bytes)))
+                })
+                .transpose()?;
+            Ok(json!({
+                "name": tool.name,
+                "description": tool.description,
+                "inputSchemaSha256": format!(
+                    "{:x}",
+                    Sha256::digest(serde_json::to_vec(&tool.input_schema)?)
+                ),
+                "outputSchemaSha256": output_schema_sha256,
+                "meta": tool.meta,
+            }))
+        })
+        .collect::<Result<Vec<_>, serde_json::Error>>()?;
+    Ok(json!({
+        "serverInfo": server_info,
+        "capabilities": capabilities,
+        "tools": tools,
+        "resources": resources,
+    }))
+}
+
+fn expected_contract() -> Result<Value, serde_json::Error> {
+    serde_json::from_str(include_str!("fixtures/rmcp-2.2-server-discover.json"))
+}
+
+#[test]
+fn local_discovery_matches_rmcp_2_2_golden() -> Result<(), Box<dyn std::error::Error>> {
+    let info = CompassMcp::new("unused").get_info();
+    let contract = normalized_contract(
+        info.server_info,
+        info.capabilities,
+        CompassMcp::tools(),
+        CompassMcp::resources(),
+    )?;
+    assert_eq!(contract, expected_contract()?);
+    Ok(())
+}
+
+#[tokio::test]
+async fn server_discover_matches_rmcp_2_2_golden() -> Result<(), Box<dyn std::error::Error>> {
+    let (server_transport, client_transport) = tokio::io::duplex(16 * 1024);
+    let server_task = tokio::spawn(async move {
+        let running = CompassMcp::new("unused")
+            .serve(server_transport)
+            .await
+            .map_err(|error| error.to_string())?;
+        running.waiting().await.map_err(|error| error.to_string())
+    });
+    let client_info = ClientInfo::new(
+        ClientCapabilities::default(),
+        Implementation::new("compass-test", env!("CARGO_PKG_VERSION")),
+    )
+    .with_protocol_version(ProtocolVersion::V_2026_07_28);
+    let client = client_info
+        .serve_with_lifecycle(
+            client_transport,
+            ClientLifecycleMode::Discover {
+                preferred_versions: vec![ProtocolVersion::V_2026_07_28],
+            },
+        )
+        .await?;
+    let peer = client
+        .peer_info()
+        .ok_or("server/discover omitted peer data")?;
+    let server_info = peer
+        .server_info
+        .clone()
+        .ok_or("server/discover omitted server identity")?;
+    let tools = client.list_tools(None).await?.tools;
+    let resources = client.list_resources(None).await?.resources;
+    let contract = normalized_contract(server_info, peer.capabilities.clone(), tools, resources)?;
+    assert_eq!(contract, expected_contract()?);
+
+    client.cancel().await?;
+    server_task.await?.map_err(std::io::Error::other)?;
+    Ok(())
+}
diff --git a/crates/compass-mcp/tests/fixtures/get_callees-query-v1.json b/crates/compass-mcp/tests/fixtures/get_callees-query-v1.json
new file mode 100644
index 000000000..b5d46d736
--- /dev/null
+++ b/crates/compass-mcp/tests/fixtures/get_callees-query-v1.json
@@ -0,0 +1 @@
+{"schema":"compass.query/1","operation":"callees","results":[],"nodes":[{"id":"n:caller","kind":"function","roles":[],"name":"Caller","qualifiedName":"Fixture.Caller","language":"rust","framework":null,"source":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"details":null,"evidence":[{"layer":"structural_graph","origin":"ast","extractor":"mcp-test","confidence":"exact","anchor":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"rule":null,"wiringSite":null,"resolution":"exact"}]},{"id":"n:target","kind":"function","roles":[],"name":"Target","qualifiedName":"Fixture.Target","language":"rust","framework":null,"source":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"details":null,"evidence":[{"layer":"structural_graph","origin":"ast","extractor":"mcp-test","confidence":"exact","anchor":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"rule":null,"wiringSite":null,"resolution":"exact"}]}],"edges":[{"id":"sha256:535e0008b8e0bdc764fca652e83b7a3323e07fd6b623f941813ec523e5d7851e","source":"n:caller","target":"n:target","kind":"calls","relationshipSite":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"details":null,"evidence":[{"layer":"structural_graph","origin":"ast","extractor":"mcp-test","confidence":"exact","anchor":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"rule":null,"wiringSite":null,"resolution":"exact"}]}],"files":[],"paths":[],"diagnostics":[],"limits":{"maxDepth":8,"maxNodes":500,"maxEdges":1000,"maxPaths":100,"maxCandidates":20,"maxSourceBytes":1048576,"maxResponseBytes":8388608},"truncated":false}
diff --git a/crates/compass-mcp/tests/fixtures/get_callees-result.json b/crates/compass-mcp/tests/fixtures/get_callees-result.json
new file mode 100644
index 000000000..7a0b0cd9e
--- /dev/null
+++ b/crates/compass-mcp/tests/fixtures/get_callees-result.json
@@ -0,0 +1 @@
+{"schema":"compass.code_context.v1","repository":"sha256:test","generation":"sha256:test","freshness":{"status":"unknown"},"data":{"schema":"compass.query/1","operation":"callees","results":[],"nodes":[{"id":"n:caller","kind":"function","roles":[],"name":"Caller","qualifiedName":"Fixture.Caller","language":"rust","framework":null,"source":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"details":null,"evidence":[{"layer":"structural_graph","origin":"ast","extractor":"mcp-test","confidence":"exact","anchor":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"rule":null,"wiringSite":null,"resolution":"exact"}]},{"id":"n:target","kind":"function","roles":[],"name":"Target","qualifiedName":"Fixture.Target","language":"rust","framework":null,"source":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"details":null,"evidence":[{"layer":"structural_graph","origin":"ast","extractor":"mcp-test","confidence":"exact","anchor":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"rule":null,"wiringSite":null,"resolution":"exact"}]}],"edges":[{"id":"sha256:535e0008b8e0bdc764fca652e83b7a3323e07fd6b623f941813ec523e5d7851e","source":"n:caller","target":"n:target","kind":"calls","relationshipSite":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"details":null,"evidence":[{"layer":"structural_graph","origin":"ast","extractor":"mcp-test","confidence":"exact","anchor":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"rule":null,"wiringSite":null,"resolution":"exact"}]}],"files":[],"paths":[],"diagnostics":[],"limits":{"maxDepth":8,"maxNodes":500,"maxEdges":1000,"maxPaths":100,"maxCandidates":20,"maxSourceBytes":1048576,"maxResponseBytes":8388608},"truncated":false},"evidence":{"records":3,"anchored":3},"confidence":{"exact":3,"inferred":0,"ambiguous":0},"truncation":{"truncated":false,"next":null},"warnings":[]}
diff --git a/crates/compass-mcp/tests/fixtures/get_callers-parallel-query-v1.json b/crates/compass-mcp/tests/fixtures/get_callers-parallel-query-v1.json
new file mode 100644
index 000000000..32ebe1b05
--- /dev/null
+++ b/crates/compass-mcp/tests/fixtures/get_callers-parallel-query-v1.json
@@ -0,0 +1 @@
+{"schema":"compass.query/1","operation":"callers","results":[],"nodes":[{"id":"n:caller","kind":"function","roles":[],"name":"Caller","qualifiedName":"Fixture.Caller","language":"rust","framework":null,"source":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"details":null,"evidence":[{"layer":"structural_graph","origin":"ast","extractor":"mcp-test","confidence":"exact","anchor":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"rule":null,"wiringSite":null,"resolution":"exact"}]},{"id":"n:target","kind":"function","roles":[],"name":"Target","qualifiedName":"Fixture.Target","language":"rust","framework":null,"source":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"details":null,"evidence":[{"layer":"structural_graph","origin":"ast","extractor":"mcp-test","confidence":"exact","anchor":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"rule":null,"wiringSite":null,"resolution":"exact"}]}],"edges":[{"id":"sha256:17dfacb84d4891ec9878667243904348d51ebf5e753ecf1d68d230e9d24346f9","source":"n:caller","target":"n:target","kind":"calls","relationshipSite":{"file":"src/lib.rs","startByte":1,"endByte":4,"startLine":1,"startColumn":1,"endLine":1,"endColumn":4},"details":{"type":"call","data":{"dispatch":"static","receiverType":"Fixture","argumentCount":1}},"evidence":[{"layer":"structural_graph","origin":"ast","extractor":"mcp-test-parallel","confidence":"exact","anchor":{"file":"src/lib.rs","startByte":1,"endByte":4,"startLine":1,"startColumn":1,"endLine":1,"endColumn":4},"rule":"second-call-site","wiringSite":null,"resolution":"exact"}]},{"id":"sha256:535e0008b8e0bdc764fca652e83b7a3323e07fd6b623f941813ec523e5d7851e","source":"n:caller","target":"n:target","kind":"calls","relationshipSite":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"details":null,"evidence":[{"layer":"structural_graph","origin":"ast","extractor":"mcp-test","confidence":"exact","anchor":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"rule":null,"wiringSite":null,"resolution":"exact"}]}],"files":[],"paths":[],"diagnostics":[],"limits":{"maxDepth":8,"maxNodes":500,"maxEdges":1000,"maxPaths":100,"maxCandidates":20,"maxSourceBytes":1048576,"maxResponseBytes":8388608},"truncated":false}
diff --git a/crates/compass-mcp/tests/fixtures/get_callers-query-v1.json b/crates/compass-mcp/tests/fixtures/get_callers-query-v1.json
new file mode 100644
index 000000000..8f6d2f959
--- /dev/null
+++ b/crates/compass-mcp/tests/fixtures/get_callers-query-v1.json
@@ -0,0 +1 @@
+{"schema":"compass.query/1","operation":"callers","results":[],"nodes":[{"id":"n:caller","kind":"function","roles":[],"name":"Caller","qualifiedName":"Fixture.Caller","language":"rust","framework":null,"source":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"details":null,"evidence":[{"layer":"structural_graph","origin":"ast","extractor":"mcp-test","confidence":"exact","anchor":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"rule":null,"wiringSite":null,"resolution":"exact"}]},{"id":"n:target","kind":"function","roles":[],"name":"Target","qualifiedName":"Fixture.Target","language":"rust","framework":null,"source":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"details":null,"evidence":[{"layer":"structural_graph","origin":"ast","extractor":"mcp-test","confidence":"exact","anchor":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"rule":null,"wiringSite":null,"resolution":"exact"}]}],"edges":[{"id":"sha256:535e0008b8e0bdc764fca652e83b7a3323e07fd6b623f941813ec523e5d7851e","source":"n:caller","target":"n:target","kind":"calls","relationshipSite":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"details":null,"evidence":[{"layer":"structural_graph","origin":"ast","extractor":"mcp-test","confidence":"exact","anchor":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"rule":null,"wiringSite":null,"resolution":"exact"}]}],"files":[],"paths":[],"diagnostics":[],"limits":{"maxDepth":8,"maxNodes":500,"maxEdges":1000,"maxPaths":100,"maxCandidates":20,"maxSourceBytes":1048576,"maxResponseBytes":8388608},"truncated":false}
diff --git a/crates/compass-mcp/tests/fixtures/get_callers-result.json b/crates/compass-mcp/tests/fixtures/get_callers-result.json
new file mode 100644
index 000000000..c36c95668
--- /dev/null
+++ b/crates/compass-mcp/tests/fixtures/get_callers-result.json
@@ -0,0 +1 @@
+{"schema":"compass.code_context.v1","repository":"sha256:test","generation":"sha256:test","freshness":{"status":"unknown"},"data":{"schema":"compass.query/1","operation":"callers","results":[],"nodes":[{"id":"n:caller","kind":"function","roles":[],"name":"Caller","qualifiedName":"Fixture.Caller","language":"rust","framework":null,"source":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"details":null,"evidence":[{"layer":"structural_graph","origin":"ast","extractor":"mcp-test","confidence":"exact","anchor":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"rule":null,"wiringSite":null,"resolution":"exact"}]},{"id":"n:target","kind":"function","roles":[],"name":"Target","qualifiedName":"Fixture.Target","language":"rust","framework":null,"source":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"details":null,"evidence":[{"layer":"structural_graph","origin":"ast","extractor":"mcp-test","confidence":"exact","anchor":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"rule":null,"wiringSite":null,"resolution":"exact"}]}],"edges":[{"id":"sha256:535e0008b8e0bdc764fca652e83b7a3323e07fd6b623f941813ec523e5d7851e","source":"n:caller","target":"n:target","kind":"calls","relationshipSite":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"details":null,"evidence":[{"layer":"structural_graph","origin":"ast","extractor":"mcp-test","confidence":"exact","anchor":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"rule":null,"wiringSite":null,"resolution":"exact"}]}],"files":[],"paths":[],"diagnostics":[],"limits":{"maxDepth":8,"maxNodes":500,"maxEdges":1000,"maxPaths":100,"maxCandidates":20,"maxSourceBytes":1048576,"maxResponseBytes":8388608},"truncated":false},"evidence":{"records":3,"anchored":3},"confidence":{"exact":3,"inferred":0,"ambiguous":0},"truncation":{"truncated":false,"next":null},"warnings":[]}
diff --git a/crates/compass-mcp/tests/fixtures/get_impact-query-v1.json b/crates/compass-mcp/tests/fixtures/get_impact-query-v1.json
new file mode 100644
index 000000000..9a0aa1a34
--- /dev/null
+++ b/crates/compass-mcp/tests/fixtures/get_impact-query-v1.json
@@ -0,0 +1 @@
+{"schema":"compass.query/1","operation":"impact","results":[],"nodes":[{"id":"n:caller","kind":"function","roles":[],"name":"Caller","qualifiedName":"Fixture.Caller","language":"rust","framework":null,"source":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"details":null,"evidence":[{"layer":"structural_graph","origin":"ast","extractor":"mcp-test","confidence":"exact","anchor":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"rule":null,"wiringSite":null,"resolution":"exact"}]},{"id":"n:target","kind":"function","roles":[],"name":"Target","qualifiedName":"Fixture.Target","language":"rust","framework":null,"source":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"details":null,"evidence":[{"layer":"structural_graph","origin":"ast","extractor":"mcp-test","confidence":"exact","anchor":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"rule":null,"wiringSite":null,"resolution":"exact"}]}],"edges":[{"id":"sha256:535e0008b8e0bdc764fca652e83b7a3323e07fd6b623f941813ec523e5d7851e","source":"n:caller","target":"n:target","kind":"calls","relationshipSite":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"details":null,"evidence":[{"layer":"structural_graph","origin":"ast","extractor":"mcp-test","confidence":"exact","anchor":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"rule":null,"wiringSite":null,"resolution":"exact"}]}],"files":[],"paths":[{"id":"path:sha256:535e0008b8e0bdc764fca652e83b7a3323e07fd6b623f941813ec523e5d7851e","nodeIds":["n:target","n:caller"],"edgeIds":["sha256:535e0008b8e0bdc764fca652e83b7a3323e07fd6b623f941813ec523e5d7851e"],"weakestResolution":"exact","weakestConfidence":"exact"}],"diagnostics":[],"limits":{"maxDepth":8,"maxNodes":500,"maxEdges":1000,"maxPaths":100,"maxCandidates":20,"maxSourceBytes":1048576,"maxResponseBytes":8388608},"truncated":false}
diff --git a/crates/compass-mcp/tests/fixtures/get_impact-result.json b/crates/compass-mcp/tests/fixtures/get_impact-result.json
new file mode 100644
index 000000000..524223a74
--- /dev/null
+++ b/crates/compass-mcp/tests/fixtures/get_impact-result.json
@@ -0,0 +1 @@
+{"schema":"compass.code_context.v1","repository":"sha256:test","generation":"sha256:test","freshness":{"status":"unknown"},"data":{"schema":"compass.query/1","operation":"impact","results":[],"nodes":[{"id":"n:caller","kind":"function","roles":[],"name":"Caller","qualifiedName":"Fixture.Caller","language":"rust","framework":null,"source":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"details":null,"evidence":[{"layer":"structural_graph","origin":"ast","extractor":"mcp-test","confidence":"exact","anchor":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"rule":null,"wiringSite":null,"resolution":"exact"}]},{"id":"n:target","kind":"function","roles":[],"name":"Target","qualifiedName":"Fixture.Target","language":"rust","framework":null,"source":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"details":null,"evidence":[{"layer":"structural_graph","origin":"ast","extractor":"mcp-test","confidence":"exact","anchor":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"rule":null,"wiringSite":null,"resolution":"exact"}]}],"edges":[{"id":"sha256:535e0008b8e0bdc764fca652e83b7a3323e07fd6b623f941813ec523e5d7851e","source":"n:caller","target":"n:target","kind":"calls","relationshipSite":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"details":null,"evidence":[{"layer":"structural_graph","origin":"ast","extractor":"mcp-test","confidence":"exact","anchor":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"rule":null,"wiringSite":null,"resolution":"exact"}]}],"files":[],"paths":[{"id":"path:sha256:535e0008b8e0bdc764fca652e83b7a3323e07fd6b623f941813ec523e5d7851e","nodeIds":["n:target","n:caller"],"edgeIds":["sha256:535e0008b8e0bdc764fca652e83b7a3323e07fd6b623f941813ec523e5d7851e"],"weakestResolution":"exact","weakestConfidence":"exact"}],"diagnostics":[],"limits":{"maxDepth":8,"maxNodes":500,"maxEdges":1000,"maxPaths":100,"maxCandidates":20,"maxSourceBytes":1048576,"maxResponseBytes":8388608},"truncated":false},"evidence":{"records":3,"anchored":3},"confidence":{"exact":3,"inferred":0,"ambiguous":0},"truncation":{"truncated":false,"next":null},"warnings":[]}
diff --git a/crates/compass-mcp/tests/fixtures/rmcp-2.2-server-discover.json b/crates/compass-mcp/tests/fixtures/rmcp-2.2-server-discover.json
new file mode 100644
index 000000000..c31b5d0e4
--- /dev/null
+++ b/crates/compass-mcp/tests/fixtures/rmcp-2.2-server-discover.json
@@ -0,0 +1,123 @@
+{
+  "serverInfo": { "name": "compass", "version": "0.3.7" },
+  "capabilities": {
+    "experimental": {},
+    "resources": { "subscribe": false, "listChanged": false },
+    "tools": { "listChanged": false }
+  },
+  "tools": [
+    {
+      "name": "search_symbols",
+      "description": "Search Compass code symbols with the trusted FTS5 index.",
+      "inputSchemaSha256": "df170b3f22be4fc77387451f05377db4edec7d19c9df1e21d449d34cde47623f",
+      "outputSchemaSha256": "4f21d4f3609e8de41ed866beeb00eb8dc160f87039c5ab9a16e43d0b832d6811",
+      "meta": null
+    },
+    {
+      "name": "get_callers",
+      "description": "Return one-hop callers and route bindings for a symbol.",
+      "inputSchemaSha256": "1ba62b0f7c36273912f66f28fc87b7e6e6d0f5b4195a8cf9b1f7b41d3a869f24",
+      "outputSchemaSha256": "d8a8e3afa72e1543381e7a0876cc628645a1cf130ed9425c802e85d83a560597",
+      "meta": null
+    },
+    {
+      "name": "get_callees",
+      "description": "Return one-hop callees for a symbol.",
+      "inputSchemaSha256": "1ba62b0f7c36273912f66f28fc87b7e6e6d0f5b4195a8cf9b1f7b41d3a869f24",
+      "outputSchemaSha256": "e70af59566e98b2565979f0810e52de25d679cc7d8f7fcfcf2e10c381590cc90",
+      "meta": null
+    },
+    {
+      "name": "get_impact",
+      "description": "Return the bounded transitive impact radius for a symbol.",
+      "inputSchemaSha256": "1ba62b0f7c36273912f66f28fc87b7e6e6d0f5b4195a8cf9b1f7b41d3a869f24",
+      "outputSchemaSha256": "0999677d330f016ceaa747342e17a5cb53c21311dfb6a3f9dec0b8054a9a63c9",
+      "meta": null
+    },
+    {
+      "name": "explore_code",
+      "description": "Return related symbols, connecting paths, and verified source grouped by file.",
+      "inputSchemaSha256": "5a398ec333fe461aad7e7aeef15bc7842f5f098f57ac9de445d5b009e88fdfa1",
+      "outputSchemaSha256": null,
+      "meta": null
+    },
+    {
+      "name": "get_node",
+      "description": "Return the trusted evidence trail between two code-graph nodes.",
+      "inputSchemaSha256": "ec0b8e297e45abfab2654128199b3a3a0af8dfe0628aae08f098fb22c8e3fe32",
+      "outputSchemaSha256": null,
+      "meta": null
+    },
+    {
+      "name": "query_graph",
+      "description": "Route clear natural-language intents through bounded typed code queries. DEPRECATED text mode: explicit BFS/DFS traversal controls return legacy text; use the typed navigation tools.",
+      "inputSchemaSha256": "4dcfe2279aa911354ddcd5f272e55358addf462922a38923bae85515034749d3",
+      "outputSchemaSha256": null,
+      "meta": {"compass/deprecatedTextMode": true, "compass/deprecatedSince": "0.4.0"}
+    },
+    {
+      "name": "get_neighbors",
+      "description": "DEPRECATED text result: get direct neighbors of a node with edge details; use typed navigation tools for machine-readable evidence.",
+      "inputSchemaSha256": "12796fe72a0b8ab8dd19e537713d3b761170b4c88ae4781741e5ee870ef9c512",
+      "outputSchemaSha256": null,
+      "meta": {"compass/deprecated": true, "compass/deprecatedSince": "0.4.0", "compass/deprecationReason": "legacy text result; use a typed navigation result"}
+    },
+    {
+      "name": "get_community",
+      "description": "DEPRECATED text result: get nodes in a community; a typed replacement is pending.",
+      "inputSchemaSha256": "5f13bd931adf8f9bf8e057c7a917bc4bdcaec9fa3fa9f688ce2e7a6f5b8b40d4",
+      "outputSchemaSha256": null,
+      "meta": {"compass/deprecated": true, "compass/deprecatedSince": "0.4.0", "compass/deprecationReason": "legacy text result; use a typed navigation result"}
+    },
+    {
+      "name": "god_nodes",
+      "description": "DEPRECATED text result: return the most connected nodes; a typed replacement is pending.",
+      "inputSchemaSha256": "df352c1270d201428785d2a222339df526ea26add33f3b9a0bff35882ddcb18b",
+      "outputSchemaSha256": null,
+      "meta": {"compass/deprecated": true, "compass/deprecatedSince": "0.4.0", "compass/deprecationReason": "legacy text result; use a typed navigation result"}
+    },
+    {
+      "name": "graph_stats",
+      "description": "DEPRECATED text result: return graph summary statistics; a typed replacement is pending.",
+      "inputSchemaSha256": "30af74bece539d75af9d33b742faa1679a684daa11fb081aa4f4052ff9390346",
+      "outputSchemaSha256": null,
+      "meta": {"compass/deprecated": true, "compass/deprecatedSince": "0.4.0", "compass/deprecationReason": "legacy text result; use a typed navigation result"}
+    },
+    {
+      "name": "shortest_path",
+      "description": "DEPRECATED text result: find a shortest path; use get_node for typed directed evidence.",
+      "inputSchemaSha256": "3c41eef041a3e532995559db0f57c58f206fd962c19f601b891a3747a897aa0d",
+      "outputSchemaSha256": null,
+      "meta": {"compass/deprecated": true, "compass/deprecatedSince": "0.4.0", "compass/deprecationReason": "legacy text result; use a typed navigation result"}
+    },
+    {
+      "name": "list_prs",
+      "description": "DEPRECATED text result: list open GitHub PRs with CI, review, and graph-impact context; a typed replacement is pending.",
+      "inputSchemaSha256": "878ed13d2d718235d0fbbf3eea60405018ed32bc3ca9d797d0b7c9824829bdbf",
+      "outputSchemaSha256": null,
+      "meta": {"compass/deprecated": true, "compass/deprecatedSince": "0.4.0", "compass/deprecationReason": "legacy text result; use a typed navigation result"}
+    },
+    {
+      "name": "get_pr_impact",
+      "description": "DEPRECATED text result: get graph impact for a pull request; use get_impact for typed symbol impact or await the typed PR replacement.",
+      "inputSchemaSha256": "4f0abdeb62d25d91210ada4310071176039f74a85c24bd38adf8bccb778ac454",
+      "outputSchemaSha256": null,
+      "meta": {"compass/deprecated": true, "compass/deprecatedSince": "0.4.0", "compass/deprecationReason": "legacy text result; use a typed navigation result"}
+    },
+    {
+      "name": "triage_prs",
+      "description": "DEPRECATED text result: triage actionable open pull requests; a typed replacement is pending.",
+      "inputSchemaSha256": "878ed13d2d718235d0fbbf3eea60405018ed32bc3ca9d797d0b7c9824829bdbf",
+      "outputSchemaSha256": null,
+      "meta": {"compass/deprecated": true, "compass/deprecatedSince": "0.4.0", "compass/deprecationReason": "legacy text result; use a typed navigation result"}
+    }
+  ],
+  "resources": [
+    { "uri": "compass://report", "name": "Graph Report", "description": "Full GRAPH_REPORT.md", "mimeType": "text/markdown" },
+    { "uri": "compass://stats", "name": "Graph Stats", "description": "Node/edge/community counts and confidence breakdown", "mimeType": "text/plain" },
+    { "uri": "compass://god-nodes", "name": "God Nodes", "description": "Top 10 most-connected nodes", "mimeType": "text/plain" },
+    { "uri": "compass://surprises", "name": "Surprising Connections", "description": "Cross-community surprising connections", "mimeType": "text/plain" },
+    { "uri": "compass://audit", "name": "Confidence Audit", "description": "EXTRACTED/INFERRED/AMBIGUOUS edge breakdown", "mimeType": "text/plain" },
+    { "uri": "compass://questions", "name": "Suggested Questions", "description": "Suggested questions for this codebase", "mimeType": "text/plain" }
+  ]
+}
diff --git a/crates/compass-mcp/tests/fixtures/search_symbols-query-v1.json b/crates/compass-mcp/tests/fixtures/search_symbols-query-v1.json
new file mode 100644
index 000000000..245c2c309
--- /dev/null
+++ b/crates/compass-mcp/tests/fixtures/search_symbols-query-v1.json
@@ -0,0 +1 @@
+{"schema":"compass.query/1","operation":"search","results":[{"nodeId":"n:target","score":320000.0,"matchedFields":["name","qualified_name"]}],"nodes":[{"id":"n:target","kind":"function","roles":[],"name":"Target","qualifiedName":"Fixture.Target","language":"rust","framework":null,"source":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"details":null,"evidence":[{"layer":"structural_graph","origin":"ast","extractor":"mcp-test","confidence":"exact","anchor":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"rule":null,"wiringSite":null,"resolution":"exact"}]}],"edges":[],"files":[],"paths":[],"diagnostics":[],"limits":{"maxDepth":8,"maxNodes":500,"maxEdges":1000,"maxPaths":100,"maxCandidates":20,"maxSourceBytes":1048576,"maxResponseBytes":8388608},"truncated":false}
diff --git a/crates/compass-mcp/tests/fixtures/search_symbols-result.json b/crates/compass-mcp/tests/fixtures/search_symbols-result.json
new file mode 100644
index 000000000..c86124dec
--- /dev/null
+++ b/crates/compass-mcp/tests/fixtures/search_symbols-result.json
@@ -0,0 +1 @@
+{"schema":"compass.code_context.v1","repository":"sha256:test","generation":"sha256:test","freshness":{"status":"unknown"},"data":{"schema":"compass.query/1","operation":"search","results":[{"nodeId":"n:target","score":320000.0,"matchedFields":["name","qualified_name"]}],"nodes":[{"id":"n:target","kind":"function","roles":[],"name":"Target","qualifiedName":"Fixture.Target","language":"rust","framework":null,"source":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"details":null,"evidence":[{"layer":"structural_graph","origin":"ast","extractor":"mcp-test","confidence":"exact","anchor":{"file":"src/lib.rs","startByte":0,"endByte":4,"startLine":1,"startColumn":0,"endLine":1,"endColumn":4},"rule":null,"wiringSite":null,"resolution":"exact"}]}],"edges":[],"files":[],"paths":[],"diagnostics":[],"limits":{"maxDepth":8,"maxNodes":500,"maxEdges":1000,"maxPaths":100,"maxCandidates":20,"maxSourceBytes":1048576,"maxResponseBytes":8388608},"truncated":false},"evidence":{"records":1,"anchored":1},"confidence":{"exact":1,"inferred":0,"ambiguous":0},"truncation":{"truncated":false,"next":null},"warnings":[]}
diff --git a/crates/compass-mcp/tests/protocol_conformance.rs b/crates/compass-mcp/tests/protocol_conformance.rs
new file mode 100644
index 000000000..6fd037f4d
--- /dev/null
+++ b/crates/compass-mcp/tests/protocol_conformance.rs
@@ -0,0 +1,157 @@
+use std::error::Error;
+use std::fs;
+
+use compass_mcp::CompassMcp;
+use rmcp::model::{
+    CallToolRequestParams, ClientCapabilities, ClientInfo, Implementation, ProtocolVersion,
+    ReadResourceRequestParams,
+};
+use rmcp::{ClientLifecycleMode, ClientServiceExt, ServiceExt};
+
+#[tokio::test]
+async fn stdio_conformance_discovers_lists_invokes_reads_and_closes() -> Result<(), Box<dyn Error>>
+{
+    let temp = tempfile::tempdir()?;
+    let graph = temp.path().join("graph.json");
+    fs::write(
+        &graph,
+        r#"{
+          "directed":true,"multigraph":false,"graph":{},
+          "nodes":[{"id":"a","label":"Alpha","community":0}],
+          "links":[]
+        }"#,
+    )?;
+    fs::write(
+        temp.path().join("GRAPH_REPORT.md"),
+        "# Conformance fixture\n",
+    )?;
+
+    let (server_transport, client_transport) = tokio::io::duplex(64 * 1024);
+    let server_task = tokio::spawn(async move {
+        let running = CompassMcp::new(graph)
+            .serve(server_transport)
+            .await
+            .map_err(|error| error.to_string())?;
+        running.waiting().await.map_err(|error| error.to_string())
+    });
+    let client_info = ClientInfo::new(
+        ClientCapabilities::default(),
+        Implementation::new("compass-conformance", env!("CARGO_PKG_VERSION")),
+    )
+    .with_protocol_version(ProtocolVersion::V_2026_07_28);
+    let client = client_info
+        .serve_with_lifecycle(
+            client_transport,
+            ClientLifecycleMode::Discover {
+                preferred_versions: vec![ProtocolVersion::V_2026_07_28],
+            },
+        )
+        .await?;
+
+    let peer = client.peer_info().ok_or("missing MCP peer information")?;
+    assert_eq!(peer.protocol_version, ProtocolVersion::V_2026_07_28);
+    let server_info = peer
+        .server_info
+        .as_ref()
+        .ok_or("missing MCP server identity")?;
+    assert_eq!(server_info.name, "compass");
+    let tools = client.list_tools(None).await?;
+    let tool_names = tools
+        .tools
+        .iter()
+        .map(|tool| tool.name.as_ref())
+        .collect::<Vec<_>>();
+    assert_eq!(
+        tool_names,
+        [
+            "search_symbols",
+            "get_callers",
+            "get_callees",
+            "get_impact",
+            "explore_code",
+            "get_node",
+            "query_graph",
+            "get_neighbors",
+            "get_community",
+            "god_nodes",
+            "graph_stats",
+            "shortest_path",
+            "list_prs",
+            "get_pr_impact",
+            "triage_prs",
+        ]
+    );
+    let resources = client.list_resources(None).await?;
+    let resource_uris = resources
+        .resources
+        .iter()
+        .map(|resource| resource.uri.as_str())
+        .collect::<Vec<_>>();
+    assert_eq!(
+        resource_uris,
+        [
+            "compass://report",
+            "compass://stats",
+            "compass://god-nodes",
+            "compass://surprises",
+            "compass://audit",
+            "compass://questions",
+        ]
+    );
+
+    let call = client
+        .call_tool(CallToolRequestParams::new("graph_stats"))
+        .await?;
+    let text = call
+        .content
+        .first()
+        .and_then(|content| content.as_text())
+        .map(|content| content.text.as_str());
+    assert!(text.is_some_and(|text| text.contains("Nodes: 1")));
+
+    let report = client
+        .read_resource(ReadResourceRequestParams::new("compass://report"))
+        .await?;
+    assert_eq!(report.contents.len(), 1);
+    assert!(
+        client
+            .read_resource(ReadResourceRequestParams::new("compass://missing"))
+            .await
+            .is_err()
+    );
+
+    client.cancel().await?;
+    server_task.await?.map_err(std::io::Error::other)?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn stdio_rejects_a_legacy_initialize_lifecycle() -> Result<(), Box<dyn Error>> {
+    let (server_transport, client_transport) = tokio::io::duplex(16 * 1024);
+    let server_task = tokio::spawn(async move {
+        let running = CompassMcp::new("missing.json")
+            .serve(server_transport)
+            .await
+            .map_err(|error| error.to_string())?;
+        running.waiting().await.map_err(|error| error.to_string())
+    });
+    let client_info = ClientInfo::new(
+        ClientCapabilities::default(),
+        Implementation::new("legacy-conformance-client", "2025-11-25"),
+    )
+    .with_protocol_version(ProtocolVersion::V_2025_11_25);
+    let client_result = client_info
+        .serve_with_lifecycle(client_transport, ClientLifecycleMode::Initialize)
+        .await;
+
+    let error = client_result
+        .err()
+        .ok_or("legacy stdio lifecycle was accepted")?;
+    let diagnostic = error.to_string();
+    assert!(
+        diagnostic.contains("initialize is not available in MCP 2026-07-28"),
+        "unexpected legacy rejection: {diagnostic}"
+    );
+    assert!(server_task.await?.is_err());
+    Ok(())
+}
diff --git a/crates/compass-model/src/code_graph.rs b/crates/compass-model/src/code_graph.rs
index 46e77b5cb..9a5b0b7c6 100644
--- a/crates/compass-model/src/code_graph.rs
+++ b/crates/compass-model/src/code_graph.rs
@@ -66,6 +66,54 @@ pub enum NodeKind {
 }
 
 impl NodeKind {
+    pub const ALL: [Self; 45] = [
+        Self::File,
+        Self::Module,
+        Self::Package,
+        Self::Namespace,
+        Self::Class,
+        Self::Struct,
+        Self::Interface,
+        Self::Trait,
+        Self::Protocol,
+        Self::Enum,
+        Self::EnumMember,
+        Self::TypeAlias,
+        Self::Function,
+        Self::Method,
+        Self::Constructor,
+        Self::Property,
+        Self::Field,
+        Self::Variable,
+        Self::Constant,
+        Self::Parameter,
+        Self::Import,
+        Self::Export,
+        Self::Macro,
+        Self::Annotation,
+        Self::Route,
+        Self::Component,
+        Self::Event,
+        Self::Message,
+        Self::Topic,
+        Self::Queue,
+        Self::Job,
+        Self::Resource,
+        Self::Schema,
+        Self::Query,
+        Self::Migration,
+        Self::ConfigKey,
+        Self::Database,
+        Self::DatabaseSchema,
+        Self::DatabaseTable,
+        Self::DatabaseView,
+        Self::DatabaseColumn,
+        Self::DatabaseIndex,
+        Self::DatabaseConstraint,
+        Self::DatabaseProcedure,
+        Self::DatabaseTrigger,
+    ];
+
     #[must_use]
     pub const fn as_str(self) -> &'static str {
         match self {
@@ -191,6 +239,43 @@ pub enum NodeRole {
     Generated,
 }
 
+impl NodeRole {
+    pub const ALL: [Self; 13] = [
+        Self::Controller,
+        Self::RouteHandler,
+        Self::Middleware,
+        Self::Service,
+        Self::Resolver,
+        Self::Consumer,
+        Self::Producer,
+        Self::Subscriber,
+        Self::Repository,
+        Self::Model,
+        Self::Test,
+        Self::Fixture,
+        Self::Generated,
+    ];
+
+    #[must_use]
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::Controller => "controller",
+            Self::RouteHandler => "route_handler",
+            Self::Middleware => "middleware",
+            Self::Service => "service",
+            Self::Resolver => "resolver",
+            Self::Consumer => "consumer",
+            Self::Producer => "producer",
+            Self::Subscriber => "subscriber",
+            Self::Repository => "repository",
+            Self::Model => "model",
+            Self::Test => "test",
+            Self::Fixture => "fixture",
+            Self::Generated => "generated",
+        }
+    }
+}
+
 /// The closed relationship vocabulary for `compass.graph/1`.
 #[derive(Clone, Copy, Debug, Eq, Hash, PartialEq, Serialize, Deserialize)]
 #[serde(rename_all = "snake_case")]
@@ -227,6 +312,38 @@ pub enum EdgeKind {
 }
 
 impl EdgeKind {
+    pub const ALL: [Self; 29] = [
+        Self::Contains,
+        Self::Embeds,
+        Self::Calls,
+        Self::Imports,
+        Self::Exports,
+        Self::Extends,
+        Self::Implements,
+        Self::References,
+        Self::TypeOf,
+        Self::Returns,
+        Self::Instantiates,
+        Self::Overrides,
+        Self::Decorates,
+        Self::RoutesTo,
+        Self::Reads,
+        Self::Writes,
+        Self::Aliases,
+        Self::Registers,
+        Self::Handles,
+        Self::Publishes,
+        Self::Subscribes,
+        Self::Produces,
+        Self::Consumes,
+        Self::Schedules,
+        Self::Triggers,
+        Self::Tests,
+        Self::DependsOn,
+        Self::Documents,
+        Self::MapsTo,
+    ];
+
     #[must_use]
     pub const fn as_str(self) -> &'static str {
         match self {
diff --git a/crates/compass-model/src/lib.rs b/crates/compass-model/src/lib.rs
index 1c58c590a..177a7c84d 100644
--- a/crates/compass-model/src/lib.rs
+++ b/crates/compass-model/src/lib.rs
@@ -19,6 +19,6 @@ pub use graph::{EdgeIndex, Graph, NodeIndex};
 pub use query_index::{QueryIndex, SchemaFingerprint, cypher_node_label, cypher_relationship_type};
 pub use validation::{
     CodeGraphValidationError, CodeGraphValidationReport, ExtractionValidationError,
-    RecordValidationErrors, assert_valid_extraction, validate_code_graph,
-    validate_code_graph_records, validate_extraction,
+    RecordValidationErrors, assert_valid_extraction, validate_build_metadata_identity,
+    validate_code_graph, validate_code_graph_records, validate_extraction,
 };
diff --git a/crates/compass-model/src/query_contract.rs b/crates/compass-model/src/query_contract.rs
index 4419b3b87..e4dc6a433 100644
--- a/crates/compass-model/src/query_contract.rs
+++ b/crates/compass-model/src/query_contract.rs
@@ -1,11 +1,24 @@
 use serde::{Deserialize, Serialize};
 
-use crate::code_graph::{EdgeDetails, EdgeKind, NodeDetails, NodeKind, NodeRole};
+use crate::code_graph::{
+    EdgeDetails, EdgeKind, EdgeRecord, NodeDetails, NodeKind, NodeRecord, NodeRole,
+};
 use crate::provenance::{
     EvidenceConfidence, EvidenceOrigin, ResolutionCandidate, ResolutionState, SourceAnchor,
 };
 
 pub const CODE_QUERY_SCHEMA_V1: &str = "compass.query/1";
+pub const STRUCTURAL_QUERY_SCHEMA_V1: &str = "compass.structural-query/1";
+
+/// Normalize an exact structural symbol operand consistently across engines.
+#[must_use]
+pub fn normalize_query_symbol(value: &str) -> String {
+    value
+        .trim()
+        .trim_end_matches("()")
+        .trim_start_matches('.')
+        .to_lowercase()
+}
 
 #[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize, Deserialize)]
 #[serde(rename_all = "snake_case")]
@@ -157,6 +170,61 @@ impl CodeQueryResponse {
                 .then_with(|| left.node_id.cmp(&right.node_id))
         });
     }
+
+    /// Project transport-independent structural semantics for differential
+    /// engine qualification.
+    #[must_use]
+    pub fn structural_view(
+        &self,
+        repository_id: impl Into<String>,
+        generation_id: impl Into<String>,
+    ) -> StructuralQueryResponse {
+        let mut response = StructuralQueryResponse {
+            schema: STRUCTURAL_QUERY_SCHEMA_V1.to_owned(),
+            repository_id: repository_id.into(),
+            generation_id: generation_id.into(),
+            operation: self.operation,
+            nodes: self.nodes.clone(),
+            edges: self.edges.clone(),
+            paths: self.paths.clone(),
+            diagnostics: self.diagnostics.clone(),
+            limits: self.limits.clone(),
+            truncated: self.truncated,
+        };
+        response.sort_stable();
+        response
+    }
+}
+
+/// Canonical structural subset used to compare independent query engines.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct StructuralQueryResponse {
+    pub schema: String,
+    pub repository_id: String,
+    pub generation_id: String,
+    pub operation: CodeQueryOperation,
+    pub nodes: Vec<QueryNode>,
+    pub edges: Vec<QueryEdge>,
+    pub paths: Vec<QueryPath>,
+    pub diagnostics: Vec<QueryDiagnostic>,
+    pub limits: CodeQueryLimits,
+    pub truncated: bool,
+}
+
+impl StructuralQueryResponse {
+    pub fn sort_stable(&mut self) {
+        self.nodes.sort_by(|left, right| left.id.cmp(&right.id));
+        self.edges.sort_by(|left, right| left.id.cmp(&right.id));
+        self.paths.sort_by(|left, right| left.id.cmp(&right.id));
+        self.diagnostics.sort_by(|left, right| {
+            left.code
+                .cmp(&right.code)
+                .then_with(|| left.message.cmp(&right.message))
+                .then_with(|| left.node_id.cmp(&right.node_id))
+                .then_with(|| left.path.cmp(&right.path))
+        });
+    }
 }
 
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
@@ -251,3 +319,91 @@ pub struct QueryEvidence {
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub candidates: Vec<ResolutionCandidate>,
 }
+
+/// Convert one canonical graph node into the shared structural query contract.
+#[must_use]
+pub fn query_node_from_record(node: &NodeRecord) -> QueryNode {
+    QueryNode {
+        id: node.id.clone(),
+        kind: node.kind,
+        roles: node.roles.clone(),
+        name: node.name.clone(),
+        qualified_name: node.qualified_name.clone(),
+        language: node.language.clone(),
+        framework: node.framework.clone(),
+        source: node.source.clone(),
+        details: node.details.clone(),
+        evidence: node.evidence.iter().map(structural_evidence).collect(),
+    }
+}
+
+/// Convert one canonical graph relation into the shared structural query contract.
+#[must_use]
+pub fn query_edge_from_record(edge: &EdgeRecord) -> QueryEdge {
+    QueryEdge {
+        id: edge.id.clone(),
+        source: edge.source.clone(),
+        target: edge.target.clone(),
+        kind: edge.kind,
+        relationship_site: edge.relationship_site.clone(),
+        details: edge.details.clone(),
+        evidence: edge.evidence.iter().map(structural_evidence).collect(),
+    }
+}
+
+/// Build the deterministic path contract from canonical relation evidence.
+#[must_use]
+pub fn query_path_from_records(
+    nodes: &[String],
+    edges: &[String],
+    selected: &[EdgeRecord],
+) -> QueryPath {
+    let weakest_confidence = selected
+        .iter()
+        .flat_map(|edge| &edge.evidence)
+        .map(|evidence| evidence.confidence)
+        .max_by_key(|confidence| match confidence {
+            EvidenceConfidence::Exact => 0,
+            EvidenceConfidence::Inferred => 1,
+            EvidenceConfidence::Ambiguous => 2,
+        })
+        .unwrap_or(EvidenceConfidence::Exact);
+    let weakest_resolution = if weakest_confidence == EvidenceConfidence::Ambiguous {
+        ResolutionState::Ambiguous
+    } else if weakest_confidence == EvidenceConfidence::Inferred {
+        ResolutionState::Unresolved
+    } else {
+        ResolutionState::Exact
+    };
+    QueryPath {
+        id: format!("path:{}", edges.join(":")),
+        node_ids: nodes.to_vec(),
+        edge_ids: edges.to_vec(),
+        weakest_resolution,
+        weakest_confidence,
+    }
+}
+
+fn structural_evidence(evidence: &crate::provenance::Provenance) -> QueryEvidence {
+    QueryEvidence {
+        layer: QueryEvidenceLayer::StructuralGraph,
+        origin: evidence.origin,
+        extractor: evidence.extractor.clone(),
+        confidence: evidence.confidence,
+        anchor: evidence.anchors.first().cloned(),
+        rule: evidence.rule.clone(),
+        wiring_site: evidence.wiring_site.clone(),
+        resolution: if evidence.confidence == EvidenceConfidence::Ambiguous
+            || evidence.candidates.len() > 1
+        {
+            ResolutionState::Ambiguous
+        } else if evidence.confidence == EvidenceConfidence::Inferred
+            && evidence.candidates.is_empty()
+        {
+            ResolutionState::Unresolved
+        } else {
+            ResolutionState::Exact
+        },
+        candidates: evidence.candidates.clone(),
+    }
+}
diff --git a/crates/compass-model/src/validation.rs b/crates/compass-model/src/validation.rs
index fe4ff5d17..03cf625c0 100644
--- a/crates/compass-model/src/validation.rs
+++ b/crates/compass-model/src/validation.rs
@@ -5,8 +5,8 @@ use rayon::prelude::*;
 use serde_json::Value;
 
 use crate::code_graph::{
-    CODE_GRAPH_SCHEMA_V1, EdgeKind, GraphDocument as CodeGraphDocument, NodeDetails, NodeKind,
-    NodeRole,
+    BuildMetadata, CODE_GRAPH_SCHEMA_V1, EdgeKind, GraphDocument as CodeGraphDocument, NodeDetails,
+    NodeKind, NodeRole,
 };
 use crate::identity::{edge_id, file_id};
 use crate::provenance::{Provenance, SourceAnchor};
@@ -231,6 +231,9 @@ pub fn validate_code_graph_records(document: &CodeGraphDocument) -> CodeGraphVal
             document.graph.schema
         ));
     }
+    report
+        .document_errors
+        .extend(build_metadata_identity_errors(&document.graph.build));
 
     let mut files = HashMap::new();
     for file in &document.graph.files {
@@ -464,6 +467,33 @@ pub fn validate_code_graph(document: &CodeGraphDocument) -> Result<(), CodeGraph
     }
 }
 
+/// Validate the realization identities shared by typed graphs, immutable
+/// stores, and structured query-result envelopes.
+pub fn validate_build_metadata_identity(
+    build: &BuildMetadata,
+) -> Result<(), CodeGraphValidationError> {
+    let errors = build_metadata_identity_errors(build);
+    if errors.is_empty() {
+        Ok(())
+    } else {
+        Err(CodeGraphValidationError { errors })
+    }
+}
+
+fn build_metadata_identity_errors(build: &BuildMetadata) -> Vec<String> {
+    [
+        (
+            "graph.build.sourceTreeDigest",
+            build.source_tree_digest.as_str(),
+        ),
+        ("graph.build.generationId", build.generation_id.as_str()),
+    ]
+    .into_iter()
+    .filter(|(_, value)| value.trim().is_empty())
+    .map(|(field, _)| format!("{field} must not be empty"))
+    .collect()
+}
+
 fn validate_evidence(
     owner: &str,
     evidence: &[Provenance],
diff --git a/crates/compass-partition/Cargo.toml b/crates/compass-partition/Cargo.toml
new file mode 100644
index 000000000..163c340de
--- /dev/null
+++ b/crates/compass-partition/Cargo.toml
@@ -0,0 +1,19 @@
+[package]
+name = "compass-partition"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+repository.workspace = true
+homepage.workspace = true
+readme.workspace = true
+description.workspace = true
+keywords.workspace = true
+categories.workspace = true
+
+[dependencies]
+serde_json.workspace = true
+thiserror.workspace = true
+
+[lints]
+workspace = true
diff --git a/crates/compass-partition/src/lib.rs b/crates/compass-partition/src/lib.rs
new file mode 100644
index 000000000..cf388edab
--- /dev/null
+++ b/crates/compass-partition/src/lib.rs
@@ -0,0 +1,149 @@
+//! Storage-neutral graph partitions, stable record keys, and canonical JSON encoding.
+
+use serde_json::Value;
+
+const KEY_SCHEMA_V1: &[u8] = &[1];
+const NODE_KIND: &[u8] = &[1];
+const EDGE_KIND: &[u8] = &[2];
+const HYPEREDGE_KIND: &[u8] = &[3];
+
+/// Version of the byte-stable canonical JSON encoding.
+pub const CANONICAL_ENCODING_VERSION: u32 = 1;
+
+/// Errors produced while encoding storage-neutral partition values.
+#[derive(Debug, thiserror::Error)]
+pub enum PartitionError {
+    /// A value could not be represented by the canonical encoding.
+    #[error("canonical encoding failed: {0}")]
+    Canonical(String),
+}
+
+/// Deterministic typed records used to construct a partitioned graph.
+#[derive(Clone, Debug, Default, Eq, PartialEq)]
+pub struct PartitionedGraph {
+    /// Canonical node key/value records.
+    pub nodes: Vec<(Vec<u8>, Vec<u8>)>,
+    /// Canonical edge key/value records.
+    pub edges: Vec<(Vec<u8>, Vec<u8>)>,
+    /// Canonical hyperedge key/value records.
+    pub hyperedges: Vec<(Vec<u8>, Vec<u8>)>,
+    /// Canonical graph-analysis key/value records.
+    pub analysis: Vec<(Vec<u8>, Vec<u8>)>,
+    /// Canonical graph-metadata key/value records.
+    pub metadata: Vec<(Vec<u8>, Vec<u8>)>,
+    /// Canonical program-fact key/value records.
+    pub program_facts: Vec<(Vec<u8>, Vec<u8>)>,
+    /// Canonical program-summary key/value records.
+    pub program_summaries: Vec<(Vec<u8>, Vec<u8>)>,
+}
+
+/// Encode JSON into deterministic, whitespace-free UTF-8 bytes.
+pub fn canonical_json_bytes(value: &Value) -> Result<Vec<u8>, PartitionError> {
+    let mut output = Vec::new();
+    write_canonical_value(value, &mut output)?;
+    Ok(output)
+}
+
+fn write_canonical_value(value: &Value, output: &mut Vec<u8>) -> Result<(), PartitionError> {
+    match value {
+        Value::Null => output.extend_from_slice(b"null"),
+        Value::Bool(true) => output.extend_from_slice(b"true"),
+        Value::Bool(false) => output.extend_from_slice(b"false"),
+        Value::Number(number) => output.extend_from_slice(number.to_string().as_bytes()),
+        Value::String(text) => {
+            serde_json::to_writer(output, text)
+                .map_err(|error| PartitionError::Canonical(error.to_string()))?;
+        }
+        Value::Array(values) => {
+            output.push(b'[');
+            for (index, item) in values.iter().enumerate() {
+                if index != 0 {
+                    output.push(b',');
+                }
+                write_canonical_value(item, output)?;
+            }
+            output.push(b']');
+        }
+        Value::Object(values) => {
+            output.push(b'{');
+            let mut keys = values.keys().collect::<Vec<_>>();
+            keys.sort_unstable_by(|left, right| left.as_bytes().cmp(right.as_bytes()));
+            for (index, key) in keys.into_iter().enumerate() {
+                if index != 0 {
+                    output.push(b',');
+                }
+                serde_json::to_writer(&mut *output, key)
+                    .map_err(|error| PartitionError::Canonical(error.to_string()))?;
+                output.push(b':');
+                let item = values.get(key).ok_or_else(|| {
+                    PartitionError::Canonical("object key disappeared during encoding".to_owned())
+                })?;
+                write_canonical_value(item, output)?;
+            }
+            output.push(b'}');
+        }
+    }
+    Ok(())
+}
+
+/// Construct a segment-safe node key.
+#[must_use]
+pub fn node_key(id: &str) -> Vec<u8> {
+    encode_segments(&[KEY_SCHEMA_V1, NODE_KIND, id.as_bytes()])
+}
+
+/// Construct a direction-aware, segment-safe edge key.
+#[must_use]
+pub fn edge_key(
+    source: &str,
+    target: &str,
+    relation: &str,
+    directed: bool,
+    discriminator: Option<&[u8]>,
+) -> Vec<u8> {
+    let (source, target) = if directed || source <= target {
+        (source, target)
+    } else {
+        (target, source)
+    };
+    let mut segments = vec![
+        KEY_SCHEMA_V1,
+        EDGE_KIND,
+        source.as_bytes(),
+        target.as_bytes(),
+        relation.as_bytes(),
+    ];
+    if let Some(value) = discriminator {
+        segments.push(value);
+    }
+    encode_segments(&segments)
+}
+
+/// Construct a stable hyperedge key, optionally distinguishing an exact duplicate.
+#[must_use]
+pub fn hyperedge_key(identity: &[u8], occurrence: Option<u64>) -> Vec<u8> {
+    let rank = occurrence.map(u64::to_be_bytes);
+    let mut segments = vec![KEY_SCHEMA_V1, HYPEREDGE_KIND, identity];
+    if let Some(value) = rank.as_ref() {
+        segments.push(value);
+    }
+    encode_segments(&segments)
+}
+
+fn encode_segments(segments: &[&[u8]]) -> Vec<u8> {
+    let capacity = segments.iter().fold(0_usize, |total, segment| {
+        total.saturating_add(segment.len()).saturating_add(2)
+    });
+    let mut output = Vec::with_capacity(capacity);
+    for segment in segments {
+        for byte in *segment {
+            if *byte == 0 {
+                output.extend_from_slice(&[0, 0xff]);
+            } else {
+                output.push(*byte);
+            }
+        }
+        output.extend_from_slice(&[0, 0]);
+    }
+    output
+}
diff --git a/crates/compass-query/src/code_query.rs b/crates/compass-query/src/code_query.rs
index 9be17f0be..30a1ba19e 100644
--- a/crates/compass-query/src/code_query.rs
+++ b/crates/compass-query/src/code_query.rs
@@ -5,13 +5,17 @@ use std::time::Instant;
 
 use compass_graph::{GRAPH_SNAPSHOT_MAX_ITEMS, GRAPH_SNAPSHOT_MAX_OBJECTS, SnapshotReadLimits};
 use compass_ir::ProgramBundle;
-use compass_model::code_graph::{EdgeKind, EdgeRecord, FileRecord, GraphDocument, NodeRecord};
-use compass_model::provenance::{EvidenceConfidence, ResolutionState};
+use compass_model::code_graph::{
+    BuildMetadata, EdgeKind, EdgeRecord, FileRecord, GraphDocument, NodeRecord,
+};
+use compass_model::provenance::EvidenceConfidence;
 use compass_model::query_contract::{
     CallRequest, CodeQueryOperation, CodeQueryResponse, ExploreRequest, ImpactRequest,
-    NodeTrailRequest, QueryDiagnostic, QueryDiagnosticCode, QueryEdge, QueryEvidence,
-    QueryEvidenceLayer, QueryFile, QueryNode, QueryPath, SearchHit, SearchRequest,
+    NodeTrailRequest, QueryDiagnostic, QueryDiagnosticCode, QueryEdge, QueryFile, QueryNode,
+    QueryPath, SearchHit, SearchRequest, normalize_query_symbol, query_edge_from_record,
+    query_node_from_record, query_path_from_records,
 };
+use compass_model::validate_build_metadata_identity;
 use rusqlite::{Connection, params};
 
 use crate::cql::{QueryError, QueryErrorKind};
@@ -176,6 +180,29 @@ pub struct CodeQueryEngine {
     pub(crate) fuzzy_lookup_cache: Mutex<FuzzyLookupCache>,
 }
 
+impl CodeQueryEngine {
+    /// Return the build identity pinned to this engine's exact graph
+    /// realization.
+    pub fn build_metadata(&self) -> Result<BuildMetadata, QueryError> {
+        let build = match &self.backend {
+            CodeGraphBackend::Materialized { graph, .. } => Ok(graph.graph.build.clone()),
+            CodeGraphBackend::Store(snapshot) => snapshot
+                .reader()?
+                .metadata_summary()
+                .map(|metadata| metadata.graph.build)
+                .map_err(snapshot_error),
+        }?;
+        validate_build_metadata_identity(&build).map_err(|error| {
+            QueryError::new(
+                QueryErrorKind::CorruptArtifact,
+                "invalid_graph_build_identity",
+                error.to_string(),
+            )
+        })?;
+        Ok(build)
+    }
+}
+
 #[derive(Clone, Debug, Eq, PartialEq)]
 struct PreparedSearchQuery {
     terms: Vec<String>,
@@ -1164,12 +1191,24 @@ impl CodeQueryEngine {
     }
 
     pub fn explore(&self, request: ExploreRequest) -> Result<CodeQueryResponse, QueryError> {
-        self.explore_instrumented(request, &mut QueryInstrumentation::default())
+        self.explore_instrumented(request, true, &mut QueryInstrumentation::default())
+    }
+
+    /// Return the bounded structural subgraph without reading source files.
+    ///
+    /// This is the backend-neutral comparison route for graph engines. Public
+    /// `explore` behavior remains unchanged and still includes verified source.
+    pub fn structural_subgraph(
+        &self,
+        request: ExploreRequest,
+    ) -> Result<CodeQueryResponse, QueryError> {
+        self.explore_instrumented(request, false, &mut QueryInstrumentation::default())
     }
 
     fn explore_instrumented(
         &self,
         request: ExploreRequest,
+        include_files: bool,
         instrumentation: &mut QueryInstrumentation,
     ) -> Result<CodeQueryResponse, QueryError> {
         validate_limits(&request.limits)?;
@@ -1231,7 +1270,9 @@ impl CodeQueryEngine {
         }
         self.add_nodes(&ids, &mut response)?;
         self.add_edges(&edge_ids, &mut response)?;
-        self.add_verified_files(&request.root, &mut response)?;
+        if include_files {
+            self.add_verified_files(&request.root, &mut response)?;
+        }
         self.apply_path_bound(&mut response);
         budget.record_work(instrumentation);
         let response = self.finish_response(&mut response);
@@ -1765,38 +1806,11 @@ fn default_repository_root(graph_path: &Path) -> PathBuf {
 }
 
 fn path_record(nodes: &[String], edges: &[String], selected: &[EdgeRecord]) -> QueryPath {
-    let weakest_confidence = selected
-        .iter()
-        .flat_map(|edge| &edge.evidence)
-        .map(|evidence| evidence.confidence)
-        .max_by_key(|confidence| match confidence {
-            EvidenceConfidence::Exact => 0,
-            EvidenceConfidence::Inferred => 1,
-            EvidenceConfidence::Ambiguous => 2,
-        })
-        .unwrap_or(EvidenceConfidence::Exact);
-    let weakest_resolution = if weakest_confidence == EvidenceConfidence::Ambiguous {
-        ResolutionState::Ambiguous
-    } else if weakest_confidence == EvidenceConfidence::Inferred {
-        ResolutionState::Unresolved
-    } else {
-        ResolutionState::Exact
-    };
-    QueryPath {
-        id: format!("path:{}", edges.join(":")),
-        node_ids: nodes.to_vec(),
-        edge_ids: edges.to_vec(),
-        weakest_resolution,
-        weakest_confidence,
-    }
+    query_path_from_records(nodes, edges, selected)
 }
 
 fn normalize_symbol(value: &str) -> String {
-    value
-        .trim()
-        .trim_end_matches("()")
-        .trim_start_matches('.')
-        .to_lowercase()
+    normalize_query_symbol(value)
 }
 
 fn is_heuristic(edge: &EdgeRecord) -> bool {
@@ -1818,54 +1832,11 @@ fn evidence_quality(edge: &EdgeRecord) -> u8 {
 }
 
 pub(crate) fn query_node(node: &NodeRecord) -> QueryNode {
-    QueryNode {
-        id: node.id.clone(),
-        kind: node.kind,
-        roles: node.roles.clone(),
-        name: node.name.clone(),
-        qualified_name: node.qualified_name.clone(),
-        language: node.language.clone(),
-        framework: node.framework.clone(),
-        source: node.source.clone(),
-        details: node.details.clone(),
-        evidence: node.evidence.iter().map(structural_evidence).collect(),
-    }
+    query_node_from_record(node)
 }
 
 pub(crate) fn query_edge(edge: &EdgeRecord) -> QueryEdge {
-    QueryEdge {
-        id: edge.id.clone(),
-        source: edge.source.clone(),
-        target: edge.target.clone(),
-        kind: edge.kind,
-        relationship_site: edge.relationship_site.clone(),
-        details: edge.details.clone(),
-        evidence: edge.evidence.iter().map(structural_evidence).collect(),
-    }
-}
-
-fn structural_evidence(evidence: &compass_model::provenance::Provenance) -> QueryEvidence {
-    QueryEvidence {
-        layer: QueryEvidenceLayer::StructuralGraph,
-        origin: evidence.origin,
-        extractor: evidence.extractor.clone(),
-        confidence: evidence.confidence,
-        anchor: evidence.anchors.first().cloned(),
-        rule: evidence.rule.clone(),
-        wiring_site: evidence.wiring_site.clone(),
-        resolution: if evidence.confidence == EvidenceConfidence::Ambiguous
-            || evidence.candidates.len() > 1
-        {
-            ResolutionState::Ambiguous
-        } else if evidence.confidence == EvidenceConfidence::Inferred
-            && evidence.candidates.is_empty()
-        {
-            ResolutionState::Unresolved
-        } else {
-            ResolutionState::Exact
-        },
-        candidates: evidence.candidates.clone(),
-    }
+    query_edge_from_record(edge)
 }
 
 pub(crate) fn validate_limits(
diff --git a/crates/compass-query/tests/query_contract.rs b/crates/compass-query/tests/query_contract.rs
index cfff2dcbb..a77738691 100644
--- a/crates/compass-query/tests/query_contract.rs
+++ b/crates/compass-query/tests/query_contract.rs
@@ -1,7 +1,7 @@
 use compass_model::code_graph::{NodeKind, NodeRole};
 use compass_model::query_contract::{
     CODE_QUERY_SCHEMA_V1, CodeQueryLimits, CodeQueryOperation, CodeQueryResponse, QueryNode,
-    SearchHit, SearchRequest,
+    STRUCTURAL_QUERY_SCHEMA_V1, SearchHit, SearchRequest,
 };
 use std::fs;
 use std::path::Path;
@@ -59,6 +59,18 @@ fn shared_query_contract_is_strict_bounded_and_deterministic()
         ["a", "b", "c"]
     );
     assert!(response.edges.is_empty());
+    let structural = response.structural_view("repository", "generation");
+    assert_eq!(structural.schema, STRUCTURAL_QUERY_SCHEMA_V1);
+    assert_eq!(structural.repository_id, "repository");
+    assert_eq!(structural.generation_id, "generation");
+    assert_eq!(
+        structural
+            .nodes
+            .iter()
+            .map(|node| node.id.as_str())
+            .collect::<Vec<_>>(),
+        ["a", "b", "c"]
+    );
     Ok(())
 }
 
diff --git a/crates/compass-store/src/lib.rs b/crates/compass-store/src/lib.rs
index ef7ebcf54..5dadc622b 100644
--- a/crates/compass-store/src/lib.rs
+++ b/crates/compass-store/src/lib.rs
@@ -45,10 +45,45 @@ pub const MAX_IMMUTABLE_BATCH_BYTES: usize = 16 * 1024 * 1024;
 ///
 /// The portable in-memory JSON readers intentionally keep their independent
 /// 1 GiB cap.  The local store is the bounded large-graph path and therefore
-/// accepts up to 2 GiB while serving records through indexed scans instead of
-/// materializing the whole document.  The limit is still finite so malformed
-/// or hostile snapshots cannot request unbounded allocation.
+/// accepts up to 2 GiB.  Reads reach records through indexed scans
+/// (`GraphSnapshotReader`) or stream stored chunks
+/// (`SqliteStore::read_snapshot_chunks`) rather than materializing the whole
+/// document; `SqliteStore::read_snapshot` is the explicit opt-in that does
+/// allocate the full payload.  The limit is still finite so malformed or
+/// hostile snapshots cannot request unbounded allocation.
 pub const MAX_GRAPH_BYTES: usize = 2 * 1024 * 1024 * 1024;
+
+/// Effective opt-in graph byte bound used by snapshot publication and reads.
+/// Invalid, zero, overflowing, or unrepresentable values fail closed to the
+/// 2 GiB default. Accepted forms match Compass graph readers: raw bytes, `MB`,
+/// and `GB`, with optional underscores in the numeric component.
+#[must_use]
+pub fn max_graph_bytes() -> usize {
+    let raw = std::env::var("COMPASS_MAX_GRAPH_BYTES").ok();
+    parse_max_graph_bytes(raw.as_deref())
+}
+
+fn parse_max_graph_bytes(raw: Option<&str>) -> usize {
+    let Some(raw) = raw else {
+        return MAX_GRAPH_BYTES;
+    };
+    let upper = raw.trim().to_ascii_uppercase();
+    let (number, multiplier) = if let Some(number) = upper.strip_suffix("GB") {
+        (number.trim(), 1024_u128 * 1024 * 1024)
+    } else if let Some(number) = upper.strip_suffix("MB") {
+        (number.trim(), 1024_u128 * 1024)
+    } else {
+        (upper.as_str(), 1)
+    };
+    number
+        .replace('_', "")
+        .parse::<u128>()
+        .ok()
+        .filter(|value| *value > 0)
+        .and_then(|value| value.checked_mul(multiplier))
+        .and_then(|value| usize::try_from(value).ok())
+        .unwrap_or(MAX_GRAPH_BYTES)
+}
 const GRAPH_NAMESPACE: &[u8] = b"compass.current.graph.v1";
 const CATALOG_PARTITION: &[u8] = b"catalog";
 const OBJECT_PARTITION: &[u8] = b"object";
@@ -826,7 +861,12 @@ impl SqliteStore {
         &self.path
     }
 
-    pub fn read_snapshot(&self) -> Result<(SnapshotManifest, Vec<u8>), StoreError> {
+    /// Read and validate the active snapshot manifest without touching chunk
+    /// objects.
+    ///
+    /// Callers that only need manifest metadata must prefer this over
+    /// [`Self::read_snapshot`], which reconstructs the entire payload in memory.
+    pub fn read_snapshot_manifest(&self) -> Result<SnapshotManifest, StoreError> {
         let namespace = NamespaceId::graph();
         let catalog = PartitionKey::new(CATALOG_PARTITION)?;
         let active = Key::new(ACTIVE_KEY)?;
@@ -836,34 +876,167 @@ impl SqliteStore {
         let manifest: SnapshotManifest = serde_json::from_slice(&entry.value)
             .map_err(|error| StoreError::Corrupt(format!("active manifest: {error}")))?;
         validate_manifest(&manifest)?;
+        Ok(manifest)
+    }
+
+    /// Stream the active snapshot payload one stored chunk at a time.
+    ///
+    /// The payload is never materialized as a single allocation. Each chunk is
+    /// bounded by `CHUNK_BYTES`; the running total is still checked against
+    /// [`MAX_GRAPH_BYTES`] so a corrupt manifest cannot drive unbounded work,
+    /// and the manifest length and digest are verified after the final chunk.
+    ///
+    /// # Integrity
+    ///
+    /// Delivered chunks are provisional until this method returns `Ok`: a
+    /// terminal length or digest mismatch can reject bytes already passed to
+    /// `consume`. Consumers with irreversible side effects must write to
+    /// staging storage and commit it only after successful return, or perform
+    /// an equivalent independent verification before committing.
+    pub fn read_snapshot_chunks<F>(&self, mut consume: F) -> Result<SnapshotManifest, StoreError>
+    where
+        F: FnMut(&[u8]) -> Result<(), StoreError>,
+    {
+        let manifest = self.read_snapshot_manifest()?;
+        self.read_snapshot_chunks_for_manifest(manifest, &mut consume)
+    }
+
+    fn read_snapshot_chunks_for_manifest<F>(
+        &self,
+        manifest: SnapshotManifest,
+        mut consume: F,
+    ) -> Result<SnapshotManifest, StoreError>
+    where
+        F: FnMut(&[u8]) -> Result<(), StoreError>,
+    {
+        let namespace = NamespaceId::graph();
         let object = PartitionKey::new(OBJECT_PARTITION)?;
-        let capacity = usize::try_from(manifest.payload_bytes).unwrap_or(MAX_GRAPH_BYTES);
-        let mut bytes = Vec::with_capacity(capacity);
+        let mut hasher = Sha256::new();
+        let mut total: usize = 0;
+        let maximum = max_graph_bytes();
         for index in 0..manifest.chunk_count {
             let key = Key::new(chunk_key(&manifest.snapshot_id, index))?;
-            let Some(chunk) = self.get(&namespace, &object, &key)? else {
+            let Some(chunk) = self.read_snapshot_chunk(&namespace, &object, &key, index)? else {
                 return Err(StoreError::Corrupt(format!(
                     "snapshot chunk {index} is missing"
                 )));
             };
-            bytes.extend_from_slice(&chunk.value);
-            if bytes.len() > MAX_GRAPH_BYTES {
+            total = total.saturating_add(chunk.value.len());
+            if total > maximum {
                 return Err(StoreError::ValueTooLarge {
-                    actual: bytes.len(),
-                    maximum: MAX_GRAPH_BYTES,
+                    actual: total,
+                    maximum,
                 });
             }
+            hasher.update(&chunk.value);
+            consume(&chunk.value)?;
         }
-        if bytes.len() as u64 != manifest.payload_bytes {
+        if total as u64 != manifest.payload_bytes {
             return Err(StoreError::Corrupt(
                 "snapshot payload length does not match its manifest".to_owned(),
             ));
         }
-        if hex_digest(&bytes) != manifest.graph_digest {
+        if lower_hex(&hasher.finalize()) != manifest.graph_digest {
             return Err(StoreError::Corrupt(
                 "snapshot payload digest does not match its manifest".to_owned(),
             ));
         }
+        Ok(manifest)
+    }
+
+    /// Read one snapshot chunk only after SQLite has established that its BLOB
+    /// length is within the portable chunk bound. SQLite can obtain a BLOB's
+    /// byte length without reading its complete content from disk.
+    fn read_snapshot_chunk(
+        &self,
+        namespace: &NamespaceId,
+        partition: &PartitionKey,
+        key: &Key,
+        index: u32,
+    ) -> Result<Option<Entry>, StoreError> {
+        let connection = self.connection()?;
+        let stored_shape = connection
+            .query_row(
+                "SELECT typeof(value), length(value) FROM kv
+                 WHERE namespace = ?1 AND partition = ?2 AND key = ?3",
+                params![namespace.as_bytes(), partition.as_bytes(), key.as_bytes()],
+                |row| Ok((row.get::<_, String>(0)?, row.get::<_, i64>(1)?)),
+            )
+            .optional()?;
+        let Some((storage_class, stored_bytes)) = stored_shape else {
+            return Ok(None);
+        };
+        if storage_class != "blob" {
+            return Err(StoreError::Corrupt(format!(
+                "snapshot chunk {index} has SQLite storage class {storage_class}; expected blob"
+            )));
+        }
+        let stored_bytes = usize::try_from(stored_bytes).map_err(|_| {
+            StoreError::Corrupt(format!(
+                "snapshot chunk {index} has an invalid stored length"
+            ))
+        })?;
+        if stored_bytes > CHUNK_BYTES {
+            return Err(StoreError::Corrupt(format!(
+                "snapshot chunk {index} is {stored_bytes} bytes; maximum is {CHUNK_BYTES}"
+            )));
+        }
+        let maximum = i64::try_from(CHUNK_BYTES).map_err(|_| {
+            StoreError::Corrupt("snapshot chunk limit cannot be represented by SQLite".to_owned())
+        })?;
+        let entry = connection
+            .query_row(
+                "SELECT key, value, digest, version FROM kv
+                 WHERE namespace = ?1 AND partition = ?2 AND key = ?3
+                   AND typeof(value) = 'blob' AND length(value) <= ?4",
+                params![
+                    namespace.as_bytes(),
+                    partition.as_bytes(),
+                    key.as_bytes(),
+                    maximum,
+                ],
+                read_entry,
+            )
+            .optional()?;
+        let Some(entry) = entry else {
+            return Err(StoreError::Corrupt(format!(
+                "snapshot chunk {index} changed while reading"
+            )));
+        };
+        if entry.value.len() > CHUNK_BYTES {
+            return Err(StoreError::Corrupt(format!(
+                "snapshot chunk {index} is {} bytes; maximum is {CHUNK_BYTES}",
+                entry.value.len()
+            )));
+        }
+        Ok(Some(entry))
+    }
+
+    /// Read the active snapshot and reconstruct its full payload in memory.
+    ///
+    /// This allocates proportional to `payload_bytes` (up to
+    /// [`MAX_GRAPH_BYTES`]). Prefer [`Self::read_snapshot_manifest`] when only
+    /// metadata is needed, or [`Self::read_snapshot_chunks`] to stream the
+    /// payload without a single large allocation.
+    pub fn read_snapshot(&self) -> Result<(SnapshotManifest, Vec<u8>), StoreError> {
+        let manifest = self.read_snapshot_manifest()?;
+        let capacity = usize::try_from(manifest.payload_bytes).map_err(|_| {
+            StoreError::Corrupt(
+                "snapshot payload length cannot be represented on this platform".to_owned(),
+            )
+        })?;
+        let maximum = max_graph_bytes();
+        if capacity > maximum {
+            return Err(StoreError::ValueTooLarge {
+                actual: capacity,
+                maximum,
+            });
+        }
+        let mut bytes = Vec::with_capacity(capacity);
+        let manifest = self.read_snapshot_chunks_for_manifest(manifest, |chunk| {
+            bytes.extend_from_slice(chunk);
+            Ok(())
+        })?;
         Ok((manifest, bytes))
     }
 
@@ -879,10 +1052,11 @@ impl SqliteStore {
                 "cannot publish through a read-only store".to_owned(),
             ));
         }
-        if graph_bytes.is_empty() || graph_bytes.len() > MAX_GRAPH_BYTES {
+        let maximum = max_graph_bytes();
+        if graph_bytes.is_empty() || graph_bytes.len() > maximum {
             return Err(StoreError::ValueTooLarge {
                 actual: graph_bytes.len(),
-                maximum: MAX_GRAPH_BYTES,
+                maximum,
             });
         }
         if graph_schema != GRAPH_SCHEMA_V1 {
@@ -894,7 +1068,7 @@ impl SqliteStore {
         let chunk_count = u32::try_from(graph_bytes.len().div_ceil(CHUNK_BYTES)).map_err(|_| {
             StoreError::ValueTooLarge {
                 actual: graph_bytes.len(),
-                maximum: MAX_GRAPH_BYTES,
+                maximum,
             }
         })?;
         let manifest = SnapshotManifest {
@@ -932,7 +1106,7 @@ impl SqliteStore {
     }
 
     pub fn validate_snapshot(&self) -> Result<SnapshotManifest, StoreError> {
-        self.read_snapshot().map(|(manifest, _)| manifest)
+        self.read_snapshot_chunks(|_| Ok(()))
     }
 
     /// Flush all acknowledged WAL frames before a filesystem snapshot is
@@ -1181,7 +1355,10 @@ impl SqliteStore {
         if let Some(reference) = self.graph_snapshot_reference()? {
             return Ok(reference);
         }
-        let (manifest, _) = self.read_snapshot()?;
+        // Preserve the pre-streaming contract: a reference is issued only for
+        // a snapshot whose payload is complete and digest-valid. The streaming
+        // validator returns the manifest without retaining payload chunks.
+        let manifest = self.validate_snapshot()?;
         let manifest_bytes = serde_json::to_vec(&manifest)
             .map_err(|error| StoreError::Corrupt(format!("manifest encode: {error}")))?;
         let reference = StoreRef {
@@ -2181,7 +2358,11 @@ fn digest(value: &[u8]) -> [u8; 32] {
 }
 
 fn hex_digest(value: &[u8]) -> String {
-    format!("{:x}", Sha256::digest(value))
+    lower_hex(&Sha256::digest(value))
+}
+
+fn lower_hex(value: &impl fmt::LowerHex) -> String {
+    format!("{value:x}")
 }
 
 fn configure_connection(connection: &Connection) -> Result<(), StoreError> {
@@ -2307,7 +2488,7 @@ fn validate_manifest(manifest: &SnapshotManifest) -> Result<(), StoreError> {
         || manifest.snapshot_id != manifest.graph_digest
         || manifest.chunk_count == 0
         || manifest.payload_bytes == 0
-        || manifest.payload_bytes > MAX_GRAPH_BYTES as u64
+        || manifest.payload_bytes > max_graph_bytes() as u64
         || expected_chunks != Some(manifest.chunk_count)
     {
         return Err(StoreError::Corrupt(
diff --git a/deny.toml b/deny.toml
index 570900923..37062dd66 100644
--- a/deny.toml
+++ b/deny.toml
@@ -30,6 +30,16 @@ allow = [
 # instead of allowing the license for every future dependency.
 exceptions = [
   { allow = ["BSL-1.0"], crate = "xxhash-rust@0.8.18" },
+  # C-011 accepted the exact SurrealDB 3.2.4 artifact profiles under the
+  # retained tagged BUSL-1.1 license and notice conditions. Keep every
+  # exception dependency/version scoped; upgrades require a fresh review.
+  { allow = ["BUSL-1.1"], crate = "surrealdb@3.2.4" },
+  { allow = ["BUSL-1.1"], crate = "surrealdb-collections@3.2.4" },
+  { allow = ["BUSL-1.1"], crate = "surrealdb-core@3.2.4" },
+  { allow = ["BUSL-1.1"], crate = "surrealdb-protocol@0.10.2" },
+  { allow = ["BUSL-1.1"], crate = "surrealdb-strand@3.2.4" },
+  { allow = ["BUSL-1.1"], crate = "surrealdb-types@3.2.4" },
+  { allow = ["BUSL-1.1"], crate = "surrealdb-types-derive@3.2.4" },
 ]
 
 [bans]
diff --git a/distribution.toml b/distribution.toml
new file mode 100644
index 000000000..00c3fcb23
--- /dev/null
+++ b/distribution.toml
@@ -0,0 +1,30 @@
+schema = "compass.distribution/1"
+
+[package]
+name = "compass"
+version = "0.3.7"
+description = "Local-first code intelligence, structural navigation, and bounded MCP tools."
+author = "Compass contributors"
+homepage = "https://github.com/crabbuild/compass"
+repository = "https://github.com/crabbuild/compass"
+license = "MIT OR Apache-2.0"
+keywords = ["agent-skills", "code-intelligence", "mcp", "navigation"]
+
+[harness.codex]
+verified_version = "0.146.0"
+manifest = ".codex-plugin/plugin.json"
+mcp = ".mcp.json"
+marketplace = ".agents/plugins/marketplace.json"
+
+[harness.claude]
+verified_version = "2.1.251"
+manifest = ".claude-plugin/plugin.json"
+mcp = ".mcp.json"
+marketplace = ".claude-plugin/marketplace.json"
+
+[harness.opencode]
+verified_version = "1.18.23"
+manifest = "package.json"
+mcp = "opencode.json"
+npm_name = "@compass/opencode-plugin"
+plugin_api_version = "1.18.25"
diff --git a/docs/README.md b/docs/README.md
index 201d3a016..eb9e3a7cf 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -96,6 +96,9 @@ They are not evidence that an uncompleted design has shipped.
 | Document | Purpose |
 | --- | --- |
 | [Universal evidence implementation](implementation/universal-evidence.md) | Current universal evidence pipeline, resolution order, and failure classes |
+| [MCP conformance and interoperability](implementation/mcp-conformance-and-interop.md) | Pinned transport conformance evidence and the current named-client gate |
+| [Optional Surreal graph projection](implementation/surreal-graph-projection.md) | Feature isolation, generation activation, schema, engine profiles, and license boundary |
+| [Native agent package distribution](implementation/agent-distribution.md) | Canonical inventory, generated Codex/Claude/OpenCode packages, portability, and lifecycle ownership |
 | [Evidence resolution framework technical design](implementation/evidence-resolution-framework-technical-design.md) | Target ownership, components, interfaces, and invariants for rearchitecting the resolver |
 | [Evidence resolution framework execution plan](implementation/evidence-resolution-framework-phased-execution-plan.md) | Phased, commit-oriented implementation and verification plan |
 
diff --git a/docs/future/SURREAL_DB.md b/docs/future/SURREAL_DB.md
new file mode 100644
index 000000000..74d756e8c
--- /dev/null
+++ b/docs/future/SURREAL_DB.md
@@ -0,0 +1,138 @@
+# Proposal (future evaluation) — SurrealDB as a Compass store backend
+
+> **Status:** unevaluated idea, tabled for later. Nothing here is decided,
+> scheduled, or endorsed. Recorded on 2026-08-09 so the question is not lost.
+>
+> This document deliberately separates two proposals that are easy to conflate.
+> They have different risk profiles and, on current evidence, different answers.
+
+---
+
+## The idea
+
+Add a SurrealDB backend (embedded by default, with a remote option) for Compass
+graph storage. SurrealDB 3.2.4 is the current release as of this writing; it is
+written in Rust, embeds via SurrealKV/RocksDB, speaks a graph data model
+natively, and ships vector-index support.
+
+---
+
+## Proposal A — SurrealDB as a `Store` backend adapter
+
+**Assessment: architecturally supported. Worth a real evaluation.**
+
+`compass-store` is already designed for this. Its own crate documentation states:
+
+> Backend-neutral, namespace-scoped storage for Compass current graph snapshots.
+> […] Other backends can implement [`Store`] without importing Compass graph
+> records or query code.
+>
+> The v1 trait is synchronous and runtime-neutral. **A remote adapter may put a
+> bounded blocking boundary around its client**, while a future async facade can
+> preserve these same request, ordering, and error semantics without forcing an
+> executor into this contract crate.
+>
+> — `crates/compass-store/src/lib.rs:3-14`
+
+The portable address is `(namespace, partition, key)`. `compass-store-redb`
+(~869 lines) already demonstrates a second backend against this trait, so a
+`compass-store-surrealdb` crate would follow an established precedent rather
+than requiring new architecture.
+
+The "embedded by default, remote optional" shape matches what that doc comment
+already contemplates for remote adapters.
+
+### Open questions for a real evaluation
+
+1. **Sync/async boundary.** The `Store` trait is synchronous; SurrealDB's Rust
+   SDK is async. The bounded blocking boundary the docs describe is achievable
+   but is real work, and it must not smuggle an executor into the contract crate.
+2. **Dependency weight.** Compass's stated identity is "one native Rust
+   executable" with "no Python or Graphify dependency" (README). SurrealDB pulls
+   a substantial tree. Measure the effect on binary size, build time, and
+   `cargo deny` policy before committing.
+3. **Determinism.** AGENTS.md requires deterministic identities, ordering, and
+   canonical encoding at contract boundaries. Any backend must preserve ordered
+   scans and stable iteration; this needs proving, not assuming.
+4. **What problem does it solve?** Enumerate the concrete wins over SQLite +
+   redb. "It is a graph database" is not by itself a benefit when Compass's graph
+   semantics live in `compass-model`/`compass-graph`, above the storage layer.
+5. **Qualification.** `compass-store-qualification` exists; a new backend should
+   pass the same gates as SQLite before being offered.
+
+### What it does *not* solve
+
+The 2 GiB publication failure that prompted this discussion
+(`compass-scoping-and-bounds`) is **not** a storage-backend problem. It
+originates in `compass-graph/src/snapshot.rs:3138`, where `digest_json` caps
+serialization of one monolithic `CanonicalGraphDocument`, compounded by a read
+path that reconstructed the whole payload in memory. Both are Compass's own
+encoding, above any store adapter. Swapping SQLite for SurrealDB would leave
+that failure exactly where it is.
+
+---
+
+## Proposal B — Vector / embedding support
+
+**Assessment: this is not a missing feature. It is a documented product
+exclusion, and adopting it is a product-direction decision — not a side effect
+of choosing a storage backend.**
+
+Two places state the same invariant:
+
+> Compass is a native, local-first Rust product. Structural extraction and graph
+> queries must continue to work without Python, model credentials, **embeddings,
+> a vector database**, runtime grammar downloads, or Graphify.
+>
+> — `AGENTS.md`, Product invariants
+
+> Structural extraction and graph queries run locally. They do not require
+> Python, **embeddings, a vector database**, model credentials, or runtime parser
+> downloads.
+>
+> — `README.md`
+
+A repository-wide search finds no embedding or vector-search code. Its absence
+is deliberate, and it is part of how the README differentiates Compass from
+Graphify: deterministic structural evidence with provenance, not similarity
+scores.
+
+Adding vectors as a strictly optional layer would not violate the letter of the
+invariant — the invariant says structural extraction must work *without* them.
+But it changes what Compass claims to be, and it would need:
+
+1. an explicit decision to amend `AGENTS.md` and `README.md`, which currently
+   promise the absence;
+2. a clear account of how similarity results coexist with the "evidence over
+   implication" rule (`.impeccable.md`) and the requirement to prefer an explicit
+   unresolved/ambiguous result over invented meaning;
+3. determinism guarantees, since approximate nearest-neighbour search is
+   typically not deterministic across index builds — this may be the hardest
+   constraint to satisfy;
+4. a story for where embeddings come from without reintroducing the model
+   credentials the product invariant excludes.
+
+**Recommendation: evaluate Proposal A on its own merits first. Do not let a
+storage-backend decision quietly import a product-direction change.**
+
+---
+
+## Suggested evaluation path, if pursued
+
+1. Run `/kbd-new-phase` scoped to Proposal A only.
+2. Benchmark against SQLite and redb using `compass-store-qualification`.
+3. Measure dependency weight, binary size, and build time; check `deny.toml`
+   policy compliance.
+4. Prove determinism of ordered scans and snapshot publication.
+5. Treat Proposal B as a separate phase requiring a documented product decision
+   before any code.
+
+---
+
+## Provenance
+
+Raised during the `compass-scoping-and-bounds` phase while implementing C-001
+(`read_snapshot` API split). Tabled by the user to avoid derailing that change.
+The architectural facts above were verified by source inspection at the time of
+writing; the SurrealDB version was current per `cargo search`. Nothing here has
+been benchmarked or prototyped.
diff --git a/docs/future/compass-surrealdb-mcp-skills-research.md b/docs/future/compass-surrealdb-mcp-skills-research.md
new file mode 100644
index 000000000..0b8ec4f41
--- /dev/null
+++ b/docs/future/compass-surrealdb-mcp-skills-research.md
@@ -0,0 +1,780 @@
+
+# Compass: SurrealDB, MCP 2026, Agent Skills, and Harness Distribution
+
+> **Status:** research and planning only. This document does not describe shipped
+> Compass behavior, an accepted design, or scheduled work. It belongs under
+> `docs/future/` so current product documentation remains authoritative.
+>
+> Read this together with [the earlier SurrealDB evaluation](SURREAL_DB.md) and
+> [the upstream contribution plan](upstream-contribution-plan.md).
+
+
+## Executive conclusion
+
+Compass should pursue this direction, but as four coordinated products rather than
+one database replacement:
+
+1. **A graph-native SurrealDB projection/query adapter** that stores immutable,
+   generation-keyed Compass nodes and relations and executes bounded native graph
+   traversals. This is the part that creates new graph value.
+2. **An optional Surreal-backed `Store` adapter**, independently qualified against
+   the existing backend contract. This creates persistence portability, not graph
+   intelligence by itself.
+3. **An MCP 2026 server contract on `rmcp` 3.x** with small, structured,
+   task-oriented tools for coding work. The current server is already substantial;
+   it needs a protocol migration and product-level response contract, not a rewrite.
+4. **One canonical skill/plugin distribution inventory** that generates portable
+   Agent Skills plus native Codex and Claude packages and a real OpenCode plugin.
+
+The recommendation is deliberately additive. SQLite/redb and `graph.json` should
+remain the default local-first path until SurrealDB clears equivalence, performance,
+recovery, binary-size, and licensing gates. Prometheus should remain a separate
+system; Compass can copy its generation and installed-artifact validation patterns,
+but should not import its control plane, runtime services, or package topology.
+
+The most urgent work is the MCP compatibility migration. Compass pins `rmcp 2.2.0`
+in [Cargo.toml](../../Cargo.toml), while the
+current `rmcp 3.1.4` release targets MCP 2026-07-28 and supports Compass's Rust
+toolchain. MCP 2026 removes protocol sessions and `initialize`, requires
+`server/discover`, changes subscriptions, and requires typed result discrimination.
+Compass's existing HTTP transport explicitly tests `Mcp-Session-Id` and session
+timeouts, so those flags cannot simply be carried forward unchanged. See the
+[MCP 2026-07-28 changelog](https://modelcontextprotocol.io/specification/2026-07-28/changelog)
+and [rmcp 3.1.4](https://crates.io/crates/rmcp/3.1.4).
+
+## Scope and provenance
+
+The Compass assessment is pinned to commit
+`5ca57f2441b90a516eb2a4e78e1fb4e2d2d8269a` (2026-08-09). The checkout was dirty;
+in particular, [compass-store/src/lib.rs](../../crates/compass-store/src/lib.rs)
+contains uncommitted streaming snapshot-read methods. Those methods are promising for
+adapter work but are not treated as released behavior. The installed `compass`
+binary was 0.3.6 while the source manifest was 0.3.7. Read-only queries were run
+against an existing graph built from the exact commit, containing 119,712 nodes and
+281,207 edges.
+
+Prometheus was assessed at commit
+`f0df1e0121d176c9467e5c71022737b845af6a20` (2026-08-27). It was used only as local
+prior art. Neither checkout was modified.
+
+Current external contracts were retrieved on 2026-08-28 using Firecrawl search and
+primary documentation, with Context7 used for current SurrealDB and `rmcp` library
+documentation. All source scores, claims, and contradictions are in the companion
+research package.
+
+## What Compass already has
+
+This is not a greenfield proposal. Compass already contains most of the necessary
+seams.
+
+### Storage and query seams
+
+The `compass-store` crate defines a synchronous backend-neutral contract over
+`(namespace, partition, key)` addresses, ordered scans, opaque continuation cursors,
+conditional writes, immutable batches, and capability reporting. It includes SQLite,
+an in-memory oracle, a redb adapter, and a qualification crate. Its documentation
+explicitly anticipates a remote adapter placing a bounded blocking boundary around
+network work. That makes a Surreal-backed adapter feasible without changing the
+public query API.
+
+The caveat is semantic. `compass-query::open_with_store<S: Store>` can hydrate from
+any adapter, but the generic path currently exports/materializes the graph; the
+optimized direct record path is SQLite-specific. Therefore, implementing the Store
+contract on SurrealDB would validate backend neutrality but would not automatically
+make Compass queries graph-native. This is the decisive reason to separate a Store
+adapter from a Surreal graph projection/query adapter.
+
+The existing `compass-graphdb` crate is the closest architectural precedent. It is a
+bounded native export/push layer for Neo4j Bolt and FalkorDB RESP, rather than the
+main query engine. SurrealDB should initially follow the same derived-projection
+boundary, with a stronger read adapter added only after equivalence is proven.
+
+### MCP seams
+
+`compass-mcp` already exposes 15 tools:
+
+- typed code navigation: `search_symbols`, `get_callers`, `get_callees`,
+  `get_impact`, `explore_code`, `get_node`, and natural-language `query_graph`;
+- legacy/general graph queries: `get_neighbors`, `get_community`, `god_nodes`,
+  `graph_stats`, and `shortest_path`; and
+- pull-request workflows: `list_prs`, `get_pr_impact`, and `triage_prs`.
+
+It also exposes six resources: report, statistics, god nodes, surprises, audit, and
+questions. The server supports stdio and Streamable HTTP, bearer tokens, request and
+response limits, graph hot reload, and multi-project selection. This is a meaningful
+base, not a prototype.
+
+The weaknesses are contract-level:
+
+- most tools are manually declared and several legacy tools return text-only results;
+- there are no MCP prompts, explicit output schemas across the full surface, graph
+  generation/listen semantics, completion, or task-based long-running operations;
+- HTTP behavior is coupled to the pre-2026 session model;
+- advanced natural/raw queries are mixed into the same trust surface as safe typed
+  navigation; and
+- freshness, provenance, confidence, truncation, and continuation are not expressed
+  uniformly in every result.
+
+### Skills and harness seams
+
+Compass already embeds an agentskills.io-compatible `compass` skill with 15 reference
+documents and an OpenAI agent metadata file. It also has a careful atomic installer
+that handles project/user scopes, managed ownership, dry runs, checksums, path and
+symlink safety, hooks, and many harnesses—including Codex, Claude Code, and OpenCode.
+
+The gap is native package distribution. The installer places skills and thin
+harness adapters, but it does not yet produce current Codex `.codex-plugin` packages
+and `.agents/plugins/marketplace.json`, Claude `.claude-plugin` packages and
+marketplaces, or a robust OpenCode/npm plugin. It also does not treat MCP configuration
+and skill installation as one generated, validated distribution contract.
+
+## Recommended architecture
+
+```mermaid
+flowchart LR
+    A[Compass index/update] --> B[Canonical generation]
+    B --> C[graph.json + SQLite/redb default]
+    B --> D[Surreal graph projection]
+    B --> E[Optional Surreal Store adapter]
+    C --> F[Compass query services]
+    D --> G[Bounded native graph query adapter]
+    E --> F
+    G --> F
+    F --> H[MCP 2026 server]
+    F --> I[CLI]
+    J[Canonical skill/plugin inventory] --> K[Portable Agent Skills]
+    J --> L[Codex plugin + marketplace]
+    J --> M[Claude plugin + marketplace]
+    J --> N[OpenCode plugin/npm package]
+    K --> H
+    L --> H
+    M --> H
+    N --> H
+```
+
+### 1. Keep a canonical immutable generation
+
+Do not make a live remote database the authoritative index state. Each Compass build
+should continue to create a deterministic generation with a stable fingerprint.
+Every projected node and edge should carry at least:
+
+- `repository_id`, `generation_id`, and schema version;
+- stable Compass node/edge identity;
+- kind, language, label/name, and source location;
+- direction, multiplicity, confidence, and provenance for relations; and
+- optional commit/revision and content fingerprint.
+
+Projection should be transactionally staged and activated by swapping an
+`active_generation` pointer only after validation. Readers select one generation for
+the duration of a query. This prevents partially refreshed graphs and makes embedded,
+remote, and default backends comparable.
+
+### 2. Model true Surreal relations without losing Compass semantics
+
+SurrealDB supports typed relation records created with `RELATE`, plus graph traversal
+through inbound and outbound record links. That is useful only if Compass preserves
+its own semantics rather than flattening them into generic `RELATED_TO` edges. The
+projection should use schemafull node and relation tables and a closed mapping from
+Compass edge kinds to relation types. If the number of edge kinds makes one table per
+kind operationally unwieldy, use a small number of typed relation families with a
+required `kind` field and validated endpoints.
+
+Parallel edges, direction, source anchors, confidence, and inferred-versus-observed
+status must survive round-trip qualification. A Surreal query that silently collapses
+parallel calls or reverses edge direction is a correctness failure even if it appears
+more convenient for agents.
+
+Suggested logical schema:
+
+```text
+repository -> generation -> code_node
+code_node -[calls/imports/contains/implements/...]-> code_node
+relation fields: compass_edge_id, kind, confidence, evidence[], generation_id
+code_node fields: compass_node_id, kind, label, language, path, span, generation_id
+```
+
+The adapter should generate SurrealQL through typed builders or a closed query plan,
+not concatenate arbitrary model-provided graph queries.
+
+### 3. Separate two SurrealDB deliverables
+
+**`compass-graphdb-surreal` (recommended first):** projection, activation, health,
+and bounded native reads. It gives users the graph database they asked for and can be
+compared directly with `graph.json`/SQLite answers.
+
+**`compass-store-surreal` (optional second):** implements the backend-neutral Store
+contract. It is valuable for remote snapshot/history storage and exercises Compass's
+adapter design. Because the Store API is synchronous while the SurrealDB SDK is async,
+the adapter needs a documented bounded runtime boundary, cancellation and timeout
+rules, and no nested-runtime panics. It should pass the existing store qualification
+suite unchanged before being considered supported.
+
+Do not merge these crates merely because they share a dependency. They have different
+semantic obligations, performance profiles, and failure modes.
+
+### 4. Embedded and remote configurations
+
+For embedded mode, support three testable profiles behind non-default Cargo features:
+
+- `Mem` for deterministic tests and ephemeral sessions;
+- SurrealKV as an evaluation target for low-memory/local-first embedded work; and
+- RocksDB as the conservative persistent comparison target.
+
+SurrealDB's current deployment guidance labels SurrealKV beta and recommends RocksDB
+for conservative server workloads, while suggesting SurrealKV be evaluated first for
+embedded behavior. The correct response is a qualification matrix—not a premature
+default. See [SurrealDB deployment models](https://surrealdb.com/docs/manage/self-hosted/deployment-models).
+
+For remote mode, use the official Rust SDK transport with TLS, explicit namespace and
+database selection, scoped credentials, timeouts, retry budgets, and read-only service
+accounts for MCP. Server mode should never be an implicit fallback when an embedded
+database fails. Network use and credentials must remain explicit, consistent with
+Compass's repository constraints.
+
+### 5. Licensing boundary
+
+The execution-time artifact profile and sign-off gate are maintained in
+[`surrealdb-license-decision.md`](surrealdb-license-decision.md). That record
+pins the reviewed version and license digest and is authoritative for whether
+later SurrealDB waves may proceed.
+
+The `surrealdb` 3.2.4 crate includes core code under BSL 1.1. The official FAQ says
+applications may embed, redistribute, modify, and use it in production; the restriction
+is offering SurrealDB commercially as a managed DBaaS, and core becomes Apache-2.0
+after its change window. The same FAQ is explicit that the core is not OSI-approved
+open source during that window. See the [SurrealDB licence FAQ](https://surrealdb.com/license).
+
+Compass is MIT/Apache-2.0. Therefore:
+
+- keep SurrealDB in optional adapter crates/features rather than the default binary;
+- include the BSL notice in distributions that bundle core code;
+- recognize that optional features contain the default dependency/binary footprint,
+  not the obligations of a Surreal-enabled distributed artifact;
+- obtain legal/release approval for the exact binary, plugin/archive, package-registry,
+  and downstream-redistribution profile;
+- document the DBaaS restriction; and
+- offer remote-client-only or external-server packaging if a distribution cannot
+  accept the embedded core license.
+
+This is a release gate, not legal advice.
+
+## MCP 2026 server design
+
+### Protocol migration
+
+Upgrade to `rmcp 3.1.4` (or a compatible reviewed 3.x pin) in a dedicated change.
+Compass's Rust 1.97.1 toolchain exceeds the crate's Rust 1.88 requirement. Do not mix
+the dependency migration with SurrealDB work; first establish transport and tool
+contract parity.
+
+The migration must cover:
+
+- stateless `server/discover` and removal of default `initialize`/session behavior;
+- explicit legacy compatibility only if supporting MCP 2025 clients is a product
+  requirement;
+- `resultType` and structured output schemas for every result;
+- deterministic tool ordering;
+- new listen/subscription behavior for generation changes;
+- tasks for long-running indexing, refresh, export, and remote projection;
+- standard trace/correlation headers and OpenTelemetry propagation;
+- OAuth client metadata for hosted deployments if remote multi-user service is added;
+- removal or deprecation of `--session-timeout` and other flags that no longer have
+  meaning in the 2026 protocol; and
+- contract tests against both stdio and stateless HTTP.
+
+### Tool contract
+
+The default server should be read-only. Every tool result should have a common
+envelope:
+
+```json
+{
+  "resultType": "complete",
+  "schema": "compass.code_context.v1",
+  "repository": "stable-repository-id",
+  "generation": "generation-id-or-commit",
+  "freshness": {"indexed_at":"...","dirty_worktree":true},
+  "data": {},
+  "evidence": [{"path":"src/lib.rs","line":42,"kind":"observed"}],
+  "confidence": {"value":0.93,"basis":"resolved-call-edges"},
+  "truncation": {"truncated":false,"next":null},
+  "warnings": []
+}
+```
+
+Recommended public tools:
+
+| Tool | Primary workflow | Notes |
+| --- | --- | --- |
+| `code_search` | generation, navigation | Typed symbol/text search; replaces ambiguous naming around `search_symbols`. |
+| `symbol_context` | generation, debugging | Definition, callers, callees, owning module, tests, relations, and source anchors in one bounded result. |
+| `impact` | refactoring, review | Upstream/downstream blast radius, depth, confidence, affected tests and entry points. |
+| `path` | debugging, architecture | Bounded directed path with edge evidence; never silently reverse direction. |
+| `subgraph` | architecture | Bounded node/edge projection around explicit seeds, filters, and budget. |
+| `diff_impact` | bug fixing, review | Maps working-tree or revision diff to affected symbols, processes, tests, and risk signals. |
+| `architecture_map` | architecture | Communities/modules, boundaries, hubs, cycles, and representative source evidence. |
+| `source_evidence` | all workflows | Retrieves exact, bounded source spans behind graph claims. |
+| `change_plan` | generation/refactoring | Read-only ordered plan derived from impact and source evidence; does not edit files. |
+| `query_graph` | expert/fallback | Bounded CompassQL/natural query, read-only, allowlisted operations, strict cost caps. |
+
+Existing PR tools can remain as an optional GitHub capability group. Legacy text tools
+should either return the common structured envelope or be marked deprecated. Avoid
+publishing raw SurrealQL as a default tool. A power-user query tool can exist behind
+an explicit server profile with statement allowlists, row/time/depth limits, and no
+write statements.
+
+Mutating operations such as `update`, `watch`, projection sync, or graph-aware rename
+belong in a separate opt-in capability profile. When the client and server negotiate
+the official `io.modelcontextprotocol/tasks` extension, they should be represented as
+tasks with explicit affected paths and confirmation policy, not hidden side effects
+of navigation tools. A synchronous bounded fallback is still required for clients
+that do not implement the extension.
+
+### Resources, prompts, and change events
+
+Retain the six useful resources, but version their URIs and add generation metadata.
+Add resources for capabilities/schema, current generation, and query-cost policy.
+Publish task-specific prompts only when they encode stable workflow structure; do not
+duplicate the full Agent Skills corpus into prompts.
+
+Emit a generation-changed event/listen update after atomic activation. A client can
+then invalidate cached architecture/context results without keeping server session
+state.
+
+## Agent Skills and CLI design
+
+### Keep portable skills canonical
+
+Agent Skills are the broad compatibility layer. The current specification requires a
+directory with `SKILL.md`; optional scripts, references, and assets load progressively.
+The name must be lower-kebab-case and match the directory; description should state
+what the skill does and when to use it. The spec recommends concise bodies and
+one-level reference links. See the [Agent Skills specification](https://agentskills.io/specification).
+
+Compass's current skill is good operational documentation but broad. Keep it as a
+backward-compatible umbrella and generate smaller entry skills:
+
+| Skill | Trigger/workflow | Main MCP/CLI surface |
+| --- | --- | --- |
+| `compass-navigate` | locate symbols, callers, callees, paths | `code_search`, `symbol_context`, `path` |
+| `compass-debug` | diagnose failures and trace likely execution | `symbol_context`, `path`, `source_evidence` |
+| `compass-change-impact` | plan refactors, review diffs, find tests | `impact`, `diff_impact`, `change_plan` |
+| `compass-architecture` | boundaries, hubs, communities, cycles | `architecture_map`, `subgraph` |
+| `compass-index-maintenance` | build, update, watch, validate freshness | MCP tasks and CLI update/doctor |
+| `compass-mcp-setup` | configure and diagnose clients/transports | capability discovery and package-specific setup |
+
+Each skill should prefer MCP when the server is available, fall back to the native CLI
+using machine-readable output, then verify critical claims in source. Scripts and
+references must be physically bundled into every installed artifact; no absolute
+developer-machine paths.
+
+### Skill-aware CLI
+
+Do not discard the existing `compass install`. Make skill/package behavior explicit
+through a coherent `compass agent` namespace while preserving the current command as
+a compatibility alias:
+
+```text
+compass agent list
+compass agent install --platform codex|claude|opencode|agents --scope project|user
+compass agent doctor [--platform ...]
+compass agent export --platform ... --out ...
+compass agent validate --platform ...
+compass agent mcp-config --platform ... --transport stdio|http
+```
+
+`doctor` should verify binary version, graph availability/freshness, protocol version,
+server discovery, skill checksum, bundled reference parity, plugin manifest validity,
+and MCP configuration. `export` should produce deterministic packages without
+installing them. `validate` should run platform validators where available and reject
+unresolved absolute paths or literal credentials.
+
+## Native harness packages
+
+### Canonical inventory
+
+Create a small Compass-owned manifest—such as `distribution.toml`—that declares:
+
+- product and package version;
+- the canonical skill inventory and their bundled files;
+- MCP server command/arguments and optional hosted compatibility ID;
+- harness-specific hooks or tool bridges;
+- install targets, copy policy, and generated output paths; and
+- validation commands and artifact checksums.
+
+Generate all packages from this inventory. Commit either the generated artifacts or
+reproducible release archives according to Compass's release policy, but always test
+the installed artifact—not only the source template.
+
+### Codex
+
+Current official Codex plugin packaging uses `.codex-plugin/plugin.json`, `skills/`,
+optional `.mcp.json` for bundled MCP, and optional `.app.json` for a registered remote
+MCP compatibility ID. Repository marketplaces live at
+`.agents/plugins/marketplace.json`. See [OpenAI plugin documentation](https://developers.openai.com/plugins/build/plugins).
+
+Recommended package:
+
+```text
+compass/
+  .codex-plugin/plugin.json
+  .mcp.json
+  skills/compass-*/SKILL.md
+  hooks/                 # only if a stable Compass-specific hook is justified
+  assets/
+.agents/plugins/marketplace.json
+```
+
+Use `.mcp.json` for the local stdio server. Add `.app.json` only when Compass operates
+a registered hosted server; it is not a generic replacement for local MCP config.
+
+### Claude Code
+
+Claude plugins use `.claude-plugin/plugin.json`, skills, hooks, agents, and `.mcp.json`;
+marketplaces are supported and `claude plugin validate` should be part of release
+validation. See the [Claude plugin reference](https://code.claude.com/docs/en/plugins-reference)
+and [marketplace documentation](https://code.claude.com/docs/en/plugin-marketplaces).
+
+Recommended package:
+
+```text
+compass-marketplace/
+  .claude-plugin/marketplace.json
+  plugins/compass/
+    .claude-plugin/plugin.json
+    .mcp.json
+    skills/compass-*/SKILL.md
+    hooks/               # optional freshness or pre-change guard, never required for core use
+```
+
+Keep hook behavior advisory and deterministic. The plugin should remain useful in
+clients that consume only its skills and MCP configuration.
+
+### OpenCode
+
+OpenCode loads project plugins from `.opencode/plugins/`, global plugins from its
+config directory, or npm package names from configuration. Plugins are JavaScript or
+TypeScript modules and can define custom tools with `@opencode-ai/plugin` and Zod.
+Its current documentation does not define a Codex/Claude-style marketplace manifest.
+See [OpenCode plugins](https://opencode.ai/docs/plugins/) and
+[custom tools](https://opencode.ai/docs/custom-tools/).
+
+Distribute either:
+
+- `@compass-ai/opencode-plugin` as a versioned npm package; or
+- a generated `.opencode/plugins/compass.ts` project plugin.
+
+The plugin should register a thin native bridge or lifecycle hooks and configure the
+MCP server; it must not reimplement graph logic in TypeScript. Agent Skills remain the
+portable workflow layer.
+
+## Comparable efforts and market signal
+
+| Effort | Relevant shape | Lesson for Compass |
+| --- | --- | --- |
+| [CodeGraphContext](https://github.com/CodeGraphContext/CodeGraphContext) | Tree-sitter/SCIP indexing, graph database, CLI, MCP, multiple backends | Direct validation of the product category; reliability, packaging, and bounded outputs matter as much as graph construction. |
+| [GitNexus](https://github.com/abhigyanpatwari/GitNexus) | Embedded KuzuDB, precomputed communities/processes, seven MCP tools, skills/hooks | Precompute useful intelligence and return task bundles; `impact`, `context`, and `detect_changes` are stronger agent primitives than raw edges. |
+| [Serena](https://github.com/oraios/serena) | Language-server-backed symbol retrieval/editing/refactoring over MCP | Agents value precise semantic navigation and focused source edits; Compass should interoperate with, not pretend to replace, LSP precision. |
+| [Sourcegraph MCP](https://sourcegraph.com/mcp) | Cross-repository search, navigation, history, deep search | Remote/multi-repository value is a distinct tier; keep local-first use excellent before broadening scope. |
+| [repo-graph](https://github.com/James-Chahwan/repo-graph) | Small stdio MCP for codebase navigation | Installation simplicity is a competitive feature; one command and self-contained local operation matter. |
+| [CodeQL Development MCP](https://github.com/advanced-security/codeql-development-mcp-server) | Agent access to deep static/security analysis | Specialized analysis should be an optional capability group, with strict execution and data boundaries. |
+
+Compass's credible differentiation is not “another code graph MCP.” It is the
+combination of deterministic native indexing, explicit observed/inferred evidence,
+bounded typed queries, historical/revision graphs, local-first operation without
+credentials, store qualification, and the same contract exposed through CLI, MCP,
+and portable skills.
+
+## Lessons to borrow from Prometheus—without integration
+
+Prometheus's `skill-system.json` demonstrates the right distribution principle: one
+canonical inventory maps skills, imports, profiles, targets, and generated outputs.
+Its generated Codex/Claude packages and actual OpenCode TypeScript plugin show why
+platform-specific artifacts should be derived rather than hand-maintained.
+
+Compass should borrow these practices:
+
+- one canonical inventory with deterministic generation;
+- copy real skill directories rather than relying on symlinks;
+- bundle all scripts/references/assets;
+- validate installed artifact parity and path portability;
+- keep credentials and host-specific paths out of MCP templates;
+- version-bump and rebuild immutable plugin caches; and
+- test harness-native validators in release CI.
+
+Compass should not import Prometheus's runtime services, memory/control plane,
+orchestrator, plugin cache, or repository structure. No Compass package should require
+Prometheus to install or run. Compatibility should occur through public standards:
+Agent Skills, MCP, CLI contracts, and normal plugin packaging.
+
+## Delivery roadmap and gates
+
+### Phase -1 — cheap disqualifiers (before adapter implementation)
+
+- Obtain written legal/release acceptance for the exact SurrealDB 3.2.4 artifact
+  profile: BSL 1.1 core, Additional Use Grant excluding commercial Database Service,
+  2030-01-01 change date, Apache-2.0 change license, notices, package registries,
+  plugins, and downstream redistribution.
+- Build throwaway persistent SurrealKV and RocksDB spikes that prove parallel directed
+  relations, stable IDs, provenance, generation-scoped reads, and kill-during-write
+  recovery. Delete the spikes; retain test vectors and result records.
+- Review and name `rmcp 3.1.4` as the migration candidate rather than promising an
+  unspecified 3.x release.
+
+**Exit gate:** the full distributed-artifact profile is accepted, persistent
+edge/recovery probes pass, and the
+`rmcp 3.1.4` API/dependency review finds no blocking incompatibility. Otherwise retain
+the existing SQLite/redb/`graph.json` and `rmcp 2.2.0` paths while reconsidering
+alternatives.
+
+### Numeric qualification budgets
+
+Use deterministic `qualification-medium` (100,000 nodes/250,000 edges) and
+`qualification-large` (1,000,000 nodes/2,500,000 edges) fixtures plus the checked-in
+semantic corpus. These thresholds are initial product gates and should be changed only
+by a recorded decision before measurements are run:
+
+| Gate | Threshold |
+| --- | --- |
+| Semantic equivalence | 100% preservation of identity, direction, parallel edges, confidence, source evidence, bounds, and pagination on the semantic corpus plus deterministic samples from both scale fixtures. |
+| Default footprint | No linked Surreal dependencies and zero Surreal-attributable size delta when the feature is disabled. |
+| Enabled footprint | Compressed artifact and peak RSS each no more than 2.0x current baseline on `qualification-medium`. |
+| Core query regression | Search/callers/callees p95 no more than 1.10x current engine. |
+| Native graph value | At least 10% lower p95 on depth-3+ impact/path and at least 15% fewer query calls or response tokens, with no evidence-recall or task-success loss. |
+| Recovery | No partial generation visible; last active medium generation queryable within 30 seconds after killed writer. |
+| Agent tool value | On 30 versioned tasks, evidence recall and success are no worse than bounded raw traversal, and tool calls improve ≥20% or output tokens ≥15%. |
+| Skill compatibility | Zero regressions on recorded umbrella invocations and zero incorrect/ambiguous selections on a new focused-skill boundary-prompt suite. |
+
+These are conservative containment and minimum product-significance thresholds, not
+observed performance claims. Ratify them before benchmark results are visible. Phase 0
+must create and version the semantic corpus, scale-fixture generators, benchmark
+harness, bounded raw-traversal baseline, 30-task suite, umbrella invocation corpus,
+focused-skill boundary prompts, MCP conformance record, and harness interop matrix.
+
+### Proposed Compass change map
+
+The exact crate names can change during design review, but ownership should remain
+clear:
+
+| Area | Proposed change | Must not absorb |
+| --- | --- | --- |
+| workspace `Cargo.toml` | Pin reviewed `rmcp` 3.x; add optional Surreal adapter members and feature policy | Do not put SurrealDB in default workspace dependencies used by every binary. |
+| `compass-store` | Keep the public contract stable; land/review streaming reads independently | No Surreal SDK imports in the core contract crate. |
+| new `compass-store-surreal` | Store adapter, runtime boundary, capability mapping, qualification harness | No graph-specific `RELATE` query API. |
+| new `compass-graphdb-surreal` | Schema, projection, activation, bounded graph reads, health/migration | No MCP or CLI presentation logic. |
+| `compass-query` | Add a Surreal `GraphEngine`/typed planner route and dual-engine equivalence fixtures | No raw model-authored SurrealQL execution. |
+| `compass-mcp` | MCP 2026 discovery/transports, common result schema, tasks/listen negotiation, tool profiles | No database-specific response types. |
+| `compass-cli` | `agent` commands, Surreal configuration commands, projection/status/doctor surfaces | No hand-maintained copies of harness packages. |
+| `crates/compass-cli/assets` or new distribution crate | Canonical skills and generated plugin templates/inventory | No Prometheus runtime or repository dependency. |
+| CI/release | Store and graph equivalence, protocol conformance, package generation, native validators, clean-install tests | No validation that runs only against source templates. |
+
+Configuration should use typed, versioned sections with secrets referenced through
+environment/secret providers rather than stored inline. A representative shape is:
+
+```toml
+[graph.surreal]
+enabled = true
+mode = "embedded"              # embedded | remote
+engine = "surrealkv"           # mem | surrealkv | rocksdb
+path = "compass-out/surreal"
+namespace = "compass"
+database = "code_graph"
+
+[graph.surreal.remote]
+endpoint = "wss://graph.example.invalid"
+credential_env = "COMPASS_SURREAL_TOKEN"
+connect_timeout_ms = 5000
+query_timeout_ms = 10000
+```
+
+The final names should follow the SDK's supported endpoint/engine matrix. `doctor`
+must reject a remote-only field in embedded mode and must never echo credential values.
+
+### Phase 0 — contract baselines (1–2 weeks)
+
+- Freeze golden answers for current typed queries, MCP tool schemas/results, graph
+  direction/multiplicity, and transport behavior.
+- Record binary size, cold start, query latency, peak memory, and 100k/1m-node
+  behavior on current SQLite/JSON paths.
+- Create and version every measurement artifact named by the qualification budgets,
+  including the raw-traversal and skill-routing baselines.
+- Document which dirty streaming-store work will be committed or excluded.
+
+**Exit gate:** reproducible local baselines and no dependency on uncommitted methods.
+
+### Phase 1 — MCP 2026 migration (2–4 weeks)
+
+- On a branch, review `rmcp 3.1.4` for API breakage, MSRV/Rust 1.97.1, license,
+  transitive dependencies, unsafe-code exposure, protocol versions, and transports;
+  obtain MCP/storage owner sign-off.
+- Run reference conformance and the named harness interop matrix before merge.
+- Upgrade specifically to reviewed `rmcp 3.1.4` only after those branch gates pass.
+- Implement stateless discovery, typed results, deterministic tool ordering, and
+  transport contract tests.
+- Deprecate session flags; optionally preserve a named legacy protocol mode.
+- Introduce the common result envelope without renaming all tools at once.
+
+**Exit gate:** stdio and HTTP reference conformance plus an interop matrix for Codex
+CLI 0.146.0, Claude Code 2.1.250, and OpenCode 1.18.23 (or explicitly recorded newer
+versions). If retained, the legacy profile expires after at most 90 days or two
+Compass minor releases, whichever comes first, unless a recorded client blocker is
+approved; it carries duplicate transport/result tests and a compatibility translator.
+
+### Phase 2 — Surreal graph projection adapter (3–5 weeks)
+
+- Add the optional projection crate after the persistent throwaway probes pass; keep
+  Mem only as a deterministic test engine.
+- Define schemafull nodes/relations and generation activation.
+- Implement `symbol_context`, `impact`, `path`, and `subgraph` through both current and
+  Surreal engines.
+- Run property-based and corpus-based equivalence tests for direction, parallel edges,
+  confidence, evidence, bounds, and pagination.
+
+**Exit gate:** zero semantic mismatches on the qualification corpus and deterministic
+scale samples. A mismatch in identity, direction, multiplicity, provenance, bounds,
+or ordering is a failure, not a documented compatibility exception.
+
+### Phase 3 — embedded qualification (3–6 weeks)
+
+- Benchmark SurrealKV and RocksDB builds separately.
+- Test crash recovery, interrupted activation, corruption handling, backup/restore,
+  migrations, disk growth, cold start, incremental projection, and binary size.
+- Complete license/release review.
+
+**Exit gate:** an explicit supported engine matrix. No default switch merely because
+the spike works.
+
+### Phase 4 — remote server mode (3–6 weeks)
+
+- Add scoped authentication, TLS, secret redaction, timeouts, retries, health checks,
+  and read consistency pinned to one generation.
+- Add tasks for projection/update and listen notifications for activation.
+- Test disconnects, duplicate requests, retry safety, stale credentials, server
+  upgrades, and partial network partitions.
+
+**Exit gate:** failure-injection tests and a documented operations/runbook contract.
+
+### Phase 5 — skills and native packages (2–4 weeks)
+
+- Split task skills while preserving umbrella compatibility.
+- Add `compass agent list/install/doctor/export/validate/mcp-config`.
+- Generate Codex and Claude packages/marketplaces and an OpenCode plugin/npm artifact.
+- Test clean-machine installation and uninstall/upgrade ownership behavior.
+
+**Exit gate:** every generated artifact passes native validators and clean
+install/discovery/load/MCP invocation/upgrade/uninstall on the named harness version,
+contains no absolute developer paths or credentials, and invokes the same MCP contract.
+
+## Required test matrix
+
+| Dimension | Required cases |
+| --- | --- |
+| Semantics | node/edge identity, direction, parallel edges, self-loops, confidence, source anchors, history selector |
+| Bounds | max depth, rows, bytes, tokens, time, continuation, cancellation |
+| Storage | point reads, ordered scans, cursors, conditional writes, immutable batches, capability errors |
+| Projection | idempotence, atomic activation, interrupted write, rollback, schema migration, duplicate generation |
+| Embedded | Mem, SurrealKV, RocksDB; clean and dirty shutdown; large graph; disk pressure |
+| Remote | TLS/auth, latency, timeout, retry, disconnect, server restart, version skew, read-only role |
+| MCP | discovery, tools/resources/prompts, structured result schemas, tasks, listen, stdio/HTTP, legacy matrix |
+| Security | path scope, query allowlist, injection, secret redaction, request/response caps, denial-of-service budgets |
+| Distribution | reproducible package, checksum, copy parity, no symlinks where unsupported, native validator, upgrade/uninstall |
+
+## Risks and mitigations
+
+| Risk | Severity | Mitigation |
+| --- | --- | --- |
+| SurrealDB dependency significantly increases build time/binary size | High | Optional crates/features; measure before release; remote-client-only package option. |
+| BSL conflicts with a distribution or customer policy | High | Release/legal gate, bundled notices, optional isolation, external-server client path. |
+| Two persistence models drift semantically | High | One canonical generation, dual-engine golden/property tests, fingerprinted activation. |
+| MCP 2026 breaks current clients | High | Published compatibility matrix, explicit legacy mode, contract tests, staged deprecation. |
+| Raw graph query enables expensive or unsafe requests | High | Read-only typed tools by default, closed planners, cost estimates, hard budgets. |
+| Remote graph becomes stale relative to source | High | Generation IDs in every result, atomic activation, listen notifications, freshness warnings. |
+| Skills and plugins drift | Medium | One inventory, deterministic generation, installed-artifact validation. |
+| Tool proliferation confuses agents | Medium | Task-oriented core set, stable descriptions, deterministic ordering, capability profiles. |
+| Prometheus coupling expands scope | Medium | Standards-only compatibility and separate release pipelines. |
+
+## Falsifiers and decision checkpoints
+
+The recommendation should be revised or stopped if any of these occur:
+
+1. The full distributed-artifact BSL review or either persistent edge/recovery spike fails.
+2. Surreal projection cannot preserve Compass edge direction, multiplicity, source
+   evidence, and bounded query semantics without product-breaking exceptions.
+3. Any numeric footprint, recovery, equivalence, query-regression, or native-value
+   budget above fails.
+4. Remote Store qualification requires weakening ordered scans, cursor stability,
+   conditional writes, or error taxonomy.
+5. The 30-task MCP suite fails its evidence recall, success, call-count, and token
+   thresholds; in that case redesign or drop the task-level additions.
+6. The umbrella invocation or boundary-prompt corpus regresses; in that case keep only
+   the existing umbrella entry point while revising focused skills.
+7. MCP reference conformance or the named client/version matrix fails on the migration
+   branch; do not merge the upgrade.
+8. Generated packages fail clean install/discovery/load/MCP invocation/upgrade/uninstall,
+   or require secrets, machine-specific paths, or Prometheus runtime dependencies.
+
+Decision checkpoints should be evidence-based: approve graph projection after Phase
+2 equivalence, approve an embedded engine only after Phase 3 qualification, approve
+remote support after failure injection, and approve marketplaces after clean-machine
+artifact tests.
+
+The explicit fallback for Surreal failure is the existing SQLite/redb/`graph.json`
+stack. Existing Neo4j/Falkor exporters remain a remote alternative. A Store-only
+Surreal implementation was rejected as the first milestone because it cannot prove
+graph-native value. The umbrella skill remains the fallback if additive focused skills
+do not pass compatibility tests.
+
+## Adversarial-review result
+
+The isolated cross-model decision review ran twice and ended `BLOCK` with 2 critical,
+6 warning, and 1 suggestion findings. Its first round correctly rejected undefined
+budgets and post-build licensing/edge checks; it also received unrelated workspace
+constraints, so round two was rebuilt from the Compass repository and included the
+actual local-first constraints.
+
+Round two found that a Mem-only spike could not test persistent recovery and that
+feature gating had been incorrectly described as containing the BSL footprint. This
+final revision moves the pre-build probes to persistent SurrealKV and RocksDB with a
+kill test, defines the exact distributed-artifact license profile, adds creation of all
+measurement corpora, makes MCP interop a pre-merge condition, extends equivalence to
+scale samples, strengthens agent/skill gates, and requires clean package load tests.
+
+The review skill's two-round cap prevents another independent verdict in this run.
+Accordingly, these changes are **addressed but not re-vetted**, and the report remains
+`partial` rather than claiming an adversarial PASS. The residual unknowns are the
+formal license decision, empirical reasonableness of the proposed numeric budgets,
+and future harness interoperability. Raw findings and both review packets are retained in the original external research
+package; they are intentionally not copied into this repository.
+
+## Final recommendation
+
+Proceed with a staged program, starting with distributed-artifact license review,
+persistent edge/recovery probes, and an MCP 2026 migration branch. Do **not** begin by
+replacing SQLite or implementing
+only `Store` over SurrealDB; that would assume the most risk while delivering the
+least graph-native value.
+
+The target product is a deterministic Compass generation that can be queried through
+the current local engine or a qualified Surreal projection, exposed through one
+bounded MCP contract and taught through portable skills. Native harness plugins should
+package that same contract, not fork it. If qualification succeeds, users gain a true
+embedded or remote graph database without sacrificing Compass's local-first baseline.
+If it fails, the MCP, skill, and packaging improvements still stand on their own.
+
+## Source index
+
+The original external research package contains the 36-source registry, claim graph,
+citations, contradiction log, and review artifacts. This repository copy preserves the
+synthesis only. Highest-value external sources are:
+
+- [MCP 2026-07-28 changelog](https://modelcontextprotocol.io/specification/2026-07-28/changelog)
+- [rmcp 3.1.4](https://docs.rs/rmcp/3.1.4/rmcp/)
+- [SurrealDB deployment models](https://surrealdb.com/docs/manage/self-hosted/deployment-models)
+- [SurrealDB licence FAQ](https://surrealdb.com/license)
+- [Agent Skills specification](https://agentskills.io/specification)
+- [OpenAI Codex plugin packaging](https://developers.openai.com/plugins/build/plugins)
+- [Claude Code plugin reference](https://code.claude.com/docs/en/plugins-reference)
+- [OpenCode plugins](https://opencode.ai/docs/plugins/)
+- [CodeGraphContext](https://github.com/CodeGraphContext/CodeGraphContext)
+- [GitNexus](https://github.com/abhigyanpatwari/GitNexus)
+- [Serena](https://github.com/oraios/serena)
diff --git a/docs/future/qualification-corpora-baselines.md b/docs/future/qualification-corpora-baselines.md
new file mode 100644
index 000000000..8e18ac81e
--- /dev/null
+++ b/docs/future/qualification-corpora-baselines.md
@@ -0,0 +1,88 @@
+# Qualification corpora, baselines, and budget decision
+
+Status: **RATIFIED UNCHANGED for Wave 5 qualification**
+Decision date: 2026-08-28
+Scope: future Surreal graph projection and dual-engine comparisons
+
+## Decision basis
+
+The thresholds below were written into the research document and phase plan
+before C-012 ran. The immutable plan realization was pinned after the
+2026-08-28T12:45:00Z verify-first handoff entry and before C-013 ratification;
+its authoritative identity is SHA-256
+`46e37804d513cf32ce8e7d008816642dffbb9d3b7b60fd3f2e82a482cd398ebf`.
+No earlier filesystem timestamp is used as decision provenance.
+The exact research budget section (lines 530–550 at ratification) has SHA-256
+`d2f805da25a4904bb7137a0c13c1ab5a813a25c10875d24b2d81887e8298c744`.
+
+Decision: accept every threshold unchanged. C-012's already-recorded disposable
+engine measurements are explicitly not inputs to this ratification and are not
+evaluated here. No Wave 5 Surreal projection result exists at this decision.
+
+## Ratified profiles
+
+| Profile | Nodes | Edges | Purpose |
+| --- | ---: | ---: | --- |
+| `qualification-semantic` | checked-in corpus | checked-in corpus | Exact semantic/evidence equivalence |
+| `qualification-medium` | 100,000 | 250,000 | Footprint, query, recovery, and current-engine baseline |
+| `qualification-large` | 1,000,000 | 2,500,000 | Scale sampling and boundedness |
+
+## Ratified gates
+
+| Gate | Threshold |
+| --- | --- |
+| Semantic equivalence | 100% preservation of identity, direction, parallel edges, confidence, source evidence, bounds, and pagination on the semantic corpus plus deterministic samples from both scale fixtures. |
+| Default footprint | No linked Surreal dependencies and zero Surreal-attributable size delta when the feature is disabled. |
+| Enabled footprint | Compressed artifact and peak RSS each no more than 2.0× current baseline on `qualification-medium`. |
+| Core query regression | Search/callers/callees p95 no more than 1.10× current engine. |
+| Native graph value | At least 10% lower p95 on depth-3+ impact/path and at least 15% fewer query calls or response tokens, with no evidence-recall or task-success loss. |
+| Recovery | No partial generation visible; last active medium generation queryable within 30 seconds after a killed writer. |
+| Agent tool value | On 30 versioned tasks, evidence recall and success are no worse than bounded raw traversal, and tool calls improve at least 20% or output tokens at least 15%. |
+| Skill compatibility | Zero regressions on recorded umbrella invocations and zero incorrect/ambiguous selections on the focused-skill boundary-prompt suite. |
+
+Changing a threshold requires a new dated decision before the affected backend is
+measured. A failed gate is a falsifier, not permission to tune the corpus or
+threshold after the fact.
+
+## Artifact boundary
+
+Versioned sources and results live under `benchmarks/qualification/`. Generated
+graphs, query-index caches, binaries, and logs are disposable and must stay under
+an explicitly selected `target/` or temporary directory.
+
+## Current-engine baseline
+
+The retained baseline uses workspace Compass 0.3.7 built with
+`cargo build -p compass-cli --release --locked` on Apple arm64/macOS 26.7 with
+Python 3.12.8 and zlib 1.2.12. The
+exact `qualification-medium` graph is 220,023,199 bytes with SHA-256
+`aca4e6a1a836780f4baa352c37469787be9815db19f8bf48e858cc87eeb4f054`.
+Five measured samples follow one unmeasured cache warmup per query; p95 is the
+nearest-rank value across separate CLI processes.
+
+| Measurement | Current baseline |
+| --- | ---: |
+| Release binary | 146,726,928 B |
+| Runtime-pinned gzip-9 binary | 25,945,073 B |
+| Cold start (`--version`) p95 | 24,687 µs |
+| Search p95 / max peak RSS | 11,290,305 µs / 898,514,944 B |
+| Callers p95 / max peak RSS | 11,360,993 µs / 897,433,600 B |
+| Callees p95 / max peak RSS | 11,374,780 µs / 897,449,984 B |
+| Depth-3 impact p95 / max peak RSS | 11,238,889 µs / 912,834,560 B |
+| Exact three-hop path p95 / max peak RSS | 3,959,473 µs / 1,990,197,248 B |
+| Bounded raw 30-task run / peak RSS | 35,491,798 µs / 245,694,464 B |
+| Raw per-task p95 after load | 14,376 µs |
+
+These process-level timings include strict graph validation/load and are not
+in-process service latency. The legacy `path` command exposes no depth flag; its
+selected endpoints have a verified exact three-hop shortest path, while the
+finite graph profile and 120-second process timeout bound the run. The raw
+samples, deterministic output hashes,
+binary/graph identities, Python/zlib host, commands, and limits are retained in
+`benchmarks/qualification/current-engine-baseline-v1.json` so later comparisons
+cannot silently switch measurement conditions. Source provenance includes the
+tracked binary diff plus a bounded deterministic hash of all 638 existing
+tracked or non-ignored untracked files across the root manifests/toolchain,
+every workspace crate, and both vendored path dependencies. The 612-file tracked
+and 26-file untracked subsets have separate counts, byte totals, and digests;
+ignored ambient files are excluded from the identity.
diff --git a/docs/future/surreal-persistent-probe-results.md b/docs/future/surreal-persistent-probe-results.md
new file mode 100644
index 000000000..1fec6f4fc
--- /dev/null
+++ b/docs/future/surreal-persistent-probe-results.md
@@ -0,0 +1,102 @@
+# SurrealDB 3.2.4 persistent-engine probe results
+
+Status: **PASS — semantic/recovery gate only**
+Run date: 2026-08-28
+Host: Apple arm64, macOS 26.7 (25G224), Darwin 25.6.0
+Toolchain: Rust 1.97.1 (`8bab26f4f`), Cargo 1.97.1
+
+This is evaluation evidence, not a shipped Compass capability or performance
+claim. It does not satisfy the separate BSL sign-off in
+[`surrealdb-license-decision.md`](surrealdb-license-decision.md), and its
+measurements are not evaluated against numeric budgets until C-013 ratifies
+those budgets.
+
+## Reproducible inputs
+
+The retained fixture set is
+[`scripts/fixtures/surreal-persistent-probes/`](../../scripts/fixtures/surreal-persistent-probes/).
+`manifest-v1.json` pins the SHA-256 of every input, expected result, engine
+result, and the exact tagged SurrealDB license bytes. The workload contains:
+
+- three stable logical nodes;
+- two same-direction parallel relations with distinct stable IDs;
+- one reverse relation;
+- exact source path, line, column, and finite-decimal confidence evidence;
+- immutable `g-0001` and `g-0002` generations plus one active pointer; and
+- 2,048 generated relations, for 2,051 total relations across 17 pages of 128.
+
+`input-v1.json` retains the complete scale-edge expansion rule: zero-padded
+IDs, alternating endpoints, fixed confidence, and deterministic source path,
+line, and column formulas. `expected-v1.json` independently pins both the
+newline-joined ordered-ID digest and the canonical expanded-relation digest.
+
+The disposable runner was a standalone Cargo package under `/tmp`, pinned
+`surrealdb = "=3.2.4"`, and compiled once with only `kv-surrealkv` and once with
+only `kv-rocksdb`. Each engine used a separate empty release target. The
+runner and every target/database directory were removed after the retained
+results were verified.
+
+## Semantic and recovery results
+
+| Dimension | SurrealKV | RocksDB | Required result |
+| --- | --- | --- | --- |
+| Stable logical relation IDs | PASS | PASS | All 2,051 IDs round-trip exactly |
+| Parallel directed multiplicity | PASS | PASS | Two distinct Alpha → Beta relations |
+| Reverse direction | PASS | PASS | Beta → Alpha remains distinct |
+| Provenance and confidence | PASS | PASS | Paths, coordinates, and six-decimal strings exact |
+| Candidate isolation | PASS | PASS | Writing `g-0002` does not change active `g-0001` |
+| Atomic activation | PASS | PASS | Final pointer switch selects `g-0002` |
+| Kill during candidate write | PASS | PASS | Child killed after one durable candidate batch and before activation |
+| Reopen after kill | PASS | PASS | Retained post-crash count/digest prove `g-0001` has all 2,051 records |
+| Explicit ordering | PASS | PASS | Strict `stable_id` order, no duplicate/missing pages |
+| Pagination | PASS | PASS | 17 pages concatenate to 2,051 records |
+| Ordered-ID SHA-256 | `8d95d397…160d3` | `8d95d397…160d3` | Engine outputs equal |
+
+The retained `.semantic` objects for the two engines are byte-identical after
+canonical JSON sorting. Candidate rows written before the forced termination
+may remain as unreachable orphan data; the probe's acceptance property is that
+no incomplete candidate becomes visible through the active-generation read.
+
+## Descriptive resource measurements
+
+| Measurement | SurrealKV | RocksDB |
+| --- | ---: | ---: |
+| Selected normal dependency-tree lines | 418 | 411 |
+| Clean release build wall time | 507.55 s | 289.65 s |
+| Clean build maximum RSS | 405,012,480 B | 466,075,648 B |
+| Release executable | 62,247,392 B | 70,950,208 B |
+| Full semantic/recovery workload wall time | 2.73 s | 2.59 s |
+| Workload maximum RSS | 54,575,104 B | 155,287,552 B |
+| Median internal cold start (5 new stores) | 93,375 µs | 48,863 µs |
+| Median cold-start maximum RSS | 35,012,608 B | 120,963,072 B |
+
+Both release targets were empty, but registry sources and host caches were
+already present from feature checks. The builds ran sequentially on one host;
+the values are reproducible baselines for this environment, not universal or
+statistically controlled comparisons.
+
+## License capture
+
+`SURREALDB-3.2.4-LICENSE.txt` is byte-identical to the official `v3.2.4`
+tagged license and has SHA-256
+`98a94ac615f88370865016487b436fa404560910bd329794ed7502277a94b805`.
+It records BSL 1.1, the Database Service restriction, Change Date 2030-01-01,
+and Apache License 2.0 as the Change License. License acceptance remains C-011,
+not an inference from successful engine behavior.
+
+## Disposition
+
+C-012 passes: both required persistent engines completed every semantic,
+ordering, pagination, generation, dirty-shutdown, measurement, and license
+capture dimension. At C-012 completion on 2026-08-28, C-014/C-015 remained
+blocked until C-011 recorded explicit user/legal approval and C-013 ratified
+measurement budgets. If either gate rejected the work, Compass retained its
+current SQLite/redb/`graph.json` stack. Later gate outcomes belong to their own
+dated decision records, not this prerequisite probe record.
+
+No SurrealDB dependency is present in Compass `Cargo.toml` files or
+`Cargo.lock`; the probe does not alter default builds or published behavior.
+The pre-probe and post-disposal checksum ledgers were byte-identical. Each
+ledger contains 33 sorted Compass `Cargo.toml` SHA-256 records followed by the
+`Cargo.lock` SHA-256 record; the ledger SHA-256 is
+`a98ca39857724b88a12a306b6647299ff93fed69f4c881bee54fddc230b45e6c`.
diff --git a/docs/future/surrealdb-license-decision.md b/docs/future/surrealdb-license-decision.md
new file mode 100644
index 000000000..cf4941fcf
--- /dev/null
+++ b/docs/future/surrealdb-license-decision.md
@@ -0,0 +1,99 @@
+# SurrealDB 3.2.4 license and release decision
+
+Status: **APPROVED — ACCEPT**
+Evidence date: 2026-08-28
+Decision date: 2026-08-29
+Decision scope: Compass artifacts that may depend on or contain SurrealDB 3.2.4
+
+This is a factual release-gate record, not legal advice. The user accepted every
+named artifact profile below under its stated conditions. That acceptance is
+limited to the pinned SurrealDB 3.2.4 evidence and does not waive the remaining
+technical, notice, redistribution, or independent-problem gates.
+
+## Pinned evidence
+
+The reviewed upstream tag is `v3.2.4`. Its exact
+[`LICENSE`](https://raw.githubusercontent.com/surrealdb/surrealdb/v3.2.4/LICENSE)
+has SHA-256:
+
+```text
+98a94ac615f88370865016487b436fa404560910bd329794ed7502277a94b805
+```
+
+The license parameters in that tagged file are:
+
+| Parameter | Pinned value |
+| --- | --- |
+| License | Business Source License 1.1 |
+| Licensor | SurrealDB Ltd. |
+| Licensed Work | SurrealDB 3.0, copyright 2025 SurrealDB Limited |
+| Additional Use Grant | Use is allowed except use as a Database Service |
+| Database Service boundary | A product, service, platform, or commercial offering that provides database functionality to third parties (other than direct employees or contractors) and enables those third parties to create, manage, or control schemas or tables |
+| Change Date | 2030-01-01 |
+| Change License | Apache License, Version 2.0 |
+
+The license converts on the earlier of the stated Change Date and the fourth
+anniversary of the first publicly available distribution of the specific
+version under this license.
+
+The BSL terms also state that copies and derivative works remain under the
+license until conversion, the license applies separately per version, and the
+license must be conspicuously displayed on original or modified copies.
+
+The tagged [`surrealdb` crate
+manifest](https://raw.githubusercontent.com/surrealdb/surrealdb/v3.2.4/surrealdb/Cargo.toml)
+publishes with `license-file` metadata and an unconditional dependency on
+`surrealdb-core`. Its HTTP and WebSocket transports are features, but selecting
+only a remote protocol does not remove that core dependency. The tagged
+[`surrealdb-core` manifest](https://raw.githubusercontent.com/surrealdb/surrealdb/v3.2.4/surrealdb/core/Cargo.toml)
+publishes with the same workspace license file and owns the embedded Mem,
+SurrealKV, and RocksDB features.
+
+SurrealDB's [official licensing
+FAQ](https://github.com/surrealdb/license) describes embedding, modification,
+redistribution, and production use as permitted by its Additional Use Grant,
+while excluding commercial DBaaS use and noting that the BSL is not an
+OSI-approved open-source license before conversion. The tagged license text,
+not the FAQ summary, controls this record.
+
+## Artifact profile
+
+| Compass artifact | BSL/core relationship | Release condition if approved |
+| --- | --- | --- |
+| Source checkout with no Surreal dependency | Contains neither Surreal core nor its dependency metadata | No Surreal-specific notice. |
+| Optional Compass crate on crates.io | The Compass crate need not copy core source, but activating it resolves BSL `surrealdb` and `surrealdb-core` packages | Pin 3.2.4, disclose the optional BSL dependency and Database Service boundary, and require downstream artifacts to carry applicable notices. |
+| Prebuilt binary or native library with embedded support | Links covered core code | Bundle the exact tagged license conspicuously, identify the covered version and restriction, retain notices, and do not label the complete artifact as exclusively OSI-open-source. |
+| Plugin or archive containing such a binary | Redistributes the same covered bytes | Apply the prebuilt-binary conditions to the archive and its package metadata. |
+| Container containing a Surreal-enabled Compass binary or SurrealDB server | Redistributes covered code | Include the exact license and version in the image and accompanying notices; disclose the restriction at the distribution surface. |
+| Codex, Claude, or OpenCode skill/config package only | No covered bytes when it contains only prose and configuration | No Surreal notice solely for the package; generation must not silently attach a covered executable. |
+| Downstream redistribution of covered source or binaries | Redistributor receives a covered copy | Preserve and conspicuously display the license, notices, version, Change Date, Change License, and Database Service restriction. |
+| Genuinely remote-client-only integration | No BSL core linked into Compass | Use a core-free protocol implementation and an independently installed server. The official Rust SDK 3.2.4 is not treated as core-free because its manifest retains the unconditional core dependency. |
+
+Cargo feature isolation contains default build and binary footprint. It does
+not erase obligations from a Surreal-enabled artifact that resolves or embeds
+the covered core.
+
+## Outcome effects
+
+- **Accept all profiles:** C-014 and C-015 may proceed after C-012 and C-013
+  also pass. C-020 still requires its separate user-problem condition.
+- **Conditional:** only explicitly named profiles may proceed. All omitted
+  profiles are prohibited, and later changes must encode the allowed set as a
+  release gate.
+- **Reject:** cancel C-014 and C-015 as framed and cancel the Surreal branch of
+  C-020. Retain SQLite/redb/`graph.json`. A later remote-only proposal may be
+  evaluated only after dependency-tree evidence proves Compass links no BSL
+  core.
+
+## Sign-off
+
+```text
+Decision: ACCEPT
+Approved profiles: Every artifact profile named in this record, under its stated release conditions
+Prohibited profiles: None beyond the conditions and Database Service restriction recorded above
+Decision authority/name: Project user / active Codex task decision authority
+Authority role (user or legal reviewer): User
+Decision date: 2026-08-29
+Provenance (task message, review reference, or signed record): Active Codex task message: "C-011: ACCEPT"
+Conditions or notes: Applies only to pinned SurrealDB 3.2.4; preserve the exact BSL license, notices, version, Change Date, Change License, and Database Service restriction for covered artifacts and redistribution; perform a fresh license/profile review for every version upgrade
+```
diff --git a/docs/future/upstream-contribution-plan.md b/docs/future/upstream-contribution-plan.md
new file mode 100644
index 000000000..4d45f53d9
--- /dev/null
+++ b/docs/future/upstream-contribution-plan.md
@@ -0,0 +1,381 @@
+# Upstream contribution plan for the SurrealDB, MCP, and agent ecosystem work
+
+> **Status:** contributor planning notes, not an accepted Compass roadmap.
+>
+> These notes explain how to use the repository's existing KBD and Prometheus
+> tooling without turning local orchestration state into the product design. The
+> upstream maintainers remain the authority on scope, sequencing, dependency
+> policy, compatibility, and whether any proposal should proceed.
+
+## Purpose
+
+The companion [research report](compass-surrealdb-mcp-skills-research.md)
+contains several related recommendations:
+
+- modernize the existing Rust MCP server for MCP 2026;
+- evaluate a graph-native SurrealDB projection and a separate Store adapter;
+- evolve Compass's existing Agent Skills and skill-aware CLI installation; and
+- publish native Codex, Claude Code, and OpenCode packages.
+
+Those recommendations should not become one pull request. They cross storage,
+query, transport, security, licensing, CLI, documentation, and packaging
+contracts. Compass's contribution guide explicitly asks for focused changes and
+warns that maintainers may split broad pull requests.
+
+## Start with upstream agreement, not implementation
+
+Before opening a code pull request:
+
+1. Search Compass Issues and Discussions for SurrealDB, graph backends, MCP
+   2026, `rmcp` 3.x, Agent Skills, Codex plugins, Claude plugins, and OpenCode.
+2. Use a Discussion for the combined direction because it is still open-ended.
+3. Convert only an agreed, observable outcome into a focused feature request.
+4. Ask maintainers which slice they would review first and whether they want a
+   design document or proof-of-concept branch before code.
+5. Treat silence as no authorization to introduce a large dependency or public
+   contract.
+
+The proposal should lead with a user need, not a technology:
+
+```text
+Agents using Compass need versioned, bounded code-graph context through a
+current MCP contract. Some users also need an optional graph-native persistence
+and query target that can run embedded or remotely. The default structural
+workflow must remain local, deterministic, credential-free, and independent of
+that optional target.
+```
+
+State these non-goals explicitly:
+
+- no replacement of `graph.json`, SQLite, or redb as the default;
+- no mandatory network, credentials, embeddings, vector database, or model;
+- no raw write-capable SurrealQL tool for agents by default;
+- no Prometheus runtime dependency in Compass;
+- no Graphify compatibility or fallback path;
+- no claim that research, an MCP protocol draft, or a future document is
+  shipped behavior; and
+- no combined “database + MCP + skills + three marketplaces” mega-PR.
+
+## Preserve the current KBD work before starting
+
+As of 2026-08-28, this checkout reports:
+
+```text
+active phase: compass-scoping-and-bounds
+status: plan_ready
+next change: C-001 / stream-snapshot-read
+exact next command: /opsx:new stream-snapshot-read
+KBD runtime mode: legacy; typed runtime not initialized yet
+```
+
+Do not append the ecosystem work to that phase merely because
+`read_snapshot` may later help a remote adapter. Finish, pause, or formally
+supersede the current phase first. Use the typed KBD command surface and never
+edit `progress.json`, the waypoint, or event counters by hand.
+
+Check state before every new session:
+
+```bash
+prometheus kbd status --json
+git status --short
+```
+
+The current checkout also contains unrelated tracked modifications and many
+untracked harness/generated paths. Create a clean branch or worktree from the
+upstream base for each proposed PR. Do not use destructive cleanup commands on
+this checkout.
+
+## Suggested KBD structure
+
+After the current phase is resolved, create a new top-level phase such as
+`compass-agent-graph-ecosystem`. Its goal should be decision-quality evidence
+and independently reviewable changes, not “implement the research report.”
+
+A practical sequence is:
+
+```text
+Assess
+  verify current contracts and existing implementation
+Analyze
+  compare status quo, MCP migration, and optional backend candidates
+Plan
+  define one OpenSpec change per intended upstream PR
+Execute
+  apply one task at a time through KBD
+Reflect
+  record measured outcomes and revise the next change
+```
+
+Harness commands:
+
+```text
+/kbd-new-phase compass-agent-graph-ecosystem
+/kbd-assess compass-agent-graph-ecosystem
+/kbd-plan compass-agent-graph-ecosystem
+/opsx:new <focused-change-id>
+/kbd-apply <focused-change-id>
+/opsx:verify <focused-change-id>
+/opsx:archive <focused-change-id>
+/kbd-reflect compass-agent-graph-ecosystem
+```
+
+Use `/kbd-apply`, not bare `/opsx:apply`; the KBD wrapper advances one task at a
+time and keeps the append-only journal, projection, hooks, and waypoint
+consistent. If the installed command names differ, run the relevant skill help
+instead of guessing flags.
+
+For each change, make the OpenSpec proposal answer:
+
+- What observable problem does this solve?
+- Which crate owns the behavior?
+- Which current machine contract changes, if any?
+- What remains the supported fallback?
+- What resource, security, and network bounds apply?
+- Which test falsifies the approach?
+- Which documentation becomes authoritative only after release?
+
+## Recommended PR sequence
+
+Each PR below should be independently useful and revertible. Do not promise all
+later PRs in order to justify the first.
+
+### PR 0 — maintainer-approved decision record
+
+Prefer a Discussion or feature request first. If maintainers want a repository
+document, submit a short Compass-native design proposal distilled from the
+research. Do not submit the entire research package, local absolute paths,
+review packets, or Prometheus internals.
+
+Decision required:
+
+- Is MCP 2026 support desired now?
+- Is an optional BSL dependency acceptable in any published artifact?
+- Does upstream want SurrealDB specifically, or a backend capability with
+  SurrealDB as one candidate?
+- Which harness packages belong in the Compass repository?
+
+### PR 1 — `rmcp 3.1.4` and MCP 2026 compatibility
+
+Scope only the dependency and protocol migration. Do not add SurrealDB or new
+plugin packages.
+
+Before merge:
+
+- document the `rmcp 2.2.0` to `3.1.4` API and transitive-dependency delta;
+- confirm Rust 1.97.1, license, unsafe-code, and `deny.toml` policy;
+- add `server/discover`, stateless request metadata, `resultType`, deterministic
+  tool ordering, and the new subscription model as required;
+- run reference conformance on a branch;
+- test stdio and HTTP against named Codex, Claude Code, and OpenCode versions;
+- state whether legacy MCP support exists, its exact cost, and its removal date;
+- update MCP reference, compatibility, migration, changelog, security, and
+  operations documentation where required.
+
+If the clients do not interoperate, do not merge merely because the Rust code
+compiles.
+
+### PR 2 — structured task-level MCP results
+
+Keep database implementation out. Define a common versioned result envelope
+and improve a small number of existing tools first—prefer `search_symbols`,
+`get_callers`, `get_callees`, and `get_impact`.
+
+Measure a checked-in task corpus against the current bounded raw-traversal
+baseline. Preserve exact evidence, direction, multiplicity, ambiguity, bounds,
+pagination, and deterministic ordering. Do not use a product schema name as the
+MCP `resultType`; keep `resultType: "complete"` and carry the Compass schema in
+a separate field.
+
+### PR 3 — persistent SurrealDB evaluation only
+
+Do not begin with a production adapter. Create a disposable evaluation that
+uses the persistent engines under consideration, not only in-memory mode. It
+must test:
+
+- parallel directed relations with stable IDs;
+- source provenance and confidence round trips;
+- generation-scoped reads and atomic activation;
+- kill-during-write recovery;
+- deterministic ordering and pagination at scale;
+- dependency/build time, compressed binary size, cold start, peak RSS, and
+  query latency; and
+- the exact SurrealDB 3.2.4 license text and downstream distribution effect.
+
+This evidence can live in an issue, benchmark artifact, or maintainer-approved
+qualification document. A failed evaluation should leave no production
+dependency in the workspace.
+
+### PR 4 — optional graph projection/query adapter
+
+Proceed only after PR 3 and a maintainer decision. Keep it in a focused
+integration crate such as `compass-graphdb-surreal`; do not import SurrealDB
+into `compass-model`, `compass-store`, `compass-query`, or the default CLI path
+without an ownership reason.
+
+The projection must be derived from one immutable Compass generation. The
+current JSON/SQLite path remains authoritative and supported. Native queries
+must pass dual-engine semantic equivalence before being exposed to MCP or CLI.
+
+### PR 5 — optional `Store` adapter
+
+Treat this as a separate decision. Pass the unchanged
+`compass-store-qualification` contract, including ordered scans, cursors,
+conditional writes, error taxonomy, interruption, reopen, and bounded work.
+The synchronous/async boundary belongs in the adapter crate; no executor should
+leak into the core Store contract.
+
+If this adapter does not solve an independently stated user problem, do not add
+it merely because the graph projection exists.
+
+### PR 6 — Agent Skills and skill-aware CLI evolution
+
+First preserve the existing umbrella skill and `compass install` behavior.
+Add focused skills only as additive artifacts with trigger-discrimination and
+complete-tree installation tests. A possible CLI namespace is
+`compass agent list|install|doctor|export|validate|mcp-config`, but command names
+must be approved through normal CLI contract review.
+
+Tests must cover project/user scope, copied files, checksums, user-authored
+instruction preservation, idempotent upgrade, uninstall, path containment, and
+the absence of credentials or machine paths.
+
+### PR 7 — native harness distribution
+
+Generate platform-specific artifacts from a Compass-owned inventory:
+
+- Codex: `.codex-plugin/plugin.json`, skills, `.mcp.json`, and a repository
+  `.agents/plugins/marketplace.json` only if maintainers want a marketplace;
+- Claude Code: `.claude-plugin/plugin.json`, skills, `.mcp.json`, and
+  `.claude-plugin/marketplace.json` when distribution is approved; and
+- OpenCode: a real TypeScript/npm or project plugin, not an invented common
+  marketplace format.
+
+Clean-install, discovery/load, MCP invocation, upgrade, and uninstall must pass
+in each named harness. Generated files must be reproducible and must not contain
+local paths or secrets.
+
+## Prometheus skills to use during the work
+
+Prometheus should improve the contribution process, not become a Compass
+runtime dependency.
+
+| Stage | Useful skill | Expected artifact |
+| --- | --- | --- |
+| Assess current state | `deep-research`, Compass queries | Source-grounded assessment pinned to a commit |
+| Verify current libraries | Context7 documentation lookup | Named versions and primary documentation |
+| Challenge a decision | `adversarial-review` in decision mode | Findings with falsifiers before implementation |
+| Review a new dependency | `dependency-pin-discipline` | Exact pin, MSRV/license/transitive delta, update policy |
+| Design MCP/CLI contracts | `api-and-interface-design` | Versioned request/result/error and compatibility contract |
+| Design remote trust boundaries | `agent-runtime-security` | Authentication, authorization, path, query, secret, and DoS limits |
+| Specify behavior | `bdd-scenarios` or `bdd-testing` | Reviewable scenarios for success, ambiguity, bounds, and failure |
+| Record accepted architecture | `documentation-and-adrs` | Maintainer-approved design/ADR and consequences |
+| Pre-PR review | `code-review-and-quality`, `adversarial-review` | Actionable findings before maintainer review |
+| Close a KBD phase | `/kbd-reflect` | Measured outcomes, rejected assumptions, next-phase seed |
+
+When a skill produces local state, separate it from the proposed product patch.
+The repository currently tracks selected `.kbd-orchestrator/**`,
+`.prometheus/knowledge/wiki/**`, and harness files, but that does not mean every
+session transcript, event, generated configuration, or cache belongs in every
+feature PR. Ask maintainers which orchestration artifacts they want. If they do
+want them, keep them in a separate commit so they can review or drop them
+without touching implementation.
+
+Never add Prometheus package imports, executable requirements, MCP endpoints,
+user-home paths, model policy, or skill-cache paths to Compass production code.
+The acceptable integration boundary is the contributor workflow plus public
+standards such as MCP and Agent Skills.
+
+## Upstream acceptance checklist
+
+Before requesting review, verify all of the following:
+
+- [ ] An Issue or Discussion records the maintainer-approved scope.
+- [ ] The PR solves one observable problem and has a narrow title.
+- [ ] The branch starts from the intended upstream base in a clean worktree.
+- [ ] No unrelated KBD events, wiki transcripts, generated graphs, harness
+      configs, formatting, or user changes are included.
+- [ ] New dependencies have an exact justification, license analysis,
+      transitive-dependency review, and lockfile update.
+- [ ] Default Compass remains native, local-first, deterministic, bounded, and
+      credential-free.
+- [ ] Graph identity, direction, multiplicity, provenance, ambiguity, and source
+      anchors are preserved.
+- [ ] Network, authentication, secrets, timeouts, retries, and response limits
+      are explicit and tested with local mocks.
+- [ ] The change lives in the lowest owning crate; CLI and MCP remain thin.
+- [ ] The lowest useful unit/regression tests and public contract tests exist.
+- [ ] `COMPATIBILITY.md`, `MIGRATION.md`, `CHANGELOG.md`, `SECURITY.md`,
+      `PERFORMANCE.md`, and relevant docs are updated when their contract changes.
+- [ ] Documentation distinguishes current behavior from future evaluation.
+- [ ] `git diff --check` and all targeted gates pass.
+- [ ] The PR description follows `.github/pull_request_template.md` and lists
+      every check not run.
+- [ ] The contribution remains `MIT OR Apache-2.0`; bundled third-party license
+      notices are complete.
+
+For Rust changes, the repository's normal completion baseline is:
+
+```bash
+cargo fmt --all -- --check
+cargo clippy --workspace --lib --bins --locked -- -D warnings
+cargo test --workspace --lib --bins --locked
+```
+
+Add the surface-specific gates from `AGENTS.md`. For a documentation-only
+proposal, run `git diff --check` and verify every changed link and command.
+
+## How to present the first upstream request
+
+Keep the opening short:
+
+```markdown
+### Problem
+
+Compass already has an MCP server, but its current Rust SDK/protocol line does
+not implement the latest stateless discovery contract. Agents also lack one
+uniform structured result envelope across the safest typed code-navigation
+tools.
+
+### Desired outcome
+
+Bring the existing server to a maintainer-approved MCP 2026 contract while
+preserving the current stdio/HTTP security bounds, deterministic tool order,
+typed evidence, and a documented compatibility path for current clients.
+
+### Non-goals
+
+This proposal does not add SurrealDB, change the default graph/store engine,
+add embeddings, or publish new harness marketplaces.
+
+### Contribution
+
+I can submit a focused migration PR with conformance tests and named
+Codex/Claude/OpenCode interoperability results after the protocol scope is
+approved.
+```
+
+That first request is much easier to evaluate than asking maintainers to accept
+the entire ecosystem direction at once.
+
+## Documentation lifecycle
+
+Keep both documents in `docs/future/` while they are unaccepted planning work.
+If maintainers accept a decision:
+
+1. distill the accepted rationale and alternatives into a short design document
+   or ADR in the location they prefer;
+2. create an implementation plan under `docs/implementation/` only for approved
+   engineering work;
+3. update concepts, guides, cookbook, reference, compatibility, migration,
+   security, performance, and changelog documentation only as behavior ships;
+4. leave rejected or superseded decisions visible with their status rather than
+   rewriting history; and
+5. remove local paths, model names, KBD mechanics, and research-package metadata
+   from user-facing Compass documentation.
+
+## Recommended next step
+
+Finish or pause the active `compass-scoping-and-bounds` phase, create a clean
+worktree, and open a Discussion limited to MCP 2026 modernization. Use the
+larger SurrealDB and agent-distribution research as context, not as the scope of
+the first implementation request.
diff --git a/docs/guides/integrating-compass.md b/docs/guides/integrating-compass.md
index 3ec5e81dd..11f20d283 100644
--- a/docs/guides/integrating-compass.md
+++ b/docs/guides/integrating-compass.md
@@ -210,6 +210,38 @@ Before placing it behind an editor or network service:
 For a local coding assistant, stdio avoids opening a listening socket. Use HTTP
 only when a multi-process or remote integration actually needs it.
 
+Render a credential-free host-native starting point instead of translating
+schemas by hand:
+
+```bash
+compass agent mcp-config --platform codex --transport stdio
+compass agent mcp-config --platform claude --transport http
+compass agent mcp-config --platform opencode --transport stdio
+```
+
+Codex receives `mcp_servers` TOML, Claude receives an `.mcp.json`
+`mcpServers` object, and OpenCode receives its top-level `mcp` object. The HTTP
+form intentionally uses a loopback URL; add authentication deliberately before
+changing the bind boundary.
+
+The four core navigation tools—`search_symbols`, `get_callers`, `get_callees`,
+and `get_impact`—publish a closed structured output schema and return
+`compass.code_context.v1`. Read the previous `compass.query/1` result from
+`structuredContent.data`. The surrounding envelope adds graph identity,
+evidence-scoped freshness, evidence/confidence summaries, truncation state, and
+warnings. MCP `resultType` is a separate protocol field and is `complete` for
+these synchronous calls.
+
+Treat `freshness.status: "unknown"` as unknown rather than current. When
+`truncation.truncated` is true and `truncation.next` is null, this schema version
+has no continuation token; issue a narrower request or raise an explicit bound.
+
+Discovery marks the remaining text-only tools and explicit `query_graph`
+traversal text mode deprecated from 0.4.0. Their names and current text outputs
+remain available while typed replacements are designed; no removal release is
+scheduled yet. Prefer the four envelope-backed navigation tools for new
+machine consumers.
+
 ## Cross-repository registry
 
 Compass can register graphs in a global index:
diff --git a/docs/implementation/agent-distribution.md b/docs/implementation/agent-distribution.md
new file mode 100644
index 000000000..c1eda8f1a
--- /dev/null
+++ b/docs/implementation/agent-distribution.md
@@ -0,0 +1,53 @@
+# Native agent package distribution
+
+Compass has one checked-in `distribution.toml` inventory for its Codex, Claude
+Code, and OpenCode packages. `compass agent export` parses and validates that
+inventory, copies the real embedded umbrella and focused skill directories,
+and generates the harness-native manifests and credential-free MCP
+configuration. The same inventory records the exact harness versions used by
+installed-artifact qualification.
+
+## Generated package shapes
+
+| Harness | Native artifacts | Verified version |
+| --- | --- | --- |
+| Codex | `.codex-plugin/plugin.json`, `.agents/plugins/marketplace.json`, `.mcp.json`, `skills/**` | `0.146.0` |
+| Claude Code | `.claude-plugin/plugin.json`, `.claude-plugin/marketplace.json`, `.mcp.json`, `skills/**` | `2.1.251` |
+| OpenCode | `package.json`, `opencode.json`, compiled `src/index.js`, `skills/**` | `1.18.23` |
+
+Every export also contains `manifest.json`, a sorted SHA-256 inventory under
+`compass.agent-bundle/1`. Generation is staged beside the destination,
+validated, and published with one rename. The destination must be absent or
+empty, so export never overwrites user files.
+
+The OpenCode package depends on exactly `@opencode-ai/plugin` 1.18.25. Its
+TypeScript module registers one thin MCP-configuration tool. Run
+`npm run build -w @compass/opencode-plugin` after changing the module. The
+native generator embeds the resulting checked-in `src/index.js`, while
+`npm run typecheck:js` recompiles in memory and fails if that artifact is stale.
+It contains no graph traversal, ranking, persistence, or query logic; all such
+behavior stays in the native `compass` binary.
+
+The umbrella skill digest in `tools/skillgen/mod.rs` is an intentional
+compatibility pin. If that skill changes by design, regenerate its canonical
+LF-normalized SHA-256 digest, review the focused-skill additive contract, and
+update the pin in the same change. Release version bumps likewise update
+`distribution.toml` alongside the workspace package version.
+
+## Ownership and portability
+
+Skills are copied as real files, never symlinked. Validation rejects symlinks,
+parent traversal, absolute or machine-specific paths, likely literal
+credentials, missing native manifests, checksum mismatches, and bundles that
+omit the recorded harness version. Harness installation owns only files copied
+into the harness plugin cache or configuration entry. Qualification places a
+sentinel user instruction beside those managed files and requires it to survive
+install, upgrade, and uninstall.
+
+## Phase-end verification
+
+Package generation and lifecycle evidence is collected only after the whole
+phase implementation is complete. The verification wave runs the full Rust
+integration targets, the installed-artifact harness qualification, and the
+workspace JavaScript typecheck and integration suite. Source templates alone
+are never accepted as lifecycle evidence.
diff --git a/docs/implementation/mcp-conformance-and-interop.md b/docs/implementation/mcp-conformance-and-interop.md
new file mode 100644
index 000000000..2a9749f48
--- /dev/null
+++ b/docs/implementation/mcp-conformance-and-interop.md
@@ -0,0 +1,92 @@
+# MCP conformance and named-client interoperability
+
+This page records the qualification boundary for Compass MCP 2026-07-28, the
+latest published MCP revision at the decision date. It describes current test
+evidence and named-client compatibility without downgrading the server for
+clients that still implement an older revision.
+
+## Reference conformance
+
+HTTP qualification uses `modelcontextprotocol/conformance` at commit
+`74edef34d674f563537be8c6587cebaa58e830ca` with the frozen `2026-07-28`
+requirements. `scripts/qualify_mcp_conformance.sh` builds a strict graph from a
+checked-in source fixture, starts the Compass HTTP server, and runs the named
+stateless, listing, resource-error, DNS-rebinding, and header scenarios. CI runs
+that script with the native stdio integration test
+`protocol_conformance::stdio_conformance_discovers_lists_invokes_reads_and_closes`.
+
+The expected-failure file is check-granular. Its entries cover only reference
+runner diagnostics that require fixture-only tools Compass does not advertise,
+plus a header check whose runner calls the first real Compass tool with invalid
+arguments. Transport, wire-schema, discovery, routing, cache metadata, error
+identity, resource errors, and security failures are not baselined.
+
+## Named-client run on 2026-08-28
+
+All runs used the installed client version, isolated configuration, the local
+Compass binary, and a real `graph_stats` call. A pass required discovery and a
+returned Compass payload; configuration or process startup alone did not count.
+
+| Client | Version | Stdio | HTTP |
+| --- | --- | --- | --- |
+| Codex CLI | `0.150.1` | PASS — `Nodes: 120215` | PASS — `Nodes: 120215` |
+| Claude Code | `2.1.251` | PASS — `Nodes: 120215` | PASS — `Nodes: 120215` |
+| OpenCode | `1.18.25` | PASS — `Nodes: 120215` | INCOMPATIBLE — sends `initialize` for `2025-11-25`, then attempts the removed GET event stream |
+
+Codex stdio and HTTP were exercised without a model through the installed
+app-server's `mcpServerStatus/list` and `mcpServer/tool/call` interfaces using
+`scripts/qualify_codex_mcp_client.py`. Claude Code used `--strict-mcp-config`
+and an allowlist containing only `mcp__compass__graph_stats`. OpenCode used
+`OPENCODE_CONFIG_CONTENT`, `--pure`, and an explicit project path for the tool
+call. No credentials or unsanitized client logs are stored in the repository.
+
+Codex 0.146.0 initially failed the HTTP cell, but the isolated official 0.150.1
+release passed both cells with its `mcp_2026_07_28` feature enabled. The
+OpenCode HTTP failure was reproduced in the installed 1.18.23 build, latest
+stable 1.18.25 build, and the 2026-08-28 dev build. The stable client sent:
+
+```text
+POST /mcp
+User-Agent: opencode/1.18.25
+
+initialize(protocolVersion = "2025-11-25")
+```
+
+It omitted the MCP 2026 request headers, received Compass's typed
+`Unsupported protocol version` response, and fell back to `GET /mcp`, which
+Compass correctly answers with `405 Method Not Allowed`. MCP 2026-07-28 removed
+both `initialize` and the independent GET stream.
+
+## Gate status
+
+On 2026-08-29 the user selected the latest published MCP revision as the
+governing requirement. Both required 2026-07-28 conformance legs pass, so C-010
+may close with the OpenCode HTTP cell recorded as incompatible. Compass does not
+make that cell appear green and does not accept the removed 2025 initialize/GET
+lifecycle on either transport. A future OpenCode release can add a passing
+matrix entry without a
+Compass compatibility mode; a Compass conformance regression or a regression
+in a previously passing cell remains blocking.
+
+## Reproduction
+
+Build Compass and run the deterministic server checks:
+
+```bash
+cargo build -p compass-cli --bin compass --locked
+cargo test -p compass-mcp --test protocol_conformance --locked
+scripts/qualify_mcp_conformance.sh
+```
+
+Run the model-free Codex client harness for either transport:
+
+```bash
+scripts/qualify_codex_mcp_client.py \
+  --codex "$(command -v codex)" \
+  --expected-version 0.150.1 \
+  --compass "$PWD/target/debug/compass" \
+  --graph "$PWD/compass-out/graph.json" \
+  --transport stdio
+```
+
+Replace `stdio` with `http` to reproduce the recorded Codex 0.150.1 HTTP pass.
diff --git a/docs/implementation/surreal-graph-projection.md b/docs/implementation/surreal-graph-projection.md
new file mode 100644
index 000000000..ffa2a930c
--- /dev/null
+++ b/docs/implementation/surreal-graph-projection.md
@@ -0,0 +1,128 @@
+# Optional Surreal graph projection
+
+`compass-graphdb-surreal` is an additive library integration. It projects one
+validated, immutable `compass.graph/1` document into SurrealDB while the normal
+JSON/SQLite realization remains canonical and fully supported. No CLI or MCP
+route selects this adapter yet.
+
+## Dependency and engine boundary
+
+The crate's default feature set includes projection planning but no SurrealDB
+dependency. Three explicit features select embedded engines:
+
+| Feature | Purpose | C-014 evidence |
+| --- | --- | --- |
+| `mem` | Deterministic ephemeral integration qualification | Full schema, round-trip, idempotence, interrupted staging, reactivation, native-query, and scale-differential coverage |
+| `surrealkv` | Persistent embedded SurrealKV | Constructor/SDK compile gate; persistent semantic and recovery evidence is retained by C-012 |
+| `rocksdb` | Persistent embedded RocksDB | Constructor/SDK compile gate; persistent semantic and recovery evidence is retained by C-012 |
+
+All profiles resolve exactly SurrealDB 3.2.4 with default SDK features disabled.
+The repository gate `scripts/check_surreal_feature_isolation.sh` proves that
+`compass-cli`, `compass-mcp`, `compass-core`, and the projection crate without
+an engine feature have no SurrealDB dependency path. Its `--binary` mode also
+builds the default `compass` binary only after proving its complete dependency
+closure contains no SurrealDB package.
+
+## Projection contract
+
+Projection planning validates the source graph before producing records. Every
+record carries repository, generation, and projection-schema identities. Nodes
+retain stable Compass identity, kind, name, language, source, confidence, and
+the exact typed JSON payload. Relations additionally retain stable edge
+identity, source and target, original edge kind, source evidence, confidence,
+and one of five closed relation families.
+
+The families are structural, dependency, execution, data flow, and evidence.
+The exhaustive Rust match over `EdgeKind` makes a new Compass edge kind a
+compile-time integration decision. Callers cannot supply a relation table or a
+SurrealQL statement.
+
+Every engine client owns finite `ProjectionLimits`. The default ceilings are
+1,000,000 nodes, 2,500,000 relations, and the canonical `GraphDocument` reader's
+1 GiB serialized-byte bound (distinct from the store publication cap configured
+by `COMPASS_MAX_GRAPH_BYTES`). These are independent ceilings: the byte limit may
+bind before either count limit for payload-rich graphs. C-015 measures the
+ratified qualification corpora rather than assuming all three ceilings are
+jointly attainable. Activation validates the limits before claiming or writing
+the generation. Reads validate manifest counts and bytes before record queries,
+apply query-side row limits, and compare the returned counts and serialized
+bytes with the immutable manifest before returning a plan. Callers may choose
+smaller positive limits for constrained deployments.
+
+Database record keys are deterministic SHA-256 digests over length-delimited
+schema, record-class, repository, generation, and Compass identity values.
+Compass IDs containing SurrealQL punctuation therefore remain bound data and
+never become query syntax.
+
+## Atomic activation
+
+The runtime defines schemafull node, manifest, pointer, and relation tables.
+Publication keeps the visibility switch atomic without retaining an
+unbounded transaction:
+
+1. atomically claim the generation with an incomplete manifest carrying the
+   expected immutable fingerprint, identities, counts, and byte size;
+2. idempotently stage generation-keyed nodes and typed relations in bounded
+   512-record commits;
+3. read back and compare the exact ordered node and edge identity sets;
+4. mark the immutable generation manifest complete; and
+5. update the repository-scoped active-generation pointer last.
+
+Readers can observe only the pointer-selected complete generation. Any write,
+validation, process, or injected-interruption failure leaves the prior pointer
+unchanged; an incomplete candidate remains invisible and a later identical
+activation safely resumes its idempotent batches. A generation claim with a
+different fingerprint fails before candidate records are changed. This avoids
+SurrealDB Mem retaining a savepoint clone of an ever-growing map while
+preserving coherent generation publication.
+
+An identical complete generation is idempotent: the adapter validates its
+fingerprint and exact record identities, then may reactivate it without
+rewriting records. A generation ID already claimed or completed with different
+content fails explicitly.
+
+## Native structural reads
+
+The feature-gated engine exposes only closed native operations: callers,
+callees, impact, directed node trail, connected structural subgraph, and
+relation pagination. Each operation pins the complete active-generation
+pointer and matching manifest before reading, binds every value parameter,
+uses only static internal SurrealQL statements, and revalidates the pointer
+before publishing the response. A concurrent activation therefore yields
+either one coherent generation or a typed `ActiveGenerationChanged` error.
+
+Structural operations return the shared `compass.query/1` node, edge, path,
+diagnostic, limit, and truncation records. Exact-name lookup uses the same
+normalization contract as the canonical query engine. Direction, parallel
+edges, reverse edges, self-loops, typed details, provenance, confidence, and
+heuristic filtering are decoded from the canonical payload rather than
+reconstructed from database metadata.
+
+Relation pagination is deterministic by Compass edge identity across all five
+closed relation families. Its cursor is size-bounded, checksummed, and bound to
+the repository digest, immutable generation, schema, and operation. A cursor
+cannot select a table, inject a predicate, or be replayed against another
+repository or generation.
+
+## License and distribution
+
+SurrealDB 3.2.4 and its core use Business Source License 1.1 before conversion.
+The accepted artifact-profile decision, exact license digest, Database Service
+restriction, Change Date, Change License, notice requirements, and downstream
+redistribution conditions are recorded in
+[`surrealdb-license-decision.md`](../future/surrealdb-license-decision.md).
+Enabling a Cargo feature contains default-build impact; it does not remove
+license obligations from a Surreal-enabled binary, library, container, or
+archive.
+
+## Phase-end verification
+
+After the entire development phase is implemented, run the Surreal integration
+targets in the single coordinated verification wave:
+
+```bash
+cargo test -p compass-graphdb-surreal --test '*' --features mem --locked
+cargo test -p compass-graphdb-surreal --test '*' --features surrealkv --locked
+cargo test -p compass-graphdb-surreal --test '*' --features rocksdb --locked
+sh scripts/check_surreal_feature_isolation.sh
+```
diff --git a/docs/implementation/workspace-tour.md b/docs/implementation/workspace-tour.md
index fe3adb822..3cf309663 100644
--- a/docs/implementation/workspace-tour.md
+++ b/docs/implementation/workspace-tour.md
@@ -316,6 +316,13 @@ subprocess calls.
 Implements native Neo4j Bolt and FalkorDB RESP clients and graph-to-operation
 mapping.
 
+### `compass-graphdb-surreal`
+
+Owns the optional SurrealDB projection boundary. Its default feature set builds
+only a deterministic projection plan; explicit `mem`, `surrealkv`, or `rocksdb`
+features add the pinned SDK runtime, schemafull relation tables, and atomic
+generation activation. It contains no CLI or MCP presentation logic.
+
 ### `compass-ingest`
 
 Owns bounded, verified URL and audio acquisition, including the managed
diff --git a/docs/reference/commands.md b/docs/reference/commands.md
index a3538b05f..128df5b55 100644
--- a/docs/reference/commands.md
+++ b/docs/reference/commands.md
@@ -407,7 +407,12 @@ compass serve [GRAPH_PATH]
 ```
 
 Prefer stdio for a single local client. Avoid putting secret values directly in
-shell history; use the deployment's supported secret mechanism.
+shell history; use the deployment's supported secret mechanism. HTTP implements
+the stateless MCP 2026-07-28 contract: begin with `server/discover`, then carry
+`Mcp-Protocol-Version`, `Mcp-Method`, and required `_meta` on each request.
+`--stateless` is an accepted compatibility spelling for this default.
+`--session-timeout` is deprecated and ignored with a warning through 0.4.x and
+will be removed in 0.5.0.
 
 ## Export and visualization
 
@@ -519,6 +524,60 @@ workflows.
 
 ## Assistant and hook lifecycle
 
+### `agent`
+
+```text
+compass agent list [--format text|json]
+compass agent install [PLATFORM] [INSTALL OPTIONS]
+compass agent doctor --platform codex|claude|opencode|agents
+  [--project-root PATH | --user-root PATH]
+  [--format text|json]
+compass agent export --platform codex|claude|opencode|agents --out DIR
+  [--transport stdio|http]
+  [--format text|json]
+compass agent validate --path DIR
+  [--platform codex|claude|opencode|agents]
+  [--format text|json]
+compass agent mcp-config --platform codex|claude|opencode|agents
+  [--transport stdio|http]
+```
+
+`list` returns registry order sorted by platform identifier; its JSON schema is
+`compass.agent-list/1`. `install` passes every remaining argument unchanged to
+the established managed installer, so `compass install` remains the
+compatibility entry point with identical output and side effects.
+
+`doctor` is an offline, read-only aggregate check. It verifies the running
+binary version, compiled MCP 2026-07-28 contract, graph presence and manifest
+freshness, all seven managed skill checksums, and the selected platform's MCP
+configuration. It does not launch a server or contact a network service. JSON
+uses `compass.agent-doctor/1`; exit `0` means every check passed, exit `1`
+means at least one check failed, and exit `2` means invalid arguments.
+
+`agent list` enumerates every installable platform. Commands that inspect or
+render MCP configuration accept the four platforms shown above. Project-scoped
+doctor checks honor `COMPASS_OUT` and resolve graph and manifest files through
+the current immutable snapshot. `--user-root <PATH>` inspects the user installation
+and configuration and reports project graph checks as not applicable.
+
+`export` atomically publishes the embedded umbrella and six focused skills,
+platform-native credential-free MCP configuration, native package and
+marketplace manifests generated from `distribution.toml`, the OpenCode
+TypeScript bridge where applicable, and a sorted SHA-256 manifest using
+`compass.agent-bundle/1`. Native manifests record the exact harness version
+used for lifecycle qualification. The destination must be missing or empty.
+`validate` accepts an exported bundle or a checksum-owned managed skill
+directory and never executes its contents. It bounds file count and bytes,
+rejects symlinks, traversal, machine-specific absolute paths, and likely
+literal credentials, requires every native artifact and harness version, and
+reports only file names and rules so secret values are not echoed. Validation
+JSON uses `compass.agent-validation/1`.
+
+`mcp-config` emits Codex `mcp_servers` TOML, Claude `.mcp.json`, OpenCode `mcp`
+JSON, or the versioned generic Agent Skills JSON envelope. Stdio invokes
+`compass serve --transport stdio` as separate arguments; HTTP uses the
+loopback `http://127.0.0.1:8080/mcp` endpoint.
+
 ### `install`
 
 ```text
@@ -533,9 +592,12 @@ compass install
 
 Run `compass install --help` for the version's platform list. `--strict`
 requires a project-scoped Claude target. With no explicit platform, Compass
-detects agents and also installs the portable Agent Skills package. Dry-run
-output includes the complete skill and adapter path plan and performs read-only
-preflight checks.
+detects agents and installs the canonical `compass` Agent Skill plus focused
+`compass-navigate`, `compass-debug`, `compass-change-impact`,
+`compass-architecture`, `compass-index-maintenance`, and `compass-mcp-setup`
+sibling trees. Dry-run output includes every skill and adapter path and performs
+read-only preflight checks. Equivalent managed trees are current; unowned or
+checksum-modified skill directories are never overwritten.
 
 ### `uninstall`
 
@@ -783,6 +845,15 @@ CompassQL:
 Other command families preserve documented compatibility-specific codes. Test
 the exact command boundary your automation uses.
 
+Agent namespace:
+
+- successful list, install, export, validation, configuration, or wholly
+  healthy doctor result: exit `0`;
+- failed doctor check, unsafe/invalid bundle, checksum mismatch, or export
+  publication failure: exit `1`;
+- invalid subcommand, option, platform, transport, format, or missing required
+  argument: exit `2`.
+
 ## Related pages
 
 - [Configuration reference](configuration.md)
diff --git a/docs/reference/compatibility.md b/docs/reference/compatibility.md
index c4615e74a..984692ea9 100644
--- a/docs/reference/compatibility.md
+++ b/docs/reference/compatibility.md
@@ -20,6 +20,19 @@ The supported identity is:
 There is no alternate legacy frontend or alias. Legacy names and stores are
 not read as fallback inputs.
 
+Both stdio and Streamable HTTP use only MCP 2026-07-28 and reject older
+revisions. HTTP is stateless and has no MCP-2025 session fallback. See the root
+compatibility and migration documents for the `--session-timeout` 0.4.x
+deprecation and 0.5.0 removal schedule.
+
+The four core navigation tools return `compass.code_context.v1` structured
+content and advertise matching output schemas. Their former
+`compass.query/1` response is preserved under `data`; clients that consumed the
+old top-level shape must follow the root migration guide. MCP `resultType` is
+the separate protocol discriminator. Remaining text-only results are marked
+deprecated from 0.4.0 in discovery but remain callable; removal is not
+scheduled before typed replacements ship.
+
 ## Native evidence
 
 Changes are checked by native unit, integration, CLI, protocol, format,
diff --git a/docs/reference/configuration.md b/docs/reference/configuration.md
index 115642d75..a4f3a5715 100644
--- a/docs/reference/configuration.md
+++ b/docs/reference/configuration.md
@@ -112,6 +112,20 @@ applied as built-in safety skips, Git ignores, configured includes, configured
 excludes, then command-line exclusions. Invalid configuration stops the build
 instead of silently widening its scope.
 
+`vendor/` is deliberately not a built-in skip. Vendored directories can contain
+real Go source and can also be explicit workspace members, as Compass's vendored
+parser pack is. A language-neutral discovery layer cannot infer that this source
+is disposable from the directory name alone. Repositories that do not want
+vendored source in a graph should exclude it explicitly and reviewably:
+
+```bash
+compass init . --exclude 'vendor/**' --yes
+```
+
+The same pattern may be placed in `.compassignore`. Keeping this opt-out explicit
+preserves existing discovery behavior and applies consistently to builds and
+filesystem watching.
+
 Common explicit options:
 
