@algosuite/vo-mcp 0.2.0-beta.0 → 0.2.0-beta.10

package/dist/index.js

@@ -1122,9 +1122,15 @@ function createMemoryEventsWriter() {
 function readVoMcpVersion() {
   try {
     const here = dirname3(fileURLToPath2(import.meta.url));
-    const pkgPath = join4(here, "..", "..", "package.json");
-    const pkg = JSON.parse(readFileSync4(pkgPath, "utf8"));
-    return typeof pkg.version === "string" ? pkg.version : "0.0.0-unknown";
+    for (const rel of ["..", ["..", ".."], ["..", "..", ".."]]) {
+      try {
+        const segs = Array.isArray(rel) ? rel : [rel];
+        const pkg = JSON.parse(readFileSync4(join4(here, ...segs, "package.json"), "utf8"));
+        if (pkg.name === "@algosuite/vo-mcp" && typeof pkg.version === "string") return pkg.version;
+      } catch {
+      }
+    }
+    return "0.0.0-unknown";
   } catch {
     return "0.0.0-unknown";
   }
@@ -2044,6 +2050,8 @@ async function handleConsensusJudgment(deps, rawInput, signal) {
     ...engineResult.synthesized_verdict.confidence_badge !== void 0 ? { confidence_badge: engineResult.synthesized_verdict.confidence_badge } : {},
     // Feature 1 (agreement-gate) — fan-out diagnostics (present iff the gate ran).
     ...engineResult.fan_out_diagnostics !== void 0 ? { fan_out_diagnostics: engineResult.fan_out_diagnostics } : {},
+    // Stage A7-shadow — adaptive-vs-incumbent comparison (PII-free; present iff shadow on).
+    ...engineResult.shadow_synthesis !== void 0 ? { shadow_synthesis: engineResult.shadow_synthesis } : {},
     // Source-grounded Tier-4 outputs (present iff the call was source-grounded).
     ...engineResult.source_grounded === true ? { source_grounded: true } : {},
     ...engineResult.citation_grade !== void 0 ? { citation_grade: engineResult.citation_grade } : {},
@@ -4097,7 +4105,7 @@ var inputSchema13 = {
   properties: {},
   additionalProperties: false
 };
-var description13 = "Lists open VO-source pull requests with blocker / source / tester / specialist-context metadata. Read-only diagnostic for Command Center reads. Wraps `voListPendingPRs` admin Cloud Function. V1 stub: returns `verdict: 'unimplemented'` \u2014 cloud-mode wiring pending.";
+var description13 = "Lists open AlgoHQ-source pull requests with blocker / source / tester / specialist-context metadata. Read-only diagnostic for Command Center reads. Wraps `voListPendingPRs` admin Cloud Function. V1 stub: returns `verdict: 'unimplemented'` \u2014 cloud-mode wiring pending.";
 function isToolInput13(v) {
   return typeof v === "object" && v !== null;
 }
@@ -4133,7 +4141,7 @@ var inputSchema14 = {
   required: ["pr_number"],
   additionalProperties: false
 };
-var description14 = "Approves + merges a single VO-source pull request by number. Wraps `voMergePR` admin Cloud Function (server-side refuses non-VO PRs with permission-denied). V1 stub: returns `verdict: 'unimplemented'` \u2014 cloud-mode wiring pending.";
+var description14 = "Approves + merges a single AlgoHQ-source pull request by number. Wraps `voMergePR` admin Cloud Function (server-side refuses non-AlgoHQ PRs with permission-denied). V1 stub: returns `verdict: 'unimplemented'` \u2014 cloud-mode wiring pending.";
 function isToolInput14(v) {
   if (typeof v !== "object" || v === null) return false;
   const o = v;
@@ -4215,7 +4223,7 @@ var inputSchema16 = {
   properties: {},
   additionalProperties: false
 };
-var description16 = "Iterates all open VO-source pull requests and merges (or arms auto-merge) on each. Returns counts of merged / accepted / total plus per-PR results. Wraps `voApproveAllFixes` admin Cloud Function. V1 stub: returns `verdict: 'unimplemented'` \u2014 cloud-mode wiring pending.";
+var description16 = "Iterates all open AlgoHQ-source pull requests and merges (or arms auto-merge) on each. Returns counts of merged / accepted / total plus per-PR results. Wraps `voApproveAllFixes` admin Cloud Function. V1 stub: returns `verdict: 'unimplemented'` \u2014 cloud-mode wiring pending.";
 function isToolInput16(v) {
   return typeof v === "object" && v !== null;
 }
@@ -4249,7 +4257,7 @@ var inputSchema17 = {
   required: ["pr_number"],
   additionalProperties: false
 };
-var description17 = "Closes a VO pull request and dispatches a self-heal pass to retry the same focus page. Cloud callable refuses non-VO PRs and respects the self-heal kill switch + per-PR retry block. Wraps `voRejectAndRetry` admin Cloud Function. V1 stub: returns `verdict: 'unimplemented'` \u2014 cloud-mode wiring pending.";
+var description17 = "Closes an AlgoHQ pull request and dispatches a self-heal pass to retry the same focus page. Cloud callable refuses non-AlgoHQ PRs and respects the self-heal kill switch + per-PR retry block. Wraps `voRejectAndRetry` admin Cloud Function. V1 stub: returns `verdict: 'unimplemented'` \u2014 cloud-mode wiring pending.";
 function isToolInput17(v) {
   if (typeof v !== "object" || v === null) return false;
   const o = v;
@@ -4325,7 +4333,7 @@ function buildPrompt4(pr, notes) {
   const lines = [
     "You are a release gatekeeper deciding whether a pull request is safe to MERGE.",
     "Recommend exactly one of: merge / hold / reject. Be conservative \u2014 this is a high-stakes irreversible action.",
-    "Rules: HOLD if CI is failing/blocked, there is a merge conflict, or the change is a draft. REJECT if the PR is not a legitimate VO-source change or has no clear purpose. MERGE only if it looks complete, scoped, and unblocked.",
