@lanes-sh/link 0.8.0 → 0.9.1

package/README.md

@@ -12,10 +12,7 @@ that speaks MCP — reaches all of it through that one endpoint. Change your AI
 context, because none of it ever lived in the agent. Open source, self-hostable, no vendor in the
 middle of your data.
 
-<picture>
-  <source media="(prefers-color-scheme: dark)" srcset="docs/images/lanes-link-dark.svg">
-  <img alt="Claude, Codex, and Gemini all reach one Lanes Link endpoint, which you run yourself. Beneath it sit the profiles it serves: personal, holding Gmail, Memory, and Skills; and work, holding Gmail, Calendar, and Docs." src="docs/images/lanes-link-light.svg">
-</picture>
+![Left: every agent wired directly to every account, each line crossing the others. Right: the same three agents reaching one Lanes Link endpoint, which fans out to Gmail, GitHub, Slack, memory, skills, and a task list through an Access Profile named engineering.](docs/images/lanes-link-hero.png)
 
 ## Why
 
@@ -81,27 +78,6 @@ tool and worth stating plainly; what it is not is a dependency per request. The
 to sign in and to refresh, and a machine offline for a day keeps serving. `lanes link token
 show` still mints a static token for CI, which has no browser to sign in with.
 
-## In the Lanes desktop app
-
-Prefer not to use a terminal? The [Lanes desktop app](https://lanes.sh/desktop) drives this CLI from
-a settings page. **Settings → Integrations → Lanes Link** installs it, holds the profile and
-workspace every command runs against, starts and stops the endpoint, and registers it with Claude
-Code or Codex. From 0.8.0 your connections, profiles and audit log are on the
-[Lanes dashboard](https://lanes.sh/dashboard/link) instead, which reads your endpoint directly over
-loopback: run `lanes link pair` once to let it.
-
-![The Lanes Link page in the Lanes desktop app: the CLI status card and its version, the workspace and profile selectors, the endpoint row with its running state, and the list of connected accounts.](docs/images/lanes-link-desktop.png)
-
-It runs the commands above rather than reimplementing them, so consent and the token stay here where
-they belong, and an endpoint set up in the app is the same one you get from a shell. Available from
-Lanes v0.47.0, as a research preview.
-
-```console
-$ lanes link desktop     # opens the app on that page, installing it if it is not there
-```
-
-**[How to use it →](https://lanes.sh/docs/desktop/lanes-link)**
-
 ## What you keep in it
 
 Not "what your agent gets" — the distinction is the whole point. These are yours. An agent is a

package/instructions/skills/lanes-link/SKILL.md

@@ -107,7 +107,7 @@ when Y", that is a skill they should write, not a memory entry describing it.
 
 ## Reach for memory before answering from nothing
 
-`memory.search` before concluding you do not know something about this person or
+`lanes_memory.search` before concluding you do not know something about this person or
 their work. It is a substring search over their own notes, not a ranked index —
 try more than one wording before deciding it is not there.
 
@@ -118,7 +118,7 @@ entries with `lanes link memory list --profile <name> --workspace <name>` and a
 
 ## Tasks have a status, so finish them rather than deleting them
 
-`tasks.list` answers what is outstanding. It shows `in_progress`, `open` and
+`lanes_tasks.list` answers what is outstanding. It shows `in_progress`, `open` and
 `blocked` and hides the rest, so a listing is what is left to do rather than
 everything that ever was — name a status to see more.
 
@@ -133,7 +133,7 @@ Six of them, and the two that are easy to confuse are worth learning:
 | `done` | finished |
 | `dropped` | decided against, which is not the same as finished |
 
-**Closing a task is `tasks.update` with a status, never `tasks.remove`.** The
+**Closing a task is `lanes_tasks.update` with a status, never `lanes_tasks.remove`.** The
 record of having done it is the useful half, and it is what stops the same thing
 being suggested again next week. Remove is for something recorded by mistake.
 
@@ -180,7 +180,7 @@ value has been printed by accident, say so.
 ## Who you are writing as is declared, not inferred
 
 A profile may declare the names, addresses and handles its owner wants used when
-something is written as them. Call `identity_list` for the profile in play
+something is written as them. Call `lanes_identity_list` for the profile in play
 before signing a message, choosing an address to send from, or attributing work
 to a handle — **do not** read a name off the conversation, off a previous
 message's signature, or off the account label on a connection. That label is the
@@ -200,7 +200,7 @@ Nothing you can call writes here, deliberately.
 
