feat(skills): add incident commander workflow

dist/packets/runx.incident.review.v1.schema.json

@@ -0,0 +1,16 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schemas.runx.ai/runx/incident/review/v1.json",
+  "x-runx-packet-id": "runx.incident.review.v1",
+  "x-runx-generated-from": "skills/incident-commander/graph/review/X.yaml#root.runners.default",
+  "type": "object",
+  "required": [
+    "incident_turn"
+  ],
+  "properties": {
+    "incident_turn": {
+      "type": "object"
+    }
+  },
+  "additionalProperties": false
+}

dist/packets/runx.incident.turn.v1.schema.json

@@ -0,0 +1,16 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schemas.runx.ai/runx/incident/turn/v1.json",
+  "x-runx-packet-id": "runx.incident.turn.v1",
+  "x-runx-generated-from": "skills/incident-commander/graph/enforce/X.yaml#root.runners.default",
+  "type": "object",
+  "required": [
+    "incident_turn"
+  ],
+  "properties": {
+    "incident_turn": {
+      "type": "object"
+    }
+  },
+  "additionalProperties": false
+}

docs/core-skill-review-decisions.json

@@ -20,6 +20,7 @@
     "github-sync": { "archetype": "operation", "action": "improve", "reason": "Bounded GitHub synchronization is a high-value provider operation.", "improvement": "Replace plan-only closure with scoped provider reads/writes, approval gates, idempotency, and provider readback." },
     "governed-outbound": { "archetype": "workflow", "action": "improve", "reason": "Source gathering, privacy scrubbing, approval, and outward handoff form a distinctive trust-boundary workflow.", "improvement": "Make every fetch, scrub, send, and seal claim resolve to a deterministic or provider-backed stage." },
     "helpdesk": { "archetype": "workflow", "action": "keep", "reason": "The published and dogfooded support classifier has truthful capability metadata, a verified deterministic runner, and a human-gated send boundary." },
+    "incident-commander": { "archetype": "workflow", "action": "improve", "reason": "Incident command is a distinctive multi-turn governance workflow that constrains decisions to a fixed agency roster and keeps communications behind digest-bound approval.", "improvement": "Keep the decision layer thin and publish raw agency-runner receipts that prove the event-stream fold, CAS append, and embedded member receipt." },
     "issue-intake": { "archetype": "workflow", "action": "keep", "reason": "Turning noisy requests into bounded change artifacts and explicit lanes is recurring operator work, with truthful metadata and four replayable intake-contract cases." },
     "issue-to-pr": { "archetype": "workflow", "action": "improve", "reason": "The scafld, filesystem, git, and outbox composition is a core developer workflow.", "improvement": "Add a standalone proof for the native boundaries while keeping authoring judgments explicit." },
     "issue-triage": { "archetype": "workflow", "action": "improve", "reason": "Provider-grounded issue assessment and response preparation is distinct from intake and implementation.", "improvement": "Make provider reads the default evidence path and prove draft-versus-mutation separation." },