+    "Rules: HOLD if CI is failing/blocked, there is a merge conflict, or the change is a draft. REJECT if the PR is not a legitimate AlgoHQ-source change or has no clear purpose. MERGE only if it looks complete, scoped, and unblocked.",
     "",
     `PR #${pr.number}: ${pr.title}`,
     `Source: ${pr.source ?? "unknown"}`,
@@ -4393,7 +4401,7 @@ async function handleReviewMerge(deps, rawInput, signal) {
   }
   if (pr === null) {
     return emit(
-      emptyPayload("hold", `PR #${prNumber} is not among open VO PRs (already merged/closed, or not a VO-source PR).`, null)
+      emptyPayload("hold", `PR #${prNumber} is not among open AlgoHQ PRs (already merged/closed, or not an AlgoHQ-source PR).`, null)
     );
   }
   const hasBlocker = pr.blocker !== null && pr.blocker !== "none";
@@ -4488,6 +4496,8 @@ function suggestedHandoffPath(session_id, isoTimestamp) {
 }
 
 // src/tools/session/report-session-state.ts
+init_auth_token_source();
+init_credential_store();
 var TOOL_NAME19 = "vo_report_session_state";
 var VALID_AGENT_TYPES = ["claude-code", "codex", "cursor", "continue"];
 var MAX_GOAL_CHARS = 500;
@@ -4538,7 +4548,7 @@ var inputSchema19 = {
   required: ["operator_id", "session_id", "agent_type", "context_used_pct"],
   additionalProperties: false
 };
-var description19 = "Reports per-session context-window utilization to VO and returns a directive: 'continue' (under 70%), 'prepare_handoff' (70-84%), or 'execute_handoff_now' (\u226585%). Implements V1 launch gate #9 (fleet context lifecycle management) per the official VO roadmap. V1 backend is stub-local \u2014 computes the directive purely from `context_used_pct` against the documented thresholds without a network call. Phase 3 wires this to the deployed vo-control-plane HTTP API; the response shape stays stable across the cutover (`backend_mode` field in the payload tells the caller which mode produced the verdict).";
+var description19 = "Reports per-session context-window utilization to AlgoHQ and returns a directive: 'continue' (under 70%), 'prepare_handoff' (70-84%), or 'execute_handoff_now' (\u226585%). Implements V1 launch gate #9 (fleet context lifecycle management) per the official AlgoHQ roadmap. Cloud-control-plane mode when VO_CONTROL_PLANE_URL plus a user/scoped HQ credential (or legacy admin token) is available; auto-allocates the session on first report so interactive agents (Claude Code, Cursor, Codex, Continue) appear on the live fleet whiteboard. Stub-local fallback when cloud config is absent or fails. The response shape stays stable across modes (`backend_mode` field in the payload tells the caller which mode produced the verdict).";
 function isStringArray2(v, maxItems) {
   if (!Array.isArray(v)) return false;
   if (v.length > maxItems) return false;
@@ -4563,33 +4573,93 @@ function isToolInput19(v) {
   }
   return true;
 }
-function getCloudConfig() {
-  const url = process.env["VO_CONTROL_PLANE_URL"];
-  const token = process.env["VO_CONTROL_PLANE_ADMIN_TOKEN"];
-  if (!url || !token) return null;
-  return { url, token };
+async function fetchCloudIdentity(url, token, fetchFn) {
+  try {
+    const response = await fetchFn(`${url}/api/v1/auth/me`, {
+      method: "GET",
+      headers: {
+        "Authorization": `Bearer ${token}`
+      }
+    });
+    if (!response.ok) return null;
+    const data = await response.json();
+    if (!data.ok || !data.provisioned || !data.operator_id || !data.tenant_id) return null;
+    return { operator_id: data.operator_id, tenant_id: data.tenant_id };
+  } catch {
+    return null;
+  }
 }
-async function tryCloudReportState(cloud, input) {
+async function getCloudConfig(fetchFn = fetch) {
+  const url = process.env["VO_CONTROL_PLANE_URL"]?.trim();
+  if (!url) return null;
+  const tokenSource = createAuthTokenSourceFromEnv(
+    process.env,
+    fetchFn,
+    () => readStoredCredential(process.env)
+  );
+  const token = await tokenSource?.getToken();
+  if (!token) return null;
+  const tenant_id = process.env["VO_TENANT_ID"]?.trim();
+  if (tenant_id) return { url, token, tenant_id };
+  const identity = await fetchCloudIdentity(url, token, fetchFn);
+  if (!identity) return null;
+  return { url, token, tenant_id: identity.tenant_id, operator_id: identity.operator_id };
+}
+async function tryCloudReportState(cloud, input, fetchFn = fetch) {
   try {
-    const body = {
+    const reportBody = {
       context_used_pct: input.context_used_pct
     };
-    if (input.current_goal !== void 0) body["current_goal"] = input.current_goal;
+    if (input.current_goal !== void 0) reportBody["current_goal"] = input.current_goal;
     if (input.recent_files_touched !== void 0) {
-      body["recent_files_touched"] = input.recent_files_touched;
+      reportBody["recent_files_touched"] = input.recent_files_touched;
     }
     if (input.recent_tool_uses !== void 0) {
-      body["recent_tool_uses"] = input.recent_tool_uses;
+      reportBody["recent_tool_uses"] = input.recent_tool_uses;
     }
-    const url = `${cloud.url}/api/v1/session/${input.session_id}/report-state`;
-    const response = await fetch(url, {
+    const reportUrl = `${cloud.url}/api/v1/session/${input.session_id}/report-state`;
+    let response = await fetchFn(reportUrl, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
         "Authorization": `Bearer ${cloud.token}`
       },
-      body: JSON.stringify(body)
+      body: JSON.stringify(reportBody)
     });