 ## Who you are writing *to* is declared as well
 
-`entities_find` holds the people, companies and projects this owner deals with,
+`lanes_entities_find` holds the people, companies and projects this owner deals with,
 with the addresses and handles to reach each of them. Call it before using
 anyone's address — do not recall one from earlier in the conversation, and do
 not lift one off a message you happen to have read.
@@ -218,9 +218,9 @@ Where an entity holds two of a kind — a work address and a personal one — th
 first is the default and the notes say when to prefer the other, exactly as
 identity works.
 
-Writing is a separate grant. Where you have it, `entities_write` declares one
-and `entities_link` relates two; a field you do not send is left as it is.
-`entities_forget` does not clean up edges pointing at what it removed, and says
+Writing is a separate grant. Where you have it, `lanes_entities_write` declares one
+and `lanes_entities_link` relates two; a field you do not send is left as it is.
+`lanes_entities_forget` does not clean up edges pointing at what it removed, and says
 which ones will dangle.
 
 ## Attachments are named, not carried
@@ -279,9 +279,9 @@ shows what was attempted, refusals included.
 
 ## Setting something up
 
-Call `setup_overview` before answering any question about what you can reach, and
+Call `lanes_setup_overview` before answering any question about what you can reach, and
 before suggesting that anything be connected. It names the accounts reachable in a
-profile and the providers that are not connected yet. `setup_provider` then gives
+profile and the providers that are not connected yet. `lanes_setup_provider` then gives
 one provider's console steps, the values it will ask for, and the exact command.
 
 **Memory, tasks, assets, skills and the vault need no setup at all.** They hold
@@ -306,7 +306,7 @@ lanes link policy allow gmail.users.messages.list --connection gmail.<id> --prof
 profiles that grant it, which is the answer when an owner says an account they
 connected is not showing up somewhere.
 
-**Take the command from `setup_provider`; never compose one yourself.** It carries
+**Take the command from `lanes_setup_provider`; never compose one yourself.** It carries
 the right profile and, where the provider stores a credential per account, the
 `--id` it needs. A command you assembled is one the owner pastes and watches fail.
 
@@ -326,7 +326,7 @@ it needs, print the scopes and let the owner add the flag. Deciding that is thei
 
 **A new connection is served at once; the tools you were handed are not.**
 Connecting publishes the config to wherever that workspace's endpoint reads it and
-asks the endpoint to re-read it, so a `setup_overview` straight after connecting
+asks the endpoint to re-read it, so a `lanes_setup_overview` straight after connecting
 *does* show the account. What has not changed is the set of tools this session
 was given when it connected — the endpoint does not announce that its tools
 changed, so a capability for a freshly connected account is not callable until

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lanes-sh/link",
-  "version": "0.8.0",
+  "version": "0.9.1",
   "description": "A self-hostable MCP gateway for all your connections, memory, tasks, files, and secrets",
   "license": "Apache-2.0",
   "homepage": "https://lanes.sh/link",

package/src/auth/oauth/store.ts

@@ -1,4 +1,4 @@
-import type { KeyValueStore } from '#stores/state';
+import { OAUTH_NAMESPACE, type KeyValueStore } from '#stores/state';
 
 /**
  * What an authorization server has to remember.
@@ -20,10 +20,26 @@ import type { KeyValueStore } from '#stores/state';
  * living about a minute.
  */
 
-const CLIENTS = 'oauth/clients';
-const CODES = 'oauth/codes';
-const TOKENS = 'oauth/tokens';
-const PENDING = 'oauth/pending';
+// Derived from `OAUTH_NAMESPACE`, not spelled. These were `oauth/clients` and
+// the rest while the namespace constant said `oauth.v1`, so the contract-4
+// migration moved every record to a key nothing read — every signed-in client
+// logged out, which is the outcome the migration exists to prevent. Worse, an
+// undotted namespace is not a workspace one, so `isWorkspaceNamespace` sent
+// live records into one profile's store: `profile remove <primary>` would take
+// the endpoint's registrations with it.
+const CLIENTS = `${OAUTH_NAMESPACE}/clients`;
+const CODES = `${OAUTH_NAMESPACE}/codes`;
+const TOKENS = `${OAUTH_NAMESPACE}/tokens`;
+const PENDING = `${OAUTH_NAMESPACE}/pending`;
+
+/**
+ * The four, for the test that holds them to `isWorkspaceNamespace`.
+ *
+ * Exported rather than retyped there: the pairing between what this module
+ * writes and where state routing sends it is the thing that broke, so the test
+ * reads the names off the module that owns them.
+ */
+export const OAUTH_SUBSPACES: readonly string[] = [CLIENTS, CODES, TOKENS, PENDING];
 
