@indigoai-us/hq-cli 5.124.0 → 5.125.0

package/dist/lib/work-context/config.js

@@ -9,12 +9,115 @@ import { DefaultCompanyUnavailableError, UnsafeConfigPathError, WorkContextError
 import { workContextConfigPath, workContextRoot } from "./paths.js";
 import { WORK_CONTEXT_CONTRACT_VERSION } from "./contract.js";
 export const DEVICE_CONFIG_SCHEMA_VERSION = 1;
+const CONFIG_LOCK_TIMEOUT_MS = 5_000;
+const CONFIG_LOCK_RETRY_MS = 10;
+export const CONFIG_LOCK_STALE_MS = 30_000;
+function waitForConfigLock(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function readConfigLockRecord(lockPath) {
+    try {
+        const stat = fs.statSync(lockPath);
+        const raw = JSON.parse(fs.readFileSync(lockPath, "utf8"));
+        const pid = typeof raw.pid === "number" && Number.isInteger(raw.pid) ? raw.pid : 0;
+        const createdAt = typeof raw.createdAt === "string" ? raw.createdAt : "";
+        const token = typeof raw.token === "string" && raw.token ? raw.token : undefined;
+        const parsedAt = Date.parse(createdAt);
+        return {
+            record: pid > 0 && createdAt ? { pid, createdAt, token } : null,
+            ageMs: Date.now() - (Number.isFinite(parsedAt) ? parsedAt : stat.mtimeMs),
+        };
+    }
+    catch {
+        return { record: null, ageMs: Number.POSITIVE_INFINITY };
+    }
+}
+function isProcessAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function reclaimStaleConfigLock(lockPath) {
+    const claim = `${lockPath}.reclaim.${process.pid}.${Date.now()}.${Math.random().toString(16).slice(2)}`;
+    try {
+        fs.renameSync(lockPath, claim);
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return false;
+        throw err;
+    }
+    try {
+        return true;
+    }
+    finally {
+        try {
+            fs.unlinkSync(claim);
+        }
+        catch { /* private claim cannot block writers */ }
+    }
+}
+/** Acquire an interprocess config lock; exported for direct lock regression tests. */
+export function acquireDeviceConfigLock(root, options = {}) {
+    ensureOwnerDir(root);
+    const configPath = resolveRealTarget(workContextConfigPath(root));
+    assertSafeConfigPath(configPath);
+    const lockPath = `${configPath}.lock`;
+    const deadline = Date.now() + (options.timeoutMs ?? CONFIG_LOCK_TIMEOUT_MS);
+    const token = `${process.pid}.${Date.now()}.${Math.random().toString(16).slice(2)}`;
+    let fd;
+    while (fd === undefined) {
+        try {
+            fd = fs.openSync(lockPath, "wx", 0o600);
+            fs.writeSync(fd, JSON.stringify({ pid: process.pid, createdAt: new Date().toISOString(), token }));
+        }
+        catch (err) {
+            if (err.code !== "EEXIST")
+                throw err;
+            const { record, ageMs } = readConfigLockRecord(lockPath);
+            // Age alone is not authority to steal a lock: a live writer may simply
+            // be slow. Only a missing/malformed or dead owner can be reclaimed.
+            if (!record || !isProcessAlive(record.pid)) {
+                reclaimStaleConfigLock(lockPath);
+                continue;
+            }
+            if (Date.now() >= deadline) {
+                throw new WorkContextError("ConfigLockTimeout", "Timed out waiting for the work-context config lock");
+            }
+            waitForConfigLock(CONFIG_LOCK_RETRY_MS);
+        }
+    }
+    return () => {
+        fs.closeSync(fd);
+        try {
+            const current = readConfigLockRecord(lockPath).record;
+            if (current?.token === token)
+                fs.unlinkSync(lockPath);
+        }
+        catch { /* stale reclaimer already retired or replaced this lock */ }
+    };
+}
+function withDeviceConfigLock(root, fn) {
+    const release = acquireDeviceConfigLock(root);
+    try {
+        return fn();
+    }
+    finally {
+        release();
+    }
+}
 function emptyConfig(now) {
     return {
         schemaVersion: DEVICE_CONFIG_SCHEMA_VERSION,
         defaultCompany: null,
         migrationCapability: null,
         repoCompanyMap: null,
+        defaultCompanyMemberships: null,
+        repairHeldWithDefault: false,
         updatedAt: now().toISOString(),
     };
 }
@@ -82,11 +185,22 @@ export function readDeviceConfig(deps) {
             throw new WorkContextError("ConfigCorruptionError", `Unsupported config schemaVersion ${String(raw.schemaVersion)}`);
         }
         // Never treat a stray activeCompany field as the default.
+        // Older `clear` commands persisted `defaultCompany: null`. A config file
+        // is durable user history, so preserving a null as "unconfigured" would
+        // re-enable automatic selection after an upgrade. Treat every persisted
+        // legacy null as the explicit opt-out tombstone instead.
+        const legacyNullDefault = Object.prototype.hasOwnProperty.call(raw, "defaultCompany") &&
+            raw.defaultCompany === null &&
+            raw.defaultCompanyAutomaticEligible !== true;
         const cleaned = {
             schemaVersion: DEVICE_CONFIG_SCHEMA_VERSION,
-            defaultCompany: raw.defaultCompany ?? null,
+            defaultCompany: legacyNullDefault
+                ? { slug: "", enabled: false, source: "disabled" }
+                : raw.defaultCompany ?? null,
             migrationCapability: raw.migrationCapability ?? null,
             repoCompanyMap: sanitizeRepoCompanyMap(raw.repoCompanyMap),
+            defaultCompanyMemberships: sanitizeMembershipSnapshot(raw.defaultCompanyMemberships),
+            repairHeldWithDefault: raw.repairHeldWithDefault === true,
             updatedAt: typeof raw.updatedAt === "string" ? raw.updatedAt : new Date(0).toISOString(),
         };
         return cleaned;
@@ -101,7 +215,12 @@ function writeDeviceConfig(deps, config) {
     ensureOwnerDir(deps.root);
     const configPath = resolveRealTarget(workContextConfigPath(deps.root));
     assertSafeConfigPath(configPath);
-    atomicWriteJson(configPath, config);
+    // New blank configuration is intentionally distinct from the legacy null
+    // that the previous `clear` command wrote. Preserve that distinction on
+    // disk so a membership-cache write cannot turn into a durable opt-out.
+    atomicWriteJson(configPath, config.defaultCompany === null
+        ? { ...config, defaultCompanyAutomaticEligible: true }
+        : config);
 }
 export function getDefaultCompany(deps) {
     const cfg = readDeviceConfig(deps);
@@ -110,6 +229,11 @@ export function getDefaultCompany(deps) {
         return null;
     return d;
 }
+/** A clear is a durable opt-out, not an invitation for automatic reactivation. */
+export function isDefaultCompanyDisabled(deps) {
+    const configured = readDeviceConfig(deps).defaultCompany;
+    return configured?.source === "disabled";
+}
 export async function setDefaultCompany(slug, deps) {
     const trimmed = slug.trim();
     if (!trimmed || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(trimmed)) {
@@ -135,35 +259,44 @@ export async function setDefaultCompany(slug, deps) {
         resolvedUid = result.uid.trim() || undefined;
     }
     const now = deps.now ?? (() => new Date());
-    const prior = readDeviceConfig(deps);
-    const defaultCompany = {
-        slug: trimmed,
-        enabled: true,
-    };
-    if (resolvedUid)
-        defaultCompany.uid = resolvedUid;
-    const next = {
-        schemaVersion: DEVICE_CONFIG_SCHEMA_VERSION,
-        defaultCompany,
-        migrationCapability: prior.migrationCapability ?? null,
-        repoCompanyMap: prior.repoCompanyMap ?? null,
-        updatedAt: now().toISOString(),
-    };
-    writeDeviceConfig(deps, next);
-    return next;
+    return withDeviceConfigLock(deps.root, () => {
+        const prior = readDeviceConfig(deps);
+        const defaultCompany = {
+            slug: trimmed,
+            enabled: true,
+            source: "chosen",
+        };
+        if (resolvedUid)
+            defaultCompany.uid = resolvedUid;
+        const next = {
+            schemaVersion: DEVICE_CONFIG_SCHEMA_VERSION,
+            defaultCompany,
+            migrationCapability: prior.migrationCapability ?? null,
+            repoCompanyMap: prior.repoCompanyMap ?? null,
+            defaultCompanyMemberships: prior.defaultCompanyMemberships ?? null,
+            repairHeldWithDefault: prior.repairHeldWithDefault === true,
+            updatedAt: now().toISOString(),
+        };
+        writeDeviceConfig(deps, next);
+        return next;
+    });
 }
 export function clearDefaultCompany(deps) {
     const now = deps.now ?? (() => new Date());
-    const prior = readDeviceConfig(deps);
-    const next = {
-        schemaVersion: DEVICE_CONFIG_SCHEMA_VERSION,
-        defaultCompany: null,
-        migrationCapability: prior.migrationCapability ?? null,
-        repoCompanyMap: prior.repoCompanyMap ?? null,
-        updatedAt: now().toISOString(),
-    };
-    writeDeviceConfig(deps, next);
-    return next;
+    return withDeviceConfigLock(deps.root, () => {
+        const prior = readDeviceConfig(deps);
+        const next = {
