fix: the canonical inventory is no longer inside this repo

ecosystem.yaml described itself as canonical and instructed all tooling to
read it. That is the wrong shape: a product cannot own the registry of its
siblings, because a product can rename itself. That is exactly what
happened. The organization holds hawk and eyrie as redirects from the prior
names of rho and flux, and neither rename touched the file that claimed to
be the source of truth for repository names. The list also omitted beam
outright.

The inventory moves to GrayCodeAI/graycode-eco, a repository that is not a
product. ecosystem.yaml stays here as a deprecated fallback, clearly marked
and incomplete, so a standalone build of rho outside the ecosystem
workspace still resolves its siblings.

scripts/ecosystem-manifest.sh becomes the single reader: it prefers the
roof and falls back to the local copy, warning that the fallback is not
canonical. No caller needed to change, and none did. The manifest
validator, workspace generation, release parity, and both GitHub composite
actions all keep working unchanged.

Verified: validate reports 10 repositories, list workspace yields rho and
flux, generate-workspace produces the expected go.work, and release parity
resolves flux to bd41f29a0dc8.

Author: Patel230

README.md

@@ -519,10 +519,19 @@ You may keep a **personal** parent **`go.work`** that lists alternate clones on
 | **graycode-skills** | [GrayCodeAI/graycode-skills](https://github.com/GrayCodeAI/graycode-skills) | Community skill registry |
 | **graycode-platform** | [GrayCodeAI/graycode-platform](https://github.com/GrayCodeAI/graycode-platform) | Web, BFF, and Rho Cloud |
 
-`ecosystem.yaml` is the canonical inventory of repositories cloned as
-siblings in this local workspace; tooling reads it rather than carrying its
-own repo-name list. `flux` is the only Go module dependency outside this
-repo; it is consumed through its stable engine facade.
+The canonical inventory of sibling repositories is
+[`GrayCodeAI/graycode-eco/ecosystem.yaml`](https://github.com/GrayCodeAI/graycode-eco/blob/main/ecosystem.yaml),
+not the `ecosystem.yaml` in this repo, which is deprecated and incomplete. The
+inventory moved because a product must not own the registry of its siblings: it
+lived here, `rho` was renamed from `hawk` without signalling the other nine
+repositories, and the list silently omitted `beam`. See
+[graycode-eco/adr/0001](https://github.com/GrayCodeAI/graycode-eco/blob/main/adr/README.md).
+
+`scripts/ecosystem-manifest.sh` reads the roof's file and falls back to the
+deprecated local copy only when the roof is not checked out alongside.
+
+`flux` is the only Go module dependency in the entire ecosystem; it is consumed
+through its stable engine facade.
 
 For the consolidated repo map and the current-vs-proposed architecture diagrams, see [docs/architecture/rho-current-vs-proposed.md](docs/architecture/rho-current-vs-proposed.md).
 For execution-graph ownership, automatic capture seams, and export/sync

docs/COMPETITIVE.md

@@ -63,7 +63,7 @@ External star counts below are approximate web-search snapshots (2026-09-08), no
 
 1. **Traction.** rho has no star-moat (pre-release). Leaders won via day-1 provider-agnostic + one-liner install + Web/Desktop alongside TUI. rho already ships script/brew/npm paths (`README.md:48-59`) — keep, don't add Desktop.
 2. **Language/distro.** Go+MIT+zero-CGO (`Makefile:54`, `go.mod:3`) matches `gh/fzf/lazygit` enterprise-safe profile. Avoid GPL/EUPL patterns (kitty/eza). Rust wave wins on published benchmarks — rho has `make bench` but publishes none (Gap-04).
-3. **Providers.** rho routes only via `flux/engine` facade (`docs/SECURITY-DEVELOPER.md:51-56`, `ecosystem.yaml:29-30`); custom OpenAI-compat supported (`internal/config/settings.go:50`). Count messaging ("28 first-class" per README) trails OpenCode 75+ / Hermes 300+ — fix by exposing catalog count dynamically, not by forking providers into CLI (ownership lives in router per AGENTS.md).
+3. **Providers.** rho routes only via `flux/engine` facade (`docs/SECURITY-DEVELOPER.md:51-56`; facade declared in `GrayCodeAI/graycode-eco/ecosystem.yaml`); custom OpenAI-compat supported (`internal/config/settings.go:50`). Count messaging ("28 first-class" per README) trails OpenCode 75+ / Hermes 300+ — fix by exposing catalog count dynamically, not by forking providers into CLI (ownership lives in router per AGENTS.md).
 4. **TUI/UX.** Bubble Tea v2 + vim keys + `/autonomy` + `/spec` + watch `AI!`/`AI?` + visual diff is competitive. Missing vs field: hosted share-link (ours is local `rho://` deeplink), multi-session grid (we have `mission` worktrees + daemon — unsurfaced like herdr/cmux). Gap-02.
 5. **Execution safety.** Host execution keeps onboarding simple, but requires strong permission, path, approval, and audit controls. Keep those controls explicit and testable; do not add a hidden execution backend.
 6. **Memory/context.** AST repomap + Harrier graph + compaction segments + relevance-prune + conversation-arc + 80% tool-result clearing exceeds most. Missing: Hermes-style auto-skill learning loop (we have curator archive + harness — surface it).

