@algosuite/vo-mcp 0.2.0-beta.2 → 0.2.0-beta.20

package/dist/index.js

@@ -180,6 +180,7 @@ __export(credential_store_exports, {
   KEYCHAIN_LOCATION: () => KEYCHAIN_LOCATION,
   credentialPath: () => credentialPath,
   readStoredCredential: () => readStoredCredential,
+  readStoredCredentialKeychainOnly: () => readStoredCredentialKeychainOnly,
   writeStoredCredential: () => writeStoredCredential
 });
 import { homedir as homedir3 } from "node:os";
@@ -238,6 +239,11 @@ function readStoredCredential(env = process.env, keychain = realKeychain) {
   }
   return readFromFile(env);
 }
+function readStoredCredentialKeychainOnly(env = process.env, keychain = realKeychain) {
+  if (!keychainEnabled(env, keychain)) return null;
+  const raw = keychain.get();
+  return raw ? deserialize(raw) : null;
+}
 function deleteFile(env) {
   try {
     rmSync(credentialPath(env), { force: true });
@@ -1122,9 +1128,15 @@ function createMemoryEventsWriter() {
 function readVoMcpVersion() {
   try {
     const here = dirname3(fileURLToPath2(import.meta.url));
-    const pkgPath = join4(here, "..", "..", "package.json");
-    const pkg = JSON.parse(readFileSync4(pkgPath, "utf8"));
-    return typeof pkg.version === "string" ? pkg.version : "0.0.0-unknown";
+    for (const rel of ["..", ["..", ".."], ["..", "..", ".."]]) {
+      try {
+        const segs = Array.isArray(rel) ? rel : [rel];
+        const pkg = JSON.parse(readFileSync4(join4(here, ...segs, "package.json"), "utf8"));
+        if (pkg.name === "@algosuite/vo-mcp" && typeof pkg.version === "string") return pkg.version;
+      } catch {
+      }
+    }
+    return "0.0.0-unknown";
   } catch {
     return "0.0.0-unknown";
   }
@@ -2044,13 +2056,19 @@ async function handleConsensusJudgment(deps, rawInput, signal) {
     ...engineResult.synthesized_verdict.confidence_badge !== void 0 ? { confidence_badge: engineResult.synthesized_verdict.confidence_badge } : {},
     // Feature 1 (agreement-gate) — fan-out diagnostics (present iff the gate ran).
     ...engineResult.fan_out_diagnostics !== void 0 ? { fan_out_diagnostics: engineResult.fan_out_diagnostics } : {},
+    // Stage A7-shadow — adaptive-vs-incumbent comparison (PII-free; present iff shadow on).
+    ...engineResult.shadow_synthesis !== void 0 ? { shadow_synthesis: engineResult.shadow_synthesis } : {},
     // Source-grounded Tier-4 outputs (present iff the call was source-grounded).
     ...engineResult.source_grounded === true ? { source_grounded: true } : {},
     ...engineResult.citation_grade !== void 0 ? { citation_grade: engineResult.citation_grade } : {},
     ...engineResult.low_confidence_sources !== void 0 ? { low_confidence_sources: engineResult.low_confidence_sources } : {},
     // Escalation (from citation grade or human-tiebreak synthesizer).
     ...engineResult.escalation_required !== void 0 ? { escalation_required: engineResult.escalation_required } : {},
-    ...engineResult.escalation_reason !== void 0 ? { escalation_reason: engineResult.escalation_reason } : {}
+    ...engineResult.escalation_reason !== void 0 ? { escalation_reason: engineResult.escalation_reason } : {},
+    // Critique-uptake (2026-07-20 red-team fix) — the engine computes this
+    // on every call; this spread closes the gap where the visibility report
+    // was itself silently dropped at the payload boundary.
+    ...engineResult.critique_uptake !== void 0 ? { critique_uptake: engineResult.critique_uptake } : {}
   };
   const envelope = {
     tool: TOOL_NAME4,
@@ -4097,7 +4115,7 @@ var inputSchema13 = {
   properties: {},
   additionalProperties: false
 };
-var description13 = "Lists open VO-source pull requests with blocker / source / tester / specialist-context metadata. Read-only diagnostic for Command Center reads. Wraps `voListPendingPRs` admin Cloud Function. V1 stub: returns `verdict: 'unimplemented'` \u2014 cloud-mode wiring pending.";
+var description13 = "Lists open AlgoHQ-source pull requests with blocker / source / tester / specialist-context metadata. Read-only diagnostic for Command Center reads. Wraps `voListPendingPRs` admin Cloud Function. V1 stub: returns `verdict: 'unimplemented'` \u2014 cloud-mode wiring pending.";
 function isToolInput13(v) {
   return typeof v === "object" && v !== null;
 }
@@ -4133,7 +4151,7 @@ var inputSchema14 = {
   required: ["pr_number"],
   additionalProperties: false
 };
-var description14 = "Approves + merges a single VO-source pull request by number. Wraps `voMergePR` admin Cloud Function (server-side refuses non-VO PRs with permission-denied). V1 stub: returns `verdict: 'unimplemented'` \u2014 cloud-mode wiring pending.";
+var description14 = "Approves + merges a single AlgoHQ-source pull request by number. Wraps `voMergePR` admin Cloud Function (server-side refuses non-AlgoHQ PRs with permission-denied). V1 stub: returns `verdict: 'unimplemented'` \u2014 cloud-mode wiring pending.";
 function isToolInput14(v) {
   if (typeof v !== "object" || v === null) return false;
   const o = v;
@@ -4215,7 +4233,7 @@ var inputSchema16 = {
   properties: {},
   additionalProperties: false
 };
-var description16 = "Iterates all open VO-source pull requests and merges (or arms auto-merge) on each. Returns counts of merged / accepted / total plus per-PR results. Wraps `voApproveAllFixes` admin Cloud Function. V1 stub: returns `verdict: 'unimplemented'` \u2014 cloud-mode wiring pending.";
+var description16 = "Iterates all open AlgoHQ-source pull requests and merges (or arms auto-merge) on each. Returns counts of merged / accepted / total plus per-PR results. Wraps `voApproveAllFixes` admin Cloud Function. V1 stub: returns `verdict: 'unimplemented'` \u2014 cloud-mode wiring pending.";
 function isToolInput16(v) {
   return typeof v === "object" && v !== null;
 }
@@ -4249,7 +4267,7 @@ var inputSchema17 = {
   required: ["pr_number"],
   additionalProperties: false
 };
-var description17 = "Closes a VO pull request and dispatches a self-heal pass to retry the same focus page. Cloud callable refuses non-VO PRs and respects the self-heal kill switch + per-PR retry block. Wraps `voRejectAndRetry` admin Cloud Function. V1 stub: returns `verdict: 'unimplemented'` \u2014 cloud-mode wiring pending.";
+var description17 = "Closes an AlgoHQ pull request and dispatches a self-heal pass to retry the same focus page. Cloud callable refuses non-AlgoHQ PRs and respects the self-heal kill switch + per-PR retry block. Wraps `voRejectAndRetry` admin Cloud Function. V1 stub: returns `verdict: 'unimplemented'` \u2014 cloud-mode wiring pending.";
 function isToolInput17(v) {
   if (typeof v !== "object" || v === null) return false;
   const o = v;
@@ -4325,7 +4343,7 @@ function buildPrompt4(pr, notes) {
   const lines = [
     "You are a release gatekeeper deciding whether a pull request is safe to MERGE.",
     "Recommend exactly one of: merge / hold / reject. Be conservative \u2014 this is a high-stakes irreversible action.",
-    "Rules: HOLD if CI is failing/blocked, there is a merge conflict, or the change is a draft. REJECT if the PR is not a legitimate VO-source change or has no clear purpose. MERGE only if it looks complete, scoped, and unblocked.",
