@integrity-labs/agt-cli 0.28.808 → 0.28.809

package/dist/{claude-pair-runtime-FUT7SLRJ.js → claude-pair-runtime-P4R5WMUQ.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-Q23JIYBR.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-QYP6FYFI.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-FUT7SLRJ.js.map
+//# sourceMappingURL=claude-pair-runtime-P4R5WMUQ.js.map

package/dist/lib/manager-worker.js

@@ -58,7 +58,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-LLR42RME.js";
+} from "../chunk-2Z5SJMME.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -123,7 +123,7 @@ import {
   takeZombieDetection,
   toOpencodeModel,
   writeEgressAllowlist
-} from "../chunk-TLPQULYH.js";
+} from "../chunk-5TXNXEOF.js";
 import {
   ACCOUNT_ENFORCEMENT_MARKER_FILENAME,
   AnchorSessionClient,
@@ -215,7 +215,7 @@ import {
   subagentActivityAgeSeconds,
   sumTranscriptUsageInWindow,
   transcriptActivityAgeSeconds
-} from "../chunk-SWUBTUYM.js";
+} from "../chunk-JNHL4KS4.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
@@ -12918,7 +12918,7 @@ var pendingDayRolloverReset = /* @__PURE__ */ new Set();
 var dayRolloverInboundHold = /* @__PURE__ */ new Map();
 var INBOUND_HOLD_EPISODE_GAP_MS = 12e4;
 async function channelInboundActivityAgeSecondsFor(codeName) {
-  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-T2I27SCG.js");
+  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-SL2MZ3WT.js");
   const newest = newestPendingInboundActivityMtimeMs(dirname10(paneLogPath(codeName)));
   if (newest === null) return null;
   return Math.max(0, Math.floor((Date.now() - newest) / 1e3));
@@ -13578,7 +13578,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.808" : "dev";
+var agtCliVersion = true ? "0.28.809" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -15125,7 +15125,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-Q23JIYBR.js");
+      const { collectDiagnostics } = await import("../persistent-session-QYP6FYFI.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
@@ -15266,7 +15266,7 @@ async function pollCycleInner() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-Q23JIYBR.js");
+      const { collectDiagnostics } = await import("../persistent-session-QYP6FYFI.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor) : void 0;
       let tailscaleHostname;
@@ -15435,7 +15435,7 @@ async function pollCycleInner() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-T2I27SCG.js");
+      } = await import("../responsiveness-probe-SL2MZ3WT.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -15552,7 +15552,7 @@ async function pollCycleInner() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-T2I27SCG.js");
+        } = await import("../responsiveness-probe-SL2MZ3WT.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-NDP36U7O.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -15708,7 +15708,7 @@ async function pollCycleInner() {
     }
     try {
       const { scrapeMcpFailedBannerCount } = await import("../pane-mcp-banner-scraper-JA437JIB.js");
-      const { probeSessionAuth } = await import("../session-auth-dead-O7DBSJ3W.js");
+      const { probeSessionAuth } = await import("../session-auth-dead-VZWGAV5K.js");
       const observations = [];
       const pendingCacheCommits = [];
       const modelApiErrorReportingOn = hostFlagStore().getBoolean("model-api-error-reporting");
@@ -19868,7 +19868,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-Q23JIYBR.js");
+        const { collectDiagnostics } = await import("../persistent-session-QYP6FYFI.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
@@ -19914,7 +19914,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-Q23JIYBR.js");
+      const { collectDiagnostics } = await import("../persistent-session-QYP6FYFI.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
@@ -20550,7 +20550,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-FUT7SLRJ.js");
+  } = await import("../claude-pair-runtime-P4R5WMUQ.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));

package/dist/mcp/direct-chat-channel.js

@@ -33806,7 +33806,15 @@ var INTEGRATION_REGISTRY = [
     // integration_rate_cards; this only declares the model + meter.
     premium: {
       pricing: "usage",
-      note: "Billed per minute of real-time voice conversation.",
+      // THE OPT-IN AUTHORISES BOTH METERS, SO THE NOTE NAMES BOTH (ENG-9913).
+      // This string is the point of sale — it renders in the add-integration
+      // dialog an org admin reads before opting in — and it described only
+      // `voice_session` while the same opt-in, and the same $50 pool, had also
+      // covered Ninja Notes cloud transcription since ENG-9870. "Of audio"
+      // rather than "of meeting" is load-bearing: the two capture sources post
+      // independently, so an hour-long meeting on default settings spends two
+      // audio-hours (ADR-0063 §2a).
+      note: "Billed per minute of real-time voice conversation, and per hour of audio for Ninja Notes cloud transcription \u2014 both against the same monthly budget.",
       meters: [
         { event_type: "voice_session", unit: "minute" },
         // ENG-9870. Ninja Notes cloud transcription, on the SAME definition id
@@ -33818,16 +33826,24 @@ var INTEGRATION_REGISTRY = [
         // `audio_hour`, not `minute`. The vendor prices per hour and the sell
         // price is per hour, so hours store exactly (50 minor) where minutes
         // would be 0.8333 repeating; `integration_usage_events.units` is
-        // `numeric`, so a 30-minute meeting records 0.5 units precisely. This
+        // `numeric`, so 30 minutes of audio records 0.5 units precisely. This
         // is the answer to ENG-9773 §10.1's open question about whether hours
         // convert to minutes or the vocabulary gains hours.
         //
-        // NOTHING RECORDS THIS EVENT YET. Metering belongs at the chokepoint
-        // where audio is actually sent, and ENG-9868 left the transport
-        // injected with no implementation. The rate card exists first
-        // deliberately: a billable event with no USD rate makes
-        // `evaluateUsageBudget` throw, and on a SHARED pool that would break
-        // Voice Chat's budget check, not just this one.
+        // AN AUDIO-HOUR IS NOT A MEETING-HOUR (ENG-9913, Brad, 2026-09-03). The
+        // Mac captures system audio and the microphone as two independent
+        // pipelines that post separately, and both default on, so the ordinary
+        // meeting records two units per wall-clock hour. That is deliberate: the
+        // audio-hour is what we buy, since xAI bills on the duration uploaded.