evidence/frantic-112-incident-commander/agency-spine-results.json

@@ -0,0 +1,116 @@
+{
+  "schema": "runx.incident_commander.agency_spine_evidence.v1",
+  "evidence_role": "Navigation index only. The raw runtime graph-state files, ledgers, and production-signed receipt documents listed below are committed alongside this file and are the primary evidence.",
+  "case_id": "incident-112-mossony-20260718",
+  "registry_package": "mossony/incident-commander@sha-f94caa7b3588",
+  "signing_identity": {
+    "algorithm": "Ed25519",
+    "kid": "mossony-frantic-112-20260718",
+    "public_key_base64": "UlNOg2tuiyOkDf6A2Dd/H0V30n5Z0cdqp4+fwiElocU=",
+    "public_key_sha256": "sha256:7eb323e168231d2d91d8af6bf5fa48c6f4f396774365c36150d706e6dbe1b520"
+  },
+  "raw_runtime_records": {
+    "agency_open": {
+      "graph_state": "receipts/runs/run_open_54f39570b920.graph-state.json",
+      "sha256": "3f52b7b7204c579d1fbb58facb1efaace8b5b1961302aa92984e31b6869ad6aa",
+      "root_receipt": "receipts/sha256-81f7210034ae42fd05bc61c4db806b3455454d30cdce1db6049fa56f2fd98b8b.json",
+      "receipt_ref": "runx:receipt:sha256:81f7210034ae42fd05bc61c4db806b3455454d30cdce1db6049fa56f2fd98b8b"
+    },
+    "agency_dispatch": {
+      "graph_state": "receipts/runs/run_advance_a87fb6c6acde.graph-state.json",
+      "sha256": "298d6ed612a6bf4449748e07686d058e68de6c30aca1c5503dad3b59bb8175f1",
+      "ledger": "receipts/ledgers/run_advance_a87fb6c6acde.jsonl",
+      "root_receipt": "receipts/sha256-6f893a84f25511c01b8d9c612341666d52501a9f810f31c366bfd50f2938f6f4.json",
+      "receipt_ref": "runx:receipt:sha256:6f893a84f25511c01b8d9c612341666d52501a9f810f31c366bfd50f2938f6f4"
+    },
+    "published_member": {
+      "graph_state": "receipts/runs/run_advance_057142a05ffd.graph-state.json",
+      "sha256": "30b0087c30f18c308a35503fe639375b95d2bd2f9c8d6310cdfb54672b6f2b99",
+      "ledger": "receipts/ledgers/run_advance_057142a05ffd.jsonl",
+      "root_receipt": "receipts/sha256-bf3149287c60d6562e3d55d36e3c4bff296c7a3b9dafcc1bb3ba70c01e274353.json",
+      "root_receipt_sha256": "8ae7ffd5c8369e86a0a7ace3dcc00f1f5e1643b3ac5f62c11d546aeb09a3d19b",
+      "receipt_ref": "runx:receipt:sha256:bf3149287c60d6562e3d55d36e3c4bff296c7a3b9dafcc1bb3ba70c01e274353"
+    },
+    "agency_bind_member": {
+      "graph_state": "receipts/runs/run_advance_838254eeead6.graph-state.json",
+      "sha256": "f75694e4fb9615305525e73666e6ead23e11666bc55a18b8a63bdbdc13d015a7",
+      "ledger": "receipts/ledgers/run_advance_838254eeead6.jsonl",
+      "root_receipt": "receipts/sha256-fc683f33c30cca0e194808ade4e201897cbfa04fff2a5ea8b7fa476de3990db2.json",
+      "root_receipt_sha256": "ee2fe6b67eea80b1ce123e65b49fd8ab59506f3f0ecd39108c07470f7fdebe3d",
+      "receipt_ref": "runx:receipt:sha256:fc683f33c30cca0e194808ade4e201897cbfa04fff2a5ea8b7fa476de3990db2"
+    }
+  },
+  "agency_bind_envelope": {
+    "graph": "agency-advance",
+    "run_id": "run_advance_838254eeead6",
+    "graph_inputs": {
+      "data_source_ref": "tenant://agency/frantic-112",
+      "case_id": "incident-112-mossony-20260718",
+      "driver_id": "agency-bind-member-receipt",
+      "member_result": {
+        "member": "commander",
+        "outcome": "advanced",
+        "receipt_ref": "runx:receipt:sha256:bf3149287c60d6562e3d55d36e3c4bff296c7a3b9dafcc1bb3ba70c01e274353"
+      }
+    },
+    "read_events": {
+      "step_receipt_ref": "runx:receipt:sha256:5b533a224235a4ee2d7a0b08224e4bcf8f158f47265766df4374ba6590accf1f",
+      "operation": "read_events",
+      "provider": "sqlite-event-store",
+      "resource": "agency_cases",
+      "event_versions": [1, 2],
+      "after_version": 2,
+      "result_digest": "sha256:b9b5bf8c239b9f37f6fc53f1bd0ae6b8162ccef841d42695b3b678b1fe541ed1"
+    },
+    "fold": {
+      "step_receipt_ref": "runx:receipt:sha256:618e8e131a46a48be8ea40461f4d9a474c7332907c67139fd1943f70e73fbfff",
+      "expected_version": 2,
+      "turn_no": 1,
+      "case_status": "working",
+      "last_action": "member commander returned: advanced"
+    },
+    "plan": {
+      "step_receipt_ref": "runx:receipt:sha256:6735eacb16a08b0b01b207ed78cd1a6516b9756f71a18e68fcd597bef9a07a67",
+      "expected_version": 2,
+      "idempotency_key": "incident-112-mossony-20260718:turn:2:agency-bind-member-receipt",
+      "turn": 2,
+      "embedded_member_receipt_ref": "runx:receipt:sha256:bf3149287c60d6562e3d55d36e3c4bff296c7a3b9dafcc1bb3ba70c01e274353"
+    },
+    "append_event": {
+      "step_receipt_ref": "runx:receipt:sha256:84d41028d80e2d88af4c2866f31a7d08654808cee1241728962269892ac0bb46",
+      "operation": "append_event",
+      "provider": "sqlite-event-store",
+      "status": "committed",
+      "before_version": 2,
+      "after_version": 3,
+      "idempotency_key": "incident-112-mossony-20260718:turn:2:agency-bind-member-receipt",
+      "event_ref": "agency_cases:incident-112-mossony-20260718:3",
+      "event_digest": "sha256:45d1be3548ccd87833b60cff43a76511fa8cf6aad58b668383a4cbf4aa4f7b16",
+      "result_digest": "sha256:b702e394c8f5297119e07babe373403816f7d30bc9981256ad1eb4be18e21b34"
+    },
+    "cas_invariant": {
+      "folded_expected_version": 2,
+      "append_before_version": 2,
+      "append_after_version": 3,
+      "matched": true
+    }
+  },
+  "tree_verification": {
+    "member": {
+      "root_receipt_id": "sha256:bf3149287c60d6562e3d55d36e3c4bff296c7a3b9dafcc1bb3ba70c01e274353",
+      "receipt_count": 5,
+      "signature_mode": "production",
+      "parent_missing": null,
+      "valid": true,
+      "findings": []
+    },
+    "agency_bind": {
+      "root_receipt_id": "sha256:fc683f33c30cca0e194808ade4e201897cbfa04fff2a5ea8b7fa476de3990db2",
+      "receipt_count": 6,
+      "signature_mode": "production",
+      "parent_missing": null,
+      "valid": true,
+      "findings": []
+    }
+  }
+}

