fix: the canonical inventory is no longer inside this repo

README.md

@@ -519,10 +519,19 @@ You may keep a **personal** parent **`go.work`** that lists alternate clones on
 | **graycode-skills** | [GrayCodeAI/graycode-skills](https://github.com/GrayCodeAI/graycode-skills) | Community skill registry |
 | **graycode-platform** | [GrayCodeAI/graycode-platform](https://github.com/GrayCodeAI/graycode-platform) | Web, BFF, and Rho Cloud |
 
-`ecosystem.yaml` is the canonical inventory of repositories cloned as
-siblings in this local workspace; tooling reads it rather than carrying its
-own repo-name list. `flux` is the only Go module dependency outside this
-repo; it is consumed through its stable engine facade.
+The canonical inventory of sibling repositories is
+[`GrayCodeAI/graycode-eco/ecosystem.yaml`](https://github.com/GrayCodeAI/graycode-eco/blob/main/ecosystem.yaml),
+not the `ecosystem.yaml` in this repo, which is deprecated and incomplete. The
+inventory moved because a product must not own the registry of its siblings: it
+lived here, `rho` was renamed from `hawk` without signalling the other nine
+repositories, and the list silently omitted `beam`. See
+[graycode-eco/adr/0001](https://github.com/GrayCodeAI/graycode-eco/blob/main/adr/README.md).
+
+`scripts/ecosystem-manifest.sh` reads the roof's file and falls back to the
+deprecated local copy only when the roof is not checked out alongside.
+
+`flux` is the only Go module dependency in the entire ecosystem; it is consumed
+through its stable engine facade.
 
 For the consolidated repo map and the current-vs-proposed architecture diagrams, see [docs/architecture/rho-current-vs-proposed.md](docs/architecture/rho-current-vs-proposed.md).
 For execution-graph ownership, automatic capture seams, and export/sync

docs/COMPETITIVE.md

@@ -63,7 +63,7 @@ External star counts below are approximate web-search snapshots (2026-09-08), no
 
 1. **Traction.** rho has no star-moat (pre-release). Leaders won via day-1 provider-agnostic + one-liner install + Web/Desktop alongside TUI. rho already ships script/brew/npm paths (`README.md:48-59`) — keep, don't add Desktop.
 2. **Language/distro.** Go+MIT+zero-CGO (`Makefile:54`, `go.mod:3`) matches `gh/fzf/lazygit` enterprise-safe profile. Avoid GPL/EUPL patterns (kitty/eza). Rust wave wins on published benchmarks — rho has `make bench` but publishes none (Gap-04).
-3. **Providers.** rho routes only via `flux/engine` facade (`docs/SECURITY-DEVELOPER.md:51-56`, `ecosystem.yaml:29-30`); custom OpenAI-compat supported (`internal/config/settings.go:50`). Count messaging ("28 first-class" per README) trails OpenCode 75+ / Hermes 300+ — fix by exposing catalog count dynamically, not by forking providers into CLI (ownership lives in router per AGENTS.md).
+3. **Providers.** rho routes only via `flux/engine` facade (`docs/SECURITY-DEVELOPER.md:51-56`; facade declared in `GrayCodeAI/graycode-eco/ecosystem.yaml`); custom OpenAI-compat supported (`internal/config/settings.go:50`). Count messaging ("28 first-class" per README) trails OpenCode 75+ / Hermes 300+ — fix by exposing catalog count dynamically, not by forking providers into CLI (ownership lives in router per AGENTS.md).
 4. **TUI/UX.** Bubble Tea v2 + vim keys + `/autonomy` + `/spec` + watch `AI!`/`AI?` + visual diff is competitive. Missing vs field: hosted share-link (ours is local `rho://` deeplink), multi-session grid (we have `mission` worktrees + daemon — unsurfaced like herdr/cmux). Gap-02.
 5. **Execution safety.** Host execution keeps onboarding simple, but requires strong permission, path, approval, and audit controls. Keep those controls explicit and testable; do not add a hidden execution backend.
 6. **Memory/context.** AST repomap + Harrier graph + compaction segments + relevance-prune + conversation-arc + 80% tool-result clearing exceeds most. Missing: Hermes-style auto-skill learning loop (we have curator archive + harness — surface it).