 /** Far above any real number of connectors, and far below a problem. */
 const MAX_CLIENTS = 200;

package/src/cli/accepts.ts

@@ -39,11 +39,12 @@ export const ACCEPTS: Record<string, readonly string[]> = {
   ],
   setup: ['id'],
   'profile add': ['workspace', 'non-interactive'],
-  // `--target` decommissions one target's stores and leaves the profile file in
-  // place (`removal.ts`). It is documented in `usage.ts` and read by
-  // `removalPlan`, and was refused here — the flag existed everywhere except in
-  // the list that decides whether it may be typed.
-  'profile remove': ['dry-run', 'yes', 'workspace'],
+  // `--delete-data` and `--migrate-to` say what becomes of the bytes the
+  // profile owns (ADR-066). Neither is optional in effect: `--yes` skips
+  // confirmations of things the command was told to do, and this is a question
+  // it has not been asked, so a run with no terminal is refused rather than
+  // guessing.
+  'profile remove': ['dry-run', 'yes', 'workspace', 'delete-data', 'migrate-to'],
   'profile members': ['me', 'role'],
   disconnect: ['yes', 'keep-credential'],
   // The one repair `doctor` can apply rather than only name. Narrow on purpose:

package/src/cli/brand.ts

@@ -13,17 +13,19 @@
  * Values are transcribed from https://lanes.sh/design/foundations. The rules
  * they express, which the CSS below encodes rather than restates:
  *
- * - **Gold is the only accent.** "Gold for positive, neutral tokens otherwise."
- *   That is why there is no green here: a connection that works is `positive`,
- *   which is gold, and everything else is one of two neutrals. `--destructive`
- *   is for errors, not for a state that merely needs attention.
+ * - **Emerald is the only accent.** "Accent for positive, neutral tokens
+ *   otherwise." A connection that works is `positive`, which is the accent, and
+ *   everything else is one of two neutrals. `--destructive` is for errors, not
+ *   for a state that merely needs attention. The accent was gold until emerald
+ *   replaced it site-wide; there is still only one.
  * - **Two weights, 400 and 500.** Nothing else is available in the loaded faces,
  *   so a heavier rule would silently synthesise.
  * - **Lora heads, Geist speaks, Geist Mono for code and eyebrow labels.**
  *
- * `--border`, `--accent-gold` and `--destructive` are constant across themes.
- * Only the five neutrals swap, which is why the dark block below is five lines
- * rather than a second stylesheet.
+ * `--border` and `--destructive` are constant across themes. The five neutrals
+ * swap, and so does `--accent-brand`: the deep emerald goes illegible on the
+ * dark ground, so dark mode takes the brighter value. That is why the dark block
+ * below is six lines rather than a second stylesheet.
  */
 
 /**
@@ -61,7 +63,7 @@ export const FONTS =
 
 /** The one-row footer, identical to the one the Lanes API's own pages carry. */
 export const FOOTER =
-  '<div class="footer"><p>Your unfair advantage in parallel AI coding. ' +
+  '<div class="footer"><p>Run many agents at once. Connect them to your tools once - ' +
   '<a href="https://lanes.sh/">lanes.sh</a></p></div>';
 
