@kontextmind/kxm 0.7.47 → 0.7.50

package/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "kxm",
       "source": "./plugins/kxm",
       "description": "Durable workflows, peer agents, and kxm tui",
-      "version": "0.7.47",
+      "version": "0.7.50",
       "category": "development",
       "tags": ["kxm", "multi-agent", "workflows", "mcp"]
     }

package/CHANGELOG.md

@@ -41,6 +41,18 @@ All notable user-facing changes are documented here. The project follows [Semant
 - **`kxm hub start` no longer generates and persists an admin token when it is
   about to refuse** because another hub already owns the claim. A refused start
   used to leave behind credentials the running hub never issued.
+- **Runtime intake contract fixes (released in 0.7.46, found in review):**
+  a lost intake insert race accepted different content under an already-used
+  idempotency key; resume drained only one page, so held intent beyond 500
+  messages was stranded; pause, ingress and admission were not atomic, which could
+  strand a message as `held_paused` in an unpaused project; a coordinator rebind
+  could widen a tool ceiling by lifting a denial, changing the preset, or dropping
+  the tool policy; relabelling a stored message's classification on a duplicate is
+  now refused; coordinators now record the real loaded configuration revision
+  instead of a hash of project path and runtime id; dispatch order is Runtime
+  arrival order, so a backdated timestamp cannot jump the queue; persisted records
+  are cross-checked against every duplicated column on read; and the intake schema
+  no longer admits contradictory states.
 
 ## 0.7.0 - 2026-09-11
 

package/docs/assignment-runner.md

@@ -57,6 +57,16 @@ and models are admitted with strict permission and vendor boundaries:
 
 ## 2. The developer loop
 
+> **Environment.** These recipes do **not** auto-load a `.env` from the working
+> directory, and neither the source text nor `just --dump` is allowed to enable it. An
+> untracked, gitignored file must not be able to set `NODE_OPTIONS`
+> and execute code before the runner validates anything — `just --dotenv-path /abs/.env assign …` is the explicit
+> opt-in (`--dotenv-path` both selects and locates the file in `just` 1.58). Arguments are passed
+> positionally and quoted, so a path is never re-read as shell source; the runner's
+> absolute-path requirement is a separate validation rule, not what makes quoting
+> safe. `accept` prints JSON by default but takes no `--json` flag, and its optional
+> `--observed-pr` / `--observed-ci` need the direct script form shown in Step 5.
+
 The standard progression follows a slim four-step lifecycle:
 
 ```text

package/docs/kb/qa-authentik-authentication.md

@@ -8,18 +8,24 @@ status: "draft"
 owner: "@operator"
 created: "2026-09-17"
 updated: "2026-09-18"
-authority: "instruction"
-confidence: "reviewed"
-summary: "Yes, but not by swapping the hub's checks for OIDC — the safest hook is a token broker that exchanges Authentik identity for the kxm tokens the hub already understands."
+authority: "hypothesis"
+confidence: "uncertain"
+summary: "Authentik authenticates browsers at the reverse proxy and the tenant portal's backend calls the loopback hub with existing machine tokens. KXM does not interpret browser identity headers, and the hub-side JWT verification and token broker once recommended here are rejected, not deferred."
 tags: ["hub", "authentik", "oidc", "auth"]
-related: ["docs/operations.md", "docs/kb/qa-hub-on-a-public-host.md"]
+related: ["docs/operations.md", "docs/kb/qa-hub-on-a-public-host.md", "plans/plan-per-tenant-hosting.md", "plans/implementation-plan.md"]
 ---
 
 # Q&A: Authentik (OIDC) for user/role/agent authentication
 
 > Researched by `claude --model fable` (planner, read-only) · 2026-09-17 · task_c0bb05339e15 · root review: pending
 
-**Short answer:** Yes, but not by swapping the hub's checks for OIDC. The hub has one shared-secret model, and the safest hook is a token broker that exchanges Authentik identity for the kxm tokens the hub already understands. Proxy forward-auth is the zero-code first step for humans; hub-side JWT validation is a later, additive gate.
+**Short answer, as of 2026-09-20: no hub-side identity subsystem at all.** Authentik
+authenticates browsers at the tenant's reverse proxy and the portal's own backend calls the
+loopback hub with the machine tokens that already work. The token-broker and JWT
+recommendations that used to sit in this answer are **rejected**, not deferred; they were
+plausible for a shared multi-tenant hub, which is not what we are deploying. Option 1 below —
+forward-auth at the existing proxy, hub unchanged — is the **selected** shape; options 2 and 3
+are rejections, not stages.
 
 ## What exists today
 
@@ -35,30 +41,57 @@ The hub knows about three credentials. None of them carries a user identity, a r
 
 ## Integration options
 
-### 1. Reverse-proxy forward-auth (Authentik outpost at the proxy; hub unchanged)
+### 1. Reverse-proxy forward-auth (Authentik outpost at the proxy; hub unchanged) — **selected shape at the edge**
 
-Authentik's proxy outpost authenticates browser sessions and passes headers upstream. The hub ignores those headers today, so the proxy must still inject the hub bearer token, or clients must still send it. Covers: Studio, `/v1/ops/*` dashboards, human CLI users via a browser-capable flow. Does not cover: agents (they present `x-kxm-agent-*` headers plus a bearer, not a cookie), and it gives the hub no per-user identity for logging. Effort: low, config only. Risk: low if the hub keeps its token check; medium if someone sets the proxy to add the admin token for every authenticated user, which flattens all Authentik users to admin. Non-loopback bind already requires a token (`hub.ts:468`), so the proxy cannot make the hub anonymous.
+Authentik's proxy outpost authenticates browser sessions and passes headers upstream. The hub ignores those headers today, and under the per-tenant decision it keeps ignoring
+them: the **portal's own backend** holds the hub bearer server-side and calls loopback, while
+the proxy's job is to keep the hub's routes off the public interface entirely. Do not
+configure the proxy to inject the admin token on behalf of every user — that flattens all
+Authentik users to hub admin. What this option does **not** give the hub is per-user identity
+for logging, which is the portal's to record. Effort: low, config only. Risk: low if the hub keeps its token check; medium if someone sets the proxy to add the admin token for every authenticated user, which flattens all Authentik users to admin. Non-loopback bind already requires a token (`hub.ts:468`), so the proxy cannot make the hub anonymous.
 
-### 2. Hub validates Authentik-issued JWTs (OIDC discovery + JWKS)
+### 2. Hub validates Authentik-issued JWTs (OIDC discovery + JWKS) — **rejected 2026-09-20; a new decision is required to revisit**
 
 Add a second accepted credential in `bearerToken`'s callers: if the bearer parses as a JWT, verify `iss`, `aud`, `exp`, and signature against a cached JWKS from `<issuer>/.well-known/openid-configuration`; else fall through to the existing `safeTokenEqual` path. Code changes: a new `oidc.ts` (discovery, JWKS cache, verify via `node:crypto` `createPublicKey` from JWK, or add `jose`), new `MeshHubOptions.oidc` and `KXM_OIDC_ISSUER` / `KXM_OIDC_AUDIENCE` env in `server.ts` and `hub-env.ts`, and changes to `requireAdminAuth` and `requireProjectAuth` to accept a verified claim set. Mapping: `groups` claim to admin (e.g. `kxm-admin`) and to project scope (e.g. `kxm-project:<name>`). Client side: `HubClient.authToken` (`client.ts:539`) already sends any string as bearer, so a client can pass an Authentik access token unchanged. Effort: medium, roughly 300 to 500 lines plus tests. Risk: medium. New network dependency at auth time (JWKS fetch must fail closed, never skip), clock skew, and the hub must reject `alg: none` and HS256. Agent registration would gain a real principal to store on the agent record (`sub`, `preferred_username`), which the schema can absorb since records are opaque JSON (`store.ts:26`).