+        // Pricing per meeting-hour would have varied the markup with a capture
+        // toggle and could only have been built on a client's assertion about
+        // how many pipelines were live. See ADR-0063 §2a.
+        //
+        // THE CHOKEPOINT EXISTS NOW — `POST /notes/transcribe` (ENG-9913)
+        // reserves against this meter before the vendor call, from the bytes it
+        // received. The rate card still had to land first, in ENG-9870: a
+        // billable event with no USD rate makes `evaluateUsageBudget` throw, and
+        // on a SHARED pool that would break Voice Chat's budget check too.
         { event_type: "transcription", unit: "audio_hour" }
       ]
     }
@@ -34724,7 +34740,18 @@ var INTEGRATION_REGISTRY = [
     // premium surface — is the structurally right answer and the follow-up.
     premium: {
       pricing: "included",
-      note: "Notes are included in your plan. Transcription runs on your own Mac and no platform summariser runs, so nothing is metered per note \u2014 the agent turn that reads it is billed as agent-hours like any other. Live meeting advising is the one exception: it is turned on separately, and billed per minute the advisor is armed."
+      // "THE ONE EXCEPTION" BECAME TWO (ENG-9913). Cloud transcription is the
+      // second metered capability under this integration, and this sentence was
+      // true only for as long as its flag stayed off — it would have become
+      // false on arming, silently, in a consent dialog. Both exceptions are
+      // written the same way, and both are still off until someone turns them
+      // on, so the sentence is accurate before and after the rollout.
+      //
+      // "Per hour of AUDIO" is deliberate here too: the two capture sources post
+      // independently, so an hour-long meeting on default settings spends two
+      // audio-hours (ADR-0063 §2a). The Mac's own caption carries the fuller
+      // explanation, at the point where the person choosing it can read it.
+      note: "Notes are included in your plan. Transcription runs on your own Mac by default and no platform summariser runs, so nothing is metered per note \u2014 the agent turn that reads it is billed as agent-hours like any other. Two capabilities are turned on separately and billed when they are: live meeting advising, per minute the advisor is armed; and cloud transcription, per hour of audio."
     }
   },
   {
@@ -37671,6 +37698,18 @@ var FLAG_REGISTRY = [
     // agent-hours-billing-enabled.
     sensitive: true
   },
+  {
+    key: "cloud-speech-to-text",
+    description: 'Cloud transcription in Ninja Notes (ENG-9913). When ON for an org, a person recording a meeting on the Mac may choose to have each capture window transcribed by xAI instead of on-device: the window is POSTed to /notes/transcribe, proxied to xAI with the platform key, metered as grok-voice/transcription per audio_hour, and the text comes back with no speaker labels. THIS IS OUR ROLLOUT GATE AND IT IS THE THIRD KEY, NOT THE FIRST. Three things must all be true before a window leaves the Mac: the org holds the grok-voice premium opt-in (authorisation, resolveCloudSttEntitlement), the user has elected it per-install (consent, CaptureSettings.cloudTranscriptionEnabled), and this flag is on (our own readiness). Without this flag the first two alone were sufficient, which is why it exists: resolveCloudSttEntitlement reports enabled for every org that ever bought Voice Chat, so the route would go live for all of them the moment it deployed. It is what finally lets the server emit `not_available` \u2014 CloudTranscriptionRefusal.notRolledOut has shipped since ENG-9869 carrying the sentence "Cloud transcription is not available for your organisation yet" with nothing able to produce it. Boolean gate; ships dark. OFF NEVER COSTS THE RECORDING. An org without the flag \u2014 or a flag read that fails \u2014 transcribes on-device exactly as before; the microphone still starts and the note is still transcribed and delivered. Same direction as live-meeting-advisor and for the same reason: the user pressed Record and a recording is what they are owed. It is also what makes rollback cheap, because flipping this off mid-flight degrades in-progress meetings to on-device rather than breaking them. Deliberately NO envVar. This is an org-scoped gate, and an envVar is highest-precedence per ADR-0022 \u2014 a literal in sst.config.ts would pin every stage and make the admin control do nothing, the ENG-8303 class exactly. No `since`: the reader is the API route, not a host-side agt-cli consumer, so this does not depend on fleet convergence. The Mac client is a separate fleet that reports no version at all, which is precisely why the gate has to live server-side.',
+    flagType: "boolean",
+    defaultValue: false,
+    // Turning it ON starts sending meeting audio — INCLUDING the other side of
+    // the call, whose participants have not been asked — to a third-party
+    // vendor, and arms a per-audio-hour meter against the org's shared
+    // grok-voice budget. Either half alone would warrant the confirm ADR-0022
+    // §4 reserves for deliberate, audited flips.
+    sensitive: true
+  },
   {
     key: "first-party-token-refusal",
     description: "ENG-8972 AC4 / ADR-0076 decision 2 \u2014 whether `resolveUserId` (packages/api/src/middleware/auth.ts) REFUSES a bearer token carrying a first-party marker that is foreign to the host-exchange lane. SUPABASE_JWT_SECRET is symmetric and signs twelve distinct token families; the generic Bearer door has always admitted any of them that mints a uuid-shaped `sub`, so a token minted for one purpose authenticates as a user for every purpose. off = the capture never runs (no log, no refusal). shadow = record the population an enforcement flip would change, on BOTH admitting lanes (lane=gotrue, lane=sub-claim), and refuse nothing \u2014 this is exactly the behaviour compiled into prod today. enforce = return null with reason=foreign-first-party-marker, above the strategy split, so the token reaches neither GoTrue nor the sub-claim lane. DEFAULT IS `shadow`, NOT `off`, and the divergence is deliberate \u2014 the shadow lines have been live in prod since 68863974b, and they are the soak instrument. Defaulting to `off` would silently switch off the measurement this flag exists to act on: the channel-quarantine-mode landmine (ENG-6252) in its exact shape. A flag-read failure degrades to `shadow` for the same reason it fails open elsewhere on this path: this is the platform front door, and a `feature_flags` blip must not start refusing the fleet. Deliberately NO envVar. The consumer is the API Lambda, whose environment block is at the AWS 4KB cap (ENG-7972), and an envVar is highest-precedence per ADR-0022 \u2014 a literal in sst.config.ts would pin every stage and make the admin control do nothing (ENG-8303). The flag value IS the kill switch: a flip back to shadow takes effect within the ~60s evaluation cache, with no deploy.",

package/dist/mcp/index.js

@@ -41350,7 +41350,15 @@ var INTEGRATION_REGISTRY = [
     // integration_rate_cards; this only declares the model + meter.