 /**
@@ -85,13 +87,13 @@ export const TOKENS = `
   --foreground: #171717;
   --muted-foreground: #202329;
   --border: rgba(120,113,108,0.2);
-  --accent-gold: #A1845A;
+  --accent-brand: #059669;
   --destructive: #A06060;
   /* The two tints the badge variants need. Spelled as rgba rather than
      color-mix because the consent screen opens in whatever browser a phone
      happens to use, and both accents are constant across themes anyway. */
-  --gold-fill: rgba(161,132,90,0.1);
-  --gold-ring: rgba(161,132,90,0.25);
+  --brand-fill: rgba(5,150,105,0.1);
+  --brand-ring: rgba(5,150,105,0.25);
   --destructive-fill: rgba(160,96,96,0.1);
   --destructive-ring: rgba(160,96,96,0.25);
   --sans: "Geist", -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
@@ -105,6 +107,9 @@ export const TOKENS = `
     --muted: #202329;
     --foreground: #EBEAE7;
     --muted-foreground: #A8A29E;
+    --accent-brand: #34D399;
+    --brand-fill: rgba(52,211,153,0.1);
+    --brand-ring: rgba(52,211,153,0.25);
   }
 }
 * { box-sizing: border-box; }
@@ -124,21 +129,21 @@ a { color: inherit; }
 /* Surfaces are dashed and 10px; controls are 6px; pills are round. */
 .surface { background: var(--card); border: 1px dashed var(--border); border-radius: 10px; }
 
-/* The four badge variants, as the design system defines them: gold for
+/* The four badge variants, as the design system defines them: the accent for
    positive, neutral tokens otherwise, destructive for an error only. The ring
    is an inset shadow so it costs no layout, exactly as \`ring-inset\` does. */
 .pill { display: inline-flex; align-items: center; flex: none; white-space: nowrap;
         font-size: 11px; font-weight: 500; letter-spacing: 0.02em;
         padding: 2px 8px; border-radius: 999px; box-shadow: inset 0 0 0 1px var(--border); }
-.pill.positive { background: var(--gold-fill); color: var(--accent-gold);
-                 box-shadow: inset 0 0 0 1px var(--gold-ring); }
+.pill.positive { background: var(--brand-fill); color: var(--accent-brand);
+                 box-shadow: inset 0 0 0 1px var(--brand-ring); }
 .pill.neutral { background: var(--muted); color: var(--muted-foreground); }
 .pill.quiet { background: transparent; color: var(--muted-foreground); opacity: 0.7; }
 .pill.negative { background: var(--destructive-fill); color: var(--destructive);
                  box-shadow: inset 0 0 0 1px var(--destructive-ring); }
 
 /* Ghost is the variant every button on these pages is: muted until it is
-   wanted, and never gold, because gold is reserved for saying a thing is good. */
+   wanted, and never the accent, which is reserved for saying a thing is good. */
 .btn { font: inherit; font-size: 12px; font-weight: 500; line-height: 1;
        padding: 6px 9px; border-radius: 6px; cursor: pointer;
        background: transparent; color: var(--muted-foreground);

package/src/cli/callback-page.ts

@@ -16,11 +16,12 @@
  *   hardcoded `#0d1117` that read as a black rectangle on a light machine. The
  *   system names a background per mode, so the fix is now to paint the right
  *   one. `color-scheme` stays, for form controls and scrollbars.
- * - **The success mark is gold, not green.** It was lucide's `check` at
- *   `#059669`, chosen to match the tick the Lanes app puts against a connected
- *   integration. The design system is explicit that gold is the only accent and
- *   "gold for positive, neutral tokens otherwise", so the green was the odd one
- *   out rather than the match it was meant to be.
+ * - **The success mark carries the accent.** It is lucide's `check` at
+ *   `--accent-brand`, which matches the tick the Lanes app puts against a
+ *   connected integration. This went the long way round: the mark was `#059669`,
+ *   was changed to gold because the design system allowed one accent and gold
+ *   was it, and is emerald again now that emerald is that one accent. The rule
+ *   never moved, only the colour it points at.
  *
  * What has not changed is that colour is reserved for status and spent nowhere
  * else — not on emphasis, and not on the heading.
@@ -49,14 +50,14 @@ body { display: flex; align-items: center; justify-content: center;
 .label { margin: 0 0 6px; font-size: 15px; font-weight: 500; color: var(--muted-foreground); }
 h1 { margin: 0 0 18px; }
 .detail { margin: 0; font-size: 15px; line-height: 1.6; color: var(--muted-foreground); }
-.icon { display: block; margin: 0 auto 18px; color: var(--accent-gold); }
+.icon { display: block; margin: 0 auto 18px; color: var(--accent-brand); }
 .err h1 { color: var(--destructive); }
 `.trim();
 
