@integrity-labs/agt-cli 0.28.599 → 0.28.601

package/dist/{chunk-4E3L4U34.js → chunk-XTLKPF2A.js}

@@ -16,7 +16,7 @@ import {
   rotateDailySession,
   sessionFileExists,
   todayLocalIso
-} from "./chunk-6EBAJFLZ.js";
+} from "./chunk-V2WCVFDA.js";
 import {
   reapOrphanChannelMcps
 } from "./chunk-XWVM4KPK.js";
@@ -4349,4 +4349,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-4E3L4U34.js.map
+//# sourceMappingURL=chunk-XTLKPF2A.js.map

package/dist/{claude-pair-runtime-7CNOVI5H.js → claude-pair-runtime-I5EA2L7Z.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-5VAAQJQA.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-4E3TSALP.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-7CNOVI5H.js.map
+//# sourceMappingURL=claude-pair-runtime-I5EA2L7Z.js.map

package/dist/lib/manager-worker.js

@@ -53,7 +53,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-MQCSDRD3.js";
+} from "../chunk-IXRVFTBR.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -109,7 +109,7 @@ import {
   takeZombieDetection,
   toOpencodeModel,
   writeEgressAllowlist
-} from "../chunk-4E3L4U34.js";
+} from "../chunk-XTLKPF2A.js";
 import {
   ACCOUNT_ENFORCEMENT_MARKER_FILENAME,
   AnchorSessionClient,
@@ -186,7 +186,7 @@ import {
   subagentActivityAgeSeconds,
   sumTranscriptUsageInWindow,
   transcriptActivityAgeSeconds
-} from "../chunk-6EBAJFLZ.js";
+} from "../chunk-V2WCVFDA.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
@@ -11880,7 +11880,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.599" : "dev";
+var agtCliVersion = true ? "0.28.601" : "dev";
 function resolveBrewPath(execFileSync3) {
   try {
     const out = execFileSync3("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -13187,7 +13187,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-5VAAQJQA.js");
+      const { collectDiagnostics } = await import("../persistent-session-4E3TSALP.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor)
@@ -13295,7 +13295,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-5VAAQJQA.js");
+      const { collectDiagnostics } = await import("../persistent-session-4E3TSALP.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor) : void 0;
       let tailscaleHostname;
@@ -13418,7 +13418,7 @@ async function pollCycle() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-AZKD6KEV.js");
+      } = await import("../responsiveness-probe-QLHKSMVN.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -13509,7 +13509,7 @@ async function pollCycle() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-AZKD6KEV.js");
+        } = await import("../responsiveness-probe-QLHKSMVN.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-NDP36U7O.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -13665,7 +13665,7 @@ async function pollCycle() {
     }
     try {
       const { scrapeMcpFailedBannerCount } = await import("../pane-mcp-banner-scraper-JA437JIB.js");
-      const { probeSessionAuth } = await import("../session-auth-dead-5VN6KL6H.js");
+      const { probeSessionAuth } = await import("../session-auth-dead-UVNMIC5M.js");
       const observations = [];
       const pendingCacheCommits = [];
       const modelApiErrorReportingOn = hostFlagStore().getBoolean("model-api-error-reporting");
@@ -17093,7 +17093,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-5VAAQJQA.js");
+        const { collectDiagnostics } = await import("../persistent-session-4E3TSALP.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor)
@@ -17144,7 +17144,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-5VAAQJQA.js");
+      const { collectDiagnostics } = await import("../persistent-session-4E3TSALP.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor)
@@ -17740,7 +17740,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-7CNOVI5H.js");
+  } = await import("../claude-pair-runtime-I5EA2L7Z.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));

