@memnexus-ai/mx-agent-cli 0.1.176 → 0.1.178

package/dist/agent-config/hooks/coordination-brief.sh

@@ -53,11 +53,19 @@ KEYVAULT_NAME="mx-dev-eastus2-kv-001"
 MIN_CLI_VERSION="0.1.172"
 CLI_UPDATE_CMD="npm install -g @memnexus-ai/mx-agent-cli@latest"
 
-# SF-2: canonical roster. The marker slug MUST be an EXACT member of this array
-# before it is ever interpolated into an `az` command. This is the real gate;
-# the slug regex only blocks shell metacharacters. Aliases mx-agent /
-# mx-agent-system are intentionally EXCLUDED (flagged for roster cleanup).
-COORD_ROSTER=(platform retrieval mcp pipeline marketing customer-portal eval product)
+# MULTI-TENANT (Phase 1). Identity is (project, team). `project` is the committed
+# project-config signal (resolveProductSlug precedence: MX_PRODUCT_SLUG →
+# mx-agent.config.json projectSlug → memnexus). `team` is the marker slug. The
+# roster is resolved from the OFFLINE generated file (ND-2) — NEVER a live
+# GET /roster at session start, so a coordination-service outage (the shared
+# SPOF) can't break session start. For the DEFAULT project (memnexus) behavior is
+# IDENTICAL to before: same roster membership, same token (via the legacy KV
+# name fallback below).
+DEFAULT_PROJECT="memnexus"
+# BUILTIN memnexus roster — OFFLINE fallback used only when the generated file is
+# unreadable (or node is unavailable). Mirrors PROVISIONED_ROSTERS in
+# coordination-service/src/config/rosters.ts.
+BUILTIN_MEMNEXUS_ROSTER="platform retrieval mcp pipeline marketing customer-portal eval product"
 
 # ── MF-2: authoritative marker, hook NEVER derives the slug. ─────────────────
 # The slug is an explicit assignment written into the worktree by an onboarding
@@ -80,22 +88,41 @@ if [ -z "$SLUG" ]; then
   exit 0
 fi
 
-# ── SF-2: roster-membership validation (exact match) before any az call. ─────
+# ── Resolve the PROJECT (resolveProductSlug precedence, offline). ────────────
+# 1) MX_PRODUCT_SLUG env; 2) mx-agent.config.json projectSlug at the worktree
+# root; 3) default memnexus. No HTTP — reads local config only.
+PROJECT="${MX_PRODUCT_SLUG:-}"
+if [ -z "$PROJECT" ] && [ -f "${WORKTREE}/mx-agent.config.json" ]; then
+  PROJECT="$(node -e 'try{const c=require(process.argv[1]);const s=(c.projectSlug||(c.project&&c.project.slug)||"");process.stdout.write(String(s).trim())}catch(e){}' "${WORKTREE}/mx-agent.config.json" 2>/dev/null || true)"
+fi
+[ -z "$PROJECT" ] && PROJECT="$DEFAULT_PROJECT"
+
+# ── SF-2: per-project roster-membership validation before any az call. ───────
+# The roster is read from the OFFLINE generated file (ND-2), with the builtin
+# memnexus roster as an offline fallback. NEVER a live GET /roster.
+ROSTER_FILE="${MX_COORD_ROSTER_FILE:-${WORKTREE}/mx-agent-system/agent-config/coordination-rosters.generated.json}"
+ROSTER_TEAMS=""
+if [ -f "$ROSTER_FILE" ]; then
+  ROSTER_TEAMS="$(node -e 'try{const r=require(process.argv[1]);const t=(r.projects&&r.projects[process.argv[2]])||[];process.stdout.write(t.join(" "))}catch(e){}' "$ROSTER_FILE" "$PROJECT" 2>/dev/null || true)"
+fi
+if [ -z "$ROSTER_TEAMS" ] && [ "$PROJECT" = "$DEFAULT_PROJECT" ]; then
+  # Offline fallback: file missing/unparseable/node absent → builtin memnexus roster.
+  ROSTER_TEAMS="$BUILTIN_MEMNEXUS_ROSTER"
+fi
 in_roster=""
-for t in "${COORD_ROSTER[@]}"; do
+for t in $ROSTER_TEAMS; do
   if [ "$SLUG" = "$t" ]; then in_roster="yes"; break; fi
 done
 if [ -z "$in_roster" ]; then
-  # Unknown/invalid slug → fail-closed. Never fetch a default token.
-  echo "coordination brief: team slug \"$SLUG\" not in roster — skipping" >&2
+  # Unknown/invalid (project, team) → fail-closed. Never fetch a default token.
+  echo "coordination brief: (project \"$PROJECT\", team \"$SLUG\") not in roster — skipping" >&2
   exit 0
 fi
 