+            schemaVersion: DEVICE_CONFIG_SCHEMA_VERSION,
+            defaultCompany: { slug: "", enabled: false, source: "disabled" },
+            migrationCapability: prior.migrationCapability ?? null,
+            repoCompanyMap: prior.repoCompanyMap ?? null,
+            defaultCompanyMemberships: prior.defaultCompanyMemberships ?? null,
+            repairHeldWithDefault: prior.repairHeldWithDefault === true,
+            updatedAt: now().toISOString(),
+        };
+        writeDeviceConfig(deps, next);
+        return next;
+    });
 }
 /**
  * Read the persisted company mapping for a repo identity key (gap 4).
@@ -193,43 +326,155 @@ export function setRepoCompany(key, mapping, deps) {
         throw new WorkContextError("InvalidCompanySlug", `Invalid company slug: ${mapping.slug}`);
     }
     const now = deps.now ?? (() => new Date());
-    const prior = readDeviceConfig({ root: deps.root });
-    const entry = { slug, updatedAt: now().toISOString() };
-    const uid = mapping.uid?.trim();
-    if (uid)
-        entry.uid = uid;
-    const nextMap = { ...(prior.repoCompanyMap ?? {}), [trimmed]: entry };
-    const next = {
-        schemaVersion: DEVICE_CONFIG_SCHEMA_VERSION,
-        defaultCompany: prior.defaultCompany ?? null,
-        migrationCapability: prior.migrationCapability ?? null,
-        repoCompanyMap: nextMap,
-        updatedAt: now().toISOString(),
-    };
-    writeDeviceConfig({ root: deps.root }, next);
-    return next;
+    return withDeviceConfigLock(deps.root, () => {
+        const prior = readDeviceConfig({ root: deps.root });
+        const entry = { slug, updatedAt: now().toISOString() };
+        const uid = mapping.uid?.trim();
+        if (uid)
+            entry.uid = uid;
+        const nextMap = { ...(prior.repoCompanyMap ?? {}), [trimmed]: entry };
+        const next = {
+            schemaVersion: DEVICE_CONFIG_SCHEMA_VERSION,
+            defaultCompany: prior.defaultCompany ?? null,
+            migrationCapability: prior.migrationCapability ?? null,
+            repoCompanyMap: nextMap,
+            defaultCompanyMemberships: prior.defaultCompanyMemberships ?? null,
+            repairHeldWithDefault: prior.repairHeldWithDefault === true,
+            updatedAt: now().toISOString(),
+        };
+        writeDeviceConfig({ root: deps.root }, next);
+        return next;
+    });
 }
 /** Persist the last memberships-wide migration capability probe (US-017B). */
 export function recordMigrationCapabilitySnapshot(snapshot, deps) {
-    const prior = readDeviceConfig(deps);
-    const now = deps.now ?? (() => new Date());
-    const next = {
-        schemaVersion: DEVICE_CONFIG_SCHEMA_VERSION,
-        defaultCompany: prior.defaultCompany ?? null,
-        migrationCapability: {
-            unlocked: snapshot.unlocked,
-            offline: snapshot.offline,
-            checkedAt: snapshot.checkedAt,
-            companies: snapshot.companies.map((c) => ({
-                companyUid: c.companyUid,
-                migration: c.migration,
-            })),
-        },
-        repoCompanyMap: prior.repoCompanyMap ?? null,
-        updatedAt: now().toISOString(),
-    };
-    writeDeviceConfig({ root: deps.root }, next);
-    return next;
+    return withDeviceConfigLock(deps.root, () => {
+        const prior = readDeviceConfig(deps);
+        const now = deps.now ?? (() => new Date());
+        const next = {
+            schemaVersion: DEVICE_CONFIG_SCHEMA_VERSION,
+            defaultCompany: prior.defaultCompany ?? null,
+            migrationCapability: {
+                unlocked: snapshot.unlocked,
+                offline: snapshot.offline,
+                checkedAt: snapshot.checkedAt,
+                companies: snapshot.companies.map((c) => ({
+                    companyUid: c.companyUid,
+                    migration: c.migration,
+                })),
+            },
+            repoCompanyMap: prior.repoCompanyMap ?? null,
+            defaultCompanyMemberships: prior.defaultCompanyMemberships ?? null,
+            repairHeldWithDefault: prior.repairHeldWithDefault === true,
+            updatedAt: now().toISOString(),
+        };
+        writeDeviceConfig({ root: deps.root }, next);
+        return next;
+    });
+}
+function sanitizeMembershipSnapshot(raw) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        return null;
+    const value = raw;
+    if (typeof value.checkedAt !== "string" || !Array.isArray(value.memberships))
+        return null;
+    const memberships = value.memberships.flatMap((entry) => {
+        if (!entry || typeof entry !== "object" || Array.isArray(entry))
+            return [];
+        const member = entry;
+        const slug = typeof member.slug === "string" ? member.slug.trim() : "";
+        const uid = typeof member.uid === "string" ? member.uid.trim() : "";
+        return slug && uid ? [{ slug, uid }] : [];
+    });
+    return { checkedAt: value.checkedAt, memberships };
+}
+export function recordDefaultCompanyMemberships(snapshot, deps) {
+    return withDeviceConfigLock(deps.root, () => {
+        const prior = readDeviceConfig(deps);
+        const now = deps.now ?? (() => new Date());
+        const next = {
+            schemaVersion: DEVICE_CONFIG_SCHEMA_VERSION,
+            defaultCompany: prior.defaultCompany ?? null,
+            migrationCapability: prior.migrationCapability ?? null,
+            repoCompanyMap: prior.repoCompanyMap ?? null,
+            defaultCompanyMemberships: {
+                checkedAt: snapshot.checkedAt,
+                memberships: snapshot.memberships.map((membership) => ({ ...membership })),
+            },
+            repairHeldWithDefault: prior.repairHeldWithDefault === true,
+            updatedAt: now().toISOString(),
+        };
+        writeDeviceConfig({ root: deps.root }, next);
+        return next;
+    });
+}
+/** Drop cached membership evidence immediately after an authoritative denial. */
+export function invalidateDefaultCompanyMemberships(deps) {
+    return withDeviceConfigLock(deps.root, () => {
+        const prior = readDeviceConfig(deps);
+        const now = deps.now ?? (() => new Date());
+        const next = {
+            schemaVersion: DEVICE_CONFIG_SCHEMA_VERSION,
+            defaultCompany: prior.defaultCompany ?? null,
+            migrationCapability: prior.migrationCapability ?? null,
+            repoCompanyMap: prior.repoCompanyMap ?? null,
+            defaultCompanyMemberships: null,
+            repairHeldWithDefault: prior.repairHeldWithDefault === true,
+            updatedAt: now().toISOString(),
+        };
+        writeDeviceConfig({ root: deps.root }, next);
+        return next;
+    });
+}
+/** Persist a default only after the complete active-membership list verified it. */
+export function setAutoDefaultCompany(membership, deps) {
+    return withDeviceConfigLock(deps.root, () => {
+        const prior = readDeviceConfig(deps);
+        // Activation may have fetched memberships while another process cleared or
+        // changed this preference. Do not let that stale discovery overwrite the
+        // newer durable choice.
+        if (prior.defaultCompany?.source === "disabled" ||
+            prior.defaultCompany?.enabled ||
+            (deps.expectedUpdatedAt !== undefined &&
+                prior.updatedAt !== deps.expectedUpdatedAt)) {
+            return prior;
+        }
+        deps.afterCompareAndSwap?.();
+        const now = deps.now ?? (() => new Date());
+        const next = {
+            schemaVersion: DEVICE_CONFIG_SCHEMA_VERSION,
+            defaultCompany: {
+                slug: membership.slug,
+                uid: membership.uid,
+                enabled: true,
+                source: "auto_single",
+            },
+            migrationCapability: prior.migrationCapability ?? null,
+            repoCompanyMap: prior.repoCompanyMap ?? null,
+            defaultCompanyMemberships: prior.defaultCompanyMemberships ?? null,
+            repairHeldWithDefault: prior.repairHeldWithDefault === true,
+            updatedAt: now().toISOString(),
+        };
+        writeDeviceConfig({ root: deps.root }, next);
+        return next;
+    });
+}
+export function setRepairHeldWithDefault(enabled, deps) {
+    return withDeviceConfigLock(deps.root, () => {
+        const prior = readDeviceConfig(deps);
+        const now = deps.now ?? (() => new Date());
+        const next = {
+            schemaVersion: DEVICE_CONFIG_SCHEMA_VERSION,
+            defaultCompany: prior.defaultCompany ?? null,
+            migrationCapability: prior.migrationCapability ?? null,
+            repoCompanyMap: prior.repoCompanyMap ?? null,
+            defaultCompanyMemberships: prior.defaultCompanyMemberships ?? null,
+            repairHeldWithDefault: enabled,
+            updatedAt: now().toISOString(),
+        };
+        writeDeviceConfig({ root: deps.root }, next);
+        return next;
+    });
 }
 /** Convenience: build deps from HOME / injectable root. */
 export function deviceConfigDepsFromHome(home, extras = {}) {

package/dist/lib/work-context/contract.d.ts

@@ -54,6 +54,8 @@ export interface ContextResult {
     lifecycle: LifecycleState;
     sessionId: string;
     companyUid?: string;
+    /** Resolved company slug; paired with companyUid for local hook consumers. */
+    companySlug?: string;
     projectId?: string;
     taskId?: string;
     bindingEpisodeId?: string;

package/dist/lib/work-context/default-company.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Device-default activation. A device may infer a default only from the caller's
+ * complete, verified active-membership list; it never infers a tenant from cwd.
+ */
+import { type DefaultCompanyMembership } from "./config.js";
+export declare const DEFAULT_COMPANY_MEMBERSHIP_TTL_MS: number;
+export interface ActiveMembership {
+    companySlug: string;
+    companyUid: string;
+}
+export type DefaultCompanyActivation = {
+    status: "existing";
+    memberships: DefaultCompanyMembership[];
+} | {
+    status: "auto_single";
+    memberships: DefaultCompanyMembership[];
+} | {
+    status: "needs_choice";
+    memberships: DefaultCompanyMembership[];
+} | {
+    status: "disabled";
+    memberships: DefaultCompanyMembership[];
+} | {
+    status: "identity_file";
+    memberships: [];
+} | {
+    status: "unavailable";
+    memberships: [];
+};
+export interface EnsureDefaultCompanyDeps {
+    root: string;
+    env?: NodeJS.ProcessEnv;
+    listMemberships: () => Promise<ActiveMembership[]>;
+    now?: () => Date;
+    log?: (message: string) => void;
+}
+/**
+ * Populate a blank device from one active membership, or expose the choices for
+ * an interactive caller. Identity-file boxes and explicitly disabled devices do
+ * not query memberships because a user/default must never override either.
+ */
+export declare function ensureDefaultCompany(deps: EnsureDefaultCompanyDeps): Promise<DefaultCompanyActivation>;
+//# sourceMappingURL=default-company.d.ts.map