+    if (response.status === 404) {
+      const allocateBody = {
+        operator_id: cloud.operator_id ?? input.operator_id,
+        tenant_id: cloud.tenant_id,
+        agent_type: input.agent_type,
+        current_goal: input.current_goal ?? "Interactive session"
+      };
+      if (input.context_used_pct > 0) {
+        allocateBody["initial_context_used_pct"] = input.context_used_pct;
+      }
+      const allocateUrl = `${cloud.url}/api/v1/session`;
+      const allocateResponse = await fetchFn(allocateUrl, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "Authorization": `Bearer ${cloud.token}`
+        },
+        body: JSON.stringify(allocateBody)
+      });
+      if (!allocateResponse.ok) {
+        return null;
+      }
+      const allocateData = await allocateResponse.json();
+      const retrySessionId = typeof allocateData.session?.session_id === "string" && allocateData.session.session_id.length > 0 ? allocateData.session.session_id : input.session_id;
+      const retryReportUrl = `${cloud.url}/api/v1/session/${retrySessionId}/report-state`;
+      response = await fetchFn(retryReportUrl, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "Authorization": `Bearer ${cloud.token}`
+        },
+        body: JSON.stringify(reportBody)
+      });
+    }
     if (!response.ok) {
       return null;
     }
@@ -4620,7 +4690,7 @@ async function handleReportSessionState(deps, rawInput, _signal) {
       `invalid input. Required fields: operator_id (non-empty string), session_id (non-empty string), agent_type (one of: ${VALID_AGENT_TYPES.join(" | ")}), context_used_pct (number 0-100). Optional: current_goal (string \u2264${MAX_GOAL_CHARS} chars), recent_files_touched (string[] \u2264${MAX_RECENT_FILES}), recent_tool_uses (string[] \u2264${MAX_RECENT_TOOLS}).`
     );
   }
-  const cloud = getCloudConfig();
+  const cloud = await getCloudConfig();
   if (cloud !== null) {
     const cloudPayload = await tryCloudReportState(cloud, rawInput);
     if (cloudPayload !== null) {
@@ -4703,7 +4773,7 @@ var MANDATORY_READS = [
 function buildSuccessorPrompt(handoffMarkdown, goal) {
   const reads = MANDATORY_READS.map((r, i) => `  ${i + 1}. ${r}`).join("\n");
   const lines = [
-    "You are the SUCCESSOR agent for a Virtual Office lane. The previous session",
+    "You are the SUCCESSOR agent for an AlgoHQ lane. The previous session",
     "exhausted its context and wrote the handoff below. Read it fully, verify its",
     '"verification needed" items against live state (a handoff is a claim, not',
     "evidence \u2014 verify via `git show origin/main:<path>`), then continue the lane.",
@@ -4714,7 +4784,7 @@ function buildSuccessorPrompt(handoffMarkdown, goal) {
     "NON-NEGOTIABLES: multi-model consensus verification is the core; test honesty",
     "(verified-answer-only, no fake green); verify-before-act + human merge approval;",
     "never a full functions-shared deploy; Gen2 only; work in a worktree on your own",
-    "branch; finish line is MERGED + DEPLOYED + LIVE-VERIFIED, and VO changes update",
+    "branch; finish line is MERGED + DEPLOYED + LIVE-VERIFIED, and AlgoHQ changes update",
     "the roadmap in the same PR.",
     "",
     "--- HANDOFF ---",
@@ -4864,6 +4934,27 @@ async function handleConciergeDispatch(deps, rawInput, _signal) {
 import { homedir as homedir5 } from "node:os";
 import { join as join7 } from "node:path";
 import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync3, readdirSync as readdirSync4 } from "node:fs";
+
+// src/tools/memory/safe-memory-file.ts
+import { resolve, sep } from "node:path";
+var SAFE_MEMORY_FILE_RE = /^[A-Za-z0-9][A-Za-z0-9._ -]*\.md$/i;
+function isSafeMemoryFileName(fileName) {
+  return fileName.length <= 200 && fileName.trim() === fileName && !fileName.includes("/") && !fileName.includes("\\") && !fileName.includes(":") && SAFE_MEMORY_FILE_RE.test(fileName);
+}
+function resolveMemoryFilePath(memoryDir, fileName) {
+  if (!isSafeMemoryFileName(fileName)) {
+    throw new Error(`unsafe memory file_name: ${fileName.slice(0, 80)}`);
+  }
+  const root = resolve(memoryDir);
+  const filePath = resolve(root, fileName);
+  const rootPrefix = root.endsWith(sep) ? root : `${root}${sep}`;
+  if (filePath !== root && !filePath.startsWith(rootPrefix)) {
+    throw new Error(`memory file path escapes memory directory: ${fileName.slice(0, 80)}`);
+  }
+  return filePath;
+}
+
+// src/tools/memory/sync-config.ts
 var TOOL_NAME22 = "vo_sync_config";
 var inputSchema22 = {
   type: "object",
@@ -4890,14 +4981,13 @@ function isToolInput22(v) {
   return true;
 }
 function deriveProjectSlug(cwd) {
-  const normalized = cwd.replace(/\\/g, "/");
-  return normalized.replace(/^([A-Z]):/i, (_, drive) => `${drive.toUpperCase()}-`).replace(/\/$/g, "").split("/").join("--").replace(/\s+/g, "-");
+  return cwd.replace(/\\/g, "/").replace(/\/+$/g, "").replace(/^([a-zA-Z]):/, (_m, drive) => `${drive.toUpperCase()}:`).replace(/[^a-zA-Z0-9]/g, "-");
 }
 function getMemoryDir(cwd) {
   const slug = deriveProjectSlug(cwd);
   return join7(homedir5(), ".claude", "projects", slug, "memory");
 }
-async function pullMemory(controlPlaneUrl, token, memoryDir, sessionId, fetchFn) {
+async function pullMemory(controlPlaneUrl, token, memoryDir, fetchFn) {
   const url = `${controlPlaneUrl}/api/v1/agent-config/memory/me`;
   const response = await fetchFn(url, {
     method: "GET",