     premium: {
       pricing: "usage",
-      note: "Billed per minute of real-time voice conversation.",
+      // THE OPT-IN AUTHORISES BOTH METERS, SO THE NOTE NAMES BOTH (ENG-9913).
+      // This string is the point of sale — it renders in the add-integration
+      // dialog an org admin reads before opting in — and it described only
+      // `voice_session` while the same opt-in, and the same $50 pool, had also
+      // covered Ninja Notes cloud transcription since ENG-9870. "Of audio"
+      // rather than "of meeting" is load-bearing: the two capture sources post
+      // independently, so an hour-long meeting on default settings spends two
+      // audio-hours (ADR-0063 §2a).
+      note: "Billed per minute of real-time voice conversation, and per hour of audio for Ninja Notes cloud transcription \u2014 both against the same monthly budget.",
       meters: [
         { event_type: "voice_session", unit: "minute" },
         // ENG-9870. Ninja Notes cloud transcription, on the SAME definition id
@@ -41362,16 +41370,24 @@ var INTEGRATION_REGISTRY = [
         // `audio_hour`, not `minute`. The vendor prices per hour and the sell
         // price is per hour, so hours store exactly (50 minor) where minutes
         // would be 0.8333 repeating; `integration_usage_events.units` is
-        // `numeric`, so a 30-minute meeting records 0.5 units precisely. This
+        // `numeric`, so 30 minutes of audio records 0.5 units precisely. This
         // is the answer to ENG-9773 §10.1's open question about whether hours
         // convert to minutes or the vocabulary gains hours.
         //
-        // NOTHING RECORDS THIS EVENT YET. Metering belongs at the chokepoint
-        // where audio is actually sent, and ENG-9868 left the transport
-        // injected with no implementation. The rate card exists first
-        // deliberately: a billable event with no USD rate makes
-        // `evaluateUsageBudget` throw, and on a SHARED pool that would break
-        // Voice Chat's budget check, not just this one.
+        // AN AUDIO-HOUR IS NOT A MEETING-HOUR (ENG-9913, Brad, 2026-09-03). The
+        // Mac captures system audio and the microphone as two independent
+        // pipelines that post separately, and both default on, so the ordinary
+        // meeting records two units per wall-clock hour. That is deliberate: the
+        // audio-hour is what we buy, since xAI bills on the duration uploaded.
+        // Pricing per meeting-hour would have varied the markup with a capture
+        // toggle and could only have been built on a client's assertion about
+        // how many pipelines were live. See ADR-0063 §2a.
+        //
+        // THE CHOKEPOINT EXISTS NOW — `POST /notes/transcribe` (ENG-9913)
+        // reserves against this meter before the vendor call, from the bytes it
+        // received. The rate card still had to land first, in ENG-9870: a
+        // billable event with no USD rate makes `evaluateUsageBudget` throw, and
+        // on a SHARED pool that would break Voice Chat's budget check too.
         { event_type: "transcription", unit: "audio_hour" }
       ]
     }
@@ -42268,7 +42284,18 @@ var INTEGRATION_REGISTRY = [
     // premium surface — is the structurally right answer and the follow-up.
     premium: {
       pricing: "included",
-      note: "Notes are included in your plan. Transcription runs on your own Mac and no platform summariser runs, so nothing is metered per note \u2014 the agent turn that reads it is billed as agent-hours like any other. Live meeting advising is the one exception: it is turned on separately, and billed per minute the advisor is armed."
+      // "THE ONE EXCEPTION" BECAME TWO (ENG-9913). Cloud transcription is the
+      // second metered capability under this integration, and this sentence was
+      // true only for as long as its flag stayed off — it would have become
+      // false on arming, silently, in a consent dialog. Both exceptions are
+      // written the same way, and both are still off until someone turns them
+      // on, so the sentence is accurate before and after the rollout.
+      //
+      // "Per hour of AUDIO" is deliberate here too: the two capture sources post
+      // independently, so an hour-long meeting on default settings spends two
+      // audio-hours (ADR-0063 §2a). The Mac's own caption carries the fuller
+      // explanation, at the point where the person choosing it can read it.
+      note: "Notes are included in your plan. Transcription runs on your own Mac by default and no platform summariser runs, so nothing is metered per note \u2014 the agent turn that reads it is billed as agent-hours like any other. Two capabilities are turned on separately and billed when they are: live meeting advising, per minute the advisor is armed; and cloud transcription, per hour of audio."
     }
   },
   {
@@ -44776,6 +44803,18 @@ var FLAG_REGISTRY = [
     // agent-hours-billing-enabled.
     sensitive: true
   },
+  {
+    key: "cloud-speech-to-text",
+    description: 'Cloud transcription in Ninja Notes (ENG-9913). When ON for an org, a person recording a meeting on the Mac may choose to have each capture window transcribed by xAI instead of on-device: the window is POSTed to /notes/transcribe, proxied to xAI with the platform key, metered as grok-voice/transcription per audio_hour, and the text comes back with no speaker labels. THIS IS OUR ROLLOUT GATE AND IT IS THE THIRD KEY, NOT THE FIRST. Three things must all be true before a window leaves the Mac: the org holds the grok-voice premium opt-in (authorisation, resolveCloudSttEntitlement), the user has elected it per-install (consent, CaptureSettings.cloudTranscriptionEnabled), and this flag is on (our own readiness). Without this flag the first two alone were sufficient, which is why it exists: resolveCloudSttEntitlement reports enabled for every org that ever bought Voice Chat, so the route would go live for all of them the moment it deployed. It is what finally lets the server emit `not_available` \u2014 CloudTranscriptionRefusal.notRolledOut has shipped since ENG-9869 carrying the sentence "Cloud transcription is not available for your organisation yet" with nothing able to produce it. Boolean gate; ships dark. OFF NEVER COSTS THE RECORDING. An org without the flag \u2014 or a flag read that fails \u2014 transcribes on-device exactly as before; the microphone still starts and the note is still transcribed and delivered. Same direction as live-meeting-advisor and for the same reason: the user pressed Record and a recording is what they are owed. It is also what makes rollback cheap, because flipping this off mid-flight degrades in-progress meetings to on-device rather than breaking them. Deliberately NO envVar. This is an org-scoped gate, and an envVar is highest-precedence per ADR-0022 \u2014 a literal in sst.config.ts would pin every stage and make the admin control do nothing, the ENG-8303 class exactly. No `since`: the reader is the API route, not a host-side agt-cli consumer, so this does not depend on fleet convergence. The Mac client is a separate fleet that reports no version at all, which is precisely why the gate has to live server-side.',
+    flagType: "boolean",
+    defaultValue: false,
+    // Turning it ON starts sending meeting audio — INCLUDING the other side of
+    // the call, whose participants have not been asked — to a third-party
+    // vendor, and arms a per-audio-hour meter against the org's shared
+    // grok-voice budget. Either half alone would warrant the confirm ADR-0022
+    // §4 reserves for deliberate, audited flips.
+    sensitive: true
+  },
   {
     key: "first-party-token-refusal",
     description: "ENG-8972 AC4 / ADR-0076 decision 2 \u2014 whether `resolveUserId` (packages/api/src/middleware/auth.ts) REFUSES a bearer token carrying a first-party marker that is foreign to the host-exchange lane. SUPABASE_JWT_SECRET is symmetric and signs twelve distinct token families; the generic Bearer door has always admitted any of them that mints a uuid-shaped `sub`, so a token minted for one purpose authenticates as a user for every purpose. off = the capture never runs (no log, no refusal). shadow = record the population an enforcement flip would change, on BOTH admitting lanes (lane=gotrue, lane=sub-claim), and refuse nothing \u2014 this is exactly the behaviour compiled into prod today. enforce = return null with reason=foreign-first-party-marker, above the strategy split, so the token reaches neither GoTrue nor the sub-claim lane. DEFAULT IS `shadow`, NOT `off`, and the divergence is deliberate \u2014 the shadow lines have been live in prod since 68863974b, and they are the soak instrument. Defaulting to `off` would silently switch off the measurement this flag exists to act on: the channel-quarantine-mode landmine (ENG-6252) in its exact shape. A flag-read failure degrades to `shadow` for the same reason it fails open elsewhere on this path: this is the platform front door, and a `feature_flags` blip must not start refusing the fleet. Deliberately NO envVar. The consumer is the API Lambda, whose environment block is at the AWS 4KB cap (ENG-7972), and an envVar is highest-precedence per ADR-0022 \u2014 a literal in sst.config.ts would pin every stage and make the admin control do nothing (ENG-8303). The flag value IS the kill switch: a flip back to shadow takes effect within the ~60s evaluation cache, with no deploy.",

package/dist/mcp/origami.js

@@ -39990,7 +39990,15 @@ var INTEGRATION_REGISTRY = [
     // integration_rate_cards; this only declares the model + meter.
     premium: {
       pricing: "usage",
-      note: "Billed per minute of real-time voice conversation.",
+      // THE OPT-IN AUTHORISES BOTH METERS, SO THE NOTE NAMES BOTH (ENG-9913).
+      // This string is the point of sale — it renders in the add-integration
+      // dialog an org admin reads before opting in — and it described only
+      // `voice_session` while the same opt-in, and the same $50 pool, had also
+      // covered Ninja Notes cloud transcription since ENG-9870. "Of audio"
+      // rather than "of meeting" is load-bearing: the two capture sources post
+      // independently, so an hour-long meeting on default settings spends two
+      // audio-hours (ADR-0063 §2a).
+      note: "Billed per minute of real-time voice conversation, and per hour of audio for Ninja Notes cloud transcription \u2014 both against the same monthly budget.",
       meters: [
         { event_type: "voice_session", unit: "minute" },
         // ENG-9870. Ninja Notes cloud transcription, on the SAME definition id
@@ -40002,16 +40010,24 @@ var INTEGRATION_REGISTRY = [
         // `audio_hour`, not `minute`. The vendor prices per hour and the sell
         // price is per hour, so hours store exactly (50 minor) where minutes
         // would be 0.8333 repeating; `integration_usage_events.units` is
-        // `numeric`, so a 30-minute meeting records 0.5 units precisely. This
+        // `numeric`, so 30 minutes of audio records 0.5 units precisely. This
         // is the answer to ENG-9773 §10.1's open question about whether hours
         // convert to minutes or the vocabulary gains hours.
         //
-        // NOTHING RECORDS THIS EVENT YET. Metering belongs at the chokepoint
-        // where audio is actually sent, and ENG-9868 left the transport
-        // injected with no implementation. The rate card exists first
-        // deliberately: a billable event with no USD rate makes
-        // `evaluateUsageBudget` throw, and on a SHARED pool that would break
-        // Voice Chat's budget check, not just this one.
+        // AN AUDIO-HOUR IS NOT A MEETING-HOUR (ENG-9913, Brad, 2026-09-03). The
+        // Mac captures system audio and the microphone as two independent
+        // pipelines that post separately, and both default on, so the ordinary
+        // meeting records two units per wall-clock hour. That is deliberate: the
+        // audio-hour is what we buy, since xAI bills on the duration uploaded.
+        // Pricing per meeting-hour would have varied the markup with a capture
+        // toggle and could only have been built on a client's assertion about
+        // how many pipelines were live. See ADR-0063 §2a.
