chhhee10 · Oct 13, 2026 · Oct 13, 2026 · Oct 13, 2026 · Oct 13, 2026 · Oct 13, 2026
diff --git a/.github/workflows/fp-cli-parity.yml b/.github/workflows/fp-cli-parity.yml
@@ -0,0 +1,75 @@
+name: Cloud CLI stacked parity
+
+# ci.yml does not yet target feat/tui-ux. Its trigger change belongs to #880;
+# keep this feature's verification disjoint from that active workflow edit.
+on:
+  pull_request:
+    branches: [feat/tui-ux]
+    paths:
+      - "fp-cloud-cli/**"
+      - "docs/reference/cloud-cli.mdx"
+      - ".github/workflows/fp-cli-parity.yml"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: fp-parity-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  cloud-cli:
+    name: Cloud CLI parity (Python ${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
+    defaults:
+      run:
+        working-directory: fp-cloud-cli
+    steps:
+      - uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+          cache-dependency-glob: fp-cloud-cli/uv.lock
+      - name: Install locked dependencies
+        run: uv sync --locked --extra dev --python ${{ matrix.python-version }}
+      - name: Test with filesystem contract required
+        env:
+          FP_CLI_REQUIRE_CONTRACT: "1"
+        run: uv run --extra dev pytest -q
+      - name: Build distribution
+        run: uv build > /tmp/fp-build.log 2>&1
+      - name: Clean wheel install and user-level Cloud smoke
+        run: |
+          uv venv /tmp/fp-parity-smoke --python ${{ matrix.python-version }}
+          uv pip install --python /tmp/fp-parity-smoke/bin/python dist/*.whl
+          /tmp/fp-parity-smoke/bin/fp --version
+          /tmp/fp-parity-smoke/bin/python tests/fake_cloud_smoke.py \
+            --fp /tmp/fp-parity-smoke/bin/fp --artifacts /tmp/fp-parity-artifacts
+
+  docs:
+    name: Cloud CLI parity docs
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 22
+      - name: Install docs dependencies
+        run: bun install --frozen-lockfile --ignore-scripts
+      - name: Parse documentation and resolve images
+        run: bun run validate:mdx
+      - name: Validate next-beta changelog
+        run: python3 scripts/changelog-section.py fp-cloud-cli/CHANGELOG.md 0.0.2b1
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -4,6 +4,8 @@
 
 ### Features
 
+- Cloud CLI parity: hosted code, LLM-judge and Jev evaluator authoring/deployment, dashboards, sentiment, assistant artifacts/approvals, org controls and the shared mint/pink screen language (#885)
+
 - New terminal look for the CLI, step one: the palette gains the redesign's label grey, progress-track grey and a red for failures. Descriptions keep the terminal's own colour, and the greys fall back to the dim attribute below 24-bit, so every screen stays readable on light themes (#881)
 - Pickers in the new look: an UPPERCASE heading with a live "n of m selected", a `›` cursor and `■ □` boxes, twelve rows before scrolling, plain `a` to toggle all, and the key hints at the foot. The `policies -i` agent menu now uses the shared picker (#881)
 - Every `--help` page in the new look, cut to usage, options and examples, with every real flag and its real default. The index opens with three getting-started steps, then lists every command by what it is for. `policies add|remove|show --help` now prints the one policies page (#881)

diff --git a/docs/reference/cloud-cli.mdx b/docs/reference/cloud-cli.mdx
@@ -6,6 +6,9 @@ icon: "cloud-cog"
 
 Use `fp` to inspect Cloud telemetry, manage cloud-managed enforcement (policies, fleet deployments, guardrail decisions), and manage audits, findings, issues, alerts, keys, users, queries, and settings. Use [`failproofai`](/reference/failproof-cli) for local hooks, policies, capture, and machine enrollment.
 
+You can also author and deploy hosted code, LLM-judge and Jev evaluators, manage
+dashboards, inspect sentiment, and use the dashboard assistant from the terminal.