@@ -4913,10 +5003,13 @@ async function pullMemory(controlPlaneUrl, token, memoryDir, sessionId, fetchFn)
   if (!data.ok || !Array.isArray(data.entries)) {
     throw new Error("GET /api/v1/agent-config/memory/me response missing ok=true or entries array");
   }
+  const writes = data.entries.map((entry) => ({
+    entry,
+    filePath: resolveMemoryFilePath(memoryDir, entry.file_name)
+  }));
   mkdirSync4(memoryDir, { recursive: true });
   const files = [];
-  for (const entry of data.entries) {
-    const filePath = join7(memoryDir, entry.file_name);
+  for (const { entry, filePath } of writes) {
     writeFileSync3(filePath, entry.content, "utf8");
     files.push(entry.file_name);
   }
@@ -4928,7 +5021,7 @@ async function pushMemory(controlPlaneUrl, token, memoryDir, sessionId, fetchFn)
   }
   const localFiles = readdirSync4(memoryDir).filter((f) => f.endsWith(".md")).map((f) => ({
     file_name: f,
-    content: readFileSync7(join7(memoryDir, f), "utf8"),
+    content: readFileSync7(resolveMemoryFilePath(memoryDir, f), "utf8"),
     entry_type: f === "MEMORY.md" ? "index" : "topic"
   }));
   if (localFiles.length === 0) {
@@ -5010,103 +5103,293 @@ async function pushMemory(controlPlaneUrl, token, memoryDir, sessionId, fetchFn)
   }
   return { pushed: localFiles.length, created, updated };
 }
-async function handleSyncConfig(deps, rawInput, _signal, fetchFn = globalThis.fetch) {
-  if (!isToolInput22(rawInput)) {
-    throw invalidParams(
-      TOOL_NAME22,
-      'invalid input. Required: { action: "pull" | "push" }. Optional: { cwd: "<path>" }.'
-    );
-  }
+async function runMemorySync(action, cwd, sessionId, fetchFn = globalThis.fetch) {
   const controlPlaneUrl = process.env["VO_CONTROL_PLANE_URL"];
   if (!controlPlaneUrl) {
-    return jsonContent({
-      tool: TOOL_NAME22,
-      schema_version: 1,
-      payload: {
-        synced: false,
-        reason: "VO_CONTROL_PLANE_URL not set \u2014 cloud mode disabled"
-      }
-    });
+    return { synced: false, reason: "VO_CONTROL_PLANE_URL not set \u2014 cloud mode disabled" };
   }
   const { createAuthTokenSourceFromEnv: createAuthTokenSourceFromEnv2 } = await Promise.resolve().then(() => (init_auth_token_source(), auth_token_source_exports));
   const { readStoredCredential: readStoredCredential2 } = await Promise.resolve().then(() => (init_credential_store(), credential_store_exports));
   const tokenSource = createAuthTokenSourceFromEnv2(process.env, fetchFn, () => readStoredCredential2(process.env));
   if (!tokenSource) {
-    return jsonContent({
-      tool: TOOL_NAME22,
-      schema_version: 1,
-      payload: {
-        synced: false,
-        reason: "No auth configured. Run `vo-mcp login` to authenticate as an operator."
-      }
-    });
+    return { synced: false, reason: "No auth configured. Run `vo-mcp login` to authenticate as an operator." };
   }
   const token = await tokenSource.getToken();
   if (!token) {
-    return jsonContent({
-      tool: TOOL_NAME22,
-      schema_version: 1,
-      payload: {
-        synced: false,
-        reason: "Failed to obtain auth token. Run `vo-mcp login` to re-authenticate."
-      }
-    });
+    return { synced: false, reason: "Failed to obtain auth token. Run `vo-mcp login` to re-authenticate." };
   }
-  const cwd = rawInput.cwd?.trim() || process.cwd();
   const memoryDir = getMemoryDir(cwd);
+  const baseUrl = controlPlaneUrl.replace(/\/+$/, "");
   try {
-    if (rawInput.action === "pull") {
-      const result = await pullMemory(
-        controlPlaneUrl.replace(/\/+$/, ""),
-        token,
-        memoryDir,
-        deps.sessionId,
-        fetchFn
-      );
-      return jsonContent({
-        tool: TOOL_NAME22,
-        schema_version: 1,
-        payload: {
-          synced: true,
-          action: "pull",
-          pulled: result.pulled,
-          files: result.files,
-          memory_dir: memoryDir
-        }
-      });
-    } else {
-      const result = await pushMemory(
-        controlPlaneUrl.replace(/\/+$/, ""),
-        token,
-        memoryDir,
-        deps.sessionId,
-        fetchFn
-      );
-      return jsonContent({
-        tool: TOOL_NAME22,
-        schema_version: 1,
-        payload: {
-          synced: true,
-          action: "push",
-          pushed: result.pushed,
-          created: result.created,
-          updated: result.updated,
-          memory_dir: memoryDir
-        }
-      });
+    if (action === "pull") {
+      const result2 = await pullMemory(baseUrl, token, memoryDir, fetchFn);
+      return { synced: true, action: "pull", pulled: result2.pulled, files: result2.files, memory_dir: memoryDir };
     }
+    const result = await pushMemory(baseUrl, token, memoryDir, sessionId, fetchFn);
+    return {
+      synced: true,
+      action: "push",
+      pushed: result.pushed,
+      created: result.created,
+      updated: result.updated,
+      memory_dir: memoryDir
+    };
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    return jsonContent({
-      tool: TOOL_NAME22,
-      schema_version: 1,
-      payload: {
-        synced: false,
-        reason: `Sync failed: ${message}`
+    return { synced: false, reason: `Sync failed: ${message}` };
+  }
+}
+async function handleSyncConfig(deps, rawInput, _signal, fetchFn = globalThis.fetch) {
+  if (!isToolInput22(rawInput)) {
+    throw invalidParams(
+      TOOL_NAME22,
+      'invalid input. Required: { action: "pull" | "push" }. Optional: { cwd: "<path>" }.'