 
-### 3. Token-broker mapping (Authentik users/groups mint per-user or per-agent kxm tokens)
+### 3. Token-broker mapping (Authentik users/groups mint per-user or per-agent kxm tokens) — **rejected 2026-09-20; a new decision is required to revisit**
 
 A small broker (could be a new hub route or a sidecar) accepts an Authentik ID token, verifies it as in option 2, then issues the tokens the runtime already consumes: a project token entry for `requireProjectAuth`, and a `kxm.session-token.v1` with a `toolPolicy` derived from the user's group (`mintSessionToken`, `commands.ts:944`). Mapping table: Authentik group to kxm role id (`role.ts:63` ids `writer`, `planner`, `critic-*`, `verifier`), role `tools` block to `ToolPolicy`, and group to project list to `projectTokens`. Today project tokens are a static map read at startup (`hub.ts:385`), so per-user project tokens need either a dynamic token store in `MeshStore` or short-lived tokens the hub can look up. Session tokens are unsigned (`commands.ts:977`), so a broker-issued one only means something if `parseSessionToken` gains signature verification; otherwise any local process can forge the same payload. Effort: medium to high, because it touches token storage, signing, and revocation. Risk: medium. Benefit: agents and humans converge on one identity source without changing every hub route.
 
-## Recommendation
-
-Phased, honoring the fail-closed rules:
-
-1. **Phase 1, now: forward-auth for human surfaces only.** Put Authentik in front of Studio and `/v1/ops/*` on any non-loopback deployment. Keep `KXM_AUTH_TOKEN` mandatory; the proxy never substitutes for it. This adds SSO without touching `hub.ts`. Fix the plain-string compare in `studio-layout.ts:350` to use `timingSafeStringCompare` while there.
-2. **Phase 2: hub-side JWT verification as an additive gate.** Implement option 2 with a hard rule: if `KXM_OIDC_ISSUER` is set and discovery or JWKS fetch fails, the JWT path returns 401, and the static-token path still works. Never let loopback plus OIDC config produce anonymous admin. Record the verified `sub` on the agent record at registration for provenance.
-3. **Phase 3 (defer): broker-issued signed session and attempt tokens.** Sign `kxm.session-token.v1` and `kxm.attempt-token.v1` payloads and verify in `enforceToolPolicy` before mapping Authentik groups to `ToolPolicy`. Until tokens are signed, group-to-policy mapping is advisory, not enforcement, because the check is client-side and forgeable.
-
-Defer any attempt to remove the static token entirely; it is the only credential the auto-start path (`hub-autostart.ts:175`) and the persisted client resolver (`hub-env.ts:203`) know how to pass.
+## Recommendation (replaced 2026-09-20)
+
+Options **2 and 3**, and the staged recommendation that used to sit in this section, are
+**superseded** — option 1 above is the selected shape, not a rejected one. They stay visible
+because they were the plausible answer for a month and someone will meet them again: **do not build a hub-side JWT verifier, a
+token broker, per-user project tokens, or signed session/attempt token issuance as hosting
+prerequisites.** They were a reasonable answer to "one hub, many users"; they are the wrong
+answer to the deployment we actually have, which is **one tenant per box**.
+
+1. **Now:** Authentik authenticates and authorizes browsers at the tenant's existing reverse
+   proxy, on the **portal's** routes. The portal's server-side backend calls the loopback hub
+   and supervisor using the machine credentials that already work (`KXM_AUTH_TOKEN`,
+   `KXM_PROJECT_TOKENS`, the persisted hub env record). The hub binds loopback and exposes no
+   public listener. Nothing in `hub.ts` changes, and no browser identity header reaches it.
+2. **What stays as-is, unmodified:** the admin-token requirement for non-loopback binding, the
+   generated-and-persisted token, project tokens read at startup, and the local loopback
+   convenience. A browser-path outage denies browsers; it must not stop authorized machine
+   clients.
+3. **Rejected, not deferred:** hub-side JWT verification, group-to-`ToolPolicy` mapping,
+   token signing, dynamic per-user token stores, and OAuth2 client-credentials or
+   device-flow login for agents. These are not waiting for a trigger; they are the wrong
+   shape for a per-tenant hub, and reopening any of them needs a **new written decision**
+   that says what the portal boundary cannot do — for example genuine per-user attribution
+   of hub writes inside KXM itself, which per-box tenancy does not need. Until such a
+   decision exists, treat every mention of them in this file as history.
+
+The technical observations underneath remain accurate and are the reason the option is *cheap to
+reject*: unsigned session tokens (`commands.ts:977`), static project tokens read at startup
+(`hub.ts:385`), a fixed-string `HubClient.authToken`, and a plain-string compare in
+`studio-layout.ts:350`. **One item is kept as a live hardening note, not a hosting
+prerequisite:** make that Studio compare timing-safe.
 
 ## Agent auth specifically
 
 Running agents today authenticate non-interactively with whatever string lands in `HubClient.authToken`, resolved by `resolveClientHubAuthToken` (`hub-env.ts:203`): `KXM_AUTH_TOKEN` env, else the persisted project token, else the persisted admin token. The MCP server (`mcp-server.ts:84`) and the Pi extension (`extension.ts:709`) both use this. Pi worker children inherit `process.env` unchanged (`pi-producer.ts:504`), so they get the same token as the supervisor. Tool policy for workers comes from `KXM_ATTEMPT_TOKEN`, which is minted only in tests today (`test/core/commands-policy.test.ts:60`); no runtime path in `plugins/kxm/src` calls `mintAttemptToken`, so engine issuance is planned but not wired.
 
-With Authentik, agents should use the OAuth2 client-credentials grant (one Authentik application per agent class, or per role such as `writer` and `verifier`), obtain an access token at spawn, and pass it as `KXM_AUTH_TOKEN` to the child. This needs option 2 in the hub so the token verifies, and a refresh hook in `HubClient` since `headers()` reads a fixed string (`client.ts:539`) and access tokens expire. Device-code flow is the fallback for Claude Code sessions that start from a human terminal. Whether Authentik's client-credentials tokens carry `groups` claims by default is unknown from this repo; it must be confirmed against the Authentik provider config before mapping roles from claims.
+**Superseded paragraph, kept for the record (see the recommendation above):** with Authentik, agents should use the OAuth2 client-credentials grant (one Authentik application per agent class, or per role such as `writer` and `verifier`), obtain an access token at spawn, and pass it as `KXM_AUTH_TOKEN` to the child. This needs option 2 in the hub so the token verifies, and a refresh hook in `HubClient` since `headers()` reads a fixed string (`client.ts:539`) and access tokens expire. Device-code flow is the fallback for Claude Code sessions that start from a human terminal. Whether Authentik's client-credentials tokens carry `groups` claims by default is unknown from this repo; it must be confirmed against the Authentik provider config before mapping roles from claims.

package/docs/kb/qa-hub-on-a-public-host.md

@@ -10,7 +10,7 @@ created: "2026-09-17"
 updated: "2026-09-18"
 authority: "instruction"
 confidence: "reviewed"
-summary: "One hub is one process and one SQLite database behind a TLS proxy; it is not multi-tenant and must never be exposed directly to the public internet."
+summary: "One hub is one process and one state set per tenant box behind a TLS proxy; it is not multi-tenant and must never be exposed directly to the public internet. Hosting tenancy is the machine plus the portal, and the hub binds loopback."
 tags: ["hub", "deployment", "security"]
 related: ["docs/operations.md", "docs/kb/qa-authentik-authentication.md", "docs/kb/qa-what-the-hub-stores.md"]
 ---

package/docs/operations.md

@@ -146,6 +146,14 @@ Recommended alerts:
 
 ## Backup and restore
 
+> **Hub-only today, and labelled as such.** The recipe below stops the hub and copies
+> `.kxm/state/kxm.db`. That is not the whole tenant state set: the Runtime keeps its own
+> `registry.db`, per-project event stores under the user state root, prompt sidecars,
+> bindings and configuration. A restore that follows only these steps can bring the hub back
+> while losing Runtime history. Queue step **S1** replaces this section with a stopped-state
+> procedure covering the full set, and **S5** proves it with one deployed restore before real
+> use; until S1 lands, treat this as the hub database only.
