codemower-ai · jeffhuber · Sep 10, 2026 · Sep 10, 2026 · gitar-bot · Sep 10, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1192,9 +1192,9 @@ install exposed a Python command-resolution sharp edge.
 - `migration package-install-rehearsal --python python3.12` now resolves
   command-style Python names through `PATH` instead of treating them as repo
   relative paths.
-- Rehearsed `v0.5.0-beta.1` against `DrinkBetter-AI/mobile-app`: easy init,
-  doctor, native check detection, lint, typecheck, tests, and package-install
-  readiness all passed when run with Python 3.12.
+- Rehearsed `v0.5.0-beta.1` against a private external TypeScript product
+  repository: easy init, doctor, native check detection, lint, typecheck,
+  tests, and package-install readiness all passed when run with Python 3.12.
 - Kept the documented public install target and package metadata aligned on
   `v0.5.0-beta.2` / `0.5.0b2`.
 

diff --git a/README.md b/README.md
@@ -4,9 +4,9 @@ Code Mower helps teams set up AI peer-programmer and reviewer lanes on real
 GitHub pull requests, then measure which builders and reviewers are useful on
 their actual codebase.
 
-Code Mower 1.0 is supervised-pilot, bring-your-own-agent-loop software for
-teams willing to calibrate reviewers. It is not a drop-in unattended merge
-gate.
+The current Code Mower release line is supervised-pilot,
+bring-your-own-agent-loop software for teams willing to calibrate reviewers.
+It is not a drop-in unattended merge gate.
 
 The short version:
 
@@ -25,6 +25,12 @@ Code Mower is local-first. The OSS tool works without the hosted service.
 Default cloud bundles exclude source code, raw diffs, raw model transcripts,
 raw stdout/stderr, auth output, and secrets.
 
+Documentation on `main` follows the source on `main`, including the changes
+listed under **Unreleased** in [the changelog](CHANGELOG.md). If you install the
+published `code-mower==1.1.2` package, use the documentation from the matching
+[`v1.1.2` tag](https://github.com/codemower-ai/code-mower/tree/v1.1.2); later
+source-only commands are not part of that package.
+
 ## Design Principles
 
 Code Mower should feel like an engineering tool, not a demo harness:
@@ -158,10 +164,12 @@ When a team wants the same operator picture on CodeMower.com, run
 zero-report, metadata-only mirror event, then add `--yes` only after review.
 The v1.0 supervised-pilot automation and event boundary is defined in
 [Supervised Pilot Contract](docs/supervised-pilot-contract.md).
-As that controller lands, `code-mower controller run --repo OWNER/REPO` is the
-dry-run-first policy check: it selects the current dispatch/merge/owner-action
-decision from metadata, can write a sanitized event with `--event-file`, and
-does not mutate GitHub state.
+`code-mower controller run --repo OWNER/REPO` is the dry-run-first policy
+check: it selects the current dispatch/merge/owner-action decision from
+metadata, can write a sanitized event with `--event-file`, and does not mutate
+GitHub state. Its modes change policy evaluation and evidence requirements;
+the generated workflows and provider transports own any separately authorized
+mutation.
 
 ## See The Value Shape First
 
@@ -280,12 +288,25 @@ reports `running` / `waiting_for_user`, so a finished informational Devin
 attempt is no longer recorded as owner-blocked. An explicit terminal API
 failure and a `waiting_for_approval` session still take precedence over any
 structured output.
+The v1.0.15 patch makes productivity current-state metrics prefer live GitHub
+state over historical Board snapshots and distinguishes historical evidence in
+reports.
 The v1.1 release adds optional Jira Cloud work tracking while keeping GitHub
 pull requests, checks, and merge gates authoritative. Jira setup starts
 read-only; mutation requires both explicit configuration and an explicit
 apply command. Controller queue visibility, Board, and PR-to-Jira milestones
 share the same bounded metadata contract, and GitHub-only repositories keep
 their existing behavior and generated workflows.
+The v1.1.1 patch hardens hosted release qualification with authenticated GitHub
+fallback, durable campaign issue binding, persistent trusted result authors,
+and bounded remote install failure reasons. The v1.1.2 patch keeps large Jira
+queues inside the response budget and adds a narrow issue-type discovery
+fallback when Jira's create-metadata inventory returns 404.
+
+Unreleased source on `main` adds a shared Jira authority brief for every
+orchestrator host, a local single-orchestrator session lease with Board
+visibility, controller orchestrator telemetry, and explicit Cursor
+orchestrator qualification. These changes are not in `code-mower==1.1.2`.
 Package-only users can start from the public package rather than a source
 checkout.
 