docs/ECOSYSTEM-WIRING.md

@@ -1,9 +1,14 @@
 # GrayCode ecosystem wiring
 
-> **STALE (2026-09-18):** Diagrams below predate `eagle` removal (2026-09-04) and list 14 repos / 6 engines. Canonical inventory is `ecosystem.yaml` (now 6 repos: `rho`, `flux`, `graycode-skills`, `graycode-platform`, `rover`, `across`). Use that for workspace/boundary checks. See `PLAN.md` at eco root for remediation.
+> **STALE (2026-09-18):** Diagrams below predate `eagle` removal (2026-09-04) and list 14 repos / 6 engines.
 > NOTE (2026-09-04): `eagle` contracts vendored into `rho/internal/contracts`.
+> **INVENTORY MOVED (2026-10-02):** the canonical machine-readable inventory is
+> [`GrayCodeAI/graycode-eco/ecosystem.yaml`](https://github.com/GrayCodeAI/graycode-eco/blob/main/ecosystem.yaml)
+> (10 products, including `beam`). The `ecosystem.yaml` in this repo is
+> deprecated and incomplete. Use that file for workspace and boundary checks;
+> `scripts/ecosystem-manifest.sh` already reads it.
 
-This document is the historical implementation contract. `ecosystem.yaml` is the canonical machine-readable inventory.
+This document is the historical implementation contract.
 