+        //
+        // THE CHOKEPOINT EXISTS NOW — `POST /notes/transcribe` (ENG-9913)
+        // reserves against this meter before the vendor call, from the bytes it
+        // received. The rate card still had to land first, in ENG-9870: a
+        // billable event with no USD rate makes `evaluateUsageBudget` throw, and
+        // on a SHARED pool that would break Voice Chat's budget check too.
         { event_type: "transcription", unit: "audio_hour" }
       ]
     }
@@ -40908,7 +40924,18 @@ var INTEGRATION_REGISTRY = [
     // premium surface — is the structurally right answer and the follow-up.
     premium: {
       pricing: "included",
-      note: "Notes are included in your plan. Transcription runs on your own Mac and no platform summariser runs, so nothing is metered per note \u2014 the agent turn that reads it is billed as agent-hours like any other. Live meeting advising is the one exception: it is turned on separately, and billed per minute the advisor is armed."
+      // "THE ONE EXCEPTION" BECAME TWO (ENG-9913). Cloud transcription is the
+      // second metered capability under this integration, and this sentence was
+      // true only for as long as its flag stayed off — it would have become
+      // false on arming, silently, in a consent dialog. Both exceptions are
+      // written the same way, and both are still off until someone turns them
+      // on, so the sentence is accurate before and after the rollout.
+      //
+      // "Per hour of AUDIO" is deliberate here too: the two capture sources post
+      // independently, so an hour-long meeting on default settings spends two
+      // audio-hours (ADR-0063 §2a). The Mac's own caption carries the fuller
+      // explanation, at the point where the person choosing it can read it.
+      note: "Notes are included in your plan. Transcription runs on your own Mac by default and no platform summariser runs, so nothing is metered per note \u2014 the agent turn that reads it is billed as agent-hours like any other. Two capabilities are turned on separately and billed when they are: live meeting advising, per minute the advisor is armed; and cloud transcription, per hour of audio."
     }
   },
   {
@@ -43395,6 +43422,18 @@ var FLAG_REGISTRY = [
     // agent-hours-billing-enabled.
     sensitive: true
   },
+  {
+    key: "cloud-speech-to-text",
+    description: 'Cloud transcription in Ninja Notes (ENG-9913). When ON for an org, a person recording a meeting on the Mac may choose to have each capture window transcribed by xAI instead of on-device: the window is POSTed to /notes/transcribe, proxied to xAI with the platform key, metered as grok-voice/transcription per audio_hour, and the text comes back with no speaker labels. THIS IS OUR ROLLOUT GATE AND IT IS THE THIRD KEY, NOT THE FIRST. Three things must all be true before a window leaves the Mac: the org holds the grok-voice premium opt-in (authorisation, resolveCloudSttEntitlement), the user has elected it per-install (consent, CaptureSettings.cloudTranscriptionEnabled), and this flag is on (our own readiness). Without this flag the first two alone were sufficient, which is why it exists: resolveCloudSttEntitlement reports enabled for every org that ever bought Voice Chat, so the route would go live for all of them the moment it deployed. It is what finally lets the server emit `not_available` \u2014 CloudTranscriptionRefusal.notRolledOut has shipped since ENG-9869 carrying the sentence "Cloud transcription is not available for your organisation yet" with nothing able to produce it. Boolean gate; ships dark. OFF NEVER COSTS THE RECORDING. An org without the flag \u2014 or a flag read that fails \u2014 transcribes on-device exactly as before; the microphone still starts and the note is still transcribed and delivered. Same direction as live-meeting-advisor and for the same reason: the user pressed Record and a recording is what they are owed. It is also what makes rollback cheap, because flipping this off mid-flight degrades in-progress meetings to on-device rather than breaking them. Deliberately NO envVar. This is an org-scoped gate, and an envVar is highest-precedence per ADR-0022 \u2014 a literal in sst.config.ts would pin every stage and make the admin control do nothing, the ENG-8303 class exactly. No `since`: the reader is the API route, not a host-side agt-cli consumer, so this does not depend on fleet convergence. The Mac client is a separate fleet that reports no version at all, which is precisely why the gate has to live server-side.',
+    flagType: "boolean",
+    defaultValue: false,
+    // Turning it ON starts sending meeting audio — INCLUDING the other side of
+    // the call, whose participants have not been asked — to a third-party
+    // vendor, and arms a per-audio-hour meter against the org's shared
+    // grok-voice budget. Either half alone would warrant the confirm ADR-0022
+    // §4 reserves for deliberate, audited flips.
+    sensitive: true
+  },
   {
     key: "first-party-token-refusal",
     description: "ENG-8972 AC4 / ADR-0076 decision 2 \u2014 whether `resolveUserId` (packages/api/src/middleware/auth.ts) REFUSES a bearer token carrying a first-party marker that is foreign to the host-exchange lane. SUPABASE_JWT_SECRET is symmetric and signs twelve distinct token families; the generic Bearer door has always admitted any of them that mints a uuid-shaped `sub`, so a token minted for one purpose authenticates as a user for every purpose. off = the capture never runs (no log, no refusal). shadow = record the population an enforcement flip would change, on BOTH admitting lanes (lane=gotrue, lane=sub-claim), and refuse nothing \u2014 this is exactly the behaviour compiled into prod today. enforce = return null with reason=foreign-first-party-marker, above the strategy split, so the token reaches neither GoTrue nor the sub-claim lane. DEFAULT IS `shadow`, NOT `off`, and the divergence is deliberate \u2014 the shadow lines have been live in prod since 68863974b, and they are the soak instrument. Defaulting to `off` would silently switch off the measurement this flag exists to act on: the channel-quarantine-mode landmine (ENG-6252) in its exact shape. A flag-read failure degrades to `shadow` for the same reason it fails open elsewhere on this path: this is the platform front door, and a `feature_flags` blip must not start refusing the fleet. Deliberately NO envVar. The consumer is the API Lambda, whose environment block is at the AWS 4KB cap (ENG-7972), and an envVar is highest-precedence per ADR-0022 \u2014 a literal in sst.config.ts would pin every stage and make the admin control do nothing (ENG-8303). The flag value IS the kill switch: a flip back to shadow takes effect within the ~60s evaluation cache, with no deploy.",

package/dist/mcp/slack-channel.js

@@ -34106,7 +34106,15 @@ var INTEGRATION_REGISTRY = [
     // integration_rate_cards; this only declares the model + meter.
     premium: {
       pricing: "usage",
-      note: "Billed per minute of real-time voice conversation.",
+      // THE OPT-IN AUTHORISES BOTH METERS, SO THE NOTE NAMES BOTH (ENG-9913).