-# ── MF-1: slug-bound per-worktree token cache. ───────────────────────────────
-# The cache filename embeds the slug, so a worktree recycled from team A to team
-# B (marker rewritten to B) can NEVER reuse A's cached token: B's cache path
-# simply does not exist yet → refetch. A's stale file is never read.
-CACHE="${WORKTREE}/.mx-coordination-token-${SLUG}"
+# ── MF-1: (project, team)-bound per-worktree token cache. ────────────────────
+# The cache filename embeds BOTH slugs, so a worktree recycled to another
+# team/project can NEVER reuse the prior tenant's cached token.
+CACHE="${WORKTREE}/.mx-coordination-token--${PROJECT}--${SLUG}"
 TOKEN=""
 if [ -s "$CACHE" ]; then
   TOKEN="$(head -n1 "$CACHE" 2>/dev/null || true)"
@@ -104,11 +131,21 @@ fi
 # ── Fetch from Key Vault once if not cached (SF-3 born-0600 write). ───────────
 if [ -z "$TOKEN" ]; then
   # Fail-OPEN on any fetch problem (not logged in, no access, missing secret).
-  # SLUG is roster-validated above and passed as a single quoted argv element.
+  # PROJECT/SLUG are roster-validated above; each is a single quoted argv element.
+  # ND-1: primary name is the parse-safe double-hyphen coordination-token--<p>--<t>.
   fetched="$(az keyvault secret show \
     --vault-name "$KEYVAULT_NAME" \
-    --name "coordination-token-${SLUG}" \
+    --name "coordination-token--${PROJECT}--${SLUG}" \
     --query value -o tsv 2>/dev/null || true)"
+  # ZERO-ORPHAN dual-read (memnexus only): the un-migrated live vault still holds
+  # the legacy single-hyphen secret. Fall back to it so memnexus session-start is
+  # identical to today. Phase 2 renames the secret and removes this fallback.
+  if [ -z "$fetched" ] && [ "$PROJECT" = "$DEFAULT_PROJECT" ]; then
+    fetched="$(az keyvault secret show \
+      --vault-name "$KEYVAULT_NAME" \
+      --name "coordination-token-${SLUG}" \
+      --query value -o tsv 2>/dev/null || true)"
+  fi
   if [ -z "$fetched" ]; then
     # No token available — tolerate and skip (fail-open).
     exit 0

package/dist/lib/coordination-client.d.ts

@@ -22,13 +22,26 @@ export type CoordinationMode = 'queue' | 'memory';
 /** Env override for the coordination mode (highest precedence, test seam). */
 export declare const ENV_KEY_MODE = "MX_COORDINATION_MODE";
 /**
- * Resolve the coordination backend mode: env → config → default.
+ * Resolve the coordination backend mode with a strict 4-level precedence, where
+ * each level short-circuits ONLY when it produced a non-empty value:
  *
- * DEFAULT is `memory` (fail-safe): nothing changes for a project until it opts
- * in with `mx-agent config set coordination-mode queue`. An unknown/garbage
- * value (typo, corrupted config) also resolves to `memory` — the mode read is
- * cheap and MUST NEVER crash a command, so any read failure degrades to the
- * safe default rather than throwing.
+ *   1. env `MX_COORDINATION_MODE`                — highest; per-invocation / test seam.
+ *   2. global operator config `coordination-mode` — ~/.mx-agent/config.json.
+ *   3. committed project config `coordinationMode` — mx-agent.config.json at the
+ *      project (worktree) root. This is the DURABLE per-project default: it is
+ *      checked in, so a project's queue cutover survives environment rebuilds
+ *      instead of relying on a manually-set global config value on one box.
+ *   4. default `memory` (fail-safe).
+ *
+ * An explicitly-set level wins even when its value is `memory` (a box-level or
+ * committed opt-out beats a lower default). A set-but-invalid value at any level
+ * resolves to `memory` and stops — it does NOT fall through. Only a truly unset
+ * level falls through to the next.
+ *
+ * Every read is crash-proof: the mode lookup is cheap and MUST NEVER crash a
+ * command, so any thrown error (unwritable HOME on config read, project-root
+ * walk failure, unreadable config file) degrades to the safe default rather than
+ * propagating.
  */
 export declare function resolveCoordinationMode(): CoordinationMode;
 export interface EnqueueRequest {

package/dist/lib/coordination-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"coordination-client.d.ts","sourceRoot":"","sources":["../../src/lib/coordination-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,MAAM,MAAM,QAAQ,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;AAEjD,eAAO,MAAM,cAAc,6BAA6B,CAAC;AACzD,eAAO,MAAM,gBAAgB,+BAA+B,CAAC;AAC7D,eAAO,MAAM,eAAe,sBAAsB,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,QAAQ,CAAC;AAElD,8EAA8E;AAC9E,eAAO,MAAM,YAAY,yBAAyB,CAAC;AAEnD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,IAAI,gBAAgB,CAU1D;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,QAAQ,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,QAAQ,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,uCAAuC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,6DAA6D;AAC7D,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACjF,KAAK,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAClD,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CACzD;AAED,yFAAyF;AACzF,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,KAAK,EAAE,OAAO;CAI3B;AAED,6EAA6E;AAC7E,qBAAa,gBAAiB,SAAQ,KAAK;aACb,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAI5D;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C,sFAAsF;AACtF,wBAAgB,mBAAmB,IAAI,YAAY,CAYlD;AAED,qBAAa,sBAAuB,YAAW,kBAAkB;IACnD,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,YAAY;YAEnC,OAAO;IAiCrB,OAAO,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;IAIhF,KAAK,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC;IAO3C,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5C,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI3C,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC;CAOxD"}
+{"version":3,"file":"coordination-client.d.ts","sourceRoot":"","sources":["../../src/lib/coordination-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,MAAM,MAAM,QAAQ,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;AAEjD,eAAO,MAAM,cAAc,6BAA6B,CAAC;AACzD,eAAO,MAAM,gBAAgB,+BAA+B,CAAC;AAC7D,eAAO,MAAM,eAAe,sBAAsB,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,QAAQ,CAAC;AAElD,8EAA8E;AAC9E,eAAO,MAAM,YAAY,yBAAyB,CAAC;AAiBnD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,uBAAuB,IAAI,gBAAgB,CA4B1D;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,QAAQ,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,QAAQ,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,uCAAuC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,6DAA6D;AAC7D,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACjF,KAAK,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAClD,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CACzD;AAED,yFAAyF;AACzF,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,KAAK,EAAE,OAAO;CAI3B;AAED,6EAA6E;AAC7E,qBAAa,gBAAiB,SAAQ,KAAK;aACb,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAI5D;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C,sFAAsF;AACtF,wBAAgB,mBAAmB,IAAI,YAAY,CAYlD;AAED,qBAAa,sBAAuB,YAAW,kBAAkB;IACnD,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,YAAY;YAEnC,OAAO;IAiCrB,OAAO,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;IAIhF,KAAK,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC;IAO3C,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5C,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI3C,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC;CAOxD"}

package/dist/lib/coordination-client.js

@@ -8,31 +8,81 @@
  * Part of PR-B / FR-7 (CLI commands) of the agent coordination queue PRD.
  */
 import { getConfigValue } from './config.js';
+import { loadProjectConfig, resolveProjectConfig } from './project-config.js';
+import { findProjectRoot } from './worktree.js';
 export const CONFIG_KEY_URL = 'coordination-service-url';
 export const CONFIG_KEY_TOKEN = 'coordination-service-token';
 export const CONFIG_KEY_MODE = 'coordination-mode';
 /** Env override for the coordination mode (highest precedence, test seam). */
 export const ENV_KEY_MODE = 'MX_COORDINATION_MODE';
 /**
- * Resolve the coordination backend mode: env → config → default.
+ * Coerce a raw mode string to a resolved value, or `undefined` when unset.
  *
- * DEFAULT is `memory` (fail-safe): nothing changes for a project until it opts
- * in with `mx-agent config set coordination-mode queue`. An unknown/garbage
- * value (typo, corrupted config) also resolves to `memory` — the mode read is
- * cheap and MUST NEVER crash a command, so any read failure degrades to the
- * safe default rather than throwing.
+ * A set-but-invalid value (typo, garbage) resolves to `memory` and STOPS the
+ * precedence walk — an explicit level, even a malformed one, is not treated as
+ * "unset". Only a genuinely empty/whitespace value returns `undefined` so the
+ * caller falls through to the next precedence level.
+ */
+function coerceMode(raw) {
+    const v = raw?.trim().toLowerCase();
+    if (!v)
+        return undefined; // unset → fall through
+    if (v === 'queue')
+        return 'queue';
+    return 'memory'; // set-but-not-queue (incl. 'memory' and garbage) → memory, stop
+}
+/**
+ * Resolve the coordination backend mode with a strict 4-level precedence, where
+ * each level short-circuits ONLY when it produced a non-empty value:
+ *
+ *   1. env `MX_COORDINATION_MODE`                — highest; per-invocation / test seam.
+ *   2. global operator config `coordination-mode` — ~/.mx-agent/config.json.
+ *   3. committed project config `coordinationMode` — mx-agent.config.json at the
+ *      project (worktree) root. This is the DURABLE per-project default: it is
+ *      checked in, so a project's queue cutover survives environment rebuilds
+ *      instead of relying on a manually-set global config value on one box.
+ *   4. default `memory` (fail-safe).
+ *
+ * An explicitly-set level wins even when its value is `memory` (a box-level or
+ * committed opt-out beats a lower default). A set-but-invalid value at any level
+ * resolves to `memory` and stops — it does NOT fall through. Only a truly unset
+ * level falls through to the next.
+ *
+ * Every read is crash-proof: the mode lookup is cheap and MUST NEVER crash a
+ * command, so any thrown error (unwritable HOME on config read, project-root
+ * walk failure, unreadable config file) degrades to the safe default rather than
+ * propagating.
  */
 export function resolveCoordinationMode() {
-    let raw;
+    // 1. Env override (highest).
+    const fromEnv = coerceMode(process.env[ENV_KEY_MODE]);
+    if (fromEnv)
+        return fromEnv;
+    // 2. Global operator config.
     try {
-        raw = (process.env[ENV_KEY_MODE] || getConfigValue(CONFIG_KEY_MODE))?.trim().toLowerCase();
+        const fromGlobal = coerceMode(getConfigValue(CONFIG_KEY_MODE));
+        if (fromGlobal)
+            return fromGlobal;
     }
     catch {
         // getConfigValue can touch the filesystem (mkdirSync on an unwritable HOME).
-        // Any failure → safe default; never propagate.
-        return 'memory';
+        // A read failure is NOT an explicit setting — fall through to project config.
+    }
+    // 3. Committed project config (durable per-project default). Reuses the same
+    //    findProjectRoot()/resolveProjectConfig(loadProjectConfig(root)) chain as
+    //    coordination-memory.ts, so it resolves the WORKTREE root where the
+    //    checked-out mx-agent.config.json lives.
+    try {
+        const root = findProjectRoot();
+        const fromProject = coerceMode(resolveProjectConfig(loadProjectConfig(root)).coordinationMode);
+        if (fromProject)
+            return fromProject;
+    }
+    catch {
+        // Project-root walk or config read failed → fall through to the default.
     }
-    return raw === 'queue' ? 'queue' : 'memory';
+    // 4. Fail-safe default.
+    return 'memory';
 }
 /** Thrown for a transport failure (service unreachable) — triggers the FR-8 fallback. */
 export class ServiceUnreachableError extends Error {

package/dist/lib/coordination-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"coordination-client.js","sourceRoot":"","sources":["../../src/lib/coordination-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAI7C,MAAM,CAAC,MAAM,cAAc,GAAG,0BAA0B,CAAC;AACzD,MAAM,CAAC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;AAC7D,MAAM,CAAC,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAWnD,8EAA8E;AAC9E,MAAM,CAAC,MAAM,YAAY,GAAG,sBAAsB,CAAC;AAEnD;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB;IACrC,IAAI,GAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,cAAc,CAAC,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7F,CAAC;IAAC,MAAM,CAAC;QACP,6EAA6E;QAC7E,+CAA+C;QAC/C,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC9C,CAAC;AA2DD,yFAAyF;AACzF,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,KAAc;QACxB,KAAK,CAAC,qCAAqC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrG,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,6EAA6E;AAC7E,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACb;IAA5B,YAA4B,MAAc,EAAE,OAAe;QACzD,KAAK,CAAC,OAAO,CAAC,CAAC;QADW,WAAM,GAAN,MAAM,CAAQ;QAExC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AASD,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAE9C,sFAAsF;AACtF,MAAM,UAAU,mBAAmB;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,cAAc,CAAC,cAAc,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,cAAc,CAAC,gBAAgB,CAAC,CAAC;IACrF,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,8DAA8D,cAAc,4CAA4C,CAAC,CAAC;IAC5I,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,gEAAgE,gBAAgB,0CAA0C,CAAC,CAAC;IAC9I,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;IACxD,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC;IAClF,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,uBAAuB,EAAE,CAAC;AAC/I,CAAC;AAED,MAAM,OAAO,sBAAsB;IACJ;IAA7B,YAA6B,MAAoB;QAApB,WAAM,GAAN,MAAM,CAAc;IAAG,CAAC;IAE7C,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACnE,IAAI,GAAa,CAAC;QAClB,2EAA2E;QAC3E,yEAAyE;QACzE,6EAA6E;QAC7E,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,uBAAuB,CAAC;QACnE,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;QAC9D,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,EAAE,EAAE;gBAC7C,MAAM;gBACN,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;oBAC5C,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC3D,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,8EAA8E;YAC9E,MAAM,IAAI,uBAAuB,CAAC,GAAG,CAAC,CAAC;QACzC,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAa,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,GAAG,GAAI,MAA6B,CAAC,KAAK,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;YACzE,MAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,MAAW,CAAC;IACrB,CAAC;IAED,OAAO,CAAC,GAAmB;QACzB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,IAAkB;QACtB,MAAM,IAAI,GAA4B,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACtD,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;YAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACrF,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAe;QAChC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,SAAiB;QACzB,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,CAAC,IAAoB;QAC1B,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACtE,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9D,CAAC;CACF"}
+{"version":3,"file":"coordination-client.js","sourceRoot":"","sources":["../../src/lib/coordination-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAIhD,MAAM,CAAC,MAAM,cAAc,GAAG,0BAA0B,CAAC;AACzD,MAAM,CAAC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;AAC7D,MAAM,CAAC,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAWnD,8EAA8E;AAC9E,MAAM,CAAC,MAAM,YAAY,GAAG,sBAAsB,CAAC;AAEnD;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,GAA8B;IAChD,MAAM,CAAC,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpC,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC,CAAC,uBAAuB;IACjD,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IAClC,OAAO,QAAQ,CAAC,CAAC,gEAAgE;AACnF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,uBAAuB;IACrC,6BAA6B;IAC7B,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;IACtD,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAE5B,6BAA6B;IAC7B,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,UAAU,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC,CAAC;QAC/D,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,6EAA6E;QAC7E,8EAA8E;IAChF,CAAC;IAED,6EAA6E;IAC7E,8EAA8E;IAC9E,wEAAwE;IACxE,6CAA6C;IAC7C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,UAAU,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;QAC/F,IAAI,WAAW;YAAE,OAAO,WAAW,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;IAC3E,CAAC;IAED,wBAAwB;IACxB,OAAO,QAAQ,CAAC;AAClB,CAAC;AA2DD,yFAAyF;AACzF,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,KAAc;QACxB,KAAK,CAAC,qCAAqC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrG,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,6EAA6E;AAC7E,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACb;IAA5B,YAA4B,MAAc,EAAE,OAAe;QACzD,KAAK,CAAC,OAAO,CAAC,CAAC;QADW,WAAM,GAAN,MAAM,CAAQ;QAExC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AASD,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAE9C,sFAAsF;AACtF,MAAM,UAAU,mBAAmB;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,cAAc,CAAC,cAAc,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,cAAc,CAAC,gBAAgB,CAAC,CAAC;IACrF,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,8DAA8D,cAAc,4CAA4C,CAAC,CAAC;IAC5I,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,gEAAgE,gBAAgB,0CAA0C,CAAC,CAAC;IAC9I,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;IACxD,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC;IAClF,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,uBAAuB,EAAE,CAAC;AAC/I,CAAC;AAED,MAAM,OAAO,sBAAsB;IACJ;IAA7B,YAA6B,MAAoB;QAApB,WAAM,GAAN,MAAM,CAAc;IAAG,CAAC;IAE7C,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACnE,IAAI,GAAa,CAAC;QAClB,2EAA2E;QAC3E,yEAAyE;QACzE,6EAA6E;QAC7E,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,uBAAuB,CAAC;QACnE,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;QAC9D,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,EAAE,EAAE;gBAC7C,MAAM;gBACN,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;oBAC5C,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC3D,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,8EAA8E;YAC9E,MAAM,IAAI,uBAAuB,CAAC,GAAG,CAAC,CAAC;QACzC,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAa,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,GAAG,GAAI,MAA6B,CAAC,KAAK,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;YACzE,MAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,MAAW,CAAC;IACrB,CAAC;IAED,OAAO,CAAC,GAAmB;QACzB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,IAAkB;QACtB,MAAM,IAAI,GAA4B,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACtD,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;YAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACrF,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAe;QAChC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,SAAiB;QACzB,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,CAAC,IAAoB;QAC1B,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACtE,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9D,CAAC;CACF"}