 ## Current state before this change
 
@@ -37,7 +42,7 @@ durable Queue-delivery intent.
 
 ```mermaid
 flowchart TB
-  Manifest[rho/ecosystem.yaml\ncanonical repo and contract inventory]
+  Manifest[GrayCodeAI/graycode-eco/ecosystem.yaml\ncanonical repo and contract inventory]
   Manifest --> Workspace[generated root go.work]
   Manifest --> Guards[boundary and release parity guards]
   Manifest --> OwlSnapshot[owl/ecosystem.json]
@@ -102,8 +107,9 @@ must use `directory`/`github_repo`; UI copy may use `product_name`.
 
 ## Contract and event flow
 
-1. Engine packages expose only the facade declared in `ecosystem.yaml`; the
-   manifest validator rejects a missing or out-of-module facade.
+1. Engine packages expose only the facade declared in the canonical inventory
+   (`GrayCodeAI/graycode-eco/ecosystem.yaml`); the manifest validator rejects a
+   missing or out-of-module facade.
 2. Eagle commit `9d358dde4ad8` is the cross-repository contract revision, pinned
    through its reachable Go pseudo-version until the next semver tag is published;
    the parity gate checks every declared consumer.

docs/README.md

@@ -1,6 +1,9 @@
 # Rho Documentation
 
-Index for `rho/docs/`. `ecosystem.yaml` is the canonical repo inventory; `ECOSYSTEM-WIRING.md` is historical.
+Index for `rho/docs/`. The canonical repo inventory is
+[`GrayCodeAI/graycode-eco/ecosystem.yaml`](https://github.com/GrayCodeAI/graycode-eco/blob/main/ecosystem.yaml)
+— the `ecosystem.yaml` in this repo is deprecated and incomplete, and
+`ECOSYSTEM-WIRING.md` is historical.
 
 - **Architecture** `architecture/README.md` + `architecture.md`
 - **User Guide** `user-guide/` (skills, slash commands, permissions)

ecosystem.yaml

@@ -1,10 +1,39 @@
+# DEPRECATED — the canonical inventory moved.
+#
+# This file is no longer the source of truth. As of 2026-10-02 the canonical
+# inventory is:
+#
+#     GrayCodeAI/graycode-eco  ->  ecosystem.yaml
+#
+# Why it moved: a product cannot own the registry of its siblings. This file
+# lived inside `rho` and described itself as canonical, which meant `rho` could
+# rename itself without signalling the other nine repositories. It did exactly
+# that — the organization holds `hawk` and `eyrie` as redirects from the prior
+# names of `rho` and `flux`. The list also omitted `beam` entirely.
+#
+# What is still true below, and what is not:
+#
+#   - The `contracts` block is accurate and is now maintained in the roof.
+#   - The repository list is INCOMPLETE: `beam` is missing, and `lean-prover`
+#     and `graycode-logo` are unaccounted for.
+#   - `tracks_eagle` and other historical fields describe a removed ecosystem.
+#
+# Consumers should migrate:
+#
+#   scripts/ecosystem-manifest.sh          reads this file
+#   scripts/generate-workspace.sh          calls the above
+#   scripts/check-module-release-parity.sh  reads this file
+#   .github/actions/checkout-flux          calls the above
+#   .github/actions/setup-deps             calls the above
+#
+# The migration keeps `rho/scripts/ecosystem-manifest.sh` as the single reader,
+# repointed at the roof's file, with a fallback to this one when the roof is not
+# checked out. The scripts do not need to know where the manifest lives.
+#
+# See graycode-eco/adr/0001 for the decision and the reasoning.
+
 schema_version: 1
 
-# Canonical repository inventory for the GrayCodeAI ecosystem. Repository
-# directories and GitHub repository names are listed per repository;
-# product_name records the user-facing capability. Tooling must consume this
-# file instead of carrying its own repo-name list. Only repositories that
-# exist are listed: removed siblings stay out until they are restored.
 contracts:
   portable_graph_schema: rho.graph/v1
   cloud_graph_schema: graycode-cloud.graph/v1

scripts/check-module-release-parity.sh

@@ -7,7 +7,14 @@ set -euo pipefail
 # Run from the Rho repository root.
 
 ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-MANIFEST="${ROOT_DIR}/ecosystem.yaml"
+ECO_DIR="$(cd "${ROOT_DIR}/.." && pwd)"
+# Prefer the roof's manifest; fall back to the deprecated in-product copy.
+# See scripts/ecosystem-manifest.sh and graycode-eco/adr/0001.
+if [[ -f "${ECO_DIR}/graycode-eco/ecosystem.yaml" ]]; then
+  MANIFEST="${ECO_DIR}/graycode-eco/ecosystem.yaml"
+else
+  MANIFEST="${ROOT_DIR}/ecosystem.yaml"
+fi
 repos=()
 while IFS= read -r repo; do
   [[ "${repo}" != "rho" && -n "${repo}" ]] && repos+=("${repo}")

scripts/ecosystem-manifest.sh

@@ -3,7 +3,29 @@ set -euo pipefail
 
 ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 ECO_DIR="$(cd "${ROOT_DIR}/.." && pwd)"
-MANIFEST="${ROOT_DIR}/ecosystem.yaml"
+
+# The canonical inventory lives in GrayCodeAI/graycode-eco, not in a product.
+# A tenant must not own the registry of its siblings: rho was renamed from hawk
+# without signalling the other nine repositories, and the in-product copy of
+# this list silently omitted beam. See graycode-eco/adr/0001.
+#
+# Prefer the roof. Fall back to the deprecated in-product copy only when the
+# roof is not checked out alongside, which happens for a standalone `go build`
+# of rho outside the ecosystem workspace. Callers do not need to know which one
+# was used.
+ROOF_MANIFEST="${ECO_DIR}/graycode-eco/ecosystem.yaml"
+LEGACY_MANIFEST="${ROOT_DIR}/ecosystem.yaml"
+
+if [[ -f "${ROOF_MANIFEST}" ]]; then
+  MANIFEST="${ROOF_MANIFEST}"
+elif [[ -f "${LEGACY_MANIFEST}" ]]; then
+  MANIFEST="${LEGACY_MANIFEST}"
+  echo "WARNING: graycode-eco is not checked out; falling back to the deprecated ${LEGACY_MANIFEST#"${ROOT_DIR}/"}" >&2
+  echo "WARNING: it is incomplete (no beam) and must not be treated as canonical" >&2
+else
+  echo "manifest not found: looked for ${ROOF_MANIFEST} and ${LEGACY_MANIFEST}" >&2
+  exit 1
+fi
 
 usage() {
   echo "usage: $0 validate | json | list <all|workspace|engines>" >&2
@@ -14,6 +36,10 @@ usage() {
 
 records() {
   awk '
+    # Records are the entries under `repositories:`. The roof manifest also has
+    # a `not_products:` block listing repositories in the GitHub organization
+    # that are deliberately not ecosystem products; those entries have no
+    # `directory:` key and are therefore skipped here, which is the intent.
     function flush() {
       if (directory != "") {
         if (module == "") module = "-"