@indigoai-us/hq-cloud 6.12.4 → 6.13.0

package/dist/lib/cloud-authoritative.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Cloud-authoritative vault paths — files the SERVER regenerates and owns, so
+ * on a sync conflict the cloud version always wins (pull-wins) and NO
+ * `.conflict-` mirror is minted.
+ *
+ * Why this exists
+ * ---------------
+ * Some vault files are written/regenerated server-side on a schedule, not by
+ * the client:
+ *   - `company-brief.md`  — rewritten by the ontology gardener's brief-generator
+ *                           on every run.
+ *   - `board.json`        — rewritten by board automation.
+ *   - `ontology/**`, `signals/**`, `sources/**` — the gardener / sources+signals
+ *                           pipeline are the sole authors; clients only consume.
+ *
+ * A client that also holds these locally diverges from the server copy on
+ * essentially every sync. Under `--on-conflict keep` (what outposts run) that
+ * produced two compounding bugs:
+ *   1. CONFLICT LOOP — each sync minted a fresh `<file>.conflict-<ts>-<machine>`
+ *      mirror that was never cleaned up (e.g. ~50 `company-brief.md.conflict-*`
+ *      piled up on an outpost over a few days).
+ *   2. SILENT DRIFT — the keep path stamped the journal with the REMOTE etag
+ *      while leaving the divergent LOCAL content in place, so the journal
+ *      reported "in sync" forever and the file never reconciled.
+ *
+ * Treating these paths as cloud-authoritative resolves both: the conflict path
+ * short-circuits to a normal overwrite-from-cloud (correct journal stamp, no
+ * mirror), because for a server-owned file the cloud copy is the truth.
+ *
+ * Extending
+ * ---------
+ * Add a pattern to {@link CLOUD_AUTHORITATIVE_PATTERNS}. Patterns are matched
+ * against the VAULT-RELATIVE path (a leading `companies/<slug>/` is stripped
+ * first), so both call sites — the pull leg (hqRoot-relative
+ * `companies/<slug>/…`) and the push leg (company-relative `…`) — work.
+ */
+/** Vault-relative patterns for server-owned, cloud-wins files. */
+export declare const CLOUD_AUTHORITATIVE_PATTERNS: readonly RegExp[];
+/**
+ * True iff `relPath` is a server-regenerated, cloud-authoritative vault file.
+ * Accepts either an hqRoot-relative path (`companies/<slug>/…`) or a
+ * vault-relative path (`…`); Windows separators are normalized.
+ */
+export declare function isCloudAuthoritative(relPath: string): boolean;
+//# sourceMappingURL=cloud-authoritative.d.ts.map

package/dist/lib/cloud-authoritative.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-authoritative.d.ts","sourceRoot":"","sources":["../../src/lib/cloud-authoritative.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,kEAAkE;AAClE,eAAO,MAAM,4BAA4B,EAAE,SAAS,MAAM,EAMzD,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAO7D"}