+
 Install the released Cloud CLI as an isolated tool:
 
 ```bash
@@ -36,6 +39,122 @@ Run `fp COMMAND --help` or `fp COMMAND SUBCOMMAND --help` for terminal help.
 
 ## CLI commands
 
+### Author an evaluator
+
+`fp evaluators` authors definitions; `fp evals` reads results. An enabled managed
+instance is required (`fp evaluators instances`). Authoring needs
+`evaluations:trigger`; session dry-runs and schema profiling also need `events:read`.
+
+Code is one restricted Python expression. Save this as `error_free.py`:
+
+```python
+EvalResult(score=Score(1.0 if session.count("error") == 0 else 0.0), reasoning="Error-free session")
+```
+
+```bash
+fp --json evaluators create --key error_free --name "Error free" --code error_free.py --dry-run-on run-001
+fp --json evaluators dry-run --code error_free.py --session run-001
+fp --json evaluators deploy error_free --code error_free.py --version 2 --dry-run-on run-001
+fp --json evaluators list --key error_free --all
+```
+
+LLM judge:
+
+```bash
+fp --json evaluators create --key relevance --name Relevance --judge --criteria "Grade relevance to the request" --threshold 0.7
+fp --json evaluators deploy relevance --version 2 --judge --criteria "Grade relevance and completeness" --threshold 0.8
+fp --json sessions re-evaluate run-001
+fp --json sessions history run-001
+```
+
+Jev binary and graded rubric:
+
+```bash
+fp --json evaluators create --key resolution --name Resolution --jev noul --instructions "Was the request resolved?" --true "Resolved" --false "Unresolved"
+fp --json evaluators dry-run --jev noul --instructions "Was the request resolved?" --true "Resolved" --false "Unresolved" --session run-001
+fp --json evaluators deploy resolution --version 2 --jev score --instructions "Grade resolution quality" --level "Unresolved" --level "Partly resolved" --level "Fully resolved"
+```
+
+<Warning>
+Creation enables the evaluator. Deploy creates a new immutable version, then
+disables older enabled versions. A failed follow-up leaves the new version
+published: inspect `evaluators list --all` before retrying.
+Judge dry-runs are refused by Cloud. Jev dry-runs spend model budget.
+Backfill excludes judge/Jev and accepts at most 90 days.
+Human output shows per-session dry-run results before creating/deploying.
+Failed previews stop the write unless you explicitly pass `--force` after review.
+</Warning>
+
+AI drafting requires `fp login` and writes a spec accepted by create/deploy:
+
+```bash
+fp --json evaluators draft "Measure error-free sessions with code" --kind code --out evaluator.json
+# Review the draft's key, source and condition before enabling it.
+fp --json evaluators create --file evaluator.json --dry-run-on run-001
+fp --json evaluators dry-run --file evaluator.json
+```
+
+| Command | Options / behavior |
+| --- | --- |
+| `fp evaluators list` | `--key`, `--all` |
+| `fp evaluators show KEY[@VERSION]` | Full source/envelope |
+| `fp evaluators create` | `--key`, `--name`, `--version`, repeated `--label`, `--condition EXPR\|@file`, one source, repeated `--dry-run-on`, `--disabled`, explicit `--force` for failed previews |
+| `fp evaluators deploy KEY` | Same source flags; `--version`, code-only `--backfill 7d`, `--force`; numeric versions auto-increment; KEY supplies a missing spec-file `eval_key` |
+| `fp evaluators draft "intent"` | Session; `--kind code\|judge\|jev`, `--out` |
+| `fp evaluators dry-run` | Source flags or `--file`, repeated `--session` (maximum 10); none = compile only |
+| `fp evaluators enable\|disable KEY[@VERSION]` | Toggle |
+| `fp evaluators label KEY[@VERSION]` | Repeated `--add`, `--remove` |
+| `fp evaluators instances\|schema\|jobs` | Inspect managed fleet/schema/jobs |
+| `fp evaluators backfill` | `--from`, `--to`, `--key`, `--dry-run` |
+
+Code flags are `--code FILE|-`, `--result-kind score|metric|assertion`,
+`--timeout S`. Judge flags are `--judge --criteria TEXT`, repeated `--step` and
+`--threshold`. Jev flags are `--jev noul --instructions --true --false` or
+`--jev score --instructions` with 3–5 distinct `--level` values, worst first.