+      // This string is the point of sale — it renders in the add-integration
+      // dialog an org admin reads before opting in — and it described only
+      // `voice_session` while the same opt-in, and the same $50 pool, had also
+      // covered Ninja Notes cloud transcription since ENG-9870. "Of audio"
+      // rather than "of meeting" is load-bearing: the two capture sources post
+      // independently, so an hour-long meeting on default settings spends two
+      // audio-hours (ADR-0063 §2a).
+      note: "Billed per minute of real-time voice conversation, and per hour of audio for Ninja Notes cloud transcription \u2014 both against the same monthly budget.",
       meters: [
         { event_type: "voice_session", unit: "minute" },
         // ENG-9870. Ninja Notes cloud transcription, on the SAME definition id
@@ -34118,16 +34126,24 @@ var INTEGRATION_REGISTRY = [
         // `audio_hour`, not `minute`. The vendor prices per hour and the sell
         // price is per hour, so hours store exactly (50 minor) where minutes
         // would be 0.8333 repeating; `integration_usage_events.units` is
-        // `numeric`, so a 30-minute meeting records 0.5 units precisely. This
+        // `numeric`, so 30 minutes of audio records 0.5 units precisely. This
         // is the answer to ENG-9773 §10.1's open question about whether hours
         // convert to minutes or the vocabulary gains hours.
         //
-        // NOTHING RECORDS THIS EVENT YET. Metering belongs at the chokepoint
-        // where audio is actually sent, and ENG-9868 left the transport
-        // injected with no implementation. The rate card exists first
-        // deliberately: a billable event with no USD rate makes
-        // `evaluateUsageBudget` throw, and on a SHARED pool that would break
-        // Voice Chat's budget check, not just this one.
+        // AN AUDIO-HOUR IS NOT A MEETING-HOUR (ENG-9913, Brad, 2026-09-03). The
+        // Mac captures system audio and the microphone as two independent
+        // pipelines that post separately, and both default on, so the ordinary
+        // meeting records two units per wall-clock hour. That is deliberate: the
+        // audio-hour is what we buy, since xAI bills on the duration uploaded.
+        // Pricing per meeting-hour would have varied the markup with a capture
+        // toggle and could only have been built on a client's assertion about
+        // how many pipelines were live. See ADR-0063 §2a.
+        //
+        // THE CHOKEPOINT EXISTS NOW — `POST /notes/transcribe` (ENG-9913)
+        // reserves against this meter before the vendor call, from the bytes it
+        // received. The rate card still had to land first, in ENG-9870: a
+        // billable event with no USD rate makes `evaluateUsageBudget` throw, and
+        // on a SHARED pool that would break Voice Chat's budget check too.
         { event_type: "transcription", unit: "audio_hour" }
       ]
     }
@@ -35024,7 +35040,18 @@ var INTEGRATION_REGISTRY = [
     // premium surface — is the structurally right answer and the follow-up.
     premium: {
       pricing: "included",
-      note: "Notes are included in your plan. Transcription runs on your own Mac and no platform summariser runs, so nothing is metered per note \u2014 the agent turn that reads it is billed as agent-hours like any other. Live meeting advising is the one exception: it is turned on separately, and billed per minute the advisor is armed."
+      // "THE ONE EXCEPTION" BECAME TWO (ENG-9913). Cloud transcription is the
+      // second metered capability under this integration, and this sentence was
+      // true only for as long as its flag stayed off — it would have become
+      // false on arming, silently, in a consent dialog. Both exceptions are
+      // written the same way, and both are still off until someone turns them
+      // on, so the sentence is accurate before and after the rollout.
+      //
+      // "Per hour of AUDIO" is deliberate here too: the two capture sources post
+      // independently, so an hour-long meeting on default settings spends two
+      // audio-hours (ADR-0063 §2a). The Mac's own caption carries the fuller
+      // explanation, at the point where the person choosing it can read it.
+      note: "Notes are included in your plan. Transcription runs on your own Mac by default and no platform summariser runs, so nothing is metered per note \u2014 the agent turn that reads it is billed as agent-hours like any other. Two capabilities are turned on separately and billed when they are: live meeting advising, per minute the advisor is armed; and cloud transcription, per hour of audio."
     }
   },
   {
@@ -37918,6 +37945,18 @@ var FLAG_REGISTRY = [
     // agent-hours-billing-enabled.