@@ -554,11 +575,14 @@ first so local work exercises the same package entrypoint users install.
 
 ## Docs Map
 
+### Start And Operate
+
 - [Install And Bootstrap](docs/install.md)
 - [Upgrade An Existing Repository](docs/upgrade-existing-repo.md)
 - [Try Code Mower In 10 Minutes](docs/try-in-10-minutes.md)
 - [Build Loop In 30 Minutes](docs/build-loop-in-30-minutes.md)
 - [Quickstart Reference](docs/quickstart.md)
+- [Participants And Sessions](docs/sessions.md)
 - [Orchestrator Prompt Pack](docs/orchestrator-prompt-pack.md)
 - [Planning And Work Orders](docs/planning-work-orders.md)
 - [Builder Providers: Grok And Cursor](docs/builders-grok-cursor.md)
@@ -574,11 +598,31 @@ first so local work exercises the same package entrypoint users install.
 - [GitHub Setup](docs/github-setup.md)
 - [Jira Cloud Setup](docs/jira-cloud-setup.md)
 - [Jira Adoption Rehearsal](docs/jira-adoption-rehearsal.md)
+- [Work Tracker Data Contract](docs/tracker-data-contract.md)
+- [Release Qualification](docs/release-qualification.md)
+- [Launch Command Surface](docs/launch-command-surface.md)
+- [Troubleshooting](docs/troubleshooting.md)
+
+### Trust, Architecture, And Evidence
+
+- [Architecture](docs/architecture.md)
+- [Lane Promotion Policy](docs/lane-promotion-policy.md)
+- [Cloud Sharing](docs/cloud-sharing.md)
+- [Cloud Data Contract](docs/cloud-data-contract.md)
+- [Board Data Contract](docs/board-data-contract.md)
+- [Privacy And Threat Model](docs/privacy-threat-model.md)
+- [Current State And Roadmap](docs/current-state-and-roadmap.md)
+- [Public Release Checklist](docs/public-release-checklist.md)
+- [PyPI Release Runbook](docs/pypi-release.md)
+- [Sample Doctor Output](docs/sample-doctor-output.md)
 - [First Run Transcript](docs/first-run-transcript.md)
 - [First-User Demo Transcript](docs/first-user-demo-transcript.md)
 - [First-User Install Rehearsal](docs/first-user-install-rehearsal.md)
-- [Release Qualification](docs/release-qualification.md)
-- [Launch Command Surface](docs/launch-command-surface.md)
+- [Demo Calibration Example](examples/demo-calibration/README.md)
+- [Board Demo Rehearsal](examples/board-demo/README.md)
+
+### History And Release Records
+
 - [v0.6 Truth Baseline](docs/v06-truth-baseline.md)
 - [v0.6 Release Notes](docs/v06-release-notes.md)
 - [v0.8 Release Notes](docs/v08-release-notes.md)
@@ -599,23 +643,14 @@ first so local work exercises the same package entrypoint users install.
 - [v1.0.13 Release Notes](docs/v1013-release-notes.md)
 - [v1.0.14 Release Notes](docs/v1014-release-notes.md)
 - [v1.0.15 Release Notes](docs/v1015-release-notes.md)
+- [v1.1 Release Notes](docs/v11-release-notes.md)
 - [v1.1.1 Release Notes](docs/v111-release-notes.md)
 - [v1.1.2 Release Notes](docs/v112-release-notes.md)
-- [v1.1 Release Notes](docs/v11-release-notes.md)
 - [Post-v0.8 Effectiveness Assessment](docs/post-v08-effectiveness-assessment.md)
 - [v1.0.1 Effectiveness Assessment](docs/v101-effectiveness-assessment.md)
-- [Demo Calibration Example](examples/demo-calibration/README.md)
-- [Board Demo Rehearsal](examples/board-demo/README.md)
-- [PyPI Release Runbook](docs/pypi-release.md)
-- [Sample Doctor Output](docs/sample-doctor-output.md)
-- [Architecture](docs/architecture.md)
-- [Lane Promotion Policy](docs/lane-promotion-policy.md)
-- [Cloud Sharing](docs/cloud-sharing.md)
-- [Cloud Data Contract](docs/cloud-data-contract.md)
-- [Board Data Contract](docs/board-data-contract.md)
-- [Privacy And Threat Model](docs/privacy-threat-model.md)
-- [Current State And Roadmap](docs/current-state-and-roadmap.md)
-- [Public Release Checklist](docs/public-release-checklist.md)
+
+### Project
+
 - [Changelog](CHANGELOG.md)
 - [Contributing](CONTRIBUTING.md)
 - [Support](SUPPORT.md)

diff --git a/docs/current-state-and-roadmap.md b/docs/current-state-and-roadmap.md
@@ -11,9 +11,10 @@ around the top AI coding agents and reviewers. The OSS core helps teams move
 from plan to merge at maximum safe velocity while preserving code quality,
 architecture, and deployment confidence.
 
-Code Mower v1.0 is supervised-pilot software for teams willing to calibrate
-reviewers and keep a human or trusted orchestrator responsible for the loop. It
-is not a drop-in unattended merge gate for arbitrary repositories.
+The current Code Mower release line is supervised-pilot software for teams
+willing to calibrate reviewers and keep a human or trusted orchestrator
+responsible for the loop. It is not a drop-in unattended merge gate for
+arbitrary repositories.
 
 It also creates a quality, speed, and cost benchmark loop on a team's actual
 product: which AI builders and reviewers produce useful results on this
@@ -33,6 +34,13 @@ release and in the first-user install rehearsal. It is intended to be installed
 from the package index for supervised pilots, with GitHub tag/source installs
 kept as a fallback and development path.
 
+Source on `main` also contains the changes listed under **Unreleased** in the
+root changelog: a shared Jira authority brief, a local single-orchestrator
+session lease with Board visibility, controller orchestrator telemetry, and
+explicit Cursor orchestrator qualification. Those source changes are not in
+the published `code-mower==1.1.2` package. Package users should follow docs
+from the matching `v1.1.2` tag.
+
 The v1.1.2 supervised-pilot release keeps the Python 3.12+ runtime contract,
 pipx/uv install matrix, non-expiring dispatch-token diagnostics, native redacted
 lane status, the local Board, Board history and admin commands, spend/verdict
@@ -122,11 +130,10 @@ The beta-to-v1.0 line has proved:
 - a package-installed calibration/value-report pipeline target that keeps
   reviewer metrics, lane policy, value-report artifacts, and sanitized report
   upload in the release rehearsal path; and
-- a private-repo install rehearsal target against
-  [DrinkBetter-AI/mobile-app](https://github.com/DrinkBetter-AI/mobile-app)
-  that proved the package-installed CLI can detect and dry-run
-  repository-native checks in an external-ish private repo without committing
-  support files first.
+- a private-repo install rehearsal target against an external TypeScript
+  product repository that proved the package-installed CLI can detect and
+  dry-run repository-native checks in an external private repo without
+  committing support files first.
   The rehearsal passed with 10/10 first-user readiness and 0 readiness
   warnings, detected `npm run lint`, `npm run typecheck`, and `npm run test`
   from `package.json`, and separately reported only expected setup diagnostics

diff --git a/docs/first-user-install-rehearsal.md b/docs/first-user-install-rehearsal.md
@@ -360,9 +360,7 @@ package source after execution. The workflow run links are the publication
 evidence; the rehearsal JSON is the install-path evidence.
 
 After production PyPI rehearsal passes, repeat the package-install rehearsal
-against the private
-[DrinkBetter-AI/mobile-app](https://github.com/DrinkBetter-AI/mobile-app)
-repository:
+against a private external TypeScript product repository:
 
 ```bash
 code-mower migration package-install-rehearsal \
@@ -375,6 +373,6 @@ code-mower migration package-install-rehearsal \
 
 Record status, first-user readiness counts, external repo readiness, wrapper
 presence, and detected repository-native checks after execution. That run is
-the proof that a private JavaScript/mobile repo can try Code Mower from PyPI,
+the proof that a private TypeScript product repo can try Code Mower from PyPI,
 detect its native check surface, and preview setup without first adopting
 repo-local wrappers.
diff --git a/docs/github-setup.md b/docs/github-setup.md
@@ -1,8 +1,10 @@
 # Code Mower GitHub Setup
 
-Code Mower v1.0 is GitHub-first. The easy path assumes GitHub pull requests,
+Code Mower remains GitHub-first. The easy path assumes GitHub pull requests,
 labels, issue comments, pull request reviews, check runs, branch protection,
-GitHub Actions, and the `gh` CLI.
+GitHub Actions, and the `gh` CLI. Jira Cloud can optionally supply work items
+and receive guarded lifecycle updates, but it does not replace GitHub as the
+pull request, check, or merge-gate authority.
 
 Public and private repositories are both supported. The difference is not the
 Code Mower lane model; it is provider access, token scope, and data exposure.

diff --git a/docs/jira-cloud-setup.md b/docs/jira-cloud-setup.md
@@ -209,6 +209,11 @@ GitHub state only. Controller dry-run never dispatches, merges, or writes Jira.
 
 ## 4. Shared Orchestrator Contract
 
+This shared session-brief contract is currently an unreleased `main` feature;
+it is not part of the published `code-mower==1.1.2` package. The released Jira
+REST commands and double write guard described elsewhere in this guide remain
+available in v1.1.2.
+
 `code-mower session start` adds a `tracker` section to the operating brief
 whenever `tracker.kind` is `jira_cloud`. Codex, Claude, and every other
 selected orchestrator host receive identical rules from that section:

diff --git a/docs/oss-v1-checklist.md b/docs/oss-v1-checklist.md
@@ -1,5 +1,11 @@
 # Code Mower OSS v1.0 Checklist
 
+This is the historical v1.0 acceptance and release record. For current
+installation and operation, use [Install And Bootstrap](install.md),
+[Try Code Mower In 10 Minutes](try-in-10-minutes.md), and
+[Current State And Roadmap](current-state-and-roadmap.md). Runnable examples
+below are kept valid where they remain part of the current CLI.
+
 v1.0 should make Code Mower valuable in "easy mode" before asking users to
 understand every lane, provider, or calibration option.
 
@@ -61,12 +67,11 @@ package. Before widening the release, record:
 - local dogfood uploads from a stored dashboard-issued token, proving local
   Codex sessions can contribute current metadata without exposing source, raw
   diffs, raw transcripts, auth output, or secrets;
-- private-repo package-install rehearsal against
-  [DrinkBetter-AI/mobile-app](https://github.com/DrinkBetter-AI/mobile-app),
-  including repository-native check detection and dry-run execution. That run
-  passed with 10/10 first-user readiness, detected `npm run lint`,
-  `npm run typecheck`, and `npm run test`, and did not require committing
-  Code Mower support files into the private product repo;
+- private-repo package-install rehearsal against an external TypeScript
+  product repository, including repository-native check detection and dry-run
+  execution. That run passed with 10/10 first-user readiness, detected
+  `npm run lint`, `npm run typecheck`, and `npm run test`, and did not require
+  committing Code Mower support files into the private product repo;
 - calibration/value-report generation from the installed package plus sanitized
   report upload coverage for CodeMower.com;
 - metadata-only AI tool/model provenance in cloud bundles and dogfood events,
@@ -196,7 +201,7 @@ code-mower migration package-install-rehearsal \
   --allow-package-index \
   --repo-path /path/to/repo \
   --json
-code-mower audit pr 123
+code-mower next-steps --repo OWNER/REPO --pr 123
 code-mower calibration value-report templates/calibration-corpus.json
 python scripts/smoke_easy_mode.py --json
 ```

diff --git a/docs/provider-matrix.md b/docs/provider-matrix.md
@@ -1,10 +1,10 @@
 # Code Mower Provider Matrix
 
-Code Mower separates lane semantics from provider mechanics. v1.0 should ship a
-small default path and make every optional provider's cost, privacy, and merge
-authority clear before it runs.
+Code Mower separates lane semantics from provider mechanics. The current
+supervised-pilot line ships a small default path and makes every optional
+provider's cost, privacy, and merge authority clear before it runs.
 
-## Default v1.0 Profile
+## Default Supervised-Pilot Profile
 
 | Lane | Driver | Default role | Merge authority | Notes |
 |---|---|---|---|---|
@@ -16,9 +16,25 @@ participants explicitly with `init --interactive` or `init --with`; selecting
 them does not promote their review authority. Gitar remains available in
 `saas_research` and the optional reviewer selections. See [sessions](sessions.md).
 
+## Orchestrator Hosts
+
+Orchestrator identity is separate from builder and reviewer selection. The
+agent hosting a session is the default orchestrator.
+
+| Host | Current qualification | Jira context posture |
+|---|---|---|
+| Codex | Qualified for session coordination, controller telemetry, and the local working-copy lease | Code Mower REST is authoritative; connected Atlassian Rovo MCP is optional read/context only |
+| Claude Code | Qualified for the same session, telemetry, and lease contract | Code Mower REST is authoritative; connected Atlassian Rovo MCP is optional read/context only |
+| Cursor | Qualified for the same session, telemetry, and lease contract | Code Mower REST is authoritative; Atlassian MCP is optional read/context only and noninteractive reads need approved tool access such as `--auto-review` |
+| Devin, Grok Bot, Antigravity, Muse, custom hosts | Recognized host identities for briefs and telemetry; execution remains an explicit handoff or provider-specific transport until separately qualified | No implicit Jira authority; use the guarded Code Mower tracker commands for writes |
+
+The lease, shared Jira brief, and explicit Cursor qualification are currently
+unreleased changes on `main`; see [Participants And Sessions](sessions.md) for
+the exact release boundary.
+
 ## Provider Classes
 
-| Class | Examples | Private repo support | Source exposure | v1.0 posture |
+| Class | Examples | Private repo support | Source exposure | Current posture |
 |---|---|---|---|---|
 | Local CLI | Codex, Claude Code, Antigravity CLI, Muse Code, Grok Build, Hermes CLI, Aider, CodeRabbit CLI | Yes, if local auth can read the repo | Usually sent to the provider behind the CLI unless provider is local-only | Codex/Claude default; others informational |
 | API/local model | Qwen, Gemma, DeepSeek, Grok-compatible endpoints | Yes | Sent to configured endpoint; local endpoints can keep code local | Informational calibration |
@@ -39,7 +55,7 @@ the live catalog is untouched.
 
 ## Lane Details
 
-| Lane id | Provider | Trigger | Cost policy | Private repo requirement | v1.0 merge role |
+| Lane id | Provider | Trigger | Cost policy | Private repo requirement | Current merge role |
 |---|---|---|---|---|---|
 | `codex` | Codex CLI | Code Mower label/wrapper | included/provider account | local checkout plus GitHub token | merge-gating eligible |
 | `claude_audit` | Claude Code | Code Mower label/wrapper | included/provider account | local checkout plus GitHub token | merge-gating eligible |
@@ -49,7 +65,7 @@ the live catalog is untouched.
 | `qodo` | Qodo | manual opt-in comment/event | paid | GitHub App enabled for repo | informational |
 | `cursor_bugbot` | Cursor BugBot | `bugbot run` or `@cursor review` | paid/Cursor usage | Cursor GitHub App and BugBot repo enablement | informational |
 | `devin` | Devin | Devin Sessions API v3 | paid | service-user `DEVIN_API_KEY`, opaque `DEVIN_ORG_ID`, and exact `OWNER/REPO` in `CODE_MOWER_DEVIN_REPOSITORIES` | canonical hosted Devin; `devin_cloud` accepted alias; issue marker is optional audit evidence |
-| `devin_cli` | Devin CLI | local runner / doctor contract | included/provider account | local checkout plus local auth | informational; not merge authority until calibrated; selectable for release campaigns with the #744 maintained adapter |
+| `devin_cli` | Devin CLI | local runner / doctor contract | included/provider account | local checkout plus local auth | informational; not merge authority until calibrated; selectable for release campaigns through the maintained adapter |
 | `local_llm` | OpenAI-compatible endpoint | local runner | local or endpoint cost | endpoint receives selected code context | informational |
 | `aider` | Aider CLI | local runner | local/provider account | local checkout plus model auth | informational |
 | `gemini_cli` | Gemini CLI compatibility | local runner | provider account | local checkout plus API/auth | legacy informational |