 | Concern | Options |
@@ -311,7 +325,10 @@ The current service surface includes:
 ```
 
 Avoid literal API keys in command history. Bind to loopback for local use and
-use stdio when one local client is sufficient.
+use stdio when one local client is sufficient. HTTP is always stateless MCP
+2026-07-28 and does not use `Mcp-Session-Id`; `--stateless` remains accepted for
+script compatibility. `--session-timeout` is deprecated, validated and ignored
+with a warning through 0.4.x, and is removed in 0.5.0.
 
 ## Graph database configuration
 
diff --git a/openspec/changes/archive/2026-08-28-actionable-snapshot-limit-error/.openspec.yaml b/openspec/changes/archive/2026-08-28-actionable-snapshot-limit-error/.openspec.yaml
new file mode 100644
index 000000000..7f2cf9bc0
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-actionable-snapshot-limit-error/.openspec.yaml
@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-08-28
diff --git a/openspec/changes/archive/2026-08-28-actionable-snapshot-limit-error/design.md b/openspec/changes/archive/2026-08-28-actionable-snapshot-limit-error/design.md
new file mode 100644
index 000000000..5f0635cee
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-actionable-snapshot-limit-error/design.md
@@ -0,0 +1,52 @@
+# Design: actionable snapshot publication limit error
+
+## Ownership
+
+`compass-graph` owns the snapshot limit classification and remediation text.
+`compass-cli` continues its thin presentation behavior by prefixing the domain
+error with `error:` and returning runtime exit code 1.
+
+## Error contract
+
+An empty manifest byte count remains corruption. A count above
+`MAX_GRAPH_BYTES` becomes `SnapshotError::Limit` with this stable actionable
+suffix:
+
+`retry or rebuild with a smaller scope using --exclude <pattern> or persistent patterns in .compassignore`
+
+The rebuild wording is deliberate: the same typed manifest validation runs
+during publication and while opening an immutable snapshot. A publication can
+retry immediately; a reader can regenerate the snapshot from a narrower source
+scope. Both contexts therefore receive an accurate recovery action.
+
+## Variant and call-site audit
+
+The `SnapshotError` variant audit found no production consumer that branches on
+`Corrupt` versus `Limit`. `compass-core` converts the complete error through its
+typed `Snapshot` wrapper, while `compass-query` maps every snapshot error to the
+same `CorruptArtifact` query category and preserves the domain text. The only
+variant-specific matches outside the owning module are assertions in
+`compass-graph` tests. Reclassification therefore changes the public domain
+category intentionally without altering fallback, quarantine, or cleanup flow.
+
+The bounded serializer helper is named `digest_canonical_graph_json` and is
+called only by canonical graph identity generation (plus its focused unit test),
+so graph-scope remediation cannot leak into selector, delta, or tree encoding.
+
+The message deliberately omits `COMPASS_MAX_GRAPH_BYTES`; C-004 owns adding it
+only after the publication path honors the override.
+
+## CLI evidence
+
+The integration test first creates a valid SQLite-backed graph through the
+released binary, then replaces only the active immutable manifest/selector
+with a digest-consistent manifest whose byte count exceeds the cap. A second
+binary invocation forces the store query engine, reaches native manifest
+validation without allocating a large fixture, and asserts stderr plus exit 1.
+The fixture uses only a local temporary SQLite database and preserves the
+normal digest/selector trust chain so it exercises the intended limit branch.
+
+## Compatibility and rollback
+
+No migration action is required. Reverting the domain message and its test
+restores prior behavior without touching persisted data.
diff --git a/openspec/changes/archive/2026-08-28-actionable-snapshot-limit-error/files.txt b/openspec/changes/archive/2026-08-28-actionable-snapshot-limit-error/files.txt
new file mode 100644
index 000000000..a9af12ec6
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-actionable-snapshot-limit-error/files.txt
@@ -0,0 +1,4 @@
+crates/compass-graph/src/lib.rs
+crates/compass-graph/src/snapshot.rs
+crates/compass-cli/tests/snapshot_limit_cli.rs
+CHANGELOG.md
diff --git a/openspec/changes/archive/2026-08-28-actionable-snapshot-limit-error/proposal.md b/openspec/changes/archive/2026-08-28-actionable-snapshot-limit-error/proposal.md
new file mode 100644
index 000000000..980f28b52
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-actionable-snapshot-limit-error/proposal.md
@@ -0,0 +1,21 @@
+# Proposal: actionable snapshot publication limit error
+
+## Why
+
+When canonical graph publication exceeds the fixed 2 GiB snapshot limit,
+Compass currently reports the bound but gives no recovery action after an
+expensive build. Existing scoping controls already provide the safe remedy.
+
+## What Changes
+
+- Classify an oversized canonical graph as a snapshot limit failure.
+- Name `--exclude <pattern>` and `.compassignore` as concrete recovery paths.
+- Preserve the default limit and do not advertise `COMPASS_MAX_GRAPH_BYTES`
+  until C-004 makes that override effective on this publication path.
+- Add a binary-level CLI regression for rendered stderr and exit status.
+
+## Compatibility
+
+This intentionally extends public human-readable error text and corrects the
+error category from corruption to a resource-limit failure. No command syntax,
+serialized format, success output, or exit-code convention changes.
diff --git a/openspec/changes/archive/2026-08-28-actionable-snapshot-limit-error/specs/snapshot-publication-errors/spec.md b/openspec/changes/archive/2026-08-28-actionable-snapshot-limit-error/specs/snapshot-publication-errors/spec.md
new file mode 100644
index 000000000..7d0c159bd
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-actionable-snapshot-limit-error/specs/snapshot-publication-errors/spec.md
@@ -0,0 +1,31 @@
+## Purpose
+
+Make canonical graph snapshot limit failures recoverable through existing
+scope controls while preserving bounded publication behavior.
+
+## ADDED Requirements
+
+### Requirement: Oversized canonical graphs report a resource limit
+
+Compass SHALL reject a canonical graph whose encoded size exceeds the active
+snapshot publication limit as a typed snapshot limit failure, distinct from an
+empty or corrupt snapshot.
+
+#### Scenario: Canonical graph exceeds the default limit
+- **WHEN** snapshot validation observes `graph_bytes` above `MAX_GRAPH_BYTES`
+- **THEN** it returns `SnapshotError::Limit` and does not publish the manifest
+
+#### Scenario: Canonical graph byte count is empty
+- **WHEN** snapshot validation observes a zero `graph_bytes` value
+- **THEN** it returns a corruption failure rather than a limit failure
+
+### Requirement: Limit remediation names shipped scope controls
+
+The oversized-graph failure SHALL name `--exclude <pattern>` and
+`.compassignore` as concrete recovery actions and SHALL NOT advertise an
+override that the snapshot publication path does not yet honor.
+
+#### Scenario: CLI renders the oversized-graph failure
+- **WHEN** a CLI operation encounters the oversized canonical graph manifest
+- **THEN** stderr names both scope controls and the process exits with code 1
+- **AND** the message does not name `COMPASS_MAX_GRAPH_BYTES`
diff --git a/openspec/changes/archive/2026-08-28-actionable-snapshot-limit-error/tasks.md b/openspec/changes/archive/2026-08-28-actionable-snapshot-limit-error/tasks.md
new file mode 100644
index 000000000..4c0f20a75
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-actionable-snapshot-limit-error/tasks.md
@@ -0,0 +1,15 @@
+## 1. Contract
+
+- [x] 1.1 Define and strictly validate the limit classification, remediation text, and compatibility boundary
+
+## 2. Domain implementation
+
+- [x] 2.1 Implement the actionable `compass-graph` limit error and focused empty/oversized manifest tests
+
+## 3. CLI contract
+
+- [x] 3.1 Add a binary-level CLI regression that asserts rendered remediation text, absent unshipped override, and exit code 1
+
+## 4. Verification
+
+- [x] 4.1 Run focused tests, public CLI/product gates, the Rust workspace baseline, QA/refinement, adversarial diff review, graph refresh, verification, and archive
diff --git a/openspec/changes/archive/2026-08-28-actionable-snapshot-limit-error/verification.md b/openspec/changes/archive/2026-08-28-actionable-snapshot-limit-error/verification.md
new file mode 100644
index 000000000..f35f9c813
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-actionable-snapshot-limit-error/verification.md
@@ -0,0 +1,47 @@
+# Verification: actionable snapshot publication limit error
+
+## Result
+
+PASS. All requirements and scenarios are implemented with direct unit and
+binary-level evidence. No migration is required.
+
+## Requirement evidence
+
+- Oversized canonical manifests return `SnapshotError::Limit`; zero-byte
+  manifests remain `SnapshotError::Corrupt`.
+- The complete stable remediation names `--exclude <pattern>` and
+  `.compassignore`, omits `COMPASS_MAX_GRAPH_BYTES`, and is pinned verbatim in a
+  `compass-graph` unit test.
+- The released `compass` binary opens a digest-consistent oversized immutable
+  snapshot through the store engine, writes no stdout, renders both remediation
+  controls on stderr, and exits with code 1.
+- The CLI fixture uses graph-owned snapshot layout helpers and the
+  backend-neutral `Store` contract; it does not depend on raw SQLite schema.
+- A repository-wide `SnapshotError` audit found no production consumer that
+  branches on `Corrupt` versus `Limit`; the intentional reclassification does
+  not change fallback, quarantine, or cleanup flow.
+
+## Verification performed
+
+- `cargo fmt --all -- --check`
+- focused `compass-graph` limit test
+- `cargo test -p compass-cli --test snapshot_limit_cli --locked`
+- affected-crate all-target/all-feature Clippy with `-D warnings`
+- `cargo test -p compass-cli --test compass_product --locked`
+- `sh scripts/check_product_boundary.sh`
+- `cargo clippy --workspace --lib --bins --locked -- -D warnings`
+- `cargo test --workspace --lib --bins --locked`
+- `./scripts/qualify_code_graph_v1.sh --fixtures-only`
+- `openspec validate actionable-snapshot-limit-error --strict`
+- `compass update .`
+- deterministic artifact-refiner fallback and independent adversarial diff
+  review: PASS (0 critical, 2 warnings, 1 suggestion); all findings resolved
+
+The broader `cargo test -p compass-graph --locked` command also reached and
+passed the changed unit test, then reproduced an unrelated existing failure in
+`tests/import_alias_identity.rs` involving a direct-evidence source anchor. The
+mandated workspace lib/bin baseline and every C-002-specific/public gate pass.
+
+An optional judge confirmation after resolving the PASS review's final findings
+produced no response on its initial call or single allowed retry, so no
+confirmation verdict is claimed.
diff --git a/openspec/changes/archive/2026-08-28-compass-agent-cli/.openspec.yaml b/openspec/changes/archive/2026-08-28-compass-agent-cli/.openspec.yaml
new file mode 100644
index 000000000..7f2cf9bc0
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-compass-agent-cli/.openspec.yaml
@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-08-28
diff --git a/openspec/changes/archive/2026-08-28-compass-agent-cli/design.md b/openspec/changes/archive/2026-08-28-compass-agent-cli/design.md
new file mode 100644
index 000000000..cda89c611
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-compass-agent-cli/design.md
@@ -0,0 +1,77 @@
+## Context
+
+See `proposal.md` for motivation and `specs/agent-cli/spec.md` for the observable contract. Compass already owns an embedded, manifest-backed seven-skill collection and a registry-driven managed installer in `compass-cli`. The new namespace must compose those primitives rather than create a second installer. Public CLI behavior is compatibility-sensitive, while filesystem content and configuration are untrusted and must remain bounded.
+
+Current platform MCP configuration differs materially: Codex uses `mcp_servers` TOML; Claude uses an `.mcp.json` `mcpServers` wrapper; OpenCode uses a top-level `mcp` object with local command arrays or remote URLs. The generic `agents` platform has no vendor-owned configuration file, so Compass must identify its own schema.
+
+## Goals / Non-Goals
+
+**Goals:**
+
+- Keep command dispatch and presentation in `compass-cli`, reusing installer registry, embedded assets, manifests, atomic writes, graph manifests, and MCP protocol constants.
+- Make all enumeration, diagnostics, export, and validation deterministic and bounded.
+- Give text and machine consumers stable exit semantics and versioned JSON where output is contractual.
+- Validate portable content without executing it or disclosing a detected secret.
+
+**Non-Goals:**
+
+- Generate the full cross-harness packages, plugin manifests, or installation scripts owned by C-018.
+- Contact remote services, launch a server, repair an installation, or mutate configuration during `list`, `doctor`, `validate`, or `mcp-config`.
+- Change the MCP wire protocol, graph schema, installer destination rules, or existing `compass install` contract.
+
+## Decisions
+
+### Add a thin sibling command module
+
+Add `agent_commands` beside `install_commands` and route only the `agent` top-level token to it. `agent install` passes its remaining argument slice directly to the existing installer. Narrow `pub(crate)` helpers expose immutable registry inventory, embedded asset bytes, install destinations, and manifest verification; registry ownership stays in `install_commands`.
+
+This avoids duplicating parsing and rollback logic. Exposing registry internals wholesale was rejected because it would blur the installer ownership boundary.
+
+### Use explicit versioned output contracts
+
+JSON inventory, doctor results, export manifests, validation results, and the generic MCP configuration use explicit `compass.* /1` schema identifiers (without the separating space in serialized values). Collections and findings are sorted before rendering. Text output is derived from the same typed records.
+
+Versioned records make future additions distinguishable. Unversioned ad hoc JSON was rejected because downstream consumers could not detect incompatible changes.
+
+### Export the current collection as an atomic portable bundle
+
+Export writes a sibling staging directory, creates `skills/<skill>/...`, the platform MCP configuration, and a sorted SHA-256 manifest, validates the staged result, then renames it into place. A non-empty destination is an error; an existing empty directory is removed only immediately before the same-filesystem rename and restored on failure when possible. Staging is cleaned after any error.
+
+The bundle deliberately stops at the seven embedded skills and one MCP config. Generating platform plugin packages here was rejected because C-018 owns that surface.
+
+### Reuse graph manifests for freshness
+
+Doctor resolves the project root and configured `COMPASS_OUT` container, resolves `graph.json` and `manifest.json` through the current immutable snapshot, runs bounded repository detection, and asks the existing manifest implementation whether the source set is unchanged. Presence and freshness are separate checks so missing, corrupt, and stale graphs remain distinguishable. User-scoped diagnostics mark project graph checks not applicable instead of interpreting the user configuration root as a project.
+
+Modification-time comparison was rejected because it is unreliable across copied files, clock changes, and equivalent content.
+
+### Diagnose independently and aggregate failures
+
+Doctor executes every bounded local check and returns a sorted result record instead of stopping at the first failure. Binary version and the compiled MCP protocol constant are intrinsic checks. Skill checks use the managed install manifest and exact file checksums. MCP configuration checks resolve the registry-owned platform path and validate shape/content without parsing credentials into output.
+
+Live server discovery was rejected for this command because it would add process and network side effects; configuration discovery plus the compiled protocol contract provides a deterministic offline health check.
+
+### Validate with containment, bounds, and redaction
+
+Validation refuses symlinks, limits file count, per-file bytes, and aggregate bytes, canonicalizes the root, and ensures every visited path remains below it. It verifies the bundle schema, exact seven-skill inventory, sorted manifest entries, SHA-256 checksums, and platform config shape. Text scanning detects Unix roots, drive/UNC paths, and `file://` URLs only at token boundaries. Credential detection recognizes sensitive key names paired with non-placeholder literal values; findings name the file and rule, never the value.
+
+Scanning every arbitrary token as a path or secret was rejected because it would misclassify HTTPS URLs and documentation prose.
+
+### Render vendor-native MCP schemas directly
+
+Configuration rendering is a pure function over platform and transport. Stdio uses an executable plus separate argument elements for `compass serve --transport stdio`; HTTP uses `http://127.0.0.1:8080/mcp`. Codex output is deterministic TOML. Claude and OpenCode output are pretty JSON with sorted object construction. Generic agents output uses a Compass-owned versioned JSON envelope.
+
+A single nominally portable schema was rejected because current hosts consume different keys and command representations.
+
+## Risks / Trade-offs
+
+- [Doctor repository detection may be noticeable on very large projects] → Reuse the repository's existing bounded discovery and manifest comparison, and report limit failures rather than treating them as freshness.
+- [Credential heuristics can produce false positives or miss novel secret names] → Restrict detection to explicit sensitive key/value shapes, redact values, and keep manifest checksum validation authoritative.
+- [Atomic directory replacement differs across platforms] → Stage beside the destination, refuse non-empty destinations, use existing atomic file primitives inside the stage, and test cleanup and rollback behavior.
+- [Vendor MCP schemas can evolve] → Isolate rendering functions, version Compass-owned schemas, and cover exact current shapes with contract tests and documentation.
+
+## Migration Plan
+
+1. Ship `compass agent` as an additive namespace while retaining the legacy installer route.
+2. Document both install spellings and identify `compass install` as the compatibility entry point.
+3. If rollback is required, remove the new route and help pages; no graph, storage, or installed-file migration is needed because installation continues to use the existing managed manifest format.
diff --git a/openspec/changes/archive/2026-08-28-compass-agent-cli/files.txt b/openspec/changes/archive/2026-08-28-compass-agent-cli/files.txt
new file mode 100644
index 000000000..238384c19
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-compass-agent-cli/files.txt
@@ -0,0 +1,6 @@
+crates/compass-cli/assets/compass-skill/references/command-reference.md
+crates/compass-cli/assets/compass-skill/references/hooks.md
+crates/compass-cli/src/agent_commands.rs
+crates/compass-cli/src/help.rs
+crates/compass-cli/tests/agent_cli.rs
+docs/guides/integrating-compass.md
diff --git a/openspec/changes/archive/2026-08-28-compass-agent-cli/proposal.md b/openspec/changes/archive/2026-08-28-compass-agent-cli/proposal.md
new file mode 100644
index 000000000..dcc7bbffa
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-compass-agent-cli/proposal.md
@@ -0,0 +1,26 @@
+## Why
+
+Compass can install agent guidance, but discovery, health checks, portable export, validation, and MCP setup are scattered or implicit. A cohesive `compass agent` namespace makes those operations scriptable while preserving the established `compass install` contract.
+
+## What Changes
+
+- Add public `compass agent list|install|doctor|export|validate|mcp-config` subcommands with native help, stable exit behavior, and text or JSON results where applicable.
+- Make `compass agent install` delegate to the existing managed installer while retaining `compass install` byte-for-byte as the compatibility entry point.
+- Add deterministic export and validation for the embedded seven-skill collection without introducing the cross-harness package generators owned by C-018.
+- Add bounded health checks for the running binary, graph availability and freshness, MCP protocol/configuration, and installed skill checksums.
+- Reject exported or installed agent content containing unsafe absolute paths or likely literal credentials.
+- Document the new namespace and its compatibility boundary.
+
+## Capabilities
+
+### New Capabilities
+
+- `agent-cli`: Defines agent inventory, managed-install aliasing, diagnostics, deterministic skill export, package validation, and MCP configuration rendering.
+
+### Modified Capabilities
+
+None.
+
+## Impact
+
+The change affects public CLI parsing/help/output, the `compass-cli` installer registry and embedded assets, CLI contract tests, command reference documentation, compatibility notes, and the changelog. It adds no dependency, graph schema, MCP wire-protocol, or generated harness-package change.
diff --git a/openspec/changes/archive/2026-08-28-compass-agent-cli/specs/agent-cli/spec.md b/openspec/changes/archive/2026-08-28-compass-agent-cli/specs/agent-cli/spec.md
new file mode 100644
index 000000000..6f4d9049a
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-compass-agent-cli/specs/agent-cli/spec.md
@@ -0,0 +1,95 @@
+## Purpose
+
+Defines a stable, bounded command-line contract for discovering, installing, diagnosing, exporting, validating, and configuring Compass agent integrations.
+
+## ADDED Requirements
+
+### Requirement: Agent namespace and inventory
+Compass SHALL expose exactly the public subcommands `agent list`, `agent install`, `agent doctor`, `agent export`, `agent validate`, and `agent mcp-config`, and SHALL provide nested help for each subcommand. `agent list` SHALL report the supported agent platforms in deterministic identifier order without changing files.
+
+#### Scenario: List agents as text
+- **WHEN** a user runs `compass agent list`
+- **THEN** the command exits successfully and emits one deterministic inventory row per supported platform
+
+#### Scenario: List agents as JSON
+- **WHEN** a user runs `compass agent list --format json`
+- **THEN** the command exits successfully and emits a versioned JSON object whose agents are sorted by platform identifier
+
+#### Scenario: Reject an unknown agent subcommand
+- **WHEN** a user runs `compass agent` with an unknown subcommand
+- **THEN** the command exits with usage status 2 and identifies the invalid subcommand
+
+### Requirement: Managed install compatibility
+`compass agent install` SHALL delegate to the existing managed installer with the remaining arguments unchanged. The established `compass install` entry point SHALL remain available and SHALL retain byte-identical output, side effects, and exit behavior for equivalent arguments.
+
+#### Scenario: Install through the namespace
+- **WHEN** a user invokes `compass agent install` with valid installer arguments
+- **THEN** the command produces the same files, output bytes, and exit status as `compass install` with those arguments
+
+#### Scenario: Preserve legacy install failures
+- **WHEN** equivalent invalid arguments are supplied to `compass agent install` and `compass install`
+- **THEN** both commands produce the same error bytes and exit status
+
+### Requirement: Bounded agent diagnostics
+`compass agent doctor` SHALL report deterministic checks for the Compass binary version, MCP protocol compatibility, graph presence and freshness, installed seven-skill collection checksums, and platform MCP configuration. It SHALL bound filesystem discovery and SHALL not contact a network service or start an MCP server. The command SHALL exit 0 only when every required check passes, 1 when one or more checks fail, and 2 for invalid arguments.
+
+#### Scenario: Healthy agent environment
+- **WHEN** doctor inspects a selected platform whose graph, managed skills, protocol, and MCP configuration are current and valid
+- **THEN** every check is reported as passing and the command exits 0
+
+#### Scenario: Stale graph
+- **WHEN** doctor inspects a graph whose manifest no longer matches the project source set
+- **THEN** the graph-freshness check fails explicitly and the command exits 1
+
+#### Scenario: Bad installed skill checksum
+- **WHEN** doctor inspects a managed skill whose bytes no longer match its install manifest
+- **THEN** the skill-checksum check fails explicitly and the command exits 1
+
+#### Scenario: Inspect a user-scoped integration
+- **WHEN** doctor is given a user configuration root instead of a project root
+- **THEN** project graph checks are reported as not applicable and health is determined by the remaining user-scoped checks
+
+### Requirement: Deterministic portable export
+`compass agent export --platform <platform> --out <directory>` SHALL export the embedded seven-skill collection, a versioned manifest with sorted file checksums, and a credential-free platform-native MCP configuration. Equivalent inputs SHALL produce byte-identical file contents and manifest ordering. Export SHALL refuse to replace a non-empty destination and SHALL publish the complete output set atomically.
+
+#### Scenario: Export an agent bundle
+- **WHEN** a user exports a supported platform to a missing or empty destination
+- **THEN** the destination contains all seven skills, the native MCP configuration, and a manifest whose paths and checksums are deterministically ordered
+
+#### Scenario: Protect an existing destination
+- **WHEN** a user exports to a non-empty destination
+- **THEN** the command fails without modifying any existing destination entry
+
+### Requirement: Safe bundle validation
+`compass agent validate` SHALL validate a bounded bundle or managed installation without executing its content. Validation SHALL verify the versioned manifest, supported transport, the complete seven-skill inventory, file checksums, path containment, and platform configuration shape. It SHALL reject symlinks, unresolved or machine-specific absolute paths, file URLs, and likely literal credential values while allowing ordinary web URLs. Validation failures SHALL be deterministic and exit 1; invalid invocation SHALL exit 2.
+
+#### Scenario: Validate a portable bundle
+- **WHEN** a user validates an unmodified bundle produced by `agent export`
+- **THEN** validation succeeds without changing the bundle
+
+#### Scenario: Reject an absolute path
+- **WHEN** a validated text file contains a Unix absolute path, a Windows absolute path, or a file URL
+- **THEN** validation reports the affected relative file and exits 1
+
+#### Scenario: Reject a credential string
+- **WHEN** a validated configuration contains a likely literal secret value
+- **THEN** validation reports the affected relative file without echoing the secret and exits 1
+
+#### Scenario: Allow a web URL
+- **WHEN** a validated configuration contains an ordinary HTTPS endpoint and no unsafe value
+- **THEN** the URL is not classified as a Windows absolute path or a credential
+
+### Requirement: Native MCP configuration rendering
+`compass agent mcp-config` SHALL render deterministic, credential-free MCP configuration for `codex`, `claude`, `opencode`, and `agents` platforms using either `stdio` or `http` transport. Codex output SHALL use its `mcp_servers` TOML shape, Claude output SHALL use the `.mcp.json` `mcpServers` shape, OpenCode output SHALL use its `mcp` local or remote shape, and the generic agents output SHALL use a versioned JSON envelope. Stdio configuration SHALL invoke Compass with separate arguments; HTTP configuration SHALL use a loopback URL.
+
+#### Scenario: Render stdio configuration
+- **WHEN** a user requests stdio MCP configuration for a supported platform
+- **THEN** the output uses that platform's native schema and launches `compass serve --transport stdio` without credentials
+
+#### Scenario: Render HTTP configuration
+- **WHEN** a user requests HTTP MCP configuration for a supported platform
+- **THEN** the output uses that platform's native schema and the loopback MCP endpoint without credentials
+
+#### Scenario: Reject unsupported configuration values
+- **WHEN** a user requests an unsupported platform or transport
+- **THEN** the command exits with usage status 2 and identifies the invalid value
diff --git a/openspec/changes/archive/2026-08-28-compass-agent-cli/tasks.md b/openspec/changes/archive/2026-08-28-compass-agent-cli/tasks.md
new file mode 100644
index 000000000..6eb9e05d5
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-compass-agent-cli/tasks.md
@@ -0,0 +1,22 @@
+## 1. Namespace and Contracts
+
+- [x] 1.1 Add `agent` routing and nested help for all six public subcommands; verify CLI help and invalid-subcommand contract tests pass
+- [x] 1.2 Add deterministic typed agent inventory and MCP configuration rendering; verify text, versioned JSON, Codex TOML, Claude JSON, OpenCode JSON, and generic JSON snapshots
+- [x] 1.3 Delegate `agent install` to the managed installer without translating arguments; verify success and failure bytes, side effects, and exit codes match legacy `compass install`
+
+## 2. Portable Bundle Operations
+
+- [x] 2.1 Expose narrow immutable installer helpers for registry metadata, embedded seven-skill assets, managed destinations, and checksum verification; verify installer tests preserve registry and manifest behavior
+- [x] 2.2 Implement same-filesystem staged export with deterministic checksums and cleanup; verify repeat exports are byte-identical and non-empty destinations remain untouched
+- [x] 2.3 Implement bounded, non-executing bundle validation with containment, symlink, checksum, absolute-path, and redacted credential checks; verify valid HTTPS URLs pass while unsafe fixtures fail deterministically
+
+## 3. Diagnostics and Public Evidence
+
+- [x] 3.1 Implement offline aggregate doctor checks for binary version, MCP protocol, graph presence/freshness, installed skill checksums, and platform configuration; verify healthy, stale-graph, bad-checksum, and missing-config cases and exit statuses
+- [x] 3.2 Add public CLI integration tests for all six subcommands, JSON schemas, deterministic ordering, invalid arguments, and compatibility behavior; verify the focused `compass-cli` test targets pass
+- [x] 3.3 Update command/reference documentation, compatibility notes, and changelog; verify documented commands and schema identifiers match CLI help and fixtures
+
+## 4. Qualification and Completion
+
+- [x] 4.1 Run formatting, focused tests, all-target/all-feature `compass-cli` Clippy, product-boundary checks, strict OpenSpec validation, and relevant workspace baselines; record exact results
+- [x] 4.2 Refresh the Compass graph, perform artifact refinement and mandatory adversarial review, resolve all blocking findings, synchronize the capability spec, and archive the verified OpenSpec change
diff --git a/openspec/changes/archive/2026-08-28-compass-agent-cli/verification.md b/openspec/changes/archive/2026-08-28-compass-agent-cli/verification.md
new file mode 100644
index 000000000..6f5ed3661
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-compass-agent-cli/verification.md
@@ -0,0 +1,59 @@
+# Verification: Compass agent CLI namespace
+
+## Result
+
+PASS for the additive `compass agent` namespace and its bounded offline bundle
+and diagnostic contracts. All implementation, qualification, graph-refresh,
+artifact-refinement, and adversarial-review gates are complete.
+
+## Requirement evidence
+
+- The released binary routes exactly six nested commands and publishes nested
+  help plus deterministic text and versioned JSON inventory.
+- `compass agent install` passes its remaining arguments directly to the
+  managed installer. Integration coverage compares successful and failing exit
+  codes, stdout, stderr, and complete installed trees; manifest roots are
+  normalized while every other manifest field and checksum remains compared.
+- Export stages beside the destination, validates before rename, preserves an
+  existing empty destination's permissions, refuses non-empty destinations, and
+  emits deterministic `compass.agent-bundle/1` manifests.
+- Validation is non-executing and globally bounded. It verifies manifest schema,
+  transport, seven-skill inventory, checksums, path containment, symlink policy,
+  portable paths, redacted credential heuristics, and exact Compass stdio or
+  loopback MCP entries.
+- Doctor is offline, honors `COMPASS_OUT` and immutable snapshots, reports user
+  graph checks as not applicable, verifies the MCP transport's exported protocol
+  constant, validates exact current managed-skill bytes, and checks native MCP
+  configuration.
+
+## Verification performed
+
+- `cargo fmt --all -- --check`: passed.
+- `cargo test -p compass-cli agent_commands --locked`: 20 passed.
+- `cargo test -p compass-cli --test agent_cli --locked`: 4 passed.
+- `cargo test -p compass-cli --test install_cli --locked`: 25 passed.
+- `cargo clippy -p compass-cli --all-targets --all-features --locked -- -D
+  warnings`: passed.
+- `cargo test -p compass-cli --test compass_product --locked`: 7 passed.
+- `sh scripts/check_product_boundary.sh`: passed.
+- `cargo clippy --workspace --lib --bins --locked -- -D warnings`: passed after
+  the final adversarial refinements.
+- `cargo test --workspace --lib --bins --locked`: passed after the final
+  adversarial refinements.
+- `openspec validate compass-agent-cli --strict`: passed.
+- `git diff --check`: passed.
+- `compass update .`: passed; indexed 713 files into 121,261 nodes, 285,681
+  edges, and 3,389 communities, with 68 explicitly omitted edges and zero
+  identity collisions.
+- Deterministic artifact-refiner fallback completed because the installed skill
+  package lacks its canonical controllers and schema assets.
+- Isolated K3 adversarial diff review: PASS (0 critical, 2 warnings, 3
+  suggestions). Every remaining non-blocking finding was subsequently resolved
+  in the implementation and regression tests.
+
+## Compatibility and security
+
+The namespace is additive; `compass install` remains unchanged, so no C-017
+migration step is required. `CHANGELOG.md`, `COMPATIBILITY.md`, command docs,
+integration guidance, embedded skill references, and `SECURITY.md` describe the
+new public, portability, credential-redaction, and loopback boundaries.
diff --git a/openspec/changes/archive/2026-08-28-extract-compass-partition/.openspec.yaml b/openspec/changes/archive/2026-08-28-extract-compass-partition/.openspec.yaml
new file mode 100644
index 000000000..7f2cf9bc0
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-extract-compass-partition/.openspec.yaml
@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-08-28
diff --git a/openspec/changes/archive/2026-08-28-extract-compass-partition/design.md b/openspec/changes/archive/2026-08-28-extract-compass-partition/design.md
new file mode 100644
index 000000000..3a124e032
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-extract-compass-partition/design.md
@@ -0,0 +1,10 @@
+# Design: storage-neutral graph partitions
+
+`compass-partition` owns only the partition container and deterministic encodings.
+It deliberately does not depend on Prolly, Compass IR, or Compass analysis. Its
+small segment encoder implements Prolly's existing escaped-zero format locally,
+with golden tests pinning compatibility.
+
+`compass-history` retains partition construction, persistence, completion evidence,
+and program analysis. A thin canonical adapter converts `PartitionError` into
+`HistoryError`; key functions and the container remain source-compatible re-exports.
diff --git a/openspec/changes/archive/2026-08-28-extract-compass-partition/files.txt b/openspec/changes/archive/2026-08-28-extract-compass-partition/files.txt
new file mode 100644
index 000000000..2d9c7afe2
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-extract-compass-partition/files.txt
@@ -0,0 +1,16 @@
+Cargo.toml
+Cargo.lock
+CHANGELOG.md
+crates/compass-partition/Cargo.toml
+crates/compass-partition/src/lib.rs
+crates/compass-history/Cargo.toml
+crates/compass-history/src/artifacts.rs
+crates/compass-history/src/canonical.rs
+crates/compass-history/src/error.rs
+crates/compass-history/src/keys.rs
+openspec/changes/extract-compass-partition/.openspec.yaml
+openspec/changes/extract-compass-partition/proposal.md
+openspec/changes/extract-compass-partition/design.md
+openspec/changes/extract-compass-partition/specs/partition-contract/spec.md
+openspec/changes/extract-compass-partition/tasks.md
+openspec/changes/extract-compass-partition/verification.md
diff --git a/openspec/changes/archive/2026-08-28-extract-compass-partition/proposal.md b/openspec/changes/archive/2026-08-28-extract-compass-partition/proposal.md
new file mode 100644
index 000000000..e89c3dd63
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-extract-compass-partition/proposal.md
@@ -0,0 +1,18 @@
+# Proposal: extract compass-partition
+
+## Why
+
+Canonical partition records and their stable encodings are useful outside immutable
+history, but their definitions currently live behind history-specific dependencies.
+
+## What Changes
+
+- Add a storage-neutral `compass-partition` workspace crate.
+- Move `PartitionedGraph`, canonical JSON encoding, and stable node, edge, and
+  hyperedge key construction into it.
+- Preserve the existing `compass-history` public surface through boundary adapters.
+
+## Compatibility
+
+Canonical bytes and typed-key bytes remain unchanged. `compass-history` continues
+to expose the same helpers with its existing error boundary.
diff --git a/openspec/changes/archive/2026-08-28-extract-compass-partition/specs/partition-contract/spec.md b/openspec/changes/archive/2026-08-28-extract-compass-partition/specs/partition-contract/spec.md
new file mode 100644
index 000000000..f6d01833e
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-extract-compass-partition/specs/partition-contract/spec.md
@@ -0,0 +1,33 @@
+# Partition contract
+
+## ADDED Requirements
+
+### Requirement: storage-neutral ownership
+
+The workspace SHALL provide `compass-partition` without dependencies on
+`prolly-map`, `prolly-store-sqlite`, `compass-ir`, or `compass-analysis`.
+
+#### Scenario: inspect the dependency tree
+
+- **WHEN** the crate dependency tree is inspected
+- **THEN** none of the forbidden dependencies is reachable
+
+### Requirement: byte compatibility
+
+Canonical JSON and typed graph keys SHALL remain byte-identical to the existing
+`compass-history` contract.
+
+#### Scenario: use history compatibility exports
+
+- **WHEN** existing canonical, round-trip, and diff tests run unchanged
+- **THEN** all encoded bytes and reconstructed graph behavior remain identical
+
+### Requirement: typed boundary errors
+
+`compass-partition` SHALL expose its own error type, and `compass-history` SHALL
+convert that error at its public compatibility boundary.
+
+#### Scenario: canonical encoding fails
+
+- **WHEN** the partition encoder cannot encode a value
+- **THEN** history reports a typed `HistoryError` sourced from `PartitionError`
diff --git a/openspec/changes/archive/2026-08-28-extract-compass-partition/tasks.md b/openspec/changes/archive/2026-08-28-extract-compass-partition/tasks.md
new file mode 100644
index 000000000..a0f1a6617
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-extract-compass-partition/tasks.md
@@ -0,0 +1,15 @@
+## 1. Boundary
+
+- [x] 1.1 Define storage-neutral ownership and compatibility contract
+
+## 2. Extraction
+
+- [x] 2.1 Add the crate and move the partition container and encodings
+
+## 3. Compatibility
+
+- [x] 3.1 Preserve history exports, error conversion, and byte behavior
+
+## 4. Verification
+
+- [x] 4.1 Run dependency, focused, workspace, QA, review, and graph gates
diff --git a/openspec/changes/archive/2026-08-28-extract-compass-partition/verification.md b/openspec/changes/archive/2026-08-28-extract-compass-partition/verification.md
new file mode 100644
index 000000000..fb077262b
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-extract-compass-partition/verification.md
@@ -0,0 +1,37 @@
+# Verification: extract compass-partition
+
+## Result
+
+PASS after correction of the first review packet's missing verification record.
+
+## Evidence
+
+- `cargo test -p compass-partition --locked`: 2 passed.
+- `cargo test -p compass-history --locked`: all unit, canonical, diff, Git,
+  jobs, maintenance, publication, round-trip, and SQLite contract tests passed;
+  three explicitly opt-in performance tests remained ignored.
+- `cargo clippy -p compass-partition -p compass-history --all-targets
+  --all-features --locked -- -D warnings`: passed.
+- `cargo tree -p compass-partition --locked`: only `serde_json` and `thiserror`
+  are direct dependencies; no forbidden dependency is reachable.
+- `cargo tree -p compass-graph --locked`: no `compass-partition` path exists.
+- `cargo fmt --all -- --check`: passed.
+- `cargo clippy --workspace --lib --bins --locked -- -D warnings`: passed.
+- `cargo test --workspace --lib --bins --locked`: passed.
+- `sh scripts/check_product_boundary.sh`: passed.
+- `cargo package -p compass-partition --locked --allow-dirty --no-verify`:
+  packaged six files successfully.
+- `openspec validate extract-compass-partition --strict`: passed.
+- `git diff --check`: passed.
+- `compass update .`: 119,876 nodes, 281,866 edges, 68 pre-existing omitted
+  edges, zero identity collisions.
+- Deterministic artifact-refiner fallback: PASS; the installed package lacks
+  its canonical controllers, schemas, and validator agent.
+
+## Review provenance
+
+The first isolated review packet correctly blocked because this verification
+record was absent and task 4.1 was still unchecked. That packet also warned
+that the cumulative `CHANGELOG.md` diff contains C-001 through C-004 entries.
+Those entries are completed prior changes with their own QA receipts and review
+directories; C-005 adds only the leading `compass-partition` entry.
diff --git a/openspec/changes/archive/2026-08-28-focused-agent-skills/.openspec.yaml b/openspec/changes/archive/2026-08-28-focused-agent-skills/.openspec.yaml
new file mode 100644
index 000000000..7f2cf9bc0
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-focused-agent-skills/.openspec.yaml
@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-08-28
diff --git a/openspec/changes/archive/2026-08-28-focused-agent-skills/design.md b/openspec/changes/archive/2026-08-28-focused-agent-skills/design.md
new file mode 100644
index 000000000..7ad4d574e
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-focused-agent-skills/design.md
@@ -0,0 +1,53 @@
+## Context
+
+See `proposal.md` for motivation. `compass-cli` currently embeds `compass-skill/`, installs it transactionally into one platform-specific `skills/compass/` directory, and records checksums plus consumers in `.compass-install.json`. Multiple platforms can share the same destination. Build-time `skillgen` validation protects the canonical skill and its references.
+
+The focused skills must be discoverable by normal Agent Skills clients, which requires sibling directories whose names match their `SKILL.md` frontmatter. They cannot be nested beneath the umbrella skill. Existing installations may contain user-owned sibling directories, so collection installation needs all-destination preflight and rollback.
+
+## Goals / Non-Goals
+
+**Goals:**
+
+- Preserve the exact canonical umbrella asset while adding six narrow activation surfaces.
+- Reuse the existing ownership manifest, deterministic embedding, staging, checksums, and consumer model for each focused tree.
+- Make install, reinstall, multi-consumer uninstall, and rollback operate over the complete seven-skill collection.
+- Keep focused skills portable and independently usable by any Agent Skills-compatible client.
+
+**Non-Goals:**
+
+- Changing the umbrella instructions, public CLI grammar, MCP protocol, or graph contracts.
+- Adding client-specific plugin packaging; C-018 owns that distribution surface.
+- Treating a deterministic trigger corpus as a guarantee about every model or client implementation.
+
+## Decisions
+
+### Install focused skills as managed siblings
+
+Each focused asset is embedded under `compass-focused-skills/<name>/` and installed beside the platform's existing `compass/` directory. Every directory gets its own ownership manifest and version marker with the same consumer set. This satisfies client discovery and lets checksum validation remain local to one skill tree.
+
+Embedding focused content inside the umbrella references was rejected because clients would not discover nested skills. Duplicating the umbrella reference bundle into every focused skill was rejected because the focused instructions can invoke stable Compass commands directly and do not need the large corpus.
+
+### Generalize the existing package transaction
+
+Installation first validates all seven destinations and snapshots all existing managed directories. It then installs each package through the existing stage/backup/rename primitive. Any package or adapter failure restores the entire skill collection and adapter snapshots. This preserves the established path-containment and unowned-file rules without introducing a second installer.
+
+A single atomic rename of the whole `skills/` container was rejected because that container can hold unrelated user skills that Compass must not copy, replace, or own.
+
+### Pin umbrella compatibility and validate focused structure at build time
+
+The build validator keeps the umbrella checks and adds a fixed pre-change SHA-256 assertion plus focused inventory validation. Each focused directory must have matching lower-kebab frontmatter, a discriminative description, no absolute paths, and no unresolved relative resource links.
+
+### Check activation boundaries with a portable corpus
+
+A checked-in JSON corpus contains broad umbrella prompts and task-specific focused prompts. Tests score only explicit, documented activation terms and require a unique expected match for focused cases, with umbrella fallback for broad cases. This is deterministic regression evidence for descriptions and boundary design; it does not claim to model a client LLM.
+
+## Risks / Trade-offs
+
+- **[Risk] Seven manifests increase installed file count** → Keep focused trees minimal and deterministic; C-017 can expose inventory/doctor views without changing package ownership.
+- **[Risk] A failure after one sibling rename cannot be filesystem-atomic across the whole container** → Preflight all destinations, snapshot all owned trees, stage each package, and roll the complete collection back on failure.
+- **[Risk] Trigger words can overlap as descriptions evolve** → Keep a checked-in positive and umbrella-fallback corpus in the build/test gate and require unique focused matches.
+- **[Risk] Modified focused trees could be lost during uninstall** → Verify each manifest before removal and preserve any unowned or checksum-divergent directory.
+
+## Migration Plan
+
+Existing users run the same `compass install` command. A current managed umbrella gains six additive sibling trees. Reinstall is idempotent. Uninstall removes managed focused trees when the last consumer leaves. Rolling back to an older Compass leaves focused trees in place because that older binary does not know or own them; reinstalling the newer version reconciles them safely.
diff --git a/openspec/changes/archive/2026-08-28-focused-agent-skills/proposal.md b/openspec/changes/archive/2026-08-28-focused-agent-skills/proposal.md
new file mode 100644
index 000000000..7b2cea43e
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-focused-agent-skills/proposal.md
@@ -0,0 +1,25 @@
+## Why
+
+Compass currently installs one broad, canonical Agent Skill, so clients must load a large umbrella instruction set even for narrow navigation, debugging, impact, architecture, index-maintenance, or MCP-setup requests. Additive focused skills can make activation more precise while preserving the existing `compass` skill as the unchanged compatibility entry point.
+
+## What Changes
+
+- Add six portable Agent Skills: `compass-navigate`, `compass-debug`, `compass-change-impact`, `compass-architecture`, `compass-index-maintenance`, and `compass-mcp-setup`.
+- Keep the existing `compass` skill byte-for-byte unchanged and canonical.
+- Extend Compass installation to place every focused skill as a complete sibling tree alongside the umbrella skill.
+- Validate skill naming, relative references, trigger discrimination, complete-tree checksums, idempotent reinstall, and preservation of unowned or modified destinations.
+- Add a checked-in trigger corpus that proves existing umbrella prompts still match and focused boundary prompts select one intended skill.
+
+## Capabilities
+
+### New Capabilities
+
+- `focused-agent-skills`: Defines the additive focused skill inventory, activation boundaries, portable package structure, and managed installation behavior.
+
+### Modified Capabilities
+
+None.
+
+## Impact
+
+The change affects embedded assets, build-time asset validation, and managed installation in `compass-cli`, plus installer regression tests. It adds installed files but does not remove or rename commands, change the umbrella skill, add dependencies, or alter graph/MCP machine schemas.
diff --git a/openspec/changes/archive/2026-08-28-focused-agent-skills/specs/focused-agent-skills/spec.md b/openspec/changes/archive/2026-08-28-focused-agent-skills/specs/focused-agent-skills/spec.md
new file mode 100644
index 000000000..37965233b
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-focused-agent-skills/specs/focused-agent-skills/spec.md
@@ -0,0 +1,57 @@
+## Purpose
+
+Provide portable, task-specific Compass Agent Skills while retaining the existing umbrella skill as the stable compatibility entry point.
+
+## ADDED Requirements
+
+### Requirement: Additive focused skill inventory
+Compass SHALL distribute exactly the focused skills `compass-navigate`, `compass-debug`, `compass-change-impact`, `compass-architecture`, `compass-index-maintenance`, and `compass-mcp-setup` in addition to the canonical `compass` skill. The canonical umbrella skill SHALL remain byte-for-byte unchanged by this capability.
+
+#### Scenario: Focused inventory is present
+- **WHEN** the embedded skill inventory is validated
+- **THEN** all six focused names and the canonical umbrella are present exactly once
+- **AND** the canonical umbrella digest matches the pre-change digest
+
+### Requirement: Portable complete skill trees
+Every focused skill SHALL be a complete Agent Skills-compatible directory whose `SKILL.md` name matches its lower-kebab directory. Focused skill content MUST contain no absolute filesystem paths and MUST use only relative links to bundled resources.
+
+#### Scenario: Focused package validation succeeds
+- **WHEN** a release build validates the embedded focused skill trees
+- **THEN** every tree satisfies the Agent Skills frontmatter, naming, path, and resource-completeness constraints
+
+#### Scenario: Invalid portable content is rejected
+- **WHEN** a focused tree contains a mismatched name, absolute path, or reference to an absent bundled resource
+- **THEN** validation fails before the Compass binary is built
+
+### Requirement: Discriminative activation metadata
+Focused skill descriptions SHALL identify distinct task boundaries, and a checked-in trigger corpus SHALL select one intended focused skill for boundary prompts while retaining the umbrella fallback for broad or explicit Compass invocations.
+
+#### Scenario: Boundary prompt selects one focused skill
+- **WHEN** the trigger-discrimination corpus evaluates a task-specific prompt
+- **THEN** exactly one focused skill has the highest matching activation evidence
+- **AND** that skill equals the corpus expectation
+
+#### Scenario: Umbrella invocation remains compatible
+- **WHEN** the corpus evaluates an explicit `/compass` invocation or a broad multi-operation Compass request
+- **THEN** no focused skill supersedes the canonical umbrella fallback
+
+### Requirement: Managed installation of complete inventory
+An installation that targets an Agent Skills-capable platform SHALL place the canonical umbrella and all six focused skills as sibling directories. Installation SHALL preflight every destination, use content checksums to identify current managed trees, be idempotent for equivalent inputs, and preserve unowned or modified destinations.
+
+#### Scenario: First install places complete trees
+- **WHEN** a user installs Compass guidance into an empty supported skill container
+- **THEN** the umbrella and all six focused skill trees are installed with ownership manifests covering every managed file
+
+#### Scenario: Equivalent reinstall is idempotent
+- **WHEN** the same Compass version and consumer set are installed again
+- **THEN** every checksum remains unchanged
+- **AND** the installer reports the target as current
+
+#### Scenario: Unowned focused destination blocks mutation
+- **WHEN** any focused skill destination already contains an unowned or modified tree
+- **THEN** installation fails before changing the umbrella, focused skills, adapters, or configuration
+
+#### Scenario: Last consumer uninstall removes focused trees
+- **WHEN** the last registered consumer uninstalls a managed skill collection
+- **THEN** the umbrella and every unmodified managed focused tree are removed
+- **AND** user-owned or modified trees are preserved
diff --git a/openspec/changes/archive/2026-08-28-focused-agent-skills/tasks.md b/openspec/changes/archive/2026-08-28-focused-agent-skills/tasks.md
new file mode 100644
index 000000000..8009a3842
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-focused-agent-skills/tasks.md
@@ -0,0 +1,16 @@
+## 1. Contract and assets
+
+- [x] 1.1 Add the focused-skill OpenSpec contract and deterministic trigger corpus.
+- [x] 1.2 Add six spec-conformant focused skill trees without changing the canonical umbrella bytes.
+- [x] 1.3 Extend build-time validation for inventory, names, descriptions, paths, resources, and the umbrella digest.
+
+## 2. Managed installation
+
+- [x] 2.1 Generalize package staging and checksum comparison for umbrella and focused trees.
+- [x] 2.2 Preflight, snapshot, install, rollback, and uninstall the complete sibling collection while preserving unowned or modified trees.
+- [x] 2.3 Include focused destinations in dry-run and report paths.
+
+## 3. Verification
+
+- [x] 3.1 Add trigger-discrimination, complete-tree, checksum, idempotence, multi-consumer, conflict, and rollback regressions.
+- [x] 3.2 Run focused tests, formatting, Clippy, workspace baselines, strict OpenSpec validation, graph refresh, refinement, and adversarial review.
diff --git a/openspec/changes/archive/2026-08-28-focused-agent-skills/verification.md b/openspec/changes/archive/2026-08-28-focused-agent-skills/verification.md
new file mode 100644
index 000000000..510809048
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-focused-agent-skills/verification.md
@@ -0,0 +1,35 @@
+# Verification
+
+## Verification report: focused-agent-skills
+
+| Dimension | Status |
+| --- | --- |
+| Completeness | 8/8 tasks; 4/4 requirements implemented |
+| Correctness | 10/10 scenarios covered by build validation, unit tests, or installer contract tests |
+| Coherence | Implementation follows the managed-sibling, collection-transaction, fixed-digest, and deterministic-corpus decisions |
+
+No critical, warning, or suggestion issues remain. All checks passed; the change is ready for archive.
+
+## Deterministic evidence
+
+- The canonical umbrella remains byte-for-byte unchanged at SHA-256 `c6c097e081043c3f57cacb113423ff5783b0391f9881cb3262501277663a5d91`.
+- `cargo test -p compass-cli --locked` passes, including all 24 installer lifecycle tests.
+- `cargo clippy -p compass-cli --all-targets --all-features --locked -- -D warnings` passes.
+- `cargo fmt --all -- --check`, `sh scripts/check_product_boundary.sh`, `openspec validate --all --strict`, and `git diff --check` pass.
+- The final native baseline passes: `cargo clippy --workspace --lib --bins --locked -- -D warnings` and `cargo test --workspace --lib --bins --locked`.
+- `SkillCollectionSnapshot` regression coverage proves restoration of all seven managed siblings after partial mutation while retaining an unrelated user skill.
+- Windows drive and UNC detection rejects absolute paths without treating `https://` documentation links as drive paths.
+- `cargo metadata --locked --no-deps --format-version 1` resolves both normal and build uses of the existing workspace `sha2` dependency without a lockfile update.
+- `compass update .` completed after the final code edits: 711 files, 120590 nodes, 283773 edges, and 3398 communities. Compass reported a bounded partial graph with 68 omitted edges, 0 omitted nodes, and 0 identity collisions.
+
+## Review adjudication
+
+The first adversarial packet contained the repository-wide cumulative diff and omitted untracked focused assets, producing findings contradicted by the compiled tree. A second packet scoped the review to this change and included the untracked asset and OpenSpec files.
+
+The second review's uninstall finding is contradicted by the current source and passing lifecycle tests. `is_managed_skill` first detects `.compass-install.json` and calls `verify_manifest(parent)`, which checks each focused directory against its own manifest and file digests. Only installations without a manifest use `legacy_skill_is_unmodified` and the umbrella digest fallback. The focused uninstall path therefore verifies the focused manifest before removing the last consumer, as covered by `every_project_platform_installs_native_content` and `uninstall_removes_one_shared_consumer_without_breaking_another`.
+
+The second review correctly identified that the original Windows path marker matched two backslashes rather than an ordinary drive-qualified path. Validation now detects any ASCII drive prefix followed by `:` and either slash form, plus UNC prefixes, with focused unit coverage.
+
+The final scoped review passed with 0 critical findings, 3 warnings, and 0 suggestions. Its cumulative-documentation warning describes unrelated pre-existing work in shared files rather than a C016 behavior defect. Its rollback-evidence warning is closed by `skill_collection_snapshot_restores_all_siblings_after_partial_mutation`. Its URL-scheme warning is closed by requiring a token boundary before a drive letter and covering `https://example.com/guide` as a negative case. The strict anti-sycophancy gate passed.
+
+The installed `artifact-refiner` adapter could not run its promised PMPO pipeline because its referenced controllers, schemas, and domain files are absent from both the adapter and cached package. Deterministic OpenSpec, build-time validation, focused tests, full package tests, formatting, Clippy, and product-boundary checks provide the refinement evidence instead; no synthetic refiner state was created.
diff --git a/openspec/changes/archive/2026-08-28-honor-max-graph-bytes-on-publication/.openspec.yaml b/openspec/changes/archive/2026-08-28-honor-max-graph-bytes-on-publication/.openspec.yaml
new file mode 100644
index 000000000..b4bbeb946
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-honor-max-graph-bytes-on-publication/.openspec.yaml
@@ -0,0 +1 @@
+schema: spec-driven
diff --git a/openspec/changes/archive/2026-08-28-honor-max-graph-bytes-on-publication/design.md b/openspec/changes/archive/2026-08-28-honor-max-graph-bytes-on-publication/design.md
new file mode 100644
index 000000000..d22c0e4a6
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-honor-max-graph-bytes-on-publication/design.md
@@ -0,0 +1,11 @@
+# Design: effective snapshot byte limit
+
+`compass-store::max_graph_bytes` owns parsing and matches existing reader forms:
+raw bytes, `MB`, and `GB`, with optional numeric underscores. The function
+returns a finite `usize`; invalid inputs fail closed to `MAX_GRAPH_BYTES`.
+
+`compass-graph::max_canonical_graph_bytes` exposes that effective limit at the
+graph ownership boundary. C-003 preflight and every canonical snapshot
+publication/validation path consume it. C-001 already moved production reads
+to bounded streaming, satisfying the hard gate for raising the publication
+limit without reintroducing a mandatory contiguous payload allocation.
diff --git a/openspec/changes/archive/2026-08-28-honor-max-graph-bytes-on-publication/files.txt b/openspec/changes/archive/2026-08-28-honor-max-graph-bytes-on-publication/files.txt
new file mode 100644
index 000000000..5a707eb83
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-honor-max-graph-bytes-on-publication/files.txt
@@ -0,0 +1,7 @@
+crates/compass-store/src/lib.rs
+crates/compass-graph/src/snapshot.rs
+crates/compass-graph/src/lib.rs
+crates/compass-core/src/pipeline.rs
+crates/compass-cli/tests/snapshot_limit_cli.rs
+CHANGELOG.md
+openspec/changes/honor-max-graph-bytes-on-publication
diff --git a/openspec/changes/archive/2026-08-28-honor-max-graph-bytes-on-publication/proposal.md b/openspec/changes/archive/2026-08-28-honor-max-graph-bytes-on-publication/proposal.md
new file mode 100644
index 000000000..34d68d0f0
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-honor-max-graph-bytes-on-publication/proposal.md
@@ -0,0 +1,19 @@
+# Proposal: honor graph-byte override on publication
+
+## Why
+
+Compass graph readers honor `COMPASS_MAX_GRAPH_BYTES`, but snapshot preflight,
+publication, validation, and streaming retained a fixed 2 GiB bound. This made
+the documented opt-in ineffective on the canonical publication path.
+
+## What Changes
+
+- Centralize the effective snapshot byte limit in `compass-store`.
+- Apply it to preflight, canonical digesting, manifest validation, snapshot
+  streaming/full reads, legacy publication, and delta eligibility.
+- Advertise the now-shipped override in the actionable limit error.
+
+## Compatibility
+
+The default remains 2 GiB. The override is explicit and process-local. Invalid,
+zero, overflowing, or platform-unrepresentable values fall back to the default.
diff --git a/openspec/changes/archive/2026-08-28-honor-max-graph-bytes-on-publication/specs/snapshot-publication-limit/spec.md b/openspec/changes/archive/2026-08-28-honor-max-graph-bytes-on-publication/specs/snapshot-publication-limit/spec.md
new file mode 100644
index 000000000..73260b670
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-honor-max-graph-bytes-on-publication/specs/snapshot-publication-limit/spec.md
@@ -0,0 +1,19 @@
+# Snapshot publication limit override
+
+## ADDED Requirements
+
+### Requirement: Publication honors the explicit graph-byte override
+
+Compass SHALL use `COMPASS_MAX_GRAPH_BYTES` consistently for canonical graph
+preflight, encoding, manifest validation, snapshot streaming, and publication.
+
+#### Scenario: Valid explicit override
+
+- **WHEN** the environment contains a positive raw-byte, MB, or GB value
+- **THEN** snapshot publication uses that finite bound
+- **AND** the actionable error advertises the override
+
+#### Scenario: Missing or invalid override
+
+- **WHEN** the override is absent, zero, invalid, overflowing, or cannot fit the platform
+- **THEN** the effective limit is the unchanged 2 GiB default
diff --git a/openspec/changes/archive/2026-08-28-honor-max-graph-bytes-on-publication/tasks.md b/openspec/changes/archive/2026-08-28-honor-max-graph-bytes-on-publication/tasks.md
new file mode 100644
index 000000000..799a8658e
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-honor-max-graph-bytes-on-publication/tasks.md
@@ -0,0 +1,15 @@
+## 1. Contract
+
+- [x] 1.1 Define parser compatibility, default, and failure-closed behavior
+
+## 2. Implementation
+
+- [x] 2.1 Apply the effective limit to preflight, publication, validation, reads, and deltas
+
+## 3. Public error
+
+- [x] 3.1 Advertise `COMPASS_MAX_GRAPH_BYTES` in the C-002 actionable error and CLI regression
+
+## 4. Verification
+
+- [x] 4.1 Run focused/workspace gates, QA, independent review, graph refresh, verify and archive
diff --git a/openspec/changes/archive/2026-08-28-honor-max-graph-bytes-on-publication/verification.md b/openspec/changes/archive/2026-08-28-honor-max-graph-bytes-on-publication/verification.md
new file mode 100644
index 000000000..89f53a51c
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-honor-max-graph-bytes-on-publication/verification.md
@@ -0,0 +1,13 @@
+# Verification: honor graph-byte override on publication
+
+PASS. The explicit override is parsed compatibly, defaults to 2 GiB on absent
+or invalid values, and controls the complete canonical snapshot path. C-001's
+bounded streaming read remains the production path.
+
+Evidence: focused store/graph/CLI tests; affected all-target/all-feature
+Clippy; workspace fmt, diff, Clippy, and lib/bin tests; strict OpenSpec;
+`compass_product`; product boundary; code-graph fixture qualification; and a
+successful Compass graph refresh with zero identity collisions.
+
+Both independent K3 review calls returned no response, so no review verdict is
+claimed.
diff --git a/openspec/changes/archive/2026-08-28-mcp-result-envelope/design.md b/openspec/changes/archive/2026-08-28-mcp-result-envelope/design.md
new file mode 100644
index 000000000..42a27ec6c
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-mcp-result-envelope/design.md
@@ -0,0 +1,82 @@
+# Design: MCP result envelope
+
+## Envelope
+
+The four core navigation tools return this closed, versioned shape:
+
+```json
+{
+  "schema": "compass.code_context.v1",
+  "repository": "sha256:source-tree",
+  "generation": "sha256:generation",
+  "freshness": {"status": "current"},
+  "data": {"schema": "compass.query/1"},
+  "evidence": {"records": 2, "anchored": 2},
+  "confidence": {"exact": 2, "inferred": 0, "ambiguous": 0},
+  "truncation": {"truncated": false, "next": null},
+  "warnings": []
+}
+```
+
+`resultType` deliberately does not appear inside `structuredContent`. It is the
+MCP `CallToolResult` discriminator emitted by rmcp 3.1.4 and is `complete` for
+these synchronous operations. `schema` is the Compass result-envelope version.
+
+`repository` uses the exact realization's content-addressed source-tree digest.
+`generation` uses that same realization's generation ID. Both identities come
+from the query engine snapshot, so an atomic graph replacement cannot mix
+envelope identity from one realization with data from another. Strict graph
+validation rejects empty source-tree or generation identities before MCP
+invocation, so successful envelopes satisfy the schema's non-empty identity
+contract. Freshness is evidence-scoped: `stale` when the query
+reports stale source evidence, `current` when returned file evidence was
+checked without such a warning, and `unknown` when the result has no checked
+file evidence. Compass does not invent an indexed timestamp or dirty-worktree
+claim that the graph artifact does not record.
+
+`data` is the prior `compass.query/1` response without field removal or
+reinterpretation. Evidence and confidence are deterministic summaries of the
+returned node/edge evidence. Warnings are the prior sorted diagnostics.
+Truncation carries the existing bounded flag and reserves `next`; this version
+sets `next` to null because these tools do not yet expose continuation tokens.
+
+## Tool status
+
+| Tool | Status after this change |
+| --- | --- |
+| `search_symbols` | `compass.code_context.v1` envelope + output schema |
+| `get_callers` | `compass.code_context.v1` envelope + output schema |
+| `get_callees` | `compass.code_context.v1` envelope + output schema |
+| `get_impact` | `compass.code_context.v1` envelope + output schema |
+| `explore_code` | Existing typed `compass.query/1`; envelope deferred |
+| `get_node` | Existing typed `compass.query/1`; envelope deferred |
+| natural `query_graph` | Existing typed `compass.query/1`; envelope deferred |
+| traversal `query_graph` | Text mode deprecated since 0.4.0; typed natural routing remains |
+| `get_neighbors` | Text result deprecated since 0.4.0 |
+| `get_community` | Text result deprecated since 0.4.0 |
+| `god_nodes` | Text result deprecated since 0.4.0 |
+| `graph_stats` | Text result deprecated since 0.4.0 |
+| `shortest_path` | Text result deprecated since 0.4.0; use `get_node` |
+| `list_prs` | Text result deprecated since 0.4.0 |
+| `get_pr_impact` | Text result deprecated since 0.4.0; use typed symbol impact where applicable |
+| `triage_prs` | Text result deprecated since 0.4.0 |
+
+No tool is renamed or removed. Discovery descriptions plus Compass metadata
+mark every remaining text-only result deprecated without representing those
+formats as stable machine schemas. No removal release is scheduled before a
+typed replacement exists and receives its own compatibility review.
+
+## Determinism and compatibility
+
+Tool discovery remains in the existing fixed order. Golden fixtures cover the
+four complete results and output schemas. Pre-envelope projection tests
+asserts that each envelope's `data` is exactly the previous typed response, so
+direction, multiplicity, ambiguity, evidence, bounds, and stable record order
+cannot be lost by the wrapper. The multiplicity fixture includes two distinct
+same-endpoint call occurrences with separate identities, source sites, and
+evidence, and the schema suite validates every model enum and tagged detail
+variant.
+
+The caller's `maxResponseBytes` bound applies to the final encoded envelope,
+not only its nested query payload. An envelope that would cross the explicit
+bound fails with the existing query-response limit classification.
diff --git a/openspec/changes/archive/2026-08-28-mcp-result-envelope/proposal.md b/openspec/changes/archive/2026-08-28-mcp-result-envelope/proposal.md
new file mode 100644
index 000000000..eaa0be73a
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-mcp-result-envelope/proposal.md
@@ -0,0 +1,26 @@
+# Proposal: add typed MCP navigation result envelopes
+
+## Why
+
+Compass's typed code-query payload preserves detailed graph evidence, but its
+core navigation tools do not yet expose the common MCP-facing identity,
+freshness, confidence, warning, and pagination contract clients need.
+
+## What Changes
+
+- Wrap results from `search_symbols`, `get_callers`, `get_callees`, and
+  `get_impact` in `compass.code_context.v1`.
+- Advertise a closed structured output schema for those four tools.
+- Keep MCP `resultType: "complete"` as the protocol discriminator; the Compass
+  schema identifier remains a separate `schema` field.
+- Preserve the existing `compass.query/1` payload unchanged under `data`.
+- Keep all tool names and discovery ordering stable.
+- Mark every remaining text-only result deprecated in discovery while keeping
+  it callable until a typed replacement is separately reviewed.
+
+## Compatibility
+
+This is an additive structured-result contract at the MCP boundary, but it
+changes the top-level `structuredContent` shape for four tools. Clients that
+read those results must move their existing query-response parsing beneath
+`data`. Text fallback content and tool names remain unchanged.
diff --git a/openspec/changes/archive/2026-08-28-mcp-result-envelope/specs/mcp-result-envelope/spec.md b/openspec/changes/archive/2026-08-28-mcp-result-envelope/specs/mcp-result-envelope/spec.md
new file mode 100644
index 000000000..afcee4a10
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-mcp-result-envelope/specs/mcp-result-envelope/spec.md
@@ -0,0 +1,79 @@
+# MCP typed result envelopes
+
+## ADDED Requirements
+
+### Requirement: core navigation tools return a common versioned envelope
+
+Compass SHALL return `compass.code_context.v1` structured content for
+`search_symbols`, `get_callers`, `get_callees`, and `get_impact`, containing
+repository and generation identity, evidence-scoped freshness, the prior typed
+query payload, evidence and confidence summaries, truncation state, and
+warnings.
+
+#### Scenario: invoke a core navigation tool
+
+- **WHEN** a client successfully invokes any of the four core navigation tools
+- **THEN** the MCP result is `resultType: "complete"` and its structured content
+  matches the tool's advertised output schema with `schema` equal to
+  `compass.code_context.v1`
+
+### Requirement: existing typed navigation semantics are preserved
+
+Compass SHALL embed the complete prior `compass.query/1` response under `data`
+without discarding or reinterpreting evidence, direction, multiplicity,
+ambiguity, bounds, diagnostics, truncation, or deterministic ordering.
+
+#### Scenario: compare a result before and after the envelope
+
+- **WHEN** the same graph and bounded request are evaluated through a core
+  navigation tool
+- **THEN** removing the envelope leaves the exact pre-envelope typed response
+
+### Requirement: protocol and product discriminators remain separate
+
+Compass SHALL use MCP `resultType` only as the protocol-level completion
+discriminator and SHALL carry the Compass schema name in structured content's
+separate `schema` field.
+
+#### Scenario: serialize an MCP 2026 tool response
+
+- **WHEN** rmcp serializes a successful core navigation result for an MCP
+  2026-07-28 peer
+- **THEN** top-level `resultType` is `complete` and structured content does not
+  redefine or overload that field
+
+### Requirement: discovery ordering and tool names remain stable
+
+Compass SHALL preserve the existing deterministic tool ordering and names while
+advertising closed output schemas for the four migrated tools.
+
+#### Scenario: list tools repeatedly
+
+- **WHEN** a client requests the tool list more than once
+- **THEN** tools appear in the same order with unchanged names and the four
+  migrated tools expose equivalent output schemas
+
+### Requirement: remaining text results are explicitly deprecated
+
+Compass SHALL mark every remaining text-only tool result, plus the explicit
+text-traversal mode of `query_graph`, deprecated in discovery while retaining
+its current name and behavior until a typed replacement is separately shipped.
+
+#### Scenario: discover a legacy text tool
+
+- **WHEN** a client lists tools
+- **THEN** each legacy text result has a deprecation description and Compass
+  deprecation metadata, while typed tools are not mislabeled
+
+### Requirement: the final envelope obeys the response-byte bound
+
+Compass SHALL measure the encoded structured-content envelope against the
+request's `maxResponseBytes` value and fail explicitly rather than publishing a
+successful oversized result.
+
+#### Scenario: envelope overhead crosses the bound
+
+- **WHEN** the nested query result is within the byte bound but adding the MCP
+  envelope would exceed it
+- **THEN** Compass returns the query-response limit failure and no structured
+  result larger than the requested bound
diff --git a/openspec/changes/archive/2026-08-28-mcp-result-envelope/tasks.md b/openspec/changes/archive/2026-08-28-mcp-result-envelope/tasks.md
new file mode 100644
index 000000000..fc2c5a938
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-mcp-result-envelope/tasks.md
@@ -0,0 +1,17 @@
+# Tasks
+
+## 1. Contract
+
+- [x] 1.1 Define the versioned envelope, freshness semantics, and status of every tool
+
+## 2. Implementation
+
+- [x] 2.1 Implement typed envelopes and structured output schemas for four navigation tools
+
+## 3. Compatibility
+
+- [x] 3.1 Add golden result fixtures and pre-envelope preservation regressions
+
+## 4. Verification
+
+- [x] 4.1 Update public docs, run focused/workspace gates, QA, review, and archive
diff --git a/openspec/changes/archive/2026-08-28-mcp-result-envelope/verification.md b/openspec/changes/archive/2026-08-28-mcp-result-envelope/verification.md
new file mode 100644
index 000000000..aff9399e7
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-mcp-result-envelope/verification.md
@@ -0,0 +1,55 @@
+# Verification
+
+## Result
+
+PASS. The `compass.code_context.v1` result envelope is implemented for the
+four core navigation tools, preserves the exact prior `compass.query/1`
+payload, and is ready to archive.
+
+## Contract evidence
+
+- Each tool advertises a closed draft-2020-12 output schema whose graph enum
+  vocabulary is model-owned and whose 12 node-detail and 5 edge-detail variants
+  are closed and exhaustively tested.
+- `resultType: complete` remains the MCP protocol discriminator; `schema`
+  carries the Compass envelope version.
+- Repository/generation metadata comes from the exact query realization and is
+  validated for both strict JSON graphs and immutable store metadata.
+- Final encoded structured content honors `maxResponseBytes` and preserves the
+  stable `query_response_too_large` identifier.
+- Wire discovery pins output-schema digests and exact deprecation metadata.
+
+## Compatibility evidence
+
+- Four complete envelope goldens compare `data` exactly with independent
+  pre-envelope `compass.query/1` fixtures.
+- A separate pre-envelope golden preserves two parallel same-endpoint call
+  occurrences with distinct identities, source sites, details, evidence, and
+  deterministic order.
+- Direction, ambiguity, warnings, bounds, truncation, and null pagination are
+  covered. Remaining text-result tools are explicitly deprecated without
+  removal or rename.
+
+## Commands
+
+- `cargo test -p compass-model --lib --locked` — passed (13 tests).
+- `cargo test -p compass-graph --lib metadata_summary_rejects_empty_store_build_identities --locked` — passed.
+- `cargo test -p compass-query --lib --locked` — passed (47 tests).
+- `cargo test -p compass-mcp --locked` — passed (20 unit, 8 result-contract, 6 coverage-path, 2 discovery tests).
+- `cargo clippy -p compass-model -p compass-graph -p compass-query -p compass-mcp --all-targets --all-features --locked -- -D warnings` — passed.
+- `cargo fmt --all -- --check` — passed.
+- `cargo clippy --workspace --lib --bins --locked -- -D warnings` — passed.
+- `cargo test --workspace --lib --bins --locked` — passed.
+- `cargo test -p compass-cli --test compass_product --locked` — passed (7 tests).
+- `sh scripts/check_product_boundary.sh` — passed.
+- `openspec validate mcp-result-envelope --strict` — passed.
+- `git diff --check` — passed.
+- `compass update .` — passed: 703 files, 120,215 nodes, 283,082 edges,
+  3,385 communities, zero identity collisions; 68 pre-existing omitted edges.
+
+## QA and adversarial review
+
+Artifact Refiner used its deterministic fallback because the canonical runtime
+is not installed. The final QA verdict is PASS. Six fresh-context adversarial
+rounds drove all findings to closure; the final receipt is PASS with 0 critical,
+0 major, 0 minor, and sycophancy score 0.0.
diff --git a/openspec/changes/archive/2026-08-28-mcp-stateless-http/files.txt b/openspec/changes/archive/2026-08-28-mcp-stateless-http/files.txt
new file mode 100644
index 000000000..17119d487
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-mcp-stateless-http/files.txt
@@ -0,0 +1,16 @@
+Cargo.toml
+Cargo.lock
+crates/compass-mcp/Cargo.toml
+crates/compass-mcp/src/lib.rs
+crates/compass-mcp/src/transport.rs
+crates/compass-cli/src/lib.rs
+crates/compass-cli/src/help.rs
+crates/compass-cli/tests/mcp_http_cli.rs
+COMPATIBILITY.md
+MIGRATION.md
+SECURITY.md
+CHANGELOG.md
+docs/reference/commands.md
+docs/reference/configuration.md
+docs/reference/compatibility.md
+openspec/changes/mcp-stateless-http
diff --git a/openspec/changes/archive/2026-08-28-mcp-stateless-http/proposal.md b/openspec/changes/archive/2026-08-28-mcp-stateless-http/proposal.md
new file mode 100644
index 000000000..87a0861ce
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-mcp-stateless-http/proposal.md
@@ -0,0 +1,27 @@
+# Proposal: make MCP HTTP stateless for protocol 2026-07-28
+
+## Why
+
+Compass still defaults its Streamable HTTP endpoint to the pre-2026 session
+handshake even though rmcp 3.1.4 supports the MCP 2026-07-28 per-request
+contract. The default must become stateless without weakening authentication,
+host validation, size limits, or project selection.
+
+## What Changes
+
+- Serve HTTP requests without `Mcp-Session-Id` and require the 2026-07-28
+  `Mcp-Protocol-Version`, `Mcp-Method`, and request metadata contract.
+- Advertise only MCP 2026-07-28 from the HTTP service while leaving stdio's
+  already-qualified compatibility contract unchanged.
+- Keep `--stateless` accepted as a compatibility spelling for the new default.
+- Accept `--session-timeout` with a deprecation warning through the 0.4.x
+  release line, ignore its value because HTTP has no sessions, and remove the
+  flag in 0.5.0.
+- Do not ship a legacy MCP-2025 HTTP mode.
+
+## Compatibility
+
+Bearer-token authentication, host validation, request and response limits,
+multi-project selection, stdio behavior, tool names, and schemas are unchanged.
+Clients using the old HTTP initialize/session handshake must migrate to
+`server/discover` plus per-request 2026-07-28 metadata.
diff --git a/openspec/changes/archive/2026-08-28-mcp-stateless-http/specs/mcp-http/spec.md b/openspec/changes/archive/2026-08-28-mcp-stateless-http/specs/mcp-http/spec.md
new file mode 100644
index 000000000..7204de225
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-mcp-stateless-http/specs/mcp-http/spec.md
@@ -0,0 +1,63 @@
+# MCP HTTP transport
+
+## ADDED Requirements
+
+### Requirement: HTTP requests are stateless MCP 2026-07-28 exchanges
+
+Compass SHALL advertise MCP 2026-07-28 from its HTTP service, route every HTTP
+POST without a server session, require the protocol and standard method headers
+plus applicable per-request metadata, and SHALL NOT issue or require
+`Mcp-Session-Id`.
+
+#### Scenario: discover and list tools without a session handshake
+
+- **WHEN** an authenticated HTTP client sends `server/discover` and then
+  `tools/list` with `Mcp-Protocol-Version: 2026-07-28`, matching `Mcp-Method`
+  headers, and required request metadata
+- **THEN** both requests succeed independently, advertise only 2026-07-28, and
+  neither response contains `Mcp-Session-Id`
+
+#### Scenario: reject incomplete per-request protocol metadata
+
+- **WHEN** a non-initialize HTTP request omits its protocol-version header,
+  method header, or required request metadata
+- **THEN** Compass rejects it before tool dispatch with a typed HTTP/JSON-RPC
+  protocol error
+
+### Requirement: no legacy MCP-2025 HTTP mode ships
+
+Compass SHALL NOT expose a runtime flag, hidden fallback, or session path for
+MCP-2025 HTTP clients. Stdio compatibility remains independently qualified.
+
+#### Scenario: send an old session handshake
+
+- **WHEN** a client sends an initialize request or an `Mcp-Session-Id` expecting
+  the former HTTP session flow
+- **THEN** Compass rejects initialize, ignores an obsolete session header on an
+  otherwise valid current request, never creates or restores a legacy session,
+  and documents the required stateless migration
+
+### Requirement: session timeout follows a bounded deprecation path
+
+Compass SHALL accept both spellings of `--session-timeout` through 0.4.x,
+validate the existing value grammar, ignore a valid value, print one warning,
+and preserve the command's success or failure exit code. The option SHALL be
+removed in 0.5.0.
+
+#### Scenario: use the deprecated option with another runtime failure
+
+- **WHEN** a valid `--session-timeout` accompanies an HTTP invocation that
+  otherwise fails
+- **THEN** stderr includes the deprecation/removal warning and the invocation
+  retains the same runtime-failure exit code
+
+### Requirement: existing HTTP security and selection boundaries remain intact
+
+Compass SHALL preserve bearer and API-key authentication, allowed-host checks,
+bounded request and response bodies, and per-request multi-project selection.
+
+#### Scenario: exercise security and project inputs
+
+- **WHEN** requests use invalid credentials, an untrusted host, an oversized
+  body, or a valid project selector
+- **THEN** the existing rejection or selection behavior remains unchanged
diff --git a/openspec/changes/archive/2026-08-28-mcp-stateless-http/tasks.md b/openspec/changes/archive/2026-08-28-mcp-stateless-http/tasks.md
new file mode 100644
index 000000000..1306c8301
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-mcp-stateless-http/tasks.md
@@ -0,0 +1,15 @@
+## 1. Contract
+
+- [x] 1.1 Define the stateless HTTP, legacy-mode, and CLI deprecation contract
+
+## 2. Transport
+
+- [x] 2.1 Implement and test MCP 2026-07-28 stateless HTTP discovery and calls
+
+## 3. Compatibility
+
+- [x] 3.1 Deprecate session timeout and update compatibility, migration, command, configuration, and release documentation
+
+## 4. Verification
+
+- [x] 4.1 Run focused/workspace gates, deterministic QA, adversarial review, and archive
diff --git a/openspec/changes/archive/2026-08-28-mcp-stateless-http/verification.md b/openspec/changes/archive/2026-08-28-mcp-stateless-http/verification.md
new file mode 100644
index 000000000..ad595edd9
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-mcp-stateless-http/verification.md
@@ -0,0 +1,43 @@
+# Verification: stateless MCP HTTP
+
+## Result
+
+PASS for the MCP 2026-07-28 stateless HTTP cutover and CLI deprecation path.
+
+## Evidence
+
+- `cargo test -p compass-mcp --locked`: all 31 unit, integration, discovery,
+  tool, resource, and raw-wire transport tests passed.
+- The raw-wire HTTP regression proves `server/discover` advertises only
+  2026-07-28, `tools/list` succeeds independently, no response contains
+  `Mcp-Session-Id`, and missing/incomplete metadata, missing/mismatched method
+  headers, and initialize fail with typed HTTP/JSON-RPC errors. A valid request
+  carrying an obsolete session identifier remains independent and creates no
+  session.
+- The 64 MiB response boundary is restored for known and streaming bodies;
+  known oversized bodies return distinct JSON-RPC error `-32023`, while an
+  unknown-length multi-chunk regression proves the overflow chunk is replaced
+  by an explicit `LengthLimitError`. Authenticated untrusted hosts are rejected
+  before protocol diagnostics even when version metadata is missing or old.
+  Existing bearer-token, API-key, request-limit, project-path, stdio, tool,
+  resource, and rmcp 2.2 discovery-parity tests remain green.
+- `cargo test -p compass-cli --lib --locked`: 79 passed.
+- `cargo test -p compass-cli --test coverage_paths --locked`: 17 passed.
+- `cargo test -p compass-cli --test mcp_http_cli --locked`: 1 passed and proves
+  exact deprecation text plus unchanged exit codes 1 and 2.
+- `cargo clippy -p compass-mcp --all-targets --all-features --locked -- -D
+  warnings` and the equivalent `compass-cli` command passed.
+- `cargo fmt --all -- --check`, workspace lib/bin Clippy, and workspace lib/bin
+  tests passed under `--locked`.
+- `cargo test -p compass-cli --test compass_product --locked`: 7 passed.
+- `sh scripts/check_product_boundary.sh`: passed.
+- `openspec validate mcp-stateless-http --strict` and `git diff --check` passed.
+- Two adversarial rounds found four major issues; all were repaired and the
+  focused plus full baselines were rerun before the final isolated packet.
+- `compass update .`: 120,020 nodes, 282,421 edges, 3,460 communities, 68
+  pre-existing omitted edges, and zero identity collisions.
+
+Compatibility, migration, command, configuration, security, and release notes
+record that no legacy MCP-2025 HTTP mode ships, `--stateless` is redundant but
+accepted, and `--session-timeout` is removed in 0.5.0 after the 0.4.x warning
+window.
diff --git a/openspec/changes/archive/2026-08-28-preflight-graph-size-estimate/.openspec.yaml b/openspec/changes/archive/2026-08-28-preflight-graph-size-estimate/.openspec.yaml
new file mode 100644
index 000000000..b4bbeb946
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-preflight-graph-size-estimate/.openspec.yaml
@@ -0,0 +1 @@
+schema: spec-driven
diff --git a/openspec/changes/archive/2026-08-28-preflight-graph-size-estimate/design.md b/openspec/changes/archive/2026-08-28-preflight-graph-size-estimate/design.md
new file mode 100644
index 000000000..7ecc50627
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-preflight-graph-size-estimate/design.md
@@ -0,0 +1,35 @@
+# Design: bounded preflight graph estimate
+
+## Baseline-first calibration
+
+The original incident recorded a 331.90 s late failure on a 6.8 GB checkout.
+The available checkout has since grown to 16 GB and currently fails earlier
+with a worker stack overflow after 73.82 s, so it cannot isolate snapshot size.
+The approved synthetic equivalent uses 2,000 deterministic Rust sources. Its
+112,893 source bytes produced 6,843,452 canonical bytes in 1.61 s, an observed
+60.62x expansion. The implementation rounds this down to 60x.
+
+The measured canonical composition was:
+
+- graph metadata and file inventory: 2,065,352 bytes (30.2%);
+- nodes: 3,122,253 bytes (45.6%);
+- edges: 1,655,788 bytes (24.2%).
+
+## Estimator
+
+After discovery and language filtering, Compass performs one metadata lookup
+per source. An admitted source contributes `max(512, byte_size * 60)` plus its
+root-relative path length. A missing, non-file, or source above
+`max_source_bytes` contributes 512 bytes plus its relative path because Compass
+publishes it as inventory-only partial coverage rather than parsing it.
+
+All arithmetic saturates. No source content is read and no parser or resolver
+runs. Root-relative paths keep equivalent inputs deterministic across checkout
+locations. Exceeding the bound returns
+`SnapshotError::canonical_graph_too_large`, preserving the typed `Limit`
+classification and C-002 remediation.
+
+## Timing contract
+
+The synthetic full-build baseline is 1.61 s. The regression pins a 322 ms
+ceiling, exactly 20% of that baseline, for the estimation failure itself.
diff --git a/openspec/changes/archive/2026-08-28-preflight-graph-size-estimate/evidence/baseline.md b/openspec/changes/archive/2026-08-28-preflight-graph-size-estimate/evidence/baseline.md
new file mode 100644
index 000000000..8490d301a
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-preflight-graph-size-estimate/evidence/baseline.md
@@ -0,0 +1,26 @@
+# C-003 baseline evidence
+
+Measured 2026-08-28 with the current `compass-cli` debug binary.
+
+## Real checkout attempt
+
+- input: read-only external `universal-agent-runtime` qualification checkout
+- current disk footprint: 16 GB
+- result: worker stack overflow before graph publication
+- elapsed: 73.82 s real, 71.50 s user, 18.86 s system
+
+This checkout no longer reproduces the isolated 2 GiB publication failure, so
+it was not used for estimator calibration.
+
+## Deterministic synthetic equivalent
+
+- sources: 2,000 Rust files, one deterministic function per file
+- source bytes: 112,893
+- canonical graph bytes: 6,843,452
+- graph: 4,000 nodes, 2,000 edges
+- elapsed: 1.61 s real
+- composition: graph metadata/inventory 2,065,352 bytes; nodes 3,122,253
+  bytes; edges 1,655,788 bytes
+- observed expansion: 60.62 canonical bytes per source byte
+- implementation calibration: 60x
+- regression error ceiling: 322 ms (20% of 1.61 s)
diff --git a/openspec/changes/archive/2026-08-28-preflight-graph-size-estimate/files.txt b/openspec/changes/archive/2026-08-28-preflight-graph-size-estimate/files.txt
new file mode 100644
index 000000000..fa6db2baa
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-preflight-graph-size-estimate/files.txt
@@ -0,0 +1,11 @@
+crates/compass-core/src/pipeline.rs
+crates/compass-graph/src/lib.rs
+crates/compass-graph/src/snapshot.rs
+CHANGELOG.md
+openspec/changes/preflight-graph-size-estimate/.openspec.yaml
+openspec/changes/preflight-graph-size-estimate/proposal.md
+openspec/changes/preflight-graph-size-estimate/design.md
+openspec/changes/preflight-graph-size-estimate/specs/preflight-graph-size-estimate/spec.md
+openspec/changes/preflight-graph-size-estimate/tasks.md
+openspec/changes/preflight-graph-size-estimate/files.txt
+openspec/changes/preflight-graph-size-estimate/evidence/baseline.md
diff --git a/openspec/changes/archive/2026-08-28-preflight-graph-size-estimate/proposal.md b/openspec/changes/archive/2026-08-28-preflight-graph-size-estimate/proposal.md
new file mode 100644
index 000000000..c49179cf1
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-preflight-graph-size-estimate/proposal.md
@@ -0,0 +1,22 @@
+# Proposal: preflight canonical graph size estimation
+
+## Why
+
+An oversized repository can spend several minutes extracting a graph only to
+discover at publication that its canonical payload exceeds the fixed 2 GiB
+snapshot limit. Discovery metadata is already available before extraction and
+can provide a deterministic, bounded early estimate.
+
+## What Changes
+
+- Estimate canonical graph bytes immediately after source discovery.
+- Calibrate the estimate from a measured deterministic fixture.
+- Return the existing typed, actionable snapshot limit error when the estimate
+  exceeds the publication bound.
+- Treat files above the parser admission limit as inventory-only records.
+
+## Compatibility
+
+This adds an earlier failure for inputs estimated to exceed the existing
+publication limit. It does not change the limit, graph schema, successful
+output, or recovery controls.
diff --git a/openspec/changes/archive/2026-08-28-preflight-graph-size-estimate/specs/preflight-graph-size-estimate/spec.md b/openspec/changes/archive/2026-08-28-preflight-graph-size-estimate/specs/preflight-graph-size-estimate/spec.md
new file mode 100644
index 000000000..effe0fcf5
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-preflight-graph-size-estimate/specs/preflight-graph-size-estimate/spec.md
@@ -0,0 +1,34 @@
+# Preflight graph size estimate
+
+## ADDED Requirements
+
+### Requirement: Oversized graph estimates fail before extraction
+
+Compass SHALL estimate canonical graph payload size after deterministic source
+discovery and before project-wide per-file extraction. When the estimate exceeds
+the canonical publication bound, Compass SHALL return a typed limit error rather
+than an empty result.
+
+#### Scenario: Calibrated fixture exceeds the bound
+
+- **WHEN** the measured synthetic fixture is evaluated against its calibrated bound
+- **THEN** estimation fails before extraction completes
+- **AND** time to error is below 322 ms, 20% of the recorded 1.61 s baseline
+- **AND** the error names `--exclude <pattern>` and `.compassignore`
+
+### Requirement: Estimation is bounded and deterministic
+
+The estimate SHALL perform bounded work, use saturating arithmetic, depend on
+root-relative source metadata, and produce the same result for equivalent
+inputs in different checkout locations.
+
+#### Scenario: Equivalent source trees
+
+- **WHEN** equivalent source files exist beneath different absolute roots
+- **THEN** their estimates and limit outcomes are identical
+
+#### Scenario: Parser-oversized source
+
+- **WHEN** a source exceeds `max_source_bytes`
+- **THEN** the estimate accounts only for its inventory/partial record
+- **AND** does not amplify bytes Compass will not parse
diff --git a/openspec/changes/archive/2026-08-28-preflight-graph-size-estimate/tasks.md b/openspec/changes/archive/2026-08-28-preflight-graph-size-estimate/tasks.md
new file mode 100644
index 000000000..71d95b9c5
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-preflight-graph-size-estimate/tasks.md
@@ -0,0 +1,15 @@
+## 1. Measurement
+
+- [x] 1.1 Record real-corpus failure behavior and deterministic synthetic baseline with payload composition
+
+## 2. Contract
+
+- [x] 2.1 Define the bounded deterministic estimator and pin the 20% time-to-error ceiling
+
+## 3. Implementation
+
+- [x] 3.1 Run preflight after discovery, reuse the actionable limit error, and add deterministic/timing/partial-source regression coverage
+
+## 4. Verification
+
+- [x] 4.1 Run focused and workspace checks, refinement, adversarial review, graph refresh, strict verification, sync, and archive
diff --git a/openspec/changes/archive/2026-08-28-preflight-graph-size-estimate/verification.md b/openspec/changes/archive/2026-08-28-preflight-graph-size-estimate/verification.md
new file mode 100644
index 000000000..296e4f7e9
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-preflight-graph-size-estimate/verification.md
@@ -0,0 +1,26 @@
+# Verification: preflight graph size estimate
+
+## Result
+
+PASS. The measured estimator executes after discovery/verified reuse and before
+cold extraction, is deterministic for equivalent roots, uses bounded metadata
+work and saturating arithmetic, preserves inventory-only oversized handling,
+and returns the existing actionable typed limit error.
+
+## Evidence
+
+- `cargo fmt --all -- --check`
+- `git diff --check`
+- focused unit and `pipeline_scale` regressions
+- affected-crate all-target/all-feature Clippy with `-D warnings`
+- `cargo clippy --workspace --lib --bins --locked -- -D warnings`
+- `cargo test --workspace --lib --bins --locked`
+- `cargo test -p compass-cli --test compass_product --locked`
+- `sh scripts/check_product_boundary.sh`
+- `./scripts/qualify_code_graph_v1.sh --fixtures-only`
+- `openspec validate preflight-graph-size-estimate --strict`
+- `compass update . --no-viz --no-cluster`
+
+The broader integration package has one unrelated existing TypeScript
+star-reexport assertion mismatch. Both independent K3 review calls returned no
+response; no adversarial verdict is claimed.
diff --git a/openspec/changes/archive/2026-08-28-rmcp-3-migration/.openspec.yaml b/openspec/changes/archive/2026-08-28-rmcp-3-migration/.openspec.yaml
new file mode 100644
index 000000000..7f2cf9bc0
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-rmcp-3-migration/.openspec.yaml
@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-08-28
diff --git a/openspec/changes/archive/2026-08-28-rmcp-3-migration/design.md b/openspec/changes/archive/2026-08-28-rmcp-3-migration/design.md
new file mode 100644
index 000000000..f3b06a540
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-rmcp-3-migration/design.md
@@ -0,0 +1,51 @@
+# Design: rmcp 3.1.4 migration
+
+## Scope boundary
+
+This is a dependency and API migration only. It does not add tools, redesign
+results, introduce SurrealDB, or change the HTTP session contract.
+
+## API migration
+
+Current rmcp documentation identifies `ServiceExt::serve`/`serve_server` with
+the stdio transport as the supported server startup path. rmcp 3.1.4 also adds
+the `ServerHandler::discover` surface and 2026 protocol models while retaining
+the established list-tools/list-resources handler shape.
+
+Compilation against the exact pin required three adaptations:
+
+1. `ServerHandler::call_tool` now returns `CallToolResponse`; Compass wraps its
+   unchanged complete `CallToolResult` with the SDK's lossless `From` conversion.
+2. `ServerHandler::read_resource` likewise returns `ReadResourceResponse` and
+   wraps the unchanged complete `ReadResourceResult`.
+3. `StreamableHttpServerConfig::with_stateful_mode` was renamed to
+   `with_legacy_session_mode`; passing the same `!options.stateless` value
+   preserves the current transport choice pending the separate C-008 redesign.
+
+The stdio `ServiceExt::serve` and `RunningService::waiting` calls did not change.
+All existing duplex protocol tests pass without adaptation.
+
+## Dependency baseline
+
+Before migration, the selected rmcp 2.2.0 normal/build subtree contains 69
+normalized package-version entries and the `compass-mcp` normal/build tree
+contains 369 distinct rendered lines. After migration those counts are 70 and
+370. The exact rmcp subtree delta is:
+
+- removed: `rmcp 2.2.0`;
+- added: `rmcp 3.1.4`, `base64 0.23.1`;
+- no other rmcp-subtree packages changed.
+
+Both rmcp releases declare Apache-2.0. rmcp 3.1.4 declares Rust 1.88, below
+Compass's pinned 1.97.1 toolchain. The advisory gate also exposed two current
+lockfile issues unrelated to the rmcp version delta: `h2 0.4.15`
+(`RUSTSEC-2026-0258`) and yanked `chacha20 0.10.1`. Compatible patch updates to
+`h2 0.4.16` and `chacha20 0.10.2` make advisories, bans, licenses, and sources
+all pass without weakening `deny.toml`.
+
+## Compatibility evidence
+
+A checked-in golden derived before the upgrade records the server identity,
+capabilities, ordered tool names and SHA-256 digests of their full input
+schemas, and ordered resource inventory. Both the local handler view and a real
+rmcp 3.1.4 `server/discover` exchange must match it after the migration.
diff --git a/openspec/changes/archive/2026-08-28-rmcp-3-migration/files.txt b/openspec/changes/archive/2026-08-28-rmcp-3-migration/files.txt
new file mode 100644
index 000000000..16711594b
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-rmcp-3-migration/files.txt
@@ -0,0 +1,7 @@
+Cargo.toml
+Cargo.lock
+crates/compass-mcp/src/lib.rs
+crates/compass-mcp/src/transport.rs
+crates/compass-mcp/tests
+CHANGELOG.md
+openspec/changes/rmcp-3-migration
diff --git a/openspec/changes/archive/2026-08-28-rmcp-3-migration/proposal.md b/openspec/changes/archive/2026-08-28-rmcp-3-migration/proposal.md
new file mode 100644
index 000000000..e3813fab3
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-rmcp-3-migration/proposal.md
@@ -0,0 +1,22 @@
+# Proposal: migrate the MCP SDK to rmcp 3.1.4
+
+## Why
+
+Compass currently builds its MCP server on rmcp 2.2.0. The next MCP changes
+depend on rmcp 3.x protocol models and discovery support, so the dependency must
+move first without combining the migration with transport or result redesign.
+
+## What Changes
+
+- Pin the workspace dependency to exactly rmcp 3.1.4.
+- Port the existing handler and transports to the 3.x API, with stdio parity
+  established first.
+- Add a 2.2-derived discovery golden that freezes the existing server identity,
+  tool names, tool input schemas, and resource inventory.
+- Measure and review the transitive dependency, license, and unsafe-policy delta.
+
+## Compatibility
+
+The public MCP tools, schemas, resources, CLI flags, and stdio behavior remain
+unchanged. This change does not introduce the 2026 stateless HTTP contract or a
+new result envelope; those are separate follow-up changes.
diff --git a/openspec/changes/archive/2026-08-28-rmcp-3-migration/specs/rmcp-migration/spec.md b/openspec/changes/archive/2026-08-28-rmcp-3-migration/specs/rmcp-migration/spec.md
new file mode 100644
index 000000000..bb9f393d7
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-rmcp-3-migration/specs/rmcp-migration/spec.md
@@ -0,0 +1,46 @@
+# rmcp migration
+
+## ADDED Requirements
+
+### Requirement: exact rmcp 3.1.4 dependency
+
+Compass SHALL resolve rmcp at exactly version 3.1.4 from the workspace
+dependency declaration.
+
+#### Scenario: inspect workspace dependency state
+
+- **WHEN** Cargo metadata and the lockfile are inspected
+- **THEN** rmcp resolves to 3.1.4 and member crates inherit the workspace entry
+
+### Requirement: stdio behavior remains compatible
+
+Compass SHALL preserve bounded, blank-line-tolerant MCP stdio operation while
+using the rmcp 3.x server API.
+
+#### Scenario: exercise the in-memory stdio-equivalent protocol
+
+- **WHEN** a client initializes, lists tools and resources, calls a tool, reads
+  a resource, and closes the duplex transport
+- **THEN** all operations complete with the same public results and errors as
+  the rmcp 2.2 implementation
+
+### Requirement: discovery contract remains stable
+
+Compass SHALL preserve the existing server identity, advertised capabilities,
+ordered tool names and input schemas, and ordered resource inventory.
+
+#### Scenario: compare migrated discovery to the rmcp 2.2 golden
+
+- **WHEN** the normalized discovery contract is generated under rmcp 3.1.4
+- **THEN** it exactly matches the checked-in rmcp 2.2 golden
+
+### Requirement: dependency policy remains satisfied
+
+The migration SHALL document the exact transitive package delta and SHALL pass
+the repository license, source, ban, lint, and unsafe-code policies.
+
+#### Scenario: qualify resolved dependencies
+
+- **WHEN** dependency and workspace policy gates run
+- **THEN** rmcp remains acceptably licensed, no disallowed source is introduced,
+  and the workspace continues to compile without unsafe Compass code
diff --git a/openspec/changes/archive/2026-08-28-rmcp-3-migration/tasks.md b/openspec/changes/archive/2026-08-28-rmcp-3-migration/tasks.md
new file mode 100644
index 000000000..a7238a424
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-rmcp-3-migration/tasks.md
@@ -0,0 +1,15 @@
+## 1. Baseline
+
+- [x] 1.1 Measure the rmcp 2.2 API, discovery, license, and dependency baseline
+
+## 2. Migration
+
+- [x] 2.1 Pin rmcp 3.1.4 exactly and port the server with stdio first
+
+## 3. Compatibility
+
+- [x] 3.1 Prove rmcp 2.2 discovery parity and dependency-policy compliance
+
+## 4. Verification
+
+- [x] 4.1 Run focused/workspace gates, deterministic QA, review, and archive
diff --git a/openspec/changes/archive/2026-08-28-rmcp-3-migration/verification.md b/openspec/changes/archive/2026-08-28-rmcp-3-migration/verification.md
new file mode 100644
index 000000000..b6bcc077b
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-rmcp-3-migration/verification.md
@@ -0,0 +1,34 @@
+# Verification: rmcp 3.1.4 migration
+
+## Result
+
+PASS for the dependency/API migration and rmcp 2.2 discovery parity.
+
+## Evidence
+
+- Root `Cargo.toml` pins `rmcp = "=3.1.4"`; Cargo metadata and `Cargo.lock`
+  resolve only rmcp 3.1.4.
+- `cargo test -p compass-mcp --locked`: 31 unit, transport, tool, resource,
+  discovery, and duplex protocol tests passed.
+- The `server_discover_matches_rmcp_2_2_golden` test performs a real
+  `server/discover` exchange and matches server identity, capabilities, ordered
+  tools and schema digests, and ordered resources to the pre-migration golden.
+- `cargo clippy -p compass-mcp --all-targets --all-features --locked -- -D
+  warnings`: passed.
+- Temporarily installed `cargo-deny 0.20.2`; `cargo-deny check` reports
+  advisories, bans, licenses, and sources all passing. Existing allowed
+  duplicate-version warnings remain warnings under repository policy.
+- `cargo fmt --all -- --check`: passed.
+- `cargo clippy --workspace --lib --bins --locked -- -D warnings`: passed.
+- `cargo test --workspace --lib --bins --locked`: passed.
+- `cargo test -p compass-cli --test compass_product --locked`: 7 passed.
+- `sh scripts/check_product_boundary.sh`: passed.
+- `openspec validate rmcp-3-migration --strict`: passed.
+- `git diff --check`: passed.
+- `compass update .`: 119,961 nodes, 282,152 edges, 3,436 communities,
+  68 pre-existing omitted edges, and zero identity collisions.
+
+`cargo package -p compass-mcp --allow-dirty --locked` was also attempted. It
+cannot package this workspace member because the internal `compass-core 0.3.7`
+dependency is not present on crates.io; this is existing workspace publication
+state and is unrelated to the rmcp migration.
diff --git a/openspec/changes/archive/2026-08-28-stream-snapshot-read/.openspec.yaml b/openspec/changes/archive/2026-08-28-stream-snapshot-read/.openspec.yaml
new file mode 100644
index 000000000..7f2cf9bc0
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-stream-snapshot-read/.openspec.yaml
@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-08-28
diff --git a/openspec/changes/archive/2026-08-28-stream-snapshot-read/design.md b/openspec/changes/archive/2026-08-28-stream-snapshot-read/design.md
new file mode 100644
index 000000000..ce182cb3c
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-stream-snapshot-read/design.md
@@ -0,0 +1,55 @@
+## Context
+
+See `proposal.md` for motivation and `specs/snapshot-streaming/spec.md` for the behavior contract. The SQLite snapshot format stores a validated catalog manifest and bounded immutable chunks. The existing `read_snapshot` reconstructs all chunks into one `Vec`; its only production consumers discard those bytes. The query engine already uses indexed graph snapshot readers and is outside this change.
+
+The current serialized format, digest algorithm, snapshot identifiers, 2 GiB default bound, synchronous store contract, and public `read_snapshot` signature are compatibility constraints.
+
+## Goals / Non-Goals
+
+**Goals:**
+
+- Make metadata access constant-sized and integrity validation chunk-bounded.
+- Preserve full-read compatibility for tests and any external consumers.
+- Preserve corruption detection for both validation and reference generation.
+- Keep every chunk and accumulated byte count bounded and deterministic.
+
+**Non-Goals:**
+
+- Changing the snapshot serialization or active-selector publication protocol.
+- Raising or making the maximum graph size configurable; that is C-004.
+- Partitioning the current graph or changing query-engine read paths.
+- Introducing async I/O or a new dependency.
+
+## Decisions
+
+### Separate metadata, streaming, and collecting APIs
+
+`read_snapshot_manifest` reads and validates only the active catalog value. `read_snapshot_chunks` captures that manifest once, visits exact chunk keys in index order, maintains a running byte count and SHA-256 digest, and calls a fallible consumer for each chunk. The existing `read_snapshot` collects those callbacks into a `Vec` and remains the only API that intentionally materializes the payload.
+
+Alternative considered: change `read_snapshot` to return an iterator. Rejected because it would break the public signature and force migration despite no production consumer needing the payload.
+
+### Preserve reference integrity with streaming validation
+
+`validate_snapshot` and `snapshot_reference` use the streaming verifier and retain the returned manifest. A manifest-only reference implementation would be cheaper but would change corrupt-snapshot behavior by accepting missing or modified chunks, violating the KBD acceptance criterion.
+
+Alternative considered: read the manifest, then separately call validation. Rejected because two active-selector reads can observe different generations and do redundant work. One streaming call pins the identity being verified.
+
+### Keep the stored-chunk and aggregate guards
+
+Chunks remain bounded by the existing value-size limit. Before selecting a chunk BLOB, the SQLite read path requires the `blob` storage class, probes `length(value)`, and rejects rows above `CHUNK_BYTES`; the bounded follow-up query repeats the type and length predicates so a changed row cannot be materialized above the limit. SQLite can determine a BLOB's byte length without reading its complete contents. A defensive Rust byte-length check preserves the contract across adapter conversion behavior. The stream then uses saturating accumulation, rejects totals above the graph bound, compares the final length to the manifest, and compares the final digest. It never trusts `payload_bytes` as an allocation request.
+
+Alternative considered: preallocate from `payload_bytes` in the compatibility collector. Rejected because a corrupt manifest could again drive a multi-gigabyte allocation before any chunk evidence is read.
+
+The compatibility collector instead preallocates only after `read_snapshot_manifest` validates the bounded manifest, repeats the `MAX_GRAPH_BYTES` check at the allocation site, then streams that same captured manifest so allocation sizing and chunk identity cannot race across active-selector generations.
+
+## Risks / Trade-offs
+
+- [Public callback API can be misused by a consumer that retains every chunk] -> Document that streaming bounds the store's allocation, while consumer-owned retention remains the consumer's responsibility.
+- [Chunks are delivered before terminal length and digest validation] -> Document them as provisional and require irreversible consumers to stage work until successful return or independently verify before commit.
+- [Reference generation still reads all chunks to preserve prior corruption semantics] -> Accept the I/O cost; the defect is payload-sized memory, not the bounded verification work.
+- [A test that checks only manifest success could miss payload corruption] -> Keep separate corrupt-manifest, missing-chunk, bad-length/digest, and reference-rejection scenarios.
+- [Writable-store concurrency could advance the active selector] -> Capture one manifest per streaming operation and address immutable chunks by its snapshot ID.
+
+## Migration Plan
+
+Land the additive APIs and switch internal production callers in one change. The existing signature and serialized formats remain unchanged, so rollback is a source-level revert and users have no migration action.
diff --git a/openspec/changes/archive/2026-08-28-stream-snapshot-read/files.txt b/openspec/changes/archive/2026-08-28-stream-snapshot-read/files.txt
new file mode 100644
index 000000000..1a86d0afe
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-stream-snapshot-read/files.txt
@@ -0,0 +1,2 @@
+crates/compass-store/src/lib.rs
+CHANGELOG.md
diff --git a/openspec/changes/archive/2026-08-28-stream-snapshot-read/proposal.md b/openspec/changes/archive/2026-08-28-stream-snapshot-read/proposal.md
new file mode 100644
index 000000000..b11f388c5
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-stream-snapshot-read/proposal.md
@@ -0,0 +1,26 @@
+## Why
+
+Current SQLite snapshot validation reconstructs the entire canonical graph payload even when callers only need metadata or integrity verification. On multi-gigabyte repositories this creates an avoidable payload-sized allocation at the same bounded limit that is intended to make failure safe.
+
+## What Changes
+
+- Add a manifest-only snapshot read that validates catalog metadata without touching payload chunks.
+- Add a chunk-streaming snapshot read that verifies bounded length and digest while delivering one stored chunk at a time.
+- Reimplement production validation and reference generation on the streaming path so both preserve corruption detection without retaining payload bytes.
+- Retain the existing full-payload `read_snapshot` API as an explicit compatibility path, implemented on top of streaming.
+- Add round-trip, reopen, corruption/interruption, and publication-atomicity regression coverage.
+- Document the allocation contract and record the release-visible change.
+
+## Capabilities
+
+### New Capabilities
+
+- `snapshot-streaming`: Bounded manifest-only and chunk-streaming access to current SQLite graph snapshots while preserving full-read compatibility and integrity semantics.
+
+### Modified Capabilities
+
+None.
+
+## Impact
+
+The change is owned by `crates/compass-store` and adds two public methods without removing or changing the existing `read_snapshot` signature. Production validation and snapshot-reference call sites stop allocating proportional to `payload_bytes`; serialized snapshot formats, stable identifiers, and dependency graphs remain unchanged. `CHANGELOG.md` records the additive API and memory-safety improvement; no user migration is required.
diff --git a/openspec/changes/archive/2026-08-28-stream-snapshot-read/specs/snapshot-streaming/spec.md b/openspec/changes/archive/2026-08-28-stream-snapshot-read/specs/snapshot-streaming/spec.md
new file mode 100644
index 000000000..65578a312
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-stream-snapshot-read/specs/snapshot-streaming/spec.md
@@ -0,0 +1,72 @@
+## Purpose
+
+Provide bounded manifest-only and chunk-streaming access to current SQLite graph snapshots while preserving integrity checks and the existing full-read compatibility contract.
+
+## ADDED Requirements
+
+### Requirement: Manifest-only snapshot reads
+The store SHALL expose a manifest-only read that validates the active snapshot manifest without reading or allocating storage for payload chunks.
+
+#### Scenario: Valid active manifest
+- **WHEN** a caller requests metadata for a valid active snapshot
+- **THEN** the store returns the validated manifest without reading its payload objects
+
+#### Scenario: Missing or invalid active manifest
+- **WHEN** the active catalog entry is missing, malformed, or violates the manifest contract
+- **THEN** the store returns the same typed corruption or format failure used by snapshot reads
+
+### Requirement: Bounded chunk-streaming reads
+The store SHALL expose a streaming read that delivers one bounded stored chunk at a time and SHALL validate chunk presence, total payload length, the maximum graph-byte limit, and the payload digest before reporting success. The API contract SHALL state that delivered chunks remain provisional until successful return so callers do not commit unverified bytes irreversibly.
+
+#### Scenario: Valid multi-chunk snapshot
+- **WHEN** a caller streams a valid snapshot containing more than one chunk
+- **THEN** every callback receives at most one stored chunk and the returned manifest matches the published snapshot
+
+#### Scenario: Missing or corrupt payload data
+- **WHEN** a chunk is missing, the accumulated length differs from the manifest, the configured bound is exceeded, or the digest differs
+- **THEN** the stream terminates with a typed non-empty error and does not report successful validation
+
+#### Scenario: Caller commits streamed content
+- **WHEN** a caller performs irreversible work using delivered chunks
+- **THEN** the API documentation directs it to stage the work until the stream returns success or independently verify it before commit
+
+#### Scenario: Consumer rejects a chunk
+- **WHEN** the consumer callback returns a typed error for a delivered chunk
+- **THEN** the store stops reading further chunks and returns that error
+
+### Requirement: Full-read compatibility
+The existing full-payload snapshot read SHALL retain its public signature and observable valid/corrupt behavior, while being implemented as an explicit collector over the bounded streaming path.
+
+#### Scenario: Existing caller requests full bytes
+- **WHEN** a caller invokes the full snapshot read for a valid snapshot
+- **THEN** the store returns the same manifest and byte sequence as the published payload
+
+#### Scenario: Existing caller reads corrupt data
+- **WHEN** a caller invokes the full snapshot read for a corrupt snapshot
+- **THEN** the store returns the same typed failure as the streaming validation path
+
+### Requirement: Production integrity checks avoid payload-sized allocation
+Snapshot validation and snapshot-reference generation SHALL preserve their existing success and failure semantics for valid and corrupt snapshots without allocating memory proportional to the manifest payload size.
+
+#### Scenario: Validate a valid snapshot
+- **WHEN** production validation is requested for a valid snapshot
+- **THEN** it verifies all chunks and returns the manifest without collecting the payload
+
+#### Scenario: Validate a corrupt snapshot
+- **WHEN** production validation is requested for a snapshot with corrupt or missing payload data
+- **THEN** it returns the same failure that the previous full-read validation returned
+
+#### Scenario: Generate a reference for corrupt payload data
+- **WHEN** snapshot-reference generation encounters a corrupt or missing payload chunk
+- **THEN** it rejects the snapshot rather than publishing a reference to unverified content
+
+### Requirement: Snapshot durability behavior remains atomic
+The additive read APIs SHALL preserve round-trip, reopen, interruption/corruption rejection, and atomic publication behavior of the existing SQLite snapshot format.
+
+#### Scenario: Reopen after successful publication
+- **WHEN** a published store is checkpointed and reopened read-only
+- **THEN** manifest-only, streaming, validation, reference, and full-read operations agree on snapshot identity and integrity
+
+#### Scenario: Interrupted candidate publication
+- **WHEN** immutable payload objects exist but the active selector was not atomically advanced
+- **THEN** every active-snapshot read continues to observe only the prior complete snapshot
diff --git a/openspec/changes/archive/2026-08-28-stream-snapshot-read/tasks.md b/openspec/changes/archive/2026-08-28-stream-snapshot-read/tasks.md
new file mode 100644
index 000000000..5815b097d
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-stream-snapshot-read/tasks.md
@@ -0,0 +1,16 @@
+## 1. Snapshot Read Contract
+
+- [x] 1.1 Complete the manifest-only and chunk-streaming APIs, retain the full-read signature, and route validation/reference production callers through one streaming verification pass; verify with focused valid and corrupt snapshot tests
+
+## 2. Durability and Compatibility Coverage
+
+- [x] 2.1 Add or strengthen round-trip, reopen, corruption/interruption, consumer-error, and active-publication atomicity tests; verify with `cargo test -p compass-store --locked`
+
+## 3. Documentation
+
+- [x] 3.1 Correct the store allocation contract and add a release-visible `CHANGELOG.md` entry, confirming that no `MIGRATION.md` action is required because the existing public signature is unchanged
+
+## 4. Verification
+
+- [x] 4.1 Run `cargo fmt --all -- --check`, `cargo test -p compass-store --locked`, and `cargo clippy -p compass-store --all-targets --all-features --locked -- -D warnings`
+- [x] 4.2 Run the repository Rust baseline, applicable product-boundary gate, and `compass update .`; record any check or graph-refresh failure before certification
diff --git a/openspec/changes/archive/2026-08-28-stream-snapshot-read/verification.md b/openspec/changes/archive/2026-08-28-stream-snapshot-read/verification.md
new file mode 100644
index 000000000..2902a473f
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-stream-snapshot-read/verification.md
@@ -0,0 +1,38 @@
+# Verification report — stream-snapshot-read
+
+Result: PASS
+
+## Completeness
+
+- All five OpenSpec tasks are complete.
+- Manifest-only, bounded chunk-streaming, compatibility full-read, production
+  validation/reference, and durability behavior are implemented.
+- The public `read_snapshot` signature and serialized store formats are unchanged.
+
+## Correctness
+
+- `cargo test -p compass-store --locked`: PASS (22 tests).
+- `cargo clippy -p compass-store --all-targets --all-features --locked -- -D warnings`: PASS.
+- `cargo fmt --all -- --check`: PASS.
+- Direct negative coverage includes missing, oversized, non-BLOB, short, and
+  same-length/digest-corrupt chunks, plus consumer failure and interrupted publication.
+
+## Coherence and repository gates
+
+- `openspec validate stream-snapshot-read --strict`: PASS.
+- `cargo clippy --workspace --lib --bins --locked -- -D warnings`: PASS.
+- `cargo test --workspace --lib --bins --locked`: PASS.
+- `sh scripts/check_product_boundary.sh`: PASS.
+- `node scripts/check_viewer_assets.mjs`: PASS.
+- `compass update .`: PASS (119,755 nodes, 281,524 edges; existing partial-graph
+  warning: 68 omitted edges, zero identity collisions).
+
+## Independent review
+
+- Final isolated adversarial diff review: PASS (0 critical, 0 warnings, 1 suggestion).
+- Sycophancy screen: PASS.
+- The remaining suggestion concerns preallocation in the explicitly opt-in
+  compatibility full-read path. The manifest is validated, the allocation is
+  locally capped at `MAX_GRAPH_BYTES`, and production paths use bounded streaming.
+
+No migration action is required.
diff --git a/openspec/changes/archive/2026-08-28-surreal-persistent-probes/.openspec.yaml b/openspec/changes/archive/2026-08-28-surreal-persistent-probes/.openspec.yaml
new file mode 100644
index 000000000..b87a491b6
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-surreal-persistent-probes/.openspec.yaml
@@ -0,0 +1,3 @@
+schema: spec-driven
+created: 2026-08-28
+skip_specs: true
diff --git a/openspec/changes/archive/2026-08-28-surreal-persistent-probes/design.md b/openspec/changes/archive/2026-08-28-surreal-persistent-probes/design.md
new file mode 100644
index 000000000..6838975cf
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-surreal-persistent-probes/design.md
@@ -0,0 +1,77 @@
+## Context
+
+See `proposal.md`. Both engines must run the identical persistent workload using
+the pinned 3.2.4 Rust SDK. SurrealKV is a beta embedded/local-first engine;
+RocksDB is the conservative on-disk comparison. Mem is excluded from acceptance.
+
+## Goals / Non-Goals
+
+**Goals:**
+
+- Produce replayable, deterministic input and expected-output vectors.
+- Verify identity, direction, multiplicity, provenance, confidence, generation
+  isolation, activation, dirty-shutdown behavior, ordering, and pagination.
+- Measure enough dependency and resource cost to expose cheap disqualifiers.
+- Leave the Compass dependency graph and default binary unchanged.
+
+**Non-Goals:**
+
+- Create a production abstraction, schema migration, CLI, or MCP surface.
+- Compare results against budgets that C-013 has not yet ratified.
+- Treat successful probes as license approval or release authorization.
+
+## Decisions
+
+### One engine-neutral vector
+
+The retained vector uses stable string IDs, two directed parallel relations
+between the same endpoints, exact provenance fields, confidence encoded as a
+finite decimal, two immutable generations, and enough generated relations to
+exercise multi-page ordering. Both engines must produce the same canonical JSON.
+
+### Application-level generation activation
+
+Candidate records are written under a generation ID. Readers first resolve one
+active-generation pointer and then scope every record query to it. Activation is
+a final transaction that updates only the pointer. A killed writer may leave an
+incomplete candidate generation, but it must not change the visible active
+generation. This matches Compass's immutable-publication model.
+
+### Dirty shutdown is an OS-process probe
+
+The child process opens the persistent engine, writes a candidate in bounded
+batches, emits a readiness marker after durable candidate work begins, and waits
+before activation. The parent terminates the child at that marker, reopens the
+same database, and verifies the previous generation exactly. This avoids treating
+a normal Rust error return as crash-recovery evidence.
+
+### Ordering and pagination are explicit
+
+Queries order by stable record ID and use a fixed page size. Concatenated pages
+must equal one canonical sorted result with no duplicate or missing record. No
+storage-engine iteration order is trusted.
+
+### Measurements are descriptive
+
+For each feature-isolated release build, record clean build wall time, executable
+bytes, resolved-package count, cold-start wall time, workload wall time, and peak
+RSS using the host's native timing tool. C-012 reports values but does not ratify
+budgets or make performance claims.
+
+### Disposal is part of the gate
+
+The temporary project and its dedicated Cargo target directories are removed
+after the report is generated. Repository verification must prove that root
+manifests and `Cargo.lock` contain no SurrealDB packages.
+
+## Risks / Trade-offs
+
+- **Persistent engine build exceeds local resources** → Record the exact failure
+  as a failed probe rather than substituting Mem.
+- **Crash timing is nondeterministic** → Use an explicit child readiness marker
+  before termination and verify the old active generation, not the amount of
+  orphaned candidate data.
+- **Float rendering obscures equality** → Compare a canonical finite decimal
+  representation in retained output.
+- **Host measurements are not portable benchmarks** → Record host/tool/version
+  metadata and treat values as a baseline, not a universal claim.
diff --git a/openspec/changes/archive/2026-08-28-surreal-persistent-probes/files.txt b/openspec/changes/archive/2026-08-28-surreal-persistent-probes/files.txt
new file mode 100644
index 000000000..919839847
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-surreal-persistent-probes/files.txt
@@ -0,0 +1,13 @@
+docs/future/compass-surrealdb-mcp-skills-research.md
+docs/future/surreal-persistent-probe-results.md
+scripts/fixtures/surreal-persistent-probes/SURREALDB-3.2.4-LICENSE.txt
+scripts/fixtures/surreal-persistent-probes/expected-v1.json
+scripts/fixtures/surreal-persistent-probes/input-v1.json
+scripts/fixtures/surreal-persistent-probes/manifest-v1.json
+scripts/fixtures/surreal-persistent-probes/rocksdb-result-v1.json
+scripts/fixtures/surreal-persistent-probes/surrealkv-result-v1.json
+openspec/changes/surreal-persistent-probes/.openspec.yaml
+openspec/changes/surreal-persistent-probes/design.md
+openspec/changes/surreal-persistent-probes/proposal.md
+openspec/changes/surreal-persistent-probes/tasks.md
+openspec/changes/surreal-persistent-probes/verification.md
diff --git a/openspec/changes/archive/2026-08-28-surreal-persistent-probes/proposal.md b/openspec/changes/archive/2026-08-28-surreal-persistent-probes/proposal.md
new file mode 100644
index 000000000..9340e32c8
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-surreal-persistent-probes/proposal.md
@@ -0,0 +1,36 @@
+## Why
+
+SurrealDB's in-memory examples cannot establish whether its persistent embedded
+engines preserve Compass identities, relations, generation activation, recovery,
+ordering, and resource bounds. Disposable SurrealKV and RocksDB probes must
+produce that evidence before any production adapter is considered.
+
+## What Changes
+
+- Version deterministic graph and recovery test vectors plus their expected
+  canonical results.
+- Build an external throwaway Rust probe pinned to SurrealDB 3.2.4 and run the
+  same workload against persistent SurrealKV and RocksDB.
+- Record semantic, dirty-shutdown, ordering, pagination, dependency, build-time,
+  binary-size, cold-start, peak-RSS, and license evidence.
+- Delete the spike and its build outputs, retaining only reviewable vectors and
+  results; leave no SurrealDB workspace dependency.
+- Record an explicit pass/fail gate for later SurrealDB waves.
+
+## Capabilities
+
+### New Capabilities
+
+None. This is a disposable evaluation and evidence change, not shipped product
+behavior; `.openspec.yaml` opts out of delta specs.
+
+### Modified Capabilities
+
+None.
+
+## Impact
+
+The retained artifacts live under `scripts/fixtures/surreal-persistent-probes/`
+and `docs/future/`. Temporary code and Cargo output remain outside the workspace
+and are removed after measurement. A failed required dimension cancels C-014,
+C-015, and the Surreal branch of C-020 without changing the current stack.
diff --git a/openspec/changes/archive/2026-08-28-surreal-persistent-probes/tasks.md b/openspec/changes/archive/2026-08-28-surreal-persistent-probes/tasks.md
new file mode 100644
index 000000000..24869a25c
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-surreal-persistent-probes/tasks.md
@@ -0,0 +1,14 @@
+## 1. Reproducible Probe Surface
+
+- [x] 1.1 Add versioned deterministic input and expected-output vectors covering parallel directed relations, stable IDs, provenance, confidence, generations, and pagination; verify vector schema and canonical bytes
+- [x] 1.2 Create a disposable non-workspace SurrealDB 3.2.4 runner with feature-isolated SurrealKV and RocksDB builds; verify the temporary manifests never modify Compass manifests or lockfile
+
+## 2. Persistent Engine Qualification
+
+- [x] 2.1 Run the complete persistent workload and dirty-shutdown recovery probe on SurrealKV; record semantic and recovery pass/fail evidence plus measurements
+- [x] 2.2 Run the identical workload and dirty-shutdown recovery probe on RocksDB; record semantic and recovery pass/fail evidence plus measurements
+
+## 3. Disposition and Completion
+
+- [x] 3.1 Compare engine outputs, capture the exact pinned license evidence, delete all spike code/build outputs, and record the Wave 5 pass/fail disposition while verifying the Compass dependency graph remains clean
+- [x] 3.2 Validate and refine the retained artifacts, perform mandatory adversarial review, synchronize any applicable documentation, and archive the OpenSpec change
diff --git a/openspec/changes/archive/2026-08-28-surreal-persistent-probes/verification.md b/openspec/changes/archive/2026-08-28-surreal-persistent-probes/verification.md
new file mode 100644
index 000000000..4875cf670
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-surreal-persistent-probes/verification.md
@@ -0,0 +1,68 @@
+# Verification: SurrealDB persistent-engine probes
+
+## Result
+
+PASS for C-012's disposable persistent-engine semantic, recovery, measurement,
+license-capture, and cleanup contract. This does not approve the BSL profile or
+ratify performance budgets; C-011 and C-013 remain separate gates.
+
+## Requirement evidence
+
+- `input-v1.json` and `expected-v1.json` define 2,051 directed relations with
+  stable logical IDs, a same-endpoint parallel pair, a reverse edge, exact
+  provenance/confidence, two generations, and 17 deterministic pages.
+- Feature-isolated SurrealDB 3.2.4 builds selected SurrealKV without RocksDB and
+  RocksDB without SurrealKV, using distinct non-workspace target directories.
+- Both persistent engines emitted byte-identical canonical semantic summaries.
+  Candidate writes left `g-0001` active until the final activation pointer
+  changed to `g-0002`.
+- For each engine, the writer was terminated after one durable candidate batch
+  and before activation. Reopen preserved the complete active `g-0001` result.
+- Clean build, executable size, dependency, workload, cold-start, and RSS values
+  are retained as descriptive host baselines, not performance claims.
+- The retained BSL file is byte-identical to the official `v3.2.4` license and
+  its pinned SHA-256 is verified.
+- The disposable Cargo project, targets, databases, and raw logs were deleted.
+  Compass manifests and `Cargo.lock` stayed byte-identical and contain no
+  SurrealDB package.
+
+## Verification performed
+
+- Strict JSON/schema assertions for every retained vector and result: passed.
+- Manifest SHA-256 verification for every retained file: passed.
+- Independent ordered-ID SHA-256 derivation: matched both engine results.
+- Independently expanded all 2,051 relations from the retained rule; canonical
+  compact JSON SHA-256 matched the pinned expected value
+  `749489773e9e0329852a9e025222722af46f68bb1cfb3f4c647e17cdff9b2261`.
+- Retained post-crash count and ordered-ID digest for both engines: matched the
+  complete active `g-0001` expectation.
+- Canonical `.semantic` comparison across SurrealKV/RocksDB: byte-identical.
+- Official tagged license byte comparison: identical; SHA-256
+  `98a94ac615f88370865016487b436fa404560910bd329794ed7502277a94b805`.
+- Pre/post Compass manifest and `Cargo.lock` checksum ledgers: identical. Each
+  ledger contains 33 sorted manifest hashes plus the lockfile hash and has
+  SHA-256 `a98ca39857724b88a12a306b6647299ff93fed69f4c881bee54fddc230b45e6c`.
+- Workspace dependency search for `surrealdb`/`surrealdb-core`: no match.
+- `openspec validate surreal-persistent-probes --strict`: passed.
+- `git diff --check` for the change surface: passed.
+- `scripts/check_product_boundary.sh`: passed.
+- `compass update .`: passed with 713 files, 121,261 nodes, 285,681
+  edges, 3,389 communities, 68 omitted invalid edges, and zero identity
+  collisions.
+
+## Qualification status
+
+Deterministic artifact refinement uses the repository's established fallback
+record because the installed artifact-refiner adapter lacks its referenced
+canonical controllers and schema assets. Mandatory adversarial review and the
+final graph refresh are recorded before archive.
+
+The isolated `k3` review passed with no critical findings. Its four warnings
+were resolved by retaining the exact scale-edge rule, independent expected
+digests, post-crash count/digest evidence, and the manifest/lock checksum-ledger
+digest. Its link suggestion was verified against the existing C-011 decision
+record at `docs/future/surrealdb-license-decision.md`.
+
+The workspace Rust clippy/test baseline was already green immediately before
+C-012 and remains applicable because this change adds no Rust source,
+dependency, manifest, lockfile, or shipped product behavior.
diff --git a/openspec/changes/archive/2026-08-28-vendor-skip-policy/.openspec.yaml b/openspec/changes/archive/2026-08-28-vendor-skip-policy/.openspec.yaml
new file mode 100644
index 000000000..7f2cf9bc0
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-vendor-skip-policy/.openspec.yaml
@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-08-28
diff --git a/openspec/changes/archive/2026-08-28-vendor-skip-policy/design.md b/openspec/changes/archive/2026-08-28-vendor-skip-policy/design.md
new file mode 100644
index 000000000..1d6ada5aa
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-vendor-skip-policy/design.md
@@ -0,0 +1,19 @@
+# Design: vendor discovery policy
+
+## Decision
+
+Leave `vendor/` out of the built-in skip list.
+
+## Rationale
+
+- **Skip** would silently remove real, build-relevant Go source and change graph
+  identity for existing users.
+- **Skip unless workspace member** is ecosystem-specific: Rust workspace
+  membership does not describe Go vendor packages or other valid vendored source,
+  and generic discovery must not depend on parsing one build system first.
+- **Leave and allow explicit exclusion** preserves compatibility and uses the
+  existing deterministic scope controls: `.compassignore`, saved project scope,
+  and `--exclude`.
+
+The behavior applies equally to initial discovery and filesystem watchers. This
+change records and tests the policy; it does not introduce a new heuristic.
diff --git a/openspec/changes/archive/2026-08-28-vendor-skip-policy/files.txt b/openspec/changes/archive/2026-08-28-vendor-skip-policy/files.txt
new file mode 100644
index 000000000..e023f3590
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-vendor-skip-policy/files.txt
@@ -0,0 +1,9 @@
+crates/compass-files/tests/contracts.rs
+crates/compass-core/tests/vendor_policy.rs
+docs/reference/configuration.md
+openspec/changes/vendor-skip-policy/.openspec.yaml
+openspec/changes/vendor-skip-policy/proposal.md
+openspec/changes/vendor-skip-policy/design.md
+openspec/changes/vendor-skip-policy/specs/vendor-discovery-policy/spec.md
+openspec/changes/vendor-skip-policy/tasks.md
+openspec/changes/vendor-skip-policy/verification.md
diff --git a/openspec/changes/archive/2026-08-28-vendor-skip-policy/proposal.md b/openspec/changes/archive/2026-08-28-vendor-skip-policy/proposal.md
new file mode 100644
index 000000000..216aa4677
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-vendor-skip-policy/proposal.md
@@ -0,0 +1,18 @@
+# Proposal: retain explicit vendor exclusions
+
+## Why
+
+The name `vendor/` does not reliably mean generated or disposable content.
+Go repositories keep build-relevant source there, and Rust workspaces may make
+a vendored package an explicit member.
+
+## What Changes
+
+- Deliberately retain the existing policy: `vendor/` is discovered by default.
+- Document explicit `vendor/**` exclusion through project scope or
+  `.compassignore` for repositories that do not want that source indexed.
+- Pin build and watcher behavior for both a workspace member and Go vendor source.
+
+## Compatibility
+
+This decision preserves current discovery scope. No migration action is needed.
diff --git a/openspec/changes/archive/2026-08-28-vendor-skip-policy/specs/vendor-discovery-policy/spec.md b/openspec/changes/archive/2026-08-28-vendor-skip-policy/specs/vendor-discovery-policy/spec.md
new file mode 100644
index 000000000..60f7a7796
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-vendor-skip-policy/specs/vendor-discovery-policy/spec.md
@@ -0,0 +1,34 @@
+# Vendor discovery policy
+
+## ADDED Requirements
+
+### Requirement: vendor source is eligible by default
+
+Compass SHALL NOT exclude a directory solely because its name is `vendor`.
+
+#### Scenario: discover workspace and Go vendor source
+
+- **WHEN** default discovery scans Rust workspace-member source and Go source
+  beneath `vendor/`
+- **THEN** both sources are eligible for classification and publication
+
+### Requirement: vendor exclusion remains explicit
+
+Compass SHALL apply configured or command-line `vendor/**` exclusions through
+the existing scope and ignore contracts.
+
+#### Scenario: repository opts out of vendor source
+
+- **WHEN** the repository configures `vendor/**` in project scope,
+  `.compassignore`, or `--exclude`
+- **THEN** matching vendored source is excluded deterministically
+
+### Requirement: watcher parity
+
+Filesystem watching SHALL use the same default vendor eligibility as discovery.
+
+#### Scenario: vendor source changes
+
+- **WHEN** an otherwise eligible file beneath `vendor/` changes
+- **THEN** the watcher allows the event unless an explicit ignore or scope rule
+  excludes it
diff --git a/openspec/changes/archive/2026-08-28-vendor-skip-policy/tasks.md b/openspec/changes/archive/2026-08-28-vendor-skip-policy/tasks.md
new file mode 100644
index 000000000..a755c160a
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-vendor-skip-policy/tasks.md
@@ -0,0 +1,11 @@
+## 1. Decision
+
+- [x] 1.1 Record the deliberate leave-and-explicitly-exclude policy
+
+## 2. Regression
+
+- [x] 2.1 Pin discovery, publication, and watcher behavior for vendor source
+
+## 3. Verification
+
+- [x] 3.1 Run focused/workspace gates, deterministic QA, and graph refresh
diff --git a/openspec/changes/archive/2026-08-28-vendor-skip-policy/verification.md b/openspec/changes/archive/2026-08-28-vendor-skip-policy/verification.md
new file mode 100644
index 000000000..66613367a
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-vendor-skip-policy/verification.md
@@ -0,0 +1,33 @@
+# Verification: vendor skip policy
+
+## Result
+
+PASS for the deliberate leave-and-explicitly-exclude policy.
+
+## Evidence
+
+- The focused vendor discovery/watcher regression passes, including every
+  documented explicit exclusion surface.
+- `cargo test -p compass-core --test vendor_policy --locked`: the build-level
+  regression proves Rust and Go vendor sources are classified and published by
+  default, then omitted by `.compassignore`, `extra_excludes` (the core form of
+  CLI `--exclude`), and saved `BuildScope` exclusion.
+- `cargo clippy -p compass-core --test vendor_policy --locked -- -D warnings`:
+  passed.
+- `cargo test -p compass-files --locked`: 43 tests passed across unit,
+  contracts, and project-scope suites.
+- `cargo clippy -p compass-files --lib --locked -- -D warnings`: passed.
+- `cargo fmt --all -- --check`: passed.
+- `cargo clippy --workspace --lib --bins --locked -- -D warnings`: passed.
+- `cargo test --workspace --lib --bins --locked`: passed.
+- `sh scripts/check_product_boundary.sh`: passed.
+- `openspec validate vendor-skip-policy --strict`: passed.
+- `git diff --check`: passed.
+- `compass update .`: 119,880 nodes, 281,907 edges, 68 pre-existing omitted
+  edges, zero identity collisions.
+
+`cargo clippy -p compass-files --all-targets --all-features --locked -- -D
+warnings` was also attempted. It reaches two pre-existing test-target lints in
+`src/cache.rs` and `tests/contracts.rs` outside the new regression. The required
+repository lib/bin Clippy baseline passes; this change does not alter or suppress
+those unrelated all-target findings.
diff --git a/openspec/changes/archive/2026-08-29-distribution-inventory-generators/design.md b/openspec/changes/archive/2026-08-29-distribution-inventory-generators/design.md
new file mode 100644
index 000000000..d4eb07c65
--- /dev/null
+++ b/openspec/changes/archive/2026-08-29-distribution-inventory-generators/design.md
@@ -0,0 +1,13 @@
+# Design
+
+`distribution.toml` is the only package identity, harness-version, manifest
+path, and plugin-API inventory. The CLI parses it at runtime from an embedded
+copy, rejects unsupported schemas or non-portable paths, combines it with the
+real embedded skill files, and generates harness-native JSON plus the OpenCode
+TypeScript bridge. A sorted digest manifest closes over the staged output
+before atomic publication.
+
+Codex and Claude packages use their current plugin manifests and local
+marketplace catalogs. OpenCode uses a workspace TypeScript package and exact
+plugin API dependency; it may emit MCP configuration but contains no graph
+logic. Validation is bounded and never executes bundle content.
diff --git a/openspec/changes/archive/2026-08-29-distribution-inventory-generators/files.txt b/openspec/changes/archive/2026-08-29-distribution-inventory-generators/files.txt
new file mode 100644
index 000000000..26eaeedfc
--- /dev/null
+++ b/openspec/changes/archive/2026-08-29-distribution-inventory-generators/files.txt
@@ -0,0 +1,10 @@
+distribution.toml
+package-lock.json
+crates/compass-cli/src/agent_commands.rs
+crates/compass-cli/src/distribution.rs
+crates/compass-cli/src/lib.rs
+crates/compass-cli/tests/agent_cli.rs
+packages/compass-opencode
+tools/skillgen/mod.rs
+docs/implementation/agent-distribution.md
+openspec/changes/distribution-inventory-generators
diff --git a/openspec/changes/archive/2026-08-29-distribution-inventory-generators/proposal.md b/openspec/changes/archive/2026-08-29-distribution-inventory-generators/proposal.md
new file mode 100644
index 000000000..3f5dfc5ea
--- /dev/null
+++ b/openspec/changes/archive/2026-08-29-distribution-inventory-generators/proposal.md
@@ -0,0 +1,9 @@
+# Proposal: Native distribution inventory and generators
+
+Compass currently exports portable skills and MCP fragments, but native Codex,
+Claude Code, and OpenCode distribution metadata is not owned by one versioned
+contract. Add a canonical inventory and deterministic generators so every
+harness receives complete, portable, version-recorded packages.
+
+This is additive. Existing `compass install`, skill locations, and generic
+Agent Skills exports remain compatible.
diff --git a/openspec/changes/archive/2026-08-29-distribution-inventory-generators/specs/agent-distribution/spec.md b/openspec/changes/archive/2026-08-29-distribution-inventory-generators/specs/agent-distribution/spec.md
new file mode 100644
index 000000000..266ee8120
--- /dev/null
+++ b/openspec/changes/archive/2026-08-29-distribution-inventory-generators/specs/agent-distribution/spec.md
@@ -0,0 +1,45 @@
+# Agent distribution specification
+
+## Purpose
+
+Defines deterministic, native package exports that let supported agent
+harnesses install Compass skills and MCP configuration from one canonical
+inventory without duplicating graph behavior.
+
+## ADDED Requirements
+
+### Requirement: Canonical deterministic inventory
+
+Compass SHALL generate every native harness package from one versioned
+`distribution.toml` inventory. Equivalent inventory and embedded skills SHALL
+produce byte-identical files in stable path order.
+
+#### Scenario: Repeat generation
+
+- **WHEN** the same Compass binary exports a platform package twice
+- **THEN** every path and byte SHALL be identical
+
+### Requirement: Native complete packages
+
+Codex SHALL receive its plugin manifest, marketplace, `.mcp.json`, and copied
+skills. Claude Code SHALL receive its plugin manifest, required marketplace,
+`.mcp.json`, and copied skills. OpenCode SHALL receive its npm manifest,
+configuration, JavaScript artifact generated from the checked TypeScript
+plugin source, and copied skills.
+
+#### Scenario: Native validation
+
+- **WHEN** an exported package is validated for its declared platform
+- **THEN** missing native artifacts, missing harness versions, unsafe paths,
+  symlinks, credentials, and checksum mismatches SHALL fail closed
+
+### Requirement: Thin OpenCode bridge
+
+The OpenCode plugin MAY register MCP configuration tools but SHALL NOT contain
+graph persistence, traversal, ranking, or query behavior.
+
+#### Scenario: Bridge responsibility boundary
+
+- **WHEN** the generated OpenCode plugin is inspected and loaded
+- **THEN** it SHALL configure the native Compass MCP server without implementing
+  a second graph or query engine
diff --git a/openspec/changes/archive/2026-08-29-distribution-inventory-generators/tasks.md b/openspec/changes/archive/2026-08-29-distribution-inventory-generators/tasks.md
new file mode 100644
index 000000000..9dfd2c6e3
--- /dev/null
+++ b/openspec/changes/archive/2026-08-29-distribution-inventory-generators/tasks.md
@@ -0,0 +1,15 @@
+# Tasks
+
+## 1. Inventory and generators
+
+- [x] 1.1 Add the canonical inventory, native manifest generators, complete skill copying, deterministic digest closure, and atomic publication
+- [x] 1.2 Add the workspace OpenCode TypeScript plugin pinned to the current plugin API without graph logic
+
+## 2. Contracts and documentation
+
+- [x] 2.1 Extend bounded validation for native artifacts, harness versions, paths, credentials, symlinks, and checksums
+- [x] 2.2 Document package shapes, ownership, compatibility, and release behavior
+
+## 3. Phase-end integration verification
+
+- [x] 3.1 Run deterministic export, native validator, installed-artifact lifecycle, JavaScript, and workspace integration gates after all phase production code is complete
diff --git a/openspec/changes/archive/2026-08-29-harness-install-validation/design.md b/openspec/changes/archive/2026-08-29-harness-install-validation/design.md
new file mode 100644
index 000000000..34e97fbfa
--- /dev/null
+++ b/openspec/changes/archive/2026-08-29-harness-install-validation/design.md
@@ -0,0 +1,12 @@
+# Design
+
+One bounded integration harness creates isolated home/config directories,
+exports each package with the built Compass binary, invokes the installed
+harness validator/installer, verifies discovery and MCP registration, performs
+an upgrade, and uninstalls. A user-authored sentinel outside each managed