     sensitive: true
   },
+  {
+    key: "cloud-speech-to-text",
+    description: 'Cloud transcription in Ninja Notes (ENG-9913). When ON for an org, a person recording a meeting on the Mac may choose to have each capture window transcribed by xAI instead of on-device: the window is POSTed to /notes/transcribe, proxied to xAI with the platform key, metered as grok-voice/transcription per audio_hour, and the text comes back with no speaker labels. THIS IS OUR ROLLOUT GATE AND IT IS THE THIRD KEY, NOT THE FIRST. Three things must all be true before a window leaves the Mac: the org holds the grok-voice premium opt-in (authorisation, resolveCloudSttEntitlement), the user has elected it per-install (consent, CaptureSettings.cloudTranscriptionEnabled), and this flag is on (our own readiness). Without this flag the first two alone were sufficient, which is why it exists: resolveCloudSttEntitlement reports enabled for every org that ever bought Voice Chat, so the route would go live for all of them the moment it deployed. It is what finally lets the server emit `not_available` \u2014 CloudTranscriptionRefusal.notRolledOut has shipped since ENG-9869 carrying the sentence "Cloud transcription is not available for your organisation yet" with nothing able to produce it. Boolean gate; ships dark. OFF NEVER COSTS THE RECORDING. An org without the flag \u2014 or a flag read that fails \u2014 transcribes on-device exactly as before; the microphone still starts and the note is still transcribed and delivered. Same direction as live-meeting-advisor and for the same reason: the user pressed Record and a recording is what they are owed. It is also what makes rollback cheap, because flipping this off mid-flight degrades in-progress meetings to on-device rather than breaking them. Deliberately NO envVar. This is an org-scoped gate, and an envVar is highest-precedence per ADR-0022 \u2014 a literal in sst.config.ts would pin every stage and make the admin control do nothing, the ENG-8303 class exactly. No `since`: the reader is the API route, not a host-side agt-cli consumer, so this does not depend on fleet convergence. The Mac client is a separate fleet that reports no version at all, which is precisely why the gate has to live server-side.',
+    flagType: "boolean",
+    defaultValue: false,
+    // Turning it ON starts sending meeting audio — INCLUDING the other side of
+    // the call, whose participants have not been asked — to a third-party
+    // vendor, and arms a per-audio-hour meter against the org's shared
+    // grok-voice budget. Either half alone would warrant the confirm ADR-0022
+    // §4 reserves for deliberate, audited flips.
+    sensitive: true
+  },
   {
     key: "first-party-token-refusal",
     description: "ENG-8972 AC4 / ADR-0076 decision 2 \u2014 whether `resolveUserId` (packages/api/src/middleware/auth.ts) REFUSES a bearer token carrying a first-party marker that is foreign to the host-exchange lane. SUPABASE_JWT_SECRET is symmetric and signs twelve distinct token families; the generic Bearer door has always admitted any of them that mints a uuid-shaped `sub`, so a token minted for one purpose authenticates as a user for every purpose. off = the capture never runs (no log, no refusal). shadow = record the population an enforcement flip would change, on BOTH admitting lanes (lane=gotrue, lane=sub-claim), and refuse nothing \u2014 this is exactly the behaviour compiled into prod today. enforce = return null with reason=foreign-first-party-marker, above the strategy split, so the token reaches neither GoTrue nor the sub-claim lane. DEFAULT IS `shadow`, NOT `off`, and the divergence is deliberate \u2014 the shadow lines have been live in prod since 68863974b, and they are the soak instrument. Defaulting to `off` would silently switch off the measurement this flag exists to act on: the channel-quarantine-mode landmine (ENG-6252) in its exact shape. A flag-read failure degrades to `shadow` for the same reason it fails open elsewhere on this path: this is the platform front door, and a `feature_flags` blip must not start refusing the fleet. Deliberately NO envVar. The consumer is the API Lambda, whose environment block is at the AWS 4KB cap (ENG-7972), and an envVar is highest-precedence per ADR-0022 \u2014 a literal in sst.config.ts would pin every stage and make the admin control do nothing (ENG-8303). The flag value IS the kill switch: a flip back to shadow takes effect within the ~60s evaluation cache, with no deploy.",

package/dist/mcp/telegram-channel.js

@@ -34264,7 +34264,15 @@ var INTEGRATION_REGISTRY = [
     // integration_rate_cards; this only declares the model + meter.
     premium: {
       pricing: "usage",
-      note: "Billed per minute of real-time voice conversation.",
+      // THE OPT-IN AUTHORISES BOTH METERS, SO THE NOTE NAMES BOTH (ENG-9913).
+      // This string is the point of sale — it renders in the add-integration
+      // dialog an org admin reads before opting in — and it described only
+      // `voice_session` while the same opt-in, and the same $50 pool, had also
+      // covered Ninja Notes cloud transcription since ENG-9870. "Of audio"
+      // rather than "of meeting" is load-bearing: the two capture sources post
+      // independently, so an hour-long meeting on default settings spends two
+      // audio-hours (ADR-0063 §2a).
+      note: "Billed per minute of real-time voice conversation, and per hour of audio for Ninja Notes cloud transcription \u2014 both against the same monthly budget.",
       meters: [
         { event_type: "voice_session", unit: "minute" },
         // ENG-9870. Ninja Notes cloud transcription, on the SAME definition id
@@ -34276,16 +34284,24 @@ var INTEGRATION_REGISTRY = [
         // `audio_hour`, not `minute`. The vendor prices per hour and the sell
         // price is per hour, so hours store exactly (50 minor) where minutes
         // would be 0.8333 repeating; `integration_usage_events.units` is
-        // `numeric`, so a 30-minute meeting records 0.5 units precisely. This
+        // `numeric`, so 30 minutes of audio records 0.5 units precisely. This
         // is the answer to ENG-9773 §10.1's open question about whether hours
         // convert to minutes or the vocabulary gains hours.
         //
-        // NOTHING RECORDS THIS EVENT YET. Metering belongs at the chokepoint
-        // where audio is actually sent, and ENG-9868 left the transport
-        // injected with no implementation. The rate card exists first
-        // deliberately: a billable event with no USD rate makes
-        // `evaluateUsageBudget` throw, and on a SHARED pool that would break
-        // Voice Chat's budget check, not just this one.
+        // AN AUDIO-HOUR IS NOT A MEETING-HOUR (ENG-9913, Brad, 2026-09-03). The
+        // Mac captures system audio and the microphone as two independent
+        // pipelines that post separately, and both default on, so the ordinary
+        // meeting records two units per wall-clock hour. That is deliberate: the
+        // audio-hour is what we buy, since xAI bills on the duration uploaded.
+        // Pricing per meeting-hour would have varied the markup with a capture
+        // toggle and could only have been built on a client's assertion about
+        // how many pipelines were live. See ADR-0063 §2a.
+        //
+        // THE CHOKEPOINT EXISTS NOW — `POST /notes/transcribe` (ENG-9913)
+        // reserves against this meter before the vendor call, from the bytes it
+        // received. The rate card still had to land first, in ENG-9870: a
+        // billable event with no USD rate makes `evaluateUsageBudget` throw, and
+        // on a SHARED pool that would break Voice Chat's budget check too.
         { event_type: "transcription", unit: "audio_hour" }
       ]
     }
@@ -35182,7 +35198,18 @@ var INTEGRATION_REGISTRY = [
     // premium surface — is the structurally right answer and the follow-up.
     premium: {
       pricing: "included",
-      note: "Notes are included in your plan. Transcription runs on your own Mac and no platform summariser runs, so nothing is metered per note \u2014 the agent turn that reads it is billed as agent-hours like any other. Live meeting advising is the one exception: it is turned on separately, and billed per minute the advisor is armed."
+      // "THE ONE EXCEPTION" BECAME TWO (ENG-9913). Cloud transcription is the
+      // second metered capability under this integration, and this sentence was
+      // true only for as long as its flag stayed off — it would have become
+      // false on arming, silently, in a consent dialog. Both exceptions are
+      // written the same way, and both are still off until someone turns them
+      // on, so the sentence is accurate before and after the rollout.
+      //
+      // "Per hour of AUDIO" is deliberate here too: the two capture sources post
+      // independently, so an hour-long meeting on default settings spends two
+      // audio-hours (ADR-0063 §2a). The Mac's own caption carries the fuller
+      // explanation, at the point where the person choosing it can read it.
+      note: "Notes are included in your plan. Transcription runs on your own Mac by default and no platform summariser runs, so nothing is metered per note \u2014 the agent turn that reads it is billed as agent-hours like any other. Two capabilities are turned on separately and billed when they are: live meeting advising, per minute the advisor is armed; and cloud transcription, per hour of audio."
     }
   },
   {
@@ -38076,6 +38103,18 @@ var FLAG_REGISTRY = [
     // agent-hours-billing-enabled.
     sensitive: true
   },
+  {
+    key: "cloud-speech-to-text",
+    description: 'Cloud transcription in Ninja Notes (ENG-9913). When ON for an org, a person recording a meeting on the Mac may choose to have each capture window transcribed by xAI instead of on-device: the window is POSTed to /notes/transcribe, proxied to xAI with the platform key, metered as grok-voice/transcription per audio_hour, and the text comes back with no speaker labels. THIS IS OUR ROLLOUT GATE AND IT IS THE THIRD KEY, NOT THE FIRST. Three things must all be true before a window leaves the Mac: the org holds the grok-voice premium opt-in (authorisation, resolveCloudSttEntitlement), the user has elected it per-install (consent, CaptureSettings.cloudTranscriptionEnabled), and this flag is on (our own readiness). Without this flag the first two alone were sufficient, which is why it exists: resolveCloudSttEntitlement reports enabled for every org that ever bought Voice Chat, so the route would go live for all of them the moment it deployed. It is what finally lets the server emit `not_available` \u2014 CloudTranscriptionRefusal.notRolledOut has shipped since ENG-9869 carrying the sentence "Cloud transcription is not available for your organisation yet" with nothing able to produce it. Boolean gate; ships dark. OFF NEVER COSTS THE RECORDING. An org without the flag \u2014 or a flag read that fails \u2014 transcribes on-device exactly as before; the microphone still starts and the note is still transcribed and delivered. Same direction as live-meeting-advisor and for the same reason: the user pressed Record and a recording is what they are owed. It is also what makes rollback cheap, because flipping this off mid-flight degrades in-progress meetings to on-device rather than breaking them. Deliberately NO envVar. This is an org-scoped gate, and an envVar is highest-precedence per ADR-0022 \u2014 a literal in sst.config.ts would pin every stage and make the admin control do nothing, the ENG-8303 class exactly. No `since`: the reader is the API route, not a host-side agt-cli consumer, so this does not depend on fleet convergence. The Mac client is a separate fleet that reports no version at all, which is precisely why the gate has to live server-side.',
+    flagType: "boolean",
+    defaultValue: false,
+    // Turning it ON starts sending meeting audio — INCLUDING the other side of
+    // the call, whose participants have not been asked — to a third-party
+    // vendor, and arms a per-audio-hour meter against the org's shared
+    // grok-voice budget. Either half alone would warrant the confirm ADR-0022
+    // §4 reserves for deliberate, audited flips.
+    sensitive: true
+  },
   {
     key: "first-party-token-refusal",
     description: "ENG-8972 AC4 / ADR-0076 decision 2 \u2014 whether `resolveUserId` (packages/api/src/middleware/auth.ts) REFUSES a bearer token carrying a first-party marker that is foreign to the host-exchange lane. SUPABASE_JWT_SECRET is symmetric and signs twelve distinct token families; the generic Bearer door has always admitted any of them that mints a uuid-shaped `sub`, so a token minted for one purpose authenticates as a user for every purpose. off = the capture never runs (no log, no refusal). shadow = record the population an enforcement flip would change, on BOTH admitting lanes (lane=gotrue, lane=sub-claim), and refuse nothing \u2014 this is exactly the behaviour compiled into prod today. enforce = return null with reason=foreign-first-party-marker, above the strategy split, so the token reaches neither GoTrue nor the sub-claim lane. DEFAULT IS `shadow`, NOT `off`, and the divergence is deliberate \u2014 the shadow lines have been live in prod since 68863974b, and they are the soak instrument. Defaulting to `off` would silently switch off the measurement this flag exists to act on: the channel-quarantine-mode landmine (ENG-6252) in its exact shape. A flag-read failure degrades to `shadow` for the same reason it fails open elsewhere on this path: this is the platform front door, and a `feature_flags` blip must not start refusing the fleet. Deliberately NO envVar. The consumer is the API Lambda, whose environment block is at the AWS 4KB cap (ENG-7972), and an envVar is highest-precedence per ADR-0022 \u2014 a literal in sst.config.ts would pin every stage and make the admin control do nothing (ENG-8303). The flag value IS the kill switch: a flip back to shadow takes effect within the ~60s evaluation cache, with no deploy.",