package/dist/lib/coordination-token.d.ts

@@ -4,34 +4,54 @@
  * Ports the security-reviewed KV-fetch logic from the agent-config hook
  * `coordination-brief.sh` into the CLI so that a bare `mx-agent coordination
  * brief` (and drain/escalate/history) resolves its own token when none is
- * configured, instead of failing with "token not set" and falling back to the
- * old channel. The isolation properties the security review required are
- * preserved 1:1:
+ * configured. MULTI-TENANT (Phase 1): identity is (project, team). `project`
+ * comes from resolveProductSlug() (config-derived, default 'memnexus'); `team`
+ * from the authoritative worktree marker. The isolation properties the security
+ * review required are preserved 1:1, now project-aware:
  *
  *   - MF-2  The team slug is read from the authoritative worktree marker
  *           (.mx-coordination-team). It is NEVER derived from CLAUDE_TEAM_NAME
- *           or the worktree name.
- *   - SF-2  The slug is validated against the exact roster BEFORE any `az` call.
- *           A non-member fails CLOSED (no fetch) so the caller falls back.
- *   - MF-1  The token cache filename embeds the slug
- *           (.mx-coordination-token-<slug>), per worktree. A worktree recycled
- *           to a different team can never read another team's cached token.
+ *           or the worktree name. The PROJECT is the committed project-config
+ *           signal (resolveProductSlug), never a queue-mode client assertion.
+ *   - SF-2  The (project, team) is validated against the per-project roster
+ *           BEFORE any `az` call. A non-member fails CLOSED (no fetch).
+ *   - MF-1  The token cache filename embeds BOTH slugs
+ *           (.mx-coordination-token--<project>--<team>), per worktree. A worktree
+ *           recycled to a different team/project can never read another tenant's
+ *           cached token.
  *   - SF-3  The cache is created born 0600 (mode on create — no readable window).
- *   - No shell: the roster-validated slug is passed to `az` via execFile with an
+ *   - No shell: the roster-validated slugs are passed to `az` via execFile with an
  *           args array, never interpolated into a shell string.
- *   - The token is NEVER written to the global ~/.mx-agent config (that clobbers
- *           across worktrees — the MF-2 defect) and is NEVER logged.
+ *   - The token is NEVER written to the global ~/.mx-agent config and NEVER logged.
  *   - Fail-OPEN on infra errors (no marker, az not logged in, KV unreachable):
  *           report "unprovisioned" so the caller degrades, never crash.
  *   - Fail-CLOSED only on a roster mismatch.
+ *
+ * ZERO-ORPHAN KV shim (Phase 1): the secret name is the parse-safe double-hyphen
+ * `coordination-token--<project>--<team>` (ND-1). For the DEFAULT project
+ * (memnexus) the live Key Vault still holds the PRE-migration single-hyphen
+ * `coordination-token-<team>` secrets, so the fetch falls back to the legacy name
+ * when the double-hyphen name is absent (the PRD migration grace-window dual-read).
+ * This keeps memnexus session-start working IDENTICALLY against the un-migrated
+ * vault; Phase 2 renames the secrets and the fallback is removed.
  */
 /**
- * SF-2 canonical roster — mirror of coordination-brief.sh's COORD_ROSTER. The
- * marker slug MUST be an exact member of this list before it is ever passed to
- * `az`. Aliases (mx-agent / mx-agent-system) are intentionally excluded.
+ * BUILTIN memnexus provisioned-team roster — the OFFLINE fallback used only when
+ * the generated roster file cannot be read. Mirrors PROVISIONED_ROSTERS in
+ * coordination-service/src/config/rosters.ts. Keeping it here preserves
+ * offline-safety (a missing file never breaks the memnexus gate) without a live
+ * HTTP dependency. Aliases mx-agent / mx-agent-system are intentionally excluded.
  */
 export declare const COORD_ROSTER: readonly ["platform", "retrieval", "mcp", "pipeline", "marketing", "customer-portal", "eval", "product"];
 export declare const KEYVAULT_NAME = "mx-dev-eastus2-kv-001";
+/** Env override for the offline roster file path (test seam / operator override). */
+export declare const ENV_KEY_ROSTER_FILE = "MX_COORD_ROSTER_FILE";
+/**
+ * ND-1 single-source KV secret name shape — reproduced here (the CLI is a
+ * separate package from coordination-service). MUST stay byte-identical to
+ * kvSecretName() in coordination-service/src/types.ts.
+ */
+export declare function kvSecretName(project: string, team: string): string;
 export type TokenResolveStatus = 
 /** A token was already in env/config; KV is skipped (hook path + manual override). */
 'already-configured'
@@ -45,6 +65,8 @@ export interface TokenResolveResult {
     status: TokenResolveStatus;
     /** The resolved token — set only for 'already-configured' and 'resolved'. */
     token?: string;
+    /** The resolved project (config-derived). */
+    project?: string;
     /** The marker slug, when one was read (roster or not). */
     slug?: string;
     /** Where the token came from — for diagnostics; never includes the token. */
@@ -64,7 +86,16 @@ export interface TokenResolveDeps {
     readFileText?: (path: string) => string | undefined;
     /** Persist the fetched token to the per-worktree cache (born 0600). */
     writeCache?: (path: string, value: string) => void;
+    /** Override the resolved project (test seam); defaults to resolveProductSlug(). */
+    project?: string;
 }
+/**
+ * Resolve the per-project provisioned-team roster from the OFFLINE generated file
+ * (ND-2), falling back to the builtin roster when the file is unreadable or does
+ * not list the project. This is deliberately OFFLINE-SAFE: it never makes a
+ * session-start HTTP call to the coordination service (the shared SPOF).
+ */
+export declare function resolveRoster(project: string, env: NodeJS.ProcessEnv, readFileText: (path: string) => string | undefined): readonly string[];
 /**
  * Resolve the coordination token, self-provisioning from Key Vault when none is
  * configured. Never throws — every failure is a typed result the caller acts on.