+package must survive. Logs are redacted and bounded; no credentials or remote
+model calls are permitted.
+
+The qualification consumes installed artifacts, never source templates. CI
+runs it after the normal phase-end integration build and the OpenCode
+workspace JavaScript gates.
diff --git a/openspec/changes/archive/2026-08-29-harness-install-validation/files.txt b/openspec/changes/archive/2026-08-29-harness-install-validation/files.txt
new file mode 100644
index 000000000..ce292e567
--- /dev/null
+++ b/openspec/changes/archive/2026-08-29-harness-install-validation/files.txt
@@ -0,0 +1,5 @@
+.github/workflows/compass-ci.yml
+scripts/bounded_redacted_log.mjs
+scripts/qualify_harness_packages.sh
+docs/implementation/agent-distribution.md
+openspec/changes/harness-install-validation
diff --git a/openspec/changes/archive/2026-08-29-harness-install-validation/proposal.md b/openspec/changes/archive/2026-08-29-harness-install-validation/proposal.md
new file mode 100644
index 000000000..36fefaac9
--- /dev/null
+++ b/openspec/changes/archive/2026-08-29-harness-install-validation/proposal.md
@@ -0,0 +1,6 @@
+# Proposal: Installed harness lifecycle qualification
+
+Source-template validation cannot prove that a real harness discovers, loads,
+upgrades, and removes the generated artifact safely. Add isolated lifecycle
+qualification against named Codex, Claude Code, and OpenCode versions, using
+only exported packages and credential-free local MCP fixtures.
diff --git a/openspec/changes/archive/2026-08-29-harness-install-validation/specs/harness-lifecycle/spec.md b/openspec/changes/archive/2026-08-29-harness-install-validation/specs/harness-lifecycle/spec.md
new file mode 100644
index 000000000..61a52510d
--- /dev/null
+++ b/openspec/changes/archive/2026-08-29-harness-install-validation/specs/harness-lifecycle/spec.md
@@ -0,0 +1,32 @@
+# Harness lifecycle specification
+
+## Purpose
+
+Defines isolated installed-artifact qualification so Compass can prove native
+agent packages survive complete harness lifecycles without altering user-owned
+state.
+
+## ADDED Requirements
+
+### Requirement: Installed-artifact evidence
+
+Each native package SHALL be qualified against the exact harness version
+recorded in `distribution.toml`. Export, install, discovery, load, MCP
+configuration, upgrade, and uninstall SHALL operate on the generated artifact.
+
+#### Scenario: Complete isolated lifecycle
+
+- **WHEN** the phase-end harness runs in isolated configuration roots
+- **THEN** every stage SHALL pass without credentials, network model calls, or
+  access to a source template
+
+### Requirement: Ownership preservation
+
+Upgrade and uninstall SHALL alter only harness-managed package files and
+configuration entries. User-authored instructions and unrelated plugins SHALL
+remain byte-identical.
+
+#### Scenario: User sentinel
+
+- **WHEN** a sentinel instruction exists beside managed harness state
+- **THEN** install, upgrade, and uninstall SHALL preserve its bytes
diff --git a/openspec/changes/archive/2026-08-29-harness-install-validation/tasks.md b/openspec/changes/archive/2026-08-29-harness-install-validation/tasks.md
new file mode 100644
index 000000000..347a414dd
--- /dev/null
+++ b/openspec/changes/archive/2026-08-29-harness-install-validation/tasks.md
@@ -0,0 +1,11 @@
+# Tasks
+
+## 1. Lifecycle harness
+
+- [x] 1.1 Add isolated Codex, Claude Code, and OpenCode installed-artifact lifecycle qualification with named-version enforcement and bounded redacted logs
+- [x] 1.2 Cover complete skill discovery, MCP configuration/load, upgrade, uninstall, and user-owned sentinel preservation
+
+## 2. CI and documentation
+
+- [x] 2.1 Wire the lifecycle and OpenCode JavaScript integration gates into CI after the phase-end production implementation
+- [x] 2.2 Document installed-artifact evidence and ownership boundaries
diff --git a/openspec/changes/archive/2026-08-29-mcp-conformance-interop/.openspec.yaml b/openspec/changes/archive/2026-08-29-mcp-conformance-interop/.openspec.yaml
new file mode 100644
index 000000000..7f2cf9bc0
--- /dev/null
+++ b/openspec/changes/archive/2026-08-29-mcp-conformance-interop/.openspec.yaml
@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-08-28
diff --git a/openspec/changes/archive/2026-08-29-mcp-conformance-interop/design.md b/openspec/changes/archive/2026-08-29-mcp-conformance-interop/design.md
new file mode 100644
index 000000000..55bcd451b
--- /dev/null
+++ b/openspec/changes/archive/2026-08-29-mcp-conformance-interop/design.md
@@ -0,0 +1,77 @@
+# Design: MCP conformance and client interoperability
+
+## Qualification boundary
+
+The independent reference is `modelcontextprotocol/conformance` at commit
+`74edef34d674f563537be8c6587cebaa58e830ca` (package version
+`0.2.0-alpha.11`). The released npm package `0.1.16` is deliberately not used:
+it predates the 2026-07-28 scenarios. CI fetches the exact commit and runs the
+applicable stateless, discovery/listing, resource-error, DNS-rebinding, and
+standard-header scenarios at `--spec-version 2026-07-28`; moving the pin or the
+scenario set is a reviewed change.
+
+The official runner accepts an HTTP URL but has no stdio-server mode. HTTP is
+therefore checked directly by that runner. Stdio is checked by a native Rust
+conformance test using the same server handler through a bounded duplex stream;
+it verifies initialization/discovery, the exact ordered tool and resource lists, one
+real typed Compass invocation, protocol errors, and clean shutdown. The two
+legs are named separately in CI so neither can disappear behind the other.
+The production stdio and HTTP services advertise only 2026-07-28; the stdio
+leg also proves that a legacy initialize request is rejected.
+
+The official suite contains diagnostic fixture checks whose named tools are
+not product requirements. Compass does not expose test-only protocol methods
+in production merely to impersonate the suite's everything-server fixture.
+Those individual checks are recorded in a narrow expected-failure file; no
+whole scenario is baselined. Any transport, wire-schema, routing, or advertised
+capability failure remains a blocking failure.
+
+Four expected failures are matched by check identifier because they require
+diagnostic tools or streamed behaviors Compass does not advertise, so they are
+not evidence for product capabilities. The fifth calls the first real Compass
+tool with `{}`; after the run, the qualification script requires that exact
+entry to be HTTP 400 / JSON-RPC `-32602` from invalid tool arguments. A changed
+cause, including a header-mismatch regression, fails the gate. None is claimed
+as independent evidence for the behavior named by its runner check. Native
+coverage pins every behavior Compass does claim, including end-to-end optional-
+whitespace normalization; the remaining reference-runner coverage gaps stay
+explicit until it can supply valid product arguments.
+
+## Named-client matrix
+
+Interop runs against these installed, exact client versions:
+
+| Client | Version | Stdio | HTTP |
+| --- | --- | --- | --- |
+| Codex CLI | `0.150.1` | discover + invoke | discover + invoke |
+| Claude Code | `2.1.251` | discover + invoke | discover + invoke |
+| OpenCode | `1.18.25` | discover + invoke | discover + invoke |
+
+Each run uses a temporary home/config directory and the local Compass graph.
+Configuration-only success is insufficient: the receipt must identify a real
+Compass tool and contain evidence from its returned payload. Credentials are
+inherited only through the client's supported authentication boundary and are
+never copied into repository artifacts. Logs are sanitized before a stable
+matrix is recorded.
+
+## Gate behavior
+
+The latest published MCP revision and both CI conformance legs are the normative
+merge gate. The named-client matrix is required release evidence, but a client
+that implements an older MCP revision is recorded as incompatible rather than
+forcing Compass to reintroduce removed protocol behavior. A regression in a
+previously passing client cell or a failure caused by Compass deviating from the
+latest protocol remains blocking. Unavailable credentials or a missing named
+binary are reported as not measured, never as a pass.
+
+## Observed gate status
+
+The 2026-08-28 run passed both transports in Codex CLI 0.150.1 and Claude Code
+2.1.251, and passed stdio in OpenCode 1.18.25. OpenCode's HTTP cell is
+incompatible because that client sends `initialize` with protocol `2025-11-25`
+before falling back to the removed GET stream. The same behavior was reproduced
+in the day's dev build, whose source still depends on MCP SDK 1.29.0 and contains
+no 2026 protocol opt-in. Compass correctly rejects that lifecycle under the
+C-008 2026-only contract. On 2026-08-29 the user explicitly chose the latest MCP
+revision as the governing requirement, so this observed older-client limitation
+does not hold C-010 or Wave 3.
diff --git a/openspec/changes/archive/2026-08-29-mcp-conformance-interop/files.txt b/openspec/changes/archive/2026-08-29-mcp-conformance-interop/files.txt
new file mode 100644
index 000000000..dee7b35c4
--- /dev/null
+++ b/openspec/changes/archive/2026-08-29-mcp-conformance-interop/files.txt
@@ -0,0 +1,29 @@
+.github/workflows/compass-ci.yml
+CHANGELOG.md
+COMPATIBILITY.md
+MIGRATION.md
+crates/compass-mcp/src/lib.rs
+crates/compass-mcp/tests/protocol_conformance.rs
+crates/compass-mcp/src/transport.rs
+docs/implementation/mcp-conformance-and-interop.md
+docs/reference/compatibility.md
+scripts/fixtures/mcp-conformance-expected-failures.yaml
+scripts/fixtures/mcp-conformance-project/src/lib.rs
+scripts/qualify_codex_mcp_client.py
+scripts/qualify_mcp_conformance.sh
+openspec/changes/mcp-conformance-interop/.openspec.yaml
+openspec/changes/mcp-conformance-interop/design.md
+openspec/changes/mcp-conformance-interop/files.txt
+openspec/changes/mcp-conformance-interop/proposal.md
+openspec/changes/mcp-conformance-interop/specs/mcp-conformance/spec.md
+openspec/changes/mcp-conformance-interop/tasks.md
+openspec/changes/mcp-conformance-interop/verification.md
+openspec/specs/mcp-conformance/spec.md
+.refiner/artifacts/C-010/artifact_manifest.json
+.refiner/artifacts/C-010/constraints.json
+.refiner/artifacts/C-010/decisions.md
+.refiner/artifacts/C-010/dist/refinement-receipt.md
+.refiner/artifacts/C-010/refinement_log.md
+.kbd-orchestrator/phases/compass-scoping-and-bounds/plan.md
+.kbd-orchestrator/phases/compass-scoping-and-bounds/execution.md
+.kbd-orchestrator/phases/compass-scoping-and-bounds/decision-log.md
diff --git a/openspec/changes/archive/2026-08-29-mcp-conformance-interop/proposal.md b/openspec/changes/archive/2026-08-29-mcp-conformance-interop/proposal.md
new file mode 100644
index 000000000..1552c12cc
--- /dev/null
+++ b/openspec/changes/archive/2026-08-29-mcp-conformance-interop/proposal.md
@@ -0,0 +1,30 @@
+# Proposal: gate latest MCP on conformance and record named-client interoperability
+
+## Why
+
+Compass now exposes a stateless MCP 2026-07-28 HTTP transport and typed tool
+results, but repository tests alone do not prove that the wire contract passes
+the independent MCP conformance runner or that real coding-agent clients can
+discover and invoke the server.
+
+## What Changes
+
+- Add a deterministic transport-conformance suite covering stdio and HTTP.
+- Run the official MCP conformance runner against HTTP at an exact upstream
+  commit that includes the frozen 2026-07-28 requirements.
+- Add CI coverage that fails on a conformance regression rather than carrying
+  an unreviewed expected-failure baseline.
+- Record actual discovery and tool-invocation outcomes for exact versions of
+  Codex CLI, Claude Code, and OpenCode using isolated temporary configuration.
+- Treat the latest published MCP revision and its independent conformance suite
+  as the normative merge gate. Record clients that implement an older revision
+  as incompatible without weakening Compass to their obsolete lifecycle.
+
+## Compatibility
+
+The test and CI additions do not rename tools or alter successful result
+payloads. Any production wire correction found by conformance is
+compatibility-sensitive. Both stdio and HTTP require the latest published MCP
+behavior, currently 2026-07-28, while retaining the existing tool, resource,
+and successful-result contracts. Compass does not add a legacy transport
+fallback for lagging clients.
diff --git a/openspec/changes/archive/2026-08-29-mcp-conformance-interop/specs/mcp-conformance/spec.md b/openspec/changes/archive/2026-08-29-mcp-conformance-interop/specs/mcp-conformance/spec.md
new file mode 100644
index 000000000..14bec5a68
--- /dev/null
+++ b/openspec/changes/archive/2026-08-29-mcp-conformance-interop/specs/mcp-conformance/spec.md
@@ -0,0 +1,67 @@
+# mcp-conformance Specification
+
+## Purpose
+
+Defines how Compass proves current Model Context Protocol conformance across its
+supported transports and records real-client interoperability without weakening
+the normative protocol contract for lagging clients.
+
+## ADDED Requirements
+
+### Requirement: both MCP transports are conformance-gated
+
+Compass SHALL run deterministic conformance coverage for stdio and HTTP in CI.
+The HTTP leg SHALL use the official MCP conformance implementation pinned to an
+exact upstream revision that understands the 2026-07-28 requirement set.
+
+#### Scenario: qualify both transports in CI
+
+- **WHEN** the MCP conformance job runs
+- **THEN** stdio and HTTP are reported as separate required legs and any
+  unbaselined failure fails the job
+
+### Requirement: conformance evidence cannot be simulated by product fixtures
+
+Compass SHALL NOT expose test-only tools, prompts, resources, or protocol
+capabilities in the production server solely to satisfy diagnostic scenarios
+for capabilities Compass does not claim.
+
+#### Scenario: the reference suite requests an unsupported fixture capability
+
+- **WHEN** a diagnostic scenario depends on a tool or capability Compass does
+  not advertise
+- **THEN** the qualification records it as not applicable rather than adding a
+  production test hook or claiming a pass
+
+### Requirement: named clients prove discovery and invocation
+
+The interop matrix SHALL record exact tested versions of Codex CLI, Claude
+Code, and OpenCode. Every passing cell SHALL prove both discovery of the
+Compass MCP server and successful invocation of a real Compass tool.
+
+#### Scenario: qualify a named client
+
+- **WHEN** a pinned client is run with isolated stdio or HTTP configuration
+- **THEN** the receipt identifies the exact client version, discovered tool,
+  invoked tool, result evidence, transport, and pass/fail outcome
+
+### Requirement: latest protocol conformance governs the wave
+
+Compass SHALL treat the latest published MCP revision and the required stdio
+and HTTP conformance legs as the normative merge gate. Both production
+transports SHALL advertise only that revision and reject older negotiation. A named client that
+implements an older revision SHALL be recorded as incompatible and SHALL NOT
+cause Compass to restore protocol behavior removed by the latest revision.
+
+#### Scenario: a named client uses an older MCP lifecycle
+
+- **WHEN** discovery or invocation fails because the client requests an older
+  protocol revision or removed transport lifecycle
+- **THEN** the exact outcome is recorded, Compass retains the latest protocol,
+  and the client limitation does not by itself hold C-010
+
+#### Scenario: Compass fails current conformance
+
+- **WHEN** either required conformance leg fails or a client failure exposes a
+  Compass deviation from the latest published revision
+- **THEN** C-010 remains incomplete and the Wave 3 merge gate is explicitly held
diff --git a/openspec/changes/archive/2026-08-29-mcp-conformance-interop/tasks.md b/openspec/changes/archive/2026-08-29-mcp-conformance-interop/tasks.md
new file mode 100644
index 000000000..325afac63
--- /dev/null
+++ b/openspec/changes/archive/2026-08-29-mcp-conformance-interop/tasks.md
@@ -0,0 +1,17 @@
+# Tasks
+
+## 1. Contract
+
+- [x] 1.1 Define the pinned conformance runner, transport split, and named-client gate
+
+## 2. Conformance
+
+- [x] 2.1 Add stdio and HTTP conformance coverage and enforce both legs in CI
+
+## 3. Interoperability
+
+- [x] 3.1 Run Codex CLI, Claude Code, and OpenCode discovery plus invocation and record exact outcomes
+
+## 4. Verification
+
+- [x] 4.1 Update public docs, run focused/workspace gates, QA, review, and archive
diff --git a/openspec/changes/archive/2026-08-29-mcp-conformance-interop/verification.md b/openspec/changes/archive/2026-08-29-mcp-conformance-interop/verification.md
new file mode 100644
index 000000000..895cf1a0b
--- /dev/null
+++ b/openspec/changes/archive/2026-08-29-mcp-conformance-interop/verification.md
@@ -0,0 +1,66 @@
+# Verification — MCP conformance and interoperability
+
+Date: 2026-08-29
+
+## Contract outcome
+
+- Official current Model Context Protocol documentation identifies 2026-07-28
+  as the latest published revision.
+- The user explicitly selected the latest MCP revision as the governing C-010
+  requirement.
+- Compass retains 2026-only stdio and stateless HTTP lifecycles. OpenCode 1.18.25 HTTP
+  remains recorded as incompatible because it sends the older 2025-11-25
+  initialize/GET lifecycle; no legacy fallback was added.
+- Exact passing discovery and real `graph_stats` invocation evidence remains
+  recorded for Codex CLI 0.150.1 and Claude Code 2.1.251 on both transports and
+  OpenCode 1.18.25 on stdio.
+
+## New qualification artifacts
+
+- `crates/compass-mcp/tests/protocol_conformance.rs`
+- `scripts/qualify_mcp_conformance.sh`
+- `scripts/qualify_codex_mcp_client.py`
+- `docs/implementation/mcp-conformance-and-interop.md`
+
+These new files are named explicitly and included in the isolated review packet
+through a temporary Git index, leaving the user's real index untouched. Their
+complete bodies are also covered by the deterministic gates below.
+
+## Passing gates
+
+- `openspec validate mcp-conformance-interop --strict`
+- `cargo test -p compass-mcp --test protocol_conformance --locked`
+- `cargo test -p compass-cli --locked deprecated_session_timeout -- --nocapture`
+- `bash scripts/qualify_mcp_conformance.sh`
+- `sh scripts/check_product_boundary.sh`
+- `cargo fmt --all -- --check`
+- `cargo clippy --workspace --lib --bins --locked -- -D warnings`
+- `cargo test --workspace --lib --bins --locked`
+- deterministic artifact-refiner manifest, file-integrity, constraint, and
+  consistency checks
+- final scoped adversarial review: PASS (0 critical, 3 warnings, 1 suggestion)
+- adversarial-review sycophancy gate: PASS (score 0.0, strict mode)
+
+The official HTTP runner passed every applicable check. Its check-granular
+baseline contains only four fixture-tool diagnostics and one runner invocation
+whose real Compass tool receives intentionally invalid arguments; transport,
+wire-schema, discovery, routing, version negotiation, resource errors, and
+DNS-rebinding checks are not baselined. The four diagnostic baseline entries
+match runner check identifiers because the product does not advertise their
+fixture-only tools or streams. The header entry is additionally cause-gated
+after the run: it must be HTTP 400 / JSON-RPC `-32602` from the runner's invalid
+`{}` tool arguments, so a header-mismatch regression cannot pass under that
+identifier. It is not claimed as positive evidence for argument handling.
+Native unit and end-to-end HTTP coverage separately pin optional-whitespace
+normalization, including a successful real `graph_stats` invocation and
+treatment of a whitespace-only header as missing.
+
+## Final assessment
+
+Completeness is 4/4 tasks and all MCP conformance requirements and scenarios
+have implementation or qualification evidence. Correctness is covered by the
+native stdio and transport tests (including legacy stdio rejection), the pinned
+official HTTP runner, and the exact named-client matrix. Coherence matches the
+design decision to implement only the latest published MCP revision. The clean
+scoped final review and its strict anti-sycophancy gate both pass, so no critical
+review finding remains before archive.
diff --git a/openspec/changes/archive/2026-08-29-qualification-corpora-baselines/.openspec.yaml b/openspec/changes/archive/2026-08-29-qualification-corpora-baselines/.openspec.yaml
new file mode 100644
index 000000000..b87a491b6
--- /dev/null
+++ b/openspec/changes/archive/2026-08-29-qualification-corpora-baselines/.openspec.yaml
@@ -0,0 +1,3 @@
+schema: spec-driven
+created: 2026-08-28
+skip_specs: true
diff --git a/openspec/changes/archive/2026-08-29-qualification-corpora-baselines/design.md b/openspec/changes/archive/2026-08-29-qualification-corpora-baselines/design.md
new file mode 100644
index 000000000..0502e12de
--- /dev/null
+++ b/openspec/changes/archive/2026-08-29-qualification-corpora-baselines/design.md
@@ -0,0 +1,68 @@
+## Context
+
+The research and phase plan precommit exact scale profiles and comparison budgets.
+C-013 converts them into deterministic inputs and a recorded decision before Wave
+5 uses any Surreal projection measurement as acceptance evidence.
+
+## Goals / Non-Goals
+
+**Goals:**
+
+- Generate exact 100,000/250,000 and 1,000,000/2,500,000 typed graph profiles
+  without unbounded in-memory construction.
+- Preserve deterministic identities, direction, parallel edges, source evidence,
+  ordering, samples, and digests.
+- Compare graph-aware tools with a bounded raw-traversal baseline on 30 fixed tasks.
+- Reuse the shipped umbrella/focused-skill trigger corpus while freezing explicit
+  compatibility subsets.
+- Record host, binary, graph, command, sample, p95, and peak-RSS evidence.
+
+**Non-Goals:**
+
+- Ship a new product benchmark command or add a runtime dependency.
+- Generate and commit the multi-gigabyte large graph.
+- Treat a single-host baseline as a universal performance claim.
+- Adjust thresholds after observing a future Surreal projection result.
+
+## Decisions
+
+### Streaming fixture generation
+
+The generator writes one canonical JSON document incrementally. It holds only
+bounded record templates and digest state, not the complete node/edge set. A
+metadata-only mode exercises the complete ID/edge schedule and digest derivation
+without producing a large artifact.
+
+### Deterministic graph topology
+
+Nodes have stable ordinal identities. Every non-root node has a chain `calls`
+edge, remaining edges are deterministic forward chords, and a fixed parallel edge
+is retained. This makes callers/callees, depth-3 impact/path, multiplicity, and
+bounded pagination observable without relying on storage iteration order.
+
+### Bounded raw traversal
+
+The raw baseline scans JSON incrementally into bounded indexes, enforces explicit
+node, edge, depth, result, byte, and time ceilings, and reports limit failures as
+errors rather than empty results. It provides a comparison denominator, not an
+alternate Compass implementation.
+
+### Budget provenance
+
+The ratified table is copied byte-for-meaning from the research document. The
+phase plan realization was pinned after the 2026-08-28T12:45:00Z verify-first
+handoff entry and before C-013 ratification; its authoritative SHA-256 is
+`46e37804d513cf32ce8e7d008816642dffbb9d3b7b60fd3f2e82a482cd398ebf`.
+No earlier filesystem timestamp is used as decision provenance.
+The research budget section SHA-256 is
+`d2f805da25a4904bb7137a0c13c1ab5a813a25c10875d24b2d81887e8298c744`.
+C-012 resource values are descriptive and excluded from this decision basis.
+
+## Risks / Trade-offs
+
+- Full large generation is expensive, so ordinary tests use metadata-only large
+  validation plus a small materialized profile.
+- Process-start baselines include graph loading and cache state; every sample set
+  records which condition was measured.
+- Host metrics vary, so comparisons use ratios on the same runner and retain raw
+  samples rather than publishing universal claims.
diff --git a/openspec/changes/archive/2026-08-29-qualification-corpora-baselines/files.txt b/openspec/changes/archive/2026-08-29-qualification-corpora-baselines/files.txt
new file mode 100644
index 000000000..aae5f7fed
--- /dev/null
+++ b/openspec/changes/archive/2026-08-29-qualification-corpora-baselines/files.txt
@@ -0,0 +1,23 @@
+benchmarks/qualification/README.md
+benchmarks/qualification/agent-tasks-v1.json
+benchmarks/qualification/current-engine-baseline-v1.json
+benchmarks/qualification/generate_graph.py
+benchmarks/qualification/io.py
+benchmarks/qualification/manifest-v1.json
+benchmarks/qualification/profiles-v1.json
+benchmarks/qualification/raw_traversal.py
+benchmarks/qualification/raw-traversal-oracle-v1.json
+benchmarks/qualification/run_current_baseline.py
+benchmarks/qualification/scale-profile-digests-v1.json
+benchmarks/qualification/semantic-corpus-v1.json
+benchmarks/qualification/skill-corpora-v1.json
+benchmarks/qualification/tests/test_corpora.py
+benchmarks/qualification/tests/test_current_baseline.py
+benchmarks/qualification/tests/test_generate_graph.py
+benchmarks/qualification/tests/test_raw_traversal.py
+docs/future/qualification-corpora-baselines.md
+openspec/changes/qualification-corpora-baselines/.openspec.yaml
+openspec/changes/qualification-corpora-baselines/design.md
+openspec/changes/qualification-corpora-baselines/proposal.md
+openspec/changes/qualification-corpora-baselines/tasks.md
+openspec/changes/qualification-corpora-baselines/verification.md
diff --git a/openspec/changes/archive/2026-08-29-qualification-corpora-baselines/proposal.md b/openspec/changes/archive/2026-08-29-qualification-corpora-baselines/proposal.md
new file mode 100644
index 000000000..81e8d5cb6
--- /dev/null
+++ b/openspec/changes/archive/2026-08-29-qualification-corpora-baselines/proposal.md
@@ -0,0 +1,35 @@
+## Why
+
+Future storage and graph-engine comparisons need one frozen, deterministic
+qualification surface. Without versioned corpora, scale generators, current-engine
+baselines, and precommitted budgets, later performance and quality conclusions can
+be tuned to whichever implementation has already been measured.
+
+## What Changes
+
+- Ratify the research document's numeric qualification budgets unchanged and
+  preserve their pre-measurement provenance.
+- Add deterministic `qualification-medium` and `qualification-large` graph
+  generators plus bounded validation and traversal tools.
+- Version a semantic corpus, a 30-task agent suite, umbrella invocations, and
+  focused-skill boundary prompts.
+- Record reproducible current-engine binary, cold-start, query p95, and peak-RSS
+  baselines before Wave 5 measurements.
+
+## Capabilities
+
+### New Capabilities
+
+None. These are developer qualification artifacts, not a shipped command or
+runtime dependency; `.openspec.yaml` opts out of delta specs.
+
+### Modified Capabilities
+
+None.
+
+## Impact
+
+Artifacts live under `benchmarks/qualification/` and `docs/future/`. The baseline
+runner keeps generated medium graphs and raw run logs disposable under `target/`;
+standalone generator and raw-traversal outputs may also use `/tmp`. No default
+product dependency, public command, or compatibility contract changes.
diff --git a/openspec/changes/archive/2026-08-29-qualification-corpora-baselines/tasks.md b/openspec/changes/archive/2026-08-29-qualification-corpora-baselines/tasks.md
new file mode 100644
index 000000000..2925f1aae
--- /dev/null
+++ b/openspec/changes/archive/2026-08-29-qualification-corpora-baselines/tasks.md
@@ -0,0 +1,15 @@
+## 1. Frozen Qualification Contract
+
+- [x] 1.1 Ratify the precommitted budgets unchanged, record provenance, and define versioned artifact schemas and checksums
+
+## 2. Deterministic Corpora and Harnesses
+
+- [x] 2.1 Add bounded deterministic medium/large graph generation with exact profile metadata, samples, and regression tests
+- [x] 2.2 Version the semantic corpus and bounded raw-traversal baseline with explicit limit behavior
+- [x] 2.3 Version exactly 30 agent tasks with expected evidence and bounded tool/raw traversal routes
+- [x] 2.4 Freeze umbrella invocation and focused-skill boundary corpora without changing shipped skill selection behavior
+
+## 3. Baseline and Completion
+
+- [x] 3.1 Build and measure the current engine reproducibly; retain binary size, cold-start, query p95, peak RSS, graph identity, host, and raw samples
+- [x] 3.2 Validate/refine all artifacts, perform mandatory adversarial review, refresh the graph, and archive the OpenSpec change
diff --git a/openspec/changes/archive/2026-08-29-qualification-corpora-baselines/verification.md b/openspec/changes/archive/2026-08-29-qualification-corpora-baselines/verification.md
new file mode 100644
index 000000000..e96d4d044
--- /dev/null
+++ b/openspec/changes/archive/2026-08-29-qualification-corpora-baselines/verification.md
@@ -0,0 +1,138 @@
+# Verification: qualification corpora, baselines, and budgets
+
+## Result
+
+PASS for C-013's deterministic corpus, bounded harness, current-engine baseline,
+and precommitted budget-ratification contract. This evidence does not approve a
+SurrealDB license profile or assert that a future engine satisfies any budget.
+
+## Requirement evidence
+
+- The complete research budget table is ratified unchanged. The source phase
+  plan and exact research section are pinned by SHA-256, and C-012 measurements
+  are explicitly excluded from the decision basis.
+- `qualification-medium` has exactly 100,000 nodes and 250,000 edges;
+  `qualification-large` has exactly 1,000,000 nodes and 2,500,000 edges.
+  Full logical iteration reproduces the pinned node and edge digests for both.
+- Graph materialization atomically publishes one streamed strict `compass.graph/1`
+  document with stable
+  identities, directed calls, an explicit parallel edge, exact evidence, and
+  deterministic order. Its synthetic file content digest is profile-specific;
+  the stable file ID intentionally continues to represent the common source path.
+  Oversized or invalid profiles fail closed.
+- The semantic descriptor pins the existing code-graph qualification sources and
+  requires identity, direction, multiplicity, confidence, evidence, ambiguity,
+  negative cases, limits, ordering, and pagination. Its four count claims are
+  recomputed from the pinned semantic source in the normal test suite.
+- The raw denominator scans graph arrays incrementally, has explicit byte/node/
+  edge/depth/result/time limits, preserves direction and parallel multiplicity,
+  checks deadlines during full node scans, bounds the task document to 1 MiB and
+  100 tasks, validates declared limits against effective CLI values, emits an
+  explicit status for every operation, validates task shape, and reports limit
+  or input failures with exit status 2 rather than an empty result.
+- Exactly 30 unique tasks are balanced six each across search, callers, callees,
+  impact, and path. All pass the bounded raw oracle against the exact medium graph;
+  the timing-free result set is retained and continuously checked against every
+  expected status, node, edge-count, and path-endpoint assertion.
+- The shipped 14-case skill trigger corpus is pinned by SHA-256 and partitioned
+  exactly into two umbrella invocations and twelve focused boundary prompts, two
+  for each focused skill, with zero tolerated regression or ambiguity.
+- One documented current-engine runner emits binary and runtime-pinned gzip size,
+  cold start, five samples per query workload, nearest-rank p95, peak RSS, graph
+  and binary hashes, host/tool versions, computed source-state identity, and its
+  directly measured raw traversal denominator using repository-relative paths.
+- Before measuring, the runner verifies the supplied graph's exact bytes, file
+  SHA-256, node/edge counts, and complete logical digests against generator
+  metadata and the pinned profile catalog. It explicitly requires
+  `qualification-medium` and fails closed on any mismatch or other profile.
+- Every Git, binary, Rust, and Cargo metadata subprocess plus source-patch capture
+  and every measured workload use the existing measured-process helper with
+  explicit time and stdout/stderr limits.
+- Every discarded query warmup also uses the same bounded measured-process helper,
+  and search pins its supported `--max-candidates 256` bound explicitly.
+- Source identity covers the tracked binary diff plus all 638 existing tracked
+  or non-ignored untracked files across root manifests/toolchain, every workspace
+  crate, and both vendored path dependencies. The 612-file tracked and 26-file
+  untracked subsets have separate counts, byte totals, and digests; ignored
+  ambient files are excluded under explicit file/byte ceilings.
+- The path workload's selected endpoints have an observed exact three-hop
+  shortest path. Because the legacy command exposes no depth flag, its fixed
+  100,000-node/250,000-edge graph and 120-second process timeout are recorded as
+  independent bounds rather than inventing unsupported CLI arguments.
+- `manifest-v1.json` is a closed checksum inventory of every retained benchmark
+  source, corpus, evidence document, and regression below its directory.
+
+## Verification performed
+
+- `PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s benchmarks/qualification/tests -v`: 30 passed, including full medium/large digest regeneration, graph/profile mismatch rejection, output-cap rejection, malformed retained-evidence rejection, mandatory/strict expected-result contracts, unknown-field and empty-suite rejection, declared-limit and task-input bounds, explicit empty status, strict graph identities, duplicate-edge rejection, atomic JSON output, and interrupted graph-publication recovery.
+- Full metadata-only generation for both profiles: exact pinned node/edge counts
+  and SHA-256 digests matched.
+- All retained benchmark JSON parsed successfully.
+- `openspec validate qualification-corpora-baselines --strict`: passed.
+- `git diff --check` for the change surface: passed.
+- `sh scripts/check_product_boundary.sh`: passed.
+- `cargo build -p compass-cli --release --locked`: passed while producing the
+  retained current-engine baseline binary.
+- Full documented baseline runner: passed with five samples for all six process
+  workloads and a directly measured PASS result for all 30 raw tasks.
+- `compass update .`: passed; indexed 713 files into 121,261 nodes and 285,681
+  edges (68 unsupported edges omitted explicitly, zero nodes omitted, zero
+  identity collisions quarantined).
+
+The workspace Rust clippy/test baseline was green immediately before C-013 and
+remains applicable because this change adds no Rust source, dependency, manifest,
+lockfile, shipped product behavior, or public compatibility surface.
+
+## Qualification status
+
+Deterministic artifact refinement passed using the repository's established
+fallback record because the installed artifact-refiner adapter lacks its
+referenced canonical controllers and schema assets. The first isolated review
+correctly blocked on baseline reproducibility and raised six additional boundedness
+and evidence concerns. All findings were resolved or, for KBD-required `.refiner/`
+state, dispositioned against the explicit persistence contract. The second review
+passed without critical findings; its remaining four warnings and two suggestions
+were also resolved. A final fresh-context review and graph refresh are recorded
+before archive. A third review caught two inaccurate reproduction/evidence claims
+and two remaining runner bounds; those findings were corrected and the complete
+baseline was re-measured before the next review.
+The fourth review passed without critical findings and identified three remaining
+audit warnings plus one input-validation suggestion. Those were resolved with
+source-complete provenance, explicit KBD QA-state ownership, and clean malformed
+input failures before another full baseline run and review.
+The fifth review passed without critical findings and identified two provenance/
+evidence warnings plus two input-integrity suggestions. The source inventory now
+uses Git's tracked and non-ignored-untracked sets explicitly, the refinement date
+matches the final evidence date, expected-result field types are validated before
+execution, and duplicate edge identities fail closed. A complete five-sample
+baseline was recorded again after these corrections.
+The sixth review passed without critical findings and identified one remaining
+fail-closed warning plus two publication/documentation suggestions. Every task now
+requires an expected-evidence object, the raw and baseline JSON outputs publish
+atomically through one portable helper, and the proposal now states the runner's
+repository-contained work-directory contract accurately.
+The seventh review passed without critical findings and identified three final
+publication/immutability/bounds warnings plus three consistency suggestions.
+Graph materialization now streams to an atomic sibling, future baselines are
+added under new versions rather than replacing history, search and warmups are
+explicitly bounded through the shared process helper, binary compression streams,
+and the retained host records the Python/zlib pair governing gzip size. The full
+baseline was re-measured after these corrections.
+The eighth review passed without critical findings and identified two raw-contract
+warnings plus two boundedness/scope suggestions. All operations now publish
+explicit status, declared task limits are enforced, the task input has byte/count
+ceilings, and the current-engine runner rejects non-medium profiles before work.
+The timing-free oracle and full baseline were regenerated afterward.
+The ninth review passed without critical findings and identified two final
+fail-closed warnings plus two strictness/audit suggestions. Expected contracts now
+reject unknown keys, empty task suites cannot report PASS, graph identity/name
+fields require non-empty strings, and the normalized interpreter label is tied
+explicitly to its measured executable name and `host.python`. The full baseline
+was recorded again after the per-record validation change.
+The concluding tenth isolated review passed with zero critical findings, two
+warnings, and two suggestions; the anti-theater gate passed. Its retained
+follow-up findings cover deeply nested task JSON error normalization, a scripted
+oracle-promotion convenience, impact's necessarily non-empty source-inclusive
+status semantics, and streaming rather than post-process output caps. None changes
+the frozen corpora, measured evidence, or acceptance result, and the KBD contract
+permits archive on PASS while preserving noncritical findings in the review record.
diff --git a/openspec/changes/archive/2026-08-29-surreal-graph-projection/.openspec.yaml b/openspec/changes/archive/2026-08-29-surreal-graph-projection/.openspec.yaml
new file mode 100644
index 000000000..50adc9103
--- /dev/null
+++ b/openspec/changes/archive/2026-08-29-surreal-graph-projection/.openspec.yaml
@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-08-29
diff --git a/openspec/changes/archive/2026-08-29-surreal-graph-projection/design.md b/openspec/changes/archive/2026-08-29-surreal-graph-projection/design.md
new file mode 100644
index 000000000..6332f2048
--- /dev/null
+++ b/openspec/changes/archive/2026-08-29-surreal-graph-projection/design.md
@@ -0,0 +1,60 @@
+## Context
+
+The canonical typed graph is `compass_model::code_graph::GraphDocument`; its build metadata already carries the immutable `generation_id`, source-tree digest, configuration digest, and schema fingerprint. `compass-graphdb` is the closest graph-database integration boundary, while C-012 proved SurrealDB 3.2.4 Mem/SurrealKV/RocksDB storage semantics independently and C-011 approved the named artifact profiles. The default JSON/SQLite realization remains authoritative.
+
+## Goals / Non-Goals
+
+**Goals:**
+
+- Keep projection planning deterministic, inspectable, and testable without compiling SurrealDB.
+- Preserve exact canonical node and edge payloads while exposing stable indexed fields for later native reads.
+- Make candidate publication one database transaction whose final mutation is the active-generation pointer.
+- Keep the engine SDK and BSL-covered code behind explicit, non-default features.
+
+**Non-Goals:**
+
+- No query-engine routing, MCP/CLI surface, remote server mode, live subscription, or Store implementation in C-014.
+- No garbage collection of inactive generations; published generations are immutable and cleanup needs its own retention contract.
+- No claim that SurrealDB becomes the canonical or default backend.
+
+## Decisions
+
+### Separate the deterministic plan from the optional runtime
+
+The always-compiled crate core builds a `ProjectionPlan` from a validated typed graph. It owns typed projected node/relation records, record keys, ordering, closed relation-family mapping, expected counts, and validation. An `engine` module compiled only by `mem`, `surrealkv`, or `rocksdb` executes that plan against `Surreal<local::Db>`.
+
+This keeps ordinary workspace builds free of SurrealDB while allowing most semantic properties to be tested cheaply. Putting plan construction directly inside SDK calls was rejected because it makes determinism, feature-off footprint, and failure injection harder to prove.
+
+### Preserve full typed records plus indexed contract fields
+
+Each row stores the stable Compass ID, repository/generation/schema fields, kind, source endpoints where applicable, effective confidence, and a canonical JSON payload of the original typed record. The exact payload is the round-trip authority; indexed fields support validation and C-015 reads. Database record keys are SHA-256 hashes of the record class and length-delimited identity components, avoiding identifier grammar ambiguity and preserving deterministic collision-resistant addressing.
+
+Dropping unknown or less frequently queried typed fields was rejected because projection is an equivalence surface. Treating database record IDs as the Compass IDs was rejected because arbitrary valid Compass identities need not be valid unquoted Surreal record keys.
+
+### Use a closed set of relation families
+
+Every `EdgeKind` maps exhaustively to one of five internal families: structural, dependency, execution, data-flow, or evidence. Each family is a schemafull Surreal relation table constrained from `code_node` to `code_node`, and every relation row also requires the original Compass `kind`. The executor selects one of five static parameterized statements; no table or statement string is accepted from a caller.
+
+One table per edge kind was rejected as unnecessarily large schema churn. One generic table without a closed family was rejected because it weakens type constraints and makes arbitrary relation naming possible.
+
+### Activate inside the staging transaction
+
+The runtime ensures schema definitions first, then begins one transaction, rejects mutation of an already recorded immutable generation, writes every node and relation, validates counts and distinct stable IDs inside that transaction, records the complete generation manifest, and finally upserts the repository pointer before commit. Any SDK or validation failure cancels the transaction. A test-only interruption hook cancels after a bounded number of mutations to prove the previous pointer remains visible.
+
+Writing candidate batches outside the activation transaction was rejected for C-014 because it permits orphan candidates and requires a more complex recovery protocol. The separately retained C-012 probes cover dirty-shutdown behavior for persistent engines; C-014's runtime uses the stronger single-transaction model.
+
+### Pin and isolate engine features
+
+The root workspace dependency pins `surrealdb = "=3.2.4"` with default features disabled. The new crate has an empty default feature set and maps `mem`, `surrealkv`, and `rocksdb` separately to the SDK's `kv-mem`, `kv-surrealkv`, and `kv-rocksdb` features. Engine constructors are available only for the selected feature. License metadata and the exact tagged license fixture are referenced in crate documentation.
+
+## Risks / Trade-offs
+
+- **SurrealDB remains expensive to compile even for Mem tests** → keep SDK checks in a dedicated feature-enabled gate and prove default dependency isolation with `cargo tree`.
+- **A future Compass edge kind could make the mapping incomplete** → exhaustively match the closed Rust enum and assert `EdgeKind::ALL` coverage.
+- **One large transaction can consume substantial resources** → C-014 accepts only already bounded canonical generations; C-015 owns bounded reads and later measurement gates. If C-013 resource budgets fail, the falsifier protocol stops the feature.
+- **Canonical JSON serialization can fail on non-finite numbers** → typed graph validation already rejects non-finite evidence, and plan construction returns a typed serialization error without touching the database.
+- **Schema changes can strand older rows** → projection schema is explicit and unknown majors fail; inactive generations are never rewritten in place.
+
+## Migration Plan
+
+This is additive and disabled by default. Land the crate, exact dependency pin, license notice, and feature-off gate first. Surreal-enabled callers explicitly select one embedded engine and build a fresh projection from a canonical graph. Rollback disables the feature and continues using the unchanged JSON/SQLite path; no canonical data migration or rewrite is required.
diff --git a/openspec/changes/archive/2026-08-29-surreal-graph-projection/files.txt b/openspec/changes/archive/2026-08-29-surreal-graph-projection/files.txt
new file mode 100644
index 000000000..7eaafe615
--- /dev/null
+++ b/openspec/changes/archive/2026-08-29-surreal-graph-projection/files.txt
@@ -0,0 +1,25 @@
+deny.toml
+THIRD_PARTY_NOTICES.md
+crates/compass-graphdb-surreal/Cargo.toml
+crates/compass-graphdb-surreal/README.md
+crates/compass-graphdb-surreal/src/lib.rs
+crates/compass-graphdb-surreal/src/projection.rs
+crates/compass-graphdb-surreal/src/engine.rs
+crates/compass-graphdb-surreal/tests/projection.rs
+crates/compass-graphdb-surreal/tests/mem_projection.rs
+docs/implementation/workspace-tour.md
+docs/implementation/surreal-graph-projection.md
+scripts/check_product_boundary.sh
+scripts/check_surreal_feature_isolation.sh
+openspec/changes/surreal-graph-projection/.openspec.yaml
+openspec/changes/surreal-graph-projection/proposal.md
+openspec/changes/surreal-graph-projection/design.md
+openspec/changes/surreal-graph-projection/specs/surreal-graph-projection/spec.md
+openspec/changes/surreal-graph-projection/tasks.md
+openspec/changes/surreal-graph-projection/files.txt
+openspec/changes/surreal-graph-projection/shared-file-evidence.md
+.refiner/artifacts/C-014/artifact_manifest.json
+.refiner/artifacts/C-014/constraints.json
+.refiner/artifacts/C-014/decisions.md
+.refiner/artifacts/C-014/refinement_log.md
+.refiner/artifacts/C-014/dist/refinement-receipt.md
diff --git a/openspec/changes/archive/2026-08-29-surreal-graph-projection/proposal.md b/openspec/changes/archive/2026-08-29-surreal-graph-projection/proposal.md
new file mode 100644
index 000000000..23311b39e
--- /dev/null
+++ b/openspec/changes/archive/2026-08-29-surreal-graph-projection/proposal.md
@@ -0,0 +1,26 @@
+## Why
+
+Compass needs an optional native graph-database projection that can accelerate graph-shaped reads without replacing the canonical immutable `compass.graph/1` generation or weakening its identity, evidence, determinism, and bounded-work contracts. The C-011 license decision, C-012 persistent-engine probes, and C-013 precommitted qualification budgets now satisfy the hard gates for implementing that projection against pinned SurrealDB 3.2.4.
+
+## What Changes
+
+- Add an optional `compass-graphdb-surreal` integration crate with no default SurrealDB feature.
+- Define a schemafull, generation-keyed node and relation projection with a closed mapping from every Compass edge kind to a typed relation family and a required original `kind` field.
+- Stage and validate one immutable candidate generation before atomically swapping a repository-scoped active-generation pointer.
+- Preserve stable node and edge IDs, direction, parallel edges, self-loops, provenance, confidence, source anchors, schema version, repository identity, and generation identity.
+- Provide only typed projection operations; do not expose arbitrary caller- or model-authored SurrealQL and do not add MCP or CLI presentation logic.
+- Support deterministic Mem tests and separately gated SurrealKV and RocksDB embedded profiles using exactly pinned SurrealDB 3.2.4.
+
+## Capabilities
+
+### New Capabilities
+
+- `surreal-graph-projection`: Optional, generation-atomic projection of a validated Compass graph into schemafull SurrealDB node and relation records.
+
+### Modified Capabilities
+
+None.
+
+## Impact
+
+The workspace gains one focused integration crate and an exact optional SurrealDB dependency with non-default Mem, SurrealKV, and RocksDB features. Default Compass binaries, the canonical JSON/SQLite path, CLI and MCP contracts, and the `compass-model` public graph schema remain unchanged. Surreal-enabled artifacts remain subject to the recorded BSL 1.1 notice and redistribution conditions for SurrealDB 3.2.4.
diff --git a/openspec/changes/archive/2026-08-29-surreal-graph-projection/shared-file-evidence.md b/openspec/changes/archive/2026-08-29-surreal-graph-projection/shared-file-evidence.md
new file mode 100644
index 000000000..cee616ee4
--- /dev/null
+++ b/openspec/changes/archive/2026-08-29-surreal-graph-projection/shared-file-evidence.md
@@ -0,0 +1,61 @@
+# Shared-file evidence for C-014 review
+
+The phase is implemented in one cumulative dirty working tree. `Cargo.toml`,
+`Cargo.lock`, and `CHANGELOG.md` also contain accepted changes from C-004,
+C-005, C-007, C-010, C-016, and C-017. Including their entire `HEAD` diff in a
+C-014 packet falsely attributes those changes to this projection. The scoped
+review therefore represents C-014's exact shared-file deltas here while the
+deterministic and build gates continue to evaluate the real files.
+
+## Exact C-014 shared-file deltas
+
+`Cargo.toml` adds only:
+
+```toml
+# workspace member
+"crates/compass-graphdb-surreal",
+
+# workspace dependency
+surrealdb = { version = "=3.2.4", default-features = false }
+```
+
+`Cargo.lock` adds the `compass-graphdb-surreal` package and the exact optional
+dependency closure resolved by its three engine features. The relevant root is:
+
+```text
+name = "compass-graphdb-surreal"
+version = "0.3.7"
+dependencies = ["compass-model", "serde", "serde_json", "sha2", "surrealdb", "thiserror", "tokio"]
+```
+
+The resolved SDK package is exactly `surrealdb 3.2.4`. Default-feature `cargo
+tree` checks prove no Surreal package reaches `compass-cli`, `compass-mcp`,
+`compass-core`, or the projection crate without an engine feature.
+
+`CHANGELOG.md` adds only the first Unreleased entry, which describes the new
+optional projection crate, exact 3.2.4 pin, engine profiles, semantic round trip,
+default-build isolation, and retained BSL obligations. Later entries in that
+section predate C-014 and belong to their separately reviewed changes.
+
+`docs/README.md` adds only the optional Surreal graph projection row. The
+adjacent MCP conformance row belongs to C-010 and is retained in the cumulative
+working tree without being attributed to C-014.
+
+## Mechanical verification
+
+The actual shared files were evaluated by all of these successful gates after
+the final C-014 implementation edit:
+
+- `cargo clippy --workspace --lib --bins --locked -- -D warnings`
+- `cargo test --workspace --lib --bins --locked`
+- default, Mem, SurrealKV, and RocksDB checks for `compass-graphdb-surreal`
+- `sh scripts/check_product_boundary.sh`
+- `sh scripts/check_surreal_feature_isolation.sh --binary`
+- `openspec validate --all --strict`
+- `git diff --check`
+
+The C-004 2 GiB store publication default is not the projection default. C-014
+uses `compass_model::DEFAULT_GRAPH_SIZE_CAP_BYTES`, the canonical
+`GraphDocument` reader's 1 GiB bound, as an independent serialized projection
+ceiling. It does not claim that maximum node and relation counts are jointly
+attainable beneath that byte ceiling; C-015 measures the ratified corpora.
diff --git a/openspec/changes/archive/2026-08-29-surreal-graph-projection/specs/surreal-graph-projection/spec.md b/openspec/changes/archive/2026-08-29-surreal-graph-projection/specs/surreal-graph-projection/spec.md
new file mode 100644
index 000000000..3bea74442
--- /dev/null
+++ b/openspec/changes/archive/2026-08-29-surreal-graph-projection/specs/surreal-graph-projection/spec.md
@@ -0,0 +1,60 @@
+## Purpose
+
+Defines a lossless, optional, generation-atomic SurrealDB projection of canonical Compass graph generations without changing the default graph authority or product surface.
+
+## ADDED Requirements
+
+### Requirement: Optional dependency isolation
+The projection capability SHALL live in a focused integration crate, SHALL require an explicit engine feature, and SHALL not link SurrealDB into default Compass library or binary builds. Surreal-enabled profiles MUST use exactly the reviewed SurrealDB 3.2.4 release and retain the recorded license obligations.
+
+#### Scenario: Default workspace build
+- **WHEN** Compass is built without a `compass-graphdb-surreal` engine feature
+- **THEN** no SurrealDB package is present in that build's dependency graph or linked artifact
+
+#### Scenario: Enabled embedded profile
+- **WHEN** a caller explicitly enables Mem, SurrealKV, or RocksDB support
+- **THEN** the adapter uses pinned SurrealDB 3.2.4 and exposes only that selected embedded-engine capability
+
+### Requirement: Canonical immutable generation input
+The projection SHALL accept only a validated `compass.graph/1` document and a non-empty repository identity. Every projected record SHALL carry the repository identity, the document generation identity, the projection schema version, and its stable Compass identity. A projection MUST be deterministic for equivalent inputs and MUST reject unsupported graph or projection schema versions explicitly.
+
+#### Scenario: Valid generation is planned
+- **WHEN** a validated canonical graph and non-empty repository identity are projected twice
+- **THEN** both plans contain byte-equivalent, identically ordered node and relation records with the same identities
+
+#### Scenario: Invalid input is rejected
+- **WHEN** the repository identity is empty or the graph fails `compass.graph/1` validation
+- **THEN** projection fails with a typed error and publishes no active generation
+
+### Requirement: Lossless typed relation mapping
+The projection SHALL use schemafull node and relation tables and a closed mapping from every Compass edge kind to a typed relation family with a required original `kind`. Stable edge identity, source-to-target direction, parallel multiplicity, self-loops, source anchors, provenance, and confidence MUST survive a projection round trip without semantic loss.
+
+#### Scenario: Relationship semantics round trip
+- **WHEN** one generation contains parallel same-direction edges, a reverse edge, and a self-loop with distinct evidence and confidence
+- **THEN** reading the projected generation returns the same edge IDs, endpoints, kinds, ordering, evidence, anchors, and confidence values
+
+#### Scenario: Closed mapping remains exhaustive
+- **WHEN** the Compass edge vocabulary is compared with the projection mapping
+- **THEN** every supported edge kind maps to exactly one typed relation family and no arbitrary relation-table name can be supplied by a caller
+
+### Requirement: Generation-atomic activation
+The adapter SHALL stage all records for one candidate generation, validate candidate counts and identities, and update a repository-scoped active-generation pointer only in the same successful transaction. Readers SHALL resolve the active generation once per operation. Failed, cancelled, or interrupted staging MUST leave the previously active generation visible and MUST never expose the partial candidate.
+
+#### Scenario: Successful activation
+- **WHEN** a complete candidate passes validation and its transaction commits
+- **THEN** the active pointer selects that exact generation and all of its projected records are visible together
+
+#### Scenario: Interrupted candidate
+- **WHEN** staging stops before activation or the transaction is cancelled after only part of a candidate is written
+- **THEN** readers continue to observe the previous complete generation and no partial candidate is active
+
+### Requirement: Typed and bounded adapter surface
+The adapter SHALL expose typed projection and activation operations only. It MUST NOT expose arbitrary caller-authored SurrealQL, MCP rendering, CLI presentation, or an unbounded result path. Database statements SHALL come from a closed internal query plan and all untrusted values SHALL be parameter-bound.
+
+#### Scenario: Untrusted identifiers
+- **WHEN** repository, generation, node, or edge identities contain SurrealQL metacharacters
+- **THEN** they remain data values and cannot alter the selected statement or relation family
+
+#### Scenario: Presentation boundary
+- **WHEN** the integration crate is compiled in isolation
+- **THEN** it has no dependency on `compass-cli` or `compass-mcp` and exports no presentation-specific response type
diff --git a/openspec/changes/archive/2026-08-29-surreal-graph-projection/tasks.md b/openspec/changes/archive/2026-08-29-surreal-graph-projection/tasks.md
new file mode 100644
index 000000000..86f158e58
--- /dev/null
+++ b/openspec/changes/archive/2026-08-29-surreal-graph-projection/tasks.md
@@ -0,0 +1,15 @@
+## 1. Contract and Dependency Boundary
+
+- [x] 1.1 Add the `compass-graphdb-surreal` workspace crate, exact optional SurrealDB 3.2.4 dependency, engine feature matrix, license disclosure, and feature-off dependency gate; verify the crate builds with default features and `cargo tree` contains no Surreal package for default Compass binaries
+
+## 2. Deterministic Projection Core
+
+- [x] 2.1 Implement validated generation planning, deterministic record keys and ordering, exhaustive typed relation-family mapping, exact payload preservation, and typed errors; verify unit/property-style tests cover invalid inputs, determinism, every edge kind, parallel edges, reverse direction, self-loops, provenance, confidence, and injection-shaped identities
+
+## 3. Generation-Atomic Surreal Runtime
+
+- [x] 3.1 Implement schemafull static statements, parameter-bound Mem/SurrealKV/RocksDB constructors, transactional stage/validate/activate, active-generation reads, and cancellation failure injection; verify Mem integration tests prove successful round-trip and that interrupted writes leave the previous generation visible
+
+## 4. Documentation and Qualification
+
+- [x] 4.1 Update workspace and integration documentation, run targeted/default/feature-enabled tests plus formatting, lint, product-boundary, strict OpenSpec, footprint, and graph-refresh gates; then refine, adversarially review, verify, and archive C-014
diff --git a/openspec/changes/archive/2026-08-29-surreal-graph-projection/verification.md b/openspec/changes/archive/2026-08-29-surreal-graph-projection/verification.md
new file mode 100644
index 000000000..0fe20b85f
--- /dev/null
+++ b/openspec/changes/archive/2026-08-29-surreal-graph-projection/verification.md
@@ -0,0 +1,113 @@
+# Verification Report: surreal-graph-projection
+
+**Result:** PASS
+
+## Completeness
+
+- Tasks: 4/4 complete.
+- Requirements: 5/5 implemented.
+- Scenarios: 10/10 covered by implementation evidence and automated checks.
+
+## Correctness
+
+### Optional dependency isolation
+
+Implemented by the focused `compass-graphdb-surreal` crate, the exact optional
+`surrealdb = 3.2.4` workspace dependency, the explicit `mem`, `surrealkv`, and
+`rocksdb` features, and `scripts/check_surreal_feature_isolation.sh`. The gate
+checks default crate, library, CLI, MCP, and binary dependency closures for all
+`surrealdb*` packages. License obligations are recorded in
+`THIRD_PARTY_NOTICES.md` and the exact reviewed exceptions are present in
+`deny.toml`.
+
+### Canonical immutable generation input
+
+`ProjectionPlan::from_graph` in
+`crates/compass-graphdb-surreal/src/projection.rs:208` validates repository and
+graph input, constructs deterministic records, and rejects unsupported schema
+versions. `ProjectionPlan::validate` at line 260 revalidates the complete plan
+before activation. Projection unit tests cover empty and invalid inputs,
+deterministic byte-equivalent plans, stable identities, and payload preservation.
+
+### Lossless typed relation mapping
+
+`relation_family` at
+`crates/compass-graphdb-surreal/src/projection.rs:112` is a closed exhaustive
+mapping for every `EdgeKind`. Exact source-to-target records preserve original
+kind, stable edge identity, multiplicity, self-loops, anchors, provenance, and
+confidence. Unit and Mem round-trip tests cover parallel same-direction edges,
+reverse edges, self-loops, and all supported edge kinds.
+
+### Generation-atomic activation
+
+`SurrealProjection::activate_with_interrupt` at
+`crates/compass-graphdb-surreal/src/engine.rs:289` starts a transaction;
+`stage_generation` at line 408 writes and validates the complete candidate;
+the repository-scoped active pointer changes only inside the successful
+transaction. `validate_candidate` at line 565 checks counts, bytes, and stable
+identity records. Mem tests prove complete round trips, idempotent activation,
+changed-metadata rejection, zero-mutation interruption, and preservation of the
+previous active generation after an interrupted candidate.
+
+### Typed and bounded adapter surface
+
+`ProjectionLimits` at
+`crates/compass-graphdb-surreal/src/projection.rs:13` independently bounds nodes,
+relations, and projected bytes. The runtime uses a closed set of static internal
+statements, query-side limits such as `SELECT_NODE_IDS` at
+`crates/compass-graphdb-surreal/src/engine.rs:140`, and parameter binding for all
+untrusted values. The integration test
+`injection_shaped_repository_identity_round_trips_as_bound_data` verifies that
+SurrealQL-shaped repository data cannot change a statement. The crate has no CLI
+or MCP dependency and exports no presentation response type.
+
+## Coherence
+
+The implementation follows the proposal and design: the canonical Compass graph
+remains authoritative, projection is deterministic and optional, engine support
+is feature-gated, and activation is repository- and generation-scoped. Public
+documentation describes independent safety ceilings rather than treating the
+three default limits as a promised jointly achievable corpus size.
+
+## Verification Performed
+
+The following checks passed:
+
+- `cargo fmt --all -- --check`
+- `cargo clippy --workspace --lib --bins --locked -- -D warnings`
+- `cargo test --workspace --lib --bins --locked`
+- `cargo test -p compass-graphdb-surreal --features mem --locked`
+- `cargo clippy -p compass-graphdb-surreal --all-targets --features mem --locked -- -D warnings`
+- `cargo check -p compass-graphdb-surreal --features surrealkv --locked`
+- `cargo check -p compass-graphdb-surreal --features rocksdb --locked`
+- `sh scripts/check_product_boundary.sh`
+- `sh scripts/check_surreal_feature_isolation.sh --binary`
+- `openspec validate --all --strict`
+- `cargo package -p compass-graphdb-surreal --locked --allow-dirty --no-verify --list`
+- `git diff --check`
+- `compass update .`
+
+The final independent adversarial review passed with 0 critical findings, 5
+warnings, and 1 suggestion. The warnings do not contradict a requirement or
+scenario and the actionable isolation, binary-path, cancellation, metadata, and
+injection-test issues found in earlier rounds were corrected and reverified.
+
+## Non-blocking Limitations
+
+- `cargo-deny` is not installed in this environment, so the deny configuration
+  was reviewed through Cargo metadata and exact dependency/license declarations
+  rather than by running `cargo deny`.
+- The packaged artifact-refiner controllers and assets are absent; the execution
+  used the documented deterministic fallback state contract and retained that
+  limitation in the refinement receipt.
+- The worktree contains cumulative changes from earlier accepted KBD changes.
+  `shared-file-evidence.md` identifies the C-014 portions of shared files, while
+  the review packet limits executable review scope to C-014-owned paths.
+- The final Compass graph refresh completed successfully with 0 omitted nodes
+  and 68 omitted or unresolved edges; this is a graph evidence warning, not a
+  Surreal projection verification failure.
+
+## Conclusion
+
+C-014 is complete, verified, and safe to sync and archive. No critical errors or
+requirement gaps remain.
diff --git a/openspec/changes/archive/2026-08-29-surrealdb-license-decision/.openspec.yaml b/openspec/changes/archive/2026-08-29-surrealdb-license-decision/.openspec.yaml
new file mode 100644
index 000000000..b87a491b6
--- /dev/null
+++ b/openspec/changes/archive/2026-08-29-surrealdb-license-decision/.openspec.yaml
@@ -0,0 +1,3 @@
+schema: spec-driven
+created: 2026-08-28
+skip_specs: true
diff --git a/openspec/changes/archive/2026-08-29-surrealdb-license-decision/design.md b/openspec/changes/archive/2026-08-29-surrealdb-license-decision/design.md
new file mode 100644
index 000000000..8ef3839d5
--- /dev/null
+++ b/openspec/changes/archive/2026-08-29-surrealdb-license-decision/design.md
@@ -0,0 +1,102 @@
+## Context
+
+SurrealDB 3.2.4's official tagged `LICENSE` identifies the work as SurrealDB
+3.0 under Business Source License 1.1, licensed by SurrealDB Ltd. Its Additional
+Use Grant permits use except as a defined Database Service, its Change Date is
+2030-01-01, and its Change License is Apache License 2.0. Conversion occurs on
+the earlier of that Change Date and the fourth anniversary of the first publicly
+available distribution of the specific version under this license. The BSL
+terms require the license to be conspicuously displayed on original or modified
+copies and apply separately to each version.
+
+The official 3.2.4 `surrealdb` crate is published with `license-file` metadata
+and depends unconditionally on `surrealdb-core`; selecting only HTTP or WebSocket
+protocol features does not by itself produce a core-free Rust SDK dependency.
+The exact tagged license bytes have SHA-256
+`98a94ac615f88370865016487b436fa404560910bd329794ed7502277a94b805`.
+
+Primary evidence:
+
+- <https://raw.githubusercontent.com/surrealdb/surrealdb/v3.2.4/LICENSE>
+- <https://raw.githubusercontent.com/surrealdb/surrealdb/v3.2.4/surrealdb/Cargo.toml>
+- <https://raw.githubusercontent.com/surrealdb/surrealdb/v3.2.4/surrealdb/core/Cargo.toml>
+- <https://github.com/surrealdb/license>
+
+This record summarizes licensing evidence for a release decision; it is not
+legal advice.
+
+## Goals / Non-Goals
+
+**Goals:**
+
+- Make every proposed distribution profile explicit before code or dependency
+  work begins.
+- Separate source dependency metadata from artifacts that actually contain BSL
+  core bytes.
+- Define notice, version-pin, and downstream redistribution conditions.
+- Preserve a credible fallback when BSL-bearing artifacts are unacceptable.
+
+**Non-Goals:**
+
+- Interpret an individual customer's use as compliant or non-compliant.
+- Grant trademark rights or replace counsel.
+- Add SurrealDB, run engine probes, or approve production use.
+
+## Decisions
+
+### Evidence is pinned to 3.2.4
+
+The release decision applies only to SurrealDB 3.2.4 and its exact tagged
+license digest. A version bump must repeat the license comparison because BSL
+parameters and Change Dates apply per version.
+
+### Artifact profiles are evaluated independently
+
+| Profile | Contains or induces BSL core? | Required release treatment |
+| --- | --- | --- |
+| Compass source repository with no Surreal dependency | No | No Surreal notice; Waves 5/8 remain absent. |
+| Optional Compass crate published to crates.io | The Compass crate need not copy core source, but activating its dependency resolves the BSL `surrealdb`/`surrealdb-core` crates | Declare the optional BSL dependency prominently, pin the reviewed version, retain Compass's own license metadata, and require the consuming build/distribution to satisfy the Surreal license. |
+| Prebuilt Compass binary, library, plugin, or archive with embedded Surreal support | Yes, linked core code | Ship the exact BSL license conspicuously with the artifact, identify SurrealDB 3.2.4 and the DB-service restriction, preserve notices, and do not describe the whole artifact as exclusively OSI-open-source. |
+| Container image containing a Surreal-enabled Compass build or SurrealDB server | Yes | Apply the same BSL notice and restriction disclosure to the image and its accompanying materials; keep the covered version discoverable. |
+| Skill/config-only Codex, Claude, or OpenCode package | No, provided it contains no Surreal-enabled binary or core source | No Surreal notice is needed solely for configuration or prose; generation must not silently add a covered binary. |
+| Downstream redistribution of any covered binary/source copy | Yes | Redistributor must retain and conspicuously display the exact license, notices, version, Change Date, and Change License; the Database Service restriction remains in force until conversion. |
+| Remote-client-only Compass integration with no `surrealdb` or `surrealdb-core` linkage | No core copy in Compass | Use a core-free protocol implementation and require an independently installed external server. Do not call the official Rust SDK profile core-free while its manifest retains the unconditional core dependency. |
+
+### Approval is explicit and profile-scoped
+
+The final record must contain one of:
+
+- `accept`: every named profile above is approved under its stated conditions;
+- `conditional`: only an enumerated subset is approved, with all other profiles
+  prohibited; or
+- `reject`: no Compass artifact may add the BSL core dependency or bytes.
+
+Silence, an implementation commit, a successful probe, or an optional Cargo
+feature is not approval.
+
+### Rejection and conditional fallback
+
+If embedded/core-bearing profiles are rejected, C-014 and C-015 are cancelled
+as currently framed and the Surreal branch of C-020 is cancelled. Compass keeps
+SQLite/redb/`graph.json` as the local authoritative stack. A later remote-only
+proposal may proceed only if it proves that Compass links no BSL core and treats
+the external SurrealDB installation as a separately licensed operator choice.
+
+## Risks / Trade-offs
+
+- **License text or crate topology changes in a later SurrealDB release** → Pin
+  3.2.4 and require a fresh digest/profile review for every upgrade.
+- **“Optional” is mistaken for “license-free”** → Evaluate distributed bytes
+  and dependency resolution per profile; never use feature gating as a legal
+  conclusion.
+- **A remote profile still links core through the official Rust SDK** → Require
+  dependency-tree evidence for a core-free fallback before calling it such.
+- **Downstream users infer legal advice from project docs** → State the factual
+  license parameters, conditions, and approval provenance without adjudicating
+  a user's business model.
+
+## Migration Plan
+
+No runtime migration occurs. After explicit sign-off, copy the decision and its
+provenance into the phase decision log. Accepted or conditional profiles become
+hard constraints for later OpenSpec changes; rejection cancels the gated waves.
diff --git a/openspec/changes/archive/2026-08-29-surrealdb-license-decision/files.txt b/openspec/changes/archive/2026-08-29-surrealdb-license-decision/files.txt
new file mode 100644
index 000000000..7303fda8d
--- /dev/null
+++ b/openspec/changes/archive/2026-08-29-surrealdb-license-decision/files.txt
@@ -0,0 +1,35 @@
+docs/future/surrealdb-license-decision.md
+docs/future/surreal-persistent-probe-results.md
+docs/future/qualification-corpora-baselines.md
+.kbd-orchestrator/phases/compass-scoping-and-bounds/decision-log.md
+.kbd-orchestrator/phases/compass-scoping-and-bounds/execution.md
+.kbd-orchestrator/phases/compass-scoping-and-bounds/plan.md
+.refiner/artifacts/C-011/artifact_manifest.json
+.refiner/artifacts/C-011/constraints.json
+.refiner/artifacts/C-011/decisions.md
+.refiner/artifacts/C-011/dist/refinement-receipt.md
+.refiner/artifacts/C-011/refinement_log.md
+.refiner/artifacts/C-012/artifact_manifest.json
+.refiner/artifacts/C-012/constraints.json
+.refiner/artifacts/C-012/decisions.md
+.refiner/artifacts/C-012/dist/refinement-receipt.md
+.refiner/artifacts/C-012/refinement_log.md
+.refiner/artifacts/C-013/artifact_manifest.json
+.refiner/artifacts/C-013/constraints.json
+.refiner/artifacts/C-013/decisions.md
+.refiner/artifacts/C-013/dist/refinement-receipt.md
+.refiner/artifacts/C-013/refinement_log.md
+openspec/changes/archive/2026-08-28-surreal-persistent-probes/verification.md
+openspec/changes/archive/2026-08-29-qualification-corpora-baselines/verification.md
+scripts/fixtures/surreal-persistent-probes/manifest-v1.json
+scripts/fixtures/surreal-persistent-probes/SURREALDB-3.2.4-LICENSE.txt
+scripts/fixtures/surreal-persistent-probes/expected-v1.json
+scripts/fixtures/surreal-persistent-probes/input-v1.json
+scripts/fixtures/surreal-persistent-probes/rocksdb-result-v1.json
+scripts/fixtures/surreal-persistent-probes/surrealkv-result-v1.json
+openspec/changes/archive/2026-08-29-surrealdb-license-decision/.openspec.yaml
+openspec/changes/archive/2026-08-29-surrealdb-license-decision/design.md
+openspec/changes/archive/2026-08-29-surrealdb-license-decision/files.txt
+openspec/changes/archive/2026-08-29-surrealdb-license-decision/proposal.md
+openspec/changes/archive/2026-08-29-surrealdb-license-decision/tasks.md
+openspec/changes/archive/2026-08-29-surrealdb-license-decision/verification.md
diff --git a/openspec/changes/archive/2026-08-29-surrealdb-license-decision/proposal.md b/openspec/changes/archive/2026-08-29-surrealdb-license-decision/proposal.md
new file mode 100644
index 000000000..352324d25
--- /dev/null
+++ b/openspec/changes/archive/2026-08-29-surrealdb-license-decision/proposal.md
@@ -0,0 +1,35 @@
+## Why
+
+Compass must not add or distribute SurrealDB core until the exact BSL 1.1
+artifact and redistribution profile has explicit release/legal approval. Making
+that decision before probes and adapters prevents implementation momentum from
+silently deciding a licensing question.
+
+## What Changes
+
+- Capture the exact SurrealDB 3.2.4 license parameters and immutable source
+  evidence.
+- Define the licensing effect of source, registry, prebuilt binary, plugin,
