Loading
Use when replacing a seat's occupant (rebuild/handover/swap), reasoning about stable-seat-identity vs fluid-occupant-identity, choosing an old-occupant disposition (retire/advise/shadow), or recording
The skill file stays in the publisher's repository.
Paste the copied command in a terminal. It installs this SKILL.md into that agent.
npx skills add mvschwarz/openrig --skill seat-continuity-and-handover -a cursor -y
Use when replacing a seat's occupant (rebuild/handover/swap), reasoning about stable-seat-identity vs fluid-occupant-identity, choosing an old-occupant disposition (retire/advise/shadow), or recording provenance for an occupant change. Two independent outcomes (continuityOutcome + seatBindingOutcome) and the 5 failure modes that prevent silent dishonesty.
Use when replacing a seat's occupant (rebuild/handover/swap), reasoning about stable-seat-identity vs fluid-occupant-identity, choosing an old-occupant disposition (retire/advise/shadow), or recording provenance for an occupant change. Two independent outcomes (continuityOutcome + seatBindingOutcome) and the 5 failure modes that prevent silent dishonesty.
A pair of primitive families that separate who is sitting in a seat from what the seat itself is:
resume, fork, rebuild, fresh — produce a candidate new occupant. Answer: "where did the new occupant come from?"Core architectural decision: stable seat identity, fluid occupant identity, explicit provenance. Do not encode successive occupants into live seat names. Keep the stable address and record lineage separately.
rig launch / rig expand directlyEvery seat-binding operation produces two independent outcomes:
continuityOutcome: rebuilt | resumed | forked | fresh | failed
seatBindingOutcome: handed_over | partial | failed | unchanged
These can disagree honestly. Examples:
continuityOutcome: failed + seatBindingOutcome: unchanged — new occupant didn't materialize; seat correctly retains old occupant.continuityOutcome: rebuilt + seatBindingOutcome: failed — candidate created OK; bind failed mid-flight; provenance records the gap.Don't collapse these into one outcome. The system can describe what actually happened only if the two are recorded independently.
Every handover writes:
resume/fork/rebuild/fresh)handed_over / partial / failed)This is the system's truth-source for "how did the current occupant get there." Without it, the control plane shows the current occupant but not the legitimacy of the transition.
continuityOutcome: failedA seat stays Stable even if multiple candidate-occupants were produced and discarded.
rebuild couldn't synthesize from artifacts; fork couldn't resolve session_source; fresh couldn't launch. Action: bind operation does not begin; seat unchanged; provenance records the failed candidate-creation step.Binding state with explicit "halted" sub-status; operator alerted. Do NOT auto-rollback by reattaching old-occupant if detach didn't complete cleanly.Binding halted, not Bound.advise (keep alive as advisor) but runtime can't keep old alive. Action: degrade to retire with explicit notification, OR fail if operator passed strict-disposition flag.Do NOT collapse rebuild and seat handover into one primitive. The design specifically separates them so the system can describe what actually happened.
Do NOT introduce successor-suffix seat names (lead2/lead3). Stable seat identity is the architectural goal. The live address stays stable. A retired tenure is distinguished by its ledger
generation and exact history token; preserving it does not require a renamed live pane.
Do NOT report seatBindingOutcome: handed_over if the provenance record didn't write durably.
Do NOT auto-rollback a half-completed handover by re-attaching the old occupant unless detach completed cleanly first.
A fork can create a candidate occupant; handover binds it into an existing seat.
The continuity outcome is forked; the binding outcome is independent.
The packaged rig handover <seat> and rig seat handover <seat> accept fresh,
discovered:<id>, fork:<id> and rebuild sources. Use --dry-run to request
planning only. Without it, these surfaces can execute; do not infer read-only
behavior from the shorter seat command's planning-oriented description.
rig seat status <seat> is the read-only observability surface.
Source support is declared by the running daemon and depends on actual identity, history and artifact prerequisites. Read the returned source, continuity, binding and provenance results independently. A help listing or dry-run is not proof of a successful transition. The linked cutover SOP supplies the operator mechanics and required effect checks after the named owner authorizes the action.
A rebuild primes the successor from the seat's durable artifacts, highest trust
first:
RECAP.md;LEARNED.md;A missing RECAP.md is recorded as a gap. The successor is directed to the remaining
available artifacts in that order. So before a handover, a compaction or a long pause,
the sitting occupant writes its recap alongside LEARNED.md:
rig context recap-write --rig <rig> --seat <seat> --file <draft.md>
<seat> is the seat's folder under rigs/<rig>/seats/, the part of its session
name before @.topology.root and doesn't need the daemon.recap-superseded/ chain,
which later rebuilds also read. Write through this command, not a file tool, so
the chain is kept.The store refuses the write, and writes nothing, when a section can't be
addressed. Only H2 and H3 headings are sections. Addresses lowercase the title,
remove Markdown formatting markers, replace remaining runs outside a-z/0-9 with
a hyphen, and trim edge hyphens. Duplicate section paths, a nonblank H2/H3 title
that normalizes to an empty slug, and an unclosed code fence are refused. A
duplicate path is two H2s with the same address, or two H3s with the same address
under one H2. Blank headings are retained as scope boundaries.
It writes, with an advisory on stderr, when:
UNVERIFIED:.A recap that passes the first time has:
## Decisions, with reasons section, each decision with its reason;UNVERIFIED: line for each fact you haven't checked yourself.Any recursive seat-refresh loop must be able to replace an occupant while keeping topology stable. Without these primitives, RSI loops will either accumulate suffixed seat names (lineage leaking into identity) or destabilize topology references on each cycle. Provenance must be durable AND queryable so RSI loops can decide whether a seat is fresh enough to receive new work or needs re-handover.
A retired advisor's history can remain available without a managed node or live
pane. Query current binding and the lineage ledger separately: one answers who
holds the seat, the other identifies the retained history and exact resume token.
Do not infer that a predecessor is unreachable from registry absence alone, or
that a preserved token proves a successful resume. Check the actual runtime and
history when consultation is needed; see retiring-and-inheriting-a-seat.
references/apprentice-successor-seat-cutover.md — the portable mechanic SOP used only after the owner-worded gatereferences/orchestrator-role.md — the orchestration judgment, authority, custody, and receipt contractreferences/apprentice-evidence-toolkit.md — optional evidence apparatus selected only when the stakes earn itsession-source-fork skill — fork occupant-creation primitive (sibling)agent-starters skill — composes occupant-creation + binding into named reusable starting pointscross-host-rig-commands skill — remote addressing and transport; verify lifecycle support on the target