+
 SQLite runs in WAL mode. The safest simple backup is a coordinated copy while the hub is stopped:
 
 1. Stop the hub gracefully.
@@ -233,5 +241,5 @@ place from v0.4 databases.
 - [What is all stored on the hub?](kb/qa-what-the-hub-stores.md)
 - [Storage engine — SQLite vs DuckDB](kb/qa-sqlite-vs-duckdb.md)
 - [Hub on a public host — multiple users and projects?](kb/qa-hub-on-a-public-host.md)
-- [Authentik (OIDC) for user/role/agent authentication](kb/qa-authentik-authentication.md)
+- [Authentik at the edge: why the hub owns no browser identity](kb/qa-authentik-authentication.md)
 - [Extension install → kxm CLI bootstrap + hub auto-connect](kb/qa-extension-install-and-hub-bootstrap.md)

package/docs/operator-pi-packages.md

@@ -43,8 +43,9 @@ commands for RTK independently of `rtk.ts`.
 - The antigravity provider is bundled inside `plugins/kxm` (vendored from
   pi-antigravity, MIT); remove any standalone pi-antigravity Pi extension to
   avoid the double-registration warning. `pi-antigravity` and
-  `@tian.zuo/pi-antigravity` are different Pi providers. They do not replace
-  the native `agy` harness used by the assignment runner.
+  `@tian.zuo/pi-antigravity` are different Pi providers. For Google, this bundled
+  provider **is** the admitted route (Tracking → Decided, 2026-09-15); `agy` stays a
+  catalog/helper entry rather than the admission path.
 - For KXM development loads, prefer the working tree:
   `pi --no-extensions -e ./plugins/kxm/src/extension.ts`. Add every required
   provider extension with another `-e`; otherwise Pi discovery is disabled.

package/docs/test-matrix.md

@@ -85,7 +85,7 @@ exercised from `node_modules`.
 | Quorum parser boundaries and definition identity | `plugins/kxm/src/workflow.ts`, `test/core/workflow-quorum.test.ts`, `test/core/workflow-definition-hash.test.ts` | Rejects impossible peer pools, verifies degradation bounds, and proves secret-free semantic hash stamping plus credential-rotation invariance |
 | Artifact existence and containment gate | `plugins/kxm/src/artifacts-exist.ts`, `test/core/artifacts-exist.test.ts` | Non-empty regular files pass; missing, empty, non-file, lexical escape, and real-path escape cases fail closed (host-permitted symlink coverage) |
 | Harness inventory probe | `plugins/kxm/src/harness.ts`, `test/core/harness.test.ts` | Detect/auth/dispatch for the builtin catalog; win32 `.exe` / inner npm-package `.exe` / `.cmd` candidate order for npm shims (issue #168); `windows_shim` issue only when the shim answered; allowlisted `name.cmd` shell spawn only; rejected metacharacter commands; Linux still `not_detected` when the bare command is missing. |
-| Headless harness helper | `scripts/harness-run.mjs`, `justfile`, `test/core/harness-run.test.ts` | Offline auth success/logout/garbage, role/mode/pair/provider refusals before spawn, missing brief/schema fail closed with zero spawn, invocation-cwd relative `prompt_file`/`output_schema` vs `request.cwd` (absolute argv tokens; Claude/Codex stdin matches the brief), Pi JSONL multi-`message_end` sums, Claude auxiliary usage, native error-on-exit-0, timeout/empty payload, sidecar-only stderr/answer/error, shell:false argv metacharacters, win32 `.cmd` rejection, and win32 npm inner `claude.exe` / Pi `node.exe`+`cli.js` unwrap. Result v2 transport vs closed model claims, dispatch-before-spawn, grok/codex isolation flags, `max_turns` validation, obsolete v1 diagnosis without rewrite or unknown-schema echo, partial usage on fail/interrupt, signaled null `exitCode` plus exact `signal`, exit-before-stdio-close drain vs bounded linger, type-closed usage/cost (no object leak or zero-coercion), malformed optional text as run-stage failure with retained spend, stdin/pid-record write failures not completed, bounded timeout settle without descendant-death claims, spawn/write-failure stage and spend, and capability-fixture parser evidence (Codex `--ignore-user-config` is not invented in top-level help; captured help bytes are not rescrubbed). Recipe quoting is covered from the justfile body without a just binary (POSIX `sh` + positional argv; Windows uses the recipe's `node -e` / argv shape). Real just integration is optional and skipped when the binary is absent. No live paid smoke. |
+| Headless harness helper | `scripts/harness-run.mjs`, `justfile`, `test/core/harness-run.test.ts` | Offline auth success/logout/garbage, role/mode/pair/provider refusals before spawn, missing brief/schema fail closed with zero spawn, invocation-cwd relative `prompt_file`/`output_schema` vs `request.cwd` (absolute argv tokens; Claude/Codex stdin matches the brief), Pi JSONL multi-`message_end` sums, Claude auxiliary usage, native error-on-exit-0, timeout/empty payload, sidecar-only stderr/answer/error, shell:false argv metacharacters, win32 `.cmd` rejection, and win32 npm inner `claude.exe` / Pi `node.exe`+`cli.js` unwrap. Result v2 transport vs closed model claims, dispatch-before-spawn, grok/codex isolation flags, `max_turns` validation, obsolete v1 diagnosis without rewrite or unknown-schema echo, partial usage on fail/interrupt, signaled null `exitCode` plus exact `signal`, exit-before-stdio-close drain vs bounded linger, type-closed usage/cost (no object leak or zero-coercion), malformed optional text as run-stage failure with retained spend, stdin/pid-record write failures not completed, bounded timeout settle without descendant-death claims, spawn/write-failure stage and spend, and capability-fixture parser evidence (Codex `--ignore-user-config` is not invented in top-level help; captured help bytes are not rescrubbed). Recipe quoting is covered from the justfile body without a just binary (POSIX `sh` + positional argv; Windows uses the recipe's `node -e` / argv shape). The developer entry points are gated three ways: docs-to-recipe parity (a documented `just` verb in command form, across inline code or a fenced line with an optional `#`, tolerant of stray whitespace, pipe-separated alternations, leading interpreter options and `~~~` fences, reading a shell pipe as one command rather than an alternation, skipping a glob family like `review-*` instead of demanding a recipe, and *not* parsing prose, headings or captured listing output); per-recipe boundaries (**the load-bearing gate parses nothing**: every line that mentions `assignment-run.mjs` must be one of the seven pinned proof bodies and there must be exactly seven, so a header form no parser recognises still cannot hide a call site; column-0 comments are documentation and excluded), plus a normalized-text pass (`\`-continuations folded, comments stripped) and a second pass over `just --dump`, the interpreter's own rendering, skipped with a visible reason without the binary; the recipe name set must equal a pinned list, duplicate headers and duplicate `run :=` bindings are refused, `set allow-duplicate*`, `import`/`mod` in any spelling and `alias` are refused, `run :=` and `dispatch` are asserted exactly, and non-proof bodies are token-checked against raw text because comment-stripping first hid an executable suffix that `--dump` reproduced verbatim. Stated limit: drift protection, not a sandbox — a body can assemble its command at runtime, and anyone who can edit the file can already do what it does. Auto-loading a working-directory dotenv file is refused by a brake on any `set dotenv*` spelling, plus a real-`just` probe whose preload module writes a marker file itself — so the assertion is that injected code executed — paired with controls on the same entry point: explicit `--dotenv-path`, a justfile with the setting re-added, and a real `witness` recipe run both ways. Real just integration is optional and skipped when the binary is absent. No live paid smoke. |
 | Long-lived headless coordinator | `scripts/kxm-worker.mjs` | Restart limits, spawn failure, collision-resistant ownership, exact resource and tool loading, raw-output isolation, bounded RPC framing, bounded drain, hung-tool recovery, provider/model fallback, and `--continue` fallback are automated; the opt-in real-Pi gate verifies two workers, discovery, request/reply, fanout, durable restart/resume, journal, and checkpoint |
 | GitHub check signal adapter | `plugins/kxm/src/github-watch.ts` | Deterministic pagination, conclusion, retry, and per-wait delivery-generation states in `test/core/github-watch.test.ts` |
 | Operator CLI | `scripts/kxm.mjs` | Isolated workspace commands in `test/core/cli.test.ts`; the packed artifact is installed locally and with the documented global `--omit=peer` path by `test/core/package-install.test.ts` |

package/docs/workflow-guide.md

@@ -30,7 +30,9 @@ Existing claims inside preserved candidate lines are research claims, not dispat
 
 ## Selection Policy
 
-Candidate selection is measured per role. Filter stages are optional and are not mandatory Tier-0 gating. Prefer a provider-native authenticated subscription when Tracking says that harness is eligible. For Gemini candidates (`google/*`), the admitted native subscription harness on this runner is `agy` (Antigravity CLI, `agy -p`), not the OpenRouter provider id, when Tracking lists agy as eligible. Do not change the candidate ids themselves (they are dated research). Evidence and review remain workflow-specific. Both the Fable architecture critic and the Sol CLI critic remain required for this developer assignment runner.