 /**
  * The success mark, above the label.
  *
- * lucide's `check`, in `--accent-gold` — which is what "gold for positive"
+ * lucide's `check`, in `--accent-brand` - which is what "accent for positive"
  * means when the positive thing is a connection that now works. It carries no
  * colour of its own; `.icon` sets it, so it follows the token if the token moves.
  *

package/src/cli/commands/connect/index.ts

@@ -35,6 +35,7 @@ import { settleIdentity } from './settle.ts';
 import { runStrategySetup } from './strategy.ts';
 import { announceConnectTarget } from './target-note.ts';
 import { unknownProvider } from './unknown.ts';
+import { DISCOVERY_NAMESPACE } from '#stores/state';
 
 const PROVISIONAL_ID = 'pending';
 
@@ -265,7 +266,7 @@ export async function runConnect(
       credentials: runtime.credentials,
       connectorFor: address.connectorFor,
       remember: async (found) => {
-        await runtime.state.kv.set('discovery', providerId, JSON.stringify(found));
+        await runtime.state.kv.set(DISCOVERY_NAMESPACE, providerId, JSON.stringify(found));
         registry.setDiscovered(providerId, found);
       },
     });

package/src/cli/commands/connect/settle.ts

@@ -3,7 +3,7 @@ import { bearerTokenAsStored } from '#connectivity/auth/index.ts';
 import type { SecretStore } from '#secrets';
 import type { ConnectionConfig, Config } from '#profile';
 import type { AnyConnector, ProviderManifest } from '#connectivity';
-import { idFromAccount, resolveAccount } from '../../identity.ts';
+import { nextConnectionId, resolveAccount } from '../../identity.ts';
 import { style } from '../../output.ts';
 import { PromptCancelled, terminalPrompter, type Prompter } from '../../prompt.ts';
 import { accountSiblings } from './accounts.ts';
@@ -151,15 +151,23 @@ export async function settleIdentity(input: {
     typed = true;
   }
 
-  const taken = siblings.map((candidate) => candidate.id);
+  // Every id in the workspace, not this provider's alone. An id is opaque now,
+  // so a reader has nothing but the number to go on and two rows sharing one
+  // across providers would be a needless second thing to hold in mind — and
+  // `con3` naming exactly one row is what makes it usable in a refusal.
+  const taken = runtime.workspaceConnections.map((candidate) => candidate.id);
 
+  // The reconnect match is on the *account*, which is what tells a repair from
+  // a second row. That is the whole reason `resolveAccount` runs before this:
+  // without it a failed attempt appends rather than repairs, which is how
+  // `Gmail main3` came to exist.
   const connectionId =
     explicitId ??
     (unaccounted
-      ? idFromAccount('main', taken)
+      ? nextConnectionId(taken, true)
       : (siblings.find(
           (candidate) => candidate.account.toLowerCase() === account!.toLowerCase(),
-        )?.id ?? idFromAccount(account, taken)));
+        )?.id ?? nextConnectionId(taken, false)));
 
   return {
     connectionId,

package/src/cli/commands/connection.ts

@@ -7,6 +7,7 @@ import {
   readConnections,
   type ConnectionConfig,
   type Resolution,
+  layout,
 } from '#profile';
 import { ConfigDocument } from '../config-edit.ts';
 import { announce, announceWorkspace, emit, ok, print, style, warn } from '../output.ts';
@@ -230,7 +231,7 @@ export async function removeConnection(
     // refused at load, while a connection nothing grants is merely unused. So if
     // the process dies between the two writes, the workspace still opens.
     for (const profile of affected) {
-      const document = await ConfigDocument.openKey(root, `profiles/${profile}.yaml`);
+      const document = await ConfigDocument.openKey(root, layout.profileConfig(profile));
       if (dropGrantRow(document, key)) await document.save();
     }
 

package/src/cli/commands/identity.ts

@@ -37,9 +37,9 @@ export interface IdentityListing {
   readonly reachable: boolean;
 }
 
-/** Whether a rule list puts `identity.*` in force, in either spelling. */
+/** Whether a rule list puts `lanes_identity.*` in force, in either spelling. */
 function covers(rules: ReadonlyArray<{ capability: string }>): boolean {
-  return rules.some((rule) => rule.capability === '*' || rule.capability === 'identity.*');
+  return rules.some((rule) => rule.capability === '*' || rule.capability === 'lanes_identity.*');
 }
 