evidence/frantic-112-incident-commander/evidence.json

@@ -0,0 +1,155 @@
+{
+  "schema": "runx.incident_commander.evidence.v1",
+  "summary": "Published and dogfooded incident-commander as a reusable RunX governance workflow, then drove it through the shipped agency runner over a declared SEV-2 incident. The committed raw runtime records show the event-stream read and fold, immutable registry member execution, member receipt feedback, and CAS append at the folded version.",
+  "skill": {
+    "owner": "mossony",
+    "name": "incident-commander",
+    "version": "sha-f94caa7b3588",
+    "registry_ref": "mossony/incident-commander@sha-f94caa7b3588",
+    "digest": "e1a9dcb860ecea3d1d7c759366eb5c0abb95f7e6ce92c0056dd110aae0ff5365",
+    "profile_digest": "c3c2c5f140a65033f41834ebe71324e3ba57b8c97797e06413367d2cebd57bc7",
+    "publisher_owner": "mossony",
+    "public_url": "https://runx.ai/x/mossony/incident-commander@sha-f94caa7b3588",
+    "pr_url": "https://github.com/runxhq/runx/pull/347",
+    "source_url": "https://github.com/runxhq/runx/pull/347/files",
+    "x_yaml": "https://raw.githubusercontent.com/runxhq/runx/refs/pull/347/head/skills/incident-commander/X.yaml",
+    "skill_md": "https://raw.githubusercontent.com/runxhq/runx/refs/pull/347/head/skills/incident-commander/SKILL.md"
+  },
+  "toolchain": {
+    "runx_version_command": "runx --version",
+    "runx_version_output": "runx-cli 0.7.1",
+    "publish_method": "runx login --provider github --for publish --from-gh; runx registry publish ./skills/incident-commander/SKILL.md --registry https://api.runx.ai",
+    "install_command": "runx add mossony/incident-commander@sha-f94caa7b3588 --registry https://api.runx.ai --json",
+    "registry_read_command": "runx registry read mossony/incident-commander@sha-f94caa7b3588 --registry https://api.runx.ai --json",
+    "local_harness_command": "runx harness ./skills/incident-commander -R ../runx-evidence/local-harness --json"
+  },
+  "harness": {
+    "local_status": "passed",
+    "hosted_status": "green",
+    "hosted_cases_passed": 2,
+    "hosted_cases_total": 2,
+    "hosted_receipt_ref": "runx:receipt:sha256:f88f55b5b502bcaa50ed9177c1a7bf463de7142b37a4dbef53cd3d1f16928a12",
+    "cases": [
+      {
+        "name": "status-update-awaits-then-roster-approval-advances",
+        "status": "sealed",
+        "observed": "The first phase remained awaiting_approval with a non-executable send-as plan bound to stakeholders:checkout-api and sha256:4e44f31f628799267f0957c554b8c47d90d2eabf41e5a84248941d28c45955ae. The follow-up used approval principal incident:comms:morgan and advanced the turn."
+      },
+      {
+        "name": "assign-without-named-roster-owner-needs-agent",
+        "status": "needs_agent",
+        "observed": "The ops-desk sub-step blocked without caller.answers; no named run was returned."
+      }
+    ]
+  },
+  "dogfood": {
+    "package": "mossony/incident-commander@sha-f94caa7b3588",
+    "input": {
+      "case_id": "incident-112-mossony-20260718",
+      "incident_objective": "send",
+      "incident_severity": "SEV-2",
+      "incident_scope": "checkout-api",
+      "approval_principal": "incident:comms:morgan",
+      "named_comms_run": {
+        "skill": "send-as",
+        "runner": "plan",
+        "channel": "email",
+        "audience": {
+          "list_ref": "stakeholders:checkout-api",
+          "classification": "incident-stakeholders"
+        },
+        "content_digest": "sha256:4e44f31f628799267f0957c554b8c47d90d2eabf41e5a84248941d28c45955ae"
+      }
+    },
+    "command": "runx skill mossony/incident-commander@sha-f94caa7b3588 advance --registry https://api.runx.ai <real SEV-2 incident inputs> -R evidence/frantic-112-incident-commander/receipts --json",