+Candidate selection is measured per role. Filter stages are optional and are not mandatory Tier-0 gating. Prefer a provider-native authenticated subscription when Tracking says that harness is eligible. For Gemini candidates (`google/*`), the admitted route is the bundled `antigravity` **Pi
+provider** (Tracking → Decided, 2026-09-15) — not the OpenRouter provider id, and not a
+shell-out to `agy`, which stays a catalog/helper entry. Do not change the candidate ids themselves (they are dated research). Evidence and review remain workflow-specific. Both the Fable architecture critic and the Sol CLI critic remain required for this developer assignment runner.
 
 ### Cost band reference (dated candidates)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kontextmind/kxm",
-  "version": "0.7.47",
+  "version": "0.7.50",
   "description": "KXM local-first multi-agent orchestration and operator dashboard",
   "type": "module",
   "author": "KontextMind",

package/plugins/kxm/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "kxm",
   "displayName": "KXM",
-  "version": "0.7.47",
+  "version": "0.7.50",
   "description": "Headless multi-agent orchestration, durable workflows, and a live operator dashboard for Pi and Claude Code",
   "author": {
     "name": "KontextMind",

package/plugins/kxm/dist/cli.js

@@ -34732,8 +34732,9 @@ Follow [\`AGENTS.md\`](AGENTS.md). Official phase tracking:
 [\`plans/implementation-plan.md\`](plans/implementation-plan.md#tracking-working-tree-not-a-release).
 
 You are the **planner / architecture critic** unless the human explicitly asks
-you to implement. Default writer is native Grok CLI (\`grok --model grok-4.6\`).
-If \`grok\` is logged out, fail closed; do not fall back to Pi. Your reviews are
+you to implement. Default writer is native Grok CLI (\`grok --model grok-4.6\`) \u2014 a starting
+rotation, not a sole writer. If \`grok\` is logged out, never bill Grok through another harness;
+use a relief route Tracking **admits**, or stop and name the limits hit. Your reviews are
 artifacts, not hub \`peer-reply\` evidence.
 `;
   const claudeExisted = existsSync25(claudePath);
@@ -34747,8 +34748,10 @@ artifacts, not hub \`peer-reply\` evidence.
 Follow [\`AGENTS.md\`](AGENTS.md). Official phase tracking:
 [\`plans/implementation-plan.md\`](plans/implementation-plan.md#tracking-working-tree-not-a-release).
 
-Google / Antigravity CLI (\`agy\`) is an admitted native writer and experiment edit route
-for Gemini models. Starting rotation remains Grok.
+Google goes through the \`antigravity\` **Pi provider** (Tracking \u2192 Decided,
+2026-09-15); \`agy\` stays a harness catalog/helper entry, not the admission path.
+Current admissions come from Tracking and \`kxm harness list\`. Starting rotation
+remains Grok.
 `;
   const geminiExisted = existsSync25(geminiPath);
   if (updateHarnessDocument(geminiPath, block, geminiHeader)) {

package/plugins/kxm/dist/mcp-server.js

@@ -17121,7 +17121,7 @@ async function deliverInboxNotification(messageId, delivered, notify) {
 }
 
 // plugins/kxm/src/mcp-server.ts
-var VERSION = "0.7.47";
+var VERSION = "0.7.50";
 var inbox = /* @__PURE__ */ new Map();
 var notifiedInbox = /* @__PURE__ */ new Set();
 var meshClient;

package/plugins/kxm/dist/runtime-supervisor.js

@@ -18558,14 +18558,14 @@ var KxmRunEventStore = class {
     `).get(projectId, coordinatorId, idempotencyKey);
     return row ? intakeFromRow(row) : void 0;
   }
-  /** Intake rows in the given dispatch states, oldest first (stable, replay-safe order). */
+  /** Intake rows in the given dispatch states, in arrival order (replay-safe). */
   intakeInStates(projectId, states, limit = 100) {
     if (states.length === 0) return [];
     const placeholders = states.map(() => "?").join(", ");
     const rows = this.database.prepare(`
       SELECT * FROM intake_messages
       WHERE project_id = ? AND dispatch_state IN (${placeholders})
-      ORDER BY received_at ASC, message_id ASC
+      ORDER BY rowid ASC
       LIMIT ?
     `).all(projectId, ...states, limit);
     return rows.map(intakeFromRow);
@@ -18839,8 +18839,11 @@ var KxmRunEventStore = class {
 };
 function coordinatorFromRow(row) {
   const parsed = JSON.parse(row.record);
+  if (row.schema !== "kxm.coordinator.v1") {
+    throw runtimeError("coordinator_record_divergent", row.coordinator_id, `unexpected coordinator schema ${row.schema}`);
+  }
   validateCoordinator(parsed, row.coordinator_id);
-  if (parsed.coordinatorId !== row.coordinator_id || parsed.ceilingHash !== row.ceiling_hash || parsed.configRevision !== row.config_revision || parsed.boundAt !== row.bound_at) {
+  if (parsed.coordinatorId !== row.coordinator_id || parsed.projectId !== row.project_id || parsed.role !== row.role || parsed.channel !== row.channel || parsed.ceilingHash !== row.ceiling_hash || parsed.configRevision !== row.config_revision || parsed.boundAt !== row.bound_at) {
     throw runtimeError("coordinator_record_divergent", row.coordinator_id, "coordinator columns do not match the persisted record");
   }
   return {
@@ -18856,8 +18859,11 @@ function coordinatorFromRow(row) {
 }
 function intakeFromRow(row) {
   const parsed = JSON.parse(row.record);
+  if (row.schema !== "kxm.intake-message.v1") {
+    throw runtimeError("intake_record_divergent", row.message_id, `unexpected intake schema ${row.schema}`);
+  }
   validateIntakeMessage(parsed, row.message_id);
-  if (parsed.messageId !== row.message_id || parsed.contentHash !== row.content_hash || parsed.receivedAt !== row.received_at || parsed.dispatch?.state !== row.dispatch_state) {
+  if (parsed.messageId !== row.message_id || parsed.projectId !== row.project_id || parsed.coordinatorId !== row.coordinator_id || parsed.idempotencyKey !== row.idempotency_key || parsed.contentHash !== row.content_hash || parsed.receivedAt !== row.received_at || parsed.dispatch?.state !== row.dispatch_state) {
     throw runtimeError("intake_record_divergent", row.message_id, "intake columns do not match the persisted record");
   }
   return {
@@ -22191,6 +22197,7 @@ function openKxmRuntimeContext(projectRoot, options) {
       projectId: registration.projectId,
       homeRuntimeId: registration.homeRuntimeId,
       eventStore,
+      configRevision: bundle.configRevision,
       ...options.budgetClock ? { budgetClock: options.budgetClock } : {}
     };
   } catch (error) {

package/plugins/kxm/dist/runtime.js

@@ -18998,14 +18998,14 @@ var KxmRunEventStore = class {
     `).get(projectId, coordinatorId, idempotencyKey);
     return row ? intakeFromRow(row) : void 0;
   }
-  /** Intake rows in the given dispatch states, oldest first (stable, replay-safe order). */
+  /** Intake rows in the given dispatch states, in arrival order (replay-safe). */
   intakeInStates(projectId, states, limit = 100) {
     if (states.length === 0) return [];
     const placeholders = states.map(() => "?").join(", ");
     const rows = this.database.prepare(`
       SELECT * FROM intake_messages
       WHERE project_id = ? AND dispatch_state IN (${placeholders})
-      ORDER BY received_at ASC, message_id ASC
+      ORDER BY rowid ASC
       LIMIT ?