+Judge/Jev require a score; thresholds are 0–1. Binary judge steps are rejected.
+
+Spec files contain exactly `eval_key`, `display_name`, `eval_version`,
+`result_kind`, `labels`, `condition_source`, `evaluator_source`, `timeout_seconds`.
+Judge/Jev `evaluator_source` is a JSON envelope string. Do not include row ids,
+enabled state, or AI reasoning metadata. `--file` and discrete spec flags are
+exclusive; deploy can override the file's version. Output files are never overwritten.
+
+### New dashboard controls
+
+All commands accept global `--json`. Unknown-route 404s exit 6 with “not available
+on this FailproofAI Cloud yet”. Missing-record 404s also exit 6 but report that the
+record was not found. Session-only commands deny key mode before HTTP (exit 2).
+
+Human commands use summaries and tables. For raw JSON exports, pass global
+`--json` or save with `--out FILE`; otherwise session and JSON query exports show
+a readable view. CSV exports remain plain CSV for piping.
+
+| Commands | Options / notes |
+| --- | --- |
+| `fp dashboards list\|show ID\|create\|update ID\|delete ID` | Create `--name`, `--description`, `--file` definition; update preserves unmentioned fields |
+| `fp dashboards tiles ID list\|add\|update TILE\|remove TILE\|layout` | Add `--query ID --chart TYPE --title`; config/geometry or layout via `--file` |
+| `fp sessions show\|export\|history\|re-evaluate ID` | Export `--out`; history is evaluation history |
+| `fp events latency` | `--since` |
+| `fp sentiment summary\|messages\|sessions\|session ID` | `--since`; list `--limit`; messages `--session-id` |
+| `fp query compose "question"` | Session; `--run` |
+| `fp query export [ID]` | Or `--sql`; `--format csv\|json`, `--out` |
+| `fp alerts recipients` / `fp alerts issues ID` | Issues can `--create --title --summary` or `--create --file` |
+| `fp audits contracts list\|show ID\|create\|update ID` | `--agent-id`, `--body TEXT\|@file`, `--file` JSON; update `--enabled/--disabled` |
+| `fp policies author "intent"\|backtest FILE_OR_ID\|candidacy --issue ID` | Session; never auto-publishes |
+| `fp agent brief` | Session; `--range 24h\|7d` |
+| `fp orgs create --name N [--slug S]` | Session; derives omitted slug, does not switch org |
+| `fp roles list\|show NAME\|create\|update NAME\|delete NAME` | Permission sets; create `--name --permission`; update replace `--permission` or merge `--add/--remove`; `--description`, `--file` |
+| `fp users delete ID` / `fp users defaults` | Deletion by id |
+| `fp usage windows` / `fp plan` / `fp plan claim OFFER` | Offers and trial; plan/claim require a signed-in session |
+| `fp settings context-windows list\|set MODEL TOKENS\|delete MODEL` | 0–1000000 tokens |
+| `fp otel status\|enable\|disable` | Cloud org ingest switch, not local capture |
+| `fp slack status\|disconnect` | Session |
+
+`fp agent ask` renders artifact SQL as tables/stats through `queries:run`.
+Write approvals show the proposed change and prompt on a terminal. Scripts and
+`--json` decline unless `--approve` is explicit. Existing JSON shapes stay
+unchanged when no artifact is returned.
+
 ### Authentication
 
 | Command | Purpose | Options |

diff --git a/fp-cloud-cli/CHANGELOG.md b/fp-cloud-cli/CHANGELOG.md
@@ -1,5 +1,27 @@
 # Changelog — `fp` CLI
 
+## 0.0.2b1 — 2026-10-13
+
+### Added
+
+- Hosted evaluator authoring for code, LLM judge and Jev: create/deploy, AI draft specs, dry-run, labels, toggles, instances, schema, jobs and code-only backfill.
+- Dashboards and tiles; session overview/export/history/re-evaluate; latency and sentiment; query composition/export; alert recipients/issues and agent contracts.
+- Policy author/backtest/candidacy, assistant artifact tables, fail-closed interactive write approvals, and agent-curated home briefs.
+- Organization creation, permission-set roles, member deletion/defaults, usage windows, offers/trial, model context windows, OTEL and Slack controls.
+
+### Changed
+
+- New Cloud API families work in key mode; unsupported session-only commands deny before HTTP and unknown-route 404s exit 6 with an availability message.
+- Shared screens use the mint/pink wordmark and grey labels, without boxes/rules or shortened ids; existing JSON contracts are unchanged.
+- The agent skill, command reference, README and Cloud CLI docs include end-to-end evaluator workflows. No version bump or release is performed.
+
+### Fixes
+
+- Remove the unused colour-keyed permission rank, document full-id rendering, emit UTC `Z` timestamps for deploy backfills, and report approval-answer failures without a traceback while restoring the terminal (#885).
+- Reject natural-language binary judge steps, distinguish unknown routes from missing records on 404, normalize standalone backfill ranges to UTC `Z`, expose all subcommands in help, and render artifact headers before titles with consistent session-only wording (#885).
+- New Cloud commands use deliberate human summaries/tables and actionable empty states at 80/140 columns without raw response blobs. Evaluator previews display before writes and require explicit `--force` after failures; plan/claim deny key mode, deploy specs can omit the positional key, and older settings-route 404s degrade clearly. Existing JSON payloads stay unchanged (#885).
+- `fp evaluators deploy` keeps the previous version's condition and labels unless `--condition`/`--label` change them, so a new version no longer silently widens to every session (#885).
+
 ## 0.0.2b0 — 2026-09-22
 
 ### Added

diff --git a/fp-cloud-cli/README.md b/fp-cloud-cli/README.md
@@ -171,6 +171,126 @@ These commands are **session-only** (`fp login`). They are absent from the
 versioned API an API key authenticates against, so `--api-key` exits 2 with the
 reason rather than failing at the request.
 
+## Author an evaluator
+
+`fp evaluators` authors hosted definitions; `fp evals` continues to read results.
+Creation enables a definition by default. Check `fp evaluators instances` first:
+Cloud needs an enabled managed instance. Writes need `evaluations:trigger`;
+session dry-runs and `evaluators schema` also need `events:read`.
+
+Write `error_free.py` as a restricted Python expression (no imports or functions):
+
+```python
+EvalResult(score=Score(1.0 if session.count("error") == 0 else 0.0), reasoning="Error-free session")
+```
+
+```bash
+fp --json evaluators create --key error_free --name "Error free" --code error_free.py \
+  --result-kind score --dry-run-on run-001
+fp --json evaluators dry-run --code error_free.py --session run-001
+fp --json evaluators deploy error_free --code error_free.py --version 2 --dry-run-on run-001
+fp --json evaluators list --key error_free --all
+```
+
+LLM judge (Cloud selects the model; judge dry-runs are refused):
+
+```bash
+fp --json evaluators create --key relevance --name Relevance --judge \
+  --criteria "Grade how directly the answer addresses the request" --threshold 0.7
+fp --json evaluators deploy relevance --version 2 --judge \
+  --criteria "Grade relevance and completeness" --threshold 0.8
+fp --json sessions re-evaluate run-001
+fp --json sessions history run-001
+```
+
+Jev binary or graded rubric:
+
+```bash
+fp --json evaluators create --key resolved --name Resolved --jev noul \
+  --instructions "Was the request resolved?" --true "Resolved" --false "Unresolved"
+fp --json evaluators dry-run --jev noul --instructions "Was the request resolved?" \
+  --true "Resolved" --false "Unresolved" --session run-001
+fp --json evaluators deploy resolved --version 2 --jev score \
+  --instructions "Grade resolution quality" \
+  --level "Unresolved" --level "Partly resolved" --level "Fully resolved"
+```
+
+Jev dry-runs spend model budget. Rubrics need 3–5 distinct levels, worst first.