+    "Rules: HOLD if CI is failing/blocked, there is a merge conflict, or the change is a draft. REJECT if the PR is not a legitimate AlgoHQ-source change or has no clear purpose. MERGE only if it looks complete, scoped, and unblocked.",
     "",
     `PR #${pr.number}: ${pr.title}`,
     `Source: ${pr.source ?? "unknown"}`,
@@ -4393,7 +4411,7 @@ async function handleReviewMerge(deps, rawInput, signal) {
   }
   if (pr === null) {
     return emit(
-      emptyPayload("hold", `PR #${prNumber} is not among open VO PRs (already merged/closed, or not a VO-source PR).`, null)
+      emptyPayload("hold", `PR #${prNumber} is not among open AlgoHQ PRs (already merged/closed, or not an AlgoHQ-source PR).`, null)
     );
   }
   const hasBlocker = pr.blocker !== null && pr.blocker !== "none";
@@ -4488,6 +4506,8 @@ function suggestedHandoffPath(session_id, isoTimestamp) {
 }
 
 // src/tools/session/report-session-state.ts
+init_auth_token_source();
+init_credential_store();
 var TOOL_NAME19 = "vo_report_session_state";
 var VALID_AGENT_TYPES = ["claude-code", "codex", "cursor", "continue"];
 var MAX_GOAL_CHARS = 500;
@@ -4538,7 +4558,7 @@ var inputSchema19 = {
   required: ["operator_id", "session_id", "agent_type", "context_used_pct"],
   additionalProperties: false
 };
-var description19 = "Reports per-session context-window utilization to VO and returns a directive: 'continue' (under 70%), 'prepare_handoff' (70-84%), or 'execute_handoff_now' (\u226585%). Implements V1 launch gate #9 (fleet context lifecycle management) per the official VO roadmap. V1 backend is stub-local \u2014 computes the directive purely from `context_used_pct` against the documented thresholds without a network call. Phase 3 wires this to the deployed vo-control-plane HTTP API; the response shape stays stable across the cutover (`backend_mode` field in the payload tells the caller which mode produced the verdict).";
+var description19 = "Reports per-session context-window utilization to AlgoHQ and returns a directive: 'continue' (under 70%), 'prepare_handoff' (70-84%), or 'execute_handoff_now' (\u226585%). Implements V1 launch gate #9 (fleet context lifecycle management) per the official AlgoHQ roadmap. Cloud-control-plane mode when VO_CONTROL_PLANE_URL plus a user/scoped HQ credential (or legacy admin token) is available; auto-allocates the session on first report so interactive agents (Claude Code, Cursor, Codex, Continue) appear on the live fleet whiteboard. Stub-local fallback when cloud config is absent or fails. The response shape stays stable across modes (`backend_mode` field in the payload tells the caller which mode produced the verdict).";
 function isStringArray2(v, maxItems) {
   if (!Array.isArray(v)) return false;
   if (v.length > maxItems) return false;
@@ -4563,33 +4583,93 @@ function isToolInput19(v) {
   }
   return true;
 }
-function getCloudConfig() {
-  const url = process.env["VO_CONTROL_PLANE_URL"];
-  const token = process.env["VO_CONTROL_PLANE_ADMIN_TOKEN"];
-  if (!url || !token) return null;
-  return { url, token };
+async function fetchCloudIdentity(url, token, fetchFn) {
+  try {
+    const response = await fetchFn(`${url}/api/v1/auth/me`, {
+      method: "GET",
+      headers: {
+        "Authorization": `Bearer ${token}`
+      }
+    });
+    if (!response.ok) return null;
+    const data = await response.json();
+    if (!data.ok || !data.provisioned || !data.operator_id || !data.tenant_id) return null;
+    return { operator_id: data.operator_id, tenant_id: data.tenant_id };
+  } catch {
+    return null;
+  }
 }
-async function tryCloudReportState(cloud, input) {
+async function getCloudConfig(fetchFn = fetch) {
+  const url = process.env["VO_CONTROL_PLANE_URL"]?.trim();
+  if (!url) return null;
+  const tokenSource = createAuthTokenSourceFromEnv(
+    process.env,
+    fetchFn,
+    () => readStoredCredential(process.env)
+  );
+  const token = await tokenSource?.getToken();
+  if (!token) return null;
+  const tenant_id = process.env["VO_TENANT_ID"]?.trim();
+  if (tenant_id) return { url, token, tenant_id };
+  const identity = await fetchCloudIdentity(url, token, fetchFn);
+  if (!identity) return null;
+  return { url, token, tenant_id: identity.tenant_id, operator_id: identity.operator_id };
+}
+async function tryCloudReportState(cloud, input, fetchFn = fetch) {
   try {
-    const body = {
+    const reportBody = {
       context_used_pct: input.context_used_pct
     };
-    if (input.current_goal !== void 0) body["current_goal"] = input.current_goal;
+    if (input.current_goal !== void 0) reportBody["current_goal"] = input.current_goal;
     if (input.recent_files_touched !== void 0) {
-      body["recent_files_touched"] = input.recent_files_touched;
+      reportBody["recent_files_touched"] = input.recent_files_touched;
     }
     if (input.recent_tool_uses !== void 0) {
-      body["recent_tool_uses"] = input.recent_tool_uses;
+      reportBody["recent_tool_uses"] = input.recent_tool_uses;
     }
-    const url = `${cloud.url}/api/v1/session/${input.session_id}/report-state`;
-    const response = await fetch(url, {
+    const reportUrl = `${cloud.url}/api/v1/session/${input.session_id}/report-state`;
+    let response = await fetchFn(reportUrl, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
         "Authorization": `Bearer ${cloud.token}`
       },
-      body: JSON.stringify(body)
+      body: JSON.stringify(reportBody)
     });
+    if (response.status === 404) {
+      const allocateBody = {
+        operator_id: cloud.operator_id ?? input.operator_id,
+        tenant_id: cloud.tenant_id,
+        agent_type: input.agent_type,
+        current_goal: input.current_goal ?? "Interactive session"
+      };
+      if (input.context_used_pct > 0) {
+        allocateBody["initial_context_used_pct"] = input.context_used_pct;
+      }
+      const allocateUrl = `${cloud.url}/api/v1/session`;
+      const allocateResponse = await fetchFn(allocateUrl, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "Authorization": `Bearer ${cloud.token}`
+        },
+        body: JSON.stringify(allocateBody)
+      });
+      if (!allocateResponse.ok) {
+        return null;
+      }
+      const allocateData = await allocateResponse.json();
+      const retrySessionId = typeof allocateData.session?.session_id === "string" && allocateData.session.session_id.length > 0 ? allocateData.session.session_id : input.session_id;
+      const retryReportUrl = `${cloud.url}/api/v1/session/${retrySessionId}/report-state`;
+      response = await fetchFn(retryReportUrl, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "Authorization": `Bearer ${cloud.token}`
+        },
+        body: JSON.stringify(reportBody)
+      });
+    }
     if (!response.ok) {
       return null;
     }
@@ -4620,7 +4700,7 @@ async function handleReportSessionState(deps, rawInput, _signal) {
       `invalid input. Required fields: operator_id (non-empty string), session_id (non-empty string), agent_type (one of: ${VALID_AGENT_TYPES.join(" | ")}), context_used_pct (number 0-100). Optional: current_goal (string \u2264${MAX_GOAL_CHARS} chars), recent_files_touched (string[] \u2264${MAX_RECENT_FILES}), recent_tool_uses (string[] \u2264${MAX_RECENT_TOOLS}).`