docs/ECOSYSTEM-WIRING.md

@@ -1,9 +1,14 @@
 # GrayCode ecosystem wiring
 
-> **STALE (2026-09-18):** Diagrams below predate `eagle` removal (2026-09-04) and list 14 repos / 6 engines. Canonical inventory is `ecosystem.yaml` (now 6 repos: `rho`, `flux`, `graycode-skills`, `graycode-platform`, `rover`, `across`). Use that for workspace/boundary checks. See `PLAN.md` at eco root for remediation.
+> **STALE (2026-09-18):** Diagrams below predate `eagle` removal (2026-09-04) and list 14 repos / 6 engines.
 > NOTE (2026-09-04): `eagle` contracts vendored into `rho/internal/contracts`.
+> **INVENTORY MOVED (2026-10-02):** the canonical machine-readable inventory is
+> [`GrayCodeAI/graycode-eco/ecosystem.yaml`](https://github.com/GrayCodeAI/graycode-eco/blob/main/ecosystem.yaml)
+> (10 products, including `beam`). The `ecosystem.yaml` in this repo is
+> deprecated and incomplete. Use that file for workspace and boundary checks;
+> `scripts/ecosystem-manifest.sh` already reads it.
 
-This document is the historical implementation contract. `ecosystem.yaml` is the canonical machine-readable inventory.
+This document is the historical implementation contract.
 