+  container, and downstream-redistribution profiles.
+- Record one explicit `accept`, `reject`, or `conditional` decision with named
+  provenance and permitted profiles.
+- Preserve a remote-client-only/external-server fallback that links no
+  SurrealDB BSL core if the embedded profile is not accepted.
+
+## Capabilities
+
+### New Capabilities
+
+None. This change records a release/legal decision and does not change shipped
+product behavior; `.openspec.yaml` therefore opts out of delta specs.
+
+### Modified Capabilities
+
+None.
+
+## Impact
+
+The decision gates C-014, C-015, and the SurrealDB branch of C-020. It may
+constrain future Cargo features, crates.io publication, prebuilt binaries,
+plugin archives, containers, notices, and downstream redistribution, but this
+change itself adds no dependency and changes no runtime behavior.
diff --git a/openspec/changes/archive/2026-08-29-surrealdb-license-decision/tasks.md b/openspec/changes/archive/2026-08-29-surrealdb-license-decision/tasks.md
new file mode 100644
index 000000000..e65698e9a
--- /dev/null
+++ b/openspec/changes/archive/2026-08-29-surrealdb-license-decision/tasks.md
@@ -0,0 +1,9 @@
+## 1. Evidence and Artifact Profile
+
+- [x] 1.1 Capture the pinned SurrealDB 3.2.4 BSL parameters, official source URLs, and exact license digest; verify the digest against the tagged license bytes
+- [x] 1.2 Document source, registry, binary, plugin, container, downstream redistribution, and genuinely core-free remote profiles; verify the record distinguishes optional dependency metadata from distributed BSL bytes
+
+## 2. Decision and Completion
+
+- [x] 2.1 Obtain explicit user/legal `accept`, `reject`, or profile-scoped `conditional` sign-off and record its provenance in the phase decision log
+- [x] 2.2 Apply the recorded outcome to downstream wave gates, validate and refine the decision artifact, perform mandatory adversarial review, and archive the OpenSpec change
diff --git a/openspec/changes/archive/2026-08-29-surrealdb-license-decision/verification.md b/openspec/changes/archive/2026-08-29-surrealdb-license-decision/verification.md
new file mode 100644
index 000000000..3ff8d399c
--- /dev/null
+++ b/openspec/changes/archive/2026-08-29-surrealdb-license-decision/verification.md
@@ -0,0 +1,79 @@
+# Verification — SurrealDB 3.2.4 license decision
+
+Date: 2026-08-29
+
+## Decision evidence
+
+- The project user explicitly wrote `C-011: ACCEPT` in the active Codex task.
+- The pre-existing design defines `accept` as approval of every named profile
+  under its stated conditions.
+- The sign-off records the authority role, date, exact message provenance,
+  closed profile scope, and pinned-version conditions without adding a waiver.
+
+## Prerequisite certification evidence
+
+C-012 is archived at
+`openspec/changes/archive/2026-08-28-surreal-persistent-probes/`; every one of its
+six tasks is checked complete. Its seven blocking refinement constraints are
+PASS. The retained records have these SHA-256 identities:
+
+- `.refiner/artifacts/C-012/constraints.json`:
+  `e7ba948a92b389b7e90d687c797c642ee2529dff8be0627b5f0c434075a4cf40`
+- `.refiner/artifacts/C-012/dist/refinement-receipt.md`:
+  `36ee14e3a792f387384597051aa79e2f4b5f982b108d6e36bbfc771e7932d70d`
+
+C-013 is archived at
+`openspec/changes/archive/2026-08-29-qualification-corpora-baselines/`; every one
+of its seven tasks is checked complete. Its eight blocking refinement
+constraints are PASS. The retained records have these SHA-256 identities:
+
+- `.refiner/artifacts/C-013/constraints.json`:
+  `017a1d20a7a4f3c0015dfb5665e950b6da1cc62aa9441a2a25da8bfbcf85e05b`
+- `.refiner/artifacts/C-013/dist/refinement-receipt.md`:
+  `8e871f316594dd753995aa83816203132952c7fe85b5f04e4d33e0e9616002e3`
+- `docs/future/qualification-corpora-baselines.md`:
+  `5944c9b2b77d04f8b3b6282cb2925451054fe20e9451ff0a6f54c89a3990b6e1`
+
+The C-013 decision document records that its complete budget table was ratified
+unchanged before Wave 5 measurements and retains the exact plan and research-
+section hashes used as provenance.
+
+The current bytes of
+`.kbd-orchestrator/phases/compass-scoping-and-bounds/plan.md` have SHA-256
+`46e37804d513cf32ce8e7d008816642dffbb9d3b7b60fd3f2e82a482cd398ebf`,
+exactly preserving that immutable pre-measurement planning snapshot. Live gate
+resolution is recorded in the decision log, execution contract, and KBD progress
+rather than mutating the pinned plan.
+
+## License capture
+
+The repository contains the captured tagged license bytes at
+`scripts/fixtures/surreal-persistent-probes/SURREALDB-3.2.4-LICENSE.txt`. Their
+SHA-256 is
+`98a94ac615f88370865016487b436fa404560910bd329794ed7502277a94b805`,
+which matches the entry in `manifest-v1.json`. The manifest itself has SHA-256
+`81cb3080e87f9e780492946a37b8c92c5108d96c107aa1445b112a95832ed67d`.
+On 2026-08-29 a bounded raw fetch from the pinned upstream URL produced the same
+SHA-256 and a byte-for-byte `cmp` against the retained fixture passed.
+
+## Gate disposition
+
+C-012 and C-013 are certified complete. C-011 acceptance is recorded and its
+mandatory corrected pre-archive fresh-context review passed with zero critical
+findings, three warnings, and one suggestion; that round's strict anti-sycophancy
+gate passed with score 0.0. This change is published at
+`openspec/changes/archive/2026-08-29-surrealdb-license-decision/`, so C-014/C-015
+may proceed. C-020 remains independently conditional. No SurrealDB dependency
+exists in the Compass workspace. A separate post-publication audit caught and
+caused correction of a mutated C-013 plan precommitment. The final archived-state
+audit passed with zero critical findings and three warnings; its strict
+anti-sycophancy gate passed. The exact findings remain retained in the KBD review
+record.
+
+## Validation evidence
+
+- `openspec validate surrealdb-license-decision --strict`: PASS before archive
+- `openspec validate --all --strict`: PASS after archive (12 passed, 0 failed)
+- deterministic C-011/C-012/C-013 manifest, source/dist-path, PASS-constraint,
+  fixture-checksum, and pinned-plan-hash checks: PASS
+- `git diff --check`: PASS
diff --git a/openspec/changes/surreal-dual-engine-equivalence/.openspec.yaml b/openspec/changes/surreal-dual-engine-equivalence/.openspec.yaml
new file mode 100644
index 000000000..50adc9103
--- /dev/null
+++ b/openspec/changes/surreal-dual-engine-equivalence/.openspec.yaml
@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-08-29
diff --git a/openspec/changes/surreal-dual-engine-equivalence/design.md b/openspec/changes/surreal-dual-engine-equivalence/design.md
new file mode 100644
index 000000000..4e0cae561
--- /dev/null
+++ b/openspec/changes/surreal-dual-engine-equivalence/design.md
@@ -0,0 +1,115 @@
+## Context
+
+See `proposal.md` for motivation. C-014 stores exact node and relation payloads
+under repository/generation keys and activates them atomically. The current
+`compass-query` implementation already defines deterministic structural semantics
+and bounds over JSON/store backends. C-013 froze the semantic corpus, scale
+profiles, measurements, and numeric gates before C-014/C-015 results existed.
+
+The SurrealDB dependency must remain absent from default Compass closures, and
+the optional adapter cannot expose raw database language to callers.
+
+## Goals / Non-Goals
+
+**Goals:**
+
+- Reuse the shared `compass.query/1` node, relation, path, evidence, diagnostic,
+  and limit contracts for both engines.
+- Execute adjacency and record lookup as generation-pinned native Surreal reads,
+  with Rust coordinating deterministic bounded traversal.
+- Keep equivalence comparison canonical, timing-independent, and strict.
+- Retain reproducible host-specific measurement evidence for every C-013 gate.
+
+**Non-Goals:**
+
+- Switching the default CLI or MCP engine to SurrealDB.
+- Adding remote SurrealDB configuration, authentication, arbitrary SurrealQL, or
+  presentation-specific response types.
+- Moving ranking, traversal semantics, or public bounds into the database.
+- Treating a single-host measurement as a universal performance claim.
+
+## Decisions
+
+### Share result contracts, keep execution asynchronous and adapter-owned
+
+The adapter returns the existing model-layer query records and uses the same
+limit vocabulary. Its API remains asynchronous because embedded Surreal engines
+are asynchronous. The current engine supplies a bounded structural comparison
+route in `compass-query`; the Surreal SDK is not pulled into `compass-query`'s
+default dependencies.
+
+An async backend trait inside `compass-query` was rejected because it would force
+Surreal lifecycle and features into the default query crate. Materializing the
+complete projection and reusing the current engine was rejected because that is
+not a native read and violates the bounded-allocation purpose of C-015.
+
+### Pin the active generation once
+
+Each operation reads and validates the repository pointer and complete manifest
+once, producing an internal generation selector. Every subsequent statement
+binds repository and generation explicitly. The selector is revalidated before
+publishing the response; a changed pointer yields a typed generation-change
+error. This prevents mixed-generation results while preserving immutable
+historical records.
+
+Keeping a long database transaction open for every read was rejected because it
+adds unnecessary engine coupling and contention. Immutable generation records
+plus start/end pointer validation provide the required coherent outcome.
+
+### Static family queries with bounded Rust traversal
+
+Node lookup and each of the five closed relation families use static statements,
+parameter-bound values, explicit canonical ordering, and remaining-limit-plus-one
+sentinels. Rust merges family results by stable edge ID, filters the closed kind
+sets, and performs BFS with the existing tie-breaking and evidence-quality rules.
+This preserves parallel edges and self-loops without relying on database
+iteration order.
+
+A caller-provided table parameter is rejected even though SurrealDB supports
+`type::table`; only code-owned family constants may select a table. One large
+recursive SurrealQL statement was rejected because it makes independent node,
+edge, depth, and response accounting difficult to audit.
+
+### Generation-bound opaque cursors
+
+The page cursor is a versioned canonical payload containing repository digest,
+generation, operation, ordering version, and last stable identity, authenticated
+with a content digest. It reveals no raw database record ID and is validated
+before reads. Query-side ordering uses stable Compass identity and requests
+`page_size + 1` to distinguish completion from truncation.
+
+Offset pagination was rejected because concurrent pointer changes and large
+offset scans weaken determinism and work bounds.
+
+### Differential qualification is a hard oracle
+
+Tests build one validated graph, project it to Mem, run the current and Surreal
+operations with identical exact identities and limits, canonicalize only
+transport-irrelevant metadata, and require byte-equal semantic results. Separate
+persistent-engine/scale qualification records output digests, page boundaries,
+timings, RSS, and ratios. A mismatch or missed threshold is a failure, not a
+tolerance entry.
+
+## Risks / Trade-offs
+
+- **[Multiple family queries increase call count]** → record query-call counts,
+  merge deterministically, and use the C-013 native-value gate as a falsifier.
+- **[Start/end pointer validation may reject an otherwise coherent historical
+  result after activation]** → prefer explicit retryable failure over returning a
+  result the caller could mistake for the current generation.
+- **[Current search ranking is broader than structural exact lookup]** → qualify
+  exact identity/name structural operations; do not claim fuzzy/full-text parity
+  without a separate contract and index design.
+- **[Medium/large qualification is resource intensive]** → keep generated graphs,
+  stores, binaries, and raw logs disposable under an explicit target directory;
+  retain only bounded manifests and summarized raw samples.
+- **[Optional SDK features can leak into default binaries]** → extend the
+  dependency-closure and binary proof gate after every dependency edit.
+
+## Migration Plan
+
+This is additive and disabled by default. Land the shared contract and current
+comparison route first, then the feature-gated Surreal reader, then retained
+qualification evidence. Rollback removes the optional route and evidence without
+changing canonical graph formats, default query behavior, or active historical
+generations.
diff --git a/openspec/changes/surreal-dual-engine-equivalence/proposal.md b/openspec/changes/surreal-dual-engine-equivalence/proposal.md
new file mode 100644
index 000000000..e4b75e87e
--- /dev/null
+++ b/openspec/changes/surreal-dual-engine-equivalence/proposal.md
@@ -0,0 +1,41 @@
+## Why
+
+C-014 can publish canonical generations to SurrealDB, but Compass cannot yet use
+that projection for bounded graph-native reads or prove that those reads preserve
+the current engine's semantics. C-015 adds the closed read surface and evaluates
+it against the pre-ratified C-013 equivalence and product-value gates.
+
+## What Changes
+
+- Add parameter-bound, generation-pinned Surreal reads for exact symbol context,
+  impact, directed path, and connected-subgraph operations.
+- Add an engine-neutral structural-query result contract and a current-engine
+  route so identical requests can be evaluated against both realizations.
+- Enforce independent depth, node, edge, path, candidate, response-byte, and
+  pagination bounds before and during traversal.
+- Add deterministic semantic-corpus and scale-sample differential tests that
+  treat any identity, direction, multiplicity, evidence, ordering, bound, or
+  pagination mismatch as a failure.
+- Measure every applicable C-013 gate on the same runner and apply the recorded
+  falsifier protocol if a threshold fails; do not tune the corpus or threshold
+  after observing results.
+- Preserve the default dependency boundary and expose no caller-authored
+  SurrealQL path.
+
+## Capabilities
+
+### New Capabilities
+
+- `surreal-native-query`: Closed, bounded native Surreal graph reads and deterministic dual-engine equivalence qualification.
+
+### Modified Capabilities
+
+- None.
+
+## Impact
+
+The primary implementation lives in `compass-graphdb-surreal`; the comparison
+route and shared structural contract live at the `compass-query`/`compass-model`
+boundary. Qualification extends `benchmarks/qualification/` without changing
+default CLI or MCP behavior. SurrealDB remains exact-versioned and feature-gated,
+and default Compass builds remain free of Surreal dependencies.
diff --git a/openspec/changes/surreal-dual-engine-equivalence/specs/surreal-native-query/spec.md b/openspec/changes/surreal-dual-engine-equivalence/specs/surreal-native-query/spec.md
new file mode 100644
index 000000000..22cc114f4
--- /dev/null
+++ b/openspec/changes/surreal-dual-engine-equivalence/specs/surreal-native-query/spec.md
@@ -0,0 +1,75 @@
+## Purpose
+
+Defines closed, bounded graph-native reads over an active Surreal projection and the deterministic evidence required to prove semantic equivalence with Compass's current query engine.
+
+## ADDED Requirements
+
+### Requirement: Active-generation native reads
+The Surreal adapter SHALL expose typed operations for exact symbol context, impact, directed path, and connected subgraph reads. Each operation SHALL resolve the repository's active generation exactly once and SHALL read only records from that immutable generation. A missing active generation, incomplete manifest, or changed pointer during the operation MUST return a typed error rather than an empty result or mixed-generation response.
+
+#### Scenario: One immutable generation per operation
+- **WHEN** a repository pointer changes while a native traversal is in progress
+- **THEN** the response contains records from only the generation selected at operation start or fails explicitly without returning a partial response
+
+#### Scenario: Missing active generation
+- **WHEN** a repository has no complete active generation
+- **THEN** the operation returns a typed unavailable-generation error distinct from an empty graph result
+
+### Requirement: Closed parameter-bound query plan
+Every database statement SHALL be selected from a closed internal plan and every repository, generation, symbol, cursor, and limit value SHALL be parameter-bound. The adapter MUST NOT accept caller-authored SurrealQL or caller-selected table names.
+
+#### Scenario: Query-shaped identity
+- **WHEN** any request identity contains SurrealQL syntax or relation-table text
+- **THEN** the value remains data and cannot alter the statement, table family, generation, or bound
+
+#### Scenario: Unsupported operation
+- **WHEN** a caller requests an operation outside the closed typed surface
+- **THEN** the adapter rejects it without executing a database statement
+
+### Requirement: Independent bounded traversal and pagination
+Every operation SHALL enforce positive finite depth, node, relation, path, candidate, response-byte, and page-item limits as applicable. Database reads MUST request at most the remaining bound plus one sentinel record, traversal MUST stop at the first exhausted bound, and truncation MUST be explicit. Paginated results SHALL use an opaque generation-bound cursor and SHALL reproduce the same canonical order when pages are concatenated.
+
+#### Scenario: Bound exhaustion
+- **WHEN** one independent limit is exhausted before traversal completes
+- **THEN** the response stays within every configured limit, reports truncation, and never converts the limit condition into an empty success
+
+#### Scenario: Stable pagination
+- **WHEN** the same immutable result is read with different positive page sizes
+- **THEN** concatenated pages contain exactly the unpaged canonical identities once, in the same order, with no omission or duplication
+
+#### Scenario: Cursor generation mismatch
+- **WHEN** a cursor from another repository, generation, operation, or ordering contract is supplied
+- **THEN** the request fails with a typed cursor error before returning records
+
+### Requirement: Semantic dual-engine equivalence
+For the supported structural operations, the current engine and Surreal engine SHALL return semantically identical stable identities, edge direction, parallel multiplicity, self-loops, kinds, provenance, source anchors, confidence, paths, ordering, truncation, and pagination for equivalent inputs and limits. Ambiguity, negative cases, and limit failures MUST be compared as outcomes and a mismatch MUST fail qualification.
+
+#### Scenario: Semantic corpus equivalence
+- **WHEN** every supported operation runs against the versioned semantic corpus on both engines
+- **THEN** canonical comparison reports zero mismatches across every required C-013 dimension
+
+#### Scenario: Deterministic scale samples
+- **WHEN** the versioned deterministic samples from the medium and large profiles are evaluated
+- **THEN** both engines return the same bounded identities, paths, ordering, truncation, and page boundaries
+
+### Requirement: Pre-ratified qualification gates
+Qualification SHALL evaluate the applicable C-013 thresholds without modifying the inputs or thresholds after Surreal results are visible. Results MUST record the exact source identity, graph identity, engine profile, host, commands, limits, samples, p95 method, peak RSS, output digests, and pass or fail decision. Any failed semantic, footprint, query-regression, native-value, recovery, or agent-value gate MUST invoke the recorded falsifier protocol and MUST NOT be reported as success.
+
+#### Scenario: Gate passes
+- **WHEN** a measured result satisfies its pre-ratified threshold on the same runner as the current-engine baseline
+- **THEN** the retained evidence records the raw samples, ratio, threshold, and passing decision
+
+#### Scenario: Gate fails
+- **WHEN** any required result misses its threshold or cannot be measured comparably
+- **THEN** C-015 stops or records a revised product decision without weakening the corpus, threshold, or semantic contract post hoc
+
+### Requirement: Optional product boundary
+The Surreal native query implementation SHALL remain behind explicit engine features. Default Compass libraries and binaries MUST retain zero Surreal dependencies, and the integration crate MUST expose no MCP, CLI, or model-authored query execution surface.
+
+#### Scenario: Default closure remains unchanged
+- **WHEN** the workspace, Compass CLI, MCP server, and current query engine are built without a Surreal engine feature
+- **THEN** their dependency closures and linked artifacts contain no SurrealDB package
+
+#### Scenario: Integration crate boundary
+- **WHEN** the native query crate is inspected or compiled
+- **THEN** it depends only on domain contracts and engine support, with no Compass CLI or MCP presentation dependency
diff --git a/openspec/changes/surreal-dual-engine-equivalence/tasks.md b/openspec/changes/surreal-dual-engine-equivalence/tasks.md
new file mode 100644
index 000000000..30cb26365
--- /dev/null
+++ b/openspec/changes/surreal-dual-engine-equivalence/tasks.md
@@ -0,0 +1,16 @@
+## 1. Contract and Current-Engine Route
+
+- [x] 1.1 Add the engine-neutral structural-read contract and current-engine bounded subgraph route; verify integration/contract coverage proves exact identities, ambiguity, negative cases, independent limits, canonical ordering, and response-byte enforcement
+
+## 2. Surreal Native Reads
+
+- [x] 2.1 Implement generation-pinned static node/relation statements, typed cursor validation, exact symbol context, impact, directed path, and connected-subgraph operations; verify Mem integration tests cover query-shaped identities, pointer changes, missing generations, parallel/reverse/self-loop relations, provenance, confidence, truncation, and page concatenation
+
+## 3. Dual-Engine and Budget Qualification
+
+- [x] 3.1 Add deterministic semantic-corpus plus medium/large scale-sample differential qualification and require zero semantic mismatches; verify the retained oracle covers every C-013 dimension and both persistent feature profiles compile
+- [ ] 3.2 Measure every applicable pre-ratified C-013 gate on the same runner, retain raw identities/samples/ratios/decisions, and invoke the falsifier protocol instead of weakening any failed threshold; verify the qualification manifest closes over every retained artifact
+
+## 4. Documentation and Completion Gates
+
+- [ ] 4.1 Update integration/qualification documentation and changelog; run focused tests, default dependency/binary isolation, all feature checks, workspace formatting/lint/tests, product boundary, strict OpenSpec, graph refresh, refinement, independent adversarial review, verification, spec sync, and archive
diff --git a/openspec/specs/agent-cli/spec.md b/openspec/specs/agent-cli/spec.md
new file mode 100644
index 000000000..6282d52ea
--- /dev/null
+++ b/openspec/specs/agent-cli/spec.md
@@ -0,0 +1,98 @@
+# Agent CLI Specification
+
+## Purpose
+
+Define a stable, bounded command-line contract for discovering, installing,
+diagnosing, exporting, validating, and configuring Compass agent integrations.
+
+## Requirements
+
+### Requirement: Agent namespace and inventory
+Compass SHALL expose exactly the public subcommands `agent list`, `agent install`, `agent doctor`, `agent export`, `agent validate`, and `agent mcp-config`, and SHALL provide nested help for each subcommand. `agent list` SHALL report the supported agent platforms in deterministic identifier order without changing files.
+
+#### Scenario: List agents as text
+- **WHEN** a user runs `compass agent list`
+- **THEN** the command exits successfully and emits one deterministic inventory row per supported platform
+
+#### Scenario: List agents as JSON
+- **WHEN** a user runs `compass agent list --format json`
+- **THEN** the command exits successfully and emits a versioned JSON object whose agents are sorted by platform identifier
+
+#### Scenario: Reject an unknown agent subcommand
+- **WHEN** a user runs `compass agent` with an unknown subcommand
+- **THEN** the command exits with usage status 2 and identifies the invalid subcommand
+
+### Requirement: Managed install compatibility
+`compass agent install` SHALL delegate to the existing managed installer with the remaining arguments unchanged. The established `compass install` entry point SHALL remain available and SHALL retain byte-identical output, side effects, and exit behavior for equivalent arguments.
+
+#### Scenario: Install through the namespace
+- **WHEN** a user invokes `compass agent install` with valid installer arguments
+- **THEN** the command produces the same files, output bytes, and exit status as `compass install` with those arguments
+
+#### Scenario: Preserve legacy install failures
+- **WHEN** equivalent invalid arguments are supplied to `compass agent install` and `compass install`
+- **THEN** both commands produce the same error bytes and exit status
+
+### Requirement: Bounded agent diagnostics
+`compass agent doctor` SHALL report deterministic checks for the Compass binary version, MCP protocol compatibility, graph presence and freshness, installed seven-skill collection checksums, and platform MCP configuration. It SHALL bound filesystem discovery and SHALL not contact a network service or start an MCP server. The command SHALL exit 0 only when every required check passes, 1 when one or more checks fail, and 2 for invalid arguments.
+
+#### Scenario: Healthy agent environment
+- **WHEN** doctor inspects a selected platform whose graph, managed skills, protocol, and MCP configuration are current and valid
+- **THEN** every check is reported as passing and the command exits 0
+
+#### Scenario: Stale graph
+- **WHEN** doctor inspects a graph whose manifest no longer matches the project source set
+- **THEN** the graph-freshness check fails explicitly and the command exits 1
+
+#### Scenario: Bad installed skill checksum
+- **WHEN** doctor inspects a managed skill whose bytes no longer match its install manifest
+- **THEN** the skill-checksum check fails explicitly and the command exits 1
+
+#### Scenario: Inspect a user-scoped integration
+- **WHEN** doctor is given a user configuration root instead of a project root
+- **THEN** project graph checks are reported as not applicable and health is determined by the remaining user-scoped checks
+
+### Requirement: Deterministic portable export
+`compass agent export --platform <platform> --out <directory>` SHALL export the embedded seven-skill collection, a versioned manifest with sorted file checksums, and a credential-free platform-native MCP configuration. Equivalent inputs SHALL produce byte-identical file contents and manifest ordering. Export SHALL refuse to replace a non-empty destination and SHALL publish the complete output set atomically.
+
+#### Scenario: Export an agent bundle
+- **WHEN** a user exports a supported platform to a missing or empty destination
+- **THEN** the destination contains all seven skills, the native MCP configuration, and a manifest whose paths and checksums are deterministically ordered
+
+#### Scenario: Protect an existing destination
+- **WHEN** a user exports to a non-empty destination
+- **THEN** the command fails without modifying any existing destination entry
+
+### Requirement: Safe bundle validation
+`compass agent validate` SHALL validate a bounded bundle or managed installation without executing its content. Validation SHALL verify the versioned manifest, supported transport, the complete seven-skill inventory, file checksums, path containment, and platform configuration shape. It SHALL reject symlinks, unresolved or machine-specific absolute paths, file URLs, and likely literal credential values while allowing ordinary web URLs. Validation failures SHALL be deterministic and exit 1; invalid invocation SHALL exit 2.
+
+#### Scenario: Validate a portable bundle
+- **WHEN** a user validates an unmodified bundle produced by `agent export`
+- **THEN** validation succeeds without changing the bundle
+
+#### Scenario: Reject an absolute path
+- **WHEN** a validated text file contains a Unix absolute path, a Windows absolute path, or a file URL
+- **THEN** validation reports the affected relative file and exits 1
+
+#### Scenario: Reject a credential string
+- **WHEN** a validated configuration contains a likely literal secret value
+- **THEN** validation reports the affected relative file without echoing the secret and exits 1
+
+#### Scenario: Allow a web URL
+- **WHEN** a validated configuration contains an ordinary HTTPS endpoint and no unsafe value
+- **THEN** the URL is not classified as a Windows absolute path or a credential
+
+### Requirement: Native MCP configuration rendering
+`compass agent mcp-config` SHALL render deterministic, credential-free MCP configuration for `codex`, `claude`, `opencode`, and `agents` platforms using either `stdio` or `http` transport. Codex output SHALL use its `mcp_servers` TOML shape, Claude output SHALL use the `.mcp.json` `mcpServers` shape, OpenCode output SHALL use its `mcp` local or remote shape, and the generic agents output SHALL use a versioned JSON envelope. Stdio configuration SHALL invoke Compass with separate arguments; HTTP configuration SHALL use a loopback URL.
+
+#### Scenario: Render stdio configuration
+- **WHEN** a user requests stdio MCP configuration for a supported platform
+- **THEN** the output uses that platform's native schema and launches `compass serve --transport stdio` without credentials
+
+#### Scenario: Render HTTP configuration
+- **WHEN** a user requests HTTP MCP configuration for a supported platform
+- **THEN** the output uses that platform's native schema and the loopback MCP endpoint without credentials
+
+#### Scenario: Reject unsupported configuration values
+- **WHEN** a user requests an unsupported platform or transport
+- **THEN** the command exits with usage status 2 and identifies the invalid value
diff --git a/openspec/specs/agent-distribution/spec.md b/openspec/specs/agent-distribution/spec.md
new file mode 100644
index 000000000..275ef3df2
--- /dev/null
+++ b/openspec/specs/agent-distribution/spec.md
@@ -0,0 +1,45 @@
+# Agent distribution specification
+
+## Purpose
+
+Defines deterministic, native package exports that let supported agent
+harnesses install Compass skills and MCP configuration from one canonical
+inventory without duplicating graph behavior.
+
+## Requirements
+
+### Requirement: Canonical deterministic inventory
+
+Compass SHALL generate every native harness package from one versioned
+`distribution.toml` inventory. Equivalent inventory and embedded skills SHALL
+produce byte-identical files in stable path order.
+
+#### Scenario: Repeat generation
+
+- **WHEN** the same Compass binary exports a platform package twice
+- **THEN** every path and byte SHALL be identical
+
+### Requirement: Native complete packages
+
+Codex SHALL receive its plugin manifest, marketplace, `.mcp.json`, and copied
+skills. Claude Code SHALL receive its plugin manifest, required marketplace,
+`.mcp.json`, and copied skills. OpenCode SHALL receive its npm manifest,
+configuration, JavaScript artifact generated from the checked TypeScript
+plugin source, and copied skills.
+
+#### Scenario: Native validation
+
+- **WHEN** an exported package is validated for its declared platform
+- **THEN** missing native artifacts, missing harness versions, unsafe paths,
+  symlinks, credentials, and checksum mismatches SHALL fail closed
+
+### Requirement: Thin OpenCode bridge
+
+The OpenCode plugin MAY register MCP configuration tools but SHALL NOT contain
+graph persistence, traversal, ranking, or query behavior.
+
+#### Scenario: Bridge responsibility boundary
+
+- **WHEN** the generated OpenCode plugin is inspected and loaded
+- **THEN** it SHALL configure the native Compass MCP server without implementing
+  a second graph or query engine
diff --git a/openspec/specs/focused-agent-skills/spec.md b/openspec/specs/focused-agent-skills/spec.md
new file mode 100644
index 000000000..9f74bfe0e
--- /dev/null
+++ b/openspec/specs/focused-agent-skills/spec.md
@@ -0,0 +1,59 @@
+# Focused Agent Skills Specification
+
+## Purpose
+
+Provide portable, task-specific Compass Agent Skills while retaining the existing umbrella skill as the stable compatibility entry point.
+
+## Requirements
+
+### Requirement: Additive focused skill inventory
+Compass SHALL distribute exactly the focused skills `compass-navigate`, `compass-debug`, `compass-change-impact`, `compass-architecture`, `compass-index-maintenance`, and `compass-mcp-setup` in addition to the canonical `compass` skill. The canonical umbrella skill SHALL remain byte-for-byte unchanged by this capability.
+
+#### Scenario: Focused inventory is present
+- **WHEN** the embedded skill inventory is validated
+- **THEN** all six focused names and the canonical umbrella are present exactly once
+- **AND** the canonical umbrella digest matches the pre-change digest
+
+### Requirement: Portable complete skill trees
+Every focused skill SHALL be a complete Agent Skills-compatible directory whose `SKILL.md` name matches its lower-kebab directory. Focused skill content MUST contain no absolute filesystem paths and MUST use only relative links to bundled resources.
+
+#### Scenario: Focused package validation succeeds
+- **WHEN** a release build validates the embedded focused skill trees
+- **THEN** every tree satisfies the Agent Skills frontmatter, naming, path, and resource-completeness constraints
+
+#### Scenario: Invalid portable content is rejected
+- **WHEN** a focused tree contains a mismatched name, absolute path, or reference to an absent bundled resource
+- **THEN** validation fails before the Compass binary is built
+
+### Requirement: Discriminative activation metadata
+Focused skill descriptions SHALL identify distinct task boundaries, and a checked-in trigger corpus SHALL select one intended focused skill for boundary prompts while retaining the umbrella fallback for broad or explicit Compass invocations.
+
+#### Scenario: Boundary prompt selects one focused skill
+- **WHEN** the trigger-discrimination corpus evaluates a task-specific prompt
+- **THEN** exactly one focused skill has the highest matching activation evidence
+- **AND** that skill equals the corpus expectation
+
+#### Scenario: Umbrella invocation remains compatible
+- **WHEN** the corpus evaluates an explicit `/compass` invocation or a broad multi-operation Compass request
+- **THEN** no focused skill supersedes the canonical umbrella fallback
+
+### Requirement: Managed installation of complete inventory
+An installation that targets an Agent Skills-capable platform SHALL place the canonical umbrella and all six focused skills as sibling directories. Installation SHALL preflight every destination, use content checksums to identify current managed trees, be idempotent for equivalent inputs, and preserve unowned or modified destinations.
+
+#### Scenario: First install places complete trees
+- **WHEN** a user installs Compass guidance into an empty supported skill container
+- **THEN** the umbrella and all six focused skill trees are installed with ownership manifests covering every managed file
+
+#### Scenario: Equivalent reinstall is idempotent
+- **WHEN** the same Compass version and consumer set are installed again
+- **THEN** every checksum remains unchanged
+- **AND** the installer reports the target as current
+
+#### Scenario: Unowned focused destination blocks mutation
+- **WHEN** any focused skill destination already contains an unowned or modified tree
+- **THEN** installation fails before changing the umbrella, focused skills, adapters, or configuration
+
+#### Scenario: Last consumer uninstall removes focused trees
+- **WHEN** the last registered consumer uninstalls a managed skill collection
+- **THEN** the umbrella and every unmodified managed focused tree are removed
+- **AND** user-owned or modified trees are preserved
diff --git a/openspec/specs/harness-lifecycle/spec.md b/openspec/specs/harness-lifecycle/spec.md
new file mode 100644
index 000000000..4cdc4d746
--- /dev/null
+++ b/openspec/specs/harness-lifecycle/spec.md
@@ -0,0 +1,32 @@
+# Harness lifecycle specification
+
+## Purpose
+
+Defines isolated installed-artifact qualification so Compass can prove native
+agent packages survive complete harness lifecycles without altering user-owned
+state.
+
+## Requirements
+
+### Requirement: Installed-artifact evidence
+
+Each native package SHALL be qualified against the exact harness version
+recorded in `distribution.toml`. Export, install, discovery, load, MCP
+configuration, upgrade, and uninstall SHALL operate on the generated artifact.
+
+#### Scenario: Complete isolated lifecycle
+
+- **WHEN** the phase-end harness runs in isolated configuration roots
+- **THEN** every stage SHALL pass without credentials, network model calls, or
+  access to a source template
+
+### Requirement: Ownership preservation
+
+Upgrade and uninstall SHALL alter only harness-managed package files and
+configuration entries. User-authored instructions and unrelated plugins SHALL
+remain byte-identical.
+
+#### Scenario: User sentinel
+
+- **WHEN** a sentinel instruction exists beside managed harness state
+- **THEN** install, upgrade, and uninstall SHALL preserve its bytes
diff --git a/openspec/specs/mcp-conformance/spec.md b/openspec/specs/mcp-conformance/spec.md
new file mode 100644
index 000000000..87103010d
--- /dev/null
+++ b/openspec/specs/mcp-conformance/spec.md
@@ -0,0 +1,67 @@
+# mcp-conformance Specification
+
+## Purpose
+
+Defines how Compass proves current Model Context Protocol conformance across its
+supported transports and records real-client interoperability without weakening
+the normative protocol contract for lagging clients.
+
+## Requirements
+
+### Requirement: both MCP transports are conformance-gated
+
+Compass SHALL run deterministic conformance coverage for stdio and HTTP in CI.
+The HTTP leg SHALL use the official MCP conformance implementation pinned to an
+exact upstream revision that understands the 2026-07-28 requirement set.
+
+#### Scenario: qualify both transports in CI
+
+- **WHEN** the MCP conformance job runs
+- **THEN** stdio and HTTP are reported as separate required legs and any
+  unbaselined failure fails the job
+
+### Requirement: conformance evidence cannot be simulated by product fixtures
+
+Compass SHALL NOT expose test-only tools, prompts, resources, or protocol
+capabilities in the production server solely to satisfy diagnostic scenarios
+for capabilities Compass does not claim.
+
+#### Scenario: the reference suite requests an unsupported fixture capability
+
+- **WHEN** a diagnostic scenario depends on a tool or capability Compass does
+  not advertise
+- **THEN** the qualification records it as not applicable rather than adding a
+  production test hook or claiming a pass
+
+### Requirement: named clients prove discovery and invocation
+
+The interop matrix SHALL record exact tested versions of Codex CLI, Claude
+Code, and OpenCode. Every passing cell SHALL prove both discovery of the
+Compass MCP server and successful invocation of a real Compass tool.
+
+#### Scenario: qualify a named client
+
+- **WHEN** a pinned client is run with isolated stdio or HTTP configuration
+- **THEN** the receipt identifies the exact client version, discovered tool,
+  invoked tool, result evidence, transport, and pass/fail outcome
+
+### Requirement: latest protocol conformance governs the wave
+
+Compass SHALL treat the latest published MCP revision and the required stdio
+and HTTP conformance legs as the normative merge gate. Both production
+transports SHALL advertise only that revision and reject older negotiation. A named client that
+implements an older revision SHALL be recorded as incompatible and SHALL NOT
+cause Compass to restore protocol behavior removed by the latest revision.
+
+#### Scenario: a named client uses an older MCP lifecycle
+
+- **WHEN** discovery or invocation fails because the client requests an older
+  protocol revision or removed transport lifecycle
+- **THEN** the exact outcome is recorded, Compass retains the latest protocol,
+  and the client limitation does not by itself hold C-010
+
+#### Scenario: Compass fails current conformance
+
+- **WHEN** either required conformance leg fails or a client failure exposes a
+  Compass deviation from the latest published revision
+- **THEN** C-010 remains incomplete and the Wave 3 merge gate is explicitly held
diff --git a/openspec/specs/mcp-http/spec.md b/openspec/specs/mcp-http/spec.md
new file mode 100644
index 000000000..b8401d659
--- /dev/null
+++ b/openspec/specs/mcp-http/spec.md
@@ -0,0 +1,66 @@
+# mcp-http Specification
+
+## Purpose
+TBD - created by archiving change mcp-stateless-http. Update Purpose after archive.
+
+## Requirements
+
+### Requirement: HTTP requests are stateless MCP 2026-07-28 exchanges
+
+Compass SHALL advertise MCP 2026-07-28 from its HTTP service, route every HTTP
+POST without a server session, require the protocol and standard method headers
+plus applicable per-request metadata, and SHALL NOT issue or require
+`Mcp-Session-Id`.
+
+#### Scenario: discover and list tools without a session handshake
+
+- **WHEN** an authenticated HTTP client sends `server/discover` and then
+  `tools/list` with `Mcp-Protocol-Version: 2026-07-28`, matching `Mcp-Method`
+  headers, and required request metadata
+- **THEN** both requests succeed independently, advertise only 2026-07-28, and
+  neither response contains `Mcp-Session-Id`
+
+#### Scenario: reject incomplete per-request protocol metadata
+
+- **WHEN** a non-initialize HTTP request omits its protocol-version header,
+  method header, or required request metadata
+- **THEN** Compass rejects it before tool dispatch with a typed HTTP/JSON-RPC
+  protocol error
+
+### Requirement: no legacy MCP-2025 HTTP mode ships
+
+Compass SHALL NOT expose a runtime flag, hidden fallback, or session path for
+MCP-2025 HTTP clients. Stdio compatibility remains independently qualified.
+
+#### Scenario: send an old session handshake
+
+- **WHEN** a client sends an initialize request or an `Mcp-Session-Id` expecting
+  the former HTTP session flow
+- **THEN** Compass rejects initialize, ignores an obsolete session header on an
+  otherwise valid current request, never creates or restores a legacy session,
+  and documents the required stateless migration
+
+### Requirement: session timeout follows a bounded deprecation path
+
+Compass SHALL accept both spellings of `--session-timeout` through 0.4.x,
+validate the existing value grammar, ignore a valid value, print one warning,
+and preserve the command's success or failure exit code. The option SHALL be
+removed in 0.5.0.
+
+#### Scenario: use the deprecated option with another runtime failure
+
+- **WHEN** a valid `--session-timeout` accompanies an HTTP invocation that
+  otherwise fails
+- **THEN** stderr includes the deprecation/removal warning and the invocation
+  retains the same runtime-failure exit code
+
+### Requirement: existing HTTP security and selection boundaries remain intact
+
+Compass SHALL preserve bearer and API-key authentication, allowed-host checks,
+bounded request and response bodies, and per-request multi-project selection.
+
+#### Scenario: exercise security and project inputs
+
+- **WHEN** requests use invalid credentials, an untrusted host, an oversized
+  body, or a valid project selector
+- **THEN** the existing rejection or selection behavior remains unchanged
diff --git a/openspec/specs/mcp-result-envelope/spec.md b/openspec/specs/mcp-result-envelope/spec.md
new file mode 100644
index 000000000..f4afb622d
--- /dev/null
+++ b/openspec/specs/mcp-result-envelope/spec.md
@@ -0,0 +1,82 @@
+# mcp-result-envelope Specification
+
+## Purpose
+TBD - created by archiving change mcp-result-envelope. Update Purpose after archive.
+
+## Requirements
+
+### Requirement: core navigation tools return a common versioned envelope
+
+Compass SHALL return `compass.code_context.v1` structured content for
+`search_symbols`, `get_callers`, `get_callees`, and `get_impact`, containing
+repository and generation identity, evidence-scoped freshness, the prior typed
+query payload, evidence and confidence summaries, truncation state, and
+warnings.
+
+#### Scenario: invoke a core navigation tool
+
+- **WHEN** a client successfully invokes any of the four core navigation tools
+- **THEN** the MCP result is `resultType: "complete"` and its structured content
+  matches the tool's advertised output schema with `schema` equal to
+  `compass.code_context.v1`
+
+### Requirement: existing typed navigation semantics are preserved
+
+Compass SHALL embed the complete prior `compass.query/1` response under `data`
+without discarding or reinterpreting evidence, direction, multiplicity,
+ambiguity, bounds, diagnostics, truncation, or deterministic ordering.
+
+#### Scenario: compare a result before and after the envelope
+
+- **WHEN** the same graph and bounded request are evaluated through a core
+  navigation tool
+- **THEN** removing the envelope leaves the exact pre-envelope typed response
+
+### Requirement: protocol and product discriminators remain separate
+
+Compass SHALL use MCP `resultType` only as the protocol-level completion
+discriminator and SHALL carry the Compass schema name in structured content's
+separate `schema` field.
+
+#### Scenario: serialize an MCP 2026 tool response
+
+- **WHEN** rmcp serializes a successful core navigation result for an MCP
+  2026-07-28 peer
+- **THEN** top-level `resultType` is `complete` and structured content does not
+  redefine or overload that field
+
+### Requirement: discovery ordering and tool names remain stable
+
+Compass SHALL preserve the existing deterministic tool ordering and names while
+advertising closed output schemas for the four migrated tools.
+
+#### Scenario: list tools repeatedly
+
+- **WHEN** a client requests the tool list more than once
+- **THEN** tools appear in the same order with unchanged names and the four
+  migrated tools expose equivalent output schemas
+
+### Requirement: remaining text results are explicitly deprecated
+
+Compass SHALL mark every remaining text-only tool result, plus the explicit
+text-traversal mode of `query_graph`, deprecated in discovery while retaining
+its current name and behavior until a typed replacement is separately shipped.
+
+#### Scenario: discover a legacy text tool
+
+- **WHEN** a client lists tools
+- **THEN** each legacy text result has a deprecation description and Compass
+  deprecation metadata, while typed tools are not mislabeled
+
+### Requirement: the final envelope obeys the response-byte bound
+
+Compass SHALL measure the encoded structured-content envelope against the
+request's `maxResponseBytes` value and fail explicitly rather than publishing a
+successful oversized result.
+
+#### Scenario: envelope overhead crosses the bound
+
+- **WHEN** the nested query result is within the byte bound but adding the MCP
+  envelope would exceed it
+- **THEN** Compass returns the query-response limit failure and no structured
+  result larger than the requested bound
diff --git a/openspec/specs/partition-contract/spec.md b/openspec/specs/partition-contract/spec.md
new file mode 100644
index 000000000..11d604c75
--- /dev/null
+++ b/openspec/specs/partition-contract/spec.md
@@ -0,0 +1,36 @@
+# partition-contract Specification
+
+## Purpose
+TBD - created by archiving change extract-compass-partition. Update Purpose after archive.
+
+## Requirements
+
+### Requirement: storage-neutral ownership
+
+The workspace SHALL provide `compass-partition` without dependencies on
+`prolly-map`, `prolly-store-sqlite`, `compass-ir`, or `compass-analysis`.
+
+#### Scenario: inspect the dependency tree
+
+- **WHEN** the crate dependency tree is inspected
+- **THEN** none of the forbidden dependencies is reachable
+
+### Requirement: byte compatibility
+
+Canonical JSON and typed graph keys SHALL remain byte-identical to the existing
+`compass-history` contract.
+
+#### Scenario: use history compatibility exports
+
+- **WHEN** existing canonical, round-trip, and diff tests run unchanged
+- **THEN** all encoded bytes and reconstructed graph behavior remain identical
+
+### Requirement: typed boundary errors
+
+`compass-partition` SHALL expose its own error type, and `compass-history` SHALL
+convert that error at its public compatibility boundary.
+
+#### Scenario: canonical encoding fails
+
+- **WHEN** the partition encoder cannot encode a value
+- **THEN** history reports a typed `HistoryError` sourced from `PartitionError`
diff --git a/openspec/specs/preflight-graph-size-estimate/spec.md b/openspec/specs/preflight-graph-size-estimate/spec.md
new file mode 100644
index 000000000..de2122559
--- /dev/null
+++ b/openspec/specs/preflight-graph-size-estimate/spec.md
@@ -0,0 +1,37 @@
+# preflight-graph-size-estimate Specification
+
+## Purpose
+TBD - created by archiving change preflight-graph-size-estimate. Update Purpose after archive.
+
+## Requirements
+
+### Requirement: Oversized graph estimates fail before extraction
+
+Compass SHALL estimate canonical graph payload size after deterministic source
+discovery and before project-wide per-file extraction. When the estimate exceeds
+the canonical publication bound, Compass SHALL return a typed limit error rather
+than an empty result.
+
+#### Scenario: Calibrated fixture exceeds the bound
+
+- **WHEN** the measured synthetic fixture is evaluated against its calibrated bound
+- **THEN** estimation fails before extraction completes
+- **AND** time to error is below 322 ms, 20% of the recorded 1.61 s baseline
+- **AND** the error names `--exclude <pattern>` and `.compassignore`
+
+### Requirement: Estimation is bounded and deterministic
+
+The estimate SHALL perform bounded work, use saturating arithmetic, depend on
+root-relative source metadata, and produce the same result for equivalent
+inputs in different checkout locations.
+
+#### Scenario: Equivalent source trees
+
+- **WHEN** equivalent source files exist beneath different absolute roots
+- **THEN** their estimates and limit outcomes are identical
+
+#### Scenario: Parser-oversized source
+
+- **WHEN** a source exceeds `max_source_bytes`
+- **THEN** the estimate accounts only for its inventory/partial record
+- **AND** does not amplify bytes Compass will not parse
diff --git a/openspec/specs/rmcp-migration/spec.md b/openspec/specs/rmcp-migration/spec.md
new file mode 100644
index 000000000..707df9b08
--- /dev/null
+++ b/openspec/specs/rmcp-migration/spec.md
@@ -0,0 +1,49 @@
+# rmcp-migration Specification
+
+## Purpose
+TBD - created by archiving change rmcp-3-migration. Update Purpose after archive.
+
+## Requirements
+
+### Requirement: exact rmcp 3.1.4 dependency
+
+Compass SHALL resolve rmcp at exactly version 3.1.4 from the workspace
+dependency declaration.
+
+#### Scenario: inspect workspace dependency state
+
+- **WHEN** Cargo metadata and the lockfile are inspected
+- **THEN** rmcp resolves to 3.1.4 and member crates inherit the workspace entry
+
+### Requirement: stdio behavior remains compatible
+
+Compass SHALL preserve bounded, blank-line-tolerant MCP stdio operation while
+using the rmcp 3.x server API.
+
+#### Scenario: exercise the in-memory stdio-equivalent protocol
+
+- **WHEN** a client initializes, lists tools and resources, calls a tool, reads
+  a resource, and closes the duplex transport
+- **THEN** all operations complete with the same public results and errors as
+  the rmcp 2.2 implementation
+
+### Requirement: discovery contract remains stable
+
+Compass SHALL preserve the existing server identity, advertised capabilities,
+ordered tool names and input schemas, and ordered resource inventory.
+
+#### Scenario: compare migrated discovery to the rmcp 2.2 golden
+
+- **WHEN** the normalized discovery contract is generated under rmcp 3.1.4
+- **THEN** it exactly matches the checked-in rmcp 2.2 golden
+
+### Requirement: dependency policy remains satisfied
+
+The migration SHALL document the exact transitive package delta and SHALL pass
+the repository license, source, ban, lint, and unsafe-code policies.
+
+#### Scenario: qualify resolved dependencies
+
+- **WHEN** dependency and workspace policy gates run
+- **THEN** rmcp remains acceptably licensed, no disallowed source is introduced,
+  and the workspace continues to compile without unsafe Compass code
diff --git a/openspec/specs/snapshot-publication-errors/spec.md b/openspec/specs/snapshot-publication-errors/spec.md
new file mode 100644
index 000000000..18a3edd93
--- /dev/null
+++ b/openspec/specs/snapshot-publication-errors/spec.md
@@ -0,0 +1,32 @@
+# snapshot-publication-errors Specification
+
+## Purpose
+Make canonical graph snapshot limit failures recoverable through existing
+scope controls while preserving bounded publication behavior.
+
+## Requirements
+
+### Requirement: Oversized canonical graphs report a resource limit
+
+Compass SHALL reject a canonical graph whose encoded size exceeds the active
+snapshot publication limit as a typed snapshot limit failure, distinct from an
+empty or corrupt snapshot.
+
+#### Scenario: Canonical graph exceeds the default limit
+- **WHEN** snapshot validation observes `graph_bytes` above `MAX_GRAPH_BYTES`
+- **THEN** it returns `SnapshotError::Limit` and does not publish the manifest
+
+#### Scenario: Canonical graph byte count is empty
+- **WHEN** snapshot validation observes a zero `graph_bytes` value
+- **THEN** it returns a corruption failure rather than a limit failure
+
+### Requirement: Limit remediation names shipped scope controls
+
+The oversized-graph failure SHALL name `--exclude <pattern>` and
+`.compassignore` as concrete recovery actions and SHALL NOT advertise an
+override that the snapshot publication path does not yet honor.
+
+#### Scenario: CLI renders the oversized-graph failure
+- **WHEN** a CLI operation encounters the oversized canonical graph manifest
+- **THEN** stderr names both scope controls and the process exits with code 1
+- **AND** the message does not name `COMPASS_MAX_GRAPH_BYTES`
diff --git a/openspec/specs/snapshot-publication-limit/spec.md b/openspec/specs/snapshot-publication-limit/spec.md
new file mode 100644
index 000000000..05279ec8c
--- /dev/null
+++ b/openspec/specs/snapshot-publication-limit/spec.md
@@ -0,0 +1,22 @@
+# snapshot-publication-limit Specification
+
+## Purpose
+TBD - created by archiving change honor-max-graph-bytes-on-publication. Update Purpose after archive.
+
+## Requirements
+
+### Requirement: Publication honors the explicit graph-byte override
+
+Compass SHALL use `COMPASS_MAX_GRAPH_BYTES` consistently for canonical graph
+preflight, encoding, manifest validation, snapshot streaming, and publication.
+
+#### Scenario: Valid explicit override
+
+- **WHEN** the environment contains a positive raw-byte, MB, or GB value
+- **THEN** snapshot publication uses that finite bound
+- **AND** the actionable error advertises the override
+
+#### Scenario: Missing or invalid override
+
+- **WHEN** the override is absent, zero, invalid, overflowing, or cannot fit the platform
+- **THEN** the effective limit is the unchanged 2 GiB default
diff --git a/openspec/specs/snapshot-streaming/spec.md b/openspec/specs/snapshot-streaming/spec.md
new file mode 100644
index 000000000..36a9c6247
--- /dev/null
+++ b/openspec/specs/snapshot-streaming/spec.md
@@ -0,0 +1,73 @@
+# snapshot-streaming Specification
+
+## Purpose
+Provide bounded manifest-only and chunk-streaming access to current SQLite graph snapshots while preserving integrity checks and the existing full-read compatibility contract.
+
+## Requirements
+
+### Requirement: Manifest-only snapshot reads
+The store SHALL expose a manifest-only read that validates the active snapshot manifest without reading or allocating storage for payload chunks.
+
+#### Scenario: Valid active manifest
+- **WHEN** a caller requests metadata for a valid active snapshot
+- **THEN** the store returns the validated manifest without reading its payload objects
+
+#### Scenario: Missing or invalid active manifest
+- **WHEN** the active catalog entry is missing, malformed, or violates the manifest contract
+- **THEN** the store returns the same typed corruption or format failure used by snapshot reads
+
+### Requirement: Bounded chunk-streaming reads
+The store SHALL expose a streaming read that delivers one bounded stored chunk at a time and SHALL validate chunk presence, total payload length, the maximum graph-byte limit, and the payload digest before reporting success. The API contract SHALL state that delivered chunks remain provisional until successful return so callers do not commit unverified bytes irreversibly.
+
+#### Scenario: Valid multi-chunk snapshot
+- **WHEN** a caller streams a valid snapshot containing more than one chunk
+- **THEN** every callback receives at most one stored chunk and the returned manifest matches the published snapshot
+
+#### Scenario: Missing or corrupt payload data
+- **WHEN** a chunk is missing, the accumulated length differs from the manifest, the configured bound is exceeded, or the digest differs
+- **THEN** the stream terminates with a typed non-empty error and does not report successful validation
+
+#### Scenario: Caller commits streamed content
+- **WHEN** a caller performs irreversible work using delivered chunks
+- **THEN** the API documentation directs it to stage the work until the stream returns success or independently verify it before commit
+
+#### Scenario: Consumer rejects a chunk
+- **WHEN** the consumer callback returns a typed error for a delivered chunk
+- **THEN** the store stops reading further chunks and returns that error
+
+### Requirement: Full-read compatibility
+The existing full-payload snapshot read SHALL retain its public signature and observable valid/corrupt behavior, while being implemented as an explicit collector over the bounded streaming path.
+
+#### Scenario: Existing caller requests full bytes
+- **WHEN** a caller invokes the full snapshot read for a valid snapshot
+- **THEN** the store returns the same manifest and byte sequence as the published payload
+
+#### Scenario: Existing caller reads corrupt data
+- **WHEN** a caller invokes the full snapshot read for a corrupt snapshot
+- **THEN** the store returns the same typed failure as the streaming validation path
+
+### Requirement: Production integrity checks avoid payload-sized allocation
+Snapshot validation and snapshot-reference generation SHALL preserve their existing success and failure semantics for valid and corrupt snapshots without allocating memory proportional to the manifest payload size.
+
+#### Scenario: Validate a valid snapshot
+- **WHEN** production validation is requested for a valid snapshot
+- **THEN** it verifies all chunks and returns the manifest without collecting the payload
+
+#### Scenario: Validate a corrupt snapshot
+- **WHEN** production validation is requested for a snapshot with corrupt or missing payload data
+- **THEN** it returns the same failure that the previous full-read validation returned
+
+#### Scenario: Generate a reference for corrupt payload data
+- **WHEN** snapshot-reference generation encounters a corrupt or missing payload chunk
+- **THEN** it rejects the snapshot rather than publishing a reference to unverified content
+
+### Requirement: Snapshot durability behavior remains atomic
+The additive read APIs SHALL preserve round-trip, reopen, interruption/corruption rejection, and atomic publication behavior of the existing SQLite snapshot format.
+
+#### Scenario: Reopen after successful publication
+- **WHEN** a published store is checkpointed and reopened read-only
+- **THEN** manifest-only, streaming, validation, reference, and full-read operations agree on snapshot identity and integrity
+
+#### Scenario: Interrupted candidate publication
+- **WHEN** immutable payload objects exist but the active selector was not atomically advanced
+- **THEN** every active-snapshot read continues to observe only the prior complete snapshot
diff --git a/openspec/specs/surreal-graph-projection/spec.md b/openspec/specs/surreal-graph-projection/spec.md
new file mode 100644
index 000000000..bc435f8d2
--- /dev/null
+++ b/openspec/specs/surreal-graph-projection/spec.md
@@ -0,0 +1,62 @@
+# Surreal Graph Projection Specification
+
+## Purpose
+
+Defines a lossless, optional, generation-atomic SurrealDB projection of canonical Compass graph generations without changing the default graph authority or product surface.
+
+## Requirements
+
+### Requirement: Optional dependency isolation
+The projection capability SHALL live in a focused integration crate, SHALL require an explicit engine feature, and SHALL not link SurrealDB into default Compass library or binary builds. Surreal-enabled profiles MUST use exactly the reviewed SurrealDB 3.2.4 release and retain the recorded license obligations.
+
+#### Scenario: Default workspace build
+- **WHEN** Compass is built without a `compass-graphdb-surreal` engine feature
+- **THEN** no SurrealDB package is present in that build's dependency graph or linked artifact
+
+#### Scenario: Enabled embedded profile
+- **WHEN** a caller explicitly enables Mem, SurrealKV, or RocksDB support
+- **THEN** the adapter uses pinned SurrealDB 3.2.4 and exposes only that selected embedded-engine capability
+
+### Requirement: Canonical immutable generation input
+The projection SHALL accept only a validated `compass.graph/1` document and a non-empty repository identity. Every projected record SHALL carry the repository identity, the document generation identity, the projection schema version, and its stable Compass identity. A projection MUST be deterministic for equivalent inputs and MUST reject unsupported graph or projection schema versions explicitly.
+
+#### Scenario: Valid generation is planned
+- **WHEN** a validated canonical graph and non-empty repository identity are projected twice
+- **THEN** both plans contain byte-equivalent, identically ordered node and relation records with the same identities
+
+#### Scenario: Invalid input is rejected
+- **WHEN** the repository identity is empty or the graph fails `compass.graph/1` validation
+- **THEN** projection fails with a typed error and publishes no active generation
+
+### Requirement: Lossless typed relation mapping
+The projection SHALL use schemafull node and relation tables and a closed mapping from every Compass edge kind to a typed relation family with a required original `kind`. Stable edge identity, source-to-target direction, parallel multiplicity, self-loops, source anchors, provenance, and confidence MUST survive a projection round trip without semantic loss.
+
+#### Scenario: Relationship semantics round trip
+- **WHEN** one generation contains parallel same-direction edges, a reverse edge, and a self-loop with distinct evidence and confidence
+- **THEN** reading the projected generation returns the same edge IDs, endpoints, kinds, ordering, evidence, anchors, and confidence values
+
+#### Scenario: Closed mapping remains exhaustive
+- **WHEN** the Compass edge vocabulary is compared with the projection mapping
+- **THEN** every supported edge kind maps to exactly one typed relation family and no arbitrary relation-table name can be supplied by a caller
+
+### Requirement: Generation-atomic activation
+The adapter SHALL stage all records for one candidate generation, validate candidate counts and identities, and update a repository-scoped active-generation pointer only in the same successful transaction. Readers SHALL resolve the active generation once per operation. Failed, cancelled, or interrupted staging MUST leave the previously active generation visible and MUST never expose the partial candidate.
+
+#### Scenario: Successful activation
+- **WHEN** a complete candidate passes validation and its transaction commits
+- **THEN** the active pointer selects that exact generation and all of its projected records are visible together
+
+#### Scenario: Interrupted candidate
+- **WHEN** staging stops before activation or the transaction is cancelled after only part of a candidate is written
+- **THEN** readers continue to observe the previous complete generation and no partial candidate is active
+
+### Requirement: Typed and bounded adapter surface
+The adapter SHALL expose typed projection and activation operations only. It MUST NOT expose arbitrary caller-authored SurrealQL, MCP rendering, CLI presentation, or an unbounded result path. Database statements SHALL come from a closed internal query plan and all untrusted values SHALL be parameter-bound.
+
+#### Scenario: Untrusted identifiers
+- **WHEN** repository, generation, node, or edge identities contain SurrealQL metacharacters
+- **THEN** they remain data values and cannot alter the selected statement or relation family
+
+#### Scenario: Presentation boundary
+- **WHEN** the integration crate is compiled in isolation
+- **THEN** it has no dependency on `compass-cli` or `compass-mcp` and exports no presentation-specific response type
diff --git a/openspec/specs/vendor-discovery-policy/spec.md b/openspec/specs/vendor-discovery-policy/spec.md
new file mode 100644
index 000000000..b4c70a116
--- /dev/null
+++ b/openspec/specs/vendor-discovery-policy/spec.md
@@ -0,0 +1,37 @@
+# vendor-discovery-policy Specification
+
+## Purpose
+TBD - created by archiving change vendor-skip-policy. Update Purpose after archive.
+
+## Requirements
+
+### Requirement: vendor source is eligible by default
+
+Compass SHALL NOT exclude a directory solely because its name is `vendor`.
+
+#### Scenario: discover workspace and Go vendor source
+
+- **WHEN** default discovery scans Rust workspace-member source and Go source
+  beneath `vendor/`
+- **THEN** both sources are eligible for classification and publication
+
+### Requirement: vendor exclusion remains explicit
+
+Compass SHALL apply configured or command-line `vendor/**` exclusions through
+the existing scope and ignore contracts.
+
+#### Scenario: repository opts out of vendor source
+
+- **WHEN** the repository configures `vendor/**` in project scope,
+  `.compassignore`, or `--exclude`
+- **THEN** matching vendored source is excluded deterministically
+
+### Requirement: watcher parity
+
+Filesystem watching SHALL use the same default vendor eligibility as discovery.
+
+#### Scenario: vendor source changes
+
+- **WHEN** an otherwise eligible file beneath `vendor/` changes
+- **THEN** the watcher allows the event unless an explicit ignore or scope rule
+  excludes it
diff --git a/package-lock.json b/package-lock.json
index c6674faa7..02804d3ed 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -573,6 +573,18 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/@ai-sdk/provider": {
+      "version": "3.0.8",
+      "resolved": "https://registry.npmjs.org/@ai-sdk/provider/-/provider-3.0.8.tgz",
+      "integrity": "sha512-oGMAgGoQdBXbZqNG0Ze56CHjDZ1IDYOwGYxYjO5KLSlz5HiNQ9udIXsPZ61VWaHGZ5XW/jyjmr6t2xz2jGVwbQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "json-schema": "^0.4.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/@alloc/quick-lru": {
       "version": "5.2.0",
       "resolved": "https://registry.npmjs.org/@alloc/quick-lru/-/quick-lru-5.2.0.tgz",
@@ -1373,6 +1385,10 @@
         }
       }
     },
+    "node_modules/@compass/opencode-plugin": {
+      "resolved": "packages/compass-opencode",
+      "link": true
+    },
     "node_modules/@compass/viewer": {
       "resolved": "packages/compass-viewer",
       "link": true
@@ -2987,6 +3003,84 @@
         }
       }
     },
+    "node_modules/@msgpackr-extract/msgpackr-extract-darwin-arm64": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-darwin-arm64/-/msgpackr-extract-darwin-arm64-3.0.4.tgz",
+      "integrity": "sha512-LCkGo6JDfaBhgST7UpPWgNgLINpcpabaHfyz5OBx75nUYxBsaEPxjnyNjWpeb/xBup/682QnBfRBy2/LvPutZQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ]
+    },
+    "node_modules/@msgpackr-extract/msgpackr-extract-darwin-x64": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-darwin-x64/-/msgpackr-extract-darwin-x64-3.0.4.tgz",
+      "integrity": "sha512-zExlW9zUJKZH/tOtVMttwjKa4Xm/3KcNjnE3dPN92uCktwavMxpgCA3MoJK/DOnTWsQgo224OaST27/mPNAf+w==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ]
+    },
+    "node_modules/@msgpackr-extract/msgpackr-extract-linux-arm": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-linux-arm/-/msgpackr-extract-linux-arm-3.0.4.tgz",
+      "integrity": "sha512-Tg3yX65f5GbtXLkrYEHE5oibZG9epyYWas7FogTTEJeDEF9JlXJzKgXaNhT3UXlTOeA+AfZpYZYZ0uPj7Cfquw==",
+      "cpu": [
+        "arm"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@msgpackr-extract/msgpackr-extract-linux-arm64": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-linux-arm64/-/msgpackr-extract-linux-arm64-3.0.4.tgz",
+      "integrity": "sha512-dgX0P/9wGPJeHFBG+ZmhgE6bmtMt7NP5CRBGyyktpopdk/mW4POnrpQsSLtKI1dwpc+pPLuXHDh6vvskyQE/sw==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@msgpackr-extract/msgpackr-extract-linux-x64": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-linux-x64/-/msgpackr-extract-linux-x64-3.0.4.tgz",
+      "integrity": "sha512-8TNXMEjJc3QEy7R/x1INhgiU+XakDAFUzBhaz7+Rbrs8NH5UQeHQxxmzsSBJGyV6I1jW79undiQm8tOI+D+8FQ==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@msgpackr-extract/msgpackr-extract-win32-x64": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-win32-x64/-/msgpackr-extract-win32-x64-3.0.4.tgz",
+      "integrity": "sha512-CmCXPQrkbwExx3j946/PtHWHbYJiCRBRDl4BlkRQcJB/YOwQxJRTpoo7aTsortjgoJ1x7opzTSxn7C+ASSLVjQ==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
     "node_modules/@next/env": {
       "version": "16.2.12",
       "resolved": "https://registry.npmjs.org/@next/env/-/env-16.2.12.tgz",
@@ -3159,6 +3253,52 @@
         "node": ">= 8"
       }
     },
+    "node_modules/@opencode-ai/plugin": {
+      "version": "1.18.25",
+      "resolved": "https://registry.npmjs.org/@opencode-ai/plugin/-/plugin-1.18.25.tgz",
+      "integrity": "sha512-Kb34zFqYosFNiMd1IuYiZGjX17z+18Srm7tHZMCz+uMVRTYNkEw1FTrfAK2FLbggwYdgzifGwKMNF1slLT8eLw==",
+      "license": "MIT",
+      "dependencies": {
+        "@ai-sdk/provider": "3.0.8",
+        "@opencode-ai/sdk": "1.18.25",
+        "effect": "4.0.0-beta.83",
+        "zod": "4.1.8"
+      },
+      "peerDependencies": {
+        "@opentui/core": ">=0.4.5",
+        "@opentui/keymap": ">=0.4.5",
+        "@opentui/solid": ">=0.4.5"
+      },
+      "peerDependenciesMeta": {
+        "@opentui/core": {
+          "optional": true
+        },
+        "@opentui/keymap": {
+          "optional": true
+        },
+        "@opentui/solid": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@opencode-ai/plugin/node_modules/zod": {
+      "version": "4.1.8",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-4.1.8.tgz",
+      "integrity": "sha512-5R1P+WwQqmmMIEACyzSvo4JXHY5WiAFHRMg+zBZKgKS+Q1viRa0C1hmUKtHltoIFKtIdki3pRxkmpP74jnNYHQ==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/colinhacks"
+      }
+    },
+    "node_modules/@opencode-ai/sdk": {
+      "version": "1.18.25",
+      "resolved": "https://registry.npmjs.org/@opencode-ai/sdk/-/sdk-1.18.25.tgz",
+      "integrity": "sha512-GwgwhW+vE8FWSDw730SjzqNhsWXB0uJjbFOiqFkmM+USFuG13HuTlGe6SR2ixt+WXxoD6FV1hILWqsXyqej9hQ==",
+      "license": "MIT",
+      "dependencies": {
+        "cross-spawn": "7.0.6"
+      }
+    },
     "node_modules/@pierre/diffs": {
       "version": "1.2.12",
       "resolved": "https://registry.npmjs.org/@pierre/diffs/-/diffs-1.2.12.tgz",
@@ -7949,7 +8089,6 @@
       "version": "7.0.6",
       "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
       "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "path-key": "^3.1.0",
@@ -8485,6 +8624,46 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/effect": {
+      "version": "4.0.0-beta.83",
+      "resolved": "https://registry.npmjs.org/effect/-/effect-4.0.0-beta.83.tgz",
+      "integrity": "sha512-0wsak8RtgGAr9UWSbVDgJHZcUqMSvicHcvaZv1MbMM7MCGgW4Rn/137J1MHQbwYPcwYGxT/IqehFd+UbYuj78w==",
+      "license": "MIT",
+      "dependencies": {
+        "@standard-schema/spec": "^1.1.0",
+        "fast-check": "^4.8.0",
+        "find-my-way-ts": "^0.1.6",
+        "ini": "^7.0.0",
+        "kubernetes-types": "^1.30.0",
+        "msgpackr": "^2.0.1",
+        "multipasta": "^0.2.7",
+        "toml": "^4.1.1",
+        "uuid": "^14.0.0",
+        "yaml": "^2.9.0"
+      }
+    },
+    "node_modules/effect/node_modules/ini": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/ini/-/ini-7.0.0.tgz",
+      "integrity": "sha512-ifK0CgjALofS5bkrcTy4RaQ9Vx2Knf/eLeIO+NaswQEpH1UblrtTSCIvN71qQDMq0PeQ/SSPojvEJp9vvvfr+w==",
+      "license": "ISC",
+      "engines": {
+        "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
+      }
+    },
+    "node_modules/effect/node_modules/uuid": {
+      "version": "14.0.2",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-14.0.2.tgz",
+      "integrity": "sha512-xZe/16rV4aa+HGSOCiY2YeLT1OybRLrrkL/Rqaq7p7GMVXjFh+6wN4oMYgjFmnSnhY8t6Xpdl2l9qmnHYuMHwQ==",
+      "funding": [
+        "https://github.com/sponsors/broofa",
+        "https://github.com/sponsors/ctavan"
+      ],
+      "license": "MIT",
+      "bin": {
+        "uuid": "dist-node/bin/uuid"
+      }
+    },
     "node_modules/electron-to-chromium": {
       "version": "1.5.396",
       "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.396.tgz",
@@ -9101,6 +9280,28 @@
       "integrity": "sha512-fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g==",
       "license": "MIT"
     },
+    "node_modules/fast-check": {
+      "version": "4.9.0",
+      "resolved": "https://registry.npmjs.org/fast-check/-/fast-check-4.9.0.tgz",
+      "integrity": "sha512-7ms6T7SybUev/PQITciI0yLM2pOSFy5zpG8Ty7tQofcVaQUvrMXp6CBwqF6fThLCLOrfBtuHAtwq6Yu4XPCllg==",
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://github.com/sponsors/dubzzz"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fast-check"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "pure-rand": "^8.0.0"
+      },
+      "engines": {
+        "node": ">=12.17.0"
+      }
+    },
     "node_modules/fast-deep-equal": {
       "version": "3.1.3",
       "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
@@ -9233,6 +9434,12 @@
         "url": "https://opencollective.com/express"
       }
     },
+    "node_modules/find-my-way-ts": {
+      "version": "0.1.6",
+      "resolved": "https://registry.npmjs.org/find-my-way-ts/-/find-my-way-ts-0.1.6.tgz",
+      "integrity": "sha512-a85L9ZoXtNAey3Y6Z+eBWW658kO/MwR7zIafkIUPUMf3isZG0NCs2pjW2wtjxAKuJPxMAsHUIP4ZPGv0o5gyTA==",