package/dist/lib/cloud-authoritative.js

@@ -0,0 +1,58 @@
+/**
+ * Cloud-authoritative vault paths — files the SERVER regenerates and owns, so
+ * on a sync conflict the cloud version always wins (pull-wins) and NO
+ * `.conflict-` mirror is minted.
+ *
+ * Why this exists
+ * ---------------
+ * Some vault files are written/regenerated server-side on a schedule, not by
+ * the client:
+ *   - `company-brief.md`  — rewritten by the ontology gardener's brief-generator
+ *                           on every run.
+ *   - `board.json`        — rewritten by board automation.
+ *   - `ontology/**`, `signals/**`, `sources/**` — the gardener / sources+signals
+ *                           pipeline are the sole authors; clients only consume.
+ *
+ * A client that also holds these locally diverges from the server copy on
+ * essentially every sync. Under `--on-conflict keep` (what outposts run) that
+ * produced two compounding bugs:
+ *   1. CONFLICT LOOP — each sync minted a fresh `<file>.conflict-<ts>-<machine>`
+ *      mirror that was never cleaned up (e.g. ~50 `company-brief.md.conflict-*`
+ *      piled up on an outpost over a few days).
+ *   2. SILENT DRIFT — the keep path stamped the journal with the REMOTE etag
+ *      while leaving the divergent LOCAL content in place, so the journal
+ *      reported "in sync" forever and the file never reconciled.
+ *
+ * Treating these paths as cloud-authoritative resolves both: the conflict path
+ * short-circuits to a normal overwrite-from-cloud (correct journal stamp, no
+ * mirror), because for a server-owned file the cloud copy is the truth.
+ *
+ * Extending
+ * ---------
+ * Add a pattern to {@link CLOUD_AUTHORITATIVE_PATTERNS}. Patterns are matched
+ * against the VAULT-RELATIVE path (a leading `companies/<slug>/` is stripped
+ * first), so both call sites — the pull leg (hqRoot-relative
+ * `companies/<slug>/…`) and the push leg (company-relative `…`) — work.
+ */
+/** Vault-relative patterns for server-owned, cloud-wins files. */
+export const CLOUD_AUTHORITATIVE_PATTERNS = [
+    /^company-brief\.md$/,
+    /^board\.json$/,
+    /^ontology\//,
+    /^signals\//,
+    /^sources\//,
+];
+/**
+ * True iff `relPath` is a server-regenerated, cloud-authoritative vault file.
+ * Accepts either an hqRoot-relative path (`companies/<slug>/…`) or a
+ * vault-relative path (`…`); Windows separators are normalized.
+ */
+export function isCloudAuthoritative(relPath) {
+    const vaultRel = relPath
+        .split("\\")
+        .join("/")
+        .replace(/^\.?\//, "")
+        .replace(/^companies\/[^/]+\//, "");
+    return CLOUD_AUTHORITATIVE_PATTERNS.some((re) => re.test(vaultRel));
+}
+//# sourceMappingURL=cloud-authoritative.js.map

package/dist/lib/cloud-authoritative.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-authoritative.js","sourceRoot":"","sources":["../../src/lib/cloud-authoritative.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,kEAAkE;AAClE,MAAM,CAAC,MAAM,4BAA4B,GAAsB;IAC7D,qBAAqB;IACrB,eAAe;IACf,aAAa;IACb,YAAY;IACZ,YAAY;CACb,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,QAAQ,GAAG,OAAO;SACrB,KAAK,CAAC,IAAI,CAAC;SACX,IAAI,CAAC,GAAG,CAAC;SACT,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,OAAO,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;IACtC,OAAO,4BAA4B,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AACtE,CAAC"}

package/dist/lib/cloud-authoritative.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=cloud-authoritative.test.d.ts.map

package/dist/lib/cloud-authoritative.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-authoritative.test.d.ts","sourceRoot":"","sources":["../../src/lib/cloud-authoritative.test.ts"],"names":[],"mappings":""}