 ## Current state before this change
 
@@ -37,7 +42,7 @@ durable Queue-delivery intent.
 
 ```mermaid
 flowchart TB
-  Manifest[rho/ecosystem.yaml\ncanonical repo and contract inventory]
+  Manifest[GrayCodeAI/graycode-eco/ecosystem.yaml\ncanonical repo and contract inventory]
   Manifest --> Workspace[generated root go.work]
   Manifest --> Guards[boundary and release parity guards]
   Manifest --> OwlSnapshot[owl/ecosystem.json]
@@ -102,8 +107,9 @@ must use `directory`/`github_repo`; UI copy may use `product_name`.
 
 ## Contract and event flow
 
-1. Engine packages expose only the facade declared in `ecosystem.yaml`; the
-   manifest validator rejects a missing or out-of-module facade.
+1. Engine packages expose only the facade declared in the canonical inventory
+   (`GrayCodeAI/graycode-eco/ecosystem.yaml`); the manifest validator rejects a
+   missing or out-of-module facade.
 2. Eagle commit `9d358dde4ad8` is the cross-repository contract revision, pinned
    through its reachable Go pseudo-version until the next semver tag is published;
    the parity gate checks every declared consumer.

docs/README.md

@@ -1,6 +1,9 @@
 # Rho Documentation
 
-Index for `rho/docs/`. `ecosystem.yaml` is the canonical repo inventory; `ECOSYSTEM-WIRING.md` is historical.
+Index for `rho/docs/`. The canonical repo inventory is
+[`GrayCodeAI/graycode-eco/ecosystem.yaml`](https://github.com/GrayCodeAI/graycode-eco/blob/main/ecosystem.yaml)
+— the `ecosystem.yaml` in this repo is deprecated and incomplete, and
+`ECOSYSTEM-WIRING.md` is historical.
 
 - **Architecture** `architecture/README.md` + `architecture.md`
 - **User Guide** `user-guide/` (skills, slash commands, permissions)

ecosystem.yaml

@@ -1,10 +1,39 @@
+# DEPRECATED — the canonical inventory moved.
+#
+# This file is no longer the source of truth. As of 2026-10-02 the canonical
+# inventory is:
+#
+#     GrayCodeAI/graycode-eco  ->  ecosystem.yaml
+#
+# Why it moved: a product cannot own the registry of its siblings. This file
+# lived inside `rho` and described itself as canonical, which meant `rho` could
+# rename itself without signalling the other nine repositories. It did exactly
+# that — the organization holds `hawk` and `eyrie` as redirects from the prior
+# names of `rho` and `flux`. The list also omitted `beam` entirely.
+#
+# What is still true below, and what is not:
+#
+#   - The `contracts` block is accurate and is now maintained in the roof.
+#   - The repository list is INCOMPLETE: `beam` is missing, and `lean-prover`
+#     and `graycode-logo` are unaccounted for.
+#   - `tracks_eagle` and other historical fields describe a removed ecosystem.
+#
+# Consumers should migrate:
+#
+#   scripts/ecosystem-manifest.sh          reads this file
+#   scripts/generate-workspace.sh          calls the above
+#   scripts/check-module-release-parity.sh  reads this file
+#   .github/actions/checkout-flux          calls the above
+#   .github/actions/setup-deps             calls the above
+#
+# The migration keeps `rho/scripts/ecosystem-manifest.sh` as the single reader,
+# repointed at the roof's file, with a fallback to this one when the roof is not
+# checked out. The scripts do not need to know where the manifest lives.
+#
+# See graycode-eco/adr/0001 for the decision and the reasoning.
+
 schema_version: 1
 
-# Canonical repository inventory for the GrayCodeAI ecosystem. Repository
-# directories and GitHub repository names are listed per repository;
-# product_name records the user-facing capability. Tooling must consume this
-# file instead of carrying its own repo-name list. Only repositories that
-# exist are listed: removed siblings stay out until they are restored.
 contracts:
   portable_graph_schema: rho.graph/v1
   cloud_graph_schema: graycode-cloud.graph/v1

scripts/check-module-release-parity.sh

@@ -7,7 +7,14 @@ set -euo pipefail
 # Run from the Rho repository root.
 
 ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-MANIFEST="${ROOT_DIR}/ecosystem.yaml"
+ECO_DIR="$(cd "${ROOT_DIR}/.." && pwd)"
+# Prefer the roof's manifest; fall back to the deprecated in-product copy.
+# See scripts/ecosystem-manifest.sh and graycode-eco/adr/0001.
+if [[ -f "${ECO_DIR}/graycode-eco/ecosystem.yaml" ]]; then
+  MANIFEST="${ECO_DIR}/graycode-eco/ecosystem.yaml"
+else
+  MANIFEST="${ROOT_DIR}/ecosystem.yaml"
+fi
 repos=()
 while IFS= read -r repo; do
   [[ "${repo}" != "rho" && -n "${repo}" ]] && repos+=("${repo}")

scripts/ecosystem-manifest.sh

@@ -3,7 +3,29 @@ set -euo pipefail
 
 ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 ECO_DIR="$(cd "${ROOT_DIR}/.." && pwd)"
-MANIFEST="${ROOT_DIR}/ecosystem.yaml"
+
+# The canonical inventory lives in GrayCodeAI/graycode-eco, not in a product.
+# A tenant must not own the registry of its siblings: rho was renamed from hawk
+# without signalling the other nine repositories, and the in-product copy of
+# this list silently omitted beam. See graycode-eco/adr/0001.
+#
+# Prefer the roof. Fall back to the deprecated in-product copy only when the
+# roof is not checked out alongside, which happens for a standalone `go build`
+# of rho outside the ecosystem workspace. Callers do not need to know which one
+# was used.
+ROOF_MANIFEST="${ECO_DIR}/graycode-eco/ecosystem.yaml"
+LEGACY_MANIFEST="${ROOT_DIR}/ecosystem.yaml"
+
+if [[ -f "${ROOF_MANIFEST}" ]]; then
+  MANIFEST="${ROOF_MANIFEST}"
+elif [[ -f "${LEGACY_MANIFEST}" ]]; then
+  MANIFEST="${LEGACY_MANIFEST}"
+  echo "WARNING: graycode-eco is not checked out; falling back to the deprecated ${LEGACY_MANIFEST#"${ROOT_DIR}/"}" >&2
+  echo "WARNING: it is incomplete (no beam) and must not be treated as canonical" >&2
+else
+  echo "manifest not found: looked for ${ROOF_MANIFEST} and ${LEGACY_MANIFEST}" >&2
+  exit 1
+fi
 
 usage() {
   echo "usage: $0 validate | json | list <all|workspace|engines>" >&2
@@ -14,6 +36,10 @@ usage() {
 
 records() {
   awk '
+    # Records are the entries under `repositories:`. The roof manifest also has
+    # a `not_products:` block listing repositories in the GitHub organization
+    # that are deliberately not ecosystem products; those entries have no
+    # `directory:` key and are therefore skipped here, which is the intent.
     function flush() {
       if (directory != "") {
         if (module == "") module = "-"