bootstrap must prove the Depone runtime identity; docs must stop teaching removed commands (closes #134 #136)

.github/workflows/ci.yml

@@ -40,6 +40,8 @@ jobs:
         run: python3 scripts/check_orro_fallback_policy.py
       - name: Check ORRO command migration
         run: python3 scripts/check_orro_command_migration.py
+      - name: Check removed command documentation
+        run: python3 scripts/check_orro_removed_command_docs.py
       - name: Check ORRO command migration dry-run
         run: python3 scripts/check_orro_command_migration_dry_run.py --json --allow-network
       - name: Check ORRO wrapper
@@ -49,7 +51,7 @@ jobs:
       - name: Check ORRO wrapper distribution
         run: python3 scripts/check_orro_wrapper_distribution.py --json --allow-network
       - name: Compile scripts
-        run: python3 -m py_compile scripts/check_no_bidi_controls.py scripts/check_orro_repo_contract.py scripts/check_orro_language_boundaries.py scripts/check_orro_assurance_contract_fixtures.py scripts/check_orro_release_manifest.py scripts/check_compatibility_matrix.py scripts/check_orro_release_state.py scripts/check_orro_packaging_decision.py scripts/check_orro_fallback_policy.py scripts/check_orro_command_migration.py scripts/check_orro_command_migration_dry_run.py scripts/check_orro_wrapper.py scripts/check_orro_wrapper_install.py scripts/check_orro_wrapper_distribution.py scripts/orro_build_backend.py scripts/orro_e2e_smoke.py scripts/update_orro_engine_lock.py scripts/bootstrap_orro.py src/orro_wrapper/__init__.py src/orro_wrapper/__main__.py src/orro_wrapper/cli.py
+        run: python3 -m py_compile scripts/check_no_bidi_controls.py scripts/check_orro_repo_contract.py scripts/check_orro_language_boundaries.py scripts/check_orro_assurance_contract_fixtures.py scripts/check_orro_release_manifest.py scripts/check_compatibility_matrix.py scripts/check_orro_release_state.py scripts/check_orro_packaging_decision.py scripts/check_orro_fallback_policy.py scripts/check_orro_command_migration.py scripts/check_orro_removed_command_docs.py scripts/check_orro_command_migration_dry_run.py scripts/check_orro_wrapper.py scripts/check_orro_wrapper_install.py scripts/check_orro_wrapper_distribution.py scripts/orro_build_backend.py scripts/orro_e2e_smoke.py scripts/update_orro_engine_lock.py scripts/bootstrap_orro.py src/orro_wrapper/__init__.py src/orro_wrapper/__main__.py src/orro_wrapper/cli.py
       - name: Bidi control scanner self-test
         run: python3 scripts/check_no_bidi_controls.py --self-test
       - name: Install ORRO wrapper package (editable)
@@ -70,5 +72,7 @@ jobs:
         run: python3 scripts/update_orro_engine_lock.py --self-test
       - name: Bootstrap helper self-test
         run: python3 scripts/bootstrap_orro.py --self-test
+      - name: Removed command documentation self-test
+        run: python3 scripts/check_orro_removed_command_docs.py --self-test
       - name: Check whitespace
         run: git diff --check

README.md

@@ -49,7 +49,7 @@ Current split:
 ORRO turns a goal into an evidence-governed workflow:
 
 ```text
-advise -> init/doctor/engine-lock -> scout -> flowplan -> proofrun -> proofcheck -> handoff -> report
+advise -> init/doctor/engine-lock -> scout -> flowplan -> proofrun -> proofcheck -> handoff -> status
 ```
 
 This repository is the product, documentation, examples, distribution, and
@@ -208,6 +208,11 @@ The executable `orro` command is ORRO-owned, thin, and delegates to witnessd.
 The command migration is documented in
 [`docs/orro-command-migration.md`](docs/orro-command-migration.md).
 
+Canonical invocation rule: use `orro` for operator-facing commands. Wrapper-owned
+commands (`boundary`, `self-test`, and explicit `delegate`) are handled by ORRO;
+workflow commands are delegated to witnessd, with `orro delegate -- <command>`
+as the explicit delegated form.
+
 The migration does not publish a package, does not move engine code, and does
 not change verifier or runtime semantics. `orro-wrapper` remains a compatibility
 command for the same thin wrapper module.
@@ -266,7 +271,7 @@ orro flowplan "fix parser bug" --root . --profile code-change --out .witnessd/wo
 orro proofrun "fix parser bug" --repo . --home .witnessd --workflow-plan .witnessd/workflow-plan.json
 orro proofcheck .witnessd/runs/<run-dir> --home .witnessd --out .witnessd/runs/<run-dir>/proofcheck-verdict.json
 orro handoff .witnessd/runs/<run-dir> --out .witnessd/runs/<run-dir>/orro-handoff.json
-orro report .witnessd/runs/<run-dir> --home .witnessd
+orro status .witnessd/runs/<run-dir> --home .witnessd
 ```
 
 ## Trust Boundaries

docs/architecture.md

@@ -7,7 +7,7 @@ user
           -> evidence artifacts
       -> Depone verifier
           -> verdict artifacts
-      -> ORRO report/handoff
+      -> ORRO status/handoff
 ```
 
 ```text

docs/bootstrap.md

@@ -31,8 +31,10 @@ not run proofrun, proofcheck, handoff, auto, live models, or MCP calls.
 
 ## Check Existing
 
-`--check-existing` inspects local engine roots and compares their `HEAD` commits
-to the pinned engine lock.
+`--check-existing` inspects local engine roots, compares their `HEAD` commits to
+the pinned engine lock, and reports Depone's runtime identity: imported module
+path, installed distribution version, source-declared version, and locked
+commit. All four must agree.
 