 /**
@@ -61,7 +61,7 @@ function readable(config: {
   // (ADR-058). The old shape could say "declared but not granted" and
   // "granted but not declared", and both served nothing while reading like
   // configuration that worked; neither is expressible here.
-  const grant = config.grants.find((row) => row.connection.startsWith('identity.'));
+  const grant = config.grants.find((row) => row.connection.startsWith('lanes_identity.'));
   if (grant === undefined) return false;
 
   return covers(grant.allow) && !covers(grant.deny);
@@ -244,7 +244,7 @@ export async function identityList(options: { json?: boolean } & GlobalFlags): P
       print(warn('declared, but no agent can read it'));
       print(
         style.dim(
-          '      the identity surface needs a connection row and an identity.* allow rule;',
+          '      the identity surface needs a connection row and a lanes_identity.* allow rule;',
         ),
       );
       print(style.dim('      adding an entry with this command writes both.'));

package/src/cli/commands/knowledge/index.ts

@@ -115,11 +115,7 @@ async function useGithub(flags: KnowledgeFlags): Promise<void> {
 
     // Nothing is written until this returns: the token is asked for, the
     // repository is probed, and either can refuse while the profile is intact.
-    const secrets = await openSecretStoreFor(
-      runtime.config,
-      runtime.resolution.workspaceRoot,
-      runtime.target,
-    );
+    const secrets = await openSecretStoreFor(runtime.resolution.workspaceRoot, runtime.target);
     const token = await resolveToken(secrets, knowledge.token_ref, knowledge.repo, selection, {
       replace: flags.replace,
     });
@@ -205,11 +201,7 @@ async function useLocal(flags: KnowledgeFlags): Promise<void> {
 
     // Built here rather than taken from `runtime.knowledge`, so both directions
     // of this command reach the repository through one constructor.
-    const secrets = await openSecretStoreFor(
-      runtime.config,
-      runtime.resolution.workspaceRoot,
-      runtime.target,
-    );
+    const secrets = await openSecretStoreFor(runtime.resolution.workspaceRoot, runtime.target);
     const token = await resolveToken(secrets, knowledge.token_ref, knowledge.repo, selection);
     const repository = repositoryFor(knowledge, token, flags.fetch);
 
@@ -270,12 +262,13 @@ async function openLocalStores(
     },
     runtime.credentials,
   );
-  // The *granted* connection, not the profile name. `layout.skills` changed
-  // meaning without changing arity at ADR-059, so the compiler was silent.
-  const skillsConnection = soleGrantFor(runtime.config, 'skills');
+  // The *granted* connection, beside the profile. `layout.skills` changed
+  // meaning without changing arity at ADR-059, so the compiler was silent;
+  // ADR-066 put the profile back in front of it, and it is an argument now.
+  const skillsConnection = soleGrantFor(runtime.config, 'lanes_skills');
   return {
     storage: factory(),
-    skills: skillsConnection === undefined ? null : factory(layout.skills(skillsConnection)),
+    skills: skillsConnection === undefined ? null : factory(layout.skills(runtime.config.instance.profile, skillsConnection)),
   };
 }
 
@@ -349,7 +342,7 @@ function grantedInstances(config: Parameters<typeof soleGrantFor>[0]): {
   entities: string;
 } {
   return {
-    memory: soleGrantFor(config, 'memory') ?? 'main',
-    entities: soleGrantFor(config, 'entities') ?? 'main',
+    memory: soleGrantFor(config, 'lanes_memory') ?? 'main',
+    entities: soleGrantFor(config, 'lanes_entities') ?? 'main',
   };
 }