package/dist/lib/cloud-authoritative.test.js

@@ -0,0 +1,42 @@
+import { describe, it, expect } from "vitest";
+import { isCloudAuthoritative } from "./cloud-authoritative.js";
+describe("isCloudAuthoritative", () => {
+    it("matches server-regenerated root files (both path forms)", () => {
+        for (const p of [
+            "companies/indigo/company-brief.md",
+            "company-brief.md",
+            "companies/acme/board.json",
+            "board.json",
+        ]) {
+            expect(isCloudAuthoritative(p)).toBe(true);
+        }
+    });
+    it("matches the pipeline-authored dirs", () => {
+        for (const p of [
+            "companies/indigo/ontology/entities/concept/grok.md",
+            "ontology/entities/person/x.md",
+            "companies/indigo/signals/slack-dm/action_item/a.md",
+            "signals/decision/b.md",
+            "companies/indigo/sources/slack/T1-2.md",
+            "sources/meetings/m.md",
+        ]) {
+            expect(isCloudAuthoritative(p)).toBe(true);
+        }
+    });
+    it("does NOT match client-owned files", () => {
+        for (const p of [
+            "companies/indigo/skills/work-mesh/SKILL.md",
+            "companies/indigo/projects/company-agents/release/index.html",
+            "companies/indigo/workers/hq-notify/emails/notice.template.html",
+            "companies/indigo/knowledge/readme.md",
+            "company-brief.md.conflict-2026-06-18T00-00-00Z-501bc8.md", // a mirror, not the brief
+            "docs/handoff.md",
+        ]) {
+            expect(isCloudAuthoritative(p)).toBe(false);
+        }
+    });
+    it("normalizes windows separators", () => {
+        expect(isCloudAuthoritative("companies\\indigo\\ontology\\entities\\x.md")).toBe(true);
+    });
+});
+//# sourceMappingURL=cloud-authoritative.test.js.map

package/dist/lib/cloud-authoritative.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-authoritative.test.js","sourceRoot":"","sources":["../../src/lib/cloud-authoritative.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAEhE,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,KAAK,MAAM,CAAC,IAAI;YACd,mCAAmC;YACnC,kBAAkB;YAClB,2BAA2B;YAC3B,YAAY;SACb,EAAE,CAAC;YACF,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,KAAK,MAAM,CAAC,IAAI;YACd,oDAAoD;YACpD,+BAA+B;YAC/B,oDAAoD;YACpD,uBAAuB;YACvB,wCAAwC;YACxC,uBAAuB;SACxB,EAAE,CAAC;YACF,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,KAAK,MAAM,CAAC,IAAI;YACd,4CAA4C;YAC5C,6DAA6D;YAC7D,gEAAgE;YAChE,sCAAsC;YACtC,0DAA0D,EAAE,0BAA0B;YACtF,iBAAiB;SAClB,EAAE,CAAC;YACF,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,oBAAoB,CAAC,6CAA6C,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/types.d.ts

@@ -68,7 +68,7 @@ export interface JournalEntry {
      * the same paths as orphans, then garbage-collected.
      */
     removedAt?: string;
-    removedReason?: "scope_shrink" | "narrow_apply" | "manual";
+    removedReason?: "scope_shrink" | "narrow_apply" | "manual" | "local-delete";
     /**
      * Durable automatic-pull retention marker. Set when a scope shrink keeps an
      * out-of-scope caller-authored or unknown-author entry on disk instead of
@@ -77,6 +77,16 @@ export interface JournalEntry {
      * the entry becomes in-scope again.
      */
     outOfScopeProtected?: boolean;
+    /**
+     * Journal-honesty marker. Set when a conflict was resolved by KEEPing a local
+     * copy that diverges from the remote: the entry still records the remote
+     * `remoteEtag` (so the conflict can't re-fire — the #137 invariant), but the
+     * local bytes never matched that remote. The currency-gated delete planner
+     * refuses to propagate a delete for such an entry — its currency would
+     * falsely "match" on HEAD, and deleting would destroy the divergent remote
+     * version. Cleared by any genuine download (which makes local == remote).
+     */
+    localDiverges?: boolean;
 }
 /**
  * Per-pull boundary record (Journal v2, US-005).