+    "receipt_ref": "runx:receipt:sha256:bf3149287c60d6562e3d55d36e3c4bff296c7a3b9dafcc1bb3ba70c01e274353",
+    "raw_receipt": "https://raw.githubusercontent.com/runxhq/runx/refs/pull/347/head/evidence/frantic-112-incident-commander/receipts/sha256-bf3149287c60d6562e3d55d36e3c4bff296c7a3b9dafcc1bb3ba70c01e274353.json",
+    "raw_graph_state": "https://raw.githubusercontent.com/runxhq/runx/refs/pull/347/head/evidence/frantic-112-incident-commander/receipts/runs/run_advance_057142a05ffd.graph-state.json",
+    "verify_command": "RUNX_RECEIPT_VERIFY_KID=mossony-frantic-112-20260718 RUNX_RECEIPT_VERIFY_ED25519_PUBLIC_KEY_BASE64=UlNOg2tuiyOkDf6A2Dd/H0V30n5Z0cdqp4+fwiElocU= runx verify --receipt evidence/frantic-112-incident-commander/receipts/sha256-bf3149287c60d6562e3d55d36e3c4bff296c7a3b9dafcc1bb3ba70c01e274353.json --json",
+    "verify_verdict": {
+      "valid": true,
+      "status": "valid",
+      "signature_mode": "production",
+      "kid": "mossony-frantic-112-20260718",
+      "findings": []
+    },
+    "tree_verify_verdict": {
+      "valid": true,
+      "receipt_count": 5,
+      "parent_missing": null,
+      "findings": []
+    },
+    "harness_cases": [
+      {
+        "name": "status-update-awaits-then-roster-approval-advances",
+        "status": "sealed"
+      },
+      {
+        "name": "assign-without-named-roster-owner-needs-agent",
+        "status": "needs_agent"
+      }
+    ]
+  },
+  "agency_spine": {
+    "case_id": "incident-112-mossony-20260718",
+    "data_source_ref": "tenant://agency/frantic-112",
+    "provider": "sqlite-event-store",
+    "open_receipt_ref": "runx:receipt:sha256:81f7210034ae42fd05bc61c4db806b3455454d30cdce1db6049fa56f2fd98b8b",
+    "dispatch_receipt_ref": "runx:receipt:sha256:6f893a84f25511c01b8d9c612341666d52501a9f810f31c366bfd50f2938f6f4",
+    "member_receipt_ref": "runx:receipt:sha256:bf3149287c60d6562e3d55d36e3c4bff296c7a3b9dafcc1bb3ba70c01e274353",
+    "bind_receipt_ref": "runx:receipt:sha256:fc683f33c30cca0e194808ade4e201897cbfa04fff2a5ea8b7fa476de3990db2",
+    "bind_tree_verify_verdict": {
+      "valid": true,
+      "signature_mode": "production",
+      "receipt_count": 6,
+      "parent_missing": null,
+      "findings": []
+    },
+    "read_events": {
+      "versions": [1, 2],
+      "after_version": 2,
+      "result_digest": "sha256:b9b5bf8c239b9f37f6fc53f1bd0ae6b8162ccef841d42695b3b678b1fe541ed1"
+    },
+    "fold": {
+      "expected_version": 2,
+      "turn_no": 1,
+      "member_outcome": "advanced"
+    },
+    "append_event": {
+      "status": "committed",
+      "before_version": 2,
+      "after_version": 3,
+      "idempotency_key": "incident-112-mossony-20260718:turn:2:agency-bind-member-receipt",
+      "event_ref": "agency_cases:incident-112-mossony-20260718:3",
+      "event_digest": "sha256:45d1be3548ccd87833b60cff43a76511fa8cf6aad58b668383a4cbf4aa4f7b16"
+    },
+    "embedded_member_receipt_ref": "runx:receipt:sha256:bf3149287c60d6562e3d55d36e3c4bff296c7a3b9dafcc1bb3ba70c01e274353",
+    "raw_bind_graph_state": "https://raw.githubusercontent.com/runxhq/runx/refs/pull/347/head/evidence/frantic-112-incident-commander/receipts/runs/run_advance_838254eeead6.graph-state.json",
+    "raw_bind_root_receipt": "https://raw.githubusercontent.com/runxhq/runx/refs/pull/347/head/evidence/frantic-112-incident-commander/receipts/sha256-fc683f33c30cca0e194808ade4e201897cbfa04fff2a5ea8b7fa476de3990db2.json",
+    "raw_receipt_index": "https://raw.githubusercontent.com/runxhq/runx/refs/pull/347/head/evidence/frantic-112-incident-commander/receipts/index.json",
