@integrity-labs/agt-cli 0.28.528 → 0.28.529

package/dist/mcp/direct-chat-channel.js

@@ -33484,6 +33484,45 @@ var INTEGRATION_REGISTRY = [
       { id: "augmented-support:propose-writes", name: "Propose Self-Remediation", description: "Propose creating an agent in your own org; executed only after a human approves a server-rendered diff.", access: "write" }
     ]
   },
+  {
+    // ENG-8332: the Augmented Team HELP knowledge base, split out of
+    // `augmented-support` so an agent can be given the docs WITHOUT also being
+    // given a ticket-filing button, an agent-proposal button, and org-wide read
+    // of agents, hosts, integrations, alerts, flags and the audit log. That
+    // bundling was why "just give everyone augmented-support" was the wrong
+    // answer, and the cost was agents answering platform questions from
+    // inference instead of documentation (the CS-1529/CS-1530 case).
+    //
+    // Provisions the @integrity-labs/augmented-help-kb-mcp stdio broker, a
+    // read-only client over /host/kb - the single enumerated carve-out from the
+    // ADR-0032 org-lock invariant (ENG-7119). KB content is platform-curated
+    // and org-neutral, so this grants NO view of any org's state; the client
+    // has no POST transport at all, so writes are structurally impossible
+    // rather than merely unregistered.
+    //
+    // auth `none` - no end-user OAuth, the host JWT is the credential. `beta`
+    // while distribution widens. NOT in the Add Integration picker (no
+    // `installable`): granted deliberately, like its two siblings.
+    //
+    // NAMING (ENG-7281): this is the "help knowledge base" - shared, published,
+    // org-neutral PRODUCT help. It is NOT the org knowledge store that
+    // `knowledge_search` / `context_search` read. Keep the two distinct in every
+    // surface that names them.
+    id: "augmented-help-kb",
+    name: "Augmented Help KB",
+    category: "knowledge",
+    description: "The Augmented Team help knowledge base: search and read the shared, published product documentation (how-tos, common fixes, FAQs). Identical for every organization and org-neutral by design - it grants no view of your org's own state, and cannot file tickets or propose changes. Distinct from your organization's own knowledge store.",
+    supported_auth_types: ["none"],
+    beta: true,
+    capabilities: [
+      {
+        id: "augmented-help-kb:read",
+        name: "Read Help Docs",
+        description: "Search and read published Augmented Team help articles (org-neutral product documentation). Read-only; no ticket filing, no agent proposals, no org-state reads.",
+        access: "read"
+      }
+    ]
+  },
   {
     id: "firecrawl",
     name: "Firecrawl",
@@ -34363,10 +34402,21 @@ function parseAccountEnforcementMarker(raw) {
   const level = parsed.level;
   if (level !== "warn" && level !== "mute")
     return null;
-  return { version: ACCOUNT_ENFORCEMENT_MARKER_VERSION, level };
+  const rawText = parsed.text;
+  const text = typeof rawText === "string" && rawText.trim() ? rawText.trim() : void 0;
+  return {
+    version: ACCOUNT_ENFORCEMENT_MARKER_VERSION,
+    level,
+    ...text ? { text } : {}
+  };
 }
-function buildAccountIssueReplyText() {
-  return "There is an issue with your account, please contact support@augmented.team.";
+var DEFAULT_ACCOUNT_ENFORCEMENT_COPY = {
+  warn: "Heads-up: there's an issue with your account that needs attention. Please contact support@augmented.team so I can keep helping you.",
+  mute: "There is an issue with your account, please contact support@augmented.team."
+};
+function buildAccountIssueReplyText(level, override) {
+  const trimmed = typeof override === "string" ? override.trim() : "";
+  return trimmed || DEFAULT_ACCOUNT_ENFORCEMENT_COPY[level];
 }
 
 // ../core/dist/kanban/state-machine.js
@@ -35459,6 +35509,32 @@ var FLAG_REGISTRY = [
     // Best-effort reach estimate only; not part of the schema fingerprint.
     since: "0.28.504"
   },
+  {
+    key: "utilization-occupancy-qualifier",
+    description: "Utilization busy-minutes gate (ENG-8465): shadow = report every measured bucket exactly as before while COUNTING how many a transcript qualifier would drop; enforce = drop measured buckets that have no qualifying assistant turn (>= 25 output tokens, non-synthetic) within \xB1120s. The qualifier is the merged @augmented/core primitive (extractQualifyingTurns / isBucketQualified); the host reads a bounded transcript tail incl. <sessionId>/subagents/ at drain time and FAILS OPEN (credits ungated) when a transcript cannot be read. Read host-side via hostFlagStore (getString) in the manager; consumer ships in this PR's agt-cli auto-publish bump. Both modes emit the OccupancyQualificationClassifications shadow metric (qualified positive-control + unqualified_dropped signal + unreadable), so per-agent impact is measured before the flip.",
+    flagType: "enum",
+    allowedValues: ["shadow", "enforce"],
+    // Declared safe value is `shadow`: it reproduces pre-flag billing exactly, so
+    // rollout changes no agent's minutes while the shadow metric accrues the
+    // enforce-flip evidence. `enforce` lowers a billing-adjacent number, so it is a
+    // deliberate, audited flip — never a flag-DB-read-error default.