     );
   }
-  const cloud = getCloudConfig();
+  const cloud = await getCloudConfig();
   if (cloud !== null) {
     const cloudPayload = await tryCloudReportState(cloud, rawInput);
     if (cloudPayload !== null) {
@@ -4703,7 +4783,7 @@ var MANDATORY_READS = [
 function buildSuccessorPrompt(handoffMarkdown, goal) {
   const reads = MANDATORY_READS.map((r, i) => `  ${i + 1}. ${r}`).join("\n");
   const lines = [
-    "You are the SUCCESSOR agent for a Virtual Office lane. The previous session",
+    "You are the SUCCESSOR agent for an AlgoHQ lane. The previous session",
     "exhausted its context and wrote the handoff below. Read it fully, verify its",
     '"verification needed" items against live state (a handoff is a claim, not',
     "evidence \u2014 verify via `git show origin/main:<path>`), then continue the lane.",
@@ -4714,7 +4794,7 @@ function buildSuccessorPrompt(handoffMarkdown, goal) {
     "NON-NEGOTIABLES: multi-model consensus verification is the core; test honesty",
     "(verified-answer-only, no fake green); verify-before-act + human merge approval;",
     "never a full functions-shared deploy; Gen2 only; work in a worktree on your own",
-    "branch; finish line is MERGED + DEPLOYED + LIVE-VERIFIED, and VO changes update",
+    "branch; finish line is MERGED + DEPLOYED + LIVE-VERIFIED, and AlgoHQ changes update",
     "the roadmap in the same PR.",
     "",
     "--- HANDOFF ---",
@@ -4864,6 +4944,27 @@ async function handleConciergeDispatch(deps, rawInput, _signal) {
 import { homedir as homedir5 } from "node:os";
 import { join as join7 } from "node:path";
 import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync3, readdirSync as readdirSync4 } from "node:fs";
+
+// src/tools/memory/safe-memory-file.ts
+import { resolve, sep } from "node:path";
+var SAFE_MEMORY_FILE_RE = /^[A-Za-z0-9][A-Za-z0-9._ -]*\.md$/i;
+function isSafeMemoryFileName(fileName) {
+  return fileName.length <= 200 && fileName.trim() === fileName && !fileName.includes("/") && !fileName.includes("\\") && !fileName.includes(":") && SAFE_MEMORY_FILE_RE.test(fileName);
+}
+function resolveMemoryFilePath(memoryDir, fileName) {
+  if (!isSafeMemoryFileName(fileName)) {
+    throw new Error(`unsafe memory file_name: ${fileName.slice(0, 80)}`);
+  }
+  const root = resolve(memoryDir);
+  const filePath = resolve(root, fileName);
+  const rootPrefix = root.endsWith(sep) ? root : `${root}${sep}`;
+  if (filePath !== root && !filePath.startsWith(rootPrefix)) {
+    throw new Error(`memory file path escapes memory directory: ${fileName.slice(0, 80)}`);
+  }
+  return filePath;
+}
+
+// src/tools/memory/sync-config.ts
 var TOOL_NAME22 = "vo_sync_config";
 var inputSchema22 = {
   type: "object",
@@ -4890,14 +4991,13 @@ function isToolInput22(v) {
   return true;
 }
 function deriveProjectSlug(cwd) {
-  const normalized = cwd.replace(/\\/g, "/");
-  return normalized.replace(/^([A-Z]):/i, (_, drive) => `${drive.toUpperCase()}-`).replace(/\/$/g, "").split("/").join("--").replace(/\s+/g, "-");
+  return cwd.replace(/\\/g, "/").replace(/\/+$/g, "").replace(/^([a-zA-Z]):/, (_m, drive) => `${drive.toUpperCase()}:`).replace(/[^a-zA-Z0-9]/g, "-");
 }
 function getMemoryDir(cwd) {
   const slug = deriveProjectSlug(cwd);
   return join7(homedir5(), ".claude", "projects", slug, "memory");
 }
-async function pullMemory(controlPlaneUrl, token, memoryDir, sessionId, fetchFn) {
+async function pullMemory(controlPlaneUrl, token, memoryDir, fetchFn) {
   const url = `${controlPlaneUrl}/api/v1/agent-config/memory/me`;
   const response = await fetchFn(url, {
     method: "GET",
@@ -4913,10 +5013,13 @@ async function pullMemory(controlPlaneUrl, token, memoryDir, sessionId, fetchFn)
   if (!data.ok || !Array.isArray(data.entries)) {
     throw new Error("GET /api/v1/agent-config/memory/me response missing ok=true or entries array");
   }
+  const writes = data.entries.map((entry) => ({
+    entry,
+    filePath: resolveMemoryFilePath(memoryDir, entry.file_name)
+  }));
   mkdirSync4(memoryDir, { recursive: true });
   const files = [];
-  for (const entry of data.entries) {
-    const filePath = join7(memoryDir, entry.file_name);
+  for (const { entry, filePath } of writes) {
     writeFileSync3(filePath, entry.content, "utf8");
     files.push(entry.file_name);
   }
@@ -4928,7 +5031,7 @@ async function pushMemory(controlPlaneUrl, token, memoryDir, sessionId, fetchFn)
   }
   const localFiles = readdirSync4(memoryDir).filter((f) => f.endsWith(".md")).map((f) => ({
     file_name: f,
-    content: readFileSync7(join7(memoryDir, f), "utf8"),
+    content: readFileSync7(resolveMemoryFilePath(memoryDir, f), "utf8"),
     entry_type: f === "MEMORY.md" ? "index" : "topic"
   }));
   if (localFiles.length === 0) {
@@ -5010,6 +5113,42 @@ async function pushMemory(controlPlaneUrl, token, memoryDir, sessionId, fetchFn)
   }
   return { pushed: localFiles.length, created, updated };
 }
+async function runMemorySync(action, cwd, sessionId, fetchFn = globalThis.fetch) {
+  const controlPlaneUrl = process.env["VO_CONTROL_PLANE_URL"];
+  if (!controlPlaneUrl) {
+    return { synced: false, reason: "VO_CONTROL_PLANE_URL not set \u2014 cloud mode disabled" };
+  }
+  const { createAuthTokenSourceFromEnv: createAuthTokenSourceFromEnv2 } = await Promise.resolve().then(() => (init_auth_token_source(), auth_token_source_exports));
+  const { readStoredCredential: readStoredCredential2 } = await Promise.resolve().then(() => (init_credential_store(), credential_store_exports));
+  const tokenSource = createAuthTokenSourceFromEnv2(process.env, fetchFn, () => readStoredCredential2(process.env));
+  if (!tokenSource) {
+    return { synced: false, reason: "No auth configured. Run `vo-mcp login` to authenticate as an operator." };
+  }
+  const token = await tokenSource.getToken();
+  if (!token) {
+    return { synced: false, reason: "Failed to obtain auth token. Run `vo-mcp login` to re-authenticate." };
+  }
+  const memoryDir = getMemoryDir(cwd);
+  const baseUrl = controlPlaneUrl.replace(/\/+$/, "");
+  try {
+    if (action === "pull") {
+      const result2 = await pullMemory(baseUrl, token, memoryDir, fetchFn);
+      return { synced: true, action: "pull", pulled: result2.pulled, files: result2.files, memory_dir: memoryDir };
+    }
+    const result = await pushMemory(baseUrl, token, memoryDir, sessionId, fetchFn);
+    return {
+      synced: true,
+      action: "push",
+      pushed: result.pushed,
+      created: result.created,
+      updated: result.updated,
+      memory_dir: memoryDir
+    };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return { synced: false, reason: `Sync failed: ${message}` };
+  }
+}
 async function handleSyncConfig(deps, rawInput, _signal, fetchFn = globalThis.fetch) {
   if (!isToolInput22(rawInput)) {
     throw invalidParams(
@@ -5017,95 +5156,438 @@ async function handleSyncConfig(deps, rawInput, _signal, fetchFn = globalThis.fe
       'invalid input. Required: { action: "pull" | "push" }. Optional: { cwd: "<path>" }.'
     );
   }
-  const controlPlaneUrl = process.env["VO_CONTROL_PLANE_URL"];
+  const cwd = rawInput.cwd?.trim() || process.cwd();
+  const result = await runMemorySync(rawInput.action, cwd, deps.session.sessionId, fetchFn);
+  return jsonContent({ tool: TOOL_NAME22, schema_version: 1, payload: result });
+}
+
+// src/tools/memory/private-knowledge.ts
+var UPSERT_TOOL_NAME = "vo_private_knowledge_upsert";
+var CONTEXT_TOOL_NAME = "vo_private_knowledge_context";
+var KNOWLEDGE_CLASSES = ["memory", "skill", "doctrine", "hook", "command"];
+var PRECISION_CHAR_BUDGET = 12e3;
+var upsertInputSchema = {
+  type: "object",
+  properties: {
+    knowledge_class: { type: "string", enum: KNOWLEDGE_CLASSES },
+    source_path: { type: "string", description: "Stable private source identifier; not exposed to other users." },
+    title: { type: "string", description: 'Descriptive, retrieval-friendly title (e.g. "AlgoTax OCR redaction architecture", not "notes") \u2014 retrieval matches on it.' },
+    content: { type: "string", description: "Private knowledge text to store server-side. Keep each entry tight and focused (~1-3 pages, under ~12k chars); split larger corpora into separate entries." }
+  },
+  required: ["knowledge_class", "source_path", "title", "content"],
+  additionalProperties: false
+};
+var contextInputSchema = {
+  type: "object",
+  properties: {
+    query: { type: "string" },
+    limit: { type: "number", minimum: 1, maximum: 50 },
+    knowledge_class: { type: "string", enum: KNOWLEDGE_CLASSES }
+  },
+  required: ["query"],
+  additionalProperties: false
+};
+var upsertDescription = "Uploads or refreshes the authenticated operator\u2019s private cloud knowledge. Works for Claude, Codex, Cursor, and cowork clients via the same vo-mcp login credential. Returns metadata only, not raw stored content. PRECISION DISCIPLINE: keep each entry tight and focused (~1-3 pages) with a descriptive retrieval-friendly title \u2014 retrieval surfaces whole entries, so small dense entries beat bulk dumps. Split large corpora into focused entries, then run a retrieval self-test via vo_private_knowledge_context before relying on the knowledge.";
+var contextDescription = "Retrieves prompt-ready private knowledge context for the authenticated operator. Returns snippets/context only; no raw corpus download. Also the retrieval self-test surface: after upserting critical knowledge, query for it here and confirm the entry surfaces before trusting it in downstream work.";
+function isKnowledgeClass(value) {
+  return typeof value === "string" && KNOWLEDGE_CLASSES.includes(value);
+}
+function isUpsertInput(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const input = value;
+  return isKnowledgeClass(input["knowledge_class"]) && typeof input["source_path"] === "string" && typeof input["title"] === "string" && typeof input["content"] === "string";
+}
+function isContextInput(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const input = value;
+  if (typeof input["query"] !== "string") return false;
+  if (input["limit"] !== void 0 && typeof input["limit"] !== "number") return false;
+  if (input["knowledge_class"] !== void 0 && !isKnowledgeClass(input["knowledge_class"])) return false;
+  return true;
+}
+async function getCloudAuth(fetchFn) {
+  const controlPlaneUrl = process.env["VO_CONTROL_PLANE_URL"]?.replace(/\/+$/, "");
   if (!controlPlaneUrl) {
-    return jsonContent({
-      tool: TOOL_NAME22,
-      schema_version: 1,
-      payload: {
-        synced: false,
-        reason: "VO_CONTROL_PLANE_URL not set \u2014 cloud mode disabled"
-      }
-    });
+    return { ok: false, reason: "VO_CONTROL_PLANE_URL not set \u2014 cloud mode disabled" };
   }
   const { createAuthTokenSourceFromEnv: createAuthTokenSourceFromEnv2 } = await Promise.resolve().then(() => (init_auth_token_source(), auth_token_source_exports));
   const { readStoredCredential: readStoredCredential2 } = await Promise.resolve().then(() => (init_credential_store(), credential_store_exports));
   const tokenSource = createAuthTokenSourceFromEnv2(process.env, fetchFn, () => readStoredCredential2(process.env));
-  if (!tokenSource) {
-    return jsonContent({
-      tool: TOOL_NAME22,
-      schema_version: 1,
-      payload: {
-        synced: false,
-        reason: "No auth configured. Run `vo-mcp login` to authenticate as an operator."
-      }
-    });
-  }
+  if (!tokenSource) return { ok: false, reason: "No auth configured. Run `vo-mcp login`." };
   const token = await tokenSource.getToken();
-  if (!token) {
-    return jsonContent({
-      tool: TOOL_NAME22,
-      schema_version: 1,
-      payload: {
-        synced: false,
-        reason: "Failed to obtain auth token. Run `vo-mcp login` to re-authenticate."
-      }
-    });
+  if (!token) return { ok: false, reason: "Failed to obtain auth token. Run `vo-mcp login` again." };
+  return { ok: true, controlPlaneUrl, token };
+}
+async function callPrivateKnowledge(path3, body, fetchFn) {
+  const auth = await getCloudAuth(fetchFn);
+  if (!auth.ok) return { ok: false, reason: auth.reason };
+  const response = await fetchFn(`${auth.controlPlaneUrl}${path3}`, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${auth.token}`,
+      "content-type": "application/json"
+    },
+    body: JSON.stringify(body)
+  });
+  const text = await response.text();
+  const parsed = text ? JSON.parse(text) : null;
+  if (response.status < 200 || response.status >= 300) {
+    return { ok: false, status: response.status, response: parsed ?? text };
   }
-  const cwd = rawInput.cwd?.trim() || process.cwd();
-  const memoryDir = getMemoryDir(cwd);
+  return parsed;
+}
+async function handlePrivateKnowledgeUpsert(_deps, rawInput, _signal, fetchFn = globalThis.fetch) {
+  if (!isUpsertInput(rawInput)) {
+    throw invalidParams(UPSERT_TOOL_NAME, "expected { knowledge_class, source_path, title, content }.");
+  }
+  const payload = await callPrivateKnowledge("/api/v1/knowledge/private", rawInput, fetchFn);
+  const envelope = {
+    tool: UPSERT_TOOL_NAME,
+    schema_version: 1,
+    payload
+  };
+  if (rawInput.content.length > PRECISION_CHAR_BUDGET) {
+    envelope.precision_note = `content is ${rawInput.content.length} chars (> ${PRECISION_CHAR_BUDGET}). Tight 1-3 page entries retrieve better \u2014 consider splitting into focused entries, then re-test retrieval via ${CONTEXT_TOOL_NAME}.`;
+  }
+  return jsonContent(envelope);
+}
+async function handlePrivateKnowledgeContext(_deps, rawInput, _signal, fetchFn = globalThis.fetch) {
+  if (!isContextInput(rawInput)) {
+    throw invalidParams(CONTEXT_TOOL_NAME, "expected { query, optional limit, optional knowledge_class }.");
+  }
+  const payload = await callPrivateKnowledge("/api/v1/knowledge/private/context", rawInput, fetchFn);
+  return jsonContent({ tool: CONTEXT_TOOL_NAME, schema_version: 1, payload });
+}
+
+// src/tools/hq/whiteboard.ts
+init_auth_token_source();
+init_credential_store();
+var POST_TOOL_NAME = "hq_whiteboard_post";
+var READ_TOOL_NAME = "hq_whiteboard_read";
+var postDescription = "Post an append-only coordination note to the live AlgoHQ whiteboard. Uses the scoped credential from vo-mcp login; operator and tenant ownership are derived by the server.";
+var readDescription = "Read recent coordination notes from the caller's live AlgoHQ whiteboard. Uses the scoped credential from vo-mcp login and cannot widen tenant scope.";
+var postInputSchema = {
+  type: "object",
+  properties: {
+    from: { type: "string", minLength: 1, maxLength: 100, description: "Agent/session display name." },
+    type: { type: "string", minLength: 1, maxLength: 64, description: "Message kind, such as intent, worklog, blocker, or completion." },
+    content: { type: "string", minLength: 1, maxLength: 500, description: "Short coordination note." },
+    targetAgent: { type: "string", maxLength: 100 },
+    tester: { type: "string", maxLength: 100 },
+    tier: { type: "string", maxLength: 32 }
+  },
+  required: ["from", "type", "content"],
+  additionalProperties: false
+};
+var readInputSchema = {
+  type: "object",
+  properties: {
+    limit: { type: "integer", minimum: 1, maximum: 100, default: 25 },
+    since: { type: "string", description: "Optional ISO-8601 lower bound." },
+    type: { type: "string", minLength: 1, maxLength: 64 }
+  },
+  additionalProperties: false
+};
+function resolveTimeoutMs() {
+  const parsed = Number(process.env["HQ_WHITEBOARD_TIMEOUT_MS"]);
+  return Number.isFinite(parsed) && parsed >= 10 && parsed <= 12e4 ? parsed : 1e4;
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function onlyKeys(value, allowed) {
+  return Object.keys(value).every((key) => allowed.includes(key));
+}
+function isBoundedString(value, min, max) {
+  return typeof value === "string" && value.trim().length >= min && value.trim().length <= max;
+}
+function parsePostInput(value) {
+  if (!isRecord(value) || !onlyKeys(value, ["from", "type", "content", "targetAgent", "tester", "tier"])) return null;
+  if (!isBoundedString(value["from"], 1, 100)) return null;
+  if (!isBoundedString(value["type"], 1, 64) || !/^[a-zA-Z0-9_-]+$/.test(value["type"].trim())) return null;
+  if (!isBoundedString(value["content"], 1, 500)) return null;
+  for (const [key, max] of [["targetAgent", 100], ["tester", 100], ["tier", 32]]) {
+    if (value[key] !== void 0 && !isBoundedString(value[key], 0, max)) return null;
+  }
+  return {
+    from: value["from"].trim(),
+    type: value["type"].trim(),
+    content: value["content"].trim(),
+    ...typeof value["targetAgent"] === "string" ? { targetAgent: value["targetAgent"].trim() } : {},
+    ...typeof value["tester"] === "string" ? { tester: value["tester"].trim() } : {},
+    ...typeof value["tier"] === "string" ? { tier: value["tier"].trim() } : {}
+  };
+}
+function parseReadInput(value) {
+  if (!isRecord(value) || !onlyKeys(value, ["limit", "since", "type"])) return null;
+  if (value["limit"] !== void 0 && (!Number.isInteger(value["limit"]) || Number(value["limit"]) < 1 || Number(value["limit"]) > 100)) return null;
+  if (value["since"] !== void 0 && (typeof value["since"] !== "string" || Number.isNaN(Date.parse(value["since"])))) return null;
+  if (value["type"] !== void 0 && !isBoundedString(value["type"], 1, 64)) return null;
+  return {
+    ...typeof value["limit"] === "number" ? { limit: value["limit"] } : {},
+    ...typeof value["since"] === "string" ? { since: value["since"] } : {},
+    ...typeof value["type"] === "string" ? { type: value["type"].trim() } : {}
+  };
+}
+async function resolveCloud(fetchFn) {
+  const url = process.env["VO_CONTROL_PLANE_URL"]?.trim().replace(/\/$/, "");
+  if (!url) return null;
   try {
-    if (rawInput.action === "pull") {
-      const result = await pullMemory(
-        controlPlaneUrl.replace(/\/+$/, ""),
-        token,
-        memoryDir,
-        deps.sessionId,
-        fetchFn
-      );
-      return jsonContent({
-        tool: TOOL_NAME22,
-        schema_version: 1,
-        payload: {
-          synced: true,
-          action: "pull",
-          pulled: result.pulled,
-          files: result.files,
-          memory_dir: memoryDir
-        }
-      });
-    } else {
-      const result = await pushMemory(
-        controlPlaneUrl.replace(/\/+$/, ""),
-        token,
-        memoryDir,
-        deps.sessionId,
-        fetchFn
-      );
-      return jsonContent({
-        tool: TOOL_NAME22,
-        schema_version: 1,
-        payload: {
-          synced: true,
-          action: "push",
-          pushed: result.pushed,
-          created: result.created,
-          updated: result.updated,
-          memory_dir: memoryDir
-        }
-      });
+    const source = createAuthTokenSourceFromEnv(process.env, fetchFn, () => readStoredCredential(process.env));
+    const token = await source?.getToken();
+    return token ? { url, token } : null;
+  } catch {
+    return null;
+  }
+}
+async function callWhiteboard(method, bodyOrQuery, signal, fetchFn = fetch) {
+  const cloud = await resolveCloud(fetchFn);
+  if (!cloud) {
+    return {
+      ok: false,
+      error: "hq_whiteboard_not_configured",
+      message: "Set VO_CONTROL_PLANE_URL and run vo-mcp login to install a scoped HQ credential."
+    };
+  }
+  const timeoutSignal = AbortSignal.timeout(resolveTimeoutMs());
+  const requestSignal = signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal;
+  const query = new URLSearchParams();
+  if (method === "GET") {
+    const input = bodyOrQuery;
+    query.set("limit", String(input.limit ?? 25));
+    if (input.since) query.set("since", input.since);
+    if (input.type) query.set("type", input.type);
+  }
+  try {
+    const response = await fetchFn(
+      `${cloud.url}/api/v1/hq/whiteboard/messages${query.size ? `?${query}` : ""}`,
+      {
+        method,
+        headers: {
+          Authorization: `Bearer ${cloud.token}`,
+          ...method === "POST" ? { "Content-Type": "application/json" } : {}
+        },
+        ...method === "POST" ? { body: JSON.stringify(bodyOrQuery) } : {},
+        signal: requestSignal
+      }
+    );
+    const text = await response.text();
+    let payload;
+    try {
+      payload = JSON.parse(text);
+    } catch {
+      payload = { ok: false, error: "invalid_response", message: text.slice(0, 200) };
+    }
+    if (!response.ok) {
+      return { ok: false, error: "hq_whiteboard_http_error", status: response.status, response: payload };
+    }
+    return payload;
+  } catch (error) {
+    return {
+      ok: false,
+      error: signal?.aborted ? "cancelled" : timeoutSignal.aborted ? "hq_whiteboard_timeout" : "hq_whiteboard_unreachable",
+      message: error instanceof Error ? error.message.slice(0, 200) : String(error).slice(0, 200)
+    };
+  }
+}
+async function handleHqWhiteboardPost(_deps, rawInput, signal) {
+  const input = parsePostInput(rawInput);
+  if (!input) throw invalidParams(POST_TOOL_NAME, "requires from, type, and 1-500 character content; unknown fields are rejected");
+  return jsonContent(await callWhiteboard("POST", input, signal));
+}
+async function handleHqWhiteboardRead(_deps, rawInput, signal) {
+  const input = parseReadInput(rawInput);
+  if (!input) throw invalidParams(READ_TOOL_NAME, "limit must be 1-100, since must be ISO-8601, and unknown fields are rejected");
+  return jsonContent(await callWhiteboard("GET", input, signal));
+}
+
+// src/tools/skills/skill-corpus.ts
+import { existsSync as existsSync6, statSync as statSync5 } from "node:fs";
+import { dirname as dirname5, isAbsolute, join as join9, resolve as resolve2 } from "node:path";
+
+// ../skill-registry/src/loader.ts
+import { readdirSync as readdirSync5, readFileSync as readFileSync8, statSync as statSync4 } from "node:fs";
+import { join as join8 } from "node:path";
+var InvalidSkillFrontmatterError = class extends Error {
+  constructor(skillFile, reason) {
+    super(`Invalid frontmatter in ${skillFile}: ${reason}`);
+    this.skillFile = skillFile;
+    this.reason = reason;
+  }
+  skillFile;
+  reason;
+  name = "InvalidSkillFrontmatterError";
+};
+var FRONTMATTER_DELIMITER = "---";
+function parseFrontmatter(rawInput, sourcePath) {
+  const raw = rawInput.replace(/\r\n/g, "\n");
+  if (!raw.startsWith(`${FRONTMATTER_DELIMITER}
+`)) {
+    throw new InvalidSkillFrontmatterError(sourcePath, 'file does not start with frontmatter delimiter "---"');
+  }
+  const afterFirst = raw.slice(FRONTMATTER_DELIMITER.length + 1);
+  const closingIdx = afterFirst.indexOf(`
+${FRONTMATTER_DELIMITER}
+`);
+  if (closingIdx === -1) {
+    throw new InvalidSkillFrontmatterError(sourcePath, 'missing closing frontmatter delimiter "---"');
+  }
+  const frontmatterText = afterFirst.slice(0, closingIdx);
+  const body = afterFirst.slice(closingIdx + `
+${FRONTMATTER_DELIMITER}
+`.length);
+  let name = "";
+  let description23 = "";
+  for (const line of frontmatterText.split("\n")) {
+    const trimmed = line.trim();
+    if (trimmed.length === 0) continue;
+    const colonIdx = trimmed.indexOf(":");
+    if (colonIdx === -1) continue;
+    const key = trimmed.slice(0, colonIdx).trim();
+    const value = trimmed.slice(colonIdx + 1).trim();
+    if (key === "name") name = value;
+    else if (key === "description") description23 = value;
+  }
+  if (name.length === 0) {
+    throw new InvalidSkillFrontmatterError(sourcePath, 'missing required field "name"');
+  }
+  if (description23.length === 0) {
+    throw new InvalidSkillFrontmatterError(sourcePath, 'missing required field "description"');
+  }
+  return { name, description: description23, body };
+}
+function loadSkillsFromDir(skillsDir) {
+  const entries = readdirSync5(skillsDir);
+  const skills = [];
+  for (const entry of entries) {
+    const entryPath = join8(skillsDir, entry);
+    let stat;
+    try {
+      stat = statSync4(entryPath);
+    } catch {
+      continue;
     }
+    if (!stat.isDirectory()) continue;
+    const skillFile = join8(entryPath, "SKILL.md");
+    let raw;
+    try {
+      raw = readFileSync8(skillFile, "utf8");
+    } catch {
+      continue;
+    }
+    const { name, description: description23, body } = parseFrontmatter(raw, skillFile);
+    skills.push({ name, description: description23, body, sourcePath: skillFile });
+  }
+  return [...skills].sort((a, b) => a.name.localeCompare(b.name));
+}
+
+// src/tools/skills/skill-corpus.ts
+var LIST_TOOL_NAME = "vo_skill_list";
+var GET_TOOL_NAME = "vo_skill_get";
+var listDescription = "List the Algosuite skill corpus (name + trigger description for every skill). Call once near session start to learn which skills exist; then fetch the full instructions for a relevant skill with vo_skill_get. This is the same corpus Claude Code loads natively from .claude/skills \u2014 served over MCP so every vendor works from identical playbooks. Pass refresh:true to re-scan from disk.";
+var getDescription = "Fetch the full markdown instructions of one Algosuite skill by name. Follow the returned instructions for the current task the same way a native skill invocation would. Use vo_skill_list to discover skill names.";
+var listInputSchema = {
+  type: "object",
+  properties: {
+    refresh: {
+      type: "boolean",
+      description: "Re-scan the skills directory instead of using the cached corpus."
+    }
+  },
+  required: []
+};
+var getInputSchema = {
+  type: "object",
+  properties: {
+    name: {
+      type: "string",
+      description: "Skill name exactly as returned by vo_skill_list."