+    "verification_key": "https://raw.githubusercontent.com/runxhq/runx/refs/pull/347/head/evidence/frantic-112-incident-commander/verification-key.json"
+  },
+  "observations": [
+    "runx --version returned exactly runx-cli 0.7.1. The publish, clean install, registry read, dogfood, and verify commands used that binary, satisfying the runx-cli 0.6.14 minimum.",
+    "The authenticated publisher owner is mossony; the exact immutable package is mossony/incident-commander@sha-f94caa7b3588 with digest e1a9dcb860ecea3d1d7c759366eb5c0abb95f7e6ce92c0056dd110aae0ff5365 and profile digest c3c2c5f140a65033f41834ebe71324e3ba57b8c97797e06413367d2cebd57bc7.",
+    "The canonical public URL is https://runx.ai/x/mossony/incident-commander@sha-f94caa7b3588; the public PR is https://github.com/runxhq/runx/pull/347; source_url is its public files view; raw x_yaml and skill_md are bound to the PR head under skills/incident-commander.",
+    "The local harness passed status-update-awaits-then-roster-approval-advances and assign-without-named-roster-owner-needs-agent. The hosted registry harness is green at 2/2 and links sealed harness receipt sha256:f88f55b5b502bcaa50ed9177c1a7bf463de7142b37a4dbef53cd3d1f16928a12.",
+    "The happy turn first stayed awaiting_approval, then matched approval principal incident:comms:morgan and named send-as plan for audience stakeholders:checkout-api with content_digest sha256:4e44f31f628799267f0957c554b8c47d90d2eabf41e5a84248941d28c45955ae. It did not claim that a provider send occurred.",
+    "The stop case omitted caller.answers for an assignment with no named roster owner. It returned needs_agent with no named run; this is the refused or escalated reason required by the contract.",
+    "The real dogfood incident was declared SEV-2 for checkout-api. Running the published registry package produced post-publish receipt sha256:bf3149287c60d6562e3d55d36e3c4bff296c7a3b9dafcc1bb3ba70c01e274353, which verifies valid in production signature mode.",
+    "The shipped agency runner opened the case, read_events over versions 1 and 2, folded expected_version 2, and committed append_event from before_version 2 to after_version 3 using idempotency key incident-112-mossony-20260718:turn:2:agency-bind-member-receipt.",
+    "The agency bind run graph input and persisted turn event both embed member_result.receipt_ref runx:receipt:sha256:bf3149287c60d6562e3d55d36e3c4bff296c7a3b9dafcc1bb3ba70c01e274353. The outer agency receipt tree rooted at sha256:fc683f33c30cca0e194808ade4e201897cbfa04fff2a5ea8b7fa476de3990db2 verifies valid across six production-signed receipts.",
+    "A new user can install with runx add mossony/incident-commander@sha-f94caa7b3588 --registry https://api.runx.ai, run the immutable package with runx skill mossony/incident-commander@sha-f94caa7b3588 --registry https://api.runx.ai, and verify the raw receipt using the public Ed25519 key in verification-key.json without private context.",
+    "Machine-readable verification is in verification.json; the human report is report.md. Both point to the same immutable registry version, PR, raw receipt set, and public verification key."
+  ],
+  "credential_hygiene": {
+    "tokens_in_artifacts": false,
+    "email_addresses_in_artifacts": false,
+    "signing_seed_persisted": false,
+    "public_verification_key_only": true
+  },
+  "value_assessment": {
+    "real_operator_value": true,
+    "summary": "The package gives an incident operator a fixed-roster, approval-bound decision turn while leaving durable contention to the shipped agency CAS lease and provider delivery to separately governed communication skills."
+  }
+}