+    defaultValue: "shadow",
+    // Operator per-host override (ADR-0022 highest precedence). No _ENABLED/_DISABLED/
+    // _MODE suffix, and read via hostFlagStore not a raw process.env gate, so not a
+    // new env gate under ENG-6252. Never pinned in sst.config.ts (ENG-8303).
+    envVar: "AGT_UTILIZATION_OCCUPANCY_QUALIFIER",
+    // enforce lowers a billing-adjacent number, so flipping/weakening it is guarded
+    // like the other enforcement-mode flags.
+    sensitive: true,
+    // Reach threshold (ENG-8465): the host reader (occupancyQualifierMode in
+    // manager-worker.ts) lands in this PR's agt-cli auto-publish patch bump, which
+    // is the first published version to contain it (through 0.28.528 does not). An
+    // UNSET `since` makes classifyHostReach report `honors` (full coverage), which
+    // would greenlight an `enforce` flip while older hosts silently stay `shadow`.
+    // Best-effort estimate (like docker-hygiene's), in the safe direction — a
+    // not-yet-published version reports 0% honor until hosts update. (CodeRabbit)
+    since: "0.28.529"
+  },
   {
     key: "composio-hitl-mode",
     description: "Composio managed-toolkits HITL gate (ENG-6027): off = kill switch, shadow = resolve + audit the tier decision but never block, enforce = block write_high_risk+ calls and route them to Human Approval (an Approve/Deny card). Since ENG-7828 enforce ALWAYS routes to a Human Approval card by default; set hitl-approval-routing=off to make enforce a hard block with no approval instead. Per-org rollout from the admin Feature Flags page; ENG-7672 migrated this off the fleet-wide COMPOSIO_HITL_MODE env var.",
@@ -35865,6 +35941,15 @@ var FLAG_REGISTRY = [
     // runbook gates on it. Leaving the placeholder in place is safe (nothing
     // flips); shipping a guessed number is not.
     since: "0.29.0"
+  },
+  {
+    key: "help-kb-auto-grant",
+    description: "Auto-grant the `augmented-help-kb` integration at ORG scope when an organization is provisioned (ENG-8542), so every agent in that org gets product-doc search without a per-agent operator action. One organization_integrations row reaches every agent in the org: POST /host/agent-integrations merges org -> team -> agent and buildMcpJson's predicate reads that merged set with no scope filter. ON: the two org-provisioning call sites write the row (status=active, created_by=the org owner). OFF (default): they write nothing - byte-for-byte today's behaviour. STAGED ROLLOUT IS THE POINT. ENG-8332 argues against widening distribution of the help KB until two things close, because distributing a corpus with wrong articles \"converts one agent's wrong answer into everyone's\": (1) a live 200 from GET /host/kb/search as the anon role has still never been observed - ENG-7260 was closed on remediation evidence, not on a live call, and the deploy seed log is SERVICE-ROLE evidence that says nothing about the anon grant; (2) the `site-structure` article is unverified against the current IA. Turning this on for ONE org and watching that org's help-kb connectivity-probe verdicts (ENG-8332 added a real mcp_stdio probe that calls search_knowledge_base) is the cheap positive control for (1) - an ENG-7260-class 500 then reports as `down` per agent instead of as silence. Widen only after it comes back healthy. REVOKING IS DELETING THE ROW, not flipping this off: the flag gates GRANTING, so an already-granted org keeps its row when the flag goes off. Evaluated API-side only, per org, inside grantHelpKbToOrg; no host-side envVar and deliberately no sst.config.ts entry (a literal default there would pin it - ENG-8303).",
+    flagType: "boolean",
+    // Declared safe value is `false` = grant nothing. A flag-store outage must
+    // never auto-attach an integration nobody asked for, and both ENG-8332
+    // prerequisites above are still open.
+    defaultValue: false
   }
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));
@@ -36826,7 +36911,7 @@ function accountEnforcementMarkerPath(codeName) {
   if (!codeName) return null;
   return join12(homedir3(), ".augmented", codeName, ACCOUNT_ENFORCEMENT_MARKER_FILENAME);
 }
-function readAccountEnforcementLevel(opts) {
+function readAccountEnforcementMarker(opts) {
   const path = opts.filePath ?? accountEnforcementMarkerPath(opts.codeName);
   if (!path) return null;
   let raw;
@@ -36835,7 +36920,14 @@ function readAccountEnforcementLevel(opts) {
   } catch {
     return null;
   }
-  return parseAccountEnforcementMarker(raw)?.level ?? null;
+  return parseAccountEnforcementMarker(raw);
+}
+function readAccountEnforcementLevel(opts) {
+  return readAccountEnforcementMarker(opts)?.level ?? null;
+}
+function resolveAccountIssueReplyText(level, opts) {
+  const marker = readAccountEnforcementMarker(opts);
+  return buildAccountIssueReplyText(level, marker?.level === level ? marker.text : void 0);
 }
 function shouldSendAccountWarn(opts) {
   if (readAccountEnforcementLevel({ codeName: opts.codeName, filePath: opts.filePath }) !== "warn") {
@@ -37206,7 +37298,7 @@ async function maybeSendDirectChatAccountWarn(sessionId) {
     const res = await apiPost("/host/direct-chat/reply", {
       agent_id: AGT_AGENT_ID,
       session_id: sessionId,
-      content: buildAccountIssueReplyText(),
+      content: resolveAccountIssueReplyText("warn", { codeName: AGT_AGENT_CODE_NAME ?? null }),
       // The L1 warn nag is an extra message alongside the agent's real reply,
       // which has already advanced the cursor.