package/dist/lib/work-context/default-company.js

@@ -0,0 +1,83 @@
+/**
+ * Device-default activation. A device may infer a default only from the caller's
+ * complete, verified active-membership list; it never infers a tenant from cwd.
+ */
+import { hasAgentIdentityFile } from "./company.js";
+import { isDefaultCompanyDisabled, readDeviceConfig, recordDefaultCompanyMemberships, setAutoDefaultCompany, } from "./config.js";
+export const DEFAULT_COMPANY_MEMBERSHIP_TTL_MS = 24 * 60 * 60 * 1000;
+function normalizeMemberships(rows) {
+    const seen = new Set();
+    return rows.flatMap((row) => {
+        const slug = row.companySlug?.trim();
+        const uid = row.companyUid?.trim();
+        if (!slug || !uid || seen.has(uid))
+            return [];
+        seen.add(uid);
+        return [{ slug, uid }];
+    });
+}
+function cachedMemberships(root, now) {
+    const snapshot = readDeviceConfig({ root }).defaultCompanyMemberships;
+    if (!snapshot)
+        return null;
+    const checkedAt = Date.parse(snapshot.checkedAt);
+    if (!Number.isFinite(checkedAt) || now.getTime() - checkedAt > DEFAULT_COMPANY_MEMBERSHIP_TTL_MS) {
+        return null;
+    }
+    return snapshot.memberships;
+}
+/**
+ * Populate a blank device from one active membership, or expose the choices for
+ * an interactive caller. Identity-file boxes and explicitly disabled devices do
+ * not query memberships because a user/default must never override either.
+ */
+export async function ensureDefaultCompany(deps) {
+    const env = deps.env ?? process.env;
+    if (hasAgentIdentityFile(env))
+        return { status: "identity_file", memberships: [] };
+    const now = (deps.now ?? (() => new Date()))();
+    const configBeforeDiscovery = readDeviceConfig({ root: deps.root });
+    const cached = cachedMemberships(deps.root, now) ?? [];
+    if (isDefaultCompanyDisabled({ root: deps.root })) {
+        return { status: "disabled", memberships: cached };
+    }
+    let memberships = cachedMemberships(deps.root, now);
+    if (!memberships) {
+        try {
+            memberships = normalizeMemberships(await deps.listMemberships());
+        }
+        catch {
+            return { status: "unavailable", memberships: [] };
+        }
+        // Detect a clear or selection made while the network request was pending.
+        // A stale discovery may update the cache, but must not make a default.
+        const recorded = recordDefaultCompanyMemberships({ checkedAt: now.toISOString(), memberships }, { root: deps.root, now: deps.now });
+        if (recorded.defaultCompany?.source === "disabled") {
+            return { status: "disabled", memberships };
+        }
+        if (recorded.defaultCompany?.enabled) {
+            return { status: "existing", memberships };
+        }
+        configBeforeDiscovery.updatedAt = recorded.updatedAt;
+    }
+    if (memberships.length === 1) {
+        const selected = memberships[0];
+        const next = setAutoDefaultCompany(selected, {
+            root: deps.root,
+            now: deps.now,
+            expectedUpdatedAt: configBeforeDiscovery.updatedAt,
+        });
+        if (next.defaultCompany?.source === "disabled") {
+            return { status: "disabled", memberships };
+        }
+        if (next.defaultCompany?.source !== "auto_single") {
+            return { status: "existing", memberships };
+        }
+        deps.log?.(`Default company set automatically to ${selected.slug}.`);
+        return { status: "auto_single", memberships };
+    }
+    if (memberships.length > 1)
+        return { status: "needs_choice", memberships };
+    return { status: "unavailable", memberships: [] };
+}
+//# sourceMappingURL=default-company.js.map

package/dist/lib/work-context/outbox.d.ts

@@ -5,7 +5,7 @@
 import type { DeliveryState } from "./contract.js";
 import { WORK_CONTEXT_CONTRACT_VERSION } from "./contract.js";
 /** Fields allowed on a durable outbox operation (privacy allowlist). */
-export declare const OUTBOX_ALLOWLIST: readonly ["contractVersion", "operationId", "clientOperationId", "sessionId", "harness", "companyUid", "companySlug", "projectId", "taskId", "kind", "digest", "delivery", "createdAt", "updatedAt", "attemptCount", "lastErrorCode", "receiptId", "destinationCompanyUid", "destinationCompanySlug", "nextAttemptAt"];
+export declare const OUTBOX_ALLOWLIST: readonly ["contractVersion", "operationId", "clientOperationId", "sessionId", "harness", "companyUid", "companySlug", "projectId", "taskId", "companyConfidence", "kind", "digest", "delivery", "createdAt", "updatedAt", "attemptCount", "lastErrorCode", "receiptId", "destinationCompanyUid", "destinationCompanySlug", "nextAttemptAt"];
 /** Base delay for outbox retry backoff (attempt 1 → 30s). */
 export declare const OUTBOX_RETRY_BASE_MS = 30000;
 /** Cap for outbox retry backoff (6 hours). */
@@ -25,6 +25,8 @@ export interface OutboxOperation {
     companySlug?: string;
     projectId?: string;
     taskId?: string;
+    /** Durable provenance for weak device-default bindings. */
+    companyConfidence?: "device_default";
     kind: OutboxKind;
     digest: string;
     delivery: DeliveryState;
@@ -47,6 +49,7 @@ export interface OutboxEnqueueInput {
     companySlug?: string;
     projectId?: string;
     taskId?: string;
+    companyConfidence?: "device_default";
     kind?: OutboxKind;
     destinationCompanyUid?: string;
     destinationCompanySlug?: string;
@@ -62,6 +65,7 @@ export declare function digestOperation(parts: {
     companySlug?: string;
     projectId?: string;
     taskId?: string;
+    companyConfidence?: "device_default";
     kind: OutboxKind;
     destinationCompanyUid?: string;
     destinationCompanySlug?: string;

package/dist/lib/work-context/outbox.js

@@ -21,6 +21,7 @@ export const OUTBOX_ALLOWLIST = [
     "companySlug",
     "projectId",
     "taskId",
+    "companyConfidence",
     "kind",
     "digest",
     "delivery",
@@ -96,6 +97,8 @@ function projectOutbox(op) {
         out.projectId = op.projectId;
     if (op.taskId)
         out.taskId = op.taskId;
+    if (op.companyConfidence)
+        out.companyConfidence = op.companyConfidence;
     if (op.lastErrorCode)
         out.lastErrorCode = op.lastErrorCode;
     if (op.receiptId)
@@ -143,6 +146,7 @@ export function enqueueOutbox(input, root) {
         companySlug: input.companySlug,
         projectId: input.projectId,
         taskId: input.taskId,
+        companyConfidence: input.companyConfidence,
         kind,
         destinationCompanyUid: input.destinationCompanyUid,
         destinationCompanySlug: input.destinationCompanySlug,
@@ -172,6 +176,7 @@ export function enqueueOutbox(input, root) {
         companySlug: input.companySlug,
         projectId: input.projectId,
         taskId: input.taskId,
+        companyConfidence: input.companyConfidence,
         kind,
         digest,
         delivery: "queued",

package/dist/lib/work-context/reconcile.d.ts

@@ -52,6 +52,10 @@ export interface ReconcileDeps {
     root: string;
     env?: NodeJS.ProcessEnv;
     now?: () => Date;
+    /** Used only by explicit historical repair; ordinary reconciliation keeps defaults enabled. */
+    allowDeviceDefault?: boolean;
+    /** Mark explicit historical default repair as lower-confidence local evidence. */
+    deviceDefaultConfidence?: boolean;
     /** Network deliverer; only called after outbox write. */
     deliver?: DeliverFn;
     /** Skip network even when company is resolved (local unit tests). */