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,IAAI,GAAG,MAAM,CAAC;IACzB;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,cAAc,GAAG,cAAc,GAAG,QAAQ,CAAC;IAC3D;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACtC;;;OAGG;IACH,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B;;;;;OAKG;IACH,OAAO,EAAE,GAAG,GAAG,GAAG,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACpC;;;;OAIG;IACH,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,yBAAyB;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC;IACb,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB;IACjB,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;OAaG;IACH,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,qCAAqC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,8DAA8D;IAC9D,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;OASG;IACH,SAAS,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACrD,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;;;;;;;;;OAWG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC;AASD,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,4DAA4D;IAC5D,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,CAAC,CAAC;IACX,SAAS,EAAE,kBAAkB,EAAE,CAAC;CACjC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,IAAI,GAAG,MAAM,CAAC;IACzB;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,cAAc,GAAG,cAAc,GAAG,QAAQ,GAAG,cAAc,CAAC;IAC5E;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACtC;;;OAGG;IACH,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B;;;;;OAKG;IACH,OAAO,EAAE,GAAG,GAAG,GAAG,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACpC;;;;OAIG;IACH,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,yBAAyB;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC;IACb,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB;IACjB,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;OAaG;IACH,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,qCAAqC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,8DAA8D;IAC9D,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;OASG;IACH,SAAS,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACrD,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;;;;;;;;;OAWG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC;AASD,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,4DAA4D;IAC5D,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,CAAC,CAAC;IACX,SAAS,EAAE,kBAAkB,EAAE,CAAC;CACjC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cloud",
-  "version": "6.12.4",
+  "version": "6.13.0",
   "description": "HQ by Indigo cloud sync engine — bidirectional S3 sync for mobile access",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/bin/sync-runner.test.ts

@@ -3580,6 +3580,47 @@ describe("resolvePullScope", () => {
     expect(scope.prefixSet).toEqual(["knowledge/", "shared/"]);
   });
 
+  // Regression lock-in (Michal / ridge report): a non-owner member whose
+  // ONLY grant is a COMPANY-WIDE write grant (surfaced by the server as
+  // `source: "open"`) on a projects prefix — and who has NO direct
+  // person/group/email grant — MUST resolve a non-empty shared scope that
+  // COVERS that prefix. The reported bug was the push resolving an empty/
+  // sparse prefixSet here (ignoring company-wide grants), so every file was
+  // scope-excluded (403 SCOPE_EXCEEDS_PARENT on old clients, silent no-op on
+  // 5.54.1). resolvePullScope treats a company-wide `open` grant identically
+  // to a direct grant; this test guards against a future filter that drops
+  // `source: "open"` and re-introduces the silent-drop regression.
+  it("honors a company-wide-only write grant as the shared push scope (no empty-prune)", async () => {
+    const scope = await resolvePullScope(
+      stubClient({
+        listMyMemberships: async () => [membership("cmp_a", "mk_a")],
+        getMembershipSyncConfig: async () => ({
+          membershipId: "mk_a",
+          syncMode: "shared",
+          isDefault: false,
+        }),
+        // Exactly one grant, company-wide WRITE, no direct grant.
+        listMyExplicitGrants: async () =>
+          [
+            {
+              companyUid: "cmp_a",
+              path: "projects/alpha/",
+              permission: "write",
+              source: "open",
+            },
+          ] as never,
+      }),
+      "cmp_a",
+      "acme",
+    );
+    expect(scope.syncMode).toBe("shared");
+    // The granted prefix is present — NOT an empty set (which would scope-
+    // exclude every file and silently push nothing).
+    expect(scope.prefixSet).toEqual(["projects/alpha/"]);
+    expect(scope.prefixSet).not.toEqual([]);
+    expect(scope.prefixSet?.length).toBeGreaterThan(0);
+  });
+
   it("normalizes real-world mixed/glob grant paths into company-relative prefixes", async () => {
     // The exact shapes observed in the live hq-pro vault for `indigo`:
     // bare glob, full-anchored + /*, full-anchored exact file, slug-anchored

package/src/cli/share.test.ts

@@ -2470,6 +2470,61 @@ describe("share", () => {
     expect(journal.files["core/policies/old.md"]).toBeUndefined();
   });
 
+  it("currency-gated: propagates the S3 delete for a local-delete tombstone (pull-leg producer hand-off)", async () => {
+    // The pull-leg producer stamped a persisting `local-delete` tombstone for a
+    // file the user deleted (no respawn). The cross-leg hand-off: on the next
+    // push the S3 object must actually be DELETED and the entry dropped, so the
+    // deletion propagates to the cloud + every other surface.
+    const companyRoot = path.join(tmpDir, "companies", "acme");
+    fs.mkdirSync(companyRoot, { recursive: true });
+    const journalPath = path.join(stateDir, "sync-journal.acme.json");
+    fs.writeFileSync(
+      journalPath,
+      JSON.stringify({
+        version: "2",
+        lastSync: new Date().toISOString(),
+        files: {
+          "docs/deleted.md": {
+            hash: "h",
+            size: 100,
+            syncedAt: new Date().toISOString(),
+            direction: "down",
+            remoteEtag: "abc123",
+            removedAt: new Date().toISOString(),
+            removedReason: "local-delete",
+          },
+        },
+        pulls: [],
+      }),
+    );
+
+    // HEAD returns the same etag — this device had the current version, so the
+    // currency-gated delete is safe to propagate.
+    vi.mocked(headRemoteFile).mockResolvedValueOnce({
+      lastModified: new Date(),
+      etag: '"abc123"',
+      size: 100,
+    });
+
+    const result = await share({
+      paths: [companyRoot],
+      company: "acme",
+      vaultConfig: mockConfig,
+      hqRoot: tmpDir,
+      skipUnchanged: true,
+      propagateDeletes: true,
+      propagateDeletePolicy: "currency-gated",
+    });
+
+    expect(result.filesDeleted).toBe(1);
+    expect(deleteRemoteFile).toHaveBeenCalledWith(
+      expect.anything(),
+      "docs/deleted.md",
+    );
+    const journal = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
+    expect(journal.files["docs/deleted.md"]).toBeUndefined();
+  });
+
   it("currency-gated: refuses delete + emits stale-etag event when remote moved since last sync", async () => {
     const companyRoot = path.join(tmpDir, "companies", "acme");
     fs.mkdirSync(companyRoot, { recursive: true });
@@ -2531,6 +2586,70 @@ describe("share", () => {
     expect(result.filesTombstoned).toBe(0);
   });
 
+  it("currency-gated: refuses delete for a divergent-local entry (journal-honesty — never delete a remote the local never genuinely matched)", async () => {
+    const companyRoot = path.join(tmpDir, "companies", "acme");
+    fs.mkdirSync(companyRoot, { recursive: true });
+    // A keep-conflict recorded the REMOTE etag (so the conflict can't re-fire —
+    // the #137 invariant) but the kept LOCAL content DIVERGED from that remote
+    // (`localDiverges:true`). The local copy was then deleted. The currency HEAD
+    // would MATCH the recorded etag — the trap — yet the etag never reflected a
+    // genuine local==remote sync, so propagating the delete would destroy the
+    // (different) remote version. Must be REFUSED, not propagated.
+    const journalPath = path.join(stateDir, "sync-journal.acme.json");
+    fs.writeFileSync(
+      journalPath,
+      JSON.stringify({
+        version: "2",
+        lastSync: new Date().toISOString(),
+        files: {
+          "core/policies/kept.md": {
+            hash: "local-divergent-hash",
+            size: 100,
+            syncedAt: new Date().toISOString(),
+            direction: "down",
+            remoteEtag: "abc123",
+            localDiverges: true,
+          },
+        },
+        pulls: [],
+      }),
+    );
+
+    // Deliberately NO HEAD mock: the divergence guard short-circuits BEFORE the
+    // currency HEAD, so `headRemoteFile` is never called for this entry — the
+    // refusal costs no network round-trip (asserted below).
+    const events: Array<{ type: string; path?: string; reason?: string }> = [];
+    const result = await share({
+      paths: [companyRoot],
+      company: "acme",
+      vaultConfig: mockConfig,
+      hqRoot: tmpDir,
+      skipUnchanged: true,
+      propagateDeletes: true,
+      propagateDeletePolicy: "currency-gated",
+      onEvent: (e) => events.push(e as { type: string }),
+    });
+
+    // No remote DELETE — the recorded etag never reflected a genuine sync.
+    expect(result.filesDeleted).toBe(0);
+    expect(deleteRemoteFile).not.toHaveBeenCalledWith(
+      expect.anything(),
+      "core/policies/kept.md",
+    );
+    // Refusal short-circuits before the currency HEAD — no network needed.
+    expect(headRemoteFile).not.toHaveBeenCalled();
+    // Journal entry preserved, not silently dropped.
+    const journal = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
+    expect(journal.files["core/policies/kept.md"]).toBeDefined();
+    // Surfaced as a refusal with the divergent-local reason.
+    const refused = events.find((e) => e.type === "delete-refused-stale-etag");
+    expect(refused).toMatchObject({
+      type: "delete-refused-stale-etag",
+      path: "core/policies/kept.md",
+      reason: "divergent-local",
+    });
+  });
+
   it("currency-gated: tombstones journal entry when remote returns 404 (out-of-band cleanup)", async () => {
     const companyRoot = path.join(tmpDir, "companies", "acme");
     fs.mkdirSync(companyRoot, { recursive: true });

package/src/cli/share.ts

@@ -64,6 +64,7 @@ import {
   readShortMachineId,
 } from "../lib/conflict-file.js";
 import { appendConflictEntry } from "../lib/conflict-index.js";
+import { isCloudAuthoritative } from "../lib/cloud-authoritative.js";
 
 /**
  * Push-side fresh-collision convergence probe.
@@ -1260,6 +1261,16 @@ async function executeUploads(
       }
 
       if ((localChanged && remoteChanged) || isFreshCollision) {
+        // Cloud-authoritative paths (server-regenerated: company-brief.md,
+        // board.json, ontology/ signals/ sources/) are PULL-WINS. Never push the
+        // local copy over the server-owned version and never mint a `.conflict-`
+        // mirror — the pull leg overwrites local from cloud. Declining here is
+        // what stops the per-sync conflict-mirror loop on these files.
+        if (isCloudAuthoritative(relativePath)) {
+          run.emit({ type: "reconciled", path: relativePath, direction: "push" });
+          counters.filesSkipped++;
+          return;
+        }
         conflictPaths.push(relativePath);
 
         const resolution = await resolveConflictSerialized({
@@ -1976,7 +1987,11 @@ function resolveDeleteScopeRoots(
  *                          tracked. `journalEtag` and `remoteEtag` are
  *                          placeholder sentinels — do not display as ETags.
  */
-type RefusedStaleReason = "stale-etag" | "legacy-no-etag" | "bulk-asymmetry";
+type RefusedStaleReason =
+  | "stale-etag"
+  | "legacy-no-etag"
+  | "bulk-asymmetry"
+  | "divergent-local";
 
 /**
  * Bulk-asymmetry circuit-breaker — refuses to convert a suspiciously-large
@@ -2230,6 +2245,22 @@ async function computeDeletePlan(
     // documentation of the policy-side intent.
     if (isEphemeralPath(relativeKey)) continue;
 
+    // Journal-honesty guard: an entry flagged `localDiverges` recorded the
+    // remote etag only to silence a re-fired conflict (#137) — the local copy
+    // NEVER matched that remote. Its currency would falsely "match" on HEAD, so
+    // propagating a delete would destroy the divergent remote version. Refuse it
+    // regardless of policy, and do NOT count it toward the bulk-asymmetry ratio
+    // (it isn't a genuine mirror-loss candidate). Cleared by a real download.
+    if (entry.localDiverges) {
+      plan.refusedStale.push({
+        key: relativeKey,
+        journalEtag: entry.remoteEtag ?? "<divergent-local>",
+        remoteEtag: "<not-checked>",
+        reason: "divergent-local",
+      });
+      continue;
+    }
+
     if (policy === "all") {
       // policy:"all" is the explicit-opt-out emergency-reconcile mode; the
       // bulk-asymmetry guard skips this branch (caller asserted intent).