+    );
+  }
+  const cwd = rawInput.cwd?.trim() || process.cwd();
+  const result = await runMemorySync(rawInput.action, cwd, deps.session.sessionId, fetchFn);
+  return jsonContent({ tool: TOOL_NAME22, schema_version: 1, payload: result });
+}
+
+// src/tools/memory/private-knowledge.ts
+var UPSERT_TOOL_NAME = "vo_private_knowledge_upsert";
+var CONTEXT_TOOL_NAME = "vo_private_knowledge_context";
+var KNOWLEDGE_CLASSES = ["memory", "skill", "doctrine", "hook", "command"];
+var PRECISION_CHAR_BUDGET = 12e3;
+var upsertInputSchema = {
+  type: "object",
+  properties: {
+    knowledge_class: { type: "string", enum: KNOWLEDGE_CLASSES },
+    source_path: { type: "string", description: "Stable private source identifier; not exposed to other users." },
+    title: { type: "string", description: 'Descriptive, retrieval-friendly title (e.g. "AlgoTax OCR redaction architecture", not "notes") \u2014 retrieval matches on it.' },
+    content: { type: "string", description: "Private knowledge text to store server-side. Keep each entry tight and focused (~1-3 pages, under ~12k chars); split larger corpora into separate entries." }
+  },
+  required: ["knowledge_class", "source_path", "title", "content"],
+  additionalProperties: false
+};
+var contextInputSchema = {
+  type: "object",
+  properties: {
+    query: { type: "string" },
+    limit: { type: "number", minimum: 1, maximum: 50 },
+    knowledge_class: { type: "string", enum: KNOWLEDGE_CLASSES }
+  },
+  required: ["query"],
+  additionalProperties: false
+};
+var upsertDescription = "Uploads or refreshes the authenticated operator\u2019s private cloud knowledge. Works for Claude, Codex, Cursor, and cowork clients via the same vo-mcp login credential. Returns metadata only, not raw stored content. PRECISION DISCIPLINE: keep each entry tight and focused (~1-3 pages) with a descriptive retrieval-friendly title \u2014 retrieval surfaces whole entries, so small dense entries beat bulk dumps. Split large corpora into focused entries, then run a retrieval self-test via vo_private_knowledge_context before relying on the knowledge.";
+var contextDescription = "Retrieves prompt-ready private knowledge context for the authenticated operator. Returns snippets/context only; no raw corpus download. Also the retrieval self-test surface: after upserting critical knowledge, query for it here and confirm the entry surfaces before trusting it in downstream work.";
+function isKnowledgeClass(value) {
+  return typeof value === "string" && KNOWLEDGE_CLASSES.includes(value);
+}
+function isUpsertInput(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const input = value;
+  return isKnowledgeClass(input["knowledge_class"]) && typeof input["source_path"] === "string" && typeof input["title"] === "string" && typeof input["content"] === "string";
+}
+function isContextInput(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const input = value;
+  if (typeof input["query"] !== "string") return false;
+  if (input["limit"] !== void 0 && typeof input["limit"] !== "number") return false;
+  if (input["knowledge_class"] !== void 0 && !isKnowledgeClass(input["knowledge_class"])) return false;
+  return true;
+}
+async function getCloudAuth(fetchFn) {
+  const controlPlaneUrl = process.env["VO_CONTROL_PLANE_URL"]?.replace(/\/+$/, "");
+  if (!controlPlaneUrl) {
+    return { ok: false, reason: "VO_CONTROL_PLANE_URL not set \u2014 cloud mode disabled" };
+  }
+  const { createAuthTokenSourceFromEnv: createAuthTokenSourceFromEnv2 } = await Promise.resolve().then(() => (init_auth_token_source(), auth_token_source_exports));
+  const { readStoredCredential: readStoredCredential2 } = await Promise.resolve().then(() => (init_credential_store(), credential_store_exports));
+  const tokenSource = createAuthTokenSourceFromEnv2(process.env, fetchFn, () => readStoredCredential2(process.env));
+  if (!tokenSource) return { ok: false, reason: "No auth configured. Run `vo-mcp login`." };
+  const token = await tokenSource.getToken();
+  if (!token) return { ok: false, reason: "Failed to obtain auth token. Run `vo-mcp login` again." };
+  return { ok: true, controlPlaneUrl, token };
+}
+async function callPrivateKnowledge(path3, body, fetchFn) {
+  const auth = await getCloudAuth(fetchFn);
+  if (!auth.ok) return { ok: false, reason: auth.reason };
+  const response = await fetchFn(`${auth.controlPlaneUrl}${path3}`, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${auth.token}`,
+      "content-type": "application/json"
+    },
+    body: JSON.stringify(body)
+  });
+  const text = await response.text();
+  const parsed = text ? JSON.parse(text) : null;
+  if (response.status < 200 || response.status >= 300) {
+    return { ok: false, status: response.status, response: parsed ?? text };
+  }
+  return parsed;
+}
+async function handlePrivateKnowledgeUpsert(_deps, rawInput, _signal, fetchFn = globalThis.fetch) {
+  if (!isUpsertInput(rawInput)) {
+    throw invalidParams(UPSERT_TOOL_NAME, "expected { knowledge_class, source_path, title, content }.");
+  }
+  const payload = await callPrivateKnowledge("/api/v1/knowledge/private", rawInput, fetchFn);
+  const envelope = {
+    tool: UPSERT_TOOL_NAME,
+    schema_version: 1,
+    payload
+  };
+  if (rawInput.content.length > PRECISION_CHAR_BUDGET) {
+    envelope.precision_note = `content is ${rawInput.content.length} chars (> ${PRECISION_CHAR_BUDGET}). Tight 1-3 page entries retrieve better \u2014 consider splitting into focused entries, then re-test retrieval via ${CONTEXT_TOOL_NAME}.`;
+  }
+  return jsonContent(envelope);
+}
+async function handlePrivateKnowledgeContext(_deps, rawInput, _signal, fetchFn = globalThis.fetch) {
+  if (!isContextInput(rawInput)) {
+    throw invalidParams(CONTEXT_TOOL_NAME, "expected { query, optional limit, optional knowledge_class }.");
+  }
+  const payload = await callPrivateKnowledge("/api/v1/knowledge/private/context", rawInput, fetchFn);
+  return jsonContent({ tool: CONTEXT_TOOL_NAME, schema_version: 1, payload });
+}
+
+// src/tools/hq/whiteboard.ts
+init_auth_token_source();
+init_credential_store();
+var POST_TOOL_NAME = "hq_whiteboard_post";
+var READ_TOOL_NAME = "hq_whiteboard_read";
+var postDescription = "Post an append-only coordination note to the live AlgoHQ whiteboard. Uses the scoped credential from vo-mcp login; operator and tenant ownership are derived by the server.";
+var readDescription = "Read recent coordination notes from the caller's live AlgoHQ whiteboard. Uses the scoped credential from vo-mcp login and cannot widen tenant scope.";
+var postInputSchema = {
+  type: "object",
+  properties: {
+    from: { type: "string", minLength: 1, maxLength: 100, description: "Agent/session display name." },
+    type: { type: "string", minLength: 1, maxLength: 64, description: "Message kind, such as intent, worklog, blocker, or completion." },
+    content: { type: "string", minLength: 1, maxLength: 500, description: "Short coordination note." },
+    targetAgent: { type: "string", maxLength: 100 },
+    tester: { type: "string", maxLength: 100 },
+    tier: { type: "string", maxLength: 32 }
+  },
+  required: ["from", "type", "content"],
+  additionalProperties: false
+};
+var readInputSchema = {
+  type: "object",
+  properties: {
+    limit: { type: "integer", minimum: 1, maximum: 100, default: 25 },
+    since: { type: "string", description: "Optional ISO-8601 lower bound." },
+    type: { type: "string", minLength: 1, maxLength: 64 }
+  },
+  additionalProperties: false
+};
+function resolveTimeoutMs() {
+  const parsed = Number(process.env["HQ_WHITEBOARD_TIMEOUT_MS"]);
+  return Number.isFinite(parsed) && parsed >= 10 && parsed <= 12e4 ? parsed : 1e4;
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function onlyKeys(value, allowed) {
+  return Object.keys(value).every((key) => allowed.includes(key));
+}
+function isBoundedString(value, min, max) {
+  return typeof value === "string" && value.trim().length >= min && value.trim().length <= max;
+}
+function parsePostInput(value) {
+  if (!isRecord(value) || !onlyKeys(value, ["from", "type", "content", "targetAgent", "tester", "tier"])) return null;
+  if (!isBoundedString(value["from"], 1, 100)) return null;
+  if (!isBoundedString(value["type"], 1, 64) || !/^[a-zA-Z0-9_-]+$/.test(value["type"].trim())) return null;
+  if (!isBoundedString(value["content"], 1, 500)) return null;
+  for (const [key, max] of [["targetAgent", 100], ["tester", 100], ["tier", 32]]) {
+    if (value[key] !== void 0 && !isBoundedString(value[key], 0, max)) return null;
+  }
+  return {
+    from: value["from"].trim(),
+    type: value["type"].trim(),
+    content: value["content"].trim(),
+    ...typeof value["targetAgent"] === "string" ? { targetAgent: value["targetAgent"].trim() } : {},
+    ...typeof value["tester"] === "string" ? { tester: value["tester"].trim() } : {},
+    ...typeof value["tier"] === "string" ? { tier: value["tier"].trim() } : {}
+  };
+}
+function parseReadInput(value) {
+  if (!isRecord(value) || !onlyKeys(value, ["limit", "since", "type"])) return null;
+  if (value["limit"] !== void 0 && (!Number.isInteger(value["limit"]) || Number(value["limit"]) < 1 || Number(value["limit"]) > 100)) return null;
+  if (value["since"] !== void 0 && (typeof value["since"] !== "string" || Number.isNaN(Date.parse(value["since"])))) return null;
+  if (value["type"] !== void 0 && !isBoundedString(value["type"], 1, 64)) return null;
+  return {
+    ...typeof value["limit"] === "number" ? { limit: value["limit"] } : {},
+    ...typeof value["since"] === "string" ? { since: value["since"] } : {},
+    ...typeof value["type"] === "string" ? { type: value["type"].trim() } : {}
+  };
+}
+async function resolveCloud(fetchFn) {
+  const url = process.env["VO_CONTROL_PLANE_URL"]?.trim().replace(/\/$/, "");
+  if (!url) return null;
+  try {
+    const source = createAuthTokenSourceFromEnv(process.env, fetchFn, () => readStoredCredential(process.env));
+    const token = await source?.getToken();
+    return token ? { url, token } : null;
+  } catch {
+    return null;
+  }
+}
+async function callWhiteboard(method, bodyOrQuery, signal, fetchFn = fetch) {
+  const cloud = await resolveCloud(fetchFn);
+  if (!cloud) {
+    return {
+      ok: false,
+      error: "hq_whiteboard_not_configured",
+      message: "Set VO_CONTROL_PLANE_URL and run vo-mcp login to install a scoped HQ credential."
+    };
+  }
+  const timeoutSignal = AbortSignal.timeout(resolveTimeoutMs());
+  const requestSignal = signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal;
+  const query = new URLSearchParams();
+  if (method === "GET") {
+    const input = bodyOrQuery;
+    query.set("limit", String(input.limit ?? 25));
+    if (input.since) query.set("since", input.since);
+    if (input.type) query.set("type", input.type);
+  }
+  try {
+    const response = await fetchFn(
+      `${cloud.url}/api/v1/hq/whiteboard/messages${query.size ? `?${query}` : ""}`,
+      {
+        method,
+        headers: {
+          Authorization: `Bearer ${cloud.token}`,
+          ...method === "POST" ? { "Content-Type": "application/json" } : {}
+        },
+        ...method === "POST" ? { body: JSON.stringify(bodyOrQuery) } : {},
+        signal: requestSignal
       }
-    });
+    );
+    const text = await response.text();
+    let payload;
+    try {
+      payload = JSON.parse(text);
+    } catch {
+      payload = { ok: false, error: "invalid_response", message: text.slice(0, 200) };
+    }
+    if (!response.ok) {
+      return { ok: false, error: "hq_whiteboard_http_error", status: response.status, response: payload };
+    }
+    return payload;
+  } catch (error) {
+    return {
+      ok: false,
+      error: signal?.aborted ? "cancelled" : timeoutSignal.aborted ? "hq_whiteboard_timeout" : "hq_whiteboard_unreachable",
+      message: error instanceof Error ? error.message.slice(0, 200) : String(error).slice(0, 200)
+    };
   }
 }
+async function handleHqWhiteboardPost(_deps, rawInput, signal) {
+  const input = parsePostInput(rawInput);
+  if (!input) throw invalidParams(POST_TOOL_NAME, "requires from, type, and 1-500 character content; unknown fields are rejected");
+  return jsonContent(await callWhiteboard("POST", input, signal));
+}
+async function handleHqWhiteboardRead(_deps, rawInput, signal) {
+  const input = parseReadInput(rawInput);
+  if (!input) throw invalidParams(READ_TOOL_NAME, "limit must be 1-100, since must be ISO-8601, and unknown fields are rejected");
+  return jsonContent(await callWhiteboard("GET", input, signal));
+}
 
 // src/server.ts
 function buildToolRegistry() {
@@ -5286,6 +5569,38 @@ function buildToolRegistry() {
         inputSchema: inputSchema22
       },
       handler: handleSyncConfig
+    },
+    [UPSERT_TOOL_NAME]: {
+      definition: {
+        name: UPSERT_TOOL_NAME,
+        description: upsertDescription,
+        inputSchema: upsertInputSchema
+      },
+      handler: handlePrivateKnowledgeUpsert
+    },
+    [CONTEXT_TOOL_NAME]: {
+      definition: {
+        name: CONTEXT_TOOL_NAME,
+        description: contextDescription,
+        inputSchema: contextInputSchema
+      },
+      handler: handlePrivateKnowledgeContext
+    },
+    [POST_TOOL_NAME]: {
+      definition: {
+        name: POST_TOOL_NAME,
+        description: postDescription,
+        inputSchema: postInputSchema
+      },
+      handler: handleHqWhiteboardPost
+    },
+    [READ_TOOL_NAME]: {
+      definition: {
+        name: READ_TOOL_NAME,
+        description: readDescription,
+        inputSchema: readInputSchema
+      },
+      handler: handleHqWhiteboardRead
     }
   };
 }
@@ -5575,6 +5890,64 @@ function createNullConsensusEngineClient(reason = NULL_CLIENT_DEFAULT_REASON) {
 // src/consensus/engine-client.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
 
+// src/consensus/meta-model-caller.ts
+var META_MODEL_API_BASE_URL = "https://api.meta.ai/v1";
+var META_CONSENSUS_MODEL = "muse-spark-1.1";
+var META_MODEL_API_KEY_ENV = "MODEL_API_KEY";
+var META_MODEL_API_KEY_ALIAS = "META_API";
+function resolveMetaKey(env) {
+  return String(env[META_MODEL_API_KEY_ENV] || env[META_MODEL_API_KEY_ALIAS] || "").trim();
+}
+function positiveMaxTokens(value) {
+  const parsed = Math.floor(Number(value));
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : 2048;
+}
+function createMetaModelCaller(options = {}) {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const envSource = options.envSource ?? process.env;
+  const reasoningEffort = options.reasoningEffort ?? "high";
+  return async function callMetaWithMetrics2(prompt, systemPrompt, model, maxTokens, _privacyOptions, signal) {
+    const key = resolveMetaKey(envSource);
+    if (!key) throw new Error(`Missing ${META_MODEL_API_KEY_ENV} for Meta Model API`);
+    const messages = [
+      ...systemPrompt ? [{ role: "system", content: systemPrompt }] : [],
+      { role: "user", content: prompt }
+    ];
+    const response = await fetchImpl(`${META_MODEL_API_BASE_URL}/chat/completions`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${key}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        model: model || META_CONSENSUS_MODEL,
+        messages,
+        max_tokens: positiveMaxTokens(maxTokens),
+        reasoning_effort: reasoningEffort
+      }),
+      signal
+    });
+    const payload = await response.json();
+    if (!response.ok) {
+      const message = String(payload.error?.message || response.statusText || "request failed").slice(0, 500);
+      throw Object.assign(new Error(`Meta Model API ${response.status}: ${message}`), { status: response.status });
+    }
+    const content = payload.choices?.[0]?.message?.content;
+    if (typeof content !== "string" || !content.trim()) {
+      throw new Error(`Meta Model API returned no text (finish=${payload.choices?.[0]?.finish_reason || "unknown"})`);
+    }
+    const inputTokens = Number(payload.usage?.prompt_tokens || 0);
+    const outputTokens = Number(payload.usage?.completion_tokens || 0);
+    return {
+      content,
+      inputTokens,
+      outputTokens,
+      totalTokens: Number(payload.usage?.total_tokens || inputTokens + outputTokens)
+    };
+  };
+}
+var callMetaWithMetrics = createMetaModelCaller();
+
 // src/consensus/engine-options.ts
 var AGREEMENT_GATE_ENV_VAR = "VO_CONSENSUS_AGREEMENT_GATE";
 function isTruthyFlag(raw) {
@@ -5621,6 +5994,25 @@ function mapFanOutDiagnostics(fd) {
     refused: fd.refused
   };
 }
+var SHADOW_SYNTHESIS_ENV_VAR = "VO_CONSENSUS_SHADOW";
+function shadowEnabled(env) {
+  const raw = (env ?? {})[SHADOW_SYNTHESIS_ENV_VAR];
+  if (raw === void 0) return true;
+  const norm = raw.trim().toLowerCase();
+  return !(norm === "0" || norm === "false" || norm === "no" || norm === "off" || norm === "");
+}
+function mapShadowSynthesis(s) {
+  if (s === void 0) return void 0;
+  return {
+    incumbent: { verdict: s.incumbent.verdict, confidence: s.incumbent.confidence, synthesizer: s.incumbent.synthesizer },
+    adaptive: {
+      verdict: s.adaptive.verdict,
+      confidence: s.adaptive.confidence,
+      ...s.adaptive.calibrated_confidence !== void 0 ? { calibrated_confidence: s.adaptive.calibrated_confidence } : {}
+    },
+    agree: s.agree
+  };
+}
 function mapCitationGrade(cg) {
   if (cg === void 0) return void 0;
   return {
@@ -5761,7 +6153,12 @@ function createEngineConsensusClient(options) {
         const engineOptions = {
           panel,
           ...options.per_model_timeout_ms !== void 0 ? { per_model_timeout_ms: options.per_model_timeout_ms } : {},
-          ...agreementGate !== void 0 ? { agreement_gate: agreementGate } : {}
+          ...agreementGate !== void 0 ? { agreement_gate: agreementGate } : {},
+          // Stage A7-shadow: run the adaptive verdict alongside the live one for grading.