package/dist/mcp/direct-chat-channel.js

@@ -33772,6 +33772,65 @@ var INTEGRATION_REGISTRY = [
       }]
     }
   },
+  {
+    // Ninjafy Notes (ADR-0063, ENG-8842). Meeting capture on the user's own Mac,
+    // delivered to an agent as a tag-granted note the agent reads and summarises.
+    //
+    // No `installable` here, on purpose: ninjafy-notes is a Direct-HTTP SEED
+    // integration (integration-definitions.json), so the seed catalog already
+    // makes it picker-visible. This registry entry exists ONLY to carry the
+    // `premium` descriptor that `isPremiumDefinition` reads — which arms the
+    // per-org opt-in gate and the acknowledgement modal.
+    //
+    // PREMIUM BY ENTITLEMENT, WITH NO METER AND NO RATE CARD (ADR-0063 Decision
+    // 9). Every other premium in this registry is priced because it costs the
+    // platform something per call — a vendor bill, a model call, compute. Notes
+    // costs S3 bytes: speech-to-text runs on the user's Mac, the platform never
+    // summarises (Decision 3 gives that job to the agent, whose context is the
+    // entire value), and a 45-minute meeting is tens of KB of text. The revenue
+    // is the entitlement plus agent-hours — reading and summarising a note burns
+    // the agent's turn, which is already billed, so metering the note as well
+    // would charge for the same work twice through two mechanisms.
+    //
+    // What would change this: a per-note platform-side model call. The concrete
+    // trigger is an AGENTLESS integration destination — "send this meeting
+    // straight to Notion" has no agent to summarise it, so the platform must,
+    // and that call is a real marginal cost. Expect a rate card WITH that slice,
+    // scoped to that path, not applied to every note.
+    //
+    // ADR-0063 Decision 9 cites `agt-live` as the precedent for
+    // entitlement-without-a-rate-card. It is not one: agt-live has no entry in
+    // this registry at all, so `isPremiumDefinition('agt-live')` is false and it
+    // is free on this axis. Its premium tier is `plans.live_premium` via
+    // `getPlanForOrg` (ADR-0043) — a plan-tier entitlement enforced at the
+    // CloudFront edge, a different mechanism that shares a word. Notes is the
+    // first integration to need `pricing: 'included'`, which is why that value
+    // now exists.
+    id: "ninjafy-notes",
+    name: "Ninjafy Notes",
+    category: "workspace-productivity",
+    description: "Meeting notes captured on your Mac and sent to an agent. Ninjafy Notes records and transcribes a meeting on-device \u2014 the audio never leaves your machine \u2014 then hands the transcript to the agents you choose, which read it with your organization's context and write their own summary. Notes are private by default; sending one to an agent is the only thing that grants access.",
+    supported_auth_types: ["none"],
+    capabilities: [
+      {
+        id: "ninjafy-notes:read",
+        name: "Read Notes",
+        description: "List and read the meeting notes this agent has been sent (ninjafy_notes_list, ninjafy_notes_read).",
+        access: "read"
+      },
+      {
+        id: "ninjafy-notes:write-summary",
+        name: "Write Summaries",
+        description: "Write or revise this agent's own summary of a note it was sent (ninjafy_notes_write_summary).",
+        access: "write"
+      }
+    ],
+    beta: true,
+    premium: {
+      pricing: "included",
+      note: "Included in your plan. Transcription runs on your own Mac and no platform summariser runs, so there is nothing metered per note \u2014 the agent turn that reads it is billed as agent-hours like any other."
+    }
+  },
   {
     // Seed-catalog toolkit (composed by the ultimate-app-coder bundle). Registered
     // here only so the manager's ensureToolkitCli installs the binary via the
@@ -33964,7 +34023,7 @@ var ONBOARDING_REPLY_TIMEOUT_MS = 24 * 60 * 6e4;
 // ../core/dist/auth/oauth-principal.js
 var NOTES_WRITE_SCOPE = "notes:write";
 var USER_PRINCIPAL_SCOPE_LABELS = {
-  [NOTES_WRITE_SCOPE]: "Create meeting notes as you, and read the notes you own"
+  [NOTES_WRITE_SCOPE]: "Create meeting notes as you, read the notes you own, and see the names of your organizations and agents so you can choose where a note goes"
 };
 