     `).all(projectId, ...states, limit);
     return rows.map(intakeFromRow);
@@ -19279,8 +19279,11 @@ var KxmRunEventStore = class {
 };
 function coordinatorFromRow(row) {
   const parsed = JSON.parse(row.record);
+  if (row.schema !== "kxm.coordinator.v1") {
+    throw runtimeError("coordinator_record_divergent", row.coordinator_id, `unexpected coordinator schema ${row.schema}`);
+  }
   validateCoordinator(parsed, row.coordinator_id);
-  if (parsed.coordinatorId !== row.coordinator_id || parsed.ceilingHash !== row.ceiling_hash || parsed.configRevision !== row.config_revision || parsed.boundAt !== row.bound_at) {
+  if (parsed.coordinatorId !== row.coordinator_id || parsed.projectId !== row.project_id || parsed.role !== row.role || parsed.channel !== row.channel || parsed.ceilingHash !== row.ceiling_hash || parsed.configRevision !== row.config_revision || parsed.boundAt !== row.bound_at) {
     throw runtimeError("coordinator_record_divergent", row.coordinator_id, "coordinator columns do not match the persisted record");
   }
   return {
@@ -19296,8 +19299,11 @@ function coordinatorFromRow(row) {
 }
 function intakeFromRow(row) {
   const parsed = JSON.parse(row.record);
+  if (row.schema !== "kxm.intake-message.v1") {
+    throw runtimeError("intake_record_divergent", row.message_id, `unexpected intake schema ${row.schema}`);
+  }
   validateIntakeMessage(parsed, row.message_id);
-  if (parsed.messageId !== row.message_id || parsed.contentHash !== row.content_hash || parsed.receivedAt !== row.received_at || parsed.dispatch?.state !== row.dispatch_state) {
+  if (parsed.messageId !== row.message_id || parsed.projectId !== row.project_id || parsed.coordinatorId !== row.coordinator_id || parsed.idempotencyKey !== row.idempotency_key || parsed.contentHash !== row.content_hash || parsed.receivedAt !== row.received_at || parsed.dispatch?.state !== row.dispatch_state) {
     throw runtimeError("intake_record_divergent", row.message_id, "intake columns do not match the persisted record");
   }
   return {
@@ -22634,6 +22640,7 @@ function openKxmRuntimeContext(projectRoot, options) {
       projectId: registration.projectId,
       homeRuntimeId: registration.homeRuntimeId,
       eventStore,
+      configRevision: bundle.configRevision,
       ...options.budgetClock ? { budgetClock: options.budgetClock } : {}
     };
   } catch (error) {

package/plugins/kxm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-plugin",
-  "version": "0.7.47",
+  "version": "0.7.50",
   "private": true,
   "type": "module",
   "engines": {

package/plugins/kxm/src/intake.ts

@@ -169,6 +169,13 @@ export function bindKxmCoordinator(
       record: kxmCanonicalJson(record as unknown as JsonValue),
     });
     if (!replaced) {
+      // Another process got the same policy through. Return its identity when it
+      // reached the ceiling we asked for; anything else is a real conflict.
+      const winner = context.eventStore.coordinatorInSlot(context.projectId, role, channel);
+      const record2 = winner ? (JSON.parse(winner.record) as KxmCoordinatorRecord) : undefined;
+      if (record2 && record2.ceilingHash === ceilingHash) {
+        return { coordinator: record2, created: false };
+      }
       throw runtimeError("coordinator_write_lost", existing.coordinatorId, "the coordinator slot changed underneath this rebind");
     }
     return { coordinator: record, created: true };
@@ -186,11 +193,10 @@ export function bindKxmCoordinator(
     authority,
     boundAt: now,
     boundBy: actor,
-    configRevision: contextConfigRevision(context),
+    configRevision: context.configRevision,
     ceilingHash,
   };
-  persistCoordinator(context, record);
-  return { coordinator: record, created: true };
+  return { ...persistCoordinator(context, record), created: true };
 }
 
 /** Resolve a coordinator by id; unknown identity fails closed. */
@@ -239,65 +245,92 @@ export function acceptKxmIntakeMessage(
   const bytes = Buffer.byteLength(input.content, "utf8");
   const contentHash = `sha256:${createHash("sha256").update(input.content, "utf8").digest("hex")}`;
 
-  const existingRow = context.eventStore.intakeBySlot(context.projectId, coordinator.coordinatorId, key);
-  if (existingRow) {
-    const existing = JSON.parse(existingRow.record) as KxmIntakeMessage;
-    if (existing.contentHash !== contentHash) {
+  // One transaction covers the slot probe, the pause read and the write, so a
+  // concurrent resume cannot strand this row in an unpaused project and a racing
+  // writer with different content cannot be mistaken for a duplicate.
+  return context.eventStore.transaction(() => {
+    const existingRow = context.eventStore.intakeBySlot(context.projectId, coordinator.coordinatorId, key);
+    if (existingRow) {
+      return { message: requireSamePayload(existingRow, contentHash, classification, key), duplicate: true };
+    }
+
+    if (bytes > MAX_INTAKE_CONTENT_BYTES) {
       throw runtimeError(
-        "intake_payload_conflict",
-        existing.messageId,
-        `idempotency key ${key} was already used with different content`,
+        "intake_content_too_large",
+        coordinator.coordinatorId,
+        `intake content is ${bytes} bytes; the limit is ${MAX_INTAKE_CONTENT_BYTES}`,
       );
     }
-    return { message: existing, duplicate: true };
-  }
 
-  if (bytes > MAX_INTAKE_CONTENT_BYTES) {
+    // Only secrets are withheld, and that guarantee is about *this layer's* storage
+    // decision: classification is supplied by the caller, so an untrusted adapter
+    // can still label a credential "project" and have it persisted here. Widening
+    // this to detection is a separate, reviewed slice.
+    const persistContent = classification !== "secret";
+    const paused = isKxmProjectPaused(context);
+    const message: KxmIntakeMessage = {
+      schema: "kxm.intake-message.v1",
+      messageId: newId("msg"),
+      projectId: context.projectId,
+      coordinatorId: coordinator.coordinatorId,
+      receivedAt: now,
+      source: { kind: sourceKind, id: sourceId },
+      idempotencyKey: key,
+      contentHash,
+      ...(persistContent ? { content: input.content } : { contentOmittedReason: "secret-classified" as const }),
+      classification,
+      dispatch: paused
+        ? { state: "held_paused", reason: "project_paused", updatedAt: now }
+        : { state: "ready" },
+    };
+    validateIntakeMessage(message, message.messageId);
+
+    const inserted = context.eventStore.insertIntakeMessageIfAbsent({
+      messageId: message.messageId,
+      projectId: message.projectId,
+      coordinatorId: message.coordinatorId,
+      idempotencyKey: message.idempotencyKey,
+      contentHash: message.contentHash,
+      receivedAt: message.receivedAt,
+      dispatchState: message.dispatch.state,
+      record: kxmCanonicalJson(message as unknown as JsonValue),
+    });
+    if (!inserted) {
+      // Lost the race for the slot. The winner is only a duplicate if it carried
+      // the same content; anything else is the same conflict we refuse serially.
+      const winner = context.eventStore.intakeBySlot(context.projectId, coordinator.coordinatorId, key);
+      if (!winner) throw runtimeError("intake_write_lost", coordinator.coordinatorId, "intake write lost its slot and left no record");
+      return { message: requireSamePayload(winner, contentHash, classification, key), duplicate: true };
+    }
+    return { message, duplicate: false };
+  });
+}
+
+function requireSamePayload(
+  row: { record: string },
+  contentHash: string,
+  classification: KxmIntakeClassification,
+  key: string,
+): KxmIntakeMessage {
+  const message = JSON.parse(row.record) as KxmIntakeMessage;
+  if (message.contentHash !== contentHash) {
     throw runtimeError(
-      "intake_content_too_large",
-      coordinator.coordinatorId,
-      `intake content is ${bytes} bytes; the limit is ${MAX_INTAKE_CONTENT_BYTES}`,
+      "intake_payload_conflict",
+      message.messageId,
+      `idempotency key ${key} was already used with different content`,
     );
   }
-
-  // Only secrets are withheld. Everything else is the project's own bounded,
-  // owner-only store; omitting project content would just lose the work.
-  const persistContent = classification !== "secret";
-  const paused = isKxmProjectPaused(context);
-  const message: KxmIntakeMessage = {
-    schema: "kxm.intake-message.v1",
-    messageId: newId("msg"),
-    projectId: context.projectId,
-    coordinatorId: coordinator.coordinatorId,
-    receivedAt: now,
-    source: { kind: sourceKind, id: sourceId },
-    idempotencyKey: key,
-    contentHash,
-    ...(persistContent ? { content: input.content } : { contentOmittedReason: "secret-classified" as const }),
-    classification,
-    dispatch: paused
-      ? { state: "held_paused", reason: "project_paused", updatedAt: now }
-      : { state: "ready" },
-  };
-  validateIntakeMessage(message, message.messageId);
-
-  const inserted = context.eventStore.insertIntakeMessageIfAbsent({
-    messageId: message.messageId,
-    projectId: message.projectId,
-    coordinatorId: message.coordinatorId,
-    idempotencyKey: message.idempotencyKey,
-    contentHash: message.contentHash,
-    receivedAt: message.receivedAt,
-    dispatchState: message.dispatch.state,
-    record: kxmCanonicalJson(message as unknown as JsonValue),
-  });
-  if (!inserted) {
-    // Lost the race against an identical key: report the winner as the duplicate.
-    const winner = context.eventStore.intakeBySlot(context.projectId, coordinator.coordinatorId, key);
-    if (!winner) throw runtimeError("intake_write_lost", coordinator.coordinatorId, "intake write lost its slot and left no record");
-    return { message: JSON.parse(winner.record) as KxmIntakeMessage, duplicate: true };
+  // Re-labelling the same payload is not a no-op: a retry marked `secret` must not
+  // quietly hand back a stored plaintext record, and a retry marked `project` must
+  // not launder a row that was withheld.
+  if (message.classification !== classification) {
+    throw runtimeError(
+      "intake_classification_conflict",
+      message.messageId,
+      `idempotency key ${key} was already recorded as ${message.classification}, not ${classification}`,
+    );
   }
-  return { message, duplicate: false };
+  return message;
 }
 
 /** Pending intake that may be dispatched, oldest first. Empty while paused. */
@@ -322,29 +355,33 @@ export function admitKxmIntakeRun(
   const runId = requireText(input.runId, "runId", 144);
   if (!COORDINATOR_ID_RE.test(runId)) throw runtimeError("intake_run_id_invalid", id, "runId is not a well-formed opaque id");
   const now = requireTimestamp(input.now ?? new Date().toISOString(), "now");
-  if (isKxmProjectPaused(context)) {
-    throw runtimeError("intake_paused", id, "the project is paused; no fresh dispatch may be admitted");
-  }
-  const row = context.eventStore.intakeMessage(id);
-  if (!row) throw runtimeError("intake_message_unknown", id, "no such intake message in this project");
-  const message = JSON.parse(row.record) as KxmIntakeMessage;
-  if (message.dispatch.state === "admitted") {
-    if (message.dispatch.runId === runId) return message;
-    throw runtimeError("intake_second_admission", id, `message already admitted as ${message.dispatch.runId}`);
-  }
-  if (message.dispatch.state !== "ready") {
-    throw runtimeError("intake_not_dispatchable", id, `intake state ${message.dispatch.state} cannot be admitted`);
-  }
-  const next: KxmIntakeMessage = { ...message, dispatch: { state: "admitted", runId, updatedAt: now } };
-  validateIntakeMessage(next, next.messageId);
-  const updated = context.eventStore.updateIntakeDispatch(id, "ready", { state: "admitted", record: kxmCanonicalJson(next as unknown as JsonValue) });
-  if (!updated) {
-    const racer = context.eventStore.intakeMessage(id);
-    const current = racer ? (JSON.parse(racer.record) as KxmIntakeMessage) : undefined;
-    if (current?.dispatch.state === "admitted" && current.dispatch.runId === runId) return current;
-    throw runtimeError("intake_dispatch_race", id, "the intake record changed underneath this admission");
-  }
-  return next;
+  // The pause read, the state read and the guarded transition commit together, so
+  // a pause cannot slip in between "not paused" and "admitted".
+  return context.eventStore.transaction(() => {
+    if (isKxmProjectPaused(context)) {
+      throw runtimeError("intake_paused", id, "the project is paused; no fresh dispatch may be admitted");
+    }
+    const row = context.eventStore.intakeMessage(id);
+    if (!row) throw runtimeError("intake_message_unknown", id, "no such intake message in this project");
+    const message = JSON.parse(row.record) as KxmIntakeMessage;
+    if (message.dispatch.state === "admitted") {
+      if (message.dispatch.runId === runId) return message;
+      throw runtimeError("intake_second_admission", id, `message already admitted as ${message.dispatch.runId}`);
+    }
+    if (message.dispatch.state !== "ready") {
+      throw runtimeError("intake_not_dispatchable", id, `intake state ${message.dispatch.state} cannot be admitted`);
+    }
+    const next: KxmIntakeMessage = { ...message, dispatch: { state: "admitted", runId, updatedAt: now } };
+    validateIntakeMessage(next, next.messageId);
+    const updated = context.eventStore.updateIntakeDispatch(id, "ready", { state: "admitted", record: kxmCanonicalJson(next as unknown as JsonValue) });
+    if (!updated) {
+      const racer = context.eventStore.intakeMessage(id);
+      const current = racer ? (JSON.parse(racer.record) as KxmIntakeMessage) : undefined;
+      if (current?.dispatch.state === "admitted" && current.dispatch.runId === runId) return current;
+      throw runtimeError("intake_dispatch_race", id, "the intake record changed underneath this admission");
+    }
+    return next;
+  });
 }
 
 /**
@@ -378,9 +415,13 @@ export function setKxmProjectPause(
     actor: record.actor,
     record: kxmCanonicalJson(record as unknown as JsonValue),
   };
-  context.eventStore.putProjectControl(control);
-  const released = input.paused ? [] : releaseHeldIntake(context, now);
-  return { control, released };
+  // Control write and the held-intent release are one transaction: a crash leaves
+  // either a paused project with held rows, or a resumed project with none.
+  return context.eventStore.transaction(() => {
+    context.eventStore.putProjectControl(control);
+    const released = input.paused ? [] : releaseHeldIntake(context, now);
+    return { control, released };
+  });
 }
 
 /** Whether fresh dispatch is currently blocked for this project. */
@@ -389,20 +430,27 @@ export function isKxmProjectPaused(context: KxmRuntimeContext): boolean {
 }
 
 function releaseHeldIntake(context: KxmRuntimeContext, now: string): KxmIntakeMessage[] {
-  const held = context.eventStore.intakeInStates(context.projectId, ["held_paused"], 500);
   const released: KxmIntakeMessage[] = [];
-  for (const row of held) {
-    const message = JSON.parse(row.record) as KxmIntakeMessage;
-    const next: KxmIntakeMessage = { ...message, dispatch: { state: "ready", updatedAt: now } };
-    validateIntakeMessage(next, next.messageId);
-    if (context.eventStore.updateIntakeDispatch(row.messageId, "held_paused", { state: "ready", record: kxmCanonicalJson(next as unknown as JsonValue) })) {
-      released.push(next);
+  // Drain every held row. A paging loop, not a single capped page: stranding the
+  // 501st message behind a "resume releases held intent" claim is a lie of omission.
+  for (let page = 0; page < 1000; page += 1) {
+    const held = context.eventStore.intakeInStates(context.projectId, ["held_paused"], 500);
+    if (held.length === 0) break;
+    for (const row of held) {
+      const message = JSON.parse(row.record) as KxmIntakeMessage;
+      const next: KxmIntakeMessage = { ...message, dispatch: { state: "ready", updatedAt: now } };
+      validateIntakeMessage(next, next.messageId);
+      if (context.eventStore.updateIntakeDispatch(row.messageId, "held_paused", { state: "ready", record: kxmCanonicalJson(next as unknown as JsonValue) })) {
+        released.push(next);
+      }
     }
+    const stillHeld = context.eventStore.intakeInStates(context.projectId, ["held_paused"], 1).length;
+    if (stillHeld === 0) break;
   }
   return released;
 }
 
-function persistCoordinator(context: KxmRuntimeContext, record: KxmCoordinatorRecord): void {
+function persistCoordinator(context: KxmRuntimeContext, record: KxmCoordinatorRecord): { coordinator: KxmCoordinatorRecord } {
   validateCoordinator(record, record.coordinatorId);
   const inserted = context.eventStore.insertCoordinatorIfAbsent({
     coordinatorId: record.coordinatorId,
@@ -414,9 +462,14 @@ function persistCoordinator(context: KxmRuntimeContext, record: KxmCoordinatorRe
     boundAt: record.boundAt,
     record: kxmCanonicalJson(record as unknown as JsonValue),
   });
-  if (!inserted) {
-    throw runtimeError("coordinator_write_lost", record.coordinatorId, "the coordinator slot was claimed underneath this bind");
-  }
+  if (inserted) return { coordinator: record };
+  // Lost the race for an empty slot: binding is create-once, so the winner is the
+  // answer whenever it reached the same ceiling. Only a different ceiling is a
+  // conflict worth reporting.
+  const winner = context.eventStore.coordinatorInSlot(record.projectId, record.role, record.channel);
+  const won = winner ? (JSON.parse(winner.record) as KxmCoordinatorRecord) : undefined;
+  if (won && won.ceilingHash === record.ceilingHash) return { coordinator: won };
+  throw runtimeError("coordinator_write_lost", record.coordinatorId, "the coordinator slot was claimed by a different ceiling");
 }
 
 function assertCeilingNotWidened(
@@ -432,10 +485,28 @@ function assertCeilingNotWidened(
   if (added.length > 0) {
     throw runtimeError("coordinator_rebind_widens_effects", coordinatorId, `a rebind may not add effects: ${added.join(", ")}`);
   }
-  const allowedBefore = new Set(previous.tools?.allow ?? []);
-  const newlyAllowed = (next.tools?.allow ?? []).filter((tool) => !allowedBefore.has(tool));
-  if (newlyAllowed.length > 0) {
-    throw runtimeError("coordinator_rebind_widens_tools", coordinatorId, `a rebind may not allow new tools: ${newlyAllowed.join(", ")}`);
+  // Tool ceilings are only narrowing-safe if every restriction is checked. An
+  // omitted list or a changed preset can select a broader default, so those moves
+  // are refused outright until their semantics are defined here.
+  if ((previous.tools === undefined) !== (next.tools === undefined)) {
+    throw runtimeError("coordinator_rebind_widens_tools", coordinatorId, "a rebind may not add or remove the tool policy");
+  }
+  if (previous.tools && next.tools) {
+    const previousTools = previous.tools;
+    const nextTools = next.tools;
+    if (previousTools.preset !== nextTools.preset) {
+      throw runtimeError("coordinator_rebind_changes_preset", coordinatorId, "a rebind may not change the tool preset; its default is not defined here");
+    }
+    const allowedBefore = new Set(previousTools.allow ?? []);
+    const newlyAllowed = (nextTools.allow ?? []).filter((tool) => !allowedBefore.has(tool));
+    if (newlyAllowed.length > 0) {
+      throw runtimeError("coordinator_rebind_widens_tools", coordinatorId, `a rebind may not allow new tools: ${newlyAllowed.join(", ")}`);
+    }
+    const deniedBefore = new Set(previousTools.deny ?? []);
+    const undenied = [...deniedBefore].filter((tool) => !(nextTools.deny ?? []).includes(tool));
+    if (undenied.length > 0) {
+      throw runtimeError("coordinator_rebind_removes_denials", coordinatorId, `a rebind may not lift denials: ${undenied.join(", ")}`);
+    }
   }
 }
 
@@ -459,16 +530,35 @@ function validateAuthority(authority: KxmCoordinatorAuthority): KxmCoordinatorAu
   const tools = authority.tools;
   if (tools !== undefined) {
     const lists = [tools.allow ?? [], tools.deny ?? []];
-    for (const list of lists) for (const tool of list) requireIdentifier(tool, "tools");
+    for (const list of lists) {
+      for (const tool of list) requireIdentifier(tool, "tools");
+      if (new Set(list).size !== list.length) {
+        throw runtimeError("coordinator_authority_invalid", "tools", "tool lists must not repeat");
+      }
+    }
     if (tools.preset !== undefined) requireIdentifier(tools.preset, "tools.preset");
   }
+  // Sets are stored canonically: order and repeats carry no authority, and leaving
+  // them as supplied would let an equivalent ceiling masquerade as a rebind.
   return {
     repositoryAccess: authority.repositoryAccess,
-    effects,
-    ...(tools !== undefined ? { tools } : {}),
+    effects: canonicalSet(effects),
+    ...(tools !== undefined
+      ? {
+          tools: {
+            ...(tools.preset !== undefined ? { preset: tools.preset } : {}),
+            ...(tools.allow !== undefined ? { allow: canonicalSet(tools.allow) } : {}),
+            ...(tools.deny !== undefined ? { deny: canonicalSet(tools.deny) } : {}),
+          },
+        }
+      : {}),
   };
 }
 
+function canonicalSet(values: readonly string[]): string[] {
+  return [...new Set(values)].sort();
+}
+
 function validateActor<T extends { kind: KxmCoordinatorRecord["boundBy"]["kind"]; id: string }>(actor: T, field: string): T {
   const kinds: string[] = ["human", "runtime", "hub", "agent", "adapter"];
   if (!actor || typeof actor !== "object" || !kinds.includes(actor.kind)) {
@@ -506,18 +596,6 @@ function requireTimestamp(value: string, field: string): string {
   return value;
 }
 
-function contextConfigRevision(context: KxmRuntimeContext): string {
-  const revision = (context as { configRevision?: string }).configRevision;
-  if (typeof revision === "string" && /^sha256:[a-f0-9]{64}$/.test(revision)) return revision;
-  // The context does not carry one: fingerprint its own identity inputs instead of
-  // inventing a revision, so drift across a reopen is still detectable.