package/src/cli/commands/knowledge/migrate.ts

@@ -1,6 +1,7 @@
 import {
   ConfigError,
   KNOWLEDGE_LAYOUT,
+  KNOWLEDGE_PREFIX,
   knowledgeRoot,
   type KnowledgeArea,
   type KnowledgeConfig,
@@ -81,10 +82,14 @@ function localAreas(
     // personal's repository and then deleted them locally, leaving `work`
     // reading an empty store with no knowledge block of its own. `skills` was
     // already connection-scoped, which is why it alone was correct.
+    // `scope` reads the *local* store and `prefix` names the repository
+    // directory, and since contract 4 those are different strings:
+    // `lanes_memory/lan1/` on disk becomes `memory/lan1/` in the repository.
+    // Reading one where the other belongs finds nothing and reports success.
     memory: {
       store: storage,
-      scope: `${KNOWLEDGE_LAYOUT.memory}/${instances.memory}/`,
-      prefix: `${KNOWLEDGE_LAYOUT.memory}/`,
+      scope: `${KNOWLEDGE_PREFIX.memory}/${instances.memory}/`,
+      prefix: `${KNOWLEDGE_PREFIX.memory}/`,
     },
     // Null becomes an empty area rather than a refusal: a profile granting no
     // skills connection has none to move, and `knowledge use` should still move
@@ -93,8 +98,8 @@ function localAreas(
     skills: { store: skills ?? EMPTY_AREA, scope: '', prefix: '' },
     entities: {
       store: storage,
-      scope: `${KNOWLEDGE_LAYOUT.entities}/${instances.entities}/`,
-      prefix: `${KNOWLEDGE_LAYOUT.entities}/`,
+      scope: `${KNOWLEDGE_PREFIX.entities}/${instances.entities}/`,
+      prefix: `${KNOWLEDGE_PREFIX.entities}/`,
     },
   };
 }

package/src/cli/commands/knowledge/show.ts

@@ -1,4 +1,4 @@
-import { KNOWLEDGE_LAYOUT, layout, soleGrantFor } from '#profile';
+import { KNOWLEDGE_LAYOUT, KNOWLEDGE_PREFIX, layout, soleGrantFor } from '#profile';
 import { announce, emit, heading, print, style, table } from '../../output.ts';
 import { openRuntime } from '../../runtime.ts';
 import type { KnowledgeFlags } from './index.ts';
@@ -20,12 +20,16 @@ export async function knowledgeShow(flags: KnowledgeFlags): Promise<void> {
     const profile = runtime.config.instance.profile;
     const selection = ` --profile ${runtime.resolution.profile} --target ${runtime.target}`;
     const skills = runtime.skills ? (await runtime.skills.list()).length : 0;
-    const memory = (await runtime.storage.list(`${KNOWLEDGE_LAYOUT.memory}/`)).length;
-    const entities = (await runtime.storage.list(`${KNOWLEDGE_LAYOUT.entities}/`)).length;
+    // Counted through the *provider's* prefix, which is what the local store is
+    // scoped into; `KNOWLEDGE_LAYOUT` is the repository's directory name and
+    // since contract 4 the two are different strings. Counting by the wrong one
+    // reports zero for a profile whose memory is perfectly well populated.
+    const memory = (await runtime.storage.list(`${KNOWLEDGE_PREFIX.memory}/`)).length;
+    const entities = (await runtime.storage.list(`${KNOWLEDGE_PREFIX.entities}/`)).length;
     const where = runtime.knowledge?.describe;
     // Null when no skills connection is granted (ADR-059). The row still prints,
     // saying so: a missing row reads as "there are none", not "not granted".
-    const skillsConnection = soleGrantFor(runtime.config, 'skills');
+    const skillsConnection = soleGrantFor(runtime.config, 'lanes_skills');
 
     if (flags.json) {
       print(
@@ -41,11 +45,12 @@ export async function knowledgeShow(flags: KnowledgeFlags): Promise<void> {
     heading('Knowledge');
     table([
       // The memory *directory*, not the blob root it sits in. `layout.blobs`
-      // is `data/`, which is where every provider's namespace lives —
-      // printing it here would name a directory that is mostly not memory.
+      // is the profile's own directory, which is where every provider's
+      // namespace lives — printing it here would name a directory that is
+      // mostly not memory.
       [
         '  memory',
-        where ? `${where}/${KNOWLEDGE_LAYOUT.memory}` : `${layout.blobs()}/${KNOWLEDGE_LAYOUT.memory}`,
+        where ? `${where}/${KNOWLEDGE_LAYOUT.memory}` : `${layout.blobs(profile)}/${KNOWLEDGE_PREFIX.memory}`,
         style.dim(`${memory} file${memory === 1 ? '' : 's'}`),
       ],
       [
@@ -53,7 +58,7 @@ export async function knowledgeShow(flags: KnowledgeFlags): Promise<void> {
         where
           ? `${where}/${KNOWLEDGE_LAYOUT.skills}`
           : skillsConnection
-            ? layout.skills(skillsConnection)
+            ? layout.skills(profile, skillsConnection)
             : style.dim('not granted'),
         style.dim(`${skills} file${skills === 1 ? '' : 's'}`),
       ],
@@ -64,7 +69,7 @@ export async function knowledgeShow(flags: KnowledgeFlags): Promise<void> {
         '  entities',
         where
           ? `${where}/${KNOWLEDGE_LAYOUT.entities}`
-          : `${layout.blobs()}/${KNOWLEDGE_LAYOUT.entities}`,
+          : `${layout.blobs(profile)}/${KNOWLEDGE_PREFIX.entities}`,
         style.dim(`${entities} file${entities === 1 ? '' : 's'}`),
       ],
     ]);

package/src/cli/commands/operate/migrate.ts

@@ -71,7 +71,7 @@ export async function migratedRenamedProviders(
   // Throws when it is malformed beyond a rename, which is a better sentence
   // than the referential one it would otherwise be reported under.
   const config = shapeOf(await ConfigDocument.open(root, selection.profile));
-  const credentials = await openSecretStoreFor(config, root, target);
+  const credentials = await openSecretStoreFor(root, target);
 
   const migration = await migrateRenamedProviders(document, profiles, credentials, {
     apply: flags.fix === true,
@@ -158,7 +158,10 @@ export async function migratedContract(flags: RenameFlags, refusal: unknown): Pr
   // only about contract 1 — so a contract-2 bucket, the exact thing this
   // function exists to rescue, returned false here and fell through to the
   // refusal it was supposed to fix. With `--fix` absent this writes nothing.
-  const migration = await migrateToCurrentContract(where, { apply: flags.fix === true });
+  const migration = await migrateToCurrentContract(where, {
+    apply: flags.fix === true,
+    target,
+  });
   if (migration.alreadyCurrent) return false;
 
   const applied = flags.fix === true;

package/src/cli/commands/operate/pair.ts

@@ -121,7 +121,7 @@ export async function pair(flags: PairFlags, deps: PairDeps = {}): Promise<void>
 
   const chosen = named ?? profiles[0]!;
   const host = chosen.config.instance.host;
-  const credentials = await openSecretStoreFor(chosen.config, root, target);
+  const credentials = await openSecretStoreFor(root, target);
 
   // A workspace that declares a deployment is paired over the address the
   // platform gave it, not over loopback — which is what `declared.deploy`

package/src/cli/commands/operate/serve.ts

@@ -2,7 +2,7 @@ import { readSession } from '#auth/lanes/session.ts';
 import { ConfigError } from '#profile';
 import { startEndpoint } from '#server/endpoint.ts';
 import { streamLogger } from '#server/logging.ts';
-import { repairOwnerLayer } from '../../config-repair.ts';
+import { repairOwnerLayer } from '../../config-repair-sweep.ts';
 import { announce, ok, print, style, warn } from '../../output.ts';
 import { staleNudge } from '../../release.ts';
 import { primaryProfile, resolveProfile, type GlobalFlags } from '../../runtime.ts';

package/src/cli/commands/owner/assets.ts

@@ -127,6 +127,6 @@ export async function assetsRemove(name: string | undefined, flags: OwnerFlags):
  * it is built from the same two functions rather than spelled as a path.
  */
 export function assetsStore(runtime: Runtime, flags: OwnerFlags): BlobStore {
-  const connection = ownerConnection(runtime.config, 'assets', flags);
-  return scopeBlobStore(runtime.storage, scopeNamespace('assets', connection));
+  const connection = ownerConnection(runtime.config, 'lanes_assets', flags);
+  return scopeBlobStore(runtime.storage, scopeNamespace('lanes_assets', connection));
 }

package/src/cli/commands/owner/entities.ts

@@ -239,6 +239,6 @@ export async function entitiesReindex(flags: OwnerFlags): Promise<void> {
  * `memoryStore` gives: a path spelled out again is a path that can differ.
  */
 export function entitiesStore(runtime: Runtime, flags: OwnerFlags): BlobStore {
-  const connection = ownerConnection(runtime.config, 'entities', flags);
-  return scopeBlobStore(runtime.storage, scopeNamespace('entities', connection));
+  const connection = ownerConnection(runtime.config, 'lanes_entities', flags);
+  return scopeBlobStore(runtime.storage, scopeNamespace('lanes_entities', connection));
 }