+Thresholds are 0–1; judge/Jev always return a score. `deploy` creates the new
+immutable version before disabling older enabled versions. If disabling fails,
+the CLI names the published id; inspect `list --all` and recover explicitly.
+`--backfill 7d` is code-only; `evaluators backfill --from T --to T` accepts ≤90 days.
+
+Human output shows each `--dry-run-on` session's outcome before creation or
+deployment. Any failed run stops the write; after reviewing the failure, an
+explicit `--force` overrides this guard. Existing `--json` response shapes stay
+unchanged.
+
+AI drafting is session-only and writes an API spec that create/deploy accept:
+
+```bash
+fp login
+fp --json evaluators draft "Measure error-free sessions with code" --kind code --out evaluator.json
+# Review the spec, especially eval_key and evaluator_source, before enabling it.
+fp --json evaluators create --file evaluator.json --dry-run-on run-001
+fp --json evaluators dry-run --file evaluator.json
+```
+
+Spec fields: `eval_key`, `display_name`, `eval_version`, `result_kind`, `labels`,
+`condition_source`, `evaluator_source`, `timeout_seconds`. Judge/Jev sources are
+JSON envelope **strings**, not nested objects. `--file` is exclusive with discrete
+spec flags; deploy may override a file's version. Files written by the CLI are
+created exclusively, so existing files are never silently replaced.
+See [the command reference](skill/references/commands.md#author-an-evaluator).
+
+## Dashboard parity
+
+```text
+fp dashboards list|show|create|update|delete
+fp dashboards tiles <id> list|add|update|remove|layout
+fp sessions show|export|history|re-evaluate <id>
+fp events latency
+fp sentiment summary|messages|sessions|session <id>
+fp query compose "question" [--run]                  # session
+fp query export [<id>] [--sql SQL] --format csv|json [--out FILE]
+fp alerts recipients
+fp alerts issues <id> [--create --title ... --summary ...]
+fp audits contracts list|show|create|update
+fp policies author "intent"|backtest <file-or-id>|candidacy --issue <id>  # session
+fp agent brief [--range 24h|7d]                      # session
+fp orgs create --name N [--slug S]                   # session
+fp roles list|show|create|update|delete
+fp users delete <id>
+fp users defaults
+fp usage windows
+fp plan                                           # session
+fp plan claim <offer>                             # session
+fp settings context-windows list|set <model> <tokens>|delete <model>
+fp otel status|enable|disable
+fp slack status|disconnect                          # session
+```
+
+`fp agent ask` runs artifact SQL through the permission-gated query runner and
+renders tables/stats. It prompts before approving a write on a terminal.
+Scripts and `--json` **decline** unless you explicitly pass `--approve`.
+Normal create/update commands keep their existing non-interactive confirmation
+behavior; assistant approvals are a separate safety boundary.
+
+All new commands accept the global `--json` before the command. Session-only
+commands fail before HTTP in API-key mode, with exit 2 and a `fp login` hint.
+Unknown-route 404s exit 6 with “not available on this FailproofAI Cloud yet”.
+Missing-record 404s also exit 6 but report that the record was not found.
+`plan` and `plan claim` require a signed-in person and deny API-key mode before
+HTTP with the standard `fp login` message.
+Human screens use the mint/pink wordmark, grey labels, open tables and full ids;
+existing JSON shapes are unchanged.
+
+Human commands show summaries, tables and wrapped text rather than response
+objects. Use global `--json` for raw API results. For `sessions export` or
+`query export --format json`, use `--out FILE` to save the JSON; without either
+option, the terminal shows a readable session or query view. CSV exports remain
+plain CSV for piping.
+
 ## Configuration
 
 | Setting | Flag | Env var | Default |
@@ -256,4 +376,3 @@ working as an opt-out if it is ever switched back on. See
 cd fp-cloud-cli
 uv run --extra dev pytest
 ```
-