@limina-labs/momentum 0.36.0 → 0.38.0

package/adapters/antigravity/instructions/AGENTS.md

@@ -553,6 +553,13 @@ worktree) bound to one phase or ad-hoc record.
 - The Active Phase table holds **one row per active lane**
   (Phase | Branch | Status | Progress). Add your row at phase start; update
   only your row; mark it at completion.
+- **Across machines (Team Mode, v0.37.0+):** this convention is now backed by a
+  *mechanism*, not only discipline — per-actor coordination fragments
+  (`.momentum/team/`, collision-free by own-prefix construction) + `refs/momentum/*`
+  compare-and-swap for allocation (`momentum claim <phase|id|version>`).
+  `momentum team sync`/`board` compile the shared view. This makes **N humans on
+  N clones** trivially mergeable, not just N sessions on one disk; the social
+  discipline above is the fallback. See ADR-0012/0013/0014.
 
 #### Landing
 

package/adapters/codex/instructions/AGENTS.md

@@ -607,6 +607,13 @@ worktree) bound to one phase or ad-hoc record.
 - The Active Phase table holds **one row per active lane**
   (Phase | Branch | Status | Progress). Add your row at phase start; update
   only your row; mark it at completion.
+- **Across machines (Team Mode, v0.37.0+):** this convention is now backed by a
+  *mechanism*, not only discipline — per-actor coordination fragments
+  (`.momentum/team/`, collision-free by own-prefix construction) + `refs/momentum/*`
+  compare-and-swap for allocation (`momentum claim <phase|id|version>`).
+  `momentum team sync`/`board` compile the shared view. This makes **N humans on
+  N clones** trivially mergeable, not just N sessions on one disk; the social
+  discipline above is the fallback. See ADR-0012/0013/0014.
 
 #### Landing
 

package/adapters/opencode/instructions/AGENTS.md

@@ -520,6 +520,13 @@ worktree) bound to one phase or ad-hoc record.
 - The Active Phase table holds **one row per active lane**
   (Phase | Branch | Status | Progress). Add your row at phase start; update
   only your row; mark it at completion.
+- **Across machines (Team Mode, v0.37.0+):** this convention is now backed by a
+  *mechanism*, not only discipline — per-actor coordination fragments
+  (`.momentum/team/`, collision-free by own-prefix construction) + `refs/momentum/*`
+  compare-and-swap for allocation (`momentum claim <phase|id|version>`).
+  `momentum team sync`/`board` compile the shared view. This makes **N humans on
+  N clones** trivially mergeable, not just N sessions on one disk; the social
+  discipline above is the fallback. See ADR-0012/0013/0014.
 
 #### Landing
 

package/bin/momentum.js

@@ -2198,6 +2198,22 @@ async function main() {
       console.error(`\nError: ${err.message}`);
       exitCode = 1;
     }
+  } else if (args[0] === 'claim') {
+    try {
+      const { runClaim } = require('./team');
+      exitCode = runClaim(args.slice(1));
+    } catch (err) {
+      console.error(`\nError: ${err.message}`);
+      exitCode = 1;
+    }
+  } else if (args[0] === 'team') {
+    try {
+      const { runTeam } = require('./team');
+      exitCode = runTeam(args.slice(1));
+    } catch (err) {
+      console.error(`\nError: ${err.message}`);
+      exitCode = 1;
+    }
   } else {
     console.error(`Unknown command: ${args[0]}`);
     console.error('Run "momentum --help" for usage.');

package/bin/team.js

@@ -0,0 +1,235 @@
+'use strict';
+
+/**
+ * `momentum team` + `momentum claim` — git-native team coordination (Phase 30a
+ * Team-Walk, ADR-0012). No daemon; every command computes from git + files.
+ *
+ *   momentum claim <namespace> <key>   atomic cross-machine allocation (ref-CAS)
+ *   momentum team whoami               show the resolved durable actor
+ *   momentum team sync                 fetch coordination refs + recompile views
+ */
+
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const MOMENTUM_ROOT = path.resolve(__dirname, '..');
+const claimLib = require(path.join(MOMENTUM_ROOT, 'core', 'team', 'lib', 'claim'));
+const refcas = require(path.join(MOMENTUM_ROOT, 'core', 'team', 'lib', 'refcas'));
+const compile = require(path.join(MOMENTUM_ROOT, 'core', 'team', 'lib', 'compile'));
+const presenceLib = require(path.join(MOMENTUM_ROOT, 'core', 'team', 'lib', 'presence'));
+const approvalsLib = require(path.join(MOMENTUM_ROOT, 'core', 'team', 'lib', 'approvals'));
+const queueLib = require(path.join(MOMENTUM_ROOT, 'core', 'team', 'lib', 'queue'));
+const leaseLib = require(path.join(MOMENTUM_ROOT, 'core', 'team', 'lib', 'lease'));
+const { createRelay } = require(path.join(MOMENTUM_ROOT, 'core', 'team', 'relay', 'server'));
+const { CONTRACT } = require(path.join(MOMENTUM_ROOT, 'core', 'team', 'contract'));
+const identity = require(path.join(MOMENTUM_ROOT, 'core', 'identity'));
+
+function repoRoot(cwd) {
+  const r = spawnSync('git', ['rev-parse', '--show-toplevel'], { cwd, encoding: 'utf8' });
+  return r.status === 0 ? r.stdout.trim() : null;
+}
+
+function parseFlags(argv) {
+  const flags = {};
+  const positional = [];
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === '--json') flags.json = true;
+    else if (a.startsWith('--')) flags[a.slice(2)] = argv[++i];
+    else positional.push(a);
+  }
+  return { flags, positional };
+}
+
+function insideRepo(cwd) {
+  return spawnSync('git', ['rev-parse', '--git-dir'], { cwd, encoding: 'utf8' }).status === 0;
+}
+
+// ─── momentum claim ────────────────────────────────────────────────────────
+
+function runClaim(argv) {
+  const { flags, positional } = parseFlags(argv);
+  const [namespace, key] = positional;
+  if (!namespace || !key) {
+    console.error('usage: momentum claim <namespace> <key> [--remote origin] [--actor id]');
+    console.error('  e.g. momentum claim phase 30a  |  momentum claim version 0.37.0  |  momentum claim id BUG-028');
+    return 1;
+  }
+  const cwd = process.cwd();
+  if (!insideRepo(cwd)) { console.error('✗ not inside a git repository'); return 1; }
+  const actor = flags.actor || identity.resolveActor(cwd).id;
+  let res;
+  try {
+    res = claimLib.claimKey(cwd, namespace, key, { remote: flags.remote, actor });
+  } catch (err) {
+    console.error(`✗ claim failed: ${err.message}`);
+    return 1;
+  }
+  if (res.won) {
+    console.log(`✓ claimed ${namespace}/${key} as '${actor}'  (${res.ref})`);
+    return 0;
+  }
+  const who = res.winner && res.winner.actor ? res.winner.actor : 'someone else';
+  console.error(`✗ ${namespace}/${key} already claimed by '${who}' — pick another`);
+  return 2; // distinct from usage(1) so recipes can gate on "lost"
+}
+
+// ─── momentum team ─────────────────────────────────────────────────────────
+
+function runTeam(argv) {
+  const sub = argv[0];
+  const cwd = process.cwd();
+
+  // Auto-heartbeat (30d): any `momentum team` command in a repo refreshes this
+  // actor's presence — "live" liveness with no daemon. Best-effort + gated to
+  // team-active repos (a .momentum/team/ dir exists) so solo projects stay quiet.
+  try {
+    const root = repoRoot(cwd);
+    if (root && sub !== 'record' && sub !== 'heartbeat' && sub !== 'whoami' &&
+        require('fs').existsSync(path.join(root, '.momentum', 'team'))) {
+      presenceLib.heartbeat(root, identity.resolveActor(root).id, { activity: `team ${sub}` });
+    }
+  } catch { /* presence is best-effort; never fail a command on it */ }
+
+  if (sub === 'whoami') {
+    const a = identity.resolveActor(cwd);
+    console.log(`${a.id}  (source: ${a.source}${a.email ? `, ${a.email}` : ''})`);
+    return 0;
+  }
+  if (sub === 'sync') {
+    if (!insideRepo(cwd)) { console.error('✗ not inside a git repository'); return 1; }
+    const remote = argv[1] && !argv[1].startsWith('--') ? argv[1] : 'origin';
+    const ok = refcas.fetchAll(cwd, remote);
+    const root = repoRoot(cwd);
+    const rec = root ? compile.compileStatusFile(root) : { changed: false };
+    console.log(ok
+      ? `✓ synced coordination refs from ${remote} (refs/momentum/*). Fragments arrive via branch integration.`
+      : `⚠ could not fetch from ${remote} — working offline; coordination is eventually consistent`);
+    if (rec.changed) console.log('✓ recompiled the Active-Phase table in specs/status.md');
+    return 0;
+  }
+  if (sub === 'compile') {
+    const root = repoRoot(cwd);
+    if (!root) { console.error('✗ not inside a git repository'); return 1; }
+    const rec = compile.compileStatusFile(root);
+    console.log(rec.path
+      ? (rec.changed ? '✓ recompiled Active-Phase table in specs/status.md' : '✓ specs/status.md already current')
+      : 'ℹ no specs/status.md to compile into');
+    return 0;
+  }
+  if (sub === 'board') {
+    const root = repoRoot(cwd);
+    if (!root) { console.error('✗ not inside a git repository'); return 1; }
+    console.log(compile.compileActivePhase(root));
+    return 0;
+  }
+  if (sub === 'record') {
+    const root = repoRoot(cwd);
+    if (!root) { console.error('✗ not inside a git repository'); return 1; }
+    const { flags } = parseFlags(argv.slice(1));
+    if (!flags.branch) { console.error('usage: momentum team record --branch B [--phase P] [--status S] [--progress "..."]'); return 1; }
+    const actor = flags.actor || identity.resolveActor(root).id;
+    compile.recordActivePhase(root, actor, {
+      branch: flags.branch, phase: flags.phase || '', status: flags.status || '', progress: flags.progress || '',
+    });
+    console.log(`✓ recorded active-phase row for '${flags.branch}' as '${actor}'`);
+    return 0;
+  }
+  if (sub === 'heartbeat') {
+    const root = repoRoot(cwd);
+    if (!root) { console.error('✗ not inside a git repository'); return 1; }
+    const { flags } = parseFlags(argv.slice(1));
+    const actor = flags.actor || identity.resolveActor(root).id;
+    presenceLib.heartbeat(root, actor, { branch: flags.branch, lane: flags.lane, activity: flags.activity });
+    console.log(`✓ heartbeat for '${actor}'`);
+    return 0;
+  }
+  if (sub === 'presence') {
+    const root = repoRoot(cwd);
+    if (!root) { console.error('✗ not inside a git repository'); return 1; }
+    const now = Date.now();
+    const list = presenceLib.presence(root, now);
+    if (!list.length) { console.log('(no presence recorded)'); return 0; }
+    for (const p of list) {
+      console.log(`${p.liveness === 'active' ? '●' : p.liveness === 'idle' ? '◐' : '○'} ${p.actor}  ${p.liveness}  ${p.branch || ''}${p.activity ? '  — ' + p.activity : ''}`);
+    }
+    return 0;
+  }
+  if (sub === 'approve') {
+    const root = repoRoot(cwd);
+    if (!root) { console.error('✗ not inside a git repository'); return 1; }
+    const { flags, positional } = parseFlags(argv.slice(1));
+    const change = positional[0];
+    if (!change) { console.error('usage: momentum team approve <change> [--verdict approve|reject]'); return 1; }
+    const actor = flags.actor || identity.resolveActor(root).id;
+    approvalsLib.approve(root, actor, change, { verdict: flags.verdict || 'approve' });
+    console.log(`✓ ${flags.verdict === 'reject' ? 'rejected' : 'approved'} '${change}' as '${actor}'`);
+    return 0;
+  }
+  if (sub === 'check') {
+    const root = repoRoot(cwd);
+    if (!root) { console.error('✗ not inside a git repository'); return 1; }
+    const { flags, positional } = parseFlags(argv.slice(1));
+    const change = positional[0];
+    if (!change || !flags.author) { console.error('usage: momentum team check <change> --author <a> [--threshold N] [--allow-self]'); return 1; }
+    const threshold = flags.threshold ? parseInt(flags.threshold, 10) : 1;
+    const allowSelf = argv.includes('--allow-self');
+    const approvers = approvalsLib.approversFor(root, change, flags.author, allowSelf);
+    if (approvers.length >= threshold) {
+      console.log(`✓ '${change}' satisfied — ${approvers.length}/${threshold} approval(s): ${approvers.join(', ')}`);
+      return 0;
+    }
+    console.error(`✗ '${change}' not satisfied — ${approvers.length}/${threshold} peer approval(s)${allowSelf ? '' : ' (author self-approval does not count)'}`);
+    return 2;
+  }
+  if (sub === 'turn') {
+    const root = repoRoot(cwd);
+    if (!root) { console.error('✗ not inside a git repository'); return 1; }
+    const action = argv[1];
+    const runway = argv[2] || 'main';
+    const actor = identity.resolveActor(root).id;
+    if (action === 'take') {
+      const r = queueLib.takeTurn(root, runway, actor);
+      if (r.held) { console.log(`✓ took the '${runway}' landing turn as '${actor}'`); return 0; }
+      console.error(`✗ '${runway}' turn held by '${r.holder}' — wait or coordinate`); return 2;
+    }
+    if (action === 'release') { queueLib.releaseTurn(root, runway); console.log(`✓ released the '${runway}' turn`); return 0; }
+    if (action === 'holder') { const h = queueLib.turnHolder(root, runway); console.log(h ? `${runway}: held by '${h}'` : `${runway}: free`); return 0; }
+    console.error('usage: momentum team turn <take|release|holder> [runway]');
+    return 1;
+  }
+  if (sub === 'lease') {
+    const root = repoRoot(cwd);
+    if (!root) { console.error('✗ not inside a git repository'); return 1; }
+    const action = argv[1];
+    const resource = argv[2];
+    if (!action || !resource) { console.error('usage: momentum team lease <acquire|release|owner> <resource>'); return 1; }
+    const actor = identity.resolveActor(root).id;
+    if (action === 'acquire') {
+      const r = leaseLib.acquireLease(root, resource, actor);
+      if (r.held) { console.log(`✓ leased '${resource}' as '${actor}'`); return 0; }
+      console.error(`✗ '${resource}' leased by '${r.owner}'`); return 2;
+    }
+    if (action === 'release') { leaseLib.releaseLease(root, resource); console.log(`✓ released lease '${resource}'`); return 0; }
+    if (action === 'owner') { const o = leaseLib.leaseOwner(root, resource); console.log(o ? `${resource}: owned by '${o}'` : `${resource}: free`); return 0; }
+    console.error('usage: momentum team lease <acquire|release|owner> <resource>');
+    return 1;
+  }
+  if (sub === 'contract') {
+    console.log(JSON.stringify(CONTRACT, null, 2));
+    return 0;
+  }
+  if (sub === 'relay') {
+    const { flags } = parseFlags(argv.slice(1));
+    const relay = createRelay({ port: flags.port ? parseInt(flags.port, 10) : 0 });
+    relay.listen((port) => {
+      console.log(`✓ momentum coordination relay (authority-free) on http://127.0.0.1:${port}`);
+      console.log(`  set relay_url=http://127.0.0.1:${port} for teammates; Ctrl-C to stop.`);
+    });
+    return 0; // server keeps the process alive
+  }
+  console.error('usage: momentum team <whoami|sync|board|record|compile|heartbeat|presence|approve|check|turn|lease|contract|relay>');
+  return 1;
+}
+
+module.exports = { runTeam, runClaim };

package/core/commands/brainstorm-phase.md

@@ -73,6 +73,11 @@ The brainstorm output IS the phase files — there is no intermediate design doc
    ```bash
    rm .momentum/brainstorm-active
    ```
+   **Reserve the phase number first (team-safe — multi-session):** run
+   `momentum claim phase <N>`. If a concurrent session already grabbed that
+   number the claim loses (exit 2) — pick the next free number before writing,
+   so two people brainstorming at once can't both create "Phase N".
+
    Then write all four files to `specs/phases/phase-N-shortname/` and commit:
    ```bash
    git add specs/phases/phase-N-shortname/

package/core/commands/complete-phase.md

@@ -91,6 +91,11 @@ Verify, finalize, and release a completed phase.
    release creation and registry publishes are NOT listed here — they run
    from `specs/project-rules.md` + `specs/config.md` (`release_command`,
    `publish_target`, `release_flow`) after the tag is pushed.
+
+   **Reserve the version first (team-safe — ENH-057):** before tagging, run
+   `momentum claim version vX.Y.Z`. If another session already reserved that
+   version the claim loses (exit 2) — re-read the intended version and re-pick,
+   so two concurrent releases can never burn a version number.
    ```
    Ready to release vX.Y.Z. This will:
      1. Merge phase-N-shortname → <branch_flow[0]> (e.g. staging)

package/core/commands/hotfix.md

@@ -33,6 +33,9 @@ verification gate. For net-new features or cross-cutting work, use
 
 5. **Track it** (Rule 3): ensure the backlog has a row (`/track` if not). A
    pure chore with no backlog id is fine — note "Backlog: none" in the record.
+   **Team-safe (multi-session):** when assigning a NEW backlog id
+   (`BUG`/`FEAT`/`TD`/`ENH-NNN`), reserve it first with `momentum claim id <ID>`;
+   if it loses (exit 2) another session already filed that number — pick the next.
 
 6. **Do the work.** Commit with Conventional Commits (the `commit-msg` hook
    enforces this). Keep commits atomic.

package/core/config-templates.js

@@ -25,6 +25,10 @@ const KNOWN_KEYS = [
   'end_state',
   'branch_flow',
   'protected_branches',
+  'review_min_approvals',
+  'review_self_approval',
+  'presence_idle_seconds',
+  'presence_offline_seconds',
 ];
 
 const LIST_KEYS = new Set(['branch_flow', 'protected_branches']);

package/core/config.js

@@ -44,6 +44,12 @@ const DEFAULTS = Object.freeze({
   end_state: 'merge-after-yes',
   branch_flow: ['staging', 'main'],
   protected_branches: ['staging', 'main'],
+  // Team-mode (30d, ENH-064) — off by default so single-operator behavior is
+  // unchanged. review_min_approvals ≥ 1 turns on the reviewer≠author land gate.
+  review_min_approvals: '0',
+  review_self_approval: 'false',
+  presence_idle_seconds: '600',
+  presence_offline_seconds: '3600',
 });
 
 // Enumerations — a value outside the set resolves to the default + warning.

package/core/git-hooks/run-check.js

@@ -128,6 +128,16 @@ function prePush() {
         } catch {
           /* ignore */
         }
+        // Team-mode (Phase 30d): record WHO authorized this protected push
+        // (attributed audit). Best-effort — an audit-log failure must NEVER
+        // block a push, so the whole thing is wrapped and swallowed.
+        try {
+          const who = (require('child_process')
+            .execSync('git config user.email', { cwd: root }).toString().trim()) || 'unknown';
+          const line = `${new Date().toISOString()}  ${who}  authorized push to ${branch}  (${parsed.localSha.slice(0, 7)})\n`;
+          fs.mkdirSync(path.join(root, '.momentum', 'team'), { recursive: true });
+          fs.appendFileSync(path.join(root, '.momentum', 'team', 'merge-approvals.log'), line);
+        } catch { /* never block a push on an audit-log failure */ }
         process.stderr.write(
           `  momentum: '${C.CONTRACT.mergeApprovedSentinel}' consumed — push to '${branch}' authorized.\n`
         );

package/core/identity/index.js

@@ -0,0 +1,66 @@
+'use strict';
+
+/**
+ * Actor identity (Phase 30a Team-Walk, ADR-0012).
+ *
+ * momentum was identity-blind — "actors" were random per-process UUIDs
+ * (bin/swarm.js) and branch names (core/lanes/lib/signals.js). Team mode needs
+ * a DURABLE actor so coordination writes, claims, and approvals can say WHO.
+ *
+ * The zero-config source is git's own identity (`git config user.email` /
+ * `user.name`), overridable by $MOMENTUM_ACTOR, with a deterministic fallback
+ * (stable per repo+user) when git identity is unset. No accounts, no server.
+ *
+ * Zero dependencies — node builtins only.
+ */
+
+const crypto = require('crypto');
+const { spawnSync } = require('child_process');
+
+function git(cwd, ...args) {
+  const res = spawnSync('git', args, { cwd, encoding: 'utf8' });
+  if (res.status !== 0) return null;
+  return res.stdout.trim();
+}
+
+/** Slugify an email/name into a stable, path-safe actor id. */
+function slug(s) {
+  const out = String(s)
+    .toLowerCase()
+    .trim()
+    .replace(/@.*$/, '') // email local-part
+    .replace(/[^a-z0-9]+/g, '-')
+    .replace(/^-+|-+$/g, '')
+    .slice(0, 40);
+  return out || 'anon';
+}
+
+/**
+ * Resolve the durable actor for `cwd`.
+ * Precedence: $MOMENTUM_ACTOR → git config user.email → deterministic fallback.
+ * `env` is injectable for testing (defaults to process.env).
+ * Returns { id, name, email, source }.
+ */
+function resolveActor(cwd, env) {
+  env = env || process.env;
+  const dir = cwd || process.cwd();
+
+  const override = env.MOMENTUM_ACTOR && env.MOMENTUM_ACTOR.trim();
+  if (override) {
+    return { id: slug(override), name: override, email: null, source: 'env' };
+  }
+
+  const email = git(dir, 'config', 'user.email');
+  const name = git(dir, 'config', 'user.name');
+  if (email) {
+    return { id: slug(email), name: name || email, email, source: 'git' };
+  }
+
+  // Deterministic fallback — stable per repo+user without a git identity.
+  const root = git(dir, 'rev-parse', '--show-toplevel') || dir;
+  const user = env.USER || env.USERNAME || 'unknown';
+  const h = crypto.createHash('sha256').update(`${user}::${root}`).digest('hex').slice(0, 8);
+  return { id: `anon-${h}`, name: `anon-${h}`, email: null, source: 'fallback' };
+}
+
+module.exports = { resolveActor, slug };

package/core/instructions/rules-body.md

@@ -371,6 +371,13 @@ worktree) bound to one phase or ad-hoc record.
 - The Active Phase table holds **one row per active lane**
   (Phase | Branch | Status | Progress). Add your row at phase start; update
   only your row; mark it at completion.
+- **Across machines (Team Mode, v0.37.0+):** this convention is now backed by a
+  *mechanism*, not only discipline — per-actor coordination fragments
+  (`.momentum/team/`, collision-free by own-prefix construction) + `refs/momentum/*`
+  compare-and-swap for allocation (`momentum claim <phase|id|version>`).
+  `momentum team sync`/`board` compile the shared view. This makes **N humans on
+  N clones** trivially mergeable, not just N sessions on one disk; the social
+  discipline above is the fallback. See ADR-0012/0013/0014.
 
 #### Landing
 

package/core/lanes/lib/land.js

@@ -43,6 +43,8 @@ const { spawnSync } = require('child_process');
 const state = require('./state');
 const cleanup = require('./cleanup');
 const config = require('../../config');
+const approvals = require('../../team/lib/approvals');
+const identity = require('../../identity');
 
 function git(cwd, ...args) {
   return spawnSync('git', args, { cwd, encoding: 'utf8' });
@@ -257,6 +259,23 @@ function cmdLand(cwd, argv) {
   checks.push(`${gate.ok ? '✓' : '✗'} gate[${lane.grade}]: ${gate.detail}`);
   if (!gate.ok) ok = false;
 
+  // 4b. reviewer≠author gate (Team-mode, config-gated — ENH-064). Off by default
+  // (review_min_approvals=0) so single-operator behavior is unchanged.
+  let reviewCfg = {};
+  try { reviewCfg = config.readConfig(path.join(repoRoot, 'specs')) || {}; } catch { /* absent */ }
+  const minApprovals = parseInt(reviewCfg.review_min_approvals, 10) || 0;
+  if (minApprovals >= 1) {
+    const lander = identity.resolveActor(cwd).id;
+    const allowSelf = String(reviewCfg.review_self_approval).toLowerCase() === 'true';
+    const peers = approvals.approversFor(repoRoot, id, lander, allowSelf);
+    if (peers.length >= minApprovals) {
+      checks.push(`✓ review: ${peers.length}/${minApprovals} approval(s) (${peers.join(', ')})`);
+    } else {
+      checks.push(`✗ review: ${peers.length}/${minApprovals} peer approval(s) — needs review by someone other than '${lander}' (they run: momentum team approve ${id})`);
+      ok = false;
+    }
+  }
+
   // 5. overlap advisory
   for (const w of state.overlapWarnings(anchor, id, lane.touches)) {
     checks.push(`⚠ touch overlap with '${w.laneId}': ${w.mine} ↔ ${w.theirs} (advisory)`);

package/core/lanes/lib/signals.js

@@ -25,6 +25,7 @@ const path = require('path');
 const { spawnSync } = require('child_process');
 
 const state = require('./state');
+const identity = require('../../identity');
 
 const SEQ_WIDTH = 4;
 
@@ -120,6 +121,7 @@ function cmdSignal(cwd, argv) {
         type,
         text: text || null,
         from: currentBranch(cwd),
+        actor: identity.resolveActor(cwd).id, // Team-mode: durable "who" (ENH-064)
         at: new Date().toISOString(),
       });
     });

package/core/specs-templates/CLAUDE.md

@@ -399,6 +399,13 @@ worktree) bound to one phase or ad-hoc record.
 - The Active Phase table holds **one row per active lane**
   (Phase | Branch | Status | Progress). Add your row at phase start; update
   only your row; mark it at completion.
+- **Across machines (Team Mode, v0.37.0+):** this convention is now backed by a
+  *mechanism*, not only discipline — per-actor coordination fragments
+  (`.momentum/team/`, collision-free by own-prefix construction) + `refs/momentum/*`
+  compare-and-swap for allocation (`momentum claim <phase|id|version>`).
+  `momentum team sync`/`board` compile the shared view. This makes **N humans on
+  N clones** trivially mergeable, not just N sessions on one disk; the social
+  discipline above is the fallback. See ADR-0012/0013/0014.
 
 #### Landing
 

package/core/swarm/lib/manifest.js

@@ -488,6 +488,31 @@ function assertOwnership(manifest, repo, sessionId, nowIso) {
   };
 }
 
+/**
+ * Cross-machine lease fence (Phase 30d, ENH-064). OPT-IN via
+ * MOMENTUM_SWARM_LEASE_CAS=1: when active AND the ecosystem root is a git repo
+ * with a remote, taking over an EXPIRED lease must also win a
+ * refs/momentum/leases/* compare-and-swap — so clock skew can't let two machines
+ * both take over. Fail-open: only BLOCKS on a positively-confirmed different
+ * owner; never blocks on absence/network (the wall-clock lease then governs, as
+ * before). Default OFF → single-machine swarm behavior is unchanged.
+ */
+function leaseFence(ecosystemRoot, key, holder) {
+  if (process.env.MOMENTUM_SWARM_LEASE_CAS !== '1') return { fenced: true, active: false };
+  try {
+    const { spawnSync } = require('child_process');
+    const remotes = spawnSync('git', ['remote'], { cwd: ecosystemRoot, encoding: 'utf8' });
+    if (remotes.status !== 0 || !remotes.stdout.trim()) return { fenced: true, active: false };
+    const lease = require('../../team/lib/lease');
+    const res = lease.acquireLease(ecosystemRoot, key, holder);
+    if (res.held) return { fenced: true, active: true };
+    if (res.owner && res.owner !== holder) return { fenced: false, active: true, owner: res.owner };
+    return { fenced: true, active: false }; // couldn't positively confirm → fail-open
+  } catch {
+    return { fenced: true, active: false };
+  }
+}
+
 /**
  * Read-modify-write that enforces ownership of a specific repo BEFORE
  * applying the mutation. Throws on rejection.
@@ -520,6 +545,16 @@ function updateManifestAsOwner(args) {
       err.decision = decision;
       throw err;
     }
+    // Cross-machine fence: a wall-clock takeover must also win the ref-CAS
+    // lease (opt-in; no-op by default). Closes the clock-skew double-own hazard.
+    if (decision.expired) {
+      const fence = leaseFence(ecosystemRoot, `swarm-${swarmId}-${repo}`, sessionId);
+      if (!fence.fenced) {
+        const err = new Error(`updateManifestAsOwner: takeover fenced — "${repo}" lease held by ${fence.owner} (refs/momentum/leases)`);
+        err.code = 'EOWNERSHIP';
+        throw err;
+      }
+    }
     const result = mutate(current, decision);
     let mutated = current;
     if (result && typeof result === 'object' && 'manifest' in result) {

package/core/team/contract/index.js

@@ -0,0 +1,41 @@
+'use strict';
+
+/**
+ * Published coordination contract (Phase 30c Team-Fly, ADR-0014).
+ *
+ * The versioned, third-party-consumable description of momentum's git-native
+ * team-coordination state — the fragment layout and the `refs/momentum/*`
+ * namespace — so dashboards, CI, or other tools can read team state without
+ * momentum. Realizes the Lanes-arc "publish the lane-state contract" decision
+ * (ADR-0003 §5). Breaking changes bump CONTRACT_VERSION (pinned by a test).
+ *
+ * Zero dependencies.
+ */
+
+const CONTRACT_VERSION = '1.0.0';
+
+const CONTRACT = {
+  version: CONTRACT_VERSION,
+  fragments: {
+    location: '.momentum/team/<view>/<actor>-<seq>-<kind>.json  (committed)',
+    views: ['active-phase', 'presence', 'approvals'],
+    shape: { actor: 'string', seq: 'number', ts: 'iso8601', kind: 'string', payload: 'object' },
+    invariant: 'an actor writes only files prefixed with its own <actor>- → conflict-free by construction',
+  },
+  refs: {
+    namespace: 'refs/momentum/*  (fetched via +refs/momentum/*:refs/momentum/*)',
+    claims: 'refs/momentum/{claims,version,phase,id}/<key>   first-push-wins allocation',
+    queue: 'refs/momentum/queue/<runway>-holder             single-holder landing turn',
+    leases: 'refs/momentum/leases/<resource>                single-owner cross-machine lease',
+    payload: 'empty-tree commit whose message is JSON { actor, key, ts, ... }',
+  },
+  relay: {
+    optional: true,
+    authorityFree: true,
+    protocol: 1,
+    endpoints: ['POST /publish', 'GET /events?since=N', 'GET /health'],
+    absence: 'no relay_url → git-native fallback; nothing depends on it',
+  },
+};
+
+module.exports = { CONTRACT, CONTRACT_VERSION };