 ```bash
 python3 scripts/bootstrap_orro.py \
@@ -66,8 +68,8 @@ python3 scripts/bootstrap_orro.py \
 ```
 
 `--execute` may clone witnessd and Depone and check out the pinned commits. It
-does not run proofrun, proofcheck, handoff, or auto. Editable witnessd install is
-separate and requires the explicit `--install-witnessd` flag:
+does not run proofrun, proofcheck, handoff, or auto. Editable Depone and witnessd
+installs require the explicit `--install-witnessd` flag:
 
 ```bash
 /usr/bin/python3 -m venv ~/.local/share/orro/venv
@@ -84,7 +86,7 @@ Bootstrap rejects `--install-witnessd` outside a virtual environment so it
 cannot rewrite a system interpreter's command directory.
 
 Both ORRO and witnessd publish an `orro` console script. After installing the
-pinned editable witnessd, bootstrap installs the ORRO wrapper last and
+pinned editable Depone and witnessd, bootstrap installs the ORRO wrapper last and
 explicitly links the invoking environment's `bin/orro` plus
 `~/.local/bin/orro` to `bin/orro-wrapper`. This makes the PATH-facing owner
 deterministic instead of depending on pip install order. Bootstrap then checks

docs/e2e-runner.md

@@ -64,7 +64,7 @@ fetch, update, or mutate engine repositories.
 The happy path runs:
 
 ```text
-advise -> init -> doctor -> engine-lock -> flowplan -> proofrun -> next -> auto --until-complete -> report
+advise -> init -> doctor -> engine-lock -> flowplan -> proofrun -> auto --dry-run -> auto --until-complete -> status
 ```
 
 The negative path checks that scout-only artifacts do not proofcheck-pass or

docs/e2e-smoke-contract.md

@@ -27,9 +27,9 @@ The current runner checks:
 - `orro engine-lock --check`
 - `orro flowplan`
 - `orro proofrun`
-- `orro next`
+- `orro auto --dry-run`
 - `orro auto --until-complete`
-- `orro report`
+- `orro status --latest`
 - scout-only artifacts do not proofcheck-pass
 
 The e2e result is test metadata, not proof.
@@ -46,7 +46,7 @@ lock, and asserts:
 - `orro proofrun` emits execution evidence
 - `orro proofcheck` delegates verifier semantics to Depone
 - `orro handoff` requires a passing bound proofcheck verdict
-- `orro report` does not overclaim
+- `orro status` does not overclaim
 - scout-only artifacts do not pass proofcheck
 - auto v0 does not run proofrun
 

docs/install.md

@@ -31,13 +31,17 @@ virtual environment's Python. Bootstrap prepares the pinned
 
 The ORRO-owned `orro` command delegates to witnessd. This repository is the
 canonical source of the published product/distribution wrapper package.
-Both distributions install an `orro` console script, so bootstrap installs the
-ORRO wrapper after the pinned editable witnessd install and then explicitly
+Both engine distributions install their runtime packages from the pinned
+checkouts (Depone is not published on PyPI), so bootstrap installs Depone and
+witnessd editable before installing the ORRO wrapper last and then explicitly
 links both the shared environment's `bin/orro` and `~/.local/bin/orro` to
 `bin/orro-wrapper`. Bootstrap verifies the `orro_wrapper.cli:main` entry-point
 metadata, the non-engine wrapper boundary, and real `flowplan --help`
-delegation before it succeeds. `orro-wrapper` remains available, and the pinned
-witnessd compatibility shim remains reachable with `python -m orro`.
+delegation before it succeeds. It also records Depone's imported module path,
+installed distribution version, source-declared version, and locked commit;
+these must agree or bootstrap fails closed with a repair command. `--check-existing`
+reports the same runtime identity. `orro-wrapper` remains available, and the
+pinned witnessd compatibility shim remains reachable with `python -m orro`.
 
 ## Bootstrap Planner
 

docs/workflow-reference.md

@@ -32,7 +32,7 @@ orro flowplan "fix parser bug" --root . --profile code-change --out .witnessd/wo
 orro proofrun "fix parser bug" --repo . --home .witnessd --workflow-plan .witnessd/workflow-plan.json
 orro proofcheck .witnessd/runs/<run-dir> --home .witnessd --out .witnessd/runs/<run-dir>/proofcheck-verdict.json
 orro handoff .witnessd/runs/<run-dir> --out .witnessd/runs/<run-dir>/orro-handoff.json
-orro report .witnessd/runs/<run-dir> --home .witnessd
+orro status .witnessd/runs/<run-dir> --home .witnessd
 ```
 
 Support surfaces:
@@ -45,11 +45,15 @@ Support surfaces:
   Gemini read-only review lane through witnessd
 - `orro flowplan --profile review-only --lane-adapter agy`: route a
   Google Antigravity read-only review lane through witnessd
-- `orro next`: non-executing continuation gate
 - `orro auto --dry-run`: recommendation only
 - `orro auto --once`: one safe post-run step only
 - `orro auto --until-complete`: bounded proofcheck/handoff loop only
-- `orro report`: human-facing summary
+- `orro status <run-dir> | --latest`: human-facing summary
+
+Canonical invocation rule: use the ORRO-owned `orro` command for operator-facing
+commands. Wrapper-owned commands (`boundary`, `self-test`, and explicit
+`delegate`) are handled by ORRO; workflow commands are delegated to witnessd,
+with `orro delegate -- <command>` available when that delegation must be explicit.
 
 `orro auto` v0 does not run proofrun or workers.
 

examples/code-change.md

@@ -17,7 +17,7 @@ orro proofrun "fix parser bug" \
 orro proofcheck .witnessd/runs/<run-dir> \
   --home .witnessd \
   --out .witnessd/runs/<run-dir>/proofcheck-verdict.json
-orro report .witnessd/runs/<run-dir> --home .witnessd
+orro status .witnessd/runs/<run-dir> --home .witnessd
 ```
 
 The workflow plan is intent, not proof. Actual proof starts with witnessd evidence and Depone proofcheck.

examples/full-flow.md

@@ -26,13 +26,13 @@ orro proofrun "fix parser bug" \
   --workflow-plan .witnessd/workflow-plan.json \
   --role-lane-plan .witnessd/role-lane-plan.json
 
-orro next .witnessd/runs/<run-dir> --home .witnessd --json
+orro auto --dry-run .witnessd/runs/<run-dir> --home .witnessd --json
 orro proofcheck .witnessd/runs/<run-dir> \
   --home .witnessd \
   --out .witnessd/runs/<run-dir>/proofcheck-verdict.json
 orro handoff .witnessd/runs/<run-dir> \
   --out .witnessd/runs/<run-dir>/orro-handoff.json
-orro report .witnessd/runs/<run-dir> --home .witnessd
+orro status .witnessd/runs/<run-dir> --home .witnessd
 ```
 
 `proofcheck` must pass before formal handoff. Handoff is review packaging, not approval. Report is summary, not proof.

examples/non-developer-safe-flow.md

@@ -10,8 +10,8 @@ orro flowplan "make the documentation clearer" --root . --profile docs-change --
 After any observed run exists:
 
 ```bash
-orro next .witnessd/runs/<run-dir> --home .witnessd --json
-orro report .witnessd/runs/<run-dir> --home .witnessd
+orro auto --dry-run .witnessd/runs/<run-dir> --home .witnessd --json
+orro status .witnessd/runs/<run-dir> --home .witnessd
 ```
 
 Safe interpretation:

examples/release-readiness.md

@@ -6,7 +6,7 @@ Use release-readiness flows to check setup, pinned engines, and post-run state.
 orro doctor --home .witnessd --json
 orro engine-lock --home .witnessd --out .witnessd/orro-engine-lock.json
 orro engine-lock --home .witnessd --check .witnessd/orro-engine-lock.json --json
-orro report .witnessd/runs/<run-dir> --home .witnessd
+orro status .witnessd/runs/<run-dir> --home .witnessd
 ```
 
 Doctor and engine-lock are readiness and distribution checks only. They are not proof, not approval, and not assurance.

examples/verification-only.md

@@ -7,7 +7,7 @@ orro advise "verify existing evidence" --repo . --home .witnessd --json
 orro proofcheck .witnessd/runs/<run-dir> \
   --home .witnessd \
   --out .witnessd/runs/<run-dir>/proofcheck-verdict.json
-orro report .witnessd/runs/<run-dir> --home .witnessd
+orro status .witnessd/runs/<run-dir> --home .witnessd
 ```
 
 Verification-only should recommend proofcheck over proofrun. Depone verifies persisted evidence bytes; ORRO does not become the verifier.

packaging/command-migration-plan.v0.json

@@ -6,6 +6,12 @@
   "current_wrapper_command": "orro-wrapper",
   "target_command": "orro",
   "migration_phase": "owned-thin-wrapper",
+  "removed_commands": {
+    "sketch": "advise --mode sketch",
+    "trace": "advise --mode trace",
+    "next": "auto --dry-run",
+    "report": "status <run-dir> | --latest"
+  },
   "owns_orro_command_now": true,
   "adds_orro_console_script": true,
   "requires_separate_migration_wave": false,