feat(duty): query Agent Schedule runs, findings & reports (read-only) (#25)

Add a `praxis duty` command family so a local AI host can triage what
the org's scheduled "duty" agents did — without opening the Praxis web
UI. Closes #24.

Surface (all read-only, --json + non-TTY auto-JSON):
  praxis duty list                      duties under the agent
  praxis duty runs --duty <name|id>     recent runs (newest first)
  praxis duty run <run_id>              one run's detail
  praxis duty report <run_id>           the report artifact a run produced
  praxis duty findings <duty>           a duty's findings (open|resolved|all)

- internal/duties: typed REST client mirroring internal/memory — generic
  doJSON transport, Bearer auth, var function seams for test stubbing.
- internal/agentcatalog: add Agent.ID and FetchIncludingGlobal so the
  global "praxis" duty agent (and others) can be resolved by name→id;
  Fetch/FetchIncludingGlobal share fetchActiveSorted.
- cmd/duty: --agent (default "praxis") and <duty> args accept a name or
  id; empty-state output names the agent (+ resolved id). Reuses
  activeOrAuthExit/reportHTTPErr/render from cmd/memory.

Auth confirmed live: the schedule/run/finding/artifact routes accept the
CLI's API-key Bearer token (validate_user_cookie checks it before
cookies), so no backend change was needed. Verified end-to-end against a
real deployment.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: anujhydrabadi

CLAUDE.md

@@ -51,8 +51,11 @@ cmd/                  cobra command tree (only commands that DO something
   update.go           `praxis update` (self-update via GitHub Releases)
   completion.go       `praxis completion {bash|zsh|fish|powershell}`
   logout.go           `praxis logout` (deletes ~/.praxis/credentials)
+  duty.go             `praxis duty *` (Agent Schedule runs/findings/reports)
 internal/             pure logic, unit-tested
   paths/              ~/.praxis filesystem locations
+  duties/             REST client for Agent Schedules (duties): runs,
+                       findings, artifacts — mirrors internal/memory
   selfupdate/         GitHub Releases fetch, checksum, atomic replace
 Makefile              build (with ldflags), install, test, lint, clean
 .goreleaser.yml       release config — raw binaries × 4 arches + brew tap

README.md

@@ -36,6 +36,13 @@ Each capability is one or more functions on a server-side MCP. Run
   but its runtime didn't surface the files in smoke testing — it's
   gated off until Codex's loader catches up to its own docs.
 
+- **Triage scheduled-agent ("duty") output** — list the org's duties,
+  read a duty's recent runs, open the report artifact a run produced,
+  and list a duty's findings. Read-only: pulls overnight schedule output
+  into the terminal so your AI can answer "what did my duties find, and
+  what should I do about it?" without opening the web UI. See
+  `praxis duty --help`.
+
 ### Coming soon
 
 - **Incident operations** — open / query / attach evidence to
@@ -122,7 +129,7 @@ That's it. Open Claude Code (or Codex, or Gemini CLI) and try:
 
 ## Command surface
 
-The CLI ships **10 user-facing commands**. All AI-callable commands
+The CLI ships **11 user-facing commands**. All AI-callable commands
 accept `--json` (auto-emit when stdout is non-TTY) with stable JSON
 schemas. `login` requires a human at a browser; it still emits a
 JSON envelope so your AI host can see what got installed.
@@ -155,6 +162,16 @@ praxis agents [--json]
    agents from /ai-api/custom-agents, prefixed `praxis-`). Read-only,
    no network call.
 
+praxis duty <subcommand> [--agent <name|id>] [--json]
+   Query Agent Schedule ("duty") runs, findings, and the report
+   artifacts they produce. Read-only. --agent defaults to the global
+   "praxis" duty agent; <duty> args accept a schedule name or id.
+     list                          duties under the agent
+     runs --duty <d> [--limit N]   recent runs (newest first)
+     run <run_id>                  one run's detail
+     report <run_id>               the report artifact a run produced
+     findings <duty> [--status open|resolved|all] [--limit N]
+
 praxis refresh-skills [--project] [--json]
    Re-fetch this profile's catalog and rewrite skill files + MCP
    snapshot, without re-authenticating. Use when the org has