Sync Boatstack from Intelligence Flow Labs @ e960b4ccd592

[operator-stack-publisher]

What this sync releases

Detached Supervision can guide and guard a live coding session

Detached Supervision keeps Boatstack's controller state outside the repository. A
coding agent working in a detached repository cannot read the in-repo references it
would normally rely on, and a guard that runs for every repository must not control
the ones you never attached. This change adds the two pieces that let a live session
run under detached supervision.

First, a bounded context projection. boatstack-helper context --repo . returns a
small, read-only view of the current supervisory position for the operation about to
run: the ownership mode, the attached repository and its verified delivery state, the
active slice, the recommended next operation, and the exact next command. It reuses
Boatstack's authoritative resolver and deterministic next-move oracle rather than
asking the agent to reconstruct the workflow, so the guidance is identical to
embedded mode. An attached repository whose binding no longer verifies reports a
blocked position with one recovery action instead of a normal one.

Second, a developer-level guard entry. boatstack-helper ambient-safety-hook runs
Boatstack's full safety policy only on managed repositories — those with a detached
attachment or an embedded install — and allows everything else with no Boatstack
decision. This lets a single user-level hook protect your attached repositories while
leaving every other repository you open completely uncontrolled. On a managed
repository the guard's decisions are exactly those of the in-repo guard.

To wire the guard, boatstack-helper activate --repo . prints the exact per-agent
developer-level configuration to add — the config location and the precise
Boatstack-owned snippet — for every supported coding agent. It never rewrites your
global host configuration silently, so activation is transparent and cannot clobber
your existing hooks.

Both surfaces are host-neutral and behave the same for every supported coding agent.

Attach Boatstack to a repository without adding Boatstack to it

Until now, using Boatstack meant adopting its control plane into the repository: init
wrote .boatstack-project.json, a .product-loop/ tree, host adapter directories, and a
pull-request template into the working tree. That is the right choice for a team that owns
Boatstack, but not for a developer who wants a personal delivery supervisor on a repository
they are only evaluating, a client repository, an open-source checkout, or a large monorepo.

Boatstack now supports a second ownership mode, Detached Supervision. In this mode the
controller — configuration, plans, delivery state, operation and mutation receipts, evidence,
flow traces, generated references, and the runtime — lives under an external, developer-local
control root, not inside the target repository. The repository stays free of Boatstack-owned
files; the supervisor still changes it only through the same approved product and delivery
actuators.

Three new commands manage an attachment. boatstack-helper attach --repo . --mode detached
inspects the repository, detects its test command, and writes the controller state and a
binding to the external control root, leaving the working tree and .git byte-for-byte
unchanged. detached-status reports whether a repository is attached and whether its binding
verifies. detach removes the attachment, and its state unless you pass --preserve-state.
Use --state-root to point at a specific control root; otherwise Boatstack uses the standard
per-OS user state directory.

The layout is host-neutral: it works the same for every supported coding agent. Every
repository is bound by a stable identity derived from its origin and history, so one
repository's controller state can never be applied to another, and two worktrees keep
isolated mutable state. If a bound repository's identity no longer matches — a corrupt or
mismatched binding — Boatstack fails closed rather than silently rebinding. The safety guard
now protects the external control root from direct model mutation exactly as it protects the
embedded runtime state.

Existing embedded installations are unchanged: every controller path now flows through one
resolver that returns today's exact locations in embedded mode. This release delivers the
attach/detach lifecycle and the detached control plane; host activation for a running coding
session is delivered separately.

Projection provenance

Generated from operatorstack/intelligence-flow@e960b4ccd5929bac729d10ea9a800bad3dc572fd.
Review provenance, tests, and examples before merging.