+      "license": "MIT"
+    },
     "node_modules/find-up": {
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/find-up/-/find-up-5.0.0.tgz",
@@ -10704,7 +10911,6 @@
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
       "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
-      "dev": true,
       "license": "ISC"
     },
     "node_modules/istextorbinary": {
@@ -10851,6 +11057,12 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/json-schema": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/json-schema/-/json-schema-0.4.0.tgz",
+      "integrity": "sha512-es94M3nTIfsEPisRafak+HDLfHXnKBhV3vU5eqPcS3flIWqcxJWgXHXiey3YrpaNsanY5ei1VoYEbOzijuq9BA==",
+      "license": "(AFL-2.1 OR BSD-3-Clause)"
+    },
     "node_modules/json-schema-traverse": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
@@ -11033,6 +11245,12 @@
         "node": ">=6"
       }
     },
+    "node_modules/kubernetes-types": {
+      "version": "1.30.0",
+      "resolved": "https://registry.npmjs.org/kubernetes-types/-/kubernetes-types-1.30.0.tgz",
+      "integrity": "sha512-Dew1okvhM/SQcIa2rcgujNndZwU8VnSapDgdxlYoB84ZlpAD43U6KLAFqYo17ykSFGHNPrg0qry0bP+GJd9v7Q==",
+      "license": "Apache-2.0"
+    },
     "node_modules/leven": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/leven/-/leven-3.1.0.tgz",
@@ -12981,6 +13199,43 @@
       "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
       "license": "MIT"
     },
+    "node_modules/msgpackr": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/msgpackr/-/msgpackr-2.1.0.tgz",
+      "integrity": "sha512-p/pBCVO63CsvvpkomUnNNag6+n38rULuDA6HHe70o2gtC8ODI52foF/4ko2qQcp6OiErJXTmrZeXmsGGHsIQNQ==",
+      "license": "MIT",
+      "optionalDependencies": {
+        "msgpackr-extract": "^3.0.4"
+      }
+    },
+    "node_modules/msgpackr-extract": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/msgpackr-extract/-/msgpackr-extract-3.0.4.tgz",
+      "integrity": "sha512-4kmO/MdyUIkLIvTPr8VHLil4AtoKIoniWPIEk5+CDy0xnWC84azhSFmuJ7PxZdsYtiP5kEeQsORAVIeMgxT+Hw==",
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "node-gyp-build-optional-packages": "5.2.2"
+      },
+      "bin": {
+        "download-msgpackr-prebuilds": "bin/download-prebuilds.js"
+      },
+      "optionalDependencies": {
+        "@msgpackr-extract/msgpackr-extract-darwin-arm64": "3.0.4",
+        "@msgpackr-extract/msgpackr-extract-darwin-x64": "3.0.4",
+        "@msgpackr-extract/msgpackr-extract-linux-arm": "3.0.4",
+        "@msgpackr-extract/msgpackr-extract-linux-arm64": "3.0.4",
+        "@msgpackr-extract/msgpackr-extract-linux-x64": "3.0.4",
+        "@msgpackr-extract/msgpackr-extract-win32-x64": "3.0.4"
+      }
+    },
+    "node_modules/multipasta": {
+      "version": "0.2.8",
+      "resolved": "https://registry.npmjs.org/multipasta/-/multipasta-0.2.8.tgz",
+      "integrity": "sha512-ZPWuMKyv0cSO29f7hozp+k6+crZbQijV8ipMvxNxRf2SwtYGTX1ZX89Kd20VV4H9Znonx+EQn+iy1wGQsJ+b+Q==",
+      "license": "MIT"
+    },
     "node_modules/mute-stream": {
       "version": "0.0.8",
       "resolved": "https://registry.npmjs.org/mute-stream/-/mute-stream-0.0.8.tgz",
@@ -13151,6 +13406,21 @@
       "license": "MIT",
       "optional": true
     },
+    "node_modules/node-gyp-build-optional-packages": {
+      "version": "5.2.2",
+      "resolved": "https://registry.npmjs.org/node-gyp-build-optional-packages/-/node-gyp-build-optional-packages-5.2.2.tgz",
+      "integrity": "sha512-s+w+rBWnpTMwSFbaE0UXsRlg7hU4FjekKU4eyAih5T8nJuNZT1nNsskXpxmeqSK9UzkBl6UgRlnKc8hz8IEqOw==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "detect-libc": "^2.0.1"
+      },
+      "bin": {
+        "node-gyp-build-optional-packages": "bin.js",
+        "node-gyp-build-optional-packages-optional": "optional.js",
+        "node-gyp-build-optional-packages-test": "build-test.js"
+      }
+    },
     "node_modules/node-releases": {
       "version": "2.0.51",
       "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.51.tgz",
@@ -13772,7 +14042,6 @@
       "version": "3.1.1",
       "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
       "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
-      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -14219,6 +14488,22 @@
         "node": ">=6"
       }
     },
+    "node_modules/pure-rand": {
+      "version": "8.4.2",
+      "resolved": "https://registry.npmjs.org/pure-rand/-/pure-rand-8.4.2.tgz",
+      "integrity": "sha512-vvuOGgcuPJAirlHvuQw1TrOiw7ptaIXXmIbNuiNOY6lNGJJH49PQ1Kj4nd783nPdQhQdicgOjVI2yI/9BD6/Ng==",
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://github.com/sponsors/dubzzz"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fast-check"
+        }
+      ],
+      "license": "MIT"
+    },
     "node_modules/qs": {
       "version": "6.15.3",
       "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.3.tgz",
@@ -15398,7 +15683,6 @@
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
       "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "shebang-regex": "^3.0.0"
@@ -15411,7 +15695,6 @@
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
       "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
-      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -16327,6 +16610,15 @@
         "node": ">=0.6"
       }
     },
+    "node_modules/toml": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/toml/-/toml-4.3.0.tgz",
+      "integrity": "sha512-lVb8X9BsPVuH0M4BKeS91tXAmJvCjQ5UIyAbQFaxkKGyUFK2RPkhwaFSQH8vbpl1d23eu/IBH+dwVMHWaq9A5A==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=20"
+      }
+    },
     "node_modules/tough-cookie": {
       "version": "6.0.2",
       "resolved": "https://registry.npmjs.org/tough-cookie/-/tough-cookie-6.0.2.tgz",
@@ -17221,7 +17513,6 @@
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
       "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
-      "dev": true,
       "license": "ISC",
       "dependencies": {
         "isexe": "^2.0.0"
@@ -17651,6 +17942,17 @@
         "url": "https://github.com/sponsors/wooorm"
       }
     },
+    "packages/compass-opencode": {
+      "name": "@compass/opencode-plugin",
+      "version": "0.3.7",
+      "dependencies": {
+        "@opencode-ai/plugin": "1.18.25"
+      },
+      "devDependencies": {
+        "typescript": "^5.9.3",
+        "vitest": "^3.2.4"
+      }
+    },
     "packages/compass-viewer": {
       "name": "@compass/viewer",
       "version": "0.1.0",
diff --git a/packages/compass-opencode/package.json b/packages/compass-opencode/package.json
new file mode 100644
index 000000000..bb16c28a9
--- /dev/null
+++ b/packages/compass-opencode/package.json
@@ -0,0 +1,24 @@
+{
+  "name": "@compass/opencode-plugin",
+  "version": "0.3.7",
+  "private": true,
+  "type": "module",
+  "exports": "./src/index.js",
+  "files": [
+    "src/index.js",
+    "src/index.ts"
+  ],
+  "scripts": {
+    "build": "node scripts/generate.mjs",
+    "check-generated": "node scripts/generate.mjs --check",
+    "typecheck": "npm run check-generated && tsc --noEmit",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "@opencode-ai/plugin": "1.18.25"
+  },
+  "devDependencies": {
+    "typescript": "^5.9.3",
+    "vitest": "^3.2.4"
+  }
+}
diff --git a/packages/compass-opencode/scripts/generate.mjs b/packages/compass-opencode/scripts/generate.mjs
new file mode 100644
index 000000000..a47d4303b
--- /dev/null
+++ b/packages/compass-opencode/scripts/generate.mjs
@@ -0,0 +1,39 @@
+import { readFile, writeFile } from "node:fs/promises"
+import { dirname, join } from "node:path"
+import { fileURLToPath } from "node:url"
+
+import ts from "typescript"
+
+const root = join(dirname(fileURLToPath(import.meta.url)), "..")
+const sourcePath = join(root, "src", "index.ts")
+const outputPath = join(root, "src", "index.js")
+const source = await readFile(sourcePath, "utf8")
+const result = ts.transpileModule(source, {
+  compilerOptions: {
+    module: ts.ModuleKind.ESNext,
+    newLine: ts.NewLineKind.LineFeed,
+    target: ts.ScriptTarget.ES2022,
+  },
+  fileName: sourcePath,
+  reportDiagnostics: true,
+})
+const errors = (result.diagnostics ?? []).filter(
+  (diagnostic) => diagnostic.category === ts.DiagnosticCategory.Error,
+)
+if (errors.length > 0) {
+  const host = {
+    getCanonicalFileName: (name) => name,
+    getCurrentDirectory: () => root,
+    getNewLine: () => "\n",
+  }
+  throw new Error(ts.formatDiagnostics(errors, host))
+}
+const generated = result.outputText.replaceAll("\r\n", "\n")
+if (process.argv.includes("--check")) {
+  const current = await readFile(outputPath, "utf8").catch(() => "")
+  if (current !== generated) {
+    throw new Error("src/index.js is stale; run npm run build -w @compass/opencode-plugin")
+  }
+} else {
+  await writeFile(outputPath, generated, "utf8")
+}
diff --git a/packages/compass-opencode/src/index.js b/packages/compass-opencode/src/index.js
new file mode 100644
index 000000000..d1a0a2719
--- /dev/null
+++ b/packages/compass-opencode/src/index.js
@@ -0,0 +1,25 @@
+import { tool } from "@opencode-ai/plugin";
+const MCP_URL = "http://127.0.0.1:8080/mcp";
+/** Thin OpenCode bridge. Compass owns every graph and query operation. */
+export const CompassPlugin = async ({ $ }) => ({
+    tool: {
+        compass_mcp_config: tool({
+            description: "Emit a credential-free Compass MCP configuration for OpenCode.",
+            args: {
+                transport: tool.schema.enum(["stdio", "http"]).default("stdio"),
+            },
+            async execute({ transport }) {
+                if (transport === "http") {
+                    return JSON.stringify({
+                        mcp: {
+                            compass: { type: "remote", url: MCP_URL, enabled: true },
+                        },
+                    }, null, 2);
+                }
+                const result = await $ `compass agent mcp-config --platform opencode --transport stdio`.quiet();
+                return result.text();
+            },
+        }),
+    },
+});
+export default CompassPlugin;
diff --git a/packages/compass-opencode/src/index.ts b/packages/compass-opencode/src/index.ts
new file mode 100644
index 000000000..28d6cc0ef
--- /dev/null
+++ b/packages/compass-opencode/src/index.ts
@@ -0,0 +1,28 @@
+import { type Plugin, tool } from "@opencode-ai/plugin"
+
+const MCP_URL = "http://127.0.0.1:8080/mcp"
+
+/** Thin OpenCode bridge. Compass owns every graph and query operation. */
+export const CompassPlugin: Plugin = async ({ $ }) => ({
+  tool: {
+    compass_mcp_config: tool({
+      description: "Emit a credential-free Compass MCP configuration for OpenCode.",
+      args: {
+        transport: tool.schema.enum(["stdio", "http"]).default("stdio"),
+      },
+      async execute({ transport }) {
+        if (transport === "http") {
+          return JSON.stringify({
+            mcp: {
+              compass: { type: "remote", url: MCP_URL, enabled: true },
+            },
+          }, null, 2)
+        }
+        const result = await $`compass agent mcp-config --platform opencode --transport stdio`.quiet()
+        return result.text()
+      },
+    }),
+  },
+})
+
+export default CompassPlugin
diff --git a/packages/compass-opencode/tests/plugin.integration.test.ts b/packages/compass-opencode/tests/plugin.integration.test.ts
new file mode 100644
index 000000000..2817335ca
--- /dev/null
+++ b/packages/compass-opencode/tests/plugin.integration.test.ts
@@ -0,0 +1,40 @@
+import { describe, expect, it } from "vitest"
+
+import CompassPlugin from "../src/index"
+
+type PluginContext = Parameters<typeof CompassPlugin>[0]
+
+describe("installed Compass OpenCode bridge", () => {
+  it("loads through the plugin API and emits the native HTTP MCP entry", async () => {
+    const context = {
+      $: () => {
+        throw new Error("the HTTP configuration path must not spawn a process")
+      },
+    } as unknown as PluginContext
+    const hooks = await CompassPlugin(context)
+    const registered = hooks.tool?.compass_mcp_config
+    expect(registered).toBeDefined()
+    const rendered = await registered?.execute(
+      { transport: "http" },
+      {
+        directory: ".",
+        worktree: ".",
+        sessionID: "integration",
+        messageID: "integration",
+        agent: "integration",
+        abort: AbortSignal.timeout(1_000),
+        metadata: () => undefined,
+        ask: async () => undefined,
+      },
+    )
+    expect(JSON.parse(String(rendered))).toEqual({
+      mcp: {
+        compass: {
+          type: "remote",
+          url: "http://127.0.0.1:8080/mcp",
+          enabled: true,
+        },
+      },
+    })
+  })
+})
diff --git a/packages/compass-opencode/tsconfig.json b/packages/compass-opencode/tsconfig.json
new file mode 100644
index 000000000..bef439ba0
--- /dev/null
+++ b/packages/compass-opencode/tsconfig.json
@@ -0,0 +1,11 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "strict": true,
+    "noEmit": true,
+    "types": ["node"]
+  },
+  "include": ["src/**/*.ts", "tests/**/*.ts"]
+}
diff --git a/scripts/bounded_redacted_log.mjs b/scripts/bounded_redacted_log.mjs
new file mode 100644
index 000000000..ef5a85f4e
--- /dev/null
+++ b/scripts/bounded_redacted_log.mjs
@@ -0,0 +1,72 @@
+import { writeFile } from "node:fs/promises"
+import { spawn } from "node:child_process"
+
+const separator = process.argv.indexOf("--")
+const [outputPath, timeoutRaw, ...privatePaths] = process.argv.slice(2, separator)
+const command = process.argv.slice(separator + 1)
+const timeoutSeconds = Number.parseInt(timeoutRaw ?? "", 10)
+if (!outputPath || separator < 0 || command.length === 0) {
+  throw new Error("bounded_redacted_log requires OUTPUT TIMEOUT [PRIVATE_PATHS] -- COMMAND")
+}
+if (!Number.isSafeInteger(timeoutSeconds) || timeoutSeconds < 1 || timeoutSeconds > 3600) {
+  throw new Error("bounded_redacted_log timeout must be 1-3600 seconds")
+}
+
+const maximumBytes = 64 * 1024
+const captureLimit = maximumBytes + 4 * 1024
+const chunks = []
+let capturedBytes = 0
+let truncated = false
+let timedOut = false
+
+const child = spawn(command[0], command.slice(1), {
+  env: process.env,
+  stdio: ["inherit", "pipe", "pipe"],
+})
+const capture = (chunk) => {
+  const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)
+  const remaining = captureLimit - capturedBytes
+  if (remaining > 0) {
+    chunks.push(bytes.subarray(0, remaining))
+    capturedBytes += Math.min(bytes.length, remaining)
+  }
+  if (bytes.length > remaining) truncated = true
+}
+child.stdout.on("data", capture)
+child.stderr.on("data", capture)
+
+const timer = setTimeout(() => {
+  timedOut = true
+  child.kill("SIGTERM")
+  setTimeout(() => child.kill("SIGKILL"), 2_000).unref()
+}, timeoutSeconds * 1_000)
+
+const outcome = await new Promise((resolve, reject) => {
+  child.once("error", reject)
+  child.once("close", (code, signal) => resolve({ code, signal }))
+})
+clearTimeout(timer)
+
+let rendered = Buffer.concat(chunks).toString("utf8")
+for (const value of privatePaths.filter(Boolean).sort((left, right) => right.length - left.length)) {
+  rendered = rendered.replaceAll(value, "<private-path>")
+}
+rendered = rendered
+  .replaceAll(/\bsk-[A-Za-z0-9_-]+\b/g, "<redacted-secret>")
+  .replaceAll(/\bBearer\s+[^\s"']*/gi, "Bearer <redacted-secret>")
+  .replaceAll(
+    /\b(api[_-]?key|token|password)(["']?\s*[:=]\s*["']?)[^\s"',}]*/gi,
+    "$1$2<redacted-secret>",
+  )
+  .replaceAll(/\/(?:Users|home)\/[^/\s]+/g, "/<private-home>")
+if (rendered.length > maximumBytes) {
+  rendered = rendered.slice(0, maximumBytes)
+  truncated = true
+}
+if (timedOut) rendered += `\n<stage timed out after ${timeoutSeconds} seconds>\n`
+else if (truncated) rendered += "\n<log truncated at 65536 characters>\n"
+await writeFile(outputPath, rendered, { encoding: "utf8", mode: 0o600 })
+
+if (timedOut) process.exit(124)
+if (typeof outcome.code === "number") process.exit(outcome.code)
+process.exit(1)
diff --git a/scripts/check_surreal_feature_isolation.sh b/scripts/check_surreal_feature_isolation.sh
new file mode 100755
index 000000000..061f36770
--- /dev/null
+++ b/scripts/check_surreal_feature_isolation.sh
@@ -0,0 +1,44 @@
+#!/bin/sh
+set -eu
+
+workspace_root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
+cd "$workspace_root"
+
+check_tree() {
+    package=$1
+    tree=$(cargo tree -p "$package" --locked --prefix none)
+    if printf '%s\n' "$tree" | rg -i '^surrealdb[^ ]*( |$)' >/dev/null; then
+        printf 'error: SurrealDB reached default dependency tree for %s\n' "$package" >&2
+        exit 1
+    fi
+}
+
+check_tree compass-cli
+check_tree compass-mcp
+check_tree compass-core
+
+default_projection_tree=$(cargo tree -p compass-graphdb-surreal --locked --prefix none)
+if printf '%s\n' "$default_projection_tree" | rg -i '^surrealdb[^ ]*( |$)' >/dev/null; then
+    printf 'error: SurrealDB reached the projection crate without an engine feature\n' >&2
+    exit 1
+fi
+
+printf 'SurrealDB feature isolation: PASS\n'
+
+if [ "${1:-}" = "--binary" ]; then
+    target_root=${CARGO_TARGET_DIR:-target}
+    case "$target_root" in
+        /*) ;;
+        *) target_root="$workspace_root/$target_root" ;;
+    esac
+    cargo build -p compass-cli --locked
+    binary_path="$target_root/debug/compass"
+    if [ -f "$target_root/debug/compass.exe" ]; then
+        binary_path="$target_root/debug/compass.exe"
+    fi
+    if [ ! -f "$binary_path" ]; then
+        printf 'error: default compass binary was not produced under %s\n' "$target_root/debug" >&2
+        exit 1
+    fi
+    printf 'Default compass binary built from a SurrealDB-free dependency closure: PASS\n'
+fi
diff --git a/scripts/fixtures/mcp-conformance-expected-failures.yaml b/scripts/fixtures/mcp-conformance-expected-failures.yaml
new file mode 100644
index 000000000..b6c1c59cc
--- /dev/null
+++ b/scripts/fixtures/mcp-conformance-expected-failures.yaml
@@ -0,0 +1,12 @@
+# The upstream server runner uses named diagnostic tools to exercise these
+# checks. Compass intentionally does not expose fixture-only tools in its
+# production inventory. Keep this baseline check-granular: a whole-scenario
+# entry would hide unrelated protocol regressions.
+server:
+  - server-stateless:sep-2575-server-rejects-undeclared-capability
+  - server-stateless:sep-2575-missing-capability-http-400
+  - server-stateless:sep-2575-http-server-no-independent-requests-on-stream
+  - server-stateless:sep-2575-server-no-log-without-loglevel
+  # The runner invokes the first listed tool with `{}`; Compass preserves its
+  # stable ordering and the first tool correctly requires `query`.
+  - http-header-validation:sep-2243-server-accepts-whitespace-header-value
diff --git a/scripts/fixtures/mcp-conformance-project/src/lib.rs b/scripts/fixtures/mcp-conformance-project/src/lib.rs
new file mode 100644
index 000000000..cca6b6387
--- /dev/null
+++ b/scripts/fixtures/mcp-conformance-project/src/lib.rs
@@ -0,0 +1,7 @@
+pub fn alpha() -> usize {
+    1
+}
+
+pub fn beta() -> usize {
+    alpha() + 1
+}
diff --git a/scripts/fixtures/surreal-persistent-probes/SURREALDB-3.2.4-LICENSE.txt b/scripts/fixtures/surreal-persistent-probes/SURREALDB-3.2.4-LICENSE.txt
new file mode 100644
index 000000000..1ff6a3a2d
--- /dev/null
+++ b/scripts/fixtures/surreal-persistent-probes/SURREALDB-3.2.4-LICENSE.txt
@@ -0,0 +1,105 @@
+Business Source License 1.1
+
+Parameters
+
+Licensor:             SurrealDB Ltd.
+Licensed Work:        SurrealDB 3.0
+                      The Licensed Work is (c) 2025 SurrealDB Limited
+Additional Use Grant: You may make use of the Licensed Work, provided that
+                      you may not use the Licensed Work as a Database
+                      Service.
+
+					  “Database Service” means any product, service,
+					  platform, or commercial offering in which the Licensed
+					  Work is used to provide database functionality to
+					  third parties, other than your direct employees or
+					  contractors working on your behalf, that enables third
+					  parties to create, manage, or control schemas or
+					  tables.
+
+Change Date:          2030-01-01
+
+Change License:       Apache License, Version 2.0
+
+For information about alternative licensing arrangements for the Software,
+please visit: https://surrealdb.com/legal
+
+Notice
+
+The Business Source License (this document, or the "License") is not an Open
+Source license. However, the Licensed Work will eventually be made available
+under an Open Source License, as stated in this License.
+
+License text copyright (c) 2017 MariaDB Corporation Ab, All Rights Reserved.
+"Business Source License" is a trademark of MariaDB Corporation Ab.
+
+-----------------------------------------------------------------------------
+
+Business Source License 1.1
+
+Terms
+
+The Licensor hereby grants you the right to copy, modify, create derivative
+works, redistribute, and make non-production use of the Licensed Work. The
+Licensor may make an Additional Use Grant, above, permitting limited
+production use.
+
+Effective on the Change Date, or the fourth anniversary of the first publicly
+available distribution of a specific version of the Licensed Work under this
+License, whichever comes first, the Licensor hereby grants you rights under
+the terms of the Change License, and the rights granted in the paragraph
+above terminate.
+
+If your use of the Licensed Work does not comply with the requirements
+currently in effect as described in this License, you must purchase a
+commercial license from the Licensor, its affiliated entities, or authorized
+resellers, or you must refrain from using the Licensed Work.
+
+All copies of the original and modified Licensed Work, and derivative works
+of the Licensed Work, are subject to this License. This License applies
+separately for each version of the Licensed Work and the Change Date may vary
+for each version of the Licensed Work released by Licensor.
+
+You must conspicuously display this License on each original or modified copy
+of the Licensed Work. If you receive the Licensed Work in original or
+modified form from a third party, the terms and conditions set forth in this
+License apply to your use of that work.
+
+Any use of the Licensed Work in violation of this License will automatically
+terminate your rights under this License for the current and all other
+versions of the Licensed Work.
+
+This License does not grant you any right in any trademark or logo of
+Licensor or its affiliates (provided that you may use a trademark or logo of
+Licensor as expressly required by this License).
+
+TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON
+AN "AS IS" BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS,
+EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND
+TITLE.
+
+MariaDB hereby grants you permission to use this License's text to license
+your works, and to refer to it using the trademark "Business Source License",
+as long as you comply with the Covenants of Licensor below.
+
+Covenants of Licensor
+
+In consideration of the right to use this License's text and the "Business
+Source License" name and trademark, Licensor covenants to MariaDB, and to all
+other recipients of the licensed work to be provided by Licensor:
+
+1. To specify as the Change License the GPL Version 2.0 or any later version,
+   or a license that is compatible with GPL Version 2.0 or a later version,
+   where "compatible" means that software provided under the Change License can
+   be included in a program with software provided under GPL Version 2.0 or a
+   later version. Licensor may specify additional Change Licenses without
+   limitation.
+
+2. To either: (a) specify an additional grant of rights to use that does not
+   impose any additional restriction on the right granted in this License, as
+   the Additional Use Grant; or (b) insert the text "None".
+
+3. To specify a Change Date.
+
+4. Not to modify this License in any other way.
diff --git a/scripts/fixtures/surreal-persistent-probes/expected-v1.json b/scripts/fixtures/surreal-persistent-probes/expected-v1.json
new file mode 100644
index 000000000..beae59338
--- /dev/null
+++ b/scripts/fixtures/surreal-persistent-probes/expected-v1.json
@@ -0,0 +1,30 @@
+{
+  "schema": "compass.surreal-persistent-probe-expected/1",
+  "activeBeforeCrash": "g-0001",
+  "activeAfterCrash": "g-0001",
+  "activeAfterActivation": "g-0002",
+  "baseRelationIds": [
+    "edge-parallel-0001",
+    "edge-parallel-0002",
+    "edge-reverse-0001"
+  ],
+  "directedParallelPair": {
+    "count": 2,
+    "from": "node-alpha",
+    "to": "node-beta"
+  },
+  "pageCount": 17,
+  "pageSize": 128,
+  "relationCount": 2051,
+  "expandedRelationsCanonicalization": "UTF-8 compact JSON array, records sorted by id, object keys sorted lexicographically",
+  "expandedRelationsSha256": "749489773e9e0329852a9e025222722af46f68bb1cfb3f4c647e17cdff9b2261",
+  "orderedIdsCanonicalization": "UTF-8 stable relation IDs sorted lexicographically and joined by LF with no trailing LF",
+  "orderedIdsSha256": "8d95d3971f96e27f5e2f1dcfc0a1f1fba900dd958e3bb4fbadff43346bb160d3",
+  "postCrash": {
+    "activeGeneration": "g-0001",
+    "orderedIdsSha256": "8d95d3971f96e27f5e2f1dcfc0a1f1fba900dd958e3bb4fbadff43346bb160d3",
+    "relationCount": 2051
+  },
+  "scaleFirstId": "edge-scale-000000",
+  "scaleLastId": "edge-scale-002047"
+}
diff --git a/scripts/fixtures/surreal-persistent-probes/input-v1.json b/scripts/fixtures/surreal-persistent-probes/input-v1.json
new file mode 100644
index 000000000..fd54d5d10
--- /dev/null
+++ b/scripts/fixtures/surreal-persistent-probes/input-v1.json
@@ -0,0 +1,79 @@
+{
+  "schema": "compass.surreal-persistent-probe-input/1",
+  "database": "probe",
+  "namespace": "compass",
+  "activeGeneration": "g-0001",
+  "candidateGeneration": "g-0002",
+  "pageSize": 128,
+  "scaleEdgeCount": 2048,
+  "scaleRelationRule": {
+    "confidence": "0.500000",
+    "evenIndex": {
+      "from": "node-alpha",
+      "to": "node-gamma"
+    },
+    "idFormat": "edge-scale-{zero-padded-decimal-index:6}",
+    "indexRange": {
+      "endExclusive": 2048,
+      "startInclusive": 0
+    },
+    "oddIndex": {
+      "from": "node-gamma",
+      "to": "node-beta"
+    },
+    "provenance": {
+      "columnFormula": "index % 80",
+      "lineFormula": "index + 1",
+      "path": "src/generated.rs"
+    }
+  },
+  "nodes": [
+    {
+      "id": "node-alpha",
+      "name": "Alpha"
+    },
+    {
+      "id": "node-beta",
+      "name": "Beta"
+    },
+    {
+      "id": "node-gamma",
+      "name": "Gamma"
+    }
+  ],
+  "relations": [
+    {
+      "confidence": "0.875000",
+      "from": "node-alpha",
+      "id": "edge-parallel-0001",
+      "provenance": {
+        "column": 4,
+        "line": 11,
+        "path": "src/alpha.rs"
+      },
+      "to": "node-beta"
+    },
+    {
+      "confidence": "0.625000",
+      "from": "node-alpha",
+      "id": "edge-parallel-0002",
+      "provenance": {
+        "column": 9,
+        "line": 29,
+        "path": "src/alpha.rs"
+      },
+      "to": "node-beta"
+    },
+    {
+      "confidence": "1.000000",
+      "from": "node-beta",
+      "id": "edge-reverse-0001",
+      "provenance": {
+        "column": 2,
+        "line": 7,
+        "path": "src/beta.rs"
+      },
+      "to": "node-alpha"
+    }
+  ]
+}
diff --git a/scripts/fixtures/surreal-persistent-probes/manifest-v1.json b/scripts/fixtures/surreal-persistent-probes/manifest-v1.json
new file mode 100644
index 000000000..8a0fc310c
--- /dev/null
+++ b/scripts/fixtures/surreal-persistent-probes/manifest-v1.json
@@ -0,0 +1,25 @@
+{
+  "schema": "compass.surreal-persistent-probe-fixtures/1",
+  "files": [
+    {
+      "path": "SURREALDB-3.2.4-LICENSE.txt",
+      "sha256": "98a94ac615f88370865016487b436fa404560910bd329794ed7502277a94b805"
+    },
+    {
+      "path": "expected-v1.json",
+      "sha256": "8b78764f918bff576bd9395bf0b0e9c1807eb016edc0263101fc57bbbd681b2e"
+    },
+    {
+      "path": "input-v1.json",
+      "sha256": "69eb3ae05bd6bf4966b39fa59775b0f8f2b92b19eb41c4c41af870ef2bb16c43"
+    },
+    {
+      "path": "rocksdb-result-v1.json",
+      "sha256": "6a87740f9a3d9c5698fb3f1a2797a0cb0ec87deaed3d64de1d3c751e07b042c7"
+    },
+    {
+      "path": "surrealkv-result-v1.json",
+      "sha256": "32294e15028645095fd48d3438ffbf8abf82009fd14c0ebaedd10cee104e0cd5"
+    }
+  ]
+}
diff --git a/scripts/fixtures/surreal-persistent-probes/rocksdb-result-v1.json b/scripts/fixtures/surreal-persistent-probes/rocksdb-result-v1.json
new file mode 100644
index 000000000..9ef2cf36f
--- /dev/null
+++ b/scripts/fixtures/surreal-persistent-probes/rocksdb-result-v1.json
@@ -0,0 +1,90 @@
+{
+  "schema": "compass.surreal-persistent-probe-engine-result/1",
+  "engine": "rocksdb",
+  "engineVersion": "surrealdb-rocksdb 0.24.0-surreal.5 via surrealdb 3.2.4",
+  "status": "PASS",
+  "host": {
+    "architecture": "arm64",
+    "cargo": "1.97.1 (c980f4866 2026-06-30)",
+    "operatingSystem": "macOS 26.7 (25G224), Darwin 25.6.0",
+    "rustc": "1.97.1 (8bab26f4f 2026-07-14)"
+  },
+  "measurements": {
+    "cleanReleaseBuild": {
+      "maximumResidentSetBytes": 466075648,
+      "peakMemoryFootprintBytes": 111903440,
+      "wallSeconds": 289.65
+    },
+    "coldStart": {
+      "internalMicroseconds": [
+        49044,
+        48863,
+        48211,
+        48201,
+        52123
+      ],
+      "medianInternalMicroseconds": 48863,
+      "medianMaximumResidentSetBytes": 120963072,
+      "samples": 5
+    },
+    "releaseExecutableBytes": 70950208,
+    "selectedNormalDependencyLines": 411,
+    "workload": {
+      "maximumResidentSetBytes": 155287552,
+      "peakMemoryFootprintBytes": 132186736,
+      "wallSeconds": 2.59
+    }
+  },
+  "postCrash": {
+    "activeGeneration": "g-0001",
+    "orderedIdsSha256": "8d95d3971f96e27f5e2f1dcfc0a1f1fba900dd958e3bb4fbadff43346bb160d3",
+    "relationCount": 2051
+  },
+  "semantic": {
+    "activeAfterActivation": "g-0002",
+    "activeAfterCrash": "g-0001",
+    "activeBeforeCrash": "g-0001",
+    "baseRelations": [
+      {
+        "confidence": "0.875000",
+        "fromRecord": "node:g_0002_node_alpha",
+        "id": "edge-parallel-0001",
+        "provenance": {
+          "column": 4,
+          "line": 11,
+          "path": "src/alpha.rs"
+        },
+        "toRecord": "node:g_0002_node_beta"
+      },
+      {
+        "confidence": "0.625000",
+        "fromRecord": "node:g_0002_node_alpha",
+        "id": "edge-parallel-0002",
+        "provenance": {
+          "column": 9,
+          "line": 29,
+          "path": "src/alpha.rs"
+        },
+        "toRecord": "node:g_0002_node_beta"
+      },
+      {
+        "confidence": "1.000000",
+        "fromRecord": "node:g_0002_node_beta",
+        "id": "edge-reverse-0001",
+        "provenance": {
+          "column": 2,
+          "line": 7,
+          "path": "src/beta.rs"
+        },
+        "toRecord": "node:g_0002_node_alpha"
+      }
+    ],
+    "directedParallelCount": 2,
+    "orderedIdsSha256": "8d95d3971f96e27f5e2f1dcfc0a1f1fba900dd958e3bb4fbadff43346bb160d3",
+    "pageCount": 17,
+    "pageSize": 128,
+    "relationCount": 2051,
+    "scaleFirstId": "edge-scale-000000",
+    "scaleLastId": "edge-scale-002047"
+  }
+}
diff --git a/scripts/fixtures/surreal-persistent-probes/surrealkv-result-v1.json b/scripts/fixtures/surreal-persistent-probes/surrealkv-result-v1.json
new file mode 100644
index 000000000..049f4e664
--- /dev/null
+++ b/scripts/fixtures/surreal-persistent-probes/surrealkv-result-v1.json
@@ -0,0 +1,90 @@
+{
+  "schema": "compass.surreal-persistent-probe-engine-result/1",
+  "engine": "surrealkv",
+  "engineVersion": "surrealkv 0.21.4 via surrealdb 3.2.4",
+  "status": "PASS",
+  "host": {
+    "architecture": "arm64",
+    "cargo": "1.97.1 (c980f4866 2026-06-30)",
+    "operatingSystem": "macOS 26.7 (25G224), Darwin 25.6.0",
+    "rustc": "1.97.1 (8bab26f4f 2026-07-14)"
+  },
+  "measurements": {
+    "cleanReleaseBuild": {
+      "maximumResidentSetBytes": 405012480,
+      "peakMemoryFootprintBytes": 116736744,
+      "wallSeconds": 507.55
+    },
+    "coldStart": {
+      "internalMicroseconds": [
+        138700,
+        92313,
+        93375,
+        109426,
+        92986
+      ],
+      "medianInternalMicroseconds": 93375,
+      "medianMaximumResidentSetBytes": 35012608,
+      "samples": 5
+    },
+    "releaseExecutableBytes": 62247392,
+    "selectedNormalDependencyLines": 418,
+    "workload": {
+      "maximumResidentSetBytes": 54575104,
+      "peakMemoryFootprintBytes": 36307472,
+      "wallSeconds": 2.73
+    }
+  },
+  "postCrash": {
+    "activeGeneration": "g-0001",
+    "orderedIdsSha256": "8d95d3971f96e27f5e2f1dcfc0a1f1fba900dd958e3bb4fbadff43346bb160d3",
+    "relationCount": 2051
+  },
+  "semantic": {
+    "activeAfterActivation": "g-0002",
+    "activeAfterCrash": "g-0001",
+    "activeBeforeCrash": "g-0001",
+    "baseRelations": [
+      {
+        "confidence": "0.875000",
+        "fromRecord": "node:g_0002_node_alpha",
+        "id": "edge-parallel-0001",
+        "provenance": {
+          "column": 4,
+          "line": 11,
+          "path": "src/alpha.rs"
+        },
+        "toRecord": "node:g_0002_node_beta"
+      },
+      {
+        "confidence": "0.625000",
+        "fromRecord": "node:g_0002_node_alpha",
+        "id": "edge-parallel-0002",
+        "provenance": {
+          "column": 9,
+          "line": 29,
+          "path": "src/alpha.rs"
+        },
+        "toRecord": "node:g_0002_node_beta"
+      },
+      {
+        "confidence": "1.000000",
+        "fromRecord": "node:g_0002_node_beta",
+        "id": "edge-reverse-0001",
+        "provenance": {
+          "column": 2,
+          "line": 7,
+          "path": "src/beta.rs"
+        },
+        "toRecord": "node:g_0002_node_alpha"
+      }
+    ],
+    "directedParallelCount": 2,
+    "orderedIdsSha256": "8d95d3971f96e27f5e2f1dcfc0a1f1fba900dd958e3bb4fbadff43346bb160d3",
+    "pageCount": 17,
+    "pageSize": 128,
+    "relationCount": 2051,
+    "scaleFirstId": "edge-scale-000000",
+    "scaleLastId": "edge-scale-002047"
+  }
+}
diff --git a/scripts/qualify_code_graph_v1.sh b/scripts/qualify_code_graph_v1.sh
index 1c651e8ce..c2526fc09 100755
--- a/scripts/qualify_code_graph_v1.sh
+++ b/scripts/qualify_code_graph_v1.sh
@@ -231,18 +231,9 @@ python3 scripts/check_code_graph_v1_coverage.py \
   --corpus-manifest "$CORPUS_MANIFEST"
 
 echo "[code-graph-v1] enforce in-process scale ceilings"
-cargo test --locked -p compass-core --lib \
-  resolver_source_text_enforces_the_pre_read_byte_limit
-cargo test --locked -p compass-query --lib \
-  bounded_matching_scales_with_response_budget_on_500k_edges
-cargo test --locked -p compass-resolve --lib \
-  ambiguous_terminal_lookup_is_bounded_by_candidate_budget
-cargo test --locked -p compass-core --test pipeline_scale \
-  cold_and_warm_in_process_builds_stay_within_enterprise_ceiling
-cargo test --locked -p compass-query --test code_query_scale \
-  enterprise_queries_stay_within_in_process_ceiling
-cargo test --locked -p compass-resolve --test framework_resolution_scale \
-  shared_production_framework_resolution_stays_within_enterprise_ceiling
+cargo test --locked -p compass-core --test pipeline_scale
+cargo test --locked -p compass-query --test code_query_scale
+cargo test --locked -p compass-resolve --test framework_resolution_scale
 
 mkdir -p "$CORPUS/fixtures/code-graph"
 cp -R "$QUALIFY_ROOT/fixtures/code-graph/." "$CORPUS/fixtures/code-graph/"
diff --git a/scripts/qualify_codex_mcp_client.py b/scripts/qualify_codex_mcp_client.py
new file mode 100755
index 000000000..4d79c9afe
--- /dev/null
+++ b/scripts/qualify_codex_mcp_client.py
@@ -0,0 +1,367 @@
+#!/usr/bin/env python3
+"""Exercise Compass through the installed Codex app-server MCP client."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import queue
+import socket
+import subprocess
+import sys
+import tempfile
+import threading
+import time
+from collections import deque
+from pathlib import Path
+from typing import Any
+
+
+class AppServerError(RuntimeError):
+    pass
+
+
+class AppServerClient:
+    def __init__(self, codex: Path, env: dict[str, str], cwd: Path) -> None:
+        self._next_id = 1
+        self._messages: queue.Queue[dict[str, Any] | None] = queue.Queue()
+        self._stderr: deque[str] = deque(maxlen=100)
+        self._process = subprocess.Popen(
+            [str(codex), "app-server"],
+            cwd=cwd,
+            env=env,
+            stdin=subprocess.PIPE,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+            text=True,
+            bufsize=1,
+        )
+        self._stdout_thread = threading.Thread(target=self._read_stdout, daemon=True)
+        self._stderr_thread = threading.Thread(target=self._read_stderr, daemon=True)
+        self._stdout_thread.start()
+        self._stderr_thread.start()
+
+    def _read_stdout(self) -> None:
+        stdout = self._process.stdout
+        if stdout is None:
+            self._stderr.append("Codex app-server stdout pipe is unavailable")
+            self._messages.put(None)
+            return
+        for line in stdout:
+            try:
+                message = json.loads(line)
+            except json.JSONDecodeError:
+                continue
+            if isinstance(message, dict):
+                self._messages.put(message)
+        self._messages.put(None)
+
+    def _read_stderr(self) -> None:
+        stderr = self._process.stderr
+        if stderr is None:
+            self._stderr.append("Codex app-server stderr pipe is unavailable")
+            return
+        for line in stderr:
+            self._stderr.append(line.rstrip())
+
+    def _send(self, message: dict[str, Any]) -> None:
+        if self._process.poll() is not None:
+            raise AppServerError(self.diagnostics("Codex app-server exited"))
+        stdin = self._process.stdin
+        if stdin is None:
+            raise AppServerError(self.diagnostics("Codex app-server stdin pipe is unavailable"))
+        stdin.write(json.dumps(message, separators=(",", ":")) + "\n")
+        stdin.flush()
+
+    def notify(self, method: str) -> None:
+        self._send({"method": method})
+
+    def request(self, method: str, params: dict[str, Any]) -> dict[str, Any]:
+        request_id = self._next_id
+        self._next_id += 1
+        self._send({"id": request_id, "method": method, "params": params})
+        deadline = time.monotonic() + 30
+        while True:
+            remaining = deadline - time.monotonic()
+            if remaining <= 0:
+                raise AppServerError(self.diagnostics(f"timeout waiting for {method}"))
+            try:
+                message = self._messages.get(timeout=remaining)
+            except queue.Empty as error:
+                raise AppServerError(self.diagnostics(f"timeout waiting for {method}")) from error
+            if message is None:
+                raise AppServerError(self.diagnostics(f"app-server closed during {method}"))
+            if message.get("id") == request_id and "method" not in message:
+                return message
+            if "id" in message and isinstance(message.get("method"), str):
+                self._send(
+                    {
+                        "id": message["id"],
+                        "error": {"code": -32601, "message": "unsupported harness callback"},
+                    }
+                )
+
+    def diagnostics(self, prefix: str) -> str:
+        detail = "\n".join(self._stderr)
+        return f"{prefix}: {detail[-4000:]}" if detail else prefix
+
+    def close(self) -> None:
+        if self._process.poll() is None:
+            self._process.terminate()
+            try:
+                self._process.wait(timeout=3)
+            except subprocess.TimeoutExpired:
+                self._process.kill()
+                self._process.wait(timeout=3)
+
+
+def object_result(response: dict[str, Any], method: str) -> dict[str, Any]:
+    error = response.get("error")
+    if error is not None:
+        raise AppServerError(f"{method} failed: {json.dumps(error, sort_keys=True)}")
+    result = response.get("result")
+    if not isinstance(result, dict):
+        raise AppServerError(f"{method} returned no object result")
+    return result
+
+
+def free_port() -> int:
+    with socket.socket() as listener:
+        listener.bind(("127.0.0.1", 0))
+        return int(listener.getsockname()[1])
+
+
+def wait_for_server(process: subprocess.Popen[str], port: int) -> None:
+    deadline = time.monotonic() + 15
+    while time.monotonic() < deadline:
+        if process.poll() is not None:
+            raise AppServerError("Compass HTTP server exited before becoming ready")
+        try:
+            with socket.create_connection(("127.0.0.1", port), timeout=0.25):
+                return
+        except OSError:
+            time.sleep(0.1)
+    raise AppServerError("Compass HTTP server did not become ready")
+
+
+def run_checked(command: list[str], env: dict[str, str], cwd: Path) -> str:
+    process = subprocess.Popen(
+        command,
+        cwd=cwd,
+        env=env,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.STDOUT,
+    )
+    output = bytearray()
+
+    def drain_output() -> None:
+        stdout = process.stdout
+        if stdout is None:
+            return
+        while chunk := stdout.read(8192):
+            output.extend(chunk)
+            if len(output) > 4000:
+                del output[:-4000]
+
+    reader = threading.Thread(target=drain_output, daemon=True)
+    reader.start()
+    try:
+        returncode = process.wait(timeout=30)
+    except subprocess.TimeoutExpired as error:
+        process.kill()
+        process.wait(timeout=3)
+        reader.join(timeout=1)
+        detail = output.decode(errors="replace").strip()
+        suffix = f": {detail}" if detail else ""
+        raise AppServerError(f"command timed out after 30 seconds{suffix}") from error
+    reader.join(timeout=1)
+    if returncode != 0:
+        detail = output.decode(errors="replace").strip()
+        raise AppServerError(f"command failed ({returncode}): {detail}")
+    return output.decode(errors="replace").strip()
+
+
+def run(args: argparse.Namespace) -> dict[str, str]:
+    with tempfile.TemporaryDirectory(prefix="compass-codex-mcp-") as temp_value:
+        temp = Path(temp_value)
+        env = dict(os.environ)
+        env["CODEX_HOME"] = str(temp / "codex-home")
+        Path(env["CODEX_HOME"]).mkdir()
+        version_output = run_checked([str(args.codex), "--version"], env, temp)
+        expected_output = f"codex-cli {args.expected_version}"
+        if version_output != expected_output:
+            raise AppServerError(
+                f"expected {expected_output!r}, got {version_output!r}"
+            )
+        run_checked(
+            [str(args.codex), "features", "enable", "mcp_2026_07_28"],
+            env,
+            temp,
+        )
+
+        server: subprocess.Popen[str] | None = None
+        server_log = None
+        try:
+            if args.transport == "stdio":
+                registration = [
+                    str(args.codex),
+                    "mcp",
+                    "add",
+                    "compass",
+                    "--",
+                    str(args.compass),
+                    "serve",
+                    str(args.graph),
+                    "--transport",
+                    "stdio",
+                ]
+            else:
+                port = free_port()
+                server_log = (temp / "compass-http.log").open("w", encoding="utf-8")
+                server = subprocess.Popen(
+                    [
+                        str(args.compass),
+                        "serve",
+                        str(args.graph),
+                        "--transport",
+                        "http",
+                        "--host",
+                        "127.0.0.1",
+                        "--port",
+                        str(port),
+                        "--json-response",
+                    ],
+                    cwd=temp,
+                    env=env,
+                    stdout=subprocess.DEVNULL,
+                    stderr=server_log,
+                    text=True,
+                )
+                wait_for_server(server, port)
+                registration = [
+                    str(args.codex),
+                    "mcp",
+                    "add",
+                    "compass",
+                    "--url",
+                    f"http://127.0.0.1:{port}/mcp",
+                ]
+
+            run_checked(registration, env, temp)
+            client = AppServerClient(args.codex, env, temp)
+            try:
+                object_result(
+                    client.request(
+                        "initialize",
+                        {
+                            "clientInfo": {
+                                "name": "compass-interop",
+                                "title": "Compass interoperability harness",
+                                "version": "1.0.0",
+                            },
+                            "capabilities": {"experimentalApi": True},
+                        },
+                    ),
+                    "initialize",
+                )
+                client.notify("initialized")
+                object_result(
+                    client.request(
+                        "experimentalFeature/enablement/set",
+                        {"enablement": {"mcp_2026_07_28": True}},
+                    ),
+                    "experimentalFeature/enablement/set",
+                )
+                deadline = time.monotonic() + 15
+                entry: dict[str, Any] | None = None
+                tools: Any = None
+                while time.monotonic() < deadline:
+                    inventory = object_result(
+                        client.request("mcpServerStatus/list", {}),
+                        "mcpServerStatus/list",
+                    )
+                    entries = inventory.get("data")
+                    entry = next(
+                        (
+                            value
+                            for value in entries
+                            if isinstance(value, dict) and value.get("name") == "compass"
+                        ),
+                        None,
+                    ) if isinstance(entries, list) else None
+                    tools = entry.get("tools") if isinstance(entry, dict) else None
+                    if isinstance(tools, dict) and "graph_stats" in tools:
+                        break
+                    time.sleep(0.25)
+                if not isinstance(tools, dict) or "graph_stats" not in tools:
+                    raise AppServerError(
+                        f"Codex did not discover Compass graph_stats: {entry!r}"
+                    )
+
+                thread = object_result(
+                    client.request("thread/start", {"cwd": str(temp), "ephemeral": True}),
+                    "thread/start",
+                )
+                thread_value = thread.get("thread")
+                thread_id = thread_value.get("id") if isinstance(thread_value, dict) else None
+                if not isinstance(thread_id, str):
+                    raise AppServerError("Codex did not create an ephemeral thread")
+                call = object_result(
+                    client.request(
+                        "mcpServer/tool/call",
+                        {
+                            "threadId": thread_id,
+                            "server": "compass",
+                            "tool": "graph_stats",
+                            "arguments": {},
+                        },
+                    ),
+                    "mcpServer/tool/call",
+                )
+                content = call.get("content")
+                text = content[0].get("text") if isinstance(content, list) and content else None
+                if not isinstance(text, str) or not text.startswith("Nodes: "):
+                    raise AppServerError(f"unexpected graph_stats result: {call!r}")
+                return {
+                    "client": "codex-cli",
+                    "version": args.expected_version,
+                    "transport": args.transport,
+                    "discovery": "PASS",
+                    "invocation": "PASS",
+                    "status": "PASS",
+                    "tool": "graph_stats",
+                    "evidence": text.splitlines()[0],
+                }
+            finally:
+                client.close()
+        finally:
+            if server is not None and server.poll() is None:
+                server.terminate()
+                try:
+                    server.wait(timeout=3)
+                except subprocess.TimeoutExpired:
+                    server.kill()
+                    server.wait(timeout=3)
+            if server_log is not None:
+                server_log.close()
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--codex", type=Path, required=True)
+    parser.add_argument("--expected-version", required=True)
+    parser.add_argument("--compass", type=Path, required=True)
+    parser.add_argument("--graph", type=Path, required=True)
+    parser.add_argument("--transport", choices=("stdio", "http"), required=True)
+    args = parser.parse_args()
+    try:
+        print(json.dumps(run(args), sort_keys=True))
+    except (AppServerError, OSError, subprocess.SubprocessError) as error:
+        print(f"Codex MCP interop failed: {error}", file=sys.stderr)
+        return 1
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/scripts/qualify_harness_packages.sh b/scripts/qualify_harness_packages.sh
new file mode 100755
index 000000000..fa792c0fd
--- /dev/null
+++ b/scripts/qualify_harness_packages.sh
@@ -0,0 +1,316 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  echo "usage: $0 --compass PATH [--codex PATH] [--claude PATH] [--opencode PATH]" >&2
+}
+
+compass_binary=""
+codex_binary="codex"
+claude_binary="claude"
+opencode_binary="opencode"
+while (($# > 0)); do
+  case "$1" in
+    --compass|--codex|--claude|--opencode)
+      option="$1"
+      shift
+      if (($# == 0)); then
+        usage
+        exit 2
+      fi
+      case "$option" in
+        --compass) compass_binary="$1" ;;
+        --codex) codex_binary="$1" ;;
+        --claude) claude_binary="$1" ;;
+        --opencode) opencode_binary="$1" ;;
+      esac
+      ;;
+    *)
+      usage
+      exit 2
+      ;;
+  esac
+  shift
+done
+
+if [[ -z "$compass_binary" || ! -x "$compass_binary" ]]; then
+  echo "error: --compass must name an executable" >&2
+  exit 2
+fi
+for command in "$codex_binary" "$claude_binary" "$opencode_binary" node npm; do
+  if ! command -v "$command" >/dev/null 2>&1; then
+    echo "error: required harness command is unavailable: $command" >&2
+    exit 2
+  fi
+done
+
+scratch="$(mktemp -d "${TMPDIR:-/tmp}/compass-harness-lifecycle.XXXXXX")"
+cleanup() {
+  if [[ -n "$scratch" && -d "$scratch" && "$scratch" == *compass-harness-lifecycle.* ]]; then
+    rm -rf -- "$scratch"
+  fi
+}
+trap cleanup EXIT
+
+state="$scratch/state"
+packages="$scratch/packages"
+logs="$scratch/logs"
+script_root="$(cd "$(dirname "$0")" && pwd)"
+log_filter="$script_root/bounded_redacted_log.mjs"
+mkdir -p "$state/user" "$packages" "$logs"
+sentinel_content="user-owned instructions must survive managed package lifecycle"
+
+resolve_command() {
+  local resolved
+  resolved="$(command -v "$1")"
+  case "$resolved" in
+    /*) printf '%s' "$resolved" ;;
+    *) printf '%s/%s' "$(cd "$(dirname "$resolved")" && pwd)" "$(basename "$resolved")" ;;
+  esac
+}
+
+compass_binary="$(resolve_command "$compass_binary")"
+codex_binary="$(resolve_command "$codex_binary")"
+claude_binary="$(resolve_command "$claude_binary")"
+opencode_binary="$(resolve_command "$opencode_binary")"
+export PATH="$(dirname "$compass_binary"):$PATH"
+
+emit_log() {
+  local stage="$1"
+  echo "--- bounded redacted log: $stage ---" >&2
+  sed -n '1,240p' "$logs/$stage.log" >&2
+}
+
+run_logged() {
+  local stage="$1"
+  shift
+  set +e
+  node "$log_filter" "$logs/$stage.log" "${COMPASS_HARNESS_STAGE_TIMEOUT_SECONDS:-300}" \
+    "$scratch" "$state" "$packages" "$script_root" "${HOME:-}" "$PWD" -- "$@"
+  local stage_status=$?
+  set -e
+  if [[ "$stage_status" -ne 0 ]]; then
+    if [[ "$stage_status" -eq 124 ]]; then
+      echo "error: lifecycle stage $stage exceeded its duration limit" >&2
+    else
+      echo "error: lifecycle stage $stage failed with status $stage_status" >&2
+    fi
+    emit_log "$stage"
+    return "$stage_status"
+  fi
+}
+
+require_log_contains() {
+  local stage="$1"
+  local pattern="$2"
+  if ! grep -Fq -- "$pattern" "$logs/$stage.log"; then
+    echo "error: lifecycle stage $stage did not report $pattern" >&2
+    emit_log "$stage"
+    return 1
+  fi
+}
+
+require_skills_in_log() {
+  local stage="$1"
+  local skill
+  for skill in \
+    compass \
+    compass-architecture \
+    compass-change-impact \
+    compass-debug \
+    compass-index-maintenance \
+    compass-mcp-setup \
+    compass-navigate
+  do
+    require_log_contains "$stage" "$skill"
+  done
+}
+
+require_equal() {
+  local label="$1"
+  local expected="$2"
+  local actual="$3"
+  if [[ "$actual" != "$expected" ]]; then
+    echo "error: $label version mismatch: expected $expected, observed $actual" >&2
+    return 1
+  fi
+}
+
+extract_version() {
+  awk 'match($0, /[0-9]+\.[0-9]+\.[0-9]+/) { print substr($0, RSTART, RLENGTH); exit }' "$1"
+}
+
+make_sentinel() {
+  printf '%s\n' "$sentinel_content" >"$1"
+}
+
+require_sentinel() {
+  if ! cmp -s "$1" <(printf '%s\n' "$sentinel_content"); then
+    echo "error: harness modified user-owned sentinel" >&2
+    return 1
+  fi
+}
+
+installed_plugin_root() {
+  local cache_root="$1"
+  local marker="$2"
+  local match=""
+  local count=0
+  while IFS= read -r candidate; do
+    match="$candidate"
+    count=$((count + 1))
+  done < <(find "$cache_root" -maxdepth 8 -type f -path "*/$marker" -print | sort)
+  if [[ "$count" -ne 1 ]]; then
+    echo "error: expected one installed $marker below the isolated cache, observed $count" >&2
+    return 1
+  fi
+  dirname "$(dirname "$match")"
+}
+
+verify_installed_skills() {
+  local stage="$1"
+  local installed_root="$2"
+  local exported_root="$3"
+  run_logged "$stage" diff -qr "$exported_root/skills" "$installed_root/skills"
+}
+
+for platform in codex claude opencode; do
+  run_logged "export-$platform" "$compass_binary" agent export \
+    --platform "$platform" \
+    --transport stdio \
+    --out "$packages/$platform"
+  run_logged "validate-$platform" "$compass_binary" agent validate \
+    --platform "$platform" \
+    --path "$packages/$platform"
+done
+
+manifest_harness_version() {
+  node -e '
+    const fs = require("node:fs")
+    const manifest = JSON.parse(fs.readFileSync(process.argv[1], "utf8"))
+    if (typeof manifest.harness_version !== "string" || manifest.harness_version.length === 0) process.exit(2)
+    process.stdout.write(manifest.harness_version)
+  ' "$1/manifest.json"
+}
+
+expected_codex_version="$(manifest_harness_version "$packages/codex")"
+expected_claude_version="$(manifest_harness_version "$packages/claude")"
+expected_opencode_version="$(manifest_harness_version "$packages/opencode")"
+run_logged codex-version "$codex_binary" --version
+run_logged claude-version "$claude_binary" --version
+run_logged opencode-version "$opencode_binary" --version
+actual_codex_version="$(extract_version "$logs/codex-version.log")"
+actual_claude_version="$(extract_version "$logs/claude-version.log")"
+actual_opencode_version="$(extract_version "$logs/opencode-version.log")"
+require_equal Codex "$expected_codex_version" "$actual_codex_version"
+require_equal "Claude Code" "$expected_claude_version" "$actual_claude_version"
+require_equal OpenCode "$expected_opencode_version" "$actual_opencode_version"
+
+codex_home="$state/codex"
+mkdir -p "$codex_home"
+codex_sentinel="$codex_home/USER-INSTRUCTIONS.md"
+make_sentinel "$codex_sentinel"
+run_logged codex-marketplace env CODEX_HOME="$codex_home" HOME="$state/user" \
+  "$codex_binary" plugin marketplace add "$packages/codex" --json
+run_logged codex-available env CODEX_HOME="$codex_home" HOME="$state/user" \
+  "$codex_binary" plugin list --available --json
+require_log_contains codex-available '"compass"'
+run_logged codex-install env CODEX_HOME="$codex_home" HOME="$state/user" \
+  "$codex_binary" plugin add compass@compass-plugins --json
+require_sentinel "$codex_sentinel"
+run_logged codex-list env CODEX_HOME="$codex_home" HOME="$state/user" \
+  "$codex_binary" plugin list --json
+require_log_contains codex-list '"compass"'
+codex_plugin_root="$(installed_plugin_root "$codex_home/plugins/cache" ".codex-plugin/plugin.json")"
+verify_installed_skills codex-installed-skills "$codex_plugin_root" "$packages/codex"
+run_logged codex-skill-discovery env CODEX_HOME="$codex_home" HOME="$state/user" \
+  "$codex_binary" -C "$state/user" debug prompt-input
+require_skills_in_log codex-skill-discovery
+run_logged codex-mcp-list env CODEX_HOME="$codex_home" HOME="$state/user" \
+  "$codex_binary" mcp list
+require_log_contains codex-mcp-list compass
+# Codex documents plugin add as the reinstall/update operation for local marketplaces.
+run_logged codex-upgrade env CODEX_HOME="$codex_home" HOME="$state/user" \
+  "$codex_binary" plugin add compass@compass-plugins --json
+require_sentinel "$codex_sentinel"
+run_logged codex-uninstall env CODEX_HOME="$codex_home" HOME="$state/user" \
+  "$codex_binary" plugin remove compass@compass-plugins --json
+require_sentinel "$codex_sentinel"
+
+claude_home="$state/claude-home"
+mkdir -p "$claude_home"
+claude_sentinel="$claude_home/USER-INSTRUCTIONS.md"
+make_sentinel "$claude_sentinel"
+run_logged claude-validate env CLAUDE_CONFIG_DIR="$claude_home" HOME="$state/user" \
+  "$claude_binary" plugin validate "$packages/claude"
+run_logged claude-marketplace env CLAUDE_CONFIG_DIR="$claude_home" HOME="$state/user" \
+  "$claude_binary" plugin marketplace add "$packages/claude" --scope user
+run_logged claude-install env CLAUDE_CONFIG_DIR="$claude_home" HOME="$state/user" \
+  "$claude_binary" plugin install compass@compass-plugins --scope user --yes
+require_sentinel "$claude_sentinel"
+run_logged claude-list env CLAUDE_CONFIG_DIR="$claude_home" HOME="$state/user" \
+  "$claude_binary" plugin list
+require_log_contains claude-list compass
+claude_plugin_root="$(installed_plugin_root "$claude_home/plugins/cache" ".claude-plugin/plugin.json")"
+verify_installed_skills claude-installed-skills "$claude_plugin_root" "$packages/claude"
+run_logged claude-skill-discovery env CLAUDE_CONFIG_DIR="$claude_home" HOME="$state/user" \
+  "$claude_binary" plugin details compass@compass-plugins
+require_skills_in_log claude-skill-discovery
+run_logged claude-mcp-list env CLAUDE_CONFIG_DIR="$claude_home" HOME="$state/user" \
+  "$claude_binary" mcp list
+require_log_contains claude-mcp-list compass
+run_logged claude-upgrade env CLAUDE_CONFIG_DIR="$claude_home" HOME="$state/user" \
+  "$claude_binary" plugin update compass@compass-plugins --scope user --yes
+require_sentinel "$claude_sentinel"
+run_logged claude-uninstall env CLAUDE_CONFIG_DIR="$claude_home" HOME="$state/user" \
+  "$claude_binary" plugin uninstall compass@compass-plugins --scope user --yes
+require_sentinel "$claude_sentinel"
+
+opencode_project="$state/opencode-project"
+opencode_config="$state/opencode-config"
+mkdir -p "$opencode_project" "$opencode_config"
+opencode_sentinel="$opencode_project/USER-INSTRUCTIONS.md"
+make_sentinel "$opencode_sentinel"
+cp "$packages/opencode/opencode.json" "$opencode_project/opencode.json"
+run_logged opencode-pack npm pack "$packages/opencode" --pack-destination "$scratch" --json
+tarball=""
+tarball_count=0
+while IFS= read -r candidate; do
+  tarball="$(basename "$candidate")"
+  tarball_count=$((tarball_count + 1))
+done < <(find "$scratch" -maxdepth 1 -type f -name '*.tgz' -print | sort)
+if [[ "$tarball_count" -ne 1 ]]; then
+  echo "error: expected one packed OpenCode artifact, observed $tarball_count" >&2
+  exit 1
+fi
+run_logged opencode-install npm install --ignore-scripts --prefix "$opencode_project" "$scratch/$tarball"
+require_sentinel "$opencode_sentinel"
+opencode_plugin_root="$opencode_project/node_modules/@compass/opencode-plugin"
+verify_installed_skills opencode-installed-skills "$opencode_plugin_root" "$packages/opencode"
+(
+  cd "$opencode_project"
+  run_logged opencode-mcp-list env OPENCODE_CONFIG_DIR="$opencode_config" HOME="$state/user" \
+    "$opencode_binary" mcp list
+  run_logged opencode-skill-discovery env OPENCODE_CONFIG_DIR="$opencode_config" HOME="$state/user" \
+    "$opencode_binary" debug skill
+)
+require_log_contains opencode-mcp-list compass
+require_skills_in_log opencode-skill-discovery
+run_logged opencode-plugin-load node --input-type=module - "$opencode_project" <<'NODE'
+import { pathToFileURL } from "node:url"
+import path from "node:path"
+const project = process.argv[2]
+if (typeof project !== "string" || project.length === 0) throw new Error("missing project path")
+const pluginPath = path.join(project, "node_modules", "@compass", "opencode-plugin", "src", "index.js")
+const plugin = (await import(pathToFileURL(pluginPath).href)).default
+const hooks = await plugin({ $: () => { throw new Error("unexpected subprocess") } })
+const rendered = await hooks.tool.compass_mcp_config.execute({ transport: "http" }, {})
+const parsed = JSON.parse(rendered)
+if (parsed.mcp?.compass?.url !== "http://127.0.0.1:8080/mcp") process.exit(1)
+NODE
+run_logged opencode-upgrade npm install --ignore-scripts --force --prefix "$opencode_project" "$scratch/$tarball"
+require_sentinel "$opencode_sentinel"
+run_logged opencode-uninstall npm uninstall --ignore-scripts --prefix "$opencode_project" @compass/opencode-plugin
+require_sentinel "$opencode_sentinel"
+
+echo "qualified installed Codex $actual_codex_version, Claude Code $actual_claude_version, and OpenCode $actual_opencode_version packages"
diff --git a/scripts/qualify_mcp_conformance.sh b/scripts/qualify_mcp_conformance.sh
new file mode 100755
index 000000000..4a8407c4c
--- /dev/null
+++ b/scripts/qualify_mcp_conformance.sh
@@ -0,0 +1,156 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+readonly CONFORMANCE_REF="74edef34d674f563537be8c6587cebaa58e830ca"
+readonly SPEC_VERSION="2026-07-28"
+readonly REPOSITORY_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+readonly COMPASS_BIN="${COMPASS_BIN:-$REPOSITORY_ROOT/target/debug/compass}"
+readonly FIXTURE_ROOT="$REPOSITORY_ROOT/scripts/fixtures/mcp-conformance-project"
+readonly EXPECTED_FAILURES="$REPOSITORY_ROOT/scripts/fixtures/mcp-conformance-expected-failures.yaml"
+readonly PORT="${COMPASS_MCP_CONFORMANCE_PORT:-39091}"
+readonly RUNNER_TIMEOUT_SECONDS="${COMPASS_MCP_CONFORMANCE_TIMEOUT_SECONDS:-300}"
+readonly WORK_ROOT="$(mktemp -d "${TMPDIR:-/tmp}/compass-mcp-conformance.XXXXXX")"
+readonly GRAPH_PATH="$WORK_ROOT/compass-out/graph.json"
+readonly SERVER_LOG="$WORK_ROOT/server.log"
+
+server_pid=""
+cleanup() {
+  if [ -n "$server_pid" ]; then
+    kill "$server_pid" 2>/dev/null || true
+    wait "$server_pid" 2>/dev/null || true
+  fi
+  rm -rf "$WORK_ROOT"
+}
+trap cleanup EXIT
+
+case "$RUNNER_TIMEOUT_SECONDS" in
+  ''|*[!0-9]*)
+    echo "COMPASS_MCP_CONFORMANCE_TIMEOUT_SECONDS must be an integer from 1 through 1800" >&2
+    exit 1
+    ;;
+esac
+if [ "$RUNNER_TIMEOUT_SECONDS" -lt 1 ] || [ "$RUNNER_TIMEOUT_SECONDS" -gt 1800 ]; then
+  echo "COMPASS_MCP_CONFORMANCE_TIMEOUT_SECONDS must be an integer from 1 through 1800" >&2
+  exit 1
+fi
+
+run_bounded() {
+  python3 - "$RUNNER_TIMEOUT_SECONDS" "$@" <<'PY'
+import subprocess
+import sys
+
+timeout_seconds = int(sys.argv[1])
+command = sys.argv[2:]
+try:
+    completed = subprocess.run(command, timeout=timeout_seconds, check=False)
+except subprocess.TimeoutExpired:
+    print(
+        f"MCP conformance runner exceeded {timeout_seconds} seconds: {command[0]}",
+        file=sys.stderr,
+    )
+    raise SystemExit(124)
+raise SystemExit(completed.returncode)
+PY
+}
+
+if [ ! -x "$COMPASS_BIN" ]; then
+  echo "MCP conformance requires a built Compass binary: $COMPASS_BIN" >&2
+  exit 1
+fi
+
+"$COMPASS_BIN" update "$FIXTURE_ROOT" \
+  --store json \
+  --out "$WORK_ROOT" \
+  --force \
+  --no-cluster \
+  --no-viz >"$WORK_ROOT/update.log" 2>&1
+
+if [ ! -f "$GRAPH_PATH" ]; then
+  sed -n '1,160p' "$WORK_ROOT/update.log" >&2
+  echo "Compass did not publish the MCP conformance graph: $GRAPH_PATH" >&2
+  exit 1
+fi
+
+"$COMPASS_BIN" serve "$GRAPH_PATH" \
+  --transport http \
+  --host 127.0.0.1 \
+  --port "$PORT" \
+  --json-response >"$SERVER_LOG" 2>&1 &
+server_pid=$!
+
+ready=0
+for _attempt in $(seq 1 60); do
+  if ! kill -0 "$server_pid" 2>/dev/null; then
+    sed -n '1,160p' "$SERVER_LOG" >&2
+    echo "Compass MCP HTTP server exited before becoming ready" >&2
+    exit 1
+  fi
+  if curl --silent --output /dev/null --connect-timeout 1 "http://127.0.0.1:$PORT/mcp"; then
+    ready=1
+    break
+  fi
+  sleep 0.25
+done
+if [ "$ready" -ne 1 ]; then
+  sed -n '1,160p' "$SERVER_LOG" >&2
+  echo "Compass MCP HTTP server did not become ready" >&2
+  exit 1
+fi
+
+cd "$WORK_ROOT"
+for scenario in \
+  server-stateless \
+  tools-list \
+  resources-list \
+  prompts-list \
+  sep-2164-resource-not-found \
+  dns-rebinding-protection \
+  http-header-validation
+do
+  run_bounded npx --yes "github:modelcontextprotocol/conformance#$CONFORMANCE_REF" \
+    server \
+    --url "http://127.0.0.1:$PORT/mcp" \
+    --scenario "$scenario" \
+    --spec-version "$SPEC_VERSION" \
+    --expected-failures "$EXPECTED_FAILURES" \
+    --output-dir "$WORK_ROOT/results"
+done
+
+python3 - "$WORK_ROOT/results" <<'PY'
+import json
+import pathlib
+import sys
+
+result_root = pathlib.Path(sys.argv[1])
+matches = []
+for path in result_root.glob("server-http-header-validation-*/checks.json"):
+    with path.open(encoding="utf-8") as handle:
+        checks = json.load(handle)
+    matches.extend(
+        check
+        for check in checks
+        if check.get("id") == "sep-2243-server-accepts-whitespace-header-value"
+    )
+if len(matches) != 1:
+    raise SystemExit(
+        "expected exactly one whitespace-header conformance result, "
+        f"found {len(matches)}"
+    )
+check = matches[0]
+details = check.get("details")
+body = details.get("responseBody") if isinstance(details, dict) else None
+error = body.get("error") if isinstance(body, dict) else None
+if not (
+    check.get("status") == "FAILURE"
+    and details.get("responseStatus") == 400
+    and isinstance(error, dict)
+    and error.get("code") == -32602
+):
+    raise SystemExit(
+        "whitespace-header baseline no longer has the reviewed invalid-tool-arguments "
+        f"cause: {json.dumps(check, sort_keys=True)}"
+    )
+print("Whitespace-header expected failure cause verified: invalid tool arguments (-32602)")
+PY
+
+echo "MCP HTTP conformance passed: reference@$CONFORMANCE_REF spec=$SPEC_VERSION; stdio is the separate protocol_conformance test"
diff --git a/tools/skillgen/mod.rs b/tools/skillgen/mod.rs
index fbb3143e2..49353ee60 100644
--- a/tools/skillgen/mod.rs
+++ b/tools/skillgen/mod.rs
@@ -10,11 +10,23 @@ use std::fs;
 use std::io;
 use std::path::{Path, PathBuf};
 
+use sha2::{Digest, Sha256};
+
 const MINIMUM_CORE_WORDS: usize = 500;
 const MAXIMUM_CORE_TOKENS: usize = 5_000;
 const MINIMUM_REFERENCES: usize = 10;
 const MINIMUM_REFERENCE_WORDS: usize = 120;
 const MINIMUM_BUNDLE_WORDS: usize = 5_000;
+const CANONICAL_SKILL_SHA256: &str =
+    "c6c097e081043c3f57cacb113423ff5783b0391f9881cb3262501277663a5d91";
+const FOCUSED_SKILLS: &[&str] = &[
+    "compass-architecture",
+    "compass-change-impact",
+    "compass-debug",
+    "compass-index-maintenance",
+    "compass-mcp-setup",
+    "compass-navigate",
+];
 const REQUIRED_CORE_SECTIONS: &[&str] = &[
     "## Invocation contract",
     "## Select the evidence before acting",
@@ -46,6 +58,13 @@ pub(crate) fn validate(assets: &Path, cli_source: &Path, help_source: &Path) ->
         &skill_path,
         "frontmatter must start with the canonical Compass skill name",
     )?;
+    let canonical_skill = canonical_text(&skill);
+    let canonical_digest = format!("{:x}", Sha256::digest(canonical_skill.as_bytes()));
+    require(
+        canonical_digest == CANONICAL_SKILL_SHA256,
+        &skill_path,
+        "canonical umbrella skill changed; focused skills must remain additive",
+    )?;
     require(
         skill.split_whitespace().count() >= MINIMUM_CORE_WORDS,
         &skill_path,
@@ -130,10 +149,179 @@ pub(crate) fn validate(assets: &Path, cli_source: &Path, help_source: &Path) ->
         "complete skill bundle is unexpectedly small",
     )?;
     validate_command_coverage(cli_source, help_source, &all_docs)?;
+    validate_focused_skills(&assets.join("compass-focused-skills"))?;
     validate_integrations(&assets.join("compass-integrations"))?;
     Ok(())
 }
 
+fn validate_focused_skills(root: &Path) -> io::Result<()> {
+    let actual = fs::read_dir(root)?
+        .map(|entry| entry.map(|value| value.path()))
+        .collect::<io::Result<Vec<_>>>()?
+        .into_iter()
+        .filter(|path| path.is_dir())
+        .filter_map(|path| {
+            path.file_name()
+                .map(|name| name.to_string_lossy().into_owned())
+        })
+        .collect::<BTreeSet<_>>();
+    let expected = FOCUSED_SKILLS
+        .iter()
+        .map(|name| (*name).to_owned())
+        .collect::<BTreeSet<_>>();
+    require(
+        actual == expected,
+        root,
+        &format!("focused skill inventory drift: expected={expected:?}, actual={actual:?}"),
+    )?;
+
+    let corpus = root.join("trigger-corpus.json");
+    require(
+        corpus.is_file() && fs::metadata(&corpus)?.len() > 100,
+        &corpus,
+        "focused trigger corpus is missing or unexpectedly small",
+    )?;
+
+    for name in FOCUSED_SKILLS {
+        let skill_root = root.join(name);
+        let skill_path = skill_root.join("SKILL.md");
+        let body = canonical_text(&read_utf8(&skill_path)?);
+        require(
+            body.starts_with(&format!("---\nname: {name}\n")),
+            &skill_path,
+            "focused skill name must match its lower-kebab directory",
+        )?;
+        require(
+            is_lower_kebab(name),
+            &skill_path,
+            "focused skill name is not lower-kebab",
+        )?;
+        let description = frontmatter_value(&body, "description").ok_or_else(|| {
+            io::Error::new(
+                io::ErrorKind::InvalidData,
+                format!("{}: missing description", skill_path.display()),
+            )
+        })?;
+        require(
+            !description.is_empty() && description.len() <= 1_024,
+            &skill_path,
+            "focused skill description must contain 1-1024 characters",
+        )?;
+        require(
+            description.contains("Use ") || description.contains("use "),
+            &skill_path,
+            "focused skill description must say when to use it",
+        )?;
+        require(
+            body.split_whitespace().count() >= 100,
+            &skill_path,
+            "focused skill instructions are unexpectedly small",
+        )?;
+        require(
+            approximate_token_count(&body) <= MAXIMUM_CORE_TOKENS,
+            &skill_path,
+            "focused skill exceeds the Agent Skills activation budget",
+        )?;
+        validate_native(&skill_path, &body)?;
+        validate_portable_paths(&skill_root, &skill_path, &body)?;
+    }
+    Ok(())
+}
+
+fn validate_portable_paths(root: &Path, skill_path: &Path, body: &str) -> io::Result<()> {
+    for forbidden in ["/Users/", "/home/", "file://"] {
+        require(
+            !body.contains(forbidden),
+            skill_path,
+            &format!("focused skill contains absolute path marker {forbidden:?}"),
+        )?;
+    }
+    require(
+        !contains_windows_absolute_path(body),
+        skill_path,
+        "focused skill contains an absolute Windows path marker",
+    )?;
+    for reference in linked_references(body) {
+        let relative = Path::new(&reference);
+        require(
+            !relative.is_absolute()
+                && !relative
+                    .components()
+                    .any(|component| matches!(component, std::path::Component::ParentDir)),
+            skill_path,
+            &format!("focused skill reference is not a safe relative path: {reference}"),
+        )?;
+        require(
+            root.join(relative).is_file(),
+            skill_path,
+            &format!("focused skill reference is not bundled: {reference}"),
+        )?;
+    }
+    Ok(())
+}
+
+fn contains_windows_absolute_path(body: &str) -> bool {
+    let bytes = body.as_bytes();
+    bytes.windows(3).enumerate().any(|(index, window)| {
+        let has_drive_boundary = index == 0 || !bytes[index - 1].is_ascii_alphanumeric();
+        has_drive_boundary
+            && window[0].is_ascii_alphabetic()
+            && window[1] == b':'
+            && matches!(window[2], b'\\' | b'/')
+    }) || contains_unc_path(bytes)
+}
+
+fn contains_unc_path(bytes: &[u8]) -> bool {
+    bytes.windows(2).enumerate().any(|(index, prefix)| {
+        if prefix != b"\\\\"
+            || index
+                .checked_sub(1)
+                .is_some_and(|previous| bytes[previous] == b'\\')
+        {
+            return false;
+        }
+        let server_start = index.saturating_add(2);
+        let Some(separator_offset) = bytes[server_start..].iter().position(|byte| *byte == b'\\')
+        else {
+            return false;
+        };
+        separator_offset > 0
+            && bytes
+                .get(
+                    server_start
+                        .saturating_add(separator_offset)
+                        .saturating_add(1),
+                )
+                .is_some_and(|byte| !byte.is_ascii_whitespace() && *byte != b'\\')
+    })
+}
+
+fn frontmatter_value<'a>(body: &'a str, key: &str) -> Option<&'a str> {
+    let prefix = format!("{key}:");
+    body.lines()
+        .skip(1)
+        .take_while(|line| *line != "---")
+        .find_map(|line| {
+            line.strip_prefix(&prefix)
+                .map(str::trim)
+                .map(|value| value.trim_matches('"'))
+        })
+}
+
+fn is_lower_kebab(value: &str) -> bool {
+    !value.is_empty()
+        && !value.starts_with('-')
+        && !value.ends_with('-')
+        && !value.contains("--")
+        && value
+            .bytes()
+            .all(|byte| byte.is_ascii_lowercase() || byte.is_ascii_digit() || byte == b'-')
+}
+
+fn canonical_text(input: &str) -> String {
+    input.replace("\r\n", "\n").replace('\r', "\n")
+}
+
 fn skill_documents(
     skill_root: &Path,
     skill: &str,