package/dist/lib/coordination-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"coordination-token.d.ts","sourceRoot":"","sources":["../../src/lib/coordination-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAQH;;;;GAIG;AACH,eAAO,MAAM,YAAY,0GASf,CAAC;AAEX,eAAO,MAAM,aAAa,0BAA0B,CAAC;AAKrD,MAAM,MAAM,kBAAkB;AAC5B,sFAAsF;AACpF,oBAAoB;AACtB,iFAAiF;GAC/E,UAAU;AACZ,8EAA8E;GAC5E,eAAe;AACjB,+EAA+E;GAC7E,eAAe,CAAC;AAEpB,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,MAAM,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAC;IACjD,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,iDAAiD;IACjD,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB;;;OAGG;IACH,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IACxE,oFAAoF;IACpF,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IACpD,uEAAuE;IACvE,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CACpD;AAmDD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,GAAE,gBAAqB,GAAG,kBAAkB,CAmExF"}
+{"version":3,"file":"coordination-token.d.ts","sourceRoot":"","sources":["../../src/lib/coordination-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AASH;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,0GASf,CAAC;AAMX,eAAO,MAAM,aAAa,0BAA0B,CAAC;AAErD,qFAAqF;AACrF,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAM1D;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAElE;AAYD,MAAM,MAAM,kBAAkB;AAC5B,sFAAsF;AACpF,oBAAoB;AACtB,iFAAiF;GAC/E,UAAU;AACZ,8EAA8E;GAC5E,eAAe;AACjB,+EAA+E;GAC7E,eAAe,CAAC;AAEpB,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,MAAM,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAC;IACjD,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,iDAAiD;IACjD,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB;;;OAGG;IACH,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IACxE,oFAAoF;IACