@descix/cli 1.0.17 → 1.0.19

package/lib/commands/retired-verbs.js

@@ -0,0 +1,106 @@
+/**
+ * ONE OWNER for every retired CLI verb: a table and one refusal.
+ *
+ * A retired verb's implementation is deleted; its NAME stays registered, hidden, so typing it
+ * exits non-zero naming the replacement instead of earning commander's "unknown command". That
+ * is not a compat fence: nothing here works under an old name.
+ *
+ * bin/descix.js calls registerAllRetiredVerbs() once and names no retired verb itself, and no
+ * other module registers a hidden command (tests/retired-verbs-one-path.test.js). Retiring a verb
+ * is one row in RETIRED_VERBS.
+ */
+
+import chalk from 'chalk';
+import { TOP_LEVEL_API_URL_REMEDY } from '../workspace-config.js';
+import { MICROSERVICE_AUTH_MODEL } from './microservice-auth-model.js';
+import { CANONICAL_KB_SYNC, CANONICAL_KB_CREATE } from './kb-sync-surface.js';
+
+const kbSyncRefusal = (invocation) =>
+  `❌ \`${invocation}\` has been REMOVED. There is no replacement flag and no fallback.\n\n` +
+  `Use the one canonical KB sync surface:\n` +
+  `  ${CANONICAL_KB_SYNC} -a <app_id> [-k <kb_name>]\n\n` +
+  `It syncs from a git-tracked corpus manifest (.descix/manifests/), which the removed ` +
+  `path could not do. If the KB does not exist yet, create it first with ` +
+  `\`${CANONICAL_KB_CREATE}\`.`;
+const KB_SYNC_DESCRIPTION = `REMOVED — use \`${CANONICAL_KB_SYNC}\``;
+
+/**
+ * Every retired verb. `invocation` is what a user types; `parent` is the id of the commander
+ * parent it hangs off (a root passed to registerAllRetiredVerbs, or an earlier row); `refusal`
+ * renders the full text printed on refusal.
+ */
+export const RETIRED_VERBS = Object.freeze([
+  // The KB sync surfaces superseded by `descix kb corpus sync`.
+  { id: 'sync', parent: 'program', name: 'sync', invocation: 'descix sync',
+    description: KB_SYNC_DESCRIPTION, refusal: kbSyncRefusal },
+  { id: 'sync.kb', parent: 'sync', name: 'kb', invocation: 'descix sync kb',
+    description: KB_SYNC_DESCRIPTION, refusal: kbSyncRefusal },
+  { id: 'kb.chunk', parent: 'kb', name: 'chunk', invocation: 'descix kb chunk',
+    description: KB_SYNC_DESCRIPTION, refusal: kbSyncRefusal },
+  { id: 'kb.sync', parent: 'kb', name: 'sync', invocation: 'descix kb sync',
+    description: KB_SYNC_DESCRIPTION, refusal: kbSyncRefusal },
+  // It assigned a top-level `apiUrl` that save() never serialized and printed success over it.
+  { id: 'config.set-url', parent: 'config', name: 'set-url', invocation: 'descix config set-url',
+    description: 'retired — see error text',
+    refusal: () =>
+      '"descix config set-url" is retired: it never wrote the origin it reported (a retired top-level\n' +
+      'key that nothing reads). Set the API origin where it is read, env.apiUrl, with one of:\n' +
+      `  ${TOP_LEVEL_API_URL_REMEDY}` },
+  // There is no per-app microservice delegate key (CEO-D-2026-06-02-APP-DATA-PLANE).
+  { id: 'microservice.register-delegate', parent: 'microservice', name: 'register-delegate',
+    invocation: 'descix microservice register-delegate', description: 'removed — see error text',
+    refusal: () =>
+      '"descix microservice register-delegate" has been removed: there is no per-app microservice ' +
+      'delegate key.\n' + MICROSERVICE_AUTH_MODEL },
+]);
+
+/** Implementations deleted with the KB sync surfaces. No exported symbol survives without a caller. */
+export const DELETED_KB_SYNC_SYMBOLS = Object.freeze([
+  'runKbChunk',
+  'runKbSync',
+  'runKbBuild',
+  'runKbStatus',
+  'runKbCompare',
+  'updateKB',
+]);
+
+/** The exact text a retired verb prints. */
+export function retiredVerbRefusal(verb) {
+  return verb.refusal(verb.invocation);
+}
+
+/** THE refusal: print the verb's text and exit non-zero. Never warns, never falls back. */
+export function refuseRetiredVerb(verb) {
+  console.error(chalk.red(`\n${retiredVerbRefusal(verb)}\n`));
+  process.exit(1);
+}
+
+/**
+ * Register every row of RETIRED_VERBS, hidden, under its parent. Each accepts and ignores the old
+ * arguments and options so an old script fails with the refusal rather than a commander parse
+ * error. helpOption(false) is load-bearing: commander answers `--help` BEFORE the action and exits
+ * 0, so without it the most natural way to probe a dead verb is the one way it appears to work.
+ *
+ * @param {Record<string, import('commander').Command>} roots - seed parents by id, e.g. { program, kb, config, microservice }
+ * @returns {Record<string, import('commander').Command>} roots plus each registered verb by id
+ */
+export function registerAllRetiredVerbs(roots) {
+  const byId = { ...roots };
+  for (const verb of RETIRED_VERBS) {
+    const parent = byId[verb.parent];
+    if (!parent) {
+      throw new Error(
+        `retired-verbs: no parent '${verb.parent}' available for '${verb.invocation}'. ` +
+        'Seed it in the roots map or order the table so the parent is registered first.'
+      );
+    }
+    byId[verb.id] = parent
+      .command(verb.name, { hidden: true })
+      .description(verb.description)
+      .allowUnknownOption(true)
+      .helpOption(false)
+      .argument('[args...]', 'ignored')
+      .action(() => refuseRetiredVerb(verb));
+  }
+  return byId;
+}

package/lib/help-guard.js

@@ -0,0 +1,85 @@
+/**
+ * A COMMAND THAT DOES NOT EXIST MUST NOT APPEAR TO HAVE HELP.
+ *
+ * Commander resolves `--help` before it resolves the command, so `descix update --help` printed the
+ * TOP-LEVEL help and exited 0 — indistinguishable, to a reader or a script, from a real verb with
+ * help. `descix update` alone correctly says `error: unknown command 'update'`.
+ *
+ * That exit 0 is not only wrong, it TAUGHT something wrong: the daita-sdk docs tell readers that
+ * `site upload --help` "silently prints top-level help" and to use `help <sub>` instead. It does no
+ * such thing for a real command; the author had been probing a command that did not exist (devx
+ * review 2026-09-19, I2 → S5).
+ *
+ * This guard runs ONLY when a help flag is present, so every other path keeps Commander's own
+ * behaviour (it already exits non-zero for an unknown command without `--help`).
+ */
+
+const HELP_FLAGS = new Set(['-h', '--help']);
+
+/** Does this option consume the next argv token as its value? */
+function takesValue(option) {
+    return Boolean(option && option.required);
+}
+
+function findOption(command, token) {
+    const name = token.split('=')[0];
+    return command.options.find((o) => o.short === name || o.long === name);
+}
+
+function findSubcommand(command, token) {
+    return command.commands.find(
+        (c) => c.name() === token || (typeof c.aliases === 'function' && c.aliases().includes(token)),
+    );
+}
+
+/**
+ * Walk argv down the command tree and return the first token that should name a subcommand but does
+ * not. Returns null when every command token resolves — including when a command takes positional
+ * arguments (a command with no subcommands ends the walk, so `descix chat hello` is not "unknown").
+ *
+ * @param {import('commander').Command} program
+ * @param {string[]} argv arguments after the node binary and script (process.argv.slice(2))
+ * @returns {{token: string, parent: import('commander').Command}|null}
+ */
+export function findUnknownCommand(program, argv) {
+    let command = program;
+    for (let i = 0; i < argv.length; i++) {
+        const token = argv[i];
+        if (token === '--') break;
+        if (token.startsWith('-')) {
+            if (takesValue(findOption(command, token)) && !token.includes('=')) i++;
+            continue;
+        }
+        // A command with no subcommands takes positional arguments from here on.
+        if (command.commands.length === 0) break;
+        const sub = findSubcommand(command, token);
+        if (!sub) return { token, parent: command };
+        command = sub;
+    }
+    return null;
+}
+
+/** The command names `parent` actually has, for the "did you mean" line. */
+function nameList(parent) {
+    return parent.commands.map((c) => c.name()).sort();
+}
+
+/**
+ * When argv asks for help on a command that does not exist, refuse by name and exit 1.
+ *
+ * @param {import('commander').Command} program
+ * @param {string[]} argv
+ * @param {{ error: (msg: string) => void, exit: (code: number) => void }} io
+ */
+export function assertKnownCommandForHelp(program, argv, io = { error: console.error, exit: process.exit }) {
+    if (!argv.some((a) => HELP_FLAGS.has(a))) return;
+    const unknown = findUnknownCommand(program, argv);
+    if (!unknown) return;
+
+    const path = [];
+    for (let c = unknown.parent; c && c.parent; c = c.parent) path.unshift(c.name());
+    const where = path.length ? `'descix ${path.join(' ')}'` : 'descix';
+    io.error(`error: unknown command '${unknown.token}'`);
+    io.error(`${where} has: ${nameList(unknown.parent).join(', ')}`);
+    io.exit(1);
+}

package/lib/service-api-client.js

@@ -13,8 +13,8 @@
  *
  * Difference from the CLI: a Cloud Run service has no `.descix/wallet.json` and no TTY. So:
  *   - the developer credential is supplied EXPLICITLY (read from the service's config — the
- *     GITIGNORED dev-overrides.json in dev / a SECRET in prod, NEVER checked-in
- *     defaults-config.json, because the signature is a credential), and
+ *     app's defaults-config, the developer's choice, or Secret Manager; a defaults-config
+ *     credential ships inside the image and must never be committed to a public repo), and
  *   - on a session-refresh failure it HARD-FAILS (serviceMode) — it never tries interactive
  *     device login.
  *
@@ -50,15 +50,16 @@ export function createServiceApiClient({ baseUrl, walletAddress, signature, user
   }
   if (!walletAddress || typeof walletAddress !== 'string') {
     throw new Error(
-      'createServiceApiClient: walletAddress is required — the developer credential. Put it in the ' +
-      'GITIGNORED dev-overrides.json (dev) / a secret (prod), never defaults-config.json. No fallback.'
+      'createServiceApiClient: walletAddress is required — the developer credential. ' +
+      'It may live in the app defaults-config (your choice, e.g. a private repo) or in Secret Manager. ' +
+      'A credential in defaults-config ships inside the image; never commit it to a repo that is or will be public. No fallback.'
     );
   }
   if (!signature || typeof signature !== 'string') {
     throw new Error(
       'createServiceApiClient: signature is required — the developer durable credential (from their ' +
-      '.descix/wallet.json). Put it in the GITIGNORED dev-overrides.json (dev) / a secret (prod), ' +
-      'never defaults-config.json. No fallback.'
+      '.descix/wallet.json). It may live in the app defaults-config (your choice, e.g. a private repo) or in Secret Manager. ' +
+      'A credential in defaults-config ships inside the image; never commit it to a repo that is or will be public. No fallback.'
     );
   }
 

package/lib/verb-invokes.generated.json

@@ -103,7 +103,6 @@
   "config set-gateway-port": [],
   "config set-powch-url": [],
   "config set-site-url": [],
-  "config set-url": [],
   "config show": [],
   "credits balance": [
     "get_credit_balance"
@@ -174,10 +173,6 @@
   "microservice register": [
     "register_service"
   ],
-  "microservice register-delegate": [
-    "fetch_my_purchases",
-    "register_delegate"
-  ],
   "microservice reload": [
     "reload_service_manifests"
   ],

package/lib/workspace-config.js

@@ -5,7 +5,7 @@ import { resolveOrigin } from './origin.js';
 // The one canonical KB-sync surface, from its owner. The example in requireContext() is a remedy
 // a stuck developer will copy verbatim, so it must resolve to the live verb rather than a literal
 // that can go stale where nobody is watching.
-import { CANONICAL_KB_SYNC } from './commands/retired-kb-sync.js';
+import { CANONICAL_KB_SYNC } from './commands/kb-sync-surface.js';
 import { npxCommand } from './invocation.js';
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@descix/cli",
-  "version": "1.0.17",
+  "version": "1.0.19",
   "description": "DeSciX CLI and MCP Server - Unified command-line interface for DeSciX platform",
   "repository": {
     "type": "git",
@@ -30,8 +30,8 @@
   "author": "DeSciX",
   "license": "SEE LICENSE IN LICENSE.md",
   "dependencies": {
-    "@descix/app-sdk": "^0.1.8",
-    "@descix/sdk": "^2.0.0",
+    "@descix/app-sdk": "^0.2.0",
+    "@descix/sdk": "^3.0.0",
     "@modelcontextprotocol/sdk": "^1.25.1",
     "axios": "^1.7.9",
     "chalk": "^5.6.2",

package/templates/agent-claude.md

@@ -226,8 +226,9 @@ const user = await powch.auth();
 ### KB Integration
 
 If docs already exist (`docs/`, `README.md`, SDK reference files):
-- Copy markdown files to `kb/General/` for the sync pipeline
-- Keep originals as the source of truth — sync from there
+- Name the docs' folder as a source in a corpus manifest (`.descix/manifests/<KB>.json`), then run
+  `descix kb corpus sync`. The docs stay exactly where they are — there is no copy step and no
+  required KB folder.
 - Ask: "I see docs in `docs/`. Want me to use those as your knowledge base?"
 
 ### Decision Guide
@@ -236,7 +237,7 @@ If docs already exist (`docs/`, `README.md`, SDK reference files):
 |-----------------|---------------|-------------|
 | HTML/JS app with `index.html` | Serve as-is, add DeSciXAppSDK.js | Use any `docs/` or `*.md` files |
 | React/Vite app | Wrap root in `<AppShell>` | Use `docs/` or README |
-| SDK package with docs + demo | Serve the SDK's demo page | Copy docs to `kb/General/` |
+| SDK package with docs + demo | Serve the SDK's demo page | Name docs folder in a corpus manifest |
 | Docs only (no frontend) | Skip or create minimal site | Docs ARE the KB |
 | Empty repo | Scaffold from scratch | Create starter KB doc |
 
@@ -244,7 +245,8 @@ If docs already exist (`docs/`, `README.md`, SDK reference files):
 
 Every app has three parts:
 - `site/` — Frontend (any framework: React, VitePress, vanilla HTML)
-- `kb/General/` — Knowledge base source docs (markdown files)
+- A corpus manifest (`.descix/manifests/<KB>.json`) — names the git-tracked docs `descix kb corpus
+  sync` publishes; there is no required KB folder
 - `microservice/` — Backend service (optional)
 
 ## App Context

package/templates/agent-cline.md

@@ -165,13 +165,13 @@ unverified step — see `.descix/sdk-assets/reference/local-dev.md` §3.3.
   `DeSciXAppSDK.js` is GENERATED (from `descix-app-sdk/templates/DeSciXAppSDK.template.js`, with a `--check` drift gate) — copy it in, never hand-edit it; a local patch forks the bridge and stops inheriting its fixes.
 - **React/Vite app:** Wrap root in `<AppShell appId="{{appId}}">` from `@descix/app-sdk/AppShell`.
 - **Auth only (no DeSciX UI):** Use `PowchClient` from `@descix/app-sdk/powch-client`.
-- **Existing docs:** Copy `docs/*.md` to `kb/General/` for sync. Keep originals as source of truth.
+- **Existing docs:** Name the docs' folder as a source in a corpus manifest (`.descix/manifests/<KB>.json`), then `descix kb corpus sync`. Docs stay where they are — no copy step.
 - **Empty repo:** Scaffold from scratch.
 
 ## App Structure
 
 - `site/` — Frontend (any framework)
-- `kb/General/` — Knowledge base source docs (markdown)
+- A corpus manifest (`.descix/manifests/<KB>.json`) — names the git-tracked docs `descix kb corpus sync` publishes (no required folder)
 - `microservice/` — Backend service (optional)
 
 ## Context

package/templates/agent-copilot.md

@@ -165,13 +165,13 @@ unverified step — see `.descix/sdk-assets/reference/local-dev.md` §3.3.
   `DeSciXAppSDK.js` is GENERATED (from `descix-app-sdk/templates/DeSciXAppSDK.template.js`, with a `--check` drift gate) — copy it in, never hand-edit it; a local patch forks the bridge and stops inheriting its fixes.
 - **React/Vite app:** Wrap root in `<AppShell appId="{{appId}}">` from `@descix/app-sdk/AppShell`.
 - **Auth only (no DeSciX UI):** Use `PowchClient` from `@descix/app-sdk/powch-client`.
-- **Existing docs:** Copy `docs/*.md` to `kb/General/` for sync. Keep originals as source of truth.
+- **Existing docs:** Name the docs' folder as a source in a corpus manifest (`.descix/manifests/<KB>.json`), then `descix kb corpus sync`. Docs stay where they are — no copy step.
 - **Empty repo:** Scaffold from scratch.
 
 ## App Structure
 
 - `site/` — Frontend (any framework)
-- `kb/General/` — Knowledge base source docs (markdown)
+- A corpus manifest (`.descix/manifests/<KB>.json`) — names the git-tracked docs `descix kb corpus sync` publishes (no required folder)
 - `microservice/` — Backend service (optional)
 
 ## Context

package/templates/agent-cursor.md

@@ -165,13 +165,13 @@ unverified step — see `.descix/sdk-assets/reference/local-dev.md` §3.3.
   `DeSciXAppSDK.js` is GENERATED (from `descix-app-sdk/templates/DeSciXAppSDK.template.js`, with a `--check` drift gate) — copy it in, never hand-edit it; a local patch forks the bridge and stops inheriting its fixes.
 - **React/Vite app:** Wrap root in `<AppShell appId="{{appId}}">` from `@descix/app-sdk/AppShell`.
 - **Auth only (no DeSciX UI):** Use `PowchClient` from `@descix/app-sdk/powch-client`.
-- **Existing docs:** Copy `docs/*.md` to `kb/General/` for sync. Keep originals as source of truth.
+- **Existing docs:** Name the docs' folder as a source in a corpus manifest (`.descix/manifests/<KB>.json`), then `descix kb corpus sync`. Docs stay where they are — no copy step.
 - **Empty repo:** Scaffold from scratch.
 
 ## App Structure
 
 - `site/` — Frontend (any framework)
-- `kb/General/` — Knowledge base source docs (markdown)
+- A corpus manifest (`.descix/manifests/<KB>.json`) — names the git-tracked docs `descix kb corpus sync` publishes (no required folder)
 - `microservice/` — Backend service (optional)
 
 ## Context

package/templates/scaffolds/microservice/SERVICE_README_sdk.md

@@ -153,7 +153,7 @@ descix kb corpus sync -a myapp -k General
 
 ### Calling /apifront from your microservice (data plane)
 
-**The microservice IS the CLI's api-client running in the cloud** (CEO-D-2026-06-02-APP-MICROSERVICE-IS-CLI-CLIENT-WALLET-SIG). To call Core commands (`app_records_*`, `get_app_asset`, `get_asset_upload_token`, RAG, ...) the scaffold's `mcpClient` authenticates to `/apifront` **exactly like the CLI**: it holds the **developer's own durable credential** (`wallet_address` + `signature`) and calls `reconnect_by_wallet` to mint a session — then makes calls **as the developer**. There is NO `register-delegate`, NO `SERVICE_KEY`, NO service account, NO OIDC.
+**The microservice IS the CLI's api-client running in the cloud** (CEO-D-2026-06-02-APP-MICROSERVICE-IS-CLI-CLIENT-WALLET-SIG). To call Core commands (`app_records_*`, `get_app_asset`, `get_asset_upload_token`, RAG, ...) the scaffold's `mcpClient` authenticates to `/apifront` **exactly like the CLI**: it holds the **developer's own durable credential** (`wallet_address` + `signature`) and calls `reconnect_by_wallet` to mint a session — then makes calls **as the developer**. There is NO per-service key, NO service account, NO OIDC.
 
 **Provide the developer credential (gitignored / secret — never checked in):**
 1. Copy `dev-overrides.example.json` → `dev-overrides.json` (this file is `.gitignore`d).
@@ -170,7 +170,7 @@ descix microservice register
 # then: cp dev-overrides.example.json dev-overrides.json  and fill in the developer credential
 ```
 
-> `descix microservice register-delegate` still exists for genuine **service-slot** mesh calls (one service calling another's tools as a delegate). It is NOT used for the app **data plane** — that authenticates as the developer per the model above.
+**Inbound calls carry the caller, not a service identity** (CEO-D-2026-06-02-APP-DATA-PLANE). `/apifront` forwards each call to your service with the caller's identity injected as `params._descix`, isolated per `app_id`; your handler acts on that caller. `descix microservice register --help` prints this model.
 
 ---
 
@@ -334,9 +334,10 @@ A single-app (non-monorepo) workspace uses the same v2.1 shape with only `env.pl
 3. Check `.vscode/mcp.json` exists with a `descix` server (this file is skipped, by design, if the DeSciX VS Code extension is installed — it registers MCP natively)
 
 ### "401 Unauthorized on a loopback / mesh call"
-For the app data plane, your service authenticates AS the developer (wallet_address + signature). A 401 means the
-developer credential is missing or wrong: check `DEVELOPER_WALLET_ADDRESS` + `DEVELOPER_SIGNATURE` in the gitignored
-`dev-overrides.json` (dev) / the secret (prod). Then restart the service.
+Outbound, your service authenticates AS the developer (wallet_address + signature) through `createServiceApiClient`. A 401
+means the developer credential is missing or wrong: check `DEVELOPER_WALLET_ADDRESS` + `DEVELOPER_SIGNATURE` in the
+gitignored `dev-overrides.json` (dev) / the secret (prod). Then restart the service. Inbound, the caller's identity
+arrives as `params._descix`; no key is provisioned for your service.
 Discover it via `descix tell-me-how "my service gets 401 on a loopback call"`.
 
 ### "Session expired"

package/templates/scaffolds/microservice/app.js

@@ -8,7 +8,7 @@ import express from 'express';
 import http from 'http';
 import cors from 'cors';
 import { initializeServiceConfig, utils } from './services/utils.js';
-import { killExistingProcess } from '@descix/cloud-core';
+import { killExistingProcess, mountMeshApi } from '@descix/cloud-core';
 import apiRouter from './services/apiFront.js';
 
 const app = express();
@@ -72,8 +72,12 @@ initializeServiceConfig().then(() => {
         res.status(200).send('OK');
     });
 
-    // Mount API Router
-    app.use('/api', apiRouter);
+    // Mount the API router on /api — the surface the platform proxies mesh commands to. The
+    // mount is @descix/cloud-core's: it puts the signed-context verifier in front of the router,
+    // in the mode config resolved at boot. A deployed service boots only with
+    // MESH_CTX_VERIFY_MODE=enforce (defaults-config.json), so an unsigned request is refused
+    // before it reaches a handler. Do not mount /api yourself.
+    mountMeshApi(app, apiRouter);
 
     // Start Server
     if (!port || port === 'auto') {

package/templates/scaffolds/microservice/defaults-config.json

@@ -3,5 +3,6 @@
   "LOCAL_PORT": "auto",
   "CORE_API_URL": "https://localhost:4000/apifront",
   "community_id": "{{COMMUNITY_ID}}",
-  "app_id": "{{APP_ID}}"
+  "app_id": "{{APP_ID}}",
+  "MESH_CTX_VERIFY_MODE": "enforce"
 }

package/templates/scaffolds/microservice/dev-overrides.example.json

@@ -1,5 +1,6 @@
 {
   "_comment": "Copy this file to dev-overrides.json (GITIGNORED) and fill in the developer credential. The microservice authenticates to /apifront AS the developer — exactly like the CLI — using these. In prod these come from a SECRET, never from a checked-in file. defaults-config.json must NOT contain the signature (it is a credential).",
   "DEVELOPER_WALLET_ADDRESS": "0xYOUR_WALLET_ADDRESS",
-  "DEVELOPER_SIGNATURE": "PASTE_YOUR_DURABLE_SIGNATURE_FROM_.descix/wallet.json"
+  "DEVELOPER_SIGNATURE": "PASTE_YOUR_DURABLE_SIGNATURE_FROM_.descix/wallet.json",
+  "_MESH_CTX_VERIFY_MODE_comment": "defaults-config.json sets MESH_CTX_VERIFY_MODE to enforce, the only value a deployed service boots with. On your own machine you may relax it here: \"warn\" (verify and log, never refuse) or \"\" (no verification; every request is stamped meshContextVerified=false). Never set MESH_CTX_PUBLIC_KEY or MESH_CTX_KEY_ID in any config file: the platform key is resolved by @descix/cloud-core and a copy refuses boot."
 }

package/templates/scaffolds/microservice/manifest.json

@@ -6,7 +6,8 @@
     "healthEndpoint": "/health",
     "debugPort": 3003,
     "app_id": "{{APP_ID}}",
-    "community_id": "{{COMMUNITY_ID}}"
+    "community_id": "{{COMMUNITY_ID}}",
+    "runtime": { "profile": "default", "system_packages": [] }
   },
   "commands": {
     "sample_hello": {

package/templates/scaffolds/microservice/package.json

@@ -11,7 +11,7 @@
     "gen-jwt-secret": "node -e 'console.log(require(\"crypto\").randomBytes(32).toString(\"hex\"))'"
   },
   "dependencies": {
-    "@descix/cloud-core": "^1.0.0",
+    "@descix/cloud-core": "^1.2.0",
     "@descix/platform-api": "^2.0.0",
     "@google-cloud/secret-manager": "^5.0.1",
     "@google-cloud/storage": "^7.7.0",
@@ -19,7 +19,7 @@
     "cors": "^2.8.5",
     "dotenv": "^16.3.1",
     "express": "^4.18.2",
-    "@descix/sdk": "^2.0.0",
+    "@descix/sdk": "^3.0.0",
     "@descix/cli": "^1.0.0"
   },
   "devDependencies": {

package/templates/scaffolds/microservice/templates/SERVICE_README_TEMPLATE.md

@@ -25,8 +25,9 @@ descix microservice register                     # register the service manifest
 > + `DEVELOPER_SIGNATURE` (the developer's own wallet credential, from
 > `.descix/wallet.json`) and calls `reconnect_by_wallet` to mint a session —
 > exactly like the CLI. Put the credential in the GITIGNORED `dev-overrides.json`
-> (dev) / a secret (prod), NEVER `defaults-config.json`. There is NO
-> `register-delegate`, NO `SERVICE_KEY`, NO service account for the data plane.
+> (dev) / a secret (prod), NEVER `defaults-config.json`. There is NO per-service
+> key and NO service account for the data plane. Inbound calls carry the caller's
+> identity as `params._descix`, isolated per app_id (CEO-D-2026-06-02-APP-DATA-PLANE).
 > **HTTP 401?** The developer credential is missing or wrong — check those two keys.
 
 ## Prerequisites

package/lib/commands/retired-kb-sync.js

@@ -1,112 +0,0 @@
-/**
- * ONE OWNER for the retirement of every superseded KB-sync surface.
- *
- * CEO 2026-08-29: "there should never be a deprecated path and then everything else is a
- * waterfall of problems." The CLI exposes exactly ONE kb sync surface — `descix kb corpus
- * sync` (git-synced manifest). Every other sync path is DELETED: its implementation is gone
- * and its old name exits NON-ZERO naming the replacement. That is not a compat fence — a
- * compat fence is a path that still WORKS under an old name. These do not work at all.
- *
- * Why a module and not a literal at each site: two derivations of one fact is the general
- * form of mirror drift. The retired set is enumerated ONCE here. bin/descix.js registers by
- * ITERATING this list via registerAllRetiredKbSync() -- it does not name any retired verb
- * itself -- and tests/kb-sync-single-surface.test.js asserts against the same list. So the
- * drift is closed in BOTH directions: a surface added to the list is registered, and a
- * surface cannot be registered without being in the list.
- */
-
-/** The single canonical KB sync surface. Named in every refusal. */
-export const CANONICAL_KB_SYNC = 'descix kb corpus sync';
-
-/** The verb that creates a KB — `kb corpus sync`'s dependency (I4). */
-export const CANONICAL_KB_CREATE = 'descix app init --kb <kb_name>';
-
-/**
- * Every KB-sync surface retired by ws-devplane-cli-kb-surface-single-canonical-sync.
- * `invocation` is what a user types; `parent` is the commander parent it hung off.
- */
-export const RETIRED_KB_SYNC_SURFACES = [
-  { id: 'sync',      parent: 'program', name: 'sync',  invocation: 'descix sync' },
-  { id: 'sync.kb',   parent: 'sync',    name: 'kb',    invocation: 'descix sync kb' },
-  { id: 'kb.chunk',  parent: 'kb',      name: 'chunk', invocation: 'descix kb chunk' },
-  { id: 'kb.sync',   parent: 'kb',      name: 'sync',  invocation: 'descix kb sync' },
-];
-
-/** Implementations deleted with those surfaces. No exported symbol survives without a caller (I3). */
-export const DELETED_KB_SYNC_SYMBOLS = [
-  'runKbChunk',
-  'runKbSync',
-  'runKbBuild',
-  'runKbStatus',
-  'runKbCompare',
-  'updateKB',
-];
-
-/**
- * The single refusal message. Fails loud and names the replacement — never warns, never falls back.
- * @param {string} invocation - the retired invocation the user typed, e.g. 'descix kb chunk'
- * @returns {string}
- */
-export function retiredKbSyncMessage(invocation) {
-  return (
-    `\`${invocation}\` has been REMOVED. There is no replacement flag and no fallback.\n\n` +
-    `Use the one canonical KB sync surface:\n` +
-    `  ${CANONICAL_KB_SYNC} -a <app_id> [-k <kb_name>]\n\n` +
-    `It syncs from a git-tracked corpus manifest (.descix/manifests/), which the removed ` +
-    `path could not do. If the KB does not exist yet, create it first with ` +
-    `\`${CANONICAL_KB_CREATE}\`.`
-  );
-}
-
-/**
- * Register a retired invocation so it exits NON-ZERO naming the canonical surface.
- * Accepts and ignores any args/options the old surface took, so an old script fails with
- * this message rather than a confusing commander parse error.
- *
- * @param {import('commander').Command} parent - commander parent to attach to
- * @param {string} name - the retired command name
- * @param {string} invocation - full invocation used in the message
- * @param {(s:string)=>string} red - chalk.red or equivalent
- */
-export function registerRetiredKbSync(parent, name, invocation, red) {
-  return parent
-    .command(name, { hidden: true })
-    .description(`REMOVED — use \`${CANONICAL_KB_SYNC}\``)
-    .allowUnknownOption(true)
-    // helpOption(false) is load-bearing: commander intercepts `--help` BEFORE the action and
-    // exits 0. A retired surface must exit NON-ZERO however it is invoked — `descix kb chunk`
-    // and `descix kb chunk --help` must both fail and name the replacement. Without this, the
-    // most natural way a user probes a dead verb is the one way it appears to still work.
-    .helpOption(false)
-    .argument('[args...]', 'ignored')
-    .action(() => {
-      console.error(red(`\n❌ ${retiredKbSyncMessage(invocation)}\n`));
-      process.exit(1);
-    });
-}
-
-/**
- * Register EVERY retired surface by iterating RETIRED_KB_SYNC_SURFACES.
- *
- * This is what makes the one-owner claim true rather than merely asserted: bin/descix.js
- * calls this once and never names a retired verb itself, so a retired surface cannot be
- * registered without appearing in the list above.
- *
- * @param {Record<string, import('commander').Command>} roots - seed parents, e.g. { program, kb }
- * @param {(s:string)=>string} red - chalk.red or equivalent
- * @returns {Record<string, import('commander').Command>} roots plus each registered surface by id
- */
-export function registerAllRetiredKbSync(roots, red) {
-  const byId = { ...roots };
-  for (const s of RETIRED_KB_SYNC_SURFACES) {
-    const parent = byId[s.parent];
-    if (!parent) {
-      throw new Error(
-        `retired-kb-sync: no parent '${s.parent}' available for '${s.invocation}'. ` +
-        'Seed it in the roots map or order the list so the parent is registered first.'
-      );
-    }
-    byId[s.id] = registerRetiredKbSync(parent, s.name, s.invocation, red);
-  }
-  return byId;
-}