@algosuite/vo-mcp 0.2.0-beta.0 → 0.2.0-beta.10

package/dist/cli.js

@@ -15,500 +15,222 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
-// src/cloud/auth-token-source.ts
-var auth_token_source_exports = {};
-__export(auth_token_source_exports, {
-  FIREBASE_SECURETOKEN_URL: () => FIREBASE_SECURETOKEN_URL,
-  FIREBASE_TOKEN_REFERER: () => FIREBASE_TOKEN_REFERER,
-  createAuthTokenSourceFromEnv: () => createAuthTokenSourceFromEnv,
-  createFirebaseRefreshTokenSource: () => createFirebaseRefreshTokenSource,
-  createStaticTokenSource: () => createStaticTokenSource
+// ../vo-arch-defaults/src/schema/rule-v1.ts
+import { z } from "zod";
+function parseRule(input) {
+  return ArchitecturalDefaultRuleSchema.parse(input);
+}
+var EvidenceMatcherKind, EvidenceMatcher, ChangeType, AppliesWhen, Reference, IsoDate, RuleId, ArchitecturalDefaultRuleSchema;
+var init_rule_v1 = __esm({
+  "../vo-arch-defaults/src/schema/rule-v1.ts"() {
+    "use strict";
+    EvidenceMatcherKind = z.enum([
+      "regex",
+      "import-detector",
+      "package-json-field",
+      "file-size",
+      "ast-pattern",
+      "custom"
+    ]);
+    EvidenceMatcher = z.object({
+      kind: EvidenceMatcherKind,
+      pattern: z.string().optional(),
+      config: z.record(z.string(), z.unknown()).optional(),
+      description: z.string().min(1)
+    }).strict().refine(
+      (m) => m.kind !== "regex" || typeof m.pattern === "string" && m.pattern.length > 0,
+      { message: "regex matcher requires non-empty pattern" }
+    );
+    ChangeType = z.enum(["new-file", "edit", "delete", "rename", "any"]);
+    AppliesWhen = z.object({
+      stack: z.array(z.string().min(1)).optional(),
+      change_types: z.array(ChangeType).optional(),
+      file_globs: z.array(z.string().min(1)).optional(),
+      not_file_globs: z.array(z.string().min(1)).optional()
+    }).strict();
+    Reference = z.object({
+      type: z.enum(["framework-doc", "internal-doc", "pr", "incident", "external"]),
+      url: z.string().min(1),
+      description: z.string().min(1)
+    }).strict();
+    IsoDate = z.string().regex(/^\d{4}-\d{2}-\d{2}$/, "last_verified must be ISO date YYYY-MM-DD").refine((s) => {
+      const d = /* @__PURE__ */ new Date(s + "T00:00:00Z");
+      return !Number.isNaN(d.getTime()) && d.toISOString().startsWith(s);
+    }, "last_verified must be a real calendar date");
+    RuleId = z.string().regex(/^[a-z][a-z0-9-]*\/[a-z][a-z0-9-]*$/, {
+      message: "rule_id must be `<category>/<kebab-name>`"
+    });
+    ArchitecturalDefaultRuleSchema = z.object({
+      schema_version: z.literal(1),
+      rule_id: RuleId,
+      rule_version: z.number().int().positive(),
+      category: z.string().min(1),
+      severity: z.enum(["blocker", "warning", "info"]),
+      title: z.string().min(1),
+      rationale: z.string().min(1),
+      applies_when: AppliesWhen,
+      evidence_of_violation: z.array(EvidenceMatcher).min(1, {
+        message: "rule must declare at least one evidence matcher"
+      }),
+      remediation: z.string().min(1),
+      references: z.array(Reference),
+      last_verified: IsoDate,
+      tags: z.array(z.string().min(1))
+    }).strict();
+  }
 });
-function createStaticTokenSource(token, kind = "admin-token") {
-  const value = token.trim();
-  return { kind, getToken: async () => value.length > 0 ? value : null };
+
+// ../vo-arch-defaults/src/schema/override-v1.ts
+import { z as z2 } from "zod";
+function parseOverride(input) {
+  return TenantOverrideSchema.parse(input);
 }
-function createFirebaseRefreshTokenSource(opts) {
-  const refreshToken = opts.refreshToken.trim();
-  const apiKey = opts.apiKey.trim();
-  const now = opts.now ?? (() => Date.now());
-  const fetchFn = opts.fetchFn ?? globalThis.fetch;
-  let cachedToken = null;
-  let expiresAtMs = 0;
-  let inFlight = null;
-  async function refresh() {
-    try {
-      const res = await fetchFn(`${FIREBASE_SECURETOKEN_URL}?key=${encodeURIComponent(apiKey)}`, {
-        method: "POST",
-        headers: {
-          "content-type": "application/x-www-form-urlencoded",
-          referer: FIREBASE_TOKEN_REFERER
-        },
-        body: `grant_type=refresh_token&refresh_token=${encodeURIComponent(refreshToken)}`
-      });
-      const text = await res.text();
-      if (res.status < 200 || res.status >= 300) {
-        cachedToken = null;
-        return null;
-      }
-      const parsed = JSON.parse(text);
-      const idToken = typeof parsed.id_token === "string" ? parsed.id_token : "";
-      if (!idToken) {
-        cachedToken = null;
-        return null;
-      }
-      const expiresInSec = Number(parsed.expires_in);
-      const ttlMs = Number.isFinite(expiresInSec) && expiresInSec > 0 ? expiresInSec * 1e3 : 36e5;
-      cachedToken = idToken;
-      expiresAtMs = now() + ttlMs;
-      return idToken;
-    } catch {
-      cachedToken = null;
-      return null;
-    }
+var PartialRuleSchema, TenantOverrideSchema;
+var init_override_v1 = __esm({
+  "../vo-arch-defaults/src/schema/override-v1.ts"() {
+    "use strict";
+    init_rule_v1();
+    PartialRuleSchema = ArchitecturalDefaultRuleSchema.partial();
+    TenantOverrideSchema = z2.object({
+      schema_version: z2.literal(1),
+      suppressed_rule_ids: z2.array(z2.string().min(1)),
+      modified_rules: z2.record(z2.string().min(1), PartialRuleSchema),
+      added_rules: z2.array(ArchitecturalDefaultRuleSchema),
+      /**
+       * Per-tenant stack override (added 2026-05-24 — audit HIGH
+       * "DEFAULT_STACK hardcoded for Nexus repo"). When set, downstream
+       * consumers (vo-mcp KB pre-filter, vo-arch-check CLI) use this list
+       * instead of their built-in default. Lets external tenants whose
+       * repo isn't `firebase+react+pnpm` get useful KB rule matches by
+       * dropping a `~/.claude/vo-arch-defaults.local.json` with their own
+       * stack identifiers — no code change required.
+       *
+       * Open string union — values are not constrained beyond non-empty
+       * strings so out-of-tree tenants can declare their own
+       * (e.g. `vercel-edge`, `next-15`, `drizzle-postgres`).
+       *
+       * Optional. Undefined / omitted preserves pre-2026-05-24 behavior
+       * (consumer falls back to its hardcoded default stack).
+       */
+      tenant_stack: z2.array(z2.string().min(1)).optional()
+    }).strict();
   }
-  return {
-    kind: "firebase-refresh",
-    async getToken() {
-      if (cachedToken && now() < expiresAtMs - REFRESH_SKEW_MS) return cachedToken;
-      if (!inFlight) {
-        inFlight = refresh().finally(() => {
-          inFlight = null;
-        });
-      }
-      return inFlight;
-    }
-  };
+});
+
+// ../vo-arch-defaults/src/schema/index.ts
+var init_schema = __esm({
+  "../vo-arch-defaults/src/schema/index.ts"() {
+    "use strict";
+    init_rule_v1();
+    init_override_v1();
+  }
+});
+
+// ../vo-arch-defaults/src/storage/load-bundled.ts
+import { readdirSync, readFileSync, statSync, existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+function resolveBundledCorpusDir() {
+  const here = dirname(fileURLToPath(import.meta.url));
+  const candidates = [
+    join(here, "..", "corpus"),
+    // dist/corpus next to dist/storage
+    join(here, "..", "..", "corpus")
+    // src/corpus next to src/storage (under vitest)
+  ];
+  for (const c of candidates) {
+    if (existsSync(c) && statSync(c).isDirectory()) return c;
+  }
+  throw new Error(
+    `vo-arch-defaults: could not locate bundled corpus directory. Tried: ${candidates.join(", ")}`
+  );
 }
-function createAuthTokenSourceFromEnv(env = process.env, fetchFn, readStoredCred = () => null) {
-  const refreshToken = env["VO_USER_REFRESH_TOKEN"]?.trim();
-  const apiKey = env["VO_FIREBASE_API_KEY"]?.trim();
-  const idToken = env["VO_USER_ID_TOKEN"]?.trim();
-  const adminToken = env["VO_CONTROL_PLANE_ADMIN_TOKEN"]?.trim();
-  if (refreshToken || apiKey) {
-    if (!refreshToken || !apiKey) {
-      throw new Error(
-        "Per-user refresh auth requires BOTH VO_USER_REFRESH_TOKEN and VO_FIREBASE_API_KEY"
-      );
+function walkJson(dir, out) {
+  for (const entry of readdirSync(dir)) {
+    const full = join(dir, entry);
+    const st = statSync(full);
+    if (st.isDirectory()) {
+      walkJson(full, out);
+    } else if (entry.endsWith(".json")) {
+      out.push(full);
     }
-    return createFirebaseRefreshTokenSource({
-      refreshToken,
-      apiKey,
-      ...fetchFn ? { fetchFn } : {}
-    });
-  }
-  if (idToken) return createStaticTokenSource(idToken, "firebase-id-token");
-  const stored = readStoredCred();
-  if (stored?.vo_credential && stored.vo_credential.trim()) {
-    return createStaticTokenSource(stored.vo_credential.trim(), "vo-credential");
   }
-  if (stored && stored.refresh_token?.trim() && stored.api_key?.trim()) {
-    return createFirebaseRefreshTokenSource({
-      refreshToken: stored.refresh_token.trim(),
-      apiKey: stored.api_key.trim(),
-      ...fetchFn ? { fetchFn } : {}
-    });
+}
+function loadBundledCorpus(opts = {}) {
+  const dir = opts.corpusDir ?? resolveBundledCorpusDir();
+  const files = [];
+  walkJson(dir, files);
+  files.sort();
+  const rules = [];
+  const seenIds = /* @__PURE__ */ new Set();
+  for (const file of files) {
+    const raw = readFileSync(file, "utf8");
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch (err) {
+      const m = err instanceof Error ? err.message : String(err);
+      throw new Error(`vo-arch-defaults: invalid JSON in ${file}: ${m}`, { cause: err });
+    }
+    try {
+      const rule = parseRule(parsed);
+      if (seenIds.has(rule.rule_id)) {
+        throw new Error(
+          `vo-arch-defaults: duplicate rule_id '${rule.rule_id}' (second occurrence in ${file})`
+        );
+      }
+      seenIds.add(rule.rule_id);
+      rules.push(rule);
+    } catch (err) {
+      const m = err instanceof Error ? err.message : String(err);
+      throw new Error(`vo-arch-defaults: schema validation failed for ${file}: ${m}`, { cause: err });
+    }
   }
-  if (adminToken) return createStaticTokenSource(adminToken, "admin-token");
-  return null;
+  return { rules, source_paths: files };
 }
-var FIREBASE_SECURETOKEN_URL, FIREBASE_TOKEN_REFERER, REFRESH_SKEW_MS;
-var init_auth_token_source = __esm({
-  "src/cloud/auth-token-source.ts"() {
+var init_load_bundled = __esm({
+  "../vo-arch-defaults/src/storage/load-bundled.ts"() {
     "use strict";
-    FIREBASE_SECURETOKEN_URL = "https://securetoken.googleapis.com/v1/token";
-    FIREBASE_TOKEN_REFERER = "https://algosuite.ai/";
-    REFRESH_SKEW_MS = 6e4;
+    init_schema();
   }
 });
 
-// src/cloud/keychain.ts
-import { createRequire } from "node:module";
-function loadKeyring() {
-  if (cached !== void 0) return cached;
-  try {
-    const req = createRequire(import.meta.url);
-    const mod = req("@napi-rs/keyring");
-    cached = mod && typeof mod.Entry === "function" ? mod : null;
-  } catch {
-    cached = null;
-  }
-  return cached;
-}
-function keychainAvailable() {
-  return loadKeyring() !== null;
+// ../vo-arch-defaults/src/storage/load-override.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
+import { homedir } from "node:os";
+import { join as join2 } from "node:path";
+function defaultOverridePath() {
+  return join2(homedir(), ".claude", "vo-arch-defaults.local.json");
 }
-function keychainGet() {
-  const k = loadKeyring();
-  if (!k) return null;
-  try {
-    return new k.Entry(SERVICE, ACCOUNT).getPassword();
-  } catch {
-    return null;
+function loadTenantOverride(opts = {}) {
+  const path3 = opts.path ?? defaultOverridePath();
+  if (!existsSync2(path3)) {
+    return { override: null, source_path: null };
   }
-}
-function keychainSet(secret) {
-  const k = loadKeyring();
-  if (!k) return false;
+  const raw = readFileSync2(path3, "utf8");
+  let parsed;
   try {
-    new k.Entry(SERVICE, ACCOUNT).setPassword(secret);
-    return true;
-  } catch {
-    return false;
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    const m = err instanceof Error ? err.message : String(err);
+    throw new Error(`vo-arch-defaults: invalid JSON in override ${path3}: ${m}`, { cause: err });
   }
-}
-function keychainDelete() {
-  const k = loadKeyring();
-  if (!k) return false;
   try {
-    return new k.Entry(SERVICE, ACCOUNT).deletePassword();
-  } catch {
-    return false;
+    const override = parseOverride(parsed);
+    return { override, source_path: path3 };
+  } catch (err) {
+    const m = err instanceof Error ? err.message : String(err);
+    throw new Error(`vo-arch-defaults: override schema validation failed for ${path3}: ${m}`, { cause: err });
   }
 }
-var SERVICE, ACCOUNT, cached;
-var init_keychain = __esm({
-  "src/cloud/keychain.ts"() {
+var init_load_override = __esm({
+  "../vo-arch-defaults/src/storage/load-override.ts"() {
     "use strict";
-    SERVICE = "vo-mcp";
-    ACCOUNT = "refresh-credential";
+    init_schema();
   }
 });
 
-// src/cloud/credential-store.ts
-var credential_store_exports = {};
-__export(credential_store_exports, {
-  KEYCHAIN_LOCATION: () => KEYCHAIN_LOCATION,
-  credentialPath: () => credentialPath,
-  readStoredCredential: () => readStoredCredential,
-  writeStoredCredential: () => writeStoredCredential
-});
-import { homedir as homedir3 } from "node:os";
-import { join as join5, dirname as dirname4 } from "node:path";
-import {
-  existsSync as existsSync3,
-  mkdirSync as mkdirSync2,
-  readFileSync as readFileSync5,
-  writeFileSync as writeFileSync2,
-  chmodSync as chmodSync2,
-  rmSync
-} from "node:fs";
-function credentialPath(env = process.env) {
-  const override = env["VO_MCP_CREDENTIALS_PATH"]?.trim();
-  if (override) return override;
-  return join5(homedir3(), ".config", "vo-mcp", "credentials.json");
-}
-function keychainEnabled(env, keychain) {
-  const disabled = (env["VO_MCP_DISABLE_KEYCHAIN"] ?? "").trim().toLowerCase();
-  if (disabled === "1" || disabled === "true" || disabled === "yes") return false;
-  return keychain.available();
-}
-function deserialize(raw) {
-  try {
-    const parsed = JSON.parse(raw);
-    const refresh = typeof parsed.refresh_token === "string" ? parsed.refresh_token.trim() : "";
-    const apiKey = typeof parsed.api_key === "string" ? parsed.api_key.trim() : "";
-    const voCred = typeof parsed.vo_credential === "string" ? parsed.vo_credential.trim() : "";
-    if (!voCred && (!refresh || !apiKey)) return null;
-    return {
-      ...refresh ? { refresh_token: refresh } : {},
-      ...apiKey ? { api_key: apiKey } : {},
-      ...voCred ? { vo_credential: voCred } : {},
-      ...typeof parsed.vo_credential_expires_at === "string" ? { vo_credential_expires_at: parsed.vo_credential_expires_at } : {},
-      ...typeof parsed.email === "string" ? { email: parsed.email } : {},
-      ...typeof parsed.stored_at === "string" ? { stored_at: parsed.stored_at } : {}
-    };
-  } catch {
-    return null;
-  }
-}
-function readFromFile(env) {
-  try {
-    const p = credentialPath(env);
-    if (!existsSync3(p)) return null;
-    return deserialize(readFileSync5(p, "utf8"));
-  } catch {
-    return null;
-  }
-}
-function readStoredCredential(env = process.env, keychain = realKeychain) {
-  if (keychainEnabled(env, keychain)) {
-    const raw = keychain.get();
-    const fromKeychain = raw ? deserialize(raw) : null;
-    if (fromKeychain) return fromKeychain;
-  }
-  return readFromFile(env);
-}
-function deleteFile(env) {
-  try {
-    rmSync(credentialPath(env), { force: true });
-  } catch {
-  }
-}
-function writeToFile(payload, env) {
-  const p = credentialPath(env);
-  mkdirSync2(dirname4(p), { recursive: true });
-  writeFileSync2(p, `${JSON.stringify(payload, null, 2)}
-`, { mode: 384 });
-  try {
-    chmodSync2(p, 384);
-  } catch {
-  }
-  return p;
-}
-function writeStoredCredential(cred, storedAt, env = process.env, keychain = realKeychain) {
-  const payload = {
-    ...cred.refresh_token ? { refresh_token: cred.refresh_token } : {},
-    ...cred.api_key ? { api_key: cred.api_key } : {},
-    ...cred.vo_credential ? { vo_credential: cred.vo_credential } : {},
-    ...cred.vo_credential_expires_at ? { vo_credential_expires_at: cred.vo_credential_expires_at } : {},
-    ...cred.email ? { email: cred.email } : {},
-    stored_at: cred.stored_at ?? storedAt
-  };
-  if (keychainEnabled(env, keychain) && keychain.set(JSON.stringify(payload))) {
-    deleteFile(env);
-    return KEYCHAIN_LOCATION;
-  }
-  const p = writeToFile(payload, env);
-  if (keychainEnabled(env, keychain)) keychain.delete();
-  return p;
-}
-var realKeychain, KEYCHAIN_LOCATION;
-var init_credential_store = __esm({
-  "src/cloud/credential-store.ts"() {
-    "use strict";
-    init_keychain();
-    realKeychain = {
-      available: keychainAvailable,
-      get: keychainGet,
-      set: keychainSet,
-      delete: keychainDelete
-    };
-    KEYCHAIN_LOCATION = 'OS keychain (service "vo-mcp")';
-  }
-});
-
-// src/cli.ts
-import { homedir as homedir6, hostname } from "node:os";
-import { join as join8 } from "node:path";
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-
-// src/server.ts
-import { randomUUID as randomUUID2 } from "node:crypto";
-import { Server } from "@modelcontextprotocol/sdk/server/index.js";
-import {
-  CallToolRequestSchema,
-  ListToolsRequestSchema
-} from "@modelcontextprotocol/sdk/types.js";
-
-// src/tools/common.ts
-import { createHash as createHash2, randomUUID } from "node:crypto";
-import { readFileSync as readFileSync4 } from "node:fs";
-import { dirname as dirname3, join as join4 } from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
-import { McpError, ErrorCode } from "@modelcontextprotocol/sdk/types.js";
-
-// src/logging/events-writer.ts
-import {
-  appendFileSync,
-  chmodSync,
-  mkdirSync,
-  readdirSync as readdirSync2,
-  readFileSync as readFileSync3,
-  statSync as statSync2,
-  unlinkSync,
-  writeFileSync
-} from "node:fs";
-import { homedir as homedir2 } from "node:os";
-import { basename, dirname as dirname2, join as join3 } from "node:path";
-import { gzipSync } from "node:zlib";
-
-// ../vo-arch-defaults/src/schema/rule-v1.ts
-import { z } from "zod";
-var EvidenceMatcherKind = z.enum([
-  "regex",
-  "import-detector",
-  "package-json-field",
-  "file-size",
-  "ast-pattern",
-  "custom"
-]);
-var EvidenceMatcher = z.object({
-  kind: EvidenceMatcherKind,
-  pattern: z.string().optional(),
-  config: z.record(z.string(), z.unknown()).optional(),
-  description: z.string().min(1)
-}).strict().refine(
-  (m) => m.kind !== "regex" || typeof m.pattern === "string" && m.pattern.length > 0,
-  { message: "regex matcher requires non-empty pattern" }
-);
-var ChangeType = z.enum(["new-file", "edit", "delete", "rename", "any"]);
-var AppliesWhen = z.object({
-  stack: z.array(z.string().min(1)).optional(),
-  change_types: z.array(ChangeType).optional(),
-  file_globs: z.array(z.string().min(1)).optional(),
-  not_file_globs: z.array(z.string().min(1)).optional()
-}).strict();
-var Reference = z.object({
-  type: z.enum(["framework-doc", "internal-doc", "pr", "incident", "external"]),
-  url: z.string().min(1),
-  description: z.string().min(1)
-}).strict();
-var IsoDate = z.string().regex(/^\d{4}-\d{2}-\d{2}$/, "last_verified must be ISO date YYYY-MM-DD").refine((s) => {
-  const d = /* @__PURE__ */ new Date(s + "T00:00:00Z");
-  return !Number.isNaN(d.getTime()) && d.toISOString().startsWith(s);
-}, "last_verified must be a real calendar date");
-var RuleId = z.string().regex(/^[a-z][a-z0-9-]*\/[a-z][a-z0-9-]*$/, {
-  message: "rule_id must be `<category>/<kebab-name>`"
-});
-var ArchitecturalDefaultRuleSchema = z.object({
-  schema_version: z.literal(1),
-  rule_id: RuleId,
-  rule_version: z.number().int().positive(),
-  category: z.string().min(1),
-  severity: z.enum(["blocker", "warning", "info"]),
-  title: z.string().min(1),
-  rationale: z.string().min(1),
-  applies_when: AppliesWhen,
-  evidence_of_violation: z.array(EvidenceMatcher).min(1, {
-    message: "rule must declare at least one evidence matcher"
-  }),
-  remediation: z.string().min(1),
-  references: z.array(Reference),
-  last_verified: IsoDate,
-  tags: z.array(z.string().min(1))
-}).strict();
-function parseRule(input) {
-  return ArchitecturalDefaultRuleSchema.parse(input);
-}
-
-// ../vo-arch-defaults/src/schema/override-v1.ts
-import { z as z2 } from "zod";
-var PartialRuleSchema = ArchitecturalDefaultRuleSchema.partial();
-var TenantOverrideSchema = z2.object({
-  schema_version: z2.literal(1),
-  suppressed_rule_ids: z2.array(z2.string().min(1)),
-  modified_rules: z2.record(z2.string().min(1), PartialRuleSchema),
-  added_rules: z2.array(ArchitecturalDefaultRuleSchema),
-  /**
-   * Per-tenant stack override (added 2026-05-24 — audit HIGH
-   * "DEFAULT_STACK hardcoded for Nexus repo"). When set, downstream
-   * consumers (vo-mcp KB pre-filter, vo-arch-check CLI) use this list
-   * instead of their built-in default. Lets external tenants whose
-   * repo isn't `firebase+react+pnpm` get useful KB rule matches by
-   * dropping a `~/.claude/vo-arch-defaults.local.json` with their own
-   * stack identifiers — no code change required.
-   *
-   * Open string union — values are not constrained beyond non-empty
-   * strings so out-of-tree tenants can declare their own
-   * (e.g. `vercel-edge`, `next-15`, `drizzle-postgres`).
-   *
-   * Optional. Undefined / omitted preserves pre-2026-05-24 behavior
-   * (consumer falls back to its hardcoded default stack).
-   */
-  tenant_stack: z2.array(z2.string().min(1)).optional()
-}).strict();
-function parseOverride(input) {
-  return TenantOverrideSchema.parse(input);
-}
-
-// ../vo-arch-defaults/src/storage/load-bundled.ts
-import { readdirSync, readFileSync, statSync, existsSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
-function resolveBundledCorpusDir() {
-  const here = dirname(fileURLToPath(import.meta.url));
-  const candidates = [
-    join(here, "..", "corpus"),
-    // dist/corpus next to dist/storage
-    join(here, "..", "..", "corpus")
-    // src/corpus next to src/storage (under vitest)
-  ];
-  for (const c of candidates) {
-    if (existsSync(c) && statSync(c).isDirectory()) return c;
-  }
-  throw new Error(
-    `vo-arch-defaults: could not locate bundled corpus directory. Tried: ${candidates.join(", ")}`
-  );
-}
-function walkJson(dir, out) {
-  for (const entry of readdirSync(dir)) {
-    const full = join(dir, entry);
-    const st = statSync(full);
-    if (st.isDirectory()) {
-      walkJson(full, out);
-    } else if (entry.endsWith(".json")) {
-      out.push(full);
-    }
-  }
-}
-function loadBundledCorpus(opts = {}) {
-  const dir = opts.corpusDir ?? resolveBundledCorpusDir();
-  const files = [];
-  walkJson(dir, files);
-  files.sort();
-  const rules = [];
-  const seenIds = /* @__PURE__ */ new Set();
-  for (const file of files) {
-    const raw = readFileSync(file, "utf8");
-    let parsed;
-    try {
-      parsed = JSON.parse(raw);
-    } catch (err) {
-      const m = err instanceof Error ? err.message : String(err);
-      throw new Error(`vo-arch-defaults: invalid JSON in ${file}: ${m}`, { cause: err });
-    }
-    try {
-      const rule = parseRule(parsed);
-      if (seenIds.has(rule.rule_id)) {
-        throw new Error(
-          `vo-arch-defaults: duplicate rule_id '${rule.rule_id}' (second occurrence in ${file})`
-        );
-      }
-      seenIds.add(rule.rule_id);
-      rules.push(rule);
-    } catch (err) {
-      const m = err instanceof Error ? err.message : String(err);
-      throw new Error(`vo-arch-defaults: schema validation failed for ${file}: ${m}`, { cause: err });
-    }
-  }
-  return { rules, source_paths: files };
-}
-
-// ../vo-arch-defaults/src/storage/load-override.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
-import { homedir } from "node:os";
-import { join as join2 } from "node:path";
-function defaultOverridePath() {
-  return join2(homedir(), ".claude", "vo-arch-defaults.local.json");
-}
-function loadTenantOverride(opts = {}) {
-  const path3 = opts.path ?? defaultOverridePath();
-  if (!existsSync2(path3)) {
-    return { override: null, source_path: null };
-  }
-  const raw = readFileSync2(path3, "utf8");
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch (err) {
-    const m = err instanceof Error ? err.message : String(err);
-    throw new Error(`vo-arch-defaults: invalid JSON in override ${path3}: ${m}`, { cause: err });
-  }
-  try {
-    const override = parseOverride(parsed);
-    return { override, source_path: path3 };
-  } catch (err) {
-    const m = err instanceof Error ? err.message : String(err);
-    throw new Error(`vo-arch-defaults: override schema validation failed for ${path3}: ${m}`, { cause: err });
-  }
-}
-
 // ../vo-arch-defaults/src/storage/merge.ts
-var IMMUTABLE_FIELDS = [
-  "schema_version",
-  "rule_id"
-];
 function applyModification(base, patch) {
   const cleanPatch = { ...patch };
   for (const k of IMMUTABLE_FIELDS) {
@@ -560,6 +282,16 @@ function mergeCorpusWithOverride(bundled, override) {
     added_count: addedCount
   };
 }
+var IMMUTABLE_FIELDS;
+var init_merge = __esm({
+  "../vo-arch-defaults/src/storage/merge.ts"() {
+    "use strict";
+    IMMUTABLE_FIELDS = [
+      "schema_version",
+      "rule_id"
+    ];
+  }
+});
 
 // ../vo-arch-defaults/src/query/applies-to-stack.ts
 function appliesToStack(rule, stacks) {
@@ -572,6 +304,11 @@ function appliesToStack(rule, stacks) {
   }
   return false;
 }
+var init_applies_to_stack = __esm({
+  "../vo-arch-defaults/src/query/applies-to-stack.ts"() {
+    "use strict";
+  }
+});
 
 // ../vo-arch-defaults/src/query/applies-to-change.ts
 function appliesToChangeType(rule, changeType) {
@@ -581,9 +318,13 @@ function appliesToChangeType(rule, changeType) {
   if (changeType === "any") return true;
   return required.includes(changeType);
 }
+var init_applies_to_change = __esm({
+  "../vo-arch-defaults/src/query/applies-to-change.ts"() {
+    "use strict";
+  }
+});
 
 // ../vo-arch-defaults/src/query/glob.ts
-var REGEX_META = /[.+^${}()|[\]\\]/g;
 function globToRegExp(glob) {
   let out = "";
   let i = 0;
@@ -636,6 +377,13 @@ function matchesAnyGlob(path3, globs) {
   }
   return false;
 }
+var REGEX_META;
+var init_glob = __esm({
+  "../vo-arch-defaults/src/query/glob.ts"() {
+    "use strict";
+    REGEX_META = /[.+^${}()|[\]\\]/g;
+  }
+});
 
 // ../vo-arch-defaults/src/query/applies-to-files.ts
 function appliesToFiles(rule, filePaths) {
@@ -656,8 +404,14 @@ function appliesToFiles(rule, filePaths) {
   }
   return false;
 }
-
-// ../vo-arch-defaults/src/analyze/diff-parser.ts
+var init_applies_to_files = __esm({
+  "../vo-arch-defaults/src/query/applies-to-files.ts"() {
+    "use strict";
+    init_glob();
+  }
+});
+
+// ../vo-arch-defaults/src/analyze/diff-parser.ts
 function stripPathPrefix(p) {
   if (p.startsWith("a/") || p.startsWith("b/")) return p.slice(2);
   return p;
@@ -727,9 +481,13 @@ function parseUnifiedDiff(text) {
   }
   return { files };
 }
+var init_diff_parser = __esm({
+  "../vo-arch-defaults/src/analyze/diff-parser.ts"() {
+    "use strict";
+  }
+});
 
 // ../vo-arch-defaults/src/analyze/evidence-matchers/regex-matcher.ts
-var MAX_EXCERPT = 200;
 function sanitizeLine(s) {
   let out = s.replace(/^\s+/, "");
   if (out.length > MAX_EXCERPT) out = out.slice(0, MAX_EXCERPT) + "\u2026";
@@ -757,12 +515,15 @@ function runRegexMatcher(matcher, file) {
   }
   return hits;
 }
+var MAX_EXCERPT;
+var init_regex_matcher = __esm({
+  "../vo-arch-defaults/src/analyze/evidence-matchers/regex-matcher.ts"() {
+    "use strict";
+    MAX_EXCERPT = 200;
+  }
+});
 
 // ../vo-arch-defaults/src/analyze/evidence-matchers/import-detector.ts
-var STATIC_IMPORT = /import\s+(?:[^'"\n]{0,200}?from\s+)?(['"])([^'"]+)\1/;
-var DYNAMIC_IMPORT = /import\(\s*(['"])([^'"]+)\1\s*\)/;
-var REQUIRE_CALL = /require\(\s*(['"])([^'"]+)\1\s*\)/;
-var MAX_EXCERPT2 = 200;
 function sanitize(s) {
   let out = s.replace(/^\s+/, "");
   if (out.length > MAX_EXCERPT2) out = out.slice(0, MAX_EXCERPT2) + "\u2026";
@@ -807,6 +568,16 @@ function runImportDetector(matcher, file) {
   }
   return hits;
 }
+var STATIC_IMPORT, DYNAMIC_IMPORT, REQUIRE_CALL, MAX_EXCERPT2;
+var init_import_detector = __esm({
+  "../vo-arch-defaults/src/analyze/evidence-matchers/import-detector.ts"() {
+    "use strict";
+    STATIC_IMPORT = /import\s+(?:[^'"\n]{0,200}?from\s+)?(['"])([^'"]+)\1/;
+    DYNAMIC_IMPORT = /import\(\s*(['"])([^'"]+)\1\s*\)/;
+    REQUIRE_CALL = /require\(\s*(['"])([^'"]+)\1\s*\)/;
+    MAX_EXCERPT2 = 200;
+  }
+});
 
 // ../vo-arch-defaults/src/analyze/evidence-matchers/file-size.ts
 function runFileSizeMatcher(matcher, file) {
@@ -827,6 +598,11 @@ function runFileSizeMatcher(matcher, file) {
     }
   ];
 }
+var init_file_size = __esm({
+  "../vo-arch-defaults/src/analyze/evidence-matchers/file-size.ts"() {
+    "use strict";
+  }
+});
 
 // ../vo-arch-defaults/src/analyze/evidence-matchers/package-json.ts
 function valueMatches(value, cfg) {
@@ -867,6 +643,11 @@ function runPackageJsonMatcher(matcher, file) {
   }
   return hits;
 }
+var init_package_json = __esm({
+  "../vo-arch-defaults/src/analyze/evidence-matchers/package-json.ts"() {
+    "use strict";
+  }
+});
 
 // ../vo-arch-defaults/src/analyze/evidence-matchers/index.ts
 function runEvidenceMatcher(matcher, file) {
@@ -886,9 +667,17 @@ function runEvidenceMatcher(matcher, file) {
       return [];
   }
 }
+var init_evidence_matchers = __esm({
+  "../vo-arch-defaults/src/analyze/evidence-matchers/index.ts"() {
+    "use strict";
+    init_regex_matcher();
+    init_import_detector();
+    init_file_size();
+    init_package_json();
+  }
+});
 
 // ../vo-arch-defaults/src/query/staleness.ts
-var DEFAULT_STALENESS_THRESHOLD_DAYS = 365;
 function computeStaleRules(rules, opts = {}) {
   const threshold = opts.thresholdDays ?? DEFAULT_STALENESS_THRESHOLD_DAYS;
   if (!Number.isFinite(threshold)) return [];
@@ -912,6 +701,13 @@ function computeStaleRules(rules, opts = {}) {
   out.sort((a, b) => b.days_stale - a.days_stale);
   return out;
 }
+var DEFAULT_STALENESS_THRESHOLD_DAYS;
+var init_staleness = __esm({
+  "../vo-arch-defaults/src/query/staleness.ts"() {
+    "use strict";
+    DEFAULT_STALENESS_THRESHOLD_DAYS = 365;
+  }
+});
 
 // ../vo-arch-defaults/src/query/run-query.ts
 function findApplicableRules(input, opts = {}) {
@@ -970,9 +766,28 @@ function findApplicableRules(input, opts = {}) {
     stale_rules
   };
 }
+var init_run_query = __esm({
+  "../vo-arch-defaults/src/query/run-query.ts"() {
+    "use strict";
+    init_load_bundled();
+    init_load_override();
+    init_merge();
+    init_applies_to_stack();
+    init_applies_to_change();
+    init_applies_to_files();
+    init_diff_parser();
+    init_evidence_matchers();
+    init_staleness();
+  }
+});
 
 // ../vo-arch-defaults/src/query/corpus-version.ts
 import { createHash } from "node:crypto";
+var init_corpus_version = __esm({
+  "../vo-arch-defaults/src/query/corpus-version.ts"() {
+    "use strict";
+  }
+});
 
 // ../vo-arch-defaults/src/query/resolve-stack.ts
 function resolveStack(override, fallback) {
@@ -981,9 +796,13 @@ function resolveStack(override, fallback) {
   }
   return fallback;
 }
+var init_resolve_stack = __esm({
+  "../vo-arch-defaults/src/query/resolve-stack.ts"() {
+    "use strict";
+  }
+});
 
 // ../vo-arch-defaults/src/pii-sanitize.ts
-var SANITIZE_DEFAULT_MAX_LEN = 200;
 function sanitizeExcerpt(raw, maxLen = SANITIZE_DEFAULT_MAX_LEN) {
   let s = raw;
   s = s.replace(/eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{5,}/g, "[REDACTED_JWT]");
@@ -999,10 +818,49 @@ function sanitizeExcerpt(raw, maxLen = SANITIZE_DEFAULT_MAX_LEN) {
   if (s.length > maxLen) s = s.slice(0, maxLen) + "\u2026";
   return s;
 }
+var SANITIZE_DEFAULT_MAX_LEN;
+var init_pii_sanitize = __esm({
+  "../vo-arch-defaults/src/pii-sanitize.ts"() {
+    "use strict";
+    SANITIZE_DEFAULT_MAX_LEN = 200;
+  }
+});
+
+// ../vo-arch-defaults/src/index.ts
+var init_src = __esm({
+  "../vo-arch-defaults/src/index.ts"() {
+    init_schema();
+    init_load_bundled();
+    init_load_override();
+    init_merge();
+    init_applies_to_stack();
+    init_applies_to_change();
+    init_applies_to_files();
+    init_run_query();
+    init_glob();
+    init_corpus_version();
+    init_resolve_stack();
+    init_staleness();
+    init_diff_parser();
+    init_evidence_matchers();
+    init_pii_sanitize();
+  }
+});
 
 // src/logging/events-writer.ts
-var DEFAULT_EVENTS_MAX_BYTES = 50 * 1024 * 1024;
-var DEFAULT_EVENTS_KEEP_ROTATED = 10;
+import {
+  appendFileSync,
+  chmodSync,
+  mkdirSync,
+  readdirSync as readdirSync2,
+  readFileSync as readFileSync3,
+  statSync as statSync2,
+  unlinkSync,
+  writeFileSync
+} from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import { basename, dirname as dirname2, join as join3 } from "node:path";
+import { gzipSync } from "node:zlib";
 function defaultEventsPath() {
   const envPath = process.env["VO_MCP_EVENTS_PATH"];
   if (envPath && envPath.length > 0) return envPath;
@@ -1094,121 +952,684 @@ function createFileEventsWriter(opts = {}) {
         }
         throw err;
       }
-      if (!permsApplied) {
-        try {
-          chmodSync(filePath, 384);
-        } catch {
-        }
-        permsApplied = true;
+      if (!permsApplied) {
+        try {
+          chmodSync(filePath, 384);
+        } catch {
+        }
+        permsApplied = true;
+      }
+    },
+    path() {
+      return filePath;
+    },
+    close() {
+    }
+  };
+}
+var DEFAULT_EVENTS_MAX_BYTES, DEFAULT_EVENTS_KEEP_ROTATED;
+var init_events_writer = __esm({
+  "src/logging/events-writer.ts"() {
+    "use strict";
+    init_src();
+    DEFAULT_EVENTS_MAX_BYTES = 50 * 1024 * 1024;
+    DEFAULT_EVENTS_KEEP_ROTATED = 10;
+  }
+});
+
+// src/tools/common.ts
+import { createHash as createHash2, randomUUID } from "node:crypto";
+import { readFileSync as readFileSync4 } from "node:fs";
+import { dirname as dirname3, join as join4 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { McpError, ErrorCode } from "@modelcontextprotocol/sdk/types.js";
+function readVoMcpVersion() {
+  try {
+    const here = dirname3(fileURLToPath2(import.meta.url));
+    for (const rel of ["..", ["..", ".."], ["..", "..", ".."]]) {
+      try {
+        const segs = Array.isArray(rel) ? rel : [rel];
+        const pkg = JSON.parse(readFileSync4(join4(here, ...segs, "package.json"), "utf8"));
+        if (pkg.name === "@algosuite/vo-mcp" && typeof pkg.version === "string") return pkg.version;
+      } catch {
+      }
+    }
+    return "0.0.0-unknown";
+  } catch {
+    return "0.0.0-unknown";
+  }
+}
+function bytesOf(s) {
+  return Buffer.byteLength(s, "utf8");
+}
+function sha256Hex(s) {
+  return createHash2("sha256").update(s, "utf8").digest("hex");
+}
+function invalidParams(toolName, message) {
+  return new McpError(ErrorCode.InvalidParams, `${toolName}: ${message}`);
+}
+function methodNotFound(toolName, knownTools) {
+  return new McpError(
+    ErrorCode.MethodNotFound,
+    `Unknown tool: ${toolName}. Registered tools: ${knownTools.join(", ")}`
+  );
+}
+function assertWithinByteCap(toolName, fieldName, value, maxBytes) {
+  const bytes = Buffer.byteLength(value, "utf8");
+  if (bytes > maxBytes) {
+    throw invalidParams(
+      toolName,
+      `input field '${fieldName}' exceeds ${maxBytes}-byte cap (got ${bytes} bytes). Trim the input or split across multiple calls.`
+    );
+  }
+}
+function buildBaseEvent(args) {
+  return {
+    schema_version: 1,
+    event_id: args.eventId ?? randomUUID(),
+    ts: args.now.toISOString(),
+    tenant_id: args.session.tenantId,
+    operator_id: args.session.operatorId,
+    session_id: args.session.sessionId,
+    client_id: args.session.clientId,
+    mode: args.session.mode,
+    tool: args.tool,
+    gate_type: args.gateType,
+    input_hash: args.inputHash,
+    input_excerpt: sanitizeExcerpt(args.inputExcerpt),
+    input_size_bytes: args.inputSizeBytes,
+    per_model_verdicts: [],
+    synthesized_verdict: null,
+    consensus_confidence: null,
+    per_model_tokens_in: null,
+    per_model_tokens_out: null,
+    total_cost_usd: null,
+    duration_ms: null,
+    dev_override: null,
+    downstream_outcome: null,
+    vo_mcp_version: VO_MCP_VERSION,
+    consensus_engine_version: null,
+    cache_hit: false
+  };
+}
+function jsonContent(value) {
+  return {
+    content: [{ type: "text", text: JSON.stringify(value, null, 2) }]
+  };
+}
+function toEventPerModelVerdicts(src) {
+  return src.map((v) => {
+    const sanitizedExcerpt = sanitizeExcerpt(v.raw_response_excerpt);
+    return {
+      model: v.model,
+      model_id: v.model,
+      provider: v.provider,
+      verdict: v.verdict,
+      confidence: v.confidence,
+      duration_ms: v.duration_ms,
+      raw_response_excerpt: sanitizedExcerpt,
+      // Hash over the sanitized excerpt — engine doesn't yet thread the full
+      // raw response. Documented limitation on `raw_response_hash` in types.ts.
+      raw_response_hash: sha256Hex(v.raw_response_excerpt),
+      reasoning_summary: typeof v.reasoning_excerpt === "string" && v.reasoning_excerpt.length > 0 ? sanitizeExcerpt(v.reasoning_excerpt, 500) : null,
+      // Engine doesn't yet emit cited_sources; ship empty array so cloud
+      // ingestion doesn't NPE on `Array.isArray()` checks.
+      cited_sources: [],
+      error: v.error ?? null
+    };
+  });
+}
+function toEventSynthesizedVerdict(src) {
+  return {
+    verdict: src.verdict,
+    confidence: src.confidence,
+    reasoning_excerpt: sanitizeExcerpt(src.reasoning_excerpt)
+  };
+}
+var VO_MCP_VERSION;
+var init_common = __esm({
+  "src/tools/common.ts"() {
+    "use strict";
+    init_events_writer();
+    VO_MCP_VERSION = readVoMcpVersion();
+  }
+});
+
+// src/cloud/auth-token-source.ts
+var auth_token_source_exports = {};
+__export(auth_token_source_exports, {
+  FIREBASE_SECURETOKEN_URL: () => FIREBASE_SECURETOKEN_URL,
+  FIREBASE_TOKEN_REFERER: () => FIREBASE_TOKEN_REFERER,
+  createAuthTokenSourceFromEnv: () => createAuthTokenSourceFromEnv,
+  createFirebaseRefreshTokenSource: () => createFirebaseRefreshTokenSource,
+  createStaticTokenSource: () => createStaticTokenSource
+});
+function createStaticTokenSource(token, kind = "admin-token") {
+  const value = token.trim();
+  return { kind, getToken: async () => value.length > 0 ? value : null };
+}
+function createFirebaseRefreshTokenSource(opts) {
+  const refreshToken = opts.refreshToken.trim();
+  const apiKey = opts.apiKey.trim();
+  const now = opts.now ?? (() => Date.now());
+  const fetchFn = opts.fetchFn ?? globalThis.fetch;
+  let cachedToken = null;
+  let expiresAtMs = 0;
+  let inFlight = null;
+  async function refresh() {
+    try {
+      const res = await fetchFn(`${FIREBASE_SECURETOKEN_URL}?key=${encodeURIComponent(apiKey)}`, {
+        method: "POST",
+        headers: {
+          "content-type": "application/x-www-form-urlencoded",
+          referer: FIREBASE_TOKEN_REFERER
+        },
+        body: `grant_type=refresh_token&refresh_token=${encodeURIComponent(refreshToken)}`
+      });
+      const text = await res.text();
+      if (res.status < 200 || res.status >= 300) {
+        cachedToken = null;
+        return null;
+      }
+      const parsed = JSON.parse(text);
+      const idToken = typeof parsed.id_token === "string" ? parsed.id_token : "";
+      if (!idToken) {
+        cachedToken = null;
+        return null;
+      }
+      const expiresInSec = Number(parsed.expires_in);
+      const ttlMs = Number.isFinite(expiresInSec) && expiresInSec > 0 ? expiresInSec * 1e3 : 36e5;
+      cachedToken = idToken;
+      expiresAtMs = now() + ttlMs;
+      return idToken;
+    } catch {
+      cachedToken = null;
+      return null;
+    }
+  }
+  return {
+    kind: "firebase-refresh",
+    async getToken() {
+      if (cachedToken && now() < expiresAtMs - REFRESH_SKEW_MS) return cachedToken;
+      if (!inFlight) {
+        inFlight = refresh().finally(() => {
+          inFlight = null;
+        });
+      }
+      return inFlight;
+    }
+  };
+}
+function createAuthTokenSourceFromEnv(env = process.env, fetchFn, readStoredCred = () => null) {
+  const refreshToken = env["VO_USER_REFRESH_TOKEN"]?.trim();
+  const apiKey = env["VO_FIREBASE_API_KEY"]?.trim();
+  const idToken = env["VO_USER_ID_TOKEN"]?.trim();
+  const adminToken = env["VO_CONTROL_PLANE_ADMIN_TOKEN"]?.trim();
+  if (refreshToken || apiKey) {
+    if (!refreshToken || !apiKey) {
+      throw new Error(
+        "Per-user refresh auth requires BOTH VO_USER_REFRESH_TOKEN and VO_FIREBASE_API_KEY"
+      );
+    }
+    return createFirebaseRefreshTokenSource({
+      refreshToken,
+      apiKey,
+      ...fetchFn ? { fetchFn } : {}
+    });
+  }
+  if (idToken) return createStaticTokenSource(idToken, "firebase-id-token");
+  const stored = readStoredCred();
+  if (stored?.vo_credential && stored.vo_credential.trim()) {
+    return createStaticTokenSource(stored.vo_credential.trim(), "vo-credential");
+  }
+  if (stored && stored.refresh_token?.trim() && stored.api_key?.trim()) {
+    return createFirebaseRefreshTokenSource({
+      refreshToken: stored.refresh_token.trim(),
+      apiKey: stored.api_key.trim(),
+      ...fetchFn ? { fetchFn } : {}
+    });
+  }
+  if (adminToken) return createStaticTokenSource(adminToken, "admin-token");
+  return null;
+}
+var FIREBASE_SECURETOKEN_URL, FIREBASE_TOKEN_REFERER, REFRESH_SKEW_MS;
+var init_auth_token_source = __esm({
+  "src/cloud/auth-token-source.ts"() {
+    "use strict";
+    FIREBASE_SECURETOKEN_URL = "https://securetoken.googleapis.com/v1/token";
+    FIREBASE_TOKEN_REFERER = "https://algosuite.ai/";
+    REFRESH_SKEW_MS = 6e4;
+  }
+});
+
+// src/cloud/keychain.ts
+import { createRequire } from "node:module";
+function loadKeyring() {
+  if (cached !== void 0) return cached;
+  try {
+    const req = createRequire(import.meta.url);
+    const mod = req("@napi-rs/keyring");
+    cached = mod && typeof mod.Entry === "function" ? mod : null;
+  } catch {
+    cached = null;
+  }
+  return cached;
+}
+function keychainAvailable() {
+  return loadKeyring() !== null;
+}
+function keychainGet() {
+  const k = loadKeyring();
+  if (!k) return null;
+  try {
+    return new k.Entry(SERVICE, ACCOUNT).getPassword();
+  } catch {
+    return null;
+  }
+}
+function keychainSet(secret) {
+  const k = loadKeyring();
+  if (!k) return false;
+  try {
+    new k.Entry(SERVICE, ACCOUNT).setPassword(secret);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function keychainDelete() {
+  const k = loadKeyring();
+  if (!k) return false;
+  try {
+    return new k.Entry(SERVICE, ACCOUNT).deletePassword();
+  } catch {
+    return false;
+  }
+}
+var SERVICE, ACCOUNT, cached;
+var init_keychain = __esm({
+  "src/cloud/keychain.ts"() {
+    "use strict";
+    SERVICE = "vo-mcp";
+    ACCOUNT = "refresh-credential";
+  }
+});
+
+// src/cloud/credential-store.ts
+var credential_store_exports = {};
+__export(credential_store_exports, {
+  KEYCHAIN_LOCATION: () => KEYCHAIN_LOCATION,
+  credentialPath: () => credentialPath,
+  readStoredCredential: () => readStoredCredential,
+  writeStoredCredential: () => writeStoredCredential
+});
+import { homedir as homedir3 } from "node:os";
+import { join as join5, dirname as dirname4 } from "node:path";
+import {
+  existsSync as existsSync3,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync5,
+  writeFileSync as writeFileSync2,
+  chmodSync as chmodSync2,
+  rmSync
+} from "node:fs";
+function credentialPath(env = process.env) {
+  const override = env["VO_MCP_CREDENTIALS_PATH"]?.trim();
+  if (override) return override;
+  return join5(homedir3(), ".config", "vo-mcp", "credentials.json");
+}
+function keychainEnabled(env, keychain) {
+  const disabled = (env["VO_MCP_DISABLE_KEYCHAIN"] ?? "").trim().toLowerCase();
+  if (disabled === "1" || disabled === "true" || disabled === "yes") return false;
+  return keychain.available();
+}
+function deserialize(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    const refresh = typeof parsed.refresh_token === "string" ? parsed.refresh_token.trim() : "";
+    const apiKey = typeof parsed.api_key === "string" ? parsed.api_key.trim() : "";
+    const voCred = typeof parsed.vo_credential === "string" ? parsed.vo_credential.trim() : "";
+    if (!voCred && (!refresh || !apiKey)) return null;
+    return {
+      ...refresh ? { refresh_token: refresh } : {},
+      ...apiKey ? { api_key: apiKey } : {},
+      ...voCred ? { vo_credential: voCred } : {},
+      ...typeof parsed.vo_credential_expires_at === "string" ? { vo_credential_expires_at: parsed.vo_credential_expires_at } : {},
+      ...typeof parsed.email === "string" ? { email: parsed.email } : {},
+      ...typeof parsed.stored_at === "string" ? { stored_at: parsed.stored_at } : {}
+    };
+  } catch {
+    return null;
+  }
+}
+function readFromFile(env) {
+  try {
+    const p = credentialPath(env);
+    if (!existsSync3(p)) return null;
+    return deserialize(readFileSync5(p, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function readStoredCredential(env = process.env, keychain = realKeychain) {
+  if (keychainEnabled(env, keychain)) {
+    const raw = keychain.get();
+    const fromKeychain = raw ? deserialize(raw) : null;
+    if (fromKeychain) return fromKeychain;
+  }
+  return readFromFile(env);
+}
+function deleteFile(env) {
+  try {
+    rmSync(credentialPath(env), { force: true });
+  } catch {
+  }
+}
+function writeToFile(payload, env) {
+  const p = credentialPath(env);
+  mkdirSync2(dirname4(p), { recursive: true });
+  writeFileSync2(p, `${JSON.stringify(payload, null, 2)}
+`, { mode: 384 });
+  try {
+    chmodSync2(p, 384);
+  } catch {
+  }
+  return p;
+}
+function writeStoredCredential(cred, storedAt, env = process.env, keychain = realKeychain) {
+  const payload = {
+    ...cred.refresh_token ? { refresh_token: cred.refresh_token } : {},
+    ...cred.api_key ? { api_key: cred.api_key } : {},
+    ...cred.vo_credential ? { vo_credential: cred.vo_credential } : {},
+    ...cred.vo_credential_expires_at ? { vo_credential_expires_at: cred.vo_credential_expires_at } : {},
+    ...cred.email ? { email: cred.email } : {},
+    stored_at: cred.stored_at ?? storedAt
+  };
+  if (keychainEnabled(env, keychain) && keychain.set(JSON.stringify(payload))) {
+    deleteFile(env);
+    return KEYCHAIN_LOCATION;
+  }
+  const p = writeToFile(payload, env);
+  if (keychainEnabled(env, keychain)) keychain.delete();
+  return p;
+}
+var realKeychain, KEYCHAIN_LOCATION;
+var init_credential_store = __esm({
+  "src/cloud/credential-store.ts"() {
+    "use strict";
+    init_keychain();
+    realKeychain = {
+      available: keychainAvailable,
+      get: keychainGet,
+      set: keychainSet,
+      delete: keychainDelete
+    };
+    KEYCHAIN_LOCATION = 'OS keychain (service "vo-mcp")';
+  }
+});
+
+// src/tools/memory/safe-memory-file.ts
+import { resolve, sep } from "node:path";
+function isSafeMemoryFileName(fileName) {
+  return fileName.length <= 200 && fileName.trim() === fileName && !fileName.includes("/") && !fileName.includes("\\") && !fileName.includes(":") && SAFE_MEMORY_FILE_RE.test(fileName);
+}
+function resolveMemoryFilePath(memoryDir, fileName) {
+  if (!isSafeMemoryFileName(fileName)) {
+    throw new Error(`unsafe memory file_name: ${fileName.slice(0, 80)}`);
+  }
+  const root = resolve(memoryDir);
+  const filePath = resolve(root, fileName);
+  const rootPrefix = root.endsWith(sep) ? root : `${root}${sep}`;
+  if (filePath !== root && !filePath.startsWith(rootPrefix)) {
+    throw new Error(`memory file path escapes memory directory: ${fileName.slice(0, 80)}`);
+  }
+  return filePath;
+}
+var SAFE_MEMORY_FILE_RE;
+var init_safe_memory_file = __esm({
+  "src/tools/memory/safe-memory-file.ts"() {
+    "use strict";
+    SAFE_MEMORY_FILE_RE = /^[A-Za-z0-9][A-Za-z0-9._ -]*\.md$/i;
+  }
+});
+
+// src/tools/memory/sync-config.ts
+var sync_config_exports = {};
+__export(sync_config_exports, {
+  TOOL_NAME: () => TOOL_NAME22,
+  deriveProjectSlug: () => deriveProjectSlug,
+  description: () => description22,
+  getMemoryDir: () => getMemoryDir,
+  handleSyncConfig: () => handleSyncConfig,
+  inputSchema: () => inputSchema22,
+  isNoopSyncReason: () => isNoopSyncReason,
+  runMemorySync: () => runMemorySync
+});
+import { homedir as homedir5 } from "node:os";
+import { join as join7 } from "node:path";
+import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync3, readdirSync as readdirSync4 } from "node:fs";
+function isToolInput22(v) {
+  if (typeof v !== "object" || v === null) return false;
+  const o = v;
+  if (o["action"] !== "pull" && o["action"] !== "push") return false;
+  if (o["cwd"] !== void 0 && typeof o["cwd"] !== "string") return false;
+  return true;
+}
+function deriveProjectSlug(cwd) {
+  return cwd.replace(/\\/g, "/").replace(/\/+$/g, "").replace(/^([a-zA-Z]):/, (_m, drive) => `${drive.toUpperCase()}:`).replace(/[^a-zA-Z0-9]/g, "-");
+}
+function getMemoryDir(cwd) {
+  const slug = deriveProjectSlug(cwd);
+  return join7(homedir5(), ".claude", "projects", slug, "memory");
+}
+async function pullMemory(controlPlaneUrl, token, memoryDir, fetchFn) {
+  const url = `${controlPlaneUrl}/api/v1/agent-config/memory/me`;
+  const response = await fetchFn(url, {
+    method: "GET",
+    headers: {
+      authorization: `Bearer ${token}`
+    }
+  });
+  if (response.status !== 200) {
+    const text = await response.text();
+    throw new Error(`GET /api/v1/agent-config/memory/me returned HTTP ${response.status}: ${text.slice(0, 200)}`);
+  }
+  const data = JSON.parse(await response.text());
+  if (!data.ok || !Array.isArray(data.entries)) {
+    throw new Error("GET /api/v1/agent-config/memory/me response missing ok=true or entries array");
+  }
+  const writes = data.entries.map((entry) => ({
+    entry,
+    filePath: resolveMemoryFilePath(memoryDir, entry.file_name)
+  }));
+  mkdirSync4(memoryDir, { recursive: true });
+  const files = [];
+  for (const { entry, filePath } of writes) {
+    writeFileSync3(filePath, entry.content, "utf8");
+    files.push(entry.file_name);
+  }
+  return { pulled: data.entries.length, files };
+}
+async function pushMemory(controlPlaneUrl, token, memoryDir, sessionId, fetchFn) {
+  if (!existsSync5(memoryDir)) {
+    return { pushed: 0, created: 0, updated: 0 };
+  }
+  const localFiles = readdirSync4(memoryDir).filter((f) => f.endsWith(".md")).map((f) => ({
+    file_name: f,
+    content: readFileSync7(resolveMemoryFilePath(memoryDir, f), "utf8"),
+    entry_type: f === "MEMORY.md" ? "index" : "topic"
+  }));
+  if (localFiles.length === 0) {
+    return { pushed: 0, created: 0, updated: 0 };
+  }
+  const getUrl = `${controlPlaneUrl}/api/v1/agent-config/memory/me`;
+  const getResponse = await fetchFn(getUrl, {
+    method: "GET",
+    headers: {
+      authorization: `Bearer ${token}`
+    }
+  });
+  const existingMap = /* @__PURE__ */ new Map();
+  if (getResponse.status === 200) {
+    const getData = JSON.parse(await getResponse.text());
+    if (getData.ok && Array.isArray(getData.entries)) {
+      for (const entry of getData.entries) {
+        existingMap.set(entry.file_name, entry.memory_id);
+      }
+    }
+  }
+  let created = 0;
+  let updated = 0;
+  for (const localFile of localFiles) {
+    const memoryId = existingMap.get(localFile.file_name);
+    if (memoryId) {
+      const updateUrl = `${controlPlaneUrl}/api/v1/agent-config/memory/${memoryId}`;
+      const updateBody = {
+        content: localFile.content,
+        session_id: sessionId
+      };
+      const updateResponse = await fetchFn(updateUrl, {
+        method: "PUT",
+        headers: {
+          authorization: `Bearer ${token}`,
+          "content-type": "application/json"
+        },
+        body: JSON.stringify(updateBody)
+      });
+      if (updateResponse.status !== 200) {
+        const text = await updateResponse.text();
+        throw new Error(
+          `PUT /api/v1/agent-config/memory/${memoryId} returned HTTP ${updateResponse.status}: ${text.slice(0, 200)}`
+        );
+      }
+      const updateData = JSON.parse(await updateResponse.text());
+      if (!updateData.ok) {
+        throw new Error(`PUT /api/v1/agent-config/memory/${memoryId} returned ok=false`);
+      }
+      updated++;
+    } else {
+      const createUrl = `${controlPlaneUrl}/api/v1/agent-config/memory/me`;
+      const createBody = {
+        entry_type: localFile.entry_type,
+        file_name: localFile.file_name,
+        content: localFile.content,
+        session_id: sessionId
+      };
+      const createResponse = await fetchFn(createUrl, {
+        method: "POST",
+        headers: {
+          authorization: `Bearer ${token}`,
+          "content-type": "application/json"
+        },
+        body: JSON.stringify(createBody)
+      });
+      if (createResponse.status !== 200 && createResponse.status !== 201) {
+        const text = await createResponse.text();
+        throw new Error(
+          `POST /api/v1/agent-config/memory/me returned HTTP ${createResponse.status}: ${text.slice(0, 200)}`
+        );
+      }
+      const createData = JSON.parse(await createResponse.text());
+      if (!createData.ok) {
+        throw new Error("POST /api/v1/agent-config/memory/me returned ok=false");
       }
-    },
-    path() {
-      return filePath;
-    },
-    close() {
+      created++;
     }
-  };
-}
-
-// src/tools/common.ts
-function readVoMcpVersion() {
-  try {
-    const here = dirname3(fileURLToPath2(import.meta.url));
-    const pkgPath = join4(here, "..", "..", "package.json");
-    const pkg = JSON.parse(readFileSync4(pkgPath, "utf8"));
-    return typeof pkg.version === "string" ? pkg.version : "0.0.0-unknown";
-  } catch {
-    return "0.0.0-unknown";
   }
+  return { pushed: localFiles.length, created, updated };
 }
-var VO_MCP_VERSION = readVoMcpVersion();
-function bytesOf(s) {
-  return Buffer.byteLength(s, "utf8");
-}
-function sha256Hex(s) {
-  return createHash2("sha256").update(s, "utf8").digest("hex");
-}
-function invalidParams(toolName, message) {
-  return new McpError(ErrorCode.InvalidParams, `${toolName}: ${message}`);
+function isNoopSyncReason(reason) {
+  if (!reason) return false;
+  return /not set|No auth configured|Failed to obtain auth token/.test(reason);
 }
-function methodNotFound(toolName, knownTools) {
-  return new McpError(
-    ErrorCode.MethodNotFound,
-    `Unknown tool: ${toolName}. Registered tools: ${knownTools.join(", ")}`
-  );
+async function runMemorySync(action, cwd, sessionId, fetchFn = globalThis.fetch) {
+  const controlPlaneUrl = process.env["VO_CONTROL_PLANE_URL"];
+  if (!controlPlaneUrl) {
+    return { synced: false, reason: "VO_CONTROL_PLANE_URL not set \u2014 cloud mode disabled" };
+  }
+  const { createAuthTokenSourceFromEnv: createAuthTokenSourceFromEnv2 } = await Promise.resolve().then(() => (init_auth_token_source(), auth_token_source_exports));
+  const { readStoredCredential: readStoredCredential2 } = await Promise.resolve().then(() => (init_credential_store(), credential_store_exports));
+  const tokenSource = createAuthTokenSourceFromEnv2(process.env, fetchFn, () => readStoredCredential2(process.env));
+  if (!tokenSource) {
+    return { synced: false, reason: "No auth configured. Run `vo-mcp login` to authenticate as an operator." };
+  }
+  const token = await tokenSource.getToken();
+  if (!token) {
+    return { synced: false, reason: "Failed to obtain auth token. Run `vo-mcp login` to re-authenticate." };
+  }
+  const memoryDir = getMemoryDir(cwd);
+  const baseUrl = controlPlaneUrl.replace(/\/+$/, "");
+  try {
+    if (action === "pull") {
+      const result2 = await pullMemory(baseUrl, token, memoryDir, fetchFn);
+      return { synced: true, action: "pull", pulled: result2.pulled, files: result2.files, memory_dir: memoryDir };
+    }
+    const result = await pushMemory(baseUrl, token, memoryDir, sessionId, fetchFn);
+    return {
+      synced: true,
+      action: "push",
+      pushed: result.pushed,
+      created: result.created,
+      updated: result.updated,
+      memory_dir: memoryDir
+    };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return { synced: false, reason: `Sync failed: ${message}` };
+  }
 }
-function assertWithinByteCap(toolName, fieldName, value, maxBytes) {
-  const bytes = Buffer.byteLength(value, "utf8");
-  if (bytes > maxBytes) {
+async function handleSyncConfig(deps, rawInput, _signal, fetchFn = globalThis.fetch) {
+  if (!isToolInput22(rawInput)) {
     throw invalidParams(
-      toolName,
-      `input field '${fieldName}' exceeds ${maxBytes}-byte cap (got ${bytes} bytes). Trim the input or split across multiple calls.`
+      TOOL_NAME22,
+      'invalid input. Required: { action: "pull" | "push" }. Optional: { cwd: "<path>" }.'
     );
   }
+  const cwd = rawInput.cwd?.trim() || process.cwd();
+  const result = await runMemorySync(rawInput.action, cwd, deps.session.sessionId, fetchFn);
+  return jsonContent({ tool: TOOL_NAME22, schema_version: 1, payload: result });
 }
-function buildBaseEvent(args) {
-  return {
-    schema_version: 1,
-    event_id: args.eventId ?? randomUUID(),
-    ts: args.now.toISOString(),
-    tenant_id: args.session.tenantId,
-    operator_id: args.session.operatorId,
-    session_id: args.session.sessionId,
-    client_id: args.session.clientId,
-    mode: args.session.mode,
-    tool: args.tool,
-    gate_type: args.gateType,
-    input_hash: args.inputHash,
-    input_excerpt: sanitizeExcerpt(args.inputExcerpt),
-    input_size_bytes: args.inputSizeBytes,
-    per_model_verdicts: [],
-    synthesized_verdict: null,
-    consensus_confidence: null,
-    per_model_tokens_in: null,
-    per_model_tokens_out: null,
-    total_cost_usd: null,
-    duration_ms: null,
-    dev_override: null,
-    downstream_outcome: null,
-    vo_mcp_version: VO_MCP_VERSION,
-    consensus_engine_version: null,
-    cache_hit: false
-  };
-}
-function jsonContent(value) {
-  return {
-    content: [{ type: "text", text: JSON.stringify(value, null, 2) }]
-  };
-}
-function toEventPerModelVerdicts(src) {
-  return src.map((v) => {
-    const sanitizedExcerpt = sanitizeExcerpt(v.raw_response_excerpt);
-    return {
-      model: v.model,
-      model_id: v.model,
-      provider: v.provider,
-      verdict: v.verdict,
-      confidence: v.confidence,
-      duration_ms: v.duration_ms,
-      raw_response_excerpt: sanitizedExcerpt,
-      // Hash over the sanitized excerpt — engine doesn't yet thread the full
-      // raw response. Documented limitation on `raw_response_hash` in types.ts.
-      raw_response_hash: sha256Hex(v.raw_response_excerpt),
-      reasoning_summary: typeof v.reasoning_excerpt === "string" && v.reasoning_excerpt.length > 0 ? sanitizeExcerpt(v.reasoning_excerpt, 500) : null,
-      // Engine doesn't yet emit cited_sources; ship empty array so cloud
-      // ingestion doesn't NPE on `Array.isArray()` checks.
-      cited_sources: [],
-      error: v.error ?? null
+var TOOL_NAME22, inputSchema22, description22;
+var init_sync_config = __esm({
+  "src/tools/memory/sync-config.ts"() {
+    "use strict";
+    init_common();
+    init_safe_memory_file();
+    TOOL_NAME22 = "vo_sync_config";
+    inputSchema22 = {
+      type: "object",
+      properties: {
+        action: {
+          type: "string",
+          enum: ["pull", "push"],
+          description: "pull: download cloud memory to local files. push: upload local files to cloud."
+        },
+        cwd: {
+          type: "string",
+          description: "Working directory to derive project slug from (default: process.cwd())."
+        }
+      },
+      required: ["action"],
+      additionalProperties: false
     };
-  });
-}
-function toEventSynthesizedVerdict(src) {
-  return {
-    verdict: src.verdict,
-    confidence: src.confidence,
-    reasoning_excerpt: sanitizeExcerpt(src.reasoning_excerpt)
-  };
-}
+    description22 = "Syncs memory entries between local ~/.claude/projects/<slug>/memory/ and cloud control-plane /api/v1/agent-config/memory/me. Requires operator auth (vo-mcp login). Actions: pull (cloud\u2192local), push (local\u2192cloud). Idempotent; push creates/updates as needed.";
+  }
+});
+
+// src/cli.ts
+import { homedir as homedir6, hostname } from "node:os";
+import { randomUUID as randomUUID5 } from "node:crypto";
+import { join as join8 } from "node:path";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+
+// src/server.ts
+init_common();
+import { randomUUID as randomUUID2 } from "node:crypto";
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import {
+  CallToolRequestSchema,
+  ListToolsRequestSchema
+} from "@modelcontextprotocol/sdk/types.js";
 
 // src/modes/local.ts
 function createLocalMode() {
@@ -1223,6 +1644,7 @@ function createLocalMode() {
 }
 
 // src/tools/check-assertion-strength.ts
+init_common();
 var TOOL_NAME = "vo_check_assertion_strength";
 var GATE_TYPE = "ratchet";
 var MAX_SOURCE_BYTES = 512 * 1024;
@@ -1319,7 +1741,11 @@ async function handleCheckAssertionStrength(deps, rawInput, _signal) {
   return jsonContent(envelope);
 }
 
+// src/tools/check-hollow-test.ts
+init_common();
+
 // src/tools/architecture-review-kb-prefilter.ts
+init_src();
 var DEFAULT_STACK = [
   "node",
   "node-pnpm-monorepo",
@@ -1405,6 +1831,7 @@ function formatRulesForPrompt(hits, truncated, domainLabel = "ARCHITECTURAL") {
 }
 
 // src/tools/kb-metadata-prefilter.ts
+init_src();
 function findRulesByMetadata(opts) {
   if (opts.category === void 0 && opts.tagsAny === void 0) {
     return {
@@ -1598,6 +2025,7 @@ async function handleCheckHollowTest(deps, rawInput, signal) {
 }
 
 // src/tools/verify-answer.ts
+init_common();
 var TOOL_NAME3 = "vo_verify_answer";
 var SHALLOW_GATE = "mid-exec-verify";
 var DEEP_GATE = "final-deep-verify";
@@ -1779,6 +2207,9 @@ async function handleVerifyAnswer(deps, rawInput, signal) {
   return jsonContent(envelope);
 }
 
+// src/tools/consensus-judgment.ts
+init_common();
+
 // src/consensus/gate-types.ts
 var LEGACY_GATE_TYPES = [
   "test_assertion",
@@ -2036,6 +2467,8 @@ async function handleConsensusJudgment(deps, rawInput, signal) {
     ...engineResult.synthesized_verdict.confidence_badge !== void 0 ? { confidence_badge: engineResult.synthesized_verdict.confidence_badge } : {},
     // Feature 1 (agreement-gate) — fan-out diagnostics (present iff the gate ran).
     ...engineResult.fan_out_diagnostics !== void 0 ? { fan_out_diagnostics: engineResult.fan_out_diagnostics } : {},
+    // Stage A7-shadow — adaptive-vs-incumbent comparison (PII-free; present iff shadow on).
+    ...engineResult.shadow_synthesis !== void 0 ? { shadow_synthesis: engineResult.shadow_synthesis } : {},
     // Source-grounded Tier-4 outputs (present iff the call was source-grounded).
     ...engineResult.source_grounded === true ? { source_grounded: true } : {},
     ...engineResult.citation_grade !== void 0 ? { citation_grade: engineResult.citation_grade } : {},
@@ -2056,6 +2489,8 @@ async function handleConsensusJudgment(deps, rawInput, signal) {
 }
 
 // src/tools/architecture-review.ts
+init_common();
+init_events_writer();
 var TOOL_NAME5 = "vo_architecture_review";
 var GATE_TYPE3 = "architecture-review";
 var MAX_DIFF_BYTES = 1024 * 1024;
@@ -3300,6 +3735,7 @@ function partitionByAllowlist(findings, allowlist) {
 }
 
 // src/tools/check-ratchets.ts
+init_common();
 var TOOL_NAME6 = "vo_check_ratchets";
 var GATE_TYPE4 = "ratchet";
 var ALL_RATCHET_IDS = [
@@ -3432,6 +3868,7 @@ function buildSummary(report) {
 }
 
 // src/tools/decompose-dispatch.ts
+init_common();
 var TOOL_NAME7 = "vo_decompose_dispatch";
 var GATE_TYPE5 = "plan-review";
 var MAX_GOAL_BYTES = 32 * 1024;
@@ -3709,6 +4146,9 @@ Produce the JSON dispatch plan now.`;
   return jsonContent(envelope);
 }
 
+// src/tools/heal/trigger-heal.ts
+init_common();
+
 // src/cloud/admin-callable-client.ts
 init_auth_token_source();
 init_credential_store();
@@ -3838,6 +4278,7 @@ function buildAdminCallableClientFromEnv(env = process.env) {
 }
 
 // src/tools/cloud-call.ts
+init_common();
 var ADMIN_READONLY_GATE_REASON = "admin callables are in read-only mode (VO_ADMIN_CALLABLES_READONLY) \u2014 this write tool is gated to its stub. Unset VO_ADMIN_CALLABLES_READONLY to enable write tools.";
 async function buildCloudOrStubResponse(args) {
   const inputJson = JSON.stringify(args.normalizedInput);
@@ -3911,6 +4352,7 @@ async function buildCloudOrStubResponse(args) {
 }
 
 // src/tools/heal/common-heal.ts
+init_common();
 var HEAL_STUB_REASON = 'cloud-mode not yet wired; tool surface is live, admin-callable wiring pending vo-cloud-tenant-model dispatch (see packages/vo-mcp/src/modes/cloud.ts + EXTRACTION_AUDIT.md "Stub remaining")';
 var HEAL_GATE_TYPE = "admin-action";
 
@@ -3970,6 +4412,7 @@ async function handleTriggerHeal(deps, rawInput, _signal) {
 }
 
 // src/tools/heal/fix-retry.ts
+init_common();
 var TOOL_NAME9 = "vo_fix_retry";
 var MAX_BATCH = 50;
 var ADMIN_PATH_SINGLE = "/api/v1/admin/heal/retry-attempt";
@@ -4062,6 +4505,7 @@ async function handleFixRetry(deps, rawInput, _signal) {
 }
 
 // src/tools/heal/fix-clear.ts
+init_common();
 var TOOL_NAME10 = "vo_fix_clear";
 var CALLABLE_NAME2 = "voClearFixAttempt";
 var ADMIN_PATH2 = "/api/v1/admin/heal/clear-attempt";
@@ -4105,6 +4549,7 @@ async function handleFixClear(deps, rawInput, _signal) {
 }
 
 // src/tools/heal/stop-workflow.ts
+init_common();
 var TOOL_NAME11 = "vo_stop_workflow";
 var CALLABLE_NAME3 = "voStopWorkflow";
 var ADMIN_PATH3 = "/api/v1/admin/workflow/stop";
@@ -4160,6 +4605,7 @@ async function handleStopWorkflow(deps, rawInput, _signal) {
 }
 
 // src/tools/heal/get-workflow-runs.ts
+init_common();
 var TOOL_NAME12 = "vo_get_workflow_runs";
 var CALLABLE_NAME4 = "voGetWorkflowRuns";
 var ADMIN_PATH4 = "/api/v1/admin/workflow/runs";
@@ -4190,7 +4636,11 @@ async function handleGetWorkflowRuns(deps, rawInput, _signal) {
   });
 }
 
+// src/tools/pr/list-pending-prs.ts
+init_common();
+
 // src/tools/pr/common-pr.ts
+init_common();
 var PR_STUB_REASON = 'cloud-mode not yet wired; tool surface is live, admin-callable wiring pending vo-cloud-tenant-model dispatch (see packages/vo-mcp/src/modes/cloud.ts + EXTRACTION_AUDIT.md "Stub remaining")';
 var PR_GATE_TYPE = "admin-action";
 
@@ -4203,7 +4653,7 @@ var inputSchema13 = {
   properties: {},
   additionalProperties: false
 };
-var description13 = "Lists open VO-source pull requests with blocker / source / tester / specialist-context metadata. Read-only diagnostic for Command Center reads. Wraps `voListPendingPRs` admin Cloud Function. V1 stub: returns `verdict: 'unimplemented'` \u2014 cloud-mode wiring pending.";
+var description13 = "Lists open AlgoHQ-source pull requests with blocker / source / tester / specialist-context metadata. Read-only diagnostic for Command Center reads. Wraps `voListPendingPRs` admin Cloud Function. V1 stub: returns `verdict: 'unimplemented'` \u2014 cloud-mode wiring pending.";
 function isToolInput13(v) {
   return typeof v === "object" && v !== null;
 }
@@ -4225,6 +4675,7 @@ async function handleListPendingPRs(deps, rawInput, _signal) {
 }
 
 // src/tools/pr/merge-pr.ts
+init_common();
 var TOOL_NAME14 = "vo_merge_pr";
 var CALLABLE_NAME6 = "voMergePR";
 var ADMIN_PATH6 = "/api/v1/admin/pr/merge";
@@ -4239,7 +4690,7 @@ var inputSchema14 = {
   required: ["pr_number"],
   additionalProperties: false
 };
-var description14 = "Approves + merges a single VO-source pull request by number. Wraps `voMergePR` admin Cloud Function (server-side refuses non-VO PRs with permission-denied). V1 stub: returns `verdict: 'unimplemented'` \u2014 cloud-mode wiring pending.";
+var description14 = "Approves + merges a single AlgoHQ-source pull request by number. Wraps `voMergePR` admin Cloud Function (server-side refuses non-AlgoHQ PRs with permission-denied). V1 stub: returns `verdict: 'unimplemented'` \u2014 cloud-mode wiring pending.";
 function isToolInput14(v) {
   if (typeof v !== "object" || v === null) return false;
   const o = v;
@@ -4269,6 +4720,7 @@ async function handleMergePR(deps, rawInput, _signal) {
 }
 
 // src/tools/pr/reject-pr.ts
+init_common();
 var TOOL_NAME15 = "vo_reject_pr";
 var CALLABLE_NAME7 = "voRejectPR";
 var ADMIN_PATH7 = "/api/v1/admin/pr/reject";
@@ -4313,6 +4765,7 @@ async function handleRejectPR(deps, rawInput, _signal) {
 }
 
 // src/tools/pr/approve-all-fixes.ts
+init_common();
 var TOOL_NAME16 = "vo_approve_all_fixes";
 var CALLABLE_NAME8 = "voApproveAllFixes";
 var ADMIN_PATH8 = "/api/v1/admin/pr/approve-all";
@@ -4321,7 +4774,7 @@ var inputSchema16 = {
   properties: {},
   additionalProperties: false
 };
-var description16 = "Iterates all open VO-source pull requests and merges (or arms auto-merge) on each. Returns counts of merged / accepted / total plus per-PR results. Wraps `voApproveAllFixes` admin Cloud Function. V1 stub: returns `verdict: 'unimplemented'` \u2014 cloud-mode wiring pending.";
+var description16 = "Iterates all open AlgoHQ-source pull requests and merges (or arms auto-merge) on each. Returns counts of merged / accepted / total plus per-PR results. Wraps `voApproveAllFixes` admin Cloud Function. V1 stub: returns `verdict: 'unimplemented'` \u2014 cloud-mode wiring pending.";
 function isToolInput16(v) {
   return typeof v === "object" && v !== null;
 }
@@ -4341,6 +4794,7 @@ async function handleApproveAllFixes(deps, rawInput, _signal) {
 }
 
 // src/tools/pr/reject-and-retry.ts
+init_common();
 var TOOL_NAME17 = "vo_reject_and_retry";
 var CALLABLE_NAME9 = "voRejectAndRetry";
 var ADMIN_PATH9 = "/api/v1/admin/pr/reject-retry";
@@ -4355,7 +4809,7 @@ var inputSchema17 = {
   required: ["pr_number"],
   additionalProperties: false
 };
-var description17 = "Closes a VO pull request and dispatches a self-heal pass to retry the same focus page. Cloud callable refuses non-VO PRs and respects the self-heal kill switch + per-PR retry block. Wraps `voRejectAndRetry` admin Cloud Function. V1 stub: returns `verdict: 'unimplemented'` \u2014 cloud-mode wiring pending.";
+var description17 = "Closes an AlgoHQ pull request and dispatches a self-heal pass to retry the same focus page. Cloud callable refuses non-AlgoHQ PRs and respects the self-heal kill switch + per-PR retry block. Wraps `voRejectAndRetry` admin Cloud Function. V1 stub: returns `verdict: 'unimplemented'` \u2014 cloud-mode wiring pending.";
 function isToolInput17(v) {
   if (typeof v !== "object" || v === null) return false;
   const o = v;
@@ -4385,6 +4839,7 @@ async function handleRejectAndRetry(deps, rawInput, _signal) {
 }
 
 // src/tools/pr/review-merge.ts
+init_common();
 var TOOL_NAME18 = "vo_review_merge";
 var LIST_PATH = "/api/v1/admin/pr/list";
 var ENGINE_GATE = "final-deep-verify";
@@ -4431,7 +4886,7 @@ function buildPrompt4(pr, notes) {
   const lines = [
     "You are a release gatekeeper deciding whether a pull request is safe to MERGE.",
     "Recommend exactly one of: merge / hold / reject. Be conservative \u2014 this is a high-stakes irreversible action.",
-    "Rules: HOLD if CI is failing/blocked, there is a merge conflict, or the change is a draft. REJECT if the PR is not a legitimate VO-source change or has no clear purpose. MERGE only if it looks complete, scoped, and unblocked.",
+    "Rules: HOLD if CI is failing/blocked, there is a merge conflict, or the change is a draft. REJECT if the PR is not a legitimate AlgoHQ-source change or has no clear purpose. MERGE only if it looks complete, scoped, and unblocked.",
     "",
     `PR #${pr.number}: ${pr.title}`,
     `Source: ${pr.source ?? "unknown"}`,
@@ -4499,7 +4954,7 @@ async function handleReviewMerge(deps, rawInput, signal) {
   }
   if (pr === null) {
     return emit(
-      emptyPayload("hold", `PR #${prNumber} is not among open VO PRs (already merged/closed, or not a VO-source PR).`, null)
+      emptyPayload("hold", `PR #${prNumber} is not among open AlgoHQ PRs (already merged/closed, or not an AlgoHQ-source PR).`, null)
     );
   }
   const hasBlocker = pr.blocker !== null && pr.blocker !== "none";
@@ -4563,6 +5018,9 @@ async function handleReviewMerge(deps, rawInput, signal) {
   });
 }
 
+// src/tools/session/report-session-state.ts
+init_common();
+
 // src/tools/session/directive.ts
 var SESSION_DIRECTIVE_THRESHOLDS = {
   prepare_handoff_pct: 70,
@@ -4594,6 +5052,8 @@ function suggestedHandoffPath(session_id, isoTimestamp) {
 }
 