       // cursor-advance-allow: deliberately EMPTY — nothing to advance, no count to read.
@@ -37866,7 +37958,7 @@ async function pollForMessages(sinceMs) {
           now: Date.now()
         });
         const route = throttle.reply ? "/host/direct-chat/reply" : "/host/direct-chat/consume";
-        const body = throttle.reply ? { agent_id: AGT_AGENT_ID, session_id: msg.session_id, content: buildAccountIssueReplyText(), message_ids: [msg.id], kind: "notice" } : { agent_id: AGT_AGENT_ID, session_id: msg.session_id, message_ids: [msg.id] };
+        const body = throttle.reply ? { agent_id: AGT_AGENT_ID, session_id: msg.session_id, content: resolveAccountIssueReplyText("mute", { codeName: AGT_AGENT_CODE_NAME ?? null }), message_ids: [msg.id], kind: "notice" } : { agent_id: AGT_AGENT_ID, session_id: msg.session_id, message_ids: [msg.id] };
         try {
           const res2 = await apiPost(route, body);
           const { body: data2, httpOk, statusText } = await readCursorAdvanceBody(res2);

package/dist/mcp/origami.js

@@ -39822,6 +39822,45 @@ var INTEGRATION_REGISTRY = [
       { id: "augmented-support:propose-writes", name: "Propose Self-Remediation", description: "Propose creating an agent in your own org; executed only after a human approves a server-rendered diff.", access: "write" }
     ]
   },
+  {
+    // ENG-8332: the Augmented Team HELP knowledge base, split out of
+    // `augmented-support` so an agent can be given the docs WITHOUT also being
+    // given a ticket-filing button, an agent-proposal button, and org-wide read
+    // of agents, hosts, integrations, alerts, flags and the audit log. That
+    // bundling was why "just give everyone augmented-support" was the wrong
+    // answer, and the cost was agents answering platform questions from
+    // inference instead of documentation (the CS-1529/CS-1530 case).
+    //
+    // Provisions the @integrity-labs/augmented-help-kb-mcp stdio broker, a
+    // read-only client over /host/kb - the single enumerated carve-out from the
+    // ADR-0032 org-lock invariant (ENG-7119). KB content is platform-curated
+    // and org-neutral, so this grants NO view of any org's state; the client
+    // has no POST transport at all, so writes are structurally impossible
+    // rather than merely unregistered.
+    //
+    // auth `none` - no end-user OAuth, the host JWT is the credential. `beta`
+    // while distribution widens. NOT in the Add Integration picker (no
+    // `installable`): granted deliberately, like its two siblings.
+    //
+    // NAMING (ENG-7281): this is the "help knowledge base" - shared, published,
+    // org-neutral PRODUCT help. It is NOT the org knowledge store that
+    // `knowledge_search` / `context_search` read. Keep the two distinct in every
+    // surface that names them.
+    id: "augmented-help-kb",
+    name: "Augmented Help KB",
+    category: "knowledge",
+    description: "The Augmented Team help knowledge base: search and read the shared, published product documentation (how-tos, common fixes, FAQs). Identical for every organization and org-neutral by design - it grants no view of your org's own state, and cannot file tickets or propose changes. Distinct from your organization's own knowledge store.",
+    supported_auth_types: ["none"],
+    beta: true,
+    capabilities: [
+      {
+        id: "augmented-help-kb:read",
+        name: "Read Help Docs",
+        description: "Search and read published Augmented Team help articles (org-neutral product documentation). Read-only; no ticket filing, no agent proposals, no org-state reads.",
+        access: "read"
+      }
+    ]
+  },
   {
     id: "firecrawl",
     name: "Firecrawl",
@@ -41361,6 +41400,32 @@ var FLAG_REGISTRY = [
     // Best-effort reach estimate only; not part of the schema fingerprint.
     since: "0.28.504"
   },
+  {
+    key: "utilization-occupancy-qualifier",
+    description: "Utilization busy-minutes gate (ENG-8465): shadow = report every measured bucket exactly as before while COUNTING how many a transcript qualifier would drop; enforce = drop measured buckets that have no qualifying assistant turn (>= 25 output tokens, non-synthetic) within \xB1120s. The qualifier is the merged @augmented/core primitive (extractQualifyingTurns / isBucketQualified); the host reads a bounded transcript tail incl. <sessionId>/subagents/ at drain time and FAILS OPEN (credits ungated) when a transcript cannot be read. Read host-side via hostFlagStore (getString) in the manager; consumer ships in this PR's agt-cli auto-publish bump. Both modes emit the OccupancyQualificationClassifications shadow metric (qualified positive-control + unqualified_dropped signal + unreadable), so per-agent impact is measured before the flip.",
+    flagType: "enum",
+    allowedValues: ["shadow", "enforce"],
+    // Declared safe value is `shadow`: it reproduces pre-flag billing exactly, so
+    // rollout changes no agent's minutes while the shadow metric accrues the
+    // enforce-flip evidence. `enforce` lowers a billing-adjacent number, so it is a
+    // deliberate, audited flip — never a flag-DB-read-error default.
+    defaultValue: "shadow",
+    // Operator per-host override (ADR-0022 highest precedence). No _ENABLED/_DISABLED/
+    // _MODE suffix, and read via hostFlagStore not a raw process.env gate, so not a
+    // new env gate under ENG-6252. Never pinned in sst.config.ts (ENG-8303).
+    envVar: "AGT_UTILIZATION_OCCUPANCY_QUALIFIER",
+    // enforce lowers a billing-adjacent number, so flipping/weakening it is guarded
+    // like the other enforcement-mode flags.
+    sensitive: true,
+    // Reach threshold (ENG-8465): the host reader (occupancyQualifierMode in
+    // manager-worker.ts) lands in this PR's agt-cli auto-publish patch bump, which
+    // is the first published version to contain it (through 0.28.528 does not). An
+    // UNSET `since` makes classifyHostReach report `honors` (full coverage), which
+    // would greenlight an `enforce` flip while older hosts silently stay `shadow`.
+    // Best-effort estimate (like docker-hygiene's), in the safe direction — a
+    // not-yet-published version reports 0% honor until hosts update. (CodeRabbit)
+    since: "0.28.529"
+  },
   {
     key: "composio-hitl-mode",
     description: "Composio managed-toolkits HITL gate (ENG-6027): off = kill switch, shadow = resolve + audit the tier decision but never block, enforce = block write_high_risk+ calls and route them to Human Approval (an Approve/Deny card). Since ENG-7828 enforce ALWAYS routes to a Human Approval card by default; set hitl-approval-routing=off to make enforce a hard block with no approval instead. Per-org rollout from the admin Feature Flags page; ENG-7672 migrated this off the fleet-wide COMPOSIO_HITL_MODE env var.",
@@ -41767,6 +41832,15 @@ var FLAG_REGISTRY = [
     // runbook gates on it. Leaving the placeholder in place is safe (nothing
     // flips); shipping a guessed number is not.
     since: "0.29.0"
+  },
+  {
+    key: "help-kb-auto-grant",
+    description: "Auto-grant the `augmented-help-kb` integration at ORG scope when an organization is provisioned (ENG-8542), so every agent in that org gets product-doc search without a per-agent operator action. One organization_integrations row reaches every agent in the org: POST /host/agent-integrations merges org -> team -> agent and buildMcpJson's predicate reads that merged set with no scope filter. ON: the two org-provisioning call sites write the row (status=active, created_by=the org owner). OFF (default): they write nothing - byte-for-byte today's behaviour. STAGED ROLLOUT IS THE POINT. ENG-8332 argues against widening distribution of the help KB until two things close, because distributing a corpus with wrong articles \"converts one agent's wrong answer into everyone's\": (1) a live 200 from GET /host/kb/search as the anon role has still never been observed - ENG-7260 was closed on remediation evidence, not on a live call, and the deploy seed log is SERVICE-ROLE evidence that says nothing about the anon grant; (2) the `site-structure` article is unverified against the current IA. Turning this on for ONE org and watching that org's help-kb connectivity-probe verdicts (ENG-8332 added a real mcp_stdio probe that calls search_knowledge_base) is the cheap positive control for (1) - an ENG-7260-class 500 then reports as `down` per agent instead of as silence. Widen only after it comes back healthy. REVOKING IS DELETING THE ROW, not flipping this off: the flag gates GRANTING, so an already-granted org keeps its row when the flag goes off. Evaluated API-side only, per org, inside grantHelpKbToOrg; no host-side envVar and deliberately no sst.config.ts entry (a literal default there would pin it - ENG-8303).",
+    flagType: "boolean",
+    // Declared safe value is `false` = grant nothing. A flag-store outage must
+    // never auto-attach an integration nobody asked for, and both ENG-8332
+    // prerequisites above are still open.
+    defaultValue: false
   }
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));

package/dist/mcp/slack-channel.js

@@ -33711,6 +33711,45 @@ var INTEGRATION_REGISTRY = [
       { id: "augmented-support:propose-writes", name: "Propose Self-Remediation", description: "Propose creating an agent in your own org; executed only after a human approves a server-rendered diff.", access: "write" }
     ]
   },
+  {
+    // ENG-8332: the Augmented Team HELP knowledge base, split out of
+    // `augmented-support` so an agent can be given the docs WITHOUT also being
+    // given a ticket-filing button, an agent-proposal button, and org-wide read
+    // of agents, hosts, integrations, alerts, flags and the audit log. That
+    // bundling was why "just give everyone augmented-support" was the wrong
+    // answer, and the cost was agents answering platform questions from
+    // inference instead of documentation (the CS-1529/CS-1530 case).
+    //
+    // Provisions the @integrity-labs/augmented-help-kb-mcp stdio broker, a
+    // read-only client over /host/kb - the single enumerated carve-out from the
+    // ADR-0032 org-lock invariant (ENG-7119). KB content is platform-curated
+    // and org-neutral, so this grants NO view of any org's state; the client
+    // has no POST transport at all, so writes are structurally impossible
+    // rather than merely unregistered.
+    //
+    // auth `none` - no end-user OAuth, the host JWT is the credential. `beta`
+    // while distribution widens. NOT in the Add Integration picker (no
+    // `installable`): granted deliberately, like its two siblings.
