/unharness - Receipt-owned exit from Citadel

Orientation

Use this skill when the user wants Citadel removed from a project. Exit is a two-step, receipt-owned operation. A plan never mutates the project. Apply requires the exact saved plan and its confirmation token.

Do not infer ownership from familiar paths. Do not delete .planning/, .citadel/, runtime settings, hooks, skills, or registrations merely because they look Citadel-related.

Protocol

1. Locate Citadel and inspect adoption authority

Read .citadel/plugin-root.txt when present. Otherwise use the directory containing this skill. Check for .citadel/adoption/active.json; the adoption planner also checks the private recovery ledger.

2. Create a no-write leave plan

Choose a plan path inside the project, such as .planning/adoption/leave.plan.json, and run:

node {citadelRoot}/scripts/adopt.js leave plan \
  --target {projectRoot} \
  --out {planPath} \
  --json

Show the user:

• exact files that will be removed or restored;
• modified or ambiguous footprint entries that will be retained;
• portable archive path;
• runtime registrations whose removal evidence is unknown;
• the plan digest and confirmation token.

If the result is NOT_ADOPTED, stop. Create a conservative legacy inventory:

node {citadelRoot}/scripts/adopt.js import plan {citadelRoot} \
  --target {projectRoot} \
  --out {importPlanPath} \
  --json

Apply that import only after its own explicit approval. Then create a new leave plan from the resulting receipt. Never describe legacy cleanup as exact removal.

3. Obtain explicit approval

Leaving is destructive. Ask the user to approve the displayed plan and exact confirmation token. Do not apply from an unsaved or regenerated plan.

4. Apply and verify

After approval:

node {citadelRoot}/scripts/adopt.js leave apply {planPath} \
  --confirm {confirmationToken} \
  --json

node {citadelRoot}/scripts/adopt.js doctor \
  --target {projectRoot} \
  --json

Doctor may report not_adopted after a clean leave. Report the leave receipt, archive path, removed entries, retained conflicts, and every unknown unregistration observation. “Citadel removed” is permitted only when the receipt proves every required local and external removal.

Export-only compatibility

When the user explicitly wants a human-readable export without leaving:

node {citadelRoot}/scripts/unharness.js {projectRoot} --export-only

This writes the legacy Markdown archive but does not remove harness material.

Fringe Cases

• If .planning/ does not exist, treat it as an empty portable-state set and show the setup/import hint; do not create it merely to leave.
• Missing or invalid adoption authority blocks leave. Use import plan or private-ledger recovery; never guess ownership.
• A changed saved plan, source, target, or pre-image requires a fresh plan.
• An unavailable runtime unregister API stays unknown; report the manual observation required.
• If the Citadel root cannot be located, stop with the exact missing path.

Quality gates

• Planning is read-only unless the user explicitly requests --out.
• Apply consumes the exact saved plan and revalidates source, target, and pre-images.
• Modified owned material is retained with an explicit conflict.
• Shared runtime files restore exact pre-images only while installed bytes remain exact.
• Missing receipts, malformed receipts, and unenumerable registrations are unknown or blocked, never successful.
• The portable archive and private receipt ledger remain available for restore and recovery.

Exit Protocol

Return the leave operation ID and receipt digest, portable archive path, exact removed/restored counts, retained conflicts, and unknown external removals. State plainly whether exact exit was proved. Do not claim success from a completed command when required removal evidence is missing.