 // ../core/dist/inbound-lanes/index.js
@@ -34789,6 +34848,20 @@ registerTriggerSource(videoRenderTriggerAdapter);
 
 // ../core/dist/feature-flags/registry.js
 var FLAG_REGISTRY = [
+  {
+    key: "at-rest-v2-writes",
+    description: "ADR-0061 A2\u2192arm cutover (ENG-8944, parent ENG-8764). Gates whether the at-rest writer (encryptSecret/encryptAtRest) emits the v2 AAD-bound envelope when a DecryptContext is supplied; OFF (default) = the legacy v1 envelope (pre-ADR-0061 behaviour). Resolved FLEET-WIDE and process-global via setV2WritesArmed at the API + webapp + cron bootstrap seams, so ONLY the stage value applies \u2014 per-org overrides do not (the crypto writer carries no request/org context). Ships dark. Flip on only once every reader parses v2 (fleet-wide since release A1) AND the re-seal engine can re-seal v2 blobs before any AUTH_ENCRYPTION_KEY rotation (slice 5b). Reversible without redeploy: clearing it returns the writer to v1 within the flag cache TTL; already-written v2 blobs stay readable.",
+    flagType: "boolean",
+    // Declared safe value is `false` = v1 writes, the pre-ADR-0061 behaviour. A
+    // flag-read error must never arm v2 on its own (fail-safe = keep writing v1).
+    defaultValue: false,
+    // Deliberately NOT public (a server/process gate, never read client-side) and
+    // NO envVar (the consumers — API + webapp + cron bootstraps — evaluate the
+    // flag directly; a bare AGT_*_ENABLED env gate would trip check-new-env-gates.sh).
+    // Sensitive: arming changes the durable at-rest ciphertext format fleet-wide, a
+    // deliberate staged security flip, so mutations require explicit confirmation.
+    sensitive: true
+  },
   {
     key: "opencode-host-wizard",
     description: "Show a framework selector (Claude Code | opencode) in the new-host wizard, plus the opencode auth mode (xAI/Grok, per-agent minted keys). Off = the wizard only creates Claude Code hosts (opencode host creation stays CLI/programmatic). Additive UI gate; ships dark. The backend mint + claude_auth_mode=xai are enabled separately.",