+    //
+    // NAMING (ENG-7281): this is the "help knowledge base" - shared, published,
+    // org-neutral PRODUCT help. It is NOT the org knowledge store that
+    // `knowledge_search` / `context_search` read. Keep the two distinct in every
+    // surface that names them.
+    id: "augmented-help-kb",
+    name: "Augmented Help KB",
+    category: "knowledge",
+    description: "The Augmented Team help knowledge base: search and read the shared, published product documentation (how-tos, common fixes, FAQs). Identical for every organization and org-neutral by design - it grants no view of your org's own state, and cannot file tickets or propose changes. Distinct from your organization's own knowledge store.",
+    supported_auth_types: ["none"],
+    beta: true,
+    capabilities: [
+      {
+        id: "augmented-help-kb:read",
+        name: "Read Help Docs",
+        description: "Search and read published Augmented Team help articles (org-neutral product documentation). Read-only; no ticket filing, no agent proposals, no org-state reads.",
+        access: "read"
+      }
+    ]
+  },
   {
     id: "firecrawl",
     name: "Firecrawl",
@@ -34534,10 +34573,21 @@ function parseAccountEnforcementMarker(raw) {
   const level = parsed.level;
   if (level !== "warn" && level !== "mute")
     return null;
-  return { version: ACCOUNT_ENFORCEMENT_MARKER_VERSION, level };
+  const rawText = parsed.text;
+  const text = typeof rawText === "string" && rawText.trim() ? rawText.trim() : void 0;
+  return {
+    version: ACCOUNT_ENFORCEMENT_MARKER_VERSION,
+    level,
+    ...text ? { text } : {}
+  };
 }
-function buildAccountIssueReplyText() {
-  return "There is an issue with your account, please contact support@augmented.team.";
+var DEFAULT_ACCOUNT_ENFORCEMENT_COPY = {
+  warn: "Heads-up: there's an issue with your account that needs attention. Please contact support@augmented.team so I can keep helping you.",
+  mute: "There is an issue with your account, please contact support@augmented.team."
+};
+function buildAccountIssueReplyText(level, override) {
+  const trimmed = typeof override === "string" ? override.trim() : "";
+  return trimmed || DEFAULT_ACCOUNT_ENFORCEMENT_COPY[level];
 }
 
 // ../core/dist/kanban/state-machine.js
@@ -35633,6 +35683,32 @@ var FLAG_REGISTRY = [
     // Best-effort reach estimate only; not part of the schema fingerprint.
     since: "0.28.504"
   },
+  {
+    key: "utilization-occupancy-qualifier",
+    description: "Utilization busy-minutes gate (ENG-8465): shadow = report every measured bucket exactly as before while COUNTING how many a transcript qualifier would drop; enforce = drop measured buckets that have no qualifying assistant turn (>= 25 output tokens, non-synthetic) within \xB1120s. The qualifier is the merged @augmented/core primitive (extractQualifyingTurns / isBucketQualified); the host reads a bounded transcript tail incl. <sessionId>/subagents/ at drain time and FAILS OPEN (credits ungated) when a transcript cannot be read. Read host-side via hostFlagStore (getString) in the manager; consumer ships in this PR's agt-cli auto-publish bump. Both modes emit the OccupancyQualificationClassifications shadow metric (qualified positive-control + unqualified_dropped signal + unreadable), so per-agent impact is measured before the flip.",
+    flagType: "enum",
+    allowedValues: ["shadow", "enforce"],
+    // Declared safe value is `shadow`: it reproduces pre-flag billing exactly, so
+    // rollout changes no agent's minutes while the shadow metric accrues the
+    // enforce-flip evidence. `enforce` lowers a billing-adjacent number, so it is a
+    // deliberate, audited flip — never a flag-DB-read-error default.
+    defaultValue: "shadow",
+    // Operator per-host override (ADR-0022 highest precedence). No _ENABLED/_DISABLED/
+    // _MODE suffix, and read via hostFlagStore not a raw process.env gate, so not a
+    // new env gate under ENG-6252. Never pinned in sst.config.ts (ENG-8303).
+    envVar: "AGT_UTILIZATION_OCCUPANCY_QUALIFIER",
+    // enforce lowers a billing-adjacent number, so flipping/weakening it is guarded
+    // like the other enforcement-mode flags.
+    sensitive: true,
+    // Reach threshold (ENG-8465): the host reader (occupancyQualifierMode in
+    // manager-worker.ts) lands in this PR's agt-cli auto-publish patch bump, which
+    // is the first published version to contain it (through 0.28.528 does not). An
+    // UNSET `since` makes classifyHostReach report `honors` (full coverage), which
+    // would greenlight an `enforce` flip while older hosts silently stay `shadow`.
+    // Best-effort estimate (like docker-hygiene's), in the safe direction — a
+    // not-yet-published version reports 0% honor until hosts update. (CodeRabbit)
+    since: "0.28.529"
+  },
   {
     key: "composio-hitl-mode",
     description: "Composio managed-toolkits HITL gate (ENG-6027): off = kill switch, shadow = resolve + audit the tier decision but never block, enforce = block write_high_risk+ calls and route them to Human Approval (an Approve/Deny card). Since ENG-7828 enforce ALWAYS routes to a Human Approval card by default; set hitl-approval-routing=off to make enforce a hard block with no approval instead. Per-org rollout from the admin Feature Flags page; ENG-7672 migrated this off the fleet-wide COMPOSIO_HITL_MODE env var.",
@@ -36039,6 +36115,15 @@ var FLAG_REGISTRY = [
     // runbook gates on it. Leaving the placeholder in place is safe (nothing
     // flips); shipping a guessed number is not.
     since: "0.29.0"
+  },
+  {
+    key: "help-kb-auto-grant",
+    description: "Auto-grant the `augmented-help-kb` integration at ORG scope when an organization is provisioned (ENG-8542), so every agent in that org gets product-doc search without a per-agent operator action. One organization_integrations row reaches every agent in the org: POST /host/agent-integrations merges org -> team -> agent and buildMcpJson's predicate reads that merged set with no scope filter. ON: the two org-provisioning call sites write the row (status=active, created_by=the org owner). OFF (default): they write nothing - byte-for-byte today's behaviour. STAGED ROLLOUT IS THE POINT. ENG-8332 argues against widening distribution of the help KB until two things close, because distributing a corpus with wrong articles \"converts one agent's wrong answer into everyone's\": (1) a live 200 from GET /host/kb/search as the anon role has still never been observed - ENG-7260 was closed on remediation evidence, not on a live call, and the deploy seed log is SERVICE-ROLE evidence that says nothing about the anon grant; (2) the `site-structure` article is unverified against the current IA. Turning this on for ONE org and watching that org's help-kb connectivity-probe verdicts (ENG-8332 added a real mcp_stdio probe that calls search_knowledge_base) is the cheap positive control for (1) - an ENG-7260-class 500 then reports as `down` per agent instead of as silence. Widen only after it comes back healthy. REVOKING IS DELETING THE ROW, not flipping this off: the flag gates GRANTING, so an already-granted org keeps its row when the flag goes off. Evaluated API-side only, per org, inside grantHelpKbToOrg; no host-side envVar and deliberately no sst.config.ts entry (a literal default there would pin it - ENG-8303).",
+    flagType: "boolean",
+    // Declared safe value is `false` = grant nothing. A flag-store outage must
+    // never auto-attach an integration nobody asked for, and both ENG-8332
+    // prerequisites above are still open.
+    defaultValue: false
   }
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));
@@ -36091,7 +36176,7 @@ function accountEnforcementMarkerPath(codeName) {
   if (!codeName) return null;
   return join2(homedir2(), ".augmented", codeName, ACCOUNT_ENFORCEMENT_MARKER_FILENAME);
 }
-function readAccountEnforcementLevel(opts) {
+function readAccountEnforcementMarker(opts) {
   const path = opts.filePath ?? accountEnforcementMarkerPath(opts.codeName);
   if (!path) return null;
   let raw;
@@ -36100,7 +36185,14 @@ function readAccountEnforcementLevel(opts) {
   } catch {
     return null;
   }
-  return parseAccountEnforcementMarker(raw)?.level ?? null;
+  return parseAccountEnforcementMarker(raw);
+}
+function readAccountEnforcementLevel(opts) {
+  return readAccountEnforcementMarker(opts)?.level ?? null;
+}
+function resolveAccountIssueReplyText(level, opts) {
+  const marker = readAccountEnforcementMarker(opts);
+  return buildAccountIssueReplyText(level, marker?.level === level ? marker.text : void 0);
 }
 function shouldSendAccountWarn(opts) {
   if (readAccountEnforcementLevel({ codeName: opts.codeName, filePath: opts.filePath }) !== "warn") {
@@ -40649,7 +40741,7 @@ async function maybeSendAccountMuteNotice(args) {
       },
       body: JSON.stringify({
         channel: args.channel,
-        text: buildAccountIssueReplyText(),
+        text: resolveAccountIssueReplyText("mute", { codeName: AGENT_CODE_NAME }),
         ...args.threadTs ? { thread_ts: args.threadTs } : {}
       })
     });
@@ -40697,7 +40789,7 @@ async function maybeSendSlackAccountWarn(args) {
       },
       body: JSON.stringify({
         channel: args.channel,
-        text: buildAccountIssueReplyText(),
+        text: resolveAccountIssueReplyText("warn", { codeName: AGENT_CODE_NAME }),
         ...args.threadTs ? { thread_ts: args.threadTs } : {}
       })
     });

package/dist/mcp/telegram-channel.js

@@ -34032,6 +34032,45 @@ var INTEGRATION_REGISTRY = [
       { id: "augmented-support:propose-writes", name: "Propose Self-Remediation", description: "Propose creating an agent in your own org; executed only after a human approves a server-rendered diff.", access: "write" }
     ]
   },
+  {
+    // ENG-8332: the Augmented Team HELP knowledge base, split out of
+    // `augmented-support` so an agent can be given the docs WITHOUT also being
+    // given a ticket-filing button, an agent-proposal button, and org-wide read
+    // of agents, hosts, integrations, alerts, flags and the audit log. That
+    // bundling was why "just give everyone augmented-support" was the wrong
+    // answer, and the cost was agents answering platform questions from
+    // inference instead of documentation (the CS-1529/CS-1530 case).
+    //
+    // Provisions the @integrity-labs/augmented-help-kb-mcp stdio broker, a
+    // read-only client over /host/kb - the single enumerated carve-out from the
+    // ADR-0032 org-lock invariant (ENG-7119). KB content is platform-curated
+    // and org-neutral, so this grants NO view of any org's state; the client
+    // has no POST transport at all, so writes are structurally impossible
+    // rather than merely unregistered.
+    //
+    // auth `none` - no end-user OAuth, the host JWT is the credential. `beta`
+    // while distribution widens. NOT in the Add Integration picker (no
+    // `installable`): granted deliberately, like its two siblings.
+    //
+    // NAMING (ENG-7281): this is the "help knowledge base" - shared, published,
+    // org-neutral PRODUCT help. It is NOT the org knowledge store that
+    // `knowledge_search` / `context_search` read. Keep the two distinct in every
+    // surface that names them.
+    id: "augmented-help-kb",
+    name: "Augmented Help KB",
+    category: "knowledge",
+    description: "The Augmented Team help knowledge base: search and read the shared, published product documentation (how-tos, common fixes, FAQs). Identical for every organization and org-neutral by design - it grants no view of your org's own state, and cannot file tickets or propose changes. Distinct from your organization's own knowledge store.",
+    supported_auth_types: ["none"],
+    beta: true,
+    capabilities: [
+      {
+        id: "augmented-help-kb:read",
+        name: "Read Help Docs",
+        description: "Search and read published Augmented Team help articles (org-neutral product documentation). Read-only; no ticket filing, no agent proposals, no org-state reads.",
+        access: "read"
+      }
+    ]
+  },
   {
     id: "firecrawl",
     name: "Firecrawl",
@@ -34855,10 +34894,21 @@ function parseAccountEnforcementMarker(raw) {
   const level = parsed.level;
   if (level !== "warn" && level !== "mute")
     return null;
-  return { version: ACCOUNT_ENFORCEMENT_MARKER_VERSION, level };
+  const rawText = parsed.text;
+  const text = typeof rawText === "string" && rawText.trim() ? rawText.trim() : void 0;
+  return {
+    version: ACCOUNT_ENFORCEMENT_MARKER_VERSION,
+    level,
+    ...text ? { text } : {}
+  };
 }
-function buildAccountIssueReplyText() {
-  return "There is an issue with your account, please contact support@augmented.team.";
+var DEFAULT_ACCOUNT_ENFORCEMENT_COPY = {
+  warn: "Heads-up: there's an issue with your account that needs attention. Please contact support@augmented.team so I can keep helping you.",
+  mute: "There is an issue with your account, please contact support@augmented.team."
+};
+function buildAccountIssueReplyText(level, override) {
+  const trimmed = typeof override === "string" ? override.trim() : "";
+  return trimmed || DEFAULT_ACCOUNT_ENFORCEMENT_COPY[level];
 }
 
 // ../core/dist/kanban/state-machine.js
@@ -35954,6 +36004,32 @@ var FLAG_REGISTRY = [
     // Best-effort reach estimate only; not part of the schema fingerprint.
     since: "0.28.504"
   },
+  {
+    key: "utilization-occupancy-qualifier",
+    description: "Utilization busy-minutes gate (ENG-8465): shadow = report every measured bucket exactly as before while COUNTING how many a transcript qualifier would drop; enforce = drop measured buckets that have no qualifying assistant turn (>= 25 output tokens, non-synthetic) within \xB1120s. The qualifier is the merged @augmented/core primitive (extractQualifyingTurns / isBucketQualified); the host reads a bounded transcript tail incl. <sessionId>/subagents/ at drain time and FAILS OPEN (credits ungated) when a transcript cannot be read. Read host-side via hostFlagStore (getString) in the manager; consumer ships in this PR's agt-cli auto-publish bump. Both modes emit the OccupancyQualificationClassifications shadow metric (qualified positive-control + unqualified_dropped signal + unreadable), so per-agent impact is measured before the flip.",
+    flagType: "enum",
+    allowedValues: ["shadow", "enforce"],
+    // Declared safe value is `shadow`: it reproduces pre-flag billing exactly, so
+    // rollout changes no agent's minutes while the shadow metric accrues the
+    // enforce-flip evidence. `enforce` lowers a billing-adjacent number, so it is a
+    // deliberate, audited flip — never a flag-DB-read-error default.
+    defaultValue: "shadow",
+    // Operator per-host override (ADR-0022 highest precedence). No _ENABLED/_DISABLED/
+    // _MODE suffix, and read via hostFlagStore not a raw process.env gate, so not a
+    // new env gate under ENG-6252. Never pinned in sst.config.ts (ENG-8303).
+    envVar: "AGT_UTILIZATION_OCCUPANCY_QUALIFIER",
+    // enforce lowers a billing-adjacent number, so flipping/weakening it is guarded
+    // like the other enforcement-mode flags.
+    sensitive: true,
+    // Reach threshold (ENG-8465): the host reader (occupancyQualifierMode in
+    // manager-worker.ts) lands in this PR's agt-cli auto-publish patch bump, which
+    // is the first published version to contain it (through 0.28.528 does not). An
+    // UNSET `since` makes classifyHostReach report `honors` (full coverage), which
+    // would greenlight an `enforce` flip while older hosts silently stay `shadow`.