+          // Cheap (pure log-odds over already-fetched verdicts; no extra model calls),
+          // PII-free, and never alters the live verdict. ON by default; kill with
+          // VO_CONSENSUS_SHADOW=0. Cold-start has no skill registry → neutral priors.
+          shadow_synthesis: { enabled: shadowEnabled(options.env) }
         };
         const sources = request.source_urls;
         const useSourceGrounded = sources !== void 0 && sources.length > 0 && typeof engine.runSourceGroundedConsensus === "function";
@@ -5817,6 +6214,8 @@ function createEngineConsensusClient(options) {
           ...sourceExtras?.escalation_reason !== void 0 ? { escalation_reason: sourceExtras.escalation_reason } : response.escalation_reason !== void 0 ? { escalation_reason: response.escalation_reason } : {},
           // Feature 1 (agreement-gate) — fan-out diagnostics (additive telemetry).
           ...mapFanOutDiagnostics(response.fan_out_diagnostics) !== void 0 ? { fan_out_diagnostics: mapFanOutDiagnostics(response.fan_out_diagnostics) } : {},
+          // Stage A7-shadow — adaptive-vs-incumbent comparison (PII-free; present iff shadow on).
+          ...mapShadowSynthesis(response.shadow_synthesis) !== void 0 ? { shadow_synthesis: mapShadowSynthesis(response.shadow_synthesis) } : {},
           // Source-grounded additive outputs (Tier-4 features).
           ...useSourceGrounded ? { source_grounded: true } : {},
           ...sourceExtras?.citation_grade !== void 0 ? { citation_grade: sourceExtras.citation_grade } : {},
@@ -5843,7 +6242,8 @@ var DEFAULT_MODELS = {
   // callGeminiWithMetrics; 2.5-pro REJECTS budget 0 ("only works in thinking mode").
   // Flash is also ~10x cheaper. 2026-06-02.
   google: "gemini-2.5-flash",
-  deepseek: "deepseek-chat"
+  deepseek: "deepseek-chat",
+  meta: META_CONSENSUS_MODEL
 };
 function probeProviders(env = process.env) {
   const out = [];
@@ -5851,6 +6251,7 @@ function probeProviders(env = process.env) {
   if ((env["OPENAI_API_KEY"] ?? "").trim().length > 0) out.push("openai");
   if ((env["GOOGLE_API_KEY"] ?? "").trim().length > 0) out.push("google");
   if ((env["DEEPSEEK_API_KEY"] ?? "").trim().length > 0) out.push("deepseek");
+  if ((env[META_MODEL_API_KEY_ENV] ?? "").trim().length > 0 || (env[META_MODEL_API_KEY_ALIAS] ?? "").trim().length > 0) out.push("meta");
   return out;
 }
 async function loadFactoryAndCallers(injectedEngine, injectedShared) {
@@ -5896,21 +6297,24 @@ async function tryCreateEngineConsensusClientFromEnvAsync(options = {}) {
     anthropic: loaded.shared.callAnthropicWithMetrics,
     openai: loaded.shared.callOpenAIWithMetrics,
     google: loaded.shared.callGeminiWithMetrics,
-    deepseek: loaded.shared.callDeepSeekWithMetrics
+    deepseek: loaded.shared.callDeepSeekWithMetrics,
+    meta: options.metaCaller ?? callMetaWithMetrics
   };
   const modelByProvider = {
     anthropic: options.models?.anthropic ?? DEFAULT_MODELS.anthropic,
     openai: options.models?.openai ?? DEFAULT_MODELS.openai,
     google: options.models?.google ?? DEFAULT_MODELS.google,
-    deepseek: options.models?.deepseek ?? DEFAULT_MODELS.deepseek
+    deepseek: options.models?.deepseek ?? DEFAULT_MODELS.deepseek,
+    meta: options.models?.meta ?? DEFAULT_MODELS.meta
   };
+  const adapterEnv = !(env[META_MODEL_API_KEY_ENV] ?? "").trim() && (env[META_MODEL_API_KEY_ALIAS] ?? "").trim() ? { ...env, [META_MODEL_API_KEY_ENV]: env[META_MODEL_API_KEY_ALIAS] } : env;
   const panel = [];
   for (const p of providers) {
     try {
       const adapter = loaded.engine.createAdapter(p, {
         model: modelByProvider[p],
         caller: callerByProvider[p],
-        envSource: env
+        envSource: adapterEnv
       });
       panel.push(adapter);
     } catch {