+    }
+  },
+  required: ["name"]
+};
+var MAX_WALK_UP_LEVELS = 8;
+var cachedCorpus = null;
+function resolveSkillsDir(env = process.env, startDir = process.cwd()) {
+  const override = env.VO_SKILLS_DIR;
+  if (typeof override === "string" && override.length > 0) {
+    const abs = isAbsolute(override) ? override : resolve2(startDir, override);
+    return existsSync6(abs) && statSync5(abs).isDirectory() ? abs : null;
+  }
+  let dir = resolve2(startDir);
+  for (let i = 0; i < MAX_WALK_UP_LEVELS; i += 1) {
+    const candidate = join9(dir, ".claude", "skills");
+    if (existsSync6(candidate) && statSync5(candidate).isDirectory()) return candidate;
+    const parent = dirname5(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}
+function loadCorpus() {
+  const skillsDir = resolveSkillsDir();
+  if (skillsDir === null) {
+    return {
+      skills: [],
+      skillsDir: null,
+      unavailableReason: "No skills directory found. Set VO_SKILLS_DIR or run inside a repo with .claude/skills."
+    };
+  }
+  try {
+    return { skills: loadSkillsFromDir(skillsDir), skillsDir, unavailableReason: null };
   } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
+    const message = err instanceof Error ? `${err.name}: ${err.message}` : String(err);
+    return { skills: [], skillsDir, unavailableReason: message };
+  }
+}
+function getCorpus(refresh) {
+  if (refresh || cachedCorpus === null) {
+    cachedCorpus = loadCorpus();
+  }
+  return cachedCorpus;
+}
+async function handleSkillList(_deps, rawInput) {
+  const input = rawInput ?? {};
+  const refresh = input.refresh === true;
+  const corpus = getCorpus(refresh);
+  return jsonContent({
+    corpus_available: corpus.unavailableReason === null,
+    skills_dir: corpus.skillsDir,
+    unavailable_reason: corpus.unavailableReason,
+    skill_count: corpus.skills.length,
+    skills: corpus.skills.map((s) => ({ name: s.name, description: s.description }))
+  });
+}
+async function handleSkillGet(_deps, rawInput) {
+  const input = rawInput ?? {};
+  if (typeof input.name !== "string" || input.name.trim().length === 0) {
+    throw invalidParams(GET_TOOL_NAME, 'input field "name" (non-empty string) is required');
+  }
+  const requested = input.name.trim();
+  const corpus = getCorpus(false);
+  if (corpus.unavailableReason !== null) {
     return jsonContent({
-      tool: TOOL_NAME22,
-      schema_version: 1,
-      payload: {
-        synced: false,
-        reason: `Sync failed: ${message}`
-      }
+      corpus_available: false,
+      unavailable_reason: corpus.unavailableReason,
+      skill: null
     });
   }
+  const skill = corpus.skills.find((s) => s.name === requested);
+  if (skill === void 0) {
+    throw invalidParams(
+      GET_TOOL_NAME,
+      `unknown skill "${requested}". Known skills: ${corpus.skills.map((s) => s.name).join(", ")}`
+    );
+  }
+  return jsonContent({
+    corpus_available: true,
+    skill: {
+      name: skill.name,
+      description: skill.description,
+      instructions: skill.body,
+      source_path: skill.sourcePath
+    }
+  });
 }
 
 // src/server.ts
@@ -5286,6 +5768,54 @@ function buildToolRegistry() {
         inputSchema: inputSchema22
       },
       handler: handleSyncConfig
+    },
+    [UPSERT_TOOL_NAME]: {
+      definition: {
+        name: UPSERT_TOOL_NAME,
+        description: upsertDescription,
+        inputSchema: upsertInputSchema
+      },
+      handler: handlePrivateKnowledgeUpsert
+    },
+    [CONTEXT_TOOL_NAME]: {
+      definition: {
+        name: CONTEXT_TOOL_NAME,
+        description: contextDescription,
+        inputSchema: contextInputSchema
+      },
+      handler: handlePrivateKnowledgeContext
+    },
+    [POST_TOOL_NAME]: {
+      definition: {
+        name: POST_TOOL_NAME,
+        description: postDescription,
+        inputSchema: postInputSchema
+      },
+      handler: handleHqWhiteboardPost
+    },
+    [READ_TOOL_NAME]: {
+      definition: {
+        name: READ_TOOL_NAME,
+        description: readDescription,
+        inputSchema: readInputSchema
+      },
+      handler: handleHqWhiteboardRead
+    },
+    [LIST_TOOL_NAME]: {
+      definition: {
+        name: LIST_TOOL_NAME,
+        description: listDescription,
+        inputSchema: listInputSchema
+      },
+      handler: handleSkillList
+    },
+    [GET_TOOL_NAME]: {
+      definition: {
+        name: GET_TOOL_NAME,
+        description: getDescription,
+        inputSchema: getInputSchema
+      },
+      handler: handleSkillGet
     }
   };
 }
@@ -5344,7 +5874,7 @@ function listToolNames() {
 // src/cache/sqlite-cache.ts
 import { createHash as createHash3 } from "node:crypto";
 import { chmodSync as chmodSync3, mkdirSync as mkdirSync5 } from "node:fs";
-import { dirname as dirname5 } from "node:path";
+import { dirname as dirname6 } from "node:path";
 import { DatabaseSync } from "node:sqlite";
 
 // src/cache/canonicalize.ts
@@ -5389,7 +5919,7 @@ function normalizeString(s) {
 function createSqliteCache(options) {
   const fileBacked = options.dbPath !== ":memory:";
   if (fileBacked) {
-    mkdirSync5(dirname5(options.dbPath), { recursive: true, mode: 448 });
+    mkdirSync5(dirname6(options.dbPath), { recursive: true, mode: 448 });
   }
   const versionNamespace = options.cacheVersionNamespace ?? "";
   const db = new DatabaseSync(options.dbPath);
@@ -5575,6 +6105,44 @@ function createNullConsensusEngineClient(reason = NULL_CLIENT_DEFAULT_REASON) {
 // src/consensus/engine-client.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
 
+// src/consensus/meta-model-caller.ts
+var META_CONSENSUS_MODEL = "muse-spark-1.1";
+var META_MODEL_API_KEY_ENV = "MODEL_API_KEY";
+var META_MODEL_API_KEY_ALIAS = "META_API";
+function createMetaModelCaller(options = {}) {
+  void options;
+  return async function callMetaWithMetrics2() {
+    throw new Error(
+      "Muse Spark direct consensus is disabled. Use an explicit sanitized task capsule through the AlgoSuite Model Firewall."
+    );
+  };
+}
+var callMetaWithMetrics = createMetaModelCaller();
+
+// src/consensus/consensus-panel.ts
+var VO_MCP_CONSENSUS_PANEL = {
+  anthropic: "claude-opus-4-7",
+  openai: "gpt-5",
+  // gemini-2.5-FLASH (not -pro): flash accepts the default thinkingBudget=0 from
+  // callGeminiWithMetrics; 2.5-pro REJECTS budget 0 ("only works in thinking mode").
+  // Flash is also ~10x cheaper. 2026-06-02.
+  google: "gemini-2.5-flash",
+  deepseek: "deepseek-chat",
+  // Muse Spark identity is owned by meta-model-caller.ts (single source of
+  // truth for the meta slot); re-exported here so the panel stays complete.
+  meta: META_CONSENSUS_MODEL
+};
+function getVoMcpConsensusPanel(panel = VO_MCP_CONSENSUS_PANEL) {
+  for (const [provider, modelId] of Object.entries(panel)) {
+    if (typeof modelId !== "string" || modelId.trim().length === 0) {
+      throw new Error(
+        `getVoMcpConsensusPanel: panel slot "${provider}" has a missing or blank model ID`
+      );
+    }
+  }
+  return panel;
+}
+
 // src/consensus/engine-options.ts
 var AGREEMENT_GATE_ENV_VAR = "VO_CONSENSUS_AGREEMENT_GATE";
 function isTruthyFlag(raw) {
@@ -5621,6 +6189,25 @@ function mapFanOutDiagnostics(fd) {
     refused: fd.refused
   };
 }
+var SHADOW_SYNTHESIS_ENV_VAR = "VO_CONSENSUS_SHADOW";
+function shadowEnabled(env) {
+  const raw = (env ?? {})[SHADOW_SYNTHESIS_ENV_VAR];
+  if (raw === void 0) return true;
+  const norm = raw.trim().toLowerCase();
+  return !(norm === "0" || norm === "false" || norm === "no" || norm === "off" || norm === "");
+}
+function mapShadowSynthesis(s) {
+  if (s === void 0) return void 0;
+  return {
+    incumbent: { verdict: s.incumbent.verdict, confidence: s.incumbent.confidence, synthesizer: s.incumbent.synthesizer },
+    adaptive: {
+      verdict: s.adaptive.verdict,
+      confidence: s.adaptive.confidence,
+      ...s.adaptive.calibrated_confidence !== void 0 ? { calibrated_confidence: s.adaptive.calibrated_confidence } : {}
+    },
+    agree: s.agree
+  };
+}
 function mapCitationGrade(cg) {
   if (cg === void 0) return void 0;
   return {
@@ -5761,7 +6348,12 @@ function createEngineConsensusClient(options) {
         const engineOptions = {
           panel,
           ...options.per_model_timeout_ms !== void 0 ? { per_model_timeout_ms: options.per_model_timeout_ms } : {},
-          ...agreementGate !== void 0 ? { agreement_gate: agreementGate } : {}
+          ...agreementGate !== void 0 ? { agreement_gate: agreementGate } : {},
+          // Stage A7-shadow: run the adaptive verdict alongside the live one for grading.
+          // Cheap (pure log-odds over already-fetched verdicts; no extra model calls),
+          // PII-free, and never alters the live verdict. ON by default; kill with
+          // VO_CONSENSUS_SHADOW=0. Cold-start has no skill registry → neutral priors.
+          shadow_synthesis: { enabled: shadowEnabled(options.env) }
         };
         const sources = request.source_urls;
         const useSourceGrounded = sources !== void 0 && sources.length > 0 && typeof engine.runSourceGroundedConsensus === "function";
@@ -5817,6 +6409,12 @@ function createEngineConsensusClient(options) {
           ...sourceExtras?.escalation_reason !== void 0 ? { escalation_reason: sourceExtras.escalation_reason } : response.escalation_reason !== void 0 ? { escalation_reason: response.escalation_reason } : {},
           // Feature 1 (agreement-gate) — fan-out diagnostics (additive telemetry).
           ...mapFanOutDiagnostics(response.fan_out_diagnostics) !== void 0 ? { fan_out_diagnostics: mapFanOutDiagnostics(response.fan_out_diagnostics) } : {},
+          // Stage A7-shadow — adaptive-vs-incumbent comparison (PII-free; present iff shadow on).
+          ...mapShadowSynthesis(response.shadow_synthesis) !== void 0 ? { shadow_synthesis: mapShadowSynthesis(response.shadow_synthesis) } : {},
+          // Critique-uptake (2026-07-20 red-team fix) — verifier-critique
+          // visibility report; previously computed by the engine on every
+          // call but dropped at this boundary.
+          ...response.critique_uptake !== void 0 ? { critique_uptake: response.critique_uptake } : {},
           // Source-grounded additive outputs (Tier-4 features).
           ...useSourceGrounded ? { source_grounded: true } : {},
           ...sourceExtras?.citation_grade !== void 0 ? { citation_grade: sourceExtras.citation_grade } : {},
@@ -5832,25 +6430,12 @@ function createEngineConsensusClient(options) {
     }
   };
 }
-var DEFAULT_MODELS = {
-  // These ids match the strategic-roadmap §4 `newsStandard` / `newsDeep` panel
-  // intent — current production model ids. Per handoff §C-3 these MUST come
-  // from `CONSENSUS_PANELS` in `functions-shared/shared-model-resolvers.ts`
-  // for V1; placeholder defaults here keep Phase 2 Lane A non-blocking.
-  anthropic: "claude-opus-4-7",
-  openai: "gpt-5",
-  // gemini-2.5-FLASH (not -pro): flash accepts the default thinkingBudget=0 from
-  // callGeminiWithMetrics; 2.5-pro REJECTS budget 0 ("only works in thinking mode").
-  // Flash is also ~10x cheaper. 2026-06-02.
-  google: "gemini-2.5-flash",
-  deepseek: "deepseek-chat"
-};
+var DEFAULT_MODELS = getVoMcpConsensusPanel();
 function probeProviders(env = process.env) {
   const out = [];
   if ((env["ANTHROPIC_API_KEY"] ?? "").trim().length > 0) out.push("anthropic");
   if ((env["OPENAI_API_KEY"] ?? "").trim().length > 0) out.push("openai");
   if ((env["GOOGLE_API_KEY"] ?? "").trim().length > 0) out.push("google");
-  if ((env["DEEPSEEK_API_KEY"] ?? "").trim().length > 0) out.push("deepseek");
   return out;
 }
 async function loadFactoryAndCallers(injectedEngine, injectedShared) {
@@ -5896,21 +6481,24 @@ async function tryCreateEngineConsensusClientFromEnvAsync(options = {}) {
     anthropic: loaded.shared.callAnthropicWithMetrics,
     openai: loaded.shared.callOpenAIWithMetrics,
     google: loaded.shared.callGeminiWithMetrics,
-    deepseek: loaded.shared.callDeepSeekWithMetrics
+    deepseek: loaded.shared.callDeepSeekWithMetrics,
+    meta: options.metaCaller ?? callMetaWithMetrics
   };
   const modelByProvider = {
     anthropic: options.models?.anthropic ?? DEFAULT_MODELS.anthropic,
     openai: options.models?.openai ?? DEFAULT_MODELS.openai,
     google: options.models?.google ?? DEFAULT_MODELS.google,
-    deepseek: options.models?.deepseek ?? DEFAULT_MODELS.deepseek
+    deepseek: options.models?.deepseek ?? DEFAULT_MODELS.deepseek,
+    meta: options.models?.meta ?? DEFAULT_MODELS.meta
   };
+  const adapterEnv = !(env[META_MODEL_API_KEY_ENV] ?? "").trim() && (env[META_MODEL_API_KEY_ALIAS] ?? "").trim() ? { ...env, [META_MODEL_API_KEY_ENV]: env[META_MODEL_API_KEY_ALIAS] } : env;
   const panel = [];
   for (const p of providers) {
     try {
       const adapter = loaded.engine.createAdapter(p, {
         model: modelByProvider[p],
         caller: callerByProvider[p],
-        envSource: env
+        envSource: adapterEnv
       });
       panel.push(adapter);
     } catch {