package/dist/mcp/origami.js

@@ -40110,6 +40110,65 @@ var INTEGRATION_REGISTRY = [
       }]
     }
   },
+  {
+    // Ninjafy Notes (ADR-0063, ENG-8842). Meeting capture on the user's own Mac,
+    // delivered to an agent as a tag-granted note the agent reads and summarises.
+    //
+    // No `installable` here, on purpose: ninjafy-notes is a Direct-HTTP SEED
+    // integration (integration-definitions.json), so the seed catalog already
+    // makes it picker-visible. This registry entry exists ONLY to carry the
+    // `premium` descriptor that `isPremiumDefinition` reads — which arms the
+    // per-org opt-in gate and the acknowledgement modal.
+    //
+    // PREMIUM BY ENTITLEMENT, WITH NO METER AND NO RATE CARD (ADR-0063 Decision
+    // 9). Every other premium in this registry is priced because it costs the
+    // platform something per call — a vendor bill, a model call, compute. Notes
+    // costs S3 bytes: speech-to-text runs on the user's Mac, the platform never
+    // summarises (Decision 3 gives that job to the agent, whose context is the
+    // entire value), and a 45-minute meeting is tens of KB of text. The revenue
+    // is the entitlement plus agent-hours — reading and summarising a note burns
+    // the agent's turn, which is already billed, so metering the note as well
+    // would charge for the same work twice through two mechanisms.
+    //
+    // What would change this: a per-note platform-side model call. The concrete
+    // trigger is an AGENTLESS integration destination — "send this meeting
+    // straight to Notion" has no agent to summarise it, so the platform must,
+    // and that call is a real marginal cost. Expect a rate card WITH that slice,
+    // scoped to that path, not applied to every note.
+    //
+    // ADR-0063 Decision 9 cites `agt-live` as the precedent for
+    // entitlement-without-a-rate-card. It is not one: agt-live has no entry in
+    // this registry at all, so `isPremiumDefinition('agt-live')` is false and it
+    // is free on this axis. Its premium tier is `plans.live_premium` via
+    // `getPlanForOrg` (ADR-0043) — a plan-tier entitlement enforced at the
+    // CloudFront edge, a different mechanism that shares a word. Notes is the
+    // first integration to need `pricing: 'included'`, which is why that value
+    // now exists.
+    id: "ninjafy-notes",
+    name: "Ninjafy Notes",
+    category: "workspace-productivity",
+    description: "Meeting notes captured on your Mac and sent to an agent. Ninjafy Notes records and transcribes a meeting on-device \u2014 the audio never leaves your machine \u2014 then hands the transcript to the agents you choose, which read it with your organization's context and write their own summary. Notes are private by default; sending one to an agent is the only thing that grants access.",
+    supported_auth_types: ["none"],
+    capabilities: [
+      {
+        id: "ninjafy-notes:read",
+        name: "Read Notes",
+        description: "List and read the meeting notes this agent has been sent (ninjafy_notes_list, ninjafy_notes_read).",
+        access: "read"
+      },
+      {
+        id: "ninjafy-notes:write-summary",
+        name: "Write Summaries",
+        description: "Write or revise this agent's own summary of a note it was sent (ninjafy_notes_write_summary).",
+        access: "write"
+      }
+    ],
+    beta: true,
+    premium: {
+      pricing: "included",
+      note: "Included in your plan. Transcription runs on your own Mac and no platform summariser runs, so there is nothing metered per note \u2014 the agent turn that reads it is billed as agent-hours like any other."
+    }
+  },
   {
     // Seed-catalog toolkit (composed by the ultimate-app-coder bundle). Registered
     // here only so the manager's ensureToolkitCli installs the binary via the
@@ -40246,7 +40305,7 @@ var ONBOARDING_REPLY_TIMEOUT_MS = 24 * 60 * 6e4;
 // ../core/dist/auth/oauth-principal.js
 var NOTES_WRITE_SCOPE = "notes:write";
 var USER_PRINCIPAL_SCOPE_LABELS = {
-  [NOTES_WRITE_SCOPE]: "Create meeting notes as you, and read the notes you own"
+  [NOTES_WRITE_SCOPE]: "Create meeting notes as you, read the notes you own, and see the names of your organizations and agents so you can choose where a note goes"
 };
 
 // ../core/dist/inbound-lanes/index.js
@@ -40680,6 +40739,20 @@ registerTriggerSource(videoRenderTriggerAdapter);
 
 // ../core/dist/feature-flags/registry.js
 var FLAG_REGISTRY = [
+  {
+    key: "at-rest-v2-writes",
+    description: "ADR-0061 A2\u2192arm cutover (ENG-8944, parent ENG-8764). Gates whether the at-rest writer (encryptSecret/encryptAtRest) emits the v2 AAD-bound envelope when a DecryptContext is supplied; OFF (default) = the legacy v1 envelope (pre-ADR-0061 behaviour). Resolved FLEET-WIDE and process-global via setV2WritesArmed at the API + webapp + cron bootstrap seams, so ONLY the stage value applies \u2014 per-org overrides do not (the crypto writer carries no request/org context). Ships dark. Flip on only once every reader parses v2 (fleet-wide since release A1) AND the re-seal engine can re-seal v2 blobs before any AUTH_ENCRYPTION_KEY rotation (slice 5b). Reversible without redeploy: clearing it returns the writer to v1 within the flag cache TTL; already-written v2 blobs stay readable.",
+    flagType: "boolean",
+    // Declared safe value is `false` = v1 writes, the pre-ADR-0061 behaviour. A
+    // flag-read error must never arm v2 on its own (fail-safe = keep writing v1).
+    defaultValue: false,
+    // Deliberately NOT public (a server/process gate, never read client-side) and
+    // NO envVar (the consumers — API + webapp + cron bootstraps — evaluate the
+    // flag directly; a bare AGT_*_ENABLED env gate would trip check-new-env-gates.sh).
+    // Sensitive: arming changes the durable at-rest ciphertext format fleet-wide, a
+    // deliberate staged security flip, so mutations require explicit confirmation.
+    sensitive: true
+  },
   {
     key: "opencode-host-wizard",
     description: "Show a framework selector (Claude Code | opencode) in the new-host wizard, plus the opencode auth mode (xAI/Grok, per-agent minted keys). Off = the wizard only creates Claude Code hosts (opencode host creation stays CLI/programmatic). Additive UI gate; ships dark. The backend mint + claude_auth_mode=xai are enabled separately.",

package/dist/mcp/slack-channel.js

@@ -34161,6 +34161,65 @@ var INTEGRATION_REGISTRY = [
       }]
     }
   },
+  {
+    // Ninjafy Notes (ADR-0063, ENG-8842). Meeting capture on the user's own Mac,
+    // delivered to an agent as a tag-granted note the agent reads and summarises.
+    //
+    // No `installable` here, on purpose: ninjafy-notes is a Direct-HTTP SEED
+    // integration (integration-definitions.json), so the seed catalog already
+    // makes it picker-visible. This registry entry exists ONLY to carry the
+    // `premium` descriptor that `isPremiumDefinition` reads — which arms the
+    // per-org opt-in gate and the acknowledgement modal.
+    //
+    // PREMIUM BY ENTITLEMENT, WITH NO METER AND NO RATE CARD (ADR-0063 Decision
+    // 9). Every other premium in this registry is priced because it costs the
+    // platform something per call — a vendor bill, a model call, compute. Notes
+    // costs S3 bytes: speech-to-text runs on the user's Mac, the platform never
+    // summarises (Decision 3 gives that job to the agent, whose context is the
+    // entire value), and a 45-minute meeting is tens of KB of text. The revenue
+    // is the entitlement plus agent-hours — reading and summarising a note burns
+    // the agent's turn, which is already billed, so metering the note as well
+    // would charge for the same work twice through two mechanisms.
+    //
+    // What would change this: a per-note platform-side model call. The concrete
+    // trigger is an AGENTLESS integration destination — "send this meeting
+    // straight to Notion" has no agent to summarise it, so the platform must,
+    // and that call is a real marginal cost. Expect a rate card WITH that slice,
+    // scoped to that path, not applied to every note.
+    //
+    // ADR-0063 Decision 9 cites `agt-live` as the precedent for
+    // entitlement-without-a-rate-card. It is not one: agt-live has no entry in
+    // this registry at all, so `isPremiumDefinition('agt-live')` is false and it
+    // is free on this axis. Its premium tier is `plans.live_premium` via
+    // `getPlanForOrg` (ADR-0043) — a plan-tier entitlement enforced at the
+    // CloudFront edge, a different mechanism that shares a word. Notes is the
+    // first integration to need `pricing: 'included'`, which is why that value
+    // now exists.
+    id: "ninjafy-notes",
+    name: "Ninjafy Notes",
+    category: "workspace-productivity",
+    description: "Meeting notes captured on your Mac and sent to an agent. Ninjafy Notes records and transcribes a meeting on-device \u2014 the audio never leaves your machine \u2014 then hands the transcript to the agents you choose, which read it with your organization's context and write their own summary. Notes are private by default; sending one to an agent is the only thing that grants access.",
+    supported_auth_types: ["none"],
+    capabilities: [
+      {
+        id: "ninjafy-notes:read",
+        name: "Read Notes",
+        description: "List and read the meeting notes this agent has been sent (ninjafy_notes_list, ninjafy_notes_read).",
+        access: "read"
+      },
+      {
+        id: "ninjafy-notes:write-summary",
+        name: "Write Summaries",
+        description: "Write or revise this agent's own summary of a note it was sent (ninjafy_notes_write_summary).",
+        access: "write"
+      }
+    ],
+    beta: true,
+    premium: {
+      pricing: "included",
+      note: "Included in your plan. Transcription runs on your own Mac and no platform summariser runs, so there is nothing metered per note \u2014 the agent turn that reads it is billed as agent-hours like any other."
+    }
+  },
   {
     // Seed-catalog toolkit (composed by the ultimate-app-coder bundle). Registered
     // here only so the manager's ensureToolkitCli installs the binary via the
@@ -34297,7 +34356,7 @@ var ONBOARDING_REPLY_TIMEOUT_MS = 24 * 60 * 6e4;
 // ../core/dist/auth/oauth-principal.js
 var NOTES_WRITE_SCOPE = "notes:write";
 var USER_PRINCIPAL_SCOPE_LABELS = {
-  [NOTES_WRITE_SCOPE]: "Create meeting notes as you, and read the notes you own"
+  [NOTES_WRITE_SCOPE]: "Create meeting notes as you, read the notes you own, and see the names of your organizations and agents so you can choose where a note goes"
 };
 
 // ../core/dist/inbound-lanes/index.js
@@ -35125,6 +35184,20 @@ registerTriggerSource(videoRenderTriggerAdapter);
 
 // ../core/dist/feature-flags/registry.js
 var FLAG_REGISTRY = [
+  {
+    key: "at-rest-v2-writes",
+    description: "ADR-0061 A2\u2192arm cutover (ENG-8944, parent ENG-8764). Gates whether the at-rest writer (encryptSecret/encryptAtRest) emits the v2 AAD-bound envelope when a DecryptContext is supplied; OFF (default) = the legacy v1 envelope (pre-ADR-0061 behaviour). Resolved FLEET-WIDE and process-global via setV2WritesArmed at the API + webapp + cron bootstrap seams, so ONLY the stage value applies \u2014 per-org overrides do not (the crypto writer carries no request/org context). Ships dark. Flip on only once every reader parses v2 (fleet-wide since release A1) AND the re-seal engine can re-seal v2 blobs before any AUTH_ENCRYPTION_KEY rotation (slice 5b). Reversible without redeploy: clearing it returns the writer to v1 within the flag cache TTL; already-written v2 blobs stay readable.",
+    flagType: "boolean",
+    // Declared safe value is `false` = v1 writes, the pre-ADR-0061 behaviour. A
+    // flag-read error must never arm v2 on its own (fail-safe = keep writing v1).
+    defaultValue: false,
+    // Deliberately NOT public (a server/process gate, never read client-side) and
+    // NO envVar (the consumers — API + webapp + cron bootstraps — evaluate the
+    // flag directly; a bare AGT_*_ENABLED env gate would trip check-new-env-gates.sh).
+    // Sensitive: arming changes the durable at-rest ciphertext format fleet-wide, a
+    // deliberate staged security flip, so mutations require explicit confirmation.
+    sensitive: true
+  },
   {
     key: "opencode-host-wizard",
     description: "Show a framework selector (Claude Code | opencode) in the new-host wizard, plus the opencode auth mode (xAI/Grok, per-agent minted keys). Off = the wizard only creates Claude Code hosts (opencode host creation stays CLI/programmatic). Additive UI gate; ships dark. The backend mint + claude_auth_mode=xai are enabled separately.",

package/dist/mcp/telegram-channel.js

@@ -34320,6 +34320,65 @@ var INTEGRATION_REGISTRY = [
       }]
     }
   },
+  {
+    // Ninjafy Notes (ADR-0063, ENG-8842). Meeting capture on the user's own Mac,
+    // delivered to an agent as a tag-granted note the agent reads and summarises.
+    //
+    // No `installable` here, on purpose: ninjafy-notes is a Direct-HTTP SEED
+    // integration (integration-definitions.json), so the seed catalog already
+    // makes it picker-visible. This registry entry exists ONLY to carry the
+    // `premium` descriptor that `isPremiumDefinition` reads — which arms the
+    // per-org opt-in gate and the acknowledgement modal.
+    //
+    // PREMIUM BY ENTITLEMENT, WITH NO METER AND NO RATE CARD (ADR-0063 Decision
+    // 9). Every other premium in this registry is priced because it costs the
+    // platform something per call — a vendor bill, a model call, compute. Notes
+    // costs S3 bytes: speech-to-text runs on the user's Mac, the platform never
+    // summarises (Decision 3 gives that job to the agent, whose context is the
+    // entire value), and a 45-minute meeting is tens of KB of text. The revenue
+    // is the entitlement plus agent-hours — reading and summarising a note burns
+    // the agent's turn, which is already billed, so metering the note as well
+    // would charge for the same work twice through two mechanisms.
+    //
+    // What would change this: a per-note platform-side model call. The concrete
+    // trigger is an AGENTLESS integration destination — "send this meeting
+    // straight to Notion" has no agent to summarise it, so the platform must,
+    // and that call is a real marginal cost. Expect a rate card WITH that slice,
+    // scoped to that path, not applied to every note.
+    //
+    // ADR-0063 Decision 9 cites `agt-live` as the precedent for
+    // entitlement-without-a-rate-card. It is not one: agt-live has no entry in
+    // this registry at all, so `isPremiumDefinition('agt-live')` is false and it
+    // is free on this axis. Its premium tier is `plans.live_premium` via
+    // `getPlanForOrg` (ADR-0043) — a plan-tier entitlement enforced at the
+    // CloudFront edge, a different mechanism that shares a word. Notes is the
+    // first integration to need `pricing: 'included'`, which is why that value
+    // now exists.
+    id: "ninjafy-notes",
+    name: "Ninjafy Notes",
+    category: "workspace-productivity",
+    description: "Meeting notes captured on your Mac and sent to an agent. Ninjafy Notes records and transcribes a meeting on-device \u2014 the audio never leaves your machine \u2014 then hands the transcript to the agents you choose, which read it with your organization's context and write their own summary. Notes are private by default; sending one to an agent is the only thing that grants access.",
+    supported_auth_types: ["none"],
+    capabilities: [
+      {
+        id: "ninjafy-notes:read",
+        name: "Read Notes",
+        description: "List and read the meeting notes this agent has been sent (ninjafy_notes_list, ninjafy_notes_read).",
+        access: "read"
+      },
+      {
+        id: "ninjafy-notes:write-summary",
+        name: "Write Summaries",
+        description: "Write or revise this agent's own summary of a note it was sent (ninjafy_notes_write_summary).",
+        access: "write"
+      }
+    ],
+    beta: true,
+    premium: {
+      pricing: "included",
+      note: "Included in your plan. Transcription runs on your own Mac and no platform summariser runs, so there is nothing metered per note \u2014 the agent turn that reads it is billed as agent-hours like any other."
+    }
+  },
   {
     // Seed-catalog toolkit (composed by the ultimate-app-coder bundle). Registered
     // here only so the manager's ensureToolkitCli installs the binary via the
@@ -34456,7 +34515,7 @@ var ONBOARDING_REPLY_TIMEOUT_MS = 24 * 60 * 6e4;
 // ../core/dist/auth/oauth-principal.js
 var NOTES_WRITE_SCOPE = "notes:write";
 var USER_PRINCIPAL_SCOPE_LABELS = {
-  [NOTES_WRITE_SCOPE]: "Create meeting notes as you, and read the notes you own"
+  [NOTES_WRITE_SCOPE]: "Create meeting notes as you, read the notes you own, and see the names of your organizations and agents so you can choose where a note goes"
 };
 
 // ../core/dist/inbound-lanes/index.js
@@ -35284,6 +35343,20 @@ registerTriggerSource(videoRenderTriggerAdapter);
 
 // ../core/dist/feature-flags/registry.js
 var FLAG_REGISTRY = [
+  {
+    key: "at-rest-v2-writes",
+    description: "ADR-0061 A2\u2192arm cutover (ENG-8944, parent ENG-8764). Gates whether the at-rest writer (encryptSecret/encryptAtRest) emits the v2 AAD-bound envelope when a DecryptContext is supplied; OFF (default) = the legacy v1 envelope (pre-ADR-0061 behaviour). Resolved FLEET-WIDE and process-global via setV2WritesArmed at the API + webapp + cron bootstrap seams, so ONLY the stage value applies \u2014 per-org overrides do not (the crypto writer carries no request/org context). Ships dark. Flip on only once every reader parses v2 (fleet-wide since release A1) AND the re-seal engine can re-seal v2 blobs before any AUTH_ENCRYPTION_KEY rotation (slice 5b). Reversible without redeploy: clearing it returns the writer to v1 within the flag cache TTL; already-written v2 blobs stay readable.",
+    flagType: "boolean",
+    // Declared safe value is `false` = v1 writes, the pre-ADR-0061 behaviour. A
+    // flag-read error must never arm v2 on its own (fail-safe = keep writing v1).
+    defaultValue: false,
+    // Deliberately NOT public (a server/process gate, never read client-side) and
+    // NO envVar (the consumers — API + webapp + cron bootstraps — evaluate the
+    // flag directly; a bare AGT_*_ENABLED env gate would trip check-new-env-gates.sh).
+    // Sensitive: arming changes the durable at-rest ciphertext format fleet-wide, a
+    // deliberate staged security flip, so mutations require explicit confirmation.
+    sensitive: true
+  },
   {
     key: "opencode-host-wizard",
     description: "Show a framework selector (Claude Code | opencode) in the new-host wizard, plus the opencode auth mode (xAI/Grok, per-agent minted keys). Off = the wizard only creates Claude Code hosts (opencode host creation stays CLI/programmatic). Additive UI gate; ships dark. The backend mint + claude_auth_mode=xai are enabled separately.",

package/dist/{persistent-session-5VAAQJQA.js → persistent-session-4E3TSALP.js}

@@ -43,8 +43,8 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-4E3L4U34.js";
-import "./chunk-6EBAJFLZ.js";
+} from "./chunk-XTLKPF2A.js";
+import "./chunk-V2WCVFDA.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -92,4 +92,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-5VAAQJQA.js.map
+//# sourceMappingURL=persistent-session-4E3TSALP.js.map

package/dist/{responsiveness-probe-AZKD6KEV.js → responsiveness-probe-QLHKSMVN.js}

@@ -1,7 +1,7 @@
 import {
   paneLogPath
-} from "./chunk-4E3L4U34.js";
-import "./chunk-6EBAJFLZ.js";
+} from "./chunk-XTLKPF2A.js";
+import "./chunk-V2WCVFDA.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -690,4 +690,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-AZKD6KEV.js.map
+//# sourceMappingURL=responsiveness-probe-QLHKSMVN.js.map

package/dist/{session-auth-dead-5VN6KL6H.js → session-auth-dead-UVNMIC5M.js}

@@ -1,6 +1,6 @@
 import {
   sessionTranscriptDir
-} from "./chunk-6EBAJFLZ.js";
+} from "./chunk-V2WCVFDA.js";
 
 // src/lib/session-auth-dead.ts
 import { closeSync, openSync, readSync, readdirSync, statSync } from "fs";
@@ -203,4 +203,4 @@ export {
   decideSessionAuthState,
   probeSessionAuth
 };
-//# sourceMappingURL=session-auth-dead-5VN6KL6H.js.map
+//# sourceMappingURL=session-auth-dead-UVNMIC5M.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.599",
+  "version": "0.28.601",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {