@limina-labs/momentum 0.37.0 → 0.38.0

package/adapters/antigravity/instructions/AGENTS.md

@@ -553,6 +553,13 @@ worktree) bound to one phase or ad-hoc record.
 - The Active Phase table holds **one row per active lane**
   (Phase | Branch | Status | Progress). Add your row at phase start; update
   only your row; mark it at completion.
+- **Across machines (Team Mode, v0.37.0+):** this convention is now backed by a
+  *mechanism*, not only discipline — per-actor coordination fragments
+  (`.momentum/team/`, collision-free by own-prefix construction) + `refs/momentum/*`
+  compare-and-swap for allocation (`momentum claim <phase|id|version>`).
+  `momentum team sync`/`board` compile the shared view. This makes **N humans on
+  N clones** trivially mergeable, not just N sessions on one disk; the social
+  discipline above is the fallback. See ADR-0012/0013/0014.
 
 #### Landing
 

package/adapters/codex/instructions/AGENTS.md

@@ -607,6 +607,13 @@ worktree) bound to one phase or ad-hoc record.
 - The Active Phase table holds **one row per active lane**
   (Phase | Branch | Status | Progress). Add your row at phase start; update
   only your row; mark it at completion.
+- **Across machines (Team Mode, v0.37.0+):** this convention is now backed by a
+  *mechanism*, not only discipline — per-actor coordination fragments
+  (`.momentum/team/`, collision-free by own-prefix construction) + `refs/momentum/*`
+  compare-and-swap for allocation (`momentum claim <phase|id|version>`).
+  `momentum team sync`/`board` compile the shared view. This makes **N humans on
+  N clones** trivially mergeable, not just N sessions on one disk; the social
+  discipline above is the fallback. See ADR-0012/0013/0014.
 
 #### Landing
 

package/adapters/opencode/instructions/AGENTS.md

@@ -520,6 +520,13 @@ worktree) bound to one phase or ad-hoc record.
 - The Active Phase table holds **one row per active lane**
   (Phase | Branch | Status | Progress). Add your row at phase start; update
   only your row; mark it at completion.
+- **Across machines (Team Mode, v0.37.0+):** this convention is now backed by a
+  *mechanism*, not only discipline — per-actor coordination fragments
+  (`.momentum/team/`, collision-free by own-prefix construction) + `refs/momentum/*`
+  compare-and-swap for allocation (`momentum claim <phase|id|version>`).
+  `momentum team sync`/`board` compile the shared view. This makes **N humans on
+  N clones** trivially mergeable, not just N sessions on one disk; the social
+  discipline above is the fallback. See ADR-0012/0013/0014.
 
 #### Landing
 

package/bin/team.js

@@ -79,6 +79,18 @@ function runClaim(argv) {
 function runTeam(argv) {
   const sub = argv[0];
   const cwd = process.cwd();
+
+  // Auto-heartbeat (30d): any `momentum team` command in a repo refreshes this
+  // actor's presence — "live" liveness with no daemon. Best-effort + gated to
+  // team-active repos (a .momentum/team/ dir exists) so solo projects stay quiet.
+  try {
+    const root = repoRoot(cwd);
+    if (root && sub !== 'record' && sub !== 'heartbeat' && sub !== 'whoami' &&
+        require('fs').existsSync(path.join(root, '.momentum', 'team'))) {
+      presenceLib.heartbeat(root, identity.resolveActor(root).id, { activity: `team ${sub}` });
+    }
+  } catch { /* presence is best-effort; never fail a command on it */ }
+
   if (sub === 'whoami') {
     const a = identity.resolveActor(cwd);
     console.log(`${a.id}  (source: ${a.source}${a.email ? `, ${a.email}` : ''})`);

package/core/commands/brainstorm-phase.md

@@ -73,6 +73,11 @@ The brainstorm output IS the phase files — there is no intermediate design doc
    ```bash
    rm .momentum/brainstorm-active
    ```
+   **Reserve the phase number first (team-safe — multi-session):** run
+   `momentum claim phase <N>`. If a concurrent session already grabbed that
+   number the claim loses (exit 2) — pick the next free number before writing,
+   so two people brainstorming at once can't both create "Phase N".
+
    Then write all four files to `specs/phases/phase-N-shortname/` and commit:
    ```bash
    git add specs/phases/phase-N-shortname/

package/core/commands/complete-phase.md

@@ -91,6 +91,11 @@ Verify, finalize, and release a completed phase.
    release creation and registry publishes are NOT listed here — they run
    from `specs/project-rules.md` + `specs/config.md` (`release_command`,
    `publish_target`, `release_flow`) after the tag is pushed.
+
+   **Reserve the version first (team-safe — ENH-057):** before tagging, run
+   `momentum claim version vX.Y.Z`. If another session already reserved that
+   version the claim loses (exit 2) — re-read the intended version and re-pick,
+   so two concurrent releases can never burn a version number.
    ```
    Ready to release vX.Y.Z. This will:
      1. Merge phase-N-shortname → <branch_flow[0]> (e.g. staging)

package/core/commands/hotfix.md

@@ -33,6 +33,9 @@ verification gate. For net-new features or cross-cutting work, use
 
 5. **Track it** (Rule 3): ensure the backlog has a row (`/track` if not). A
    pure chore with no backlog id is fine — note "Backlog: none" in the record.
+   **Team-safe (multi-session):** when assigning a NEW backlog id
+   (`BUG`/`FEAT`/`TD`/`ENH-NNN`), reserve it first with `momentum claim id <ID>`;
+   if it loses (exit 2) another session already filed that number — pick the next.
 
 6. **Do the work.** Commit with Conventional Commits (the `commit-msg` hook
    enforces this). Keep commits atomic.

package/core/config-templates.js

@@ -25,6 +25,10 @@ const KNOWN_KEYS = [
   'end_state',
   'branch_flow',
   'protected_branches',
+  'review_min_approvals',
+  'review_self_approval',
+  'presence_idle_seconds',
+  'presence_offline_seconds',
 ];
 
 const LIST_KEYS = new Set(['branch_flow', 'protected_branches']);

package/core/config.js

@@ -44,6 +44,12 @@ const DEFAULTS = Object.freeze({
   end_state: 'merge-after-yes',
   branch_flow: ['staging', 'main'],
   protected_branches: ['staging', 'main'],
+  // Team-mode (30d, ENH-064) — off by default so single-operator behavior is
+  // unchanged. review_min_approvals ≥ 1 turns on the reviewer≠author land gate.
+  review_min_approvals: '0',
+  review_self_approval: 'false',
+  presence_idle_seconds: '600',
+  presence_offline_seconds: '3600',
 });
 
 // Enumerations — a value outside the set resolves to the default + warning.

package/core/git-hooks/run-check.js

@@ -128,6 +128,16 @@ function prePush() {
         } catch {
           /* ignore */
         }
+        // Team-mode (Phase 30d): record WHO authorized this protected push
+        // (attributed audit). Best-effort — an audit-log failure must NEVER
+        // block a push, so the whole thing is wrapped and swallowed.
+        try {
+          const who = (require('child_process')
+            .execSync('git config user.email', { cwd: root }).toString().trim()) || 'unknown';
+          const line = `${new Date().toISOString()}  ${who}  authorized push to ${branch}  (${parsed.localSha.slice(0, 7)})\n`;
+          fs.mkdirSync(path.join(root, '.momentum', 'team'), { recursive: true });
+          fs.appendFileSync(path.join(root, '.momentum', 'team', 'merge-approvals.log'), line);
+        } catch { /* never block a push on an audit-log failure */ }
         process.stderr.write(
           `  momentum: '${C.CONTRACT.mergeApprovedSentinel}' consumed — push to '${branch}' authorized.\n`
         );

package/core/instructions/rules-body.md

@@ -371,6 +371,13 @@ worktree) bound to one phase or ad-hoc record.
 - The Active Phase table holds **one row per active lane**
   (Phase | Branch | Status | Progress). Add your row at phase start; update
   only your row; mark it at completion.
+- **Across machines (Team Mode, v0.37.0+):** this convention is now backed by a
+  *mechanism*, not only discipline — per-actor coordination fragments
+  (`.momentum/team/`, collision-free by own-prefix construction) + `refs/momentum/*`
+  compare-and-swap for allocation (`momentum claim <phase|id|version>`).
+  `momentum team sync`/`board` compile the shared view. This makes **N humans on
+  N clones** trivially mergeable, not just N sessions on one disk; the social
+  discipline above is the fallback. See ADR-0012/0013/0014.
 
 #### Landing
 

package/core/lanes/lib/land.js

@@ -43,6 +43,8 @@ const { spawnSync } = require('child_process');
 const state = require('./state');
 const cleanup = require('./cleanup');
 const config = require('../../config');
+const approvals = require('../../team/lib/approvals');
+const identity = require('../../identity');
 
 function git(cwd, ...args) {
   return spawnSync('git', args, { cwd, encoding: 'utf8' });
@@ -257,6 +259,23 @@ function cmdLand(cwd, argv) {
   checks.push(`${gate.ok ? '✓' : '✗'} gate[${lane.grade}]: ${gate.detail}`);
   if (!gate.ok) ok = false;
 
+  // 4b. reviewer≠author gate (Team-mode, config-gated — ENH-064). Off by default
+  // (review_min_approvals=0) so single-operator behavior is unchanged.
+  let reviewCfg = {};
+  try { reviewCfg = config.readConfig(path.join(repoRoot, 'specs')) || {}; } catch { /* absent */ }
+  const minApprovals = parseInt(reviewCfg.review_min_approvals, 10) || 0;
+  if (minApprovals >= 1) {
+    const lander = identity.resolveActor(cwd).id;
+    const allowSelf = String(reviewCfg.review_self_approval).toLowerCase() === 'true';
+    const peers = approvals.approversFor(repoRoot, id, lander, allowSelf);
+    if (peers.length >= minApprovals) {
+      checks.push(`✓ review: ${peers.length}/${minApprovals} approval(s) (${peers.join(', ')})`);
+    } else {
+      checks.push(`✗ review: ${peers.length}/${minApprovals} peer approval(s) — needs review by someone other than '${lander}' (they run: momentum team approve ${id})`);
+      ok = false;
+    }
+  }
+
   // 5. overlap advisory
   for (const w of state.overlapWarnings(anchor, id, lane.touches)) {
     checks.push(`⚠ touch overlap with '${w.laneId}': ${w.mine} ↔ ${w.theirs} (advisory)`);

package/core/lanes/lib/signals.js

@@ -25,6 +25,7 @@ const path = require('path');
 const { spawnSync } = require('child_process');
 
 const state = require('./state');
+const identity = require('../../identity');
 
 const SEQ_WIDTH = 4;
 
@@ -120,6 +121,7 @@ function cmdSignal(cwd, argv) {
         type,
         text: text || null,
         from: currentBranch(cwd),
+        actor: identity.resolveActor(cwd).id, // Team-mode: durable "who" (ENH-064)
         at: new Date().toISOString(),
       });
     });

package/core/specs-templates/CLAUDE.md

@@ -399,6 +399,13 @@ worktree) bound to one phase or ad-hoc record.
 - The Active Phase table holds **one row per active lane**
   (Phase | Branch | Status | Progress). Add your row at phase start; update
   only your row; mark it at completion.
+- **Across machines (Team Mode, v0.37.0+):** this convention is now backed by a
+  *mechanism*, not only discipline — per-actor coordination fragments
+  (`.momentum/team/`, collision-free by own-prefix construction) + `refs/momentum/*`
+  compare-and-swap for allocation (`momentum claim <phase|id|version>`).
+  `momentum team sync`/`board` compile the shared view. This makes **N humans on
+  N clones** trivially mergeable, not just N sessions on one disk; the social
+  discipline above is the fallback. See ADR-0012/0013/0014.
 
 #### Landing
 

package/core/swarm/lib/manifest.js

@@ -488,6 +488,31 @@ function assertOwnership(manifest, repo, sessionId, nowIso) {
   };
 }
 
+/**
+ * Cross-machine lease fence (Phase 30d, ENH-064). OPT-IN via
+ * MOMENTUM_SWARM_LEASE_CAS=1: when active AND the ecosystem root is a git repo
+ * with a remote, taking over an EXPIRED lease must also win a
+ * refs/momentum/leases/* compare-and-swap — so clock skew can't let two machines
+ * both take over. Fail-open: only BLOCKS on a positively-confirmed different
+ * owner; never blocks on absence/network (the wall-clock lease then governs, as
+ * before). Default OFF → single-machine swarm behavior is unchanged.
+ */
+function leaseFence(ecosystemRoot, key, holder) {
+  if (process.env.MOMENTUM_SWARM_LEASE_CAS !== '1') return { fenced: true, active: false };
+  try {
+    const { spawnSync } = require('child_process');
+    const remotes = spawnSync('git', ['remote'], { cwd: ecosystemRoot, encoding: 'utf8' });
+    if (remotes.status !== 0 || !remotes.stdout.trim()) return { fenced: true, active: false };
+    const lease = require('../../team/lib/lease');
+    const res = lease.acquireLease(ecosystemRoot, key, holder);
+    if (res.held) return { fenced: true, active: true };
+    if (res.owner && res.owner !== holder) return { fenced: false, active: true, owner: res.owner };
+    return { fenced: true, active: false }; // couldn't positively confirm → fail-open
+  } catch {
+    return { fenced: true, active: false };
+  }
+}
+
 /**
  * Read-modify-write that enforces ownership of a specific repo BEFORE
  * applying the mutation. Throws on rejection.
@@ -520,6 +545,16 @@ function updateManifestAsOwner(args) {
       err.decision = decision;
       throw err;
     }
+    // Cross-machine fence: a wall-clock takeover must also win the ref-CAS
+    // lease (opt-in; no-op by default). Closes the clock-skew double-own hazard.
+    if (decision.expired) {
+      const fence = leaseFence(ecosystemRoot, `swarm-${swarmId}-${repo}`, sessionId);
+      if (!fence.fenced) {
+        const err = new Error(`updateManifestAsOwner: takeover fenced — "${repo}" lease held by ${fence.owner} (refs/momentum/leases)`);
+        err.code = 'EOWNERSHIP';
+        throw err;
+      }
+    }
     const result = mutate(current, decision);
     let mutated = current;
     if (result && typeof result === 'object' && 'manifest' in result) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@limina-labs/momentum",
-  "version": "0.37.0",
+  "version": "0.38.0",
   "description": "Agent-agnostic, specs-driven development framework — single project or multi-project ecosystem",
   "homepage": "https://trymomentum.github.io",
   "bin": {