-  return `sha256:${createHash("sha256").update(stableStringify({
-    projectId: context.projectId,
-    projectRoot: context.projectRoot,
-    homeRuntimeId: context.homeRuntimeId,
-  }), "utf8").digest("hex")}`;
-}
-
 function stableStringify(value: unknown): string {
   return JSON.stringify(sortDeep(value));
 }

package/plugins/kxm/src/mcp-server.ts

@@ -8,7 +8,7 @@ import { AGENT_COMMANDS_MAP, enforceToolPolicy, getMcpTools, reconcileInbox } fr
 import { deliverInboxNotification } from "./inbox.ts";
 import type { HubEvent, MessageRecord } from "./protocol.ts";
 
-const VERSION = "0.7.47";
+const VERSION = "0.7.50";
 const inbox = new Map<string, MessageRecord>();
 const notifiedInbox = new Set<string>();
 let meshClient: HubClient | undefined;

package/plugins/kxm/src/memory.ts

@@ -365,7 +365,7 @@ export function syncHarnessMemory(repoRoot: string): { updated: string[]; create
 
   // 2. CLAUDE.md
   const claudePath = join(root, "CLAUDE.md");
-  const claudeHeader = `# KXM (Claude)\n\nFollow [\`AGENTS.md\`](AGENTS.md). Official phase tracking:\n[\`plans/implementation-plan.md\`](plans/implementation-plan.md#tracking-working-tree-not-a-release).\n\nYou are the **planner / architecture critic** unless the human explicitly asks\nyou to implement. Default writer is native Grok CLI (\`grok --model grok-4.6\`).\nIf \`grok\` is logged out, fail closed; do not fall back to Pi. Your reviews are\nartifacts, not hub \`peer-reply\` evidence.\n`;
+  const claudeHeader = `# KXM (Claude)\n\nFollow [\`AGENTS.md\`](AGENTS.md). Official phase tracking:\n[\`plans/implementation-plan.md\`](plans/implementation-plan.md#tracking-working-tree-not-a-release).\n\nYou are the **planner / architecture critic** unless the human explicitly asks\nyou to implement. Default writer is native Grok CLI (\`grok --model grok-4.6\`) — a starting\nrotation, not a sole writer. If \`grok\` is logged out, never bill Grok through another harness;\nuse a relief route Tracking **admits**, or stop and name the limits hit. Your reviews are\nartifacts, not hub \`peer-reply\` evidence.\n`;
   const claudeExisted = existsSync(claudePath);
   if (updateHarnessDocument(claudePath, block, claudeHeader)) {
     if (claudeExisted) updated.push("CLAUDE.md");
@@ -374,7 +374,7 @@ export function syncHarnessMemory(repoRoot: string): { updated: string[]; create
 
   // 3. GEMINI.md
   const geminiPath = join(root, "GEMINI.md");
-  const geminiHeader = `# KXM (Gemini / Antigravity)\n\nFollow [\`AGENTS.md\`](AGENTS.md). Official phase tracking:\n[\`plans/implementation-plan.md\`](plans/implementation-plan.md#tracking-working-tree-not-a-release).\n\nGoogle / Antigravity CLI (\`agy\`) is an admitted native writer and experiment edit route\nfor Gemini models. Starting rotation remains Grok.\n`;
+  const geminiHeader = `# KXM (Gemini / Antigravity)\n\nFollow [\`AGENTS.md\`](AGENTS.md). Official phase tracking:\n[\`plans/implementation-plan.md\`](plans/implementation-plan.md#tracking-working-tree-not-a-release).\n\nGoogle goes through the \`antigravity\` **Pi provider** (Tracking \u2192 Decided,\n2026-09-15); \`agy\` stays a harness catalog/helper entry, not the admission path.\nCurrent admissions come from Tracking and \`kxm harness list\`. Starting rotation\nremains Grok.\n`;
   const geminiExisted = existsSync(geminiPath);
   if (updateHarnessDocument(geminiPath, block, geminiHeader)) {
     if (geminiExisted) updated.push("GEMINI.md");

package/plugins/kxm/src/runtime-service.ts

@@ -234,6 +234,8 @@ export interface KxmRuntimeContext {
   projectId: string;
   homeRuntimeId: string;
   eventStore: KxmRunEventStore;
+  /** Deterministic revision of the loaded project configuration (`sha256:...`). */
+  readonly configRevision: string;
   /**
    * Optional clock for **run-duration budget accounting only**. Budgets are
    * measured from the log's `runningSince`; this answers "what time is it now"
@@ -306,6 +308,7 @@ export function openKxmRuntimeContext(
       projectId: registration.projectId,
       homeRuntimeId: registration.homeRuntimeId,
       eventStore,
+      configRevision: bundle.configRevision,
       ...(options.budgetClock ? { budgetClock: options.budgetClock } : {}),
     };
   } catch (error) {

package/plugins/kxm/src/runtime-store.ts

@@ -1255,14 +1255,14 @@ export class KxmRunEventStore {
     return row ? intakeFromRow(row) : undefined;
   }
 
-  /** Intake rows in the given dispatch states, oldest first (stable, replay-safe order). */
+  /** Intake rows in the given dispatch states, in arrival order (replay-safe). */
   intakeInStates(projectId: string, states: readonly KxmIntakeMessageRow["dispatchState"][], limit = 100): KxmIntakeMessageRow[] {
     if (states.length === 0) return [];
     const placeholders = states.map(() => "?").join(", ");
     const rows = this.database.prepare(`
       SELECT * FROM intake_messages
       WHERE project_id = ? AND dispatch_state IN (${placeholders})
-      ORDER BY received_at ASC, message_id ASC
+      ORDER BY rowid ASC
       LIMIT ?
     `).all(projectId, ...states, limit) as unknown as IntakeSqlRow[];
     return rows.map(intakeFromRow);
@@ -1554,10 +1554,19 @@ interface ControlSqlRow {
  * whose index and payload disagree fails closed instead of trusting either.
  */
 function coordinatorFromRow(row: CoordinatorSqlRow): KxmCoordinatorRow {
-  const parsed = JSON.parse(row.record) as { coordinatorId?: string; ceilingHash?: string; configRevision?: string; boundAt?: string };
+  const parsed = JSON.parse(row.record) as {
+    coordinatorId?: string; projectId?: string; role?: string; channel?: string;
+    ceilingHash?: string; configRevision?: string; boundAt?: string;
+  };
+  if (row.schema !== "kxm.coordinator.v1") {
+    throw runtimeError("coordinator_record_divergent", row.coordinator_id, `unexpected coordinator schema ${row.schema}`);
+  }
   validateCoordinator(parsed, row.coordinator_id);
   if (
     parsed.coordinatorId !== row.coordinator_id
+    || parsed.projectId !== row.project_id
+    || parsed.role !== row.role
+    || parsed.channel !== row.channel
     || parsed.ceilingHash !== row.ceiling_hash
     || parsed.configRevision !== row.config_revision
     || parsed.boundAt !== row.bound_at
@@ -1577,10 +1586,19 @@ function coordinatorFromRow(row: CoordinatorSqlRow): KxmCoordinatorRow {
 }
 
 function intakeFromRow(row: IntakeSqlRow): KxmIntakeMessageRow {
-  const parsed = JSON.parse(row.record) as { messageId?: string; contentHash?: string; receivedAt?: string; dispatch?: { state?: string } };
+  const parsed = JSON.parse(row.record) as {
+    messageId?: string; projectId?: string; coordinatorId?: string; idempotencyKey?: string;
+    contentHash?: string; receivedAt?: string; dispatch?: { state?: string };
+  };
+  if (row.schema !== "kxm.intake-message.v1") {
+    throw runtimeError("intake_record_divergent", row.message_id, `unexpected intake schema ${row.schema}`);
+  }
   validateIntakeMessage(parsed, row.message_id);
   if (
     parsed.messageId !== row.message_id
+    || parsed.projectId !== row.project_id
+    || parsed.coordinatorId !== row.coordinator_id
+    || parsed.idempotencyKey !== row.idempotency_key
     || parsed.contentHash !== row.content_hash
     || parsed.receivedAt !== row.received_at
     || parsed.dispatch?.state !== row.dispatch_state

package/schemas/intake-message.schema.json

@@ -41,9 +41,9 @@
   "additionalProperties": false,
   "allOf": [
     {
-      "if": { "properties": { "classification": { "enum": ["public", "project", "sensitive"] } }, "required": ["classification"] },
-      "then": { "required": ["content"] },
-      "else": { "not": { "required": ["content"] } }
+      "if": { "properties": { "classification": { "const": "secret" } }, "required": ["classification"] },
+      "then": { "required": ["contentOmittedReason"], "not": { "required": ["content"] } },
+      "else": { "required": ["content"], "not": { "required": ["contentOmittedReason"] } }
     }
   ],
   "$defs": {
@@ -62,6 +62,10 @@
           "if": { "properties": { "state": { "const": "admitted" } }, "required": ["state"] },
           "then": { "required": ["runId", "updatedAt"] }
         },
+        {
+          "if": { "properties": { "state": { "not": { "const": "admitted" } } }, "required": ["state"] },
+          "then": { "not": { "required": ["runId"] } }
+        },
         {
           "if": { "properties": { "state": { "enum": ["held_paused", "refused"] } }, "required": ["state"] },
           "then": { "required": ["reason"] }