+    // Best-effort estimate (like docker-hygiene's), in the safe direction — a
+    // not-yet-published version reports 0% honor until hosts update. (CodeRabbit)
+    since: "0.28.529"
+  },
   {
     key: "composio-hitl-mode",
     description: "Composio managed-toolkits HITL gate (ENG-6027): off = kill switch, shadow = resolve + audit the tier decision but never block, enforce = block write_high_risk+ calls and route them to Human Approval (an Approve/Deny card). Since ENG-7828 enforce ALWAYS routes to a Human Approval card by default; set hitl-approval-routing=off to make enforce a hard block with no approval instead. Per-org rollout from the admin Feature Flags page; ENG-7672 migrated this off the fleet-wide COMPOSIO_HITL_MODE env var.",
@@ -36360,6 +36436,15 @@ var FLAG_REGISTRY = [
     // runbook gates on it. Leaving the placeholder in place is safe (nothing
     // flips); shipping a guessed number is not.
     since: "0.29.0"
+  },
+  {
+    key: "help-kb-auto-grant",
+    description: "Auto-grant the `augmented-help-kb` integration at ORG scope when an organization is provisioned (ENG-8542), so every agent in that org gets product-doc search without a per-agent operator action. One organization_integrations row reaches every agent in the org: POST /host/agent-integrations merges org -> team -> agent and buildMcpJson's predicate reads that merged set with no scope filter. ON: the two org-provisioning call sites write the row (status=active, created_by=the org owner). OFF (default): they write nothing - byte-for-byte today's behaviour. STAGED ROLLOUT IS THE POINT. ENG-8332 argues against widening distribution of the help KB until two things close, because distributing a corpus with wrong articles \"converts one agent's wrong answer into everyone's\": (1) a live 200 from GET /host/kb/search as the anon role has still never been observed - ENG-7260 was closed on remediation evidence, not on a live call, and the deploy seed log is SERVICE-ROLE evidence that says nothing about the anon grant; (2) the `site-structure` article is unverified against the current IA. Turning this on for ONE org and watching that org's help-kb connectivity-probe verdicts (ENG-8332 added a real mcp_stdio probe that calls search_knowledge_base) is the cheap positive control for (1) - an ENG-7260-class 500 then reports as `down` per agent instead of as silence. Widen only after it comes back healthy. REVOKING IS DELETING THE ROW, not flipping this off: the flag gates GRANTING, so an already-granted org keeps its row when the flag goes off. Evaluated API-side only, per org, inside grantHelpKbToOrg; no host-side envVar and deliberately no sst.config.ts entry (a literal default there would pin it - ENG-8303).",
+    flagType: "boolean",
+    // Declared safe value is `false` = grant nothing. A flag-store outage must
+    // never auto-attach an integration nobody asked for, and both ENG-8332
+    // prerequisites above are still open.
+    defaultValue: false
   }
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));
@@ -36412,7 +36497,7 @@ function accountEnforcementMarkerPath(codeName) {
   if (!codeName) return null;
   return join3(homedir3(), ".augmented", codeName, ACCOUNT_ENFORCEMENT_MARKER_FILENAME);
 }
-function readAccountEnforcementLevel(opts) {
+function readAccountEnforcementMarker(opts) {
   const path = opts.filePath ?? accountEnforcementMarkerPath(opts.codeName);
   if (!path) return null;
   let raw;
@@ -36421,7 +36506,14 @@ function readAccountEnforcementLevel(opts) {
   } catch {
     return null;
   }
-  return parseAccountEnforcementMarker(raw)?.level ?? null;
+  return parseAccountEnforcementMarker(raw);
+}
+function readAccountEnforcementLevel(opts) {
+  return readAccountEnforcementMarker(opts)?.level ?? null;
+}
+function resolveAccountIssueReplyText(level, opts) {
+  const marker = readAccountEnforcementMarker(opts);
+  return buildAccountIssueReplyText(level, marker?.level === level ? marker.text : void 0);
 }
 function shouldSendAccountWarn(opts) {
   if (readAccountEnforcementLevel({ codeName: opts.codeName, filePath: opts.filePath }) !== "warn") {
@@ -39677,7 +39769,7 @@ async function maybeSendTelegramAccountMuteNotice(args) {
       "sendMessage",
       {
         chat_id: args.chatId,
-        text: buildAccountIssueReplyText(),
+        text: resolveAccountIssueReplyText("mute", { codeName: AGENT_CODE_NAME }),
         ...args.messageThreadId != null ? { message_thread_id: args.messageThreadId } : {}
       },
       1e4
@@ -39714,7 +39806,7 @@ async function maybeSendTelegramAccountWarn(args) {
     return;
   }
   try {
-    const resp = await telegramApiCall("sendMessage", { chat_id: args.chatId, text: buildAccountIssueReplyText() }, 1e4);
+    const resp = await telegramApiCall("sendMessage", { chat_id: args.chatId, text: resolveAccountIssueReplyText("warn", { codeName: AGENT_CODE_NAME }) }, 1e4);
     if (!resp.ok) {
       TELEGRAM_ACCOUNT_WARN_NOTICE_CACHE.delete(key2);
       process.stderr.write(

package/dist/{persistent-session-KAHG73SM.js → persistent-session-T4IY7AJU.js}

@@ -37,7 +37,7 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-PR3QSOLI.js";
+} from "./chunk-Q4XGKOHZ.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -79,4 +79,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-KAHG73SM.js.map
+//# sourceMappingURL=persistent-session-T4IY7AJU.js.map