 // src/tools/session/report-session-state.ts
+init_auth_token_source();
+init_credential_store();
 var TOOL_NAME19 = "vo_report_session_state";
 var VALID_AGENT_TYPES = ["claude-code", "codex", "cursor", "continue"];
 var MAX_GOAL_CHARS = 500;
@@ -4644,7 +5104,7 @@ var inputSchema19 = {
   required: ["operator_id", "session_id", "agent_type", "context_used_pct"],
   additionalProperties: false
 };
-var description19 = "Reports per-session context-window utilization to VO and returns a directive: 'continue' (under 70%), 'prepare_handoff' (70-84%), or 'execute_handoff_now' (\u226585%). Implements V1 launch gate #9 (fleet context lifecycle management) per the official VO roadmap. V1 backend is stub-local \u2014 computes the directive purely from `context_used_pct` against the documented thresholds without a network call. Phase 3 wires this to the deployed vo-control-plane HTTP API; the response shape stays stable across the cutover (`backend_mode` field in the payload tells the caller which mode produced the verdict).";
+var description19 = "Reports per-session context-window utilization to AlgoHQ and returns a directive: 'continue' (under 70%), 'prepare_handoff' (70-84%), or 'execute_handoff_now' (\u226585%). Implements V1 launch gate #9 (fleet context lifecycle management) per the official AlgoHQ roadmap. Cloud-control-plane mode when VO_CONTROL_PLANE_URL plus a user/scoped HQ credential (or legacy admin token) is available; auto-allocates the session on first report so interactive agents (Claude Code, Cursor, Codex, Continue) appear on the live fleet whiteboard. Stub-local fallback when cloud config is absent or fails. The response shape stays stable across modes (`backend_mode` field in the payload tells the caller which mode produced the verdict).";
 function isStringArray2(v, maxItems) {
   if (!Array.isArray(v)) return false;
   if (v.length > maxItems) return false;
@@ -4669,33 +5129,93 @@ function isToolInput19(v) {
   }
   return true;
 }
-function getCloudConfig() {
-  const url = process.env["VO_CONTROL_PLANE_URL"];
-  const token = process.env["VO_CONTROL_PLANE_ADMIN_TOKEN"];
-  if (!url || !token) return null;
-  return { url, token };
+async function fetchCloudIdentity(url, token, fetchFn) {
+  try {
+    const response = await fetchFn(`${url}/api/v1/auth/me`, {
+      method: "GET",
+      headers: {
+        "Authorization": `Bearer ${token}`
+      }
+    });
+    if (!response.ok) return null;
+    const data = await response.json();
+    if (!data.ok || !data.provisioned || !data.operator_id || !data.tenant_id) return null;
+    return { operator_id: data.operator_id, tenant_id: data.tenant_id };
+  } catch {
+    return null;
+  }
+}
+async function getCloudConfig(fetchFn = fetch) {
+  const url = process.env["VO_CONTROL_PLANE_URL"]?.trim();
+  if (!url) return null;
+  const tokenSource = createAuthTokenSourceFromEnv(
+    process.env,
+    fetchFn,
+    () => readStoredCredential(process.env)
+  );
+  const token = await tokenSource?.getToken();
+  if (!token) return null;
+  const tenant_id = process.env["VO_TENANT_ID"]?.trim();
+  if (tenant_id) return { url, token, tenant_id };
+  const identity = await fetchCloudIdentity(url, token, fetchFn);
+  if (!identity) return null;
+  return { url, token, tenant_id: identity.tenant_id, operator_id: identity.operator_id };
 }
-async function tryCloudReportState(cloud, input) {
+async function tryCloudReportState(cloud, input, fetchFn = fetch) {
   try {
-    const body = {
+    const reportBody = {
       context_used_pct: input.context_used_pct
     };
-    if (input.current_goal !== void 0) body["current_goal"] = input.current_goal;
+    if (input.current_goal !== void 0) reportBody["current_goal"] = input.current_goal;
     if (input.recent_files_touched !== void 0) {
-      body["recent_files_touched"] = input.recent_files_touched;
+      reportBody["recent_files_touched"] = input.recent_files_touched;
     }
     if (input.recent_tool_uses !== void 0) {
-      body["recent_tool_uses"] = input.recent_tool_uses;
+      reportBody["recent_tool_uses"] = input.recent_tool_uses;
     }
-    const url = `${cloud.url}/api/v1/session/${input.session_id}/report-state`;
-    const response = await fetch(url, {
+    const reportUrl = `${cloud.url}/api/v1/session/${input.session_id}/report-state`;
+    let response = await fetchFn(reportUrl, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
         "Authorization": `Bearer ${cloud.token}`
       },
-      body: JSON.stringify(body)
+      body: JSON.stringify(reportBody)
     });
+    if (response.status === 404) {
+      const allocateBody = {
+        operator_id: cloud.operator_id ?? input.operator_id,
+        tenant_id: cloud.tenant_id,
+        agent_type: input.agent_type,
+        current_goal: input.current_goal ?? "Interactive session"
+      };
+      if (input.context_used_pct > 0) {
+        allocateBody["initial_context_used_pct"] = input.context_used_pct;
+      }
+      const allocateUrl = `${cloud.url}/api/v1/session`;
+      const allocateResponse = await fetchFn(allocateUrl, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "Authorization": `Bearer ${cloud.token}`
+        },
+        body: JSON.stringify(allocateBody)
+      });
+      if (!allocateResponse.ok) {
+        return null;
+      }
+      const allocateData = await allocateResponse.json();
+      const retrySessionId = typeof allocateData.session?.session_id === "string" && allocateData.session.session_id.length > 0 ? allocateData.session.session_id : input.session_id;
+      const retryReportUrl = `${cloud.url}/api/v1/session/${retrySessionId}/report-state`;
+      response = await fetchFn(retryReportUrl, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "Authorization": `Bearer ${cloud.token}`
+        },
+        body: JSON.stringify(reportBody)
+      });
+    }
     if (!response.ok) {
       return null;
     }
@@ -4726,7 +5246,7 @@ async function handleReportSessionState(deps, rawInput, _signal) {
       `invalid input. Required fields: operator_id (non-empty string), session_id (non-empty string), agent_type (one of: ${VALID_AGENT_TYPES.join(" | ")}), context_used_pct (number 0-100). Optional: current_goal (string \u2264${MAX_GOAL_CHARS} chars), recent_files_touched (string[] \u2264${MAX_RECENT_FILES}), recent_tool_uses (string[] \u2264${MAX_RECENT_TOOLS}).`
     );
   }
-  const cloud = getCloudConfig();
+  const cloud = await getCloudConfig();
   if (cloud !== null) {
     const cloudPayload = await tryCloudReportState(cloud, rawInput);
     if (cloudPayload !== null) {
@@ -4751,6 +5271,7 @@ async function handleReportSessionState(deps, rawInput, _signal) {
 }
 
 // src/tools/session/spawn-successor.ts
+init_common();
 import { spawn } from "node:child_process";
 import { homedir as homedir4 } from "node:os";
 import { join as join6 } from "node:path";
@@ -4809,7 +5330,7 @@ var MANDATORY_READS = [
 function buildSuccessorPrompt(handoffMarkdown, goal) {
   const reads = MANDATORY_READS.map((r, i) => `  ${i + 1}. ${r}`).join("\n");
   const lines = [
-    "You are the SUCCESSOR agent for a Virtual Office lane. The previous session",
+    "You are the SUCCESSOR agent for an AlgoHQ lane. The previous session",
     "exhausted its context and wrote the handoff below. Read it fully, verify its",
     '"verification needed" items against live state (a handoff is a claim, not',
     "evidence \u2014 verify via `git show origin/main:<path>`), then continue the lane.",
@@ -4820,7 +5341,7 @@ function buildSuccessorPrompt(handoffMarkdown, goal) {
     "NON-NEGOTIABLES: multi-model consensus verification is the core; test honesty",
     "(verified-answer-only, no fake green); verify-before-act + human merge approval;",
     "never a full functions-shared deploy; Gen2 only; work in a worktree on your own",
-    "branch; finish line is MERGED + DEPLOYED + LIVE-VERIFIED, and VO changes update",
+    "branch; finish line is MERGED + DEPLOYED + LIVE-VERIFIED, and AlgoHQ changes update",
     "the roadmap in the same PR.",
     "",
     "--- HANDOFF ---",
@@ -4885,6 +5406,9 @@ async function handleSpawnSuccessor(_deps, rawInput, _signal, spawnImpl = spawn)
   });
 }
 
+// src/tools/concierge/dispatch.ts
+init_common();
+
 // src/tools/concierge/common-concierge.ts
 var CONCIERGE_STUB_REASON = "cloud mode not active in this MCP runtime \u2014 set VO_CONTROL_PLANE_URL + VO_CONTROL_PLANE_ADMIN_TOKEN to enable. The server-side /api/v1/admin/concierge/dispatch endpoint IS built + deployed (vo-control-plane #5724/#5734); in cloud mode this tool returns the routed pack README + file index.";
 var CONCIERGE_GATE_TYPE = "concierge-dispatch";
@@ -4966,253 +5490,250 @@ async function handleConciergeDispatch(deps, rawInput, _signal) {
   });
 }
 
-// src/tools/memory/sync-config.ts
-import { homedir as homedir5 } from "node:os";
-import { join as join7 } from "node:path";
-import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync3, readdirSync as readdirSync4 } from "node:fs";
-var TOOL_NAME22 = "vo_sync_config";
-var inputSchema22 = {
+// src/server.ts
+init_sync_config();
+
+// src/tools/memory/private-knowledge.ts
+init_common();
+var UPSERT_TOOL_NAME = "vo_private_knowledge_upsert";
+var CONTEXT_TOOL_NAME = "vo_private_knowledge_context";
+var KNOWLEDGE_CLASSES = ["memory", "skill", "doctrine", "hook", "command"];
+var PRECISION_CHAR_BUDGET = 12e3;
+var upsertInputSchema = {
+  type: "object",
+  properties: {
+    knowledge_class: { type: "string", enum: KNOWLEDGE_CLASSES },
+    source_path: { type: "string", description: "Stable private source identifier; not exposed to other users." },
+    title: { type: "string", description: 'Descriptive, retrieval-friendly title (e.g. "AlgoTax OCR redaction architecture", not "notes") \u2014 retrieval matches on it.' },
+    content: { type: "string", description: "Private knowledge text to store server-side. Keep each entry tight and focused (~1-3 pages, under ~12k chars); split larger corpora into separate entries." }
+  },
+  required: ["knowledge_class", "source_path", "title", "content"],
+  additionalProperties: false
+};
+var contextInputSchema = {
+  type: "object",
+  properties: {
+    query: { type: "string" },
+    limit: { type: "number", minimum: 1, maximum: 50 },
+    knowledge_class: { type: "string", enum: KNOWLEDGE_CLASSES }
+  },
+  required: ["query"],
+  additionalProperties: false
+};
+var upsertDescription = "Uploads or refreshes the authenticated operator\u2019s private cloud knowledge. Works for Claude, Codex, Cursor, and cowork clients via the same vo-mcp login credential. Returns metadata only, not raw stored content. PRECISION DISCIPLINE: keep each entry tight and focused (~1-3 pages) with a descriptive retrieval-friendly title \u2014 retrieval surfaces whole entries, so small dense entries beat bulk dumps. Split large corpora into focused entries, then run a retrieval self-test via vo_private_knowledge_context before relying on the knowledge.";
+var contextDescription = "Retrieves prompt-ready private knowledge context for the authenticated operator. Returns snippets/context only; no raw corpus download. Also the retrieval self-test surface: after upserting critical knowledge, query for it here and confirm the entry surfaces before trusting it in downstream work.";
+function isKnowledgeClass(value) {
+  return typeof value === "string" && KNOWLEDGE_CLASSES.includes(value);
+}
+function isUpsertInput(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const input = value;
+  return isKnowledgeClass(input["knowledge_class"]) && typeof input["source_path"] === "string" && typeof input["title"] === "string" && typeof input["content"] === "string";
+}
+function isContextInput(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const input = value;
+  if (typeof input["query"] !== "string") return false;
+  if (input["limit"] !== void 0 && typeof input["limit"] !== "number") return false;
+  if (input["knowledge_class"] !== void 0 && !isKnowledgeClass(input["knowledge_class"])) return false;
+  return true;
+}
+async function getCloudAuth(fetchFn) {
+  const controlPlaneUrl = process.env["VO_CONTROL_PLANE_URL"]?.replace(/\/+$/, "");
+  if (!controlPlaneUrl) {
+    return { ok: false, reason: "VO_CONTROL_PLANE_URL not set \u2014 cloud mode disabled" };
+  }
+  const { createAuthTokenSourceFromEnv: createAuthTokenSourceFromEnv2 } = await Promise.resolve().then(() => (init_auth_token_source(), auth_token_source_exports));
+  const { readStoredCredential: readStoredCredential2 } = await Promise.resolve().then(() => (init_credential_store(), credential_store_exports));
+  const tokenSource = createAuthTokenSourceFromEnv2(process.env, fetchFn, () => readStoredCredential2(process.env));
+  if (!tokenSource) return { ok: false, reason: "No auth configured. Run `vo-mcp login`." };
+  const token = await tokenSource.getToken();
+  if (!token) return { ok: false, reason: "Failed to obtain auth token. Run `vo-mcp login` again." };
+  return { ok: true, controlPlaneUrl, token };
+}
+async function callPrivateKnowledge(path3, body, fetchFn) {
+  const auth = await getCloudAuth(fetchFn);
+  if (!auth.ok) return { ok: false, reason: auth.reason };
+  const response = await fetchFn(`${auth.controlPlaneUrl}${path3}`, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${auth.token}`,
+      "content-type": "application/json"
+    },
+    body: JSON.stringify(body)
+  });
+  const text = await response.text();
+  const parsed = text ? JSON.parse(text) : null;
+  if (response.status < 200 || response.status >= 300) {
+    return { ok: false, status: response.status, response: parsed ?? text };
+  }
+  return parsed;
+}
+async function handlePrivateKnowledgeUpsert(_deps, rawInput, _signal, fetchFn = globalThis.fetch) {
+  if (!isUpsertInput(rawInput)) {
+    throw invalidParams(UPSERT_TOOL_NAME, "expected { knowledge_class, source_path, title, content }.");
+  }
+  const payload = await callPrivateKnowledge("/api/v1/knowledge/private", rawInput, fetchFn);
+  const envelope = {
+    tool: UPSERT_TOOL_NAME,
+    schema_version: 1,
+    payload
+  };
+  if (rawInput.content.length > PRECISION_CHAR_BUDGET) {
+    envelope.precision_note = `content is ${rawInput.content.length} chars (> ${PRECISION_CHAR_BUDGET}). Tight 1-3 page entries retrieve better \u2014 consider splitting into focused entries, then re-test retrieval via ${CONTEXT_TOOL_NAME}.`;
+  }
+  return jsonContent(envelope);
+}
+async function handlePrivateKnowledgeContext(_deps, rawInput, _signal, fetchFn = globalThis.fetch) {
+  if (!isContextInput(rawInput)) {
+    throw invalidParams(CONTEXT_TOOL_NAME, "expected { query, optional limit, optional knowledge_class }.");
+  }
+  const payload = await callPrivateKnowledge("/api/v1/knowledge/private/context", rawInput, fetchFn);
+  return jsonContent({ tool: CONTEXT_TOOL_NAME, schema_version: 1, payload });
+}
+
+// src/tools/hq/whiteboard.ts
+init_auth_token_source();
+init_credential_store();
+init_common();
+var POST_TOOL_NAME = "hq_whiteboard_post";
+var READ_TOOL_NAME = "hq_whiteboard_read";
+var postDescription = "Post an append-only coordination note to the live AlgoHQ whiteboard. Uses the scoped credential from vo-mcp login; operator and tenant ownership are derived by the server.";
+var readDescription = "Read recent coordination notes from the caller's live AlgoHQ whiteboard. Uses the scoped credential from vo-mcp login and cannot widen tenant scope.";
+var postInputSchema = {
+  type: "object",
+  properties: {
+    from: { type: "string", minLength: 1, maxLength: 100, description: "Agent/session display name." },
+    type: { type: "string", minLength: 1, maxLength: 64, description: "Message kind, such as intent, worklog, blocker, or completion." },
+    content: { type: "string", minLength: 1, maxLength: 500, description: "Short coordination note." },
+    targetAgent: { type: "string", maxLength: 100 },
+    tester: { type: "string", maxLength: 100 },
+    tier: { type: "string", maxLength: 32 }
+  },
+  required: ["from", "type", "content"],
+  additionalProperties: false
+};
+var readInputSchema = {
   type: "object",
   properties: {
-    action: {
-      type: "string",
-      enum: ["pull", "push"],
-      description: "pull: download cloud memory to local files. push: upload local files to cloud."
-    },
-    cwd: {
-      type: "string",
-      description: "Working directory to derive project slug from (default: process.cwd())."
-    }
+    limit: { type: "integer", minimum: 1, maximum: 100, default: 25 },
+    since: { type: "string", description: "Optional ISO-8601 lower bound." },
+    type: { type: "string", minLength: 1, maxLength: 64 }
   },
-  required: ["action"],
   additionalProperties: false
 };
-var description22 = "Syncs memory entries between local ~/.claude/projects/<slug>/memory/ and cloud control-plane /api/v1/agent-config/memory/me. Requires operator auth (vo-mcp login). Actions: pull (cloud\u2192local), push (local\u2192cloud). Idempotent; push creates/updates as needed.";
-function isToolInput22(v) {
-  if (typeof v !== "object" || v === null) return false;
-  const o = v;
-  if (o["action"] !== "pull" && o["action"] !== "push") return false;
-  if (o["cwd"] !== void 0 && typeof o["cwd"] !== "string") return false;
-  return true;
+function resolveTimeoutMs() {
+  const parsed = Number(process.env["HQ_WHITEBOARD_TIMEOUT_MS"]);
+  return Number.isFinite(parsed) && parsed >= 10 && parsed <= 12e4 ? parsed : 1e4;
 }
-function deriveProjectSlug(cwd) {
-  const normalized = cwd.replace(/\\/g, "/");
-  return normalized.replace(/^([A-Z]):/i, (_, drive) => `${drive.toUpperCase()}-`).replace(/\/$/g, "").split("/").join("--").replace(/\s+/g, "-");
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function getMemoryDir(cwd) {
-  const slug = deriveProjectSlug(cwd);
-  return join7(homedir5(), ".claude", "projects", slug, "memory");
+function onlyKeys(value, allowed) {
+  return Object.keys(value).every((key) => allowed.includes(key));
 }
-async function pullMemory(controlPlaneUrl, token, memoryDir, sessionId, fetchFn) {
-  const url = `${controlPlaneUrl}/api/v1/agent-config/memory/me`;
-  const response = await fetchFn(url, {
-    method: "GET",
-    headers: {
-      authorization: `Bearer ${token}`
-    }
-  });
-  if (response.status !== 200) {
-    const text = await response.text();
-    throw new Error(`GET /api/v1/agent-config/memory/me returned HTTP ${response.status}: ${text.slice(0, 200)}`);
-  }
-  const data = JSON.parse(await response.text());
-  if (!data.ok || !Array.isArray(data.entries)) {
-    throw new Error("GET /api/v1/agent-config/memory/me response missing ok=true or entries array");
-  }
-  mkdirSync4(memoryDir, { recursive: true });
-  const files = [];
-  for (const entry of data.entries) {
-    const filePath = join7(memoryDir, entry.file_name);
-    writeFileSync3(filePath, entry.content, "utf8");
-    files.push(entry.file_name);
+function isBoundedString(value, min, max) {
+  return typeof value === "string" && value.trim().length >= min && value.trim().length <= max;
+}
+function parsePostInput(value) {
+  if (!isRecord(value) || !onlyKeys(value, ["from", "type", "content", "targetAgent", "tester", "tier"])) return null;
+  if (!isBoundedString(value["from"], 1, 100)) return null;
+  if (!isBoundedString(value["type"], 1, 64) || !/^[a-zA-Z0-9_-]+$/.test(value["type"].trim())) return null;
+  if (!isBoundedString(value["content"], 1, 500)) return null;
+  for (const [key, max] of [["targetAgent", 100], ["tester", 100], ["tier", 32]]) {
+    if (value[key] !== void 0 && !isBoundedString(value[key], 0, max)) return null;
   }
-  return { pulled: data.entries.length, files };
+  return {
+    from: value["from"].trim(),
+    type: value["type"].trim(),
+    content: value["content"].trim(),
+    ...typeof value["targetAgent"] === "string" ? { targetAgent: value["targetAgent"].trim() } : {},
+    ...typeof value["tester"] === "string" ? { tester: value["tester"].trim() } : {},
+    ...typeof value["tier"] === "string" ? { tier: value["tier"].trim() } : {}
+  };
 }
-async function pushMemory(controlPlaneUrl, token, memoryDir, sessionId, fetchFn) {
-  if (!existsSync5(memoryDir)) {
-    return { pushed: 0, created: 0, updated: 0 };
+function parseReadInput(value) {
+  if (!isRecord(value) || !onlyKeys(value, ["limit", "since", "type"])) return null;
+  if (value["limit"] !== void 0 && (!Number.isInteger(value["limit"]) || Number(value["limit"]) < 1 || Number(value["limit"]) > 100)) return null;
+  if (value["since"] !== void 0 && (typeof value["since"] !== "string" || Number.isNaN(Date.parse(value["since"])))) return null;
+  if (value["type"] !== void 0 && !isBoundedString(value["type"], 1, 64)) return null;
+  return {
+    ...typeof value["limit"] === "number" ? { limit: value["limit"] } : {},
+    ...typeof value["since"] === "string" ? { since: value["since"] } : {},
+    ...typeof value["type"] === "string" ? { type: value["type"].trim() } : {}
+  };
+}
+async function resolveCloud(fetchFn) {
+  const url = process.env["VO_CONTROL_PLANE_URL"]?.trim().replace(/\/$/, "");
+  if (!url) return null;
+  try {
+    const source = createAuthTokenSourceFromEnv(process.env, fetchFn, () => readStoredCredential(process.env));
+    const token = await source?.getToken();
+    return token ? { url, token } : null;
+  } catch {
+    return null;
   }
-  const localFiles = readdirSync4(memoryDir).filter((f) => f.endsWith(".md")).map((f) => ({
-    file_name: f,
-    content: readFileSync7(join7(memoryDir, f), "utf8"),
-    entry_type: f === "MEMORY.md" ? "index" : "topic"
-  }));
-  if (localFiles.length === 0) {
-    return { pushed: 0, created: 0, updated: 0 };
+}
+async function callWhiteboard(method, bodyOrQuery, signal, fetchFn = fetch) {
+  const cloud = await resolveCloud(fetchFn);
+  if (!cloud) {
+    return {
+      ok: false,
+      error: "hq_whiteboard_not_configured",
+      message: "Set VO_CONTROL_PLANE_URL and run vo-mcp login to install a scoped HQ credential."
+    };
   }
-  const getUrl = `${controlPlaneUrl}/api/v1/agent-config/memory/me`;
-  const getResponse = await fetchFn(getUrl, {
-    method: "GET",
-    headers: {
-      authorization: `Bearer ${token}`
-    }
-  });
-  const existingMap = /* @__PURE__ */ new Map();
-  if (getResponse.status === 200) {
-    const getData = JSON.parse(await getResponse.text());
-    if (getData.ok && Array.isArray(getData.entries)) {
-      for (const entry of getData.entries) {
-        existingMap.set(entry.file_name, entry.memory_id);
-      }
-    }
+  const timeoutSignal = AbortSignal.timeout(resolveTimeoutMs());
+  const requestSignal = signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal;
+  const query = new URLSearchParams();
+  if (method === "GET") {
+    const input = bodyOrQuery;
+    query.set("limit", String(input.limit ?? 25));
+    if (input.since) query.set("since", input.since);
+    if (input.type) query.set("type", input.type);
   }
-  let created = 0;
-  let updated = 0;
-  for (const localFile of localFiles) {
-    const memoryId = existingMap.get(localFile.file_name);
-    if (memoryId) {
-      const updateUrl = `${controlPlaneUrl}/api/v1/agent-config/memory/${memoryId}`;
-      const updateBody = {
-        content: localFile.content,
-        session_id: sessionId
-      };
-      const updateResponse = await fetchFn(updateUrl, {
-        method: "PUT",
-        headers: {
-          authorization: `Bearer ${token}`,
-          "content-type": "application/json"
-        },
-        body: JSON.stringify(updateBody)
-      });
-      if (updateResponse.status !== 200) {
-        const text = await updateResponse.text();
-        throw new Error(
-          `PUT /api/v1/agent-config/memory/${memoryId} returned HTTP ${updateResponse.status}: ${text.slice(0, 200)}`
-        );
-      }
-      const updateData = JSON.parse(await updateResponse.text());
-      if (!updateData.ok) {
-        throw new Error(`PUT /api/v1/agent-config/memory/${memoryId} returned ok=false`);
-      }
-      updated++;
-    } else {
-      const createUrl = `${controlPlaneUrl}/api/v1/agent-config/memory/me`;
-      const createBody = {
-        entry_type: localFile.entry_type,
-        file_name: localFile.file_name,
-        content: localFile.content,
-        session_id: sessionId
-      };
-      const createResponse = await fetchFn(createUrl, {
-        method: "POST",
+  try {
+    const response = await fetchFn(
+      `${cloud.url}/api/v1/hq/whiteboard/messages${query.size ? `?${query}` : ""}`,
+      {
+        method,
         headers: {
-          authorization: `Bearer ${token}`,
-          "content-type": "application/json"
+          Authorization: `Bearer ${cloud.token}`,
+          ...method === "POST" ? { "Content-Type": "application/json" } : {}
         },
-        body: JSON.stringify(createBody)
-      });
-      if (createResponse.status !== 200 && createResponse.status !== 201) {
-        const text = await createResponse.text();
-        throw new Error(
-          `POST /api/v1/agent-config/memory/me returned HTTP ${createResponse.status}: ${text.slice(0, 200)}`
-        );
-      }
-      const createData = JSON.parse(await createResponse.text());
-      if (!createData.ok) {
-        throw new Error("POST /api/v1/agent-config/memory/me returned ok=false");
+        ...method === "POST" ? { body: JSON.stringify(bodyOrQuery) } : {},
+        signal: requestSignal
       }
-      created++;
-    }
-  }
-  return { pushed: localFiles.length, created, updated };
-}
-async function handleSyncConfig(deps, rawInput, _signal, fetchFn = globalThis.fetch) {
-  if (!isToolInput22(rawInput)) {
-    throw invalidParams(
-      TOOL_NAME22,
-      'invalid input. Required: { action: "pull" | "push" }. Optional: { cwd: "<path>" }.'
     );
-  }
-  const controlPlaneUrl = process.env["VO_CONTROL_PLANE_URL"];
-  if (!controlPlaneUrl) {
-    return jsonContent({
-      tool: TOOL_NAME22,
-      schema_version: 1,
-      payload: {
-        synced: false,
-        reason: "VO_CONTROL_PLANE_URL not set \u2014 cloud mode disabled"
-      }
-    });
-  }
-  const { createAuthTokenSourceFromEnv: createAuthTokenSourceFromEnv2 } = await Promise.resolve().then(() => (init_auth_token_source(), auth_token_source_exports));
-  const { readStoredCredential: readStoredCredential2 } = await Promise.resolve().then(() => (init_credential_store(), credential_store_exports));
-  const tokenSource = createAuthTokenSourceFromEnv2(process.env, fetchFn, () => readStoredCredential2(process.env));
-  if (!tokenSource) {
-    return jsonContent({
-      tool: TOOL_NAME22,
-      schema_version: 1,
-      payload: {
-        synced: false,
-        reason: "No auth configured. Run `vo-mcp login` to authenticate as an operator."
-      }
-    });
-  }
-  const token = await tokenSource.getToken();
-  if (!token) {
-    return jsonContent({
-      tool: TOOL_NAME22,
-      schema_version: 1,
-      payload: {
-        synced: false,
-        reason: "Failed to obtain auth token. Run `vo-mcp login` to re-authenticate."
-      }
-    });
-  }
-  const cwd = rawInput.cwd?.trim() || process.cwd();
-  const memoryDir = getMemoryDir(cwd);
-  try {
-    if (rawInput.action === "pull") {
-      const result = await pullMemory(
-        controlPlaneUrl.replace(/\/+$/, ""),
-        token,
-        memoryDir,
-        deps.sessionId,
-        fetchFn
-      );
-      return jsonContent({
-        tool: TOOL_NAME22,
-        schema_version: 1,
-        payload: {
-          synced: true,
-          action: "pull",
-          pulled: result.pulled,
-          files: result.files,
-          memory_dir: memoryDir
-        }
-      });
-    } else {
-      const result = await pushMemory(
-        controlPlaneUrl.replace(/\/+$/, ""),
-        token,
-        memoryDir,
-        deps.sessionId,
-        fetchFn
-      );
-      return jsonContent({
-        tool: TOOL_NAME22,
-        schema_version: 1,
-        payload: {
-          synced: true,
-          action: "push",
-          pushed: result.pushed,
-          created: result.created,
-          updated: result.updated,
-          memory_dir: memoryDir
-        }
-      });
+    const text = await response.text();
+    let payload;
+    try {
+      payload = JSON.parse(text);
+    } catch {
+      payload = { ok: false, error: "invalid_response", message: text.slice(0, 200) };
     }
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    return jsonContent({
-      tool: TOOL_NAME22,
-      schema_version: 1,
-      payload: {
-        synced: false,
-        reason: `Sync failed: ${message}`
-      }
-    });
+    if (!response.ok) {
+      return { ok: false, error: "hq_whiteboard_http_error", status: response.status, response: payload };
+    }
+    return payload;
+  } catch (error) {
+    return {
+      ok: false,
+      error: signal?.aborted ? "cancelled" : timeoutSignal.aborted ? "hq_whiteboard_timeout" : "hq_whiteboard_unreachable",
+      message: error instanceof Error ? error.message.slice(0, 200) : String(error).slice(0, 200)
+    };
   }
 }
+async function handleHqWhiteboardPost(_deps, rawInput, signal) {
+  const input = parsePostInput(rawInput);
+  if (!input) throw invalidParams(POST_TOOL_NAME, "requires from, type, and 1-500 character content; unknown fields are rejected");
+  return jsonContent(await callWhiteboard("POST", input, signal));
+}
+async function handleHqWhiteboardRead(_deps, rawInput, signal) {
+  const input = parseReadInput(rawInput);
+  if (!input) throw invalidParams(READ_TOOL_NAME, "limit must be 1-100, since must be ISO-8601, and unknown fields are rejected");
+  return jsonContent(await callWhiteboard("GET", input, signal));
+}
 
 // src/server.ts
 function buildToolRegistry() {
@@ -5392,6 +5913,38 @@ function buildToolRegistry() {
         inputSchema: inputSchema22
       },
       handler: handleSyncConfig
+    },
+    [UPSERT_TOOL_NAME]: {
+      definition: {
+        name: UPSERT_TOOL_NAME,
+        description: upsertDescription,
+        inputSchema: upsertInputSchema
+      },
+      handler: handlePrivateKnowledgeUpsert
+    },
+    [CONTEXT_TOOL_NAME]: {
+      definition: {
+        name: CONTEXT_TOOL_NAME,
+        description: contextDescription,
+        inputSchema: contextInputSchema
+      },
+      handler: handlePrivateKnowledgeContext
+    },
+    [POST_TOOL_NAME]: {
+      definition: {
+        name: POST_TOOL_NAME,
+        description: postDescription,
+        inputSchema: postInputSchema
+      },
+      handler: handleHqWhiteboardPost
+    },
+    [READ_TOOL_NAME]: {
+      definition: {
+        name: READ_TOOL_NAME,
+        description: readDescription,
+        inputSchema: readInputSchema
+      },
+      handler: handleHqWhiteboardRead
     }
   };
 }
@@ -5569,6 +6122,9 @@ function createSqliteCache(options) {
   };
 }
 
+// src/cli.ts
+init_events_writer();
+
 // src/ratchets/stub-client.ts
 var HOLLOW_PATTERNS = [
   {
@@ -5656,6 +6212,8 @@ function buildSummary2(args) {
 }
 
 // src/consensus/engine-client.ts
+init_events_writer();
+init_common();
 import { randomUUID as randomUUID3 } from "node:crypto";
 
 // src/consensus/null-client.ts
@@ -5678,6 +6236,64 @@ function createNullConsensusEngineClient(reason = NULL_CLIENT_DEFAULT_REASON) {
   };
 }
 
+// src/consensus/meta-model-caller.ts
+var META_MODEL_API_BASE_URL = "https://api.meta.ai/v1";
+var META_CONSENSUS_MODEL = "muse-spark-1.1";
+var META_MODEL_API_KEY_ENV = "MODEL_API_KEY";
+var META_MODEL_API_KEY_ALIAS = "META_API";
+function resolveMetaKey(env) {
+  return String(env[META_MODEL_API_KEY_ENV] || env[META_MODEL_API_KEY_ALIAS] || "").trim();
+}
+function positiveMaxTokens(value) {
+  const parsed = Math.floor(Number(value));
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : 2048;
+}
+function createMetaModelCaller(options = {}) {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const envSource = options.envSource ?? process.env;
+  const reasoningEffort = options.reasoningEffort ?? "high";
+  return async function callMetaWithMetrics2(prompt, systemPrompt, model, maxTokens, _privacyOptions, signal) {
+    const key = resolveMetaKey(envSource);
+    if (!key) throw new Error(`Missing ${META_MODEL_API_KEY_ENV} for Meta Model API`);
+    const messages = [
+      ...systemPrompt ? [{ role: "system", content: systemPrompt }] : [],
+      { role: "user", content: prompt }
+    ];
+    const response = await fetchImpl(`${META_MODEL_API_BASE_URL}/chat/completions`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${key}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        model: model || META_CONSENSUS_MODEL,
+        messages,
+        max_tokens: positiveMaxTokens(maxTokens),
+        reasoning_effort: reasoningEffort
+      }),
+      signal
+    });
+    const payload = await response.json();
+    if (!response.ok) {
+      const message = String(payload.error?.message || response.statusText || "request failed").slice(0, 500);
+      throw Object.assign(new Error(`Meta Model API ${response.status}: ${message}`), { status: response.status });
+    }
+    const content = payload.choices?.[0]?.message?.content;
+    if (typeof content !== "string" || !content.trim()) {
+      throw new Error(`Meta Model API returned no text (finish=${payload.choices?.[0]?.finish_reason || "unknown"})`);
+    }
+    const inputTokens = Number(payload.usage?.prompt_tokens || 0);
+    const outputTokens = Number(payload.usage?.completion_tokens || 0);
+    return {
+      content,
+      inputTokens,
+      outputTokens,
+      totalTokens: Number(payload.usage?.total_tokens || inputTokens + outputTokens)
+    };
+  };
+}
+var callMetaWithMetrics = createMetaModelCaller();
+
 // src/consensus/engine-options.ts
 var AGREEMENT_GATE_ENV_VAR = "VO_CONSENSUS_AGREEMENT_GATE";
 function isTruthyFlag(raw) {
@@ -5724,6 +6340,25 @@ function mapFanOutDiagnostics(fd) {
     refused: fd.refused
   };
 }
+var SHADOW_SYNTHESIS_ENV_VAR = "VO_CONSENSUS_SHADOW";
+function shadowEnabled(env) {
+  const raw = (env ?? {})[SHADOW_SYNTHESIS_ENV_VAR];
+  if (raw === void 0) return true;
+  const norm = raw.trim().toLowerCase();
+  return !(norm === "0" || norm === "false" || norm === "no" || norm === "off" || norm === "");
+}
+function mapShadowSynthesis(s) {
+  if (s === void 0) return void 0;
+  return {
+    incumbent: { verdict: s.incumbent.verdict, confidence: s.incumbent.confidence, synthesizer: s.incumbent.synthesizer },
+    adaptive: {
+      verdict: s.adaptive.verdict,
+      confidence: s.adaptive.confidence,
+      ...s.adaptive.calibrated_confidence !== void 0 ? { calibrated_confidence: s.adaptive.calibrated_confidence } : {}
+    },
+    agree: s.agree
+  };
+}
 function mapCitationGrade(cg) {
   if (cg === void 0) return void 0;
   return {
@@ -5864,7 +6499,12 @@ function createEngineConsensusClient(options) {
         const engineOptions = {
           panel,
           ...options.per_model_timeout_ms !== void 0 ? { per_model_timeout_ms: options.per_model_timeout_ms } : {},
-          ...agreementGate !== void 0 ? { agreement_gate: agreementGate } : {}
+          ...agreementGate !== void 0 ? { agreement_gate: agreementGate } : {},
+          // Stage A7-shadow: run the adaptive verdict alongside the live one for grading.
+          // Cheap (pure log-odds over already-fetched verdicts; no extra model calls),
+          // PII-free, and never alters the live verdict. ON by default; kill with
+          // VO_CONSENSUS_SHADOW=0. Cold-start has no skill registry → neutral priors.
+          shadow_synthesis: { enabled: shadowEnabled(options.env) }
         };
         const sources = request.source_urls;
         const useSourceGrounded = sources !== void 0 && sources.length > 0 && typeof engine.runSourceGroundedConsensus === "function";
@@ -5920,6 +6560,8 @@ function createEngineConsensusClient(options) {
           ...sourceExtras?.escalation_reason !== void 0 ? { escalation_reason: sourceExtras.escalation_reason } : response.escalation_reason !== void 0 ? { escalation_reason: response.escalation_reason } : {},
           // Feature 1 (agreement-gate) — fan-out diagnostics (additive telemetry).
           ...mapFanOutDiagnostics(response.fan_out_diagnostics) !== void 0 ? { fan_out_diagnostics: mapFanOutDiagnostics(response.fan_out_diagnostics) } : {},
+          // Stage A7-shadow — adaptive-vs-incumbent comparison (PII-free; present iff shadow on).
+          ...mapShadowSynthesis(response.shadow_synthesis) !== void 0 ? { shadow_synthesis: mapShadowSynthesis(response.shadow_synthesis) } : {},
           // Source-grounded additive outputs (Tier-4 features).
           ...useSourceGrounded ? { source_grounded: true } : {},
           ...sourceExtras?.citation_grade !== void 0 ? { citation_grade: sourceExtras.citation_grade } : {},
@@ -5946,7 +6588,8 @@ var DEFAULT_MODELS = {
   // callGeminiWithMetrics; 2.5-pro REJECTS budget 0 ("only works in thinking mode").
   // Flash is also ~10x cheaper. 2026-06-02.
   google: "gemini-2.5-flash",
-  deepseek: "deepseek-chat"
+  deepseek: "deepseek-chat",
+  meta: META_CONSENSUS_MODEL
 };
 function probeProviders(env = process.env) {
   const out = [];
@@ -5954,6 +6597,7 @@ function probeProviders(env = process.env) {
   if ((env["OPENAI_API_KEY"] ?? "").trim().length > 0) out.push("openai");
   if ((env["GOOGLE_API_KEY"] ?? "").trim().length > 0) out.push("google");
   if ((env["DEEPSEEK_API_KEY"] ?? "").trim().length > 0) out.push("deepseek");
+  if ((env[META_MODEL_API_KEY_ENV] ?? "").trim().length > 0 || (env[META_MODEL_API_KEY_ALIAS] ?? "").trim().length > 0) out.push("meta");
   return out;
 }
 async function loadFactoryAndCallers(injectedEngine, injectedShared) {
@@ -5999,21 +6643,24 @@ async function tryCreateEngineConsensusClientFromEnvAsync(options = {}) {
     anthropic: loaded.shared.callAnthropicWithMetrics,
     openai: loaded.shared.callOpenAIWithMetrics,
     google: loaded.shared.callGeminiWithMetrics,
-    deepseek: loaded.shared.callDeepSeekWithMetrics
+    deepseek: loaded.shared.callDeepSeekWithMetrics,
+    meta: options.metaCaller ?? callMetaWithMetrics
   };
   const modelByProvider = {
     anthropic: options.models?.anthropic ?? DEFAULT_MODELS.anthropic,
     openai: options.models?.openai ?? DEFAULT_MODELS.openai,
     google: options.models?.google ?? DEFAULT_MODELS.google,
-    deepseek: options.models?.deepseek ?? DEFAULT_MODELS.deepseek
+    deepseek: options.models?.deepseek ?? DEFAULT_MODELS.deepseek,
+    meta: options.models?.meta ?? DEFAULT_MODELS.meta
   };
+  const adapterEnv = !(env[META_MODEL_API_KEY_ENV] ?? "").trim() && (env[META_MODEL_API_KEY_ALIAS] ?? "").trim() ? { ...env, [META_MODEL_API_KEY_ENV]: env[META_MODEL_API_KEY_ALIAS] } : env;
   const panel = [];
   for (const p of providers) {
     try {
       const adapter = loaded.engine.createAdapter(p, {
         model: modelByProvider[p],
         caller: callerByProvider[p],
-        envSource: env
+        envSource: adapterEnv
       });
       panel.push(adapter);
     } catch {
@@ -6170,6 +6817,68 @@ function tryCreateMoatConsensusClientFromEnv(env = process.env, fetchFn) {
   });
 }
 
+// src/consensus/fallback-client.ts
+var MIN_VALID_LOCAL_VERDICTS = 2;
+var INSUFFICIENT_LOCAL_VERDICTS_REASON = "local-panel-insufficient-valid-verdicts";
+function createConsensusFallbackClient(primary, fallback, options = {}) {
+  return {
+    async run(request) {
+      const primaryResult = await primary.run(request);
+      if (request.signal?.aborted || !primaryResult.ok && primaryResult.reason === CANCELLED_REASON) {
+        return primaryResult;
+      }
+      if (primaryResult.ok) {
+        const validVerdicts = primaryResult.per_model_verdicts.filter(
+          (verdict) => verdict.verdict !== "error"
+        );
+        if (validVerdicts.length >= MIN_VALID_LOCAL_VERDICTS) return primaryResult;
+        options.onFallback?.(INSUFFICIENT_LOCAL_VERDICTS_REASON);
+        return fallback.run(request);
+      }
+      options.onFallback?.(primaryResult.reason);
+      return fallback.run(request);
+    }
+  };
+}
+
+// src/consensus/local-credential-env.ts
+import { createRequire as createRequire2 } from "node:module";
+var require2 = createRequire2(import.meta.url);
+var KEY_SERVICE = "algosuite-vo";
+var KEYCHAIN_TARGETS = [
+  { account: "anthropic-api-key", envVar: "ANTHROPIC_API_KEY" },
+  { account: "openai-api-key", envVar: "OPENAI_API_KEY" },
+  { account: "meta-api-key", envVar: "MODEL_API_KEY" }
+];
+function loadEntryCtor() {
+  try {
+    return require2("@napi-rs/keyring").Entry ?? null;
+  } catch {
+    return null;
+  }
+}
+function readKey(EntryCtor, account) {
+  try {
+    return new EntryCtor(KEY_SERVICE, account).getPassword()?.trim() || null;
+  } catch {
+    return null;
+  }
+}
+function withLocalConsensusCredentials(baseEnv = process.env, options = {}) {
+  const env = { ...baseEnv };
+  if (!env.OPENAI_API_KEY?.trim() && env.CODEX_API_KEY?.trim()) {
+    env.OPENAI_API_KEY = env.CODEX_API_KEY;
+  }
+  const EntryCtor = options.EntryCtor === void 0 ? loadEntryCtor() : options.EntryCtor;
+  if (!EntryCtor) return env;
+  for (const target of KEYCHAIN_TARGETS) {
+    if (env[target.envVar]?.trim()) continue;
+    const key = readKey(EntryCtor, target.account);
+    if (key) env[target.envVar] = key;
+  }
+  return env;
+}
+
 // src/cloud/login.ts
 init_credential_store();
 import { createServer as createServer2 } from "node:http";
@@ -6204,7 +6913,7 @@ function processCapture(rawBody, expectedState, store) {
   };
 }
 function captureHtml() {
-  return `<!doctype html><html><head><meta charset="utf-8"><title>VO login</title></head>
+  return `<!doctype html><html><head><meta charset="utf-8"><title>AlgoHQ login</title></head>
 <body style="font-family:system-ui;max-width:32rem;margin:4rem auto;text-align:center">
 <h2 id="m">Completing sign-in\u2026</h2>
 <script>
@@ -6235,7 +6944,7 @@ async function runLogin(opts = {}) {
   const nowIso = opts.nowIso ?? (() => (/* @__PURE__ */ new Date()).toISOString());
   const openBrowser = opts.openBrowser ?? defaultOpenBrowser;
   const state = randomBytes(32).toString("base64url");
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     let settled = false;
     const finish = (err, result) => {
       if (settled) return;
@@ -6243,7 +6952,7 @@ async function runLogin(opts = {}) {
       clearTimeout(timer);
       server.close();
       if (err) reject(err);
-      else resolve(result);
+      else resolve2(result);
     };
     const server = createServer2((req, res) => {
       const url = new URL(req.url ?? "/", "http://127.0.0.1");
@@ -6291,7 +7000,7 @@ async function runLogin(opts = {}) {
               result = { ...capt.email ? { email: capt.email } : {}, credentialPath: path3 };
             }
             res.writeHead(outcome.httpStatus, { "content-type": "text/html; charset=utf-8" });
-            res.end(outcome.ok ? "<h2>VO login complete \u2014 you can close this tab.</h2>" : `<h2>Login failed: ${outcome.error}</h2>`);
+            res.end(outcome.ok ? "<h2>AlgoHQ login complete \u2014 you can close this tab.</h2>" : `<h2>Login failed: ${outcome.error}</h2>`);
             finish(outcome.ok ? null : new Error(outcome.error ?? "login failed"), result);
           })();
         });
@@ -6354,6 +7063,7 @@ async function exchangeForVoCredential(opts) {
 }
 
 // src/cli.ts
+init_common();
 function defaultCacheDbPath() {
   const env = process.env["VO_MCP_DB_PATH"];
   if (env && env.length > 0) return env;
@@ -6432,11 +7142,23 @@ async function main() {
   const ratchets = createStubRatchetClient();
   const testModule = process.env["VO_MCP_TEST_ENGINE_MODULE"];
   const testClient = testModule !== void 0 && testModule.length > 0 ? await loadTestEngineClient(testModule) : null;
+  const localEnv = withLocalConsensusCredentials();
+  const localProviders = probeProviders(localEnv);
+  for (const key of ["ANTHROPIC_API_KEY", "OPENAI_API_KEY", "GOOGLE_API_KEY", "DEEPSEEK_API_KEY", "MODEL_API_KEY"]) {
+    if (!process.env[key] && localEnv[key]) process.env[key] = localEnv[key];
+  }
+  const localConsensus = tryCreateEngineConsensusClientFromEnv({ envSource: localEnv });
   const cloudConsensus = testClient ? null : tryCreateMoatConsensusClientFromEnv();
-  if (cloudConsensus) {
-    console.error("[vo-mcp] cloud consensus active \u2014 verdicts via vo-moat-plane (no local model keys)");
+  let consensus = testClient ?? localConsensus;
+  if (!testClient && cloudConsensus && localProviders.length >= 2) {
+    console.error(`[vo-mcp] local-first consensus active (${localProviders.join(", ")}); cloud moat is fallback-only`);
+    consensus = createConsensusFallbackClient(localConsensus, cloudConsensus, {
+      onFallback: (reason) => console.error(`[vo-mcp] local consensus unavailable (${reason}); using cloud moat fallback`)
+    });
+  } else if (!testClient && cloudConsensus) {
+    console.error("[vo-mcp] fewer than 2 linked local providers; cloud moat consensus active");
+    consensus = cloudConsensus;
   }
-  const consensus = testClient ?? cloudConsensus ?? tryCreateEngineConsensusClientFromEnv();
   let adminCallables = null;
   try {
     adminCallables = buildAdminCallableClientFromEnv();
@@ -6486,6 +7208,31 @@ if (process.argv[2] === "login") {
     console.error("[vo-mcp] login failed:", err instanceof Error ? err.message : String(err));
     process.exit(1);
   });
+} else if (process.argv[2] === "sync") {
+  const action = process.argv[3];
+  if (action !== "push" && action !== "pull") {
+    console.error("[vo-mcp] usage: vo-mcp sync <push|pull> [--cwd <path>]");
+    process.exit(2);
+  }
+  const cwdFlag = process.argv.indexOf("--cwd");
+  const cwd = cwdFlag >= 0 && typeof process.argv[cwdFlag + 1] === "string" ? process.argv[cwdFlag + 1] : process.cwd();
+  const sessionId = randomUUID5();
+  Promise.resolve().then(() => (init_sync_config(), sync_config_exports)).then(async ({ runMemorySync: runMemorySync2, isNoopSyncReason: isNoopSyncReason2 }) => {
+    const r = await runMemorySync2(action, cwd, sessionId);
+    if (r.synced) {
+      console.error(`[vo-mcp] sync ${action} ok: ${JSON.stringify(r)}`);
+      process.exit(0);
+    }
+    if (isNoopSyncReason2(r.reason)) {
+      console.error(`[vo-mcp] sync ${action} skipped: ${r.reason}`);
+      process.exit(0);
+    }
+    console.error(`[vo-mcp] sync ${action} failed: ${r.reason}`);
+    process.exit(1);
+  }).catch((err) => {
+    console.error("[vo-mcp] sync fatal:", err instanceof Error ? err.message : String(err));
+    process.exit(1);
+  });
 } else {
   main().catch((err) => {
     console.error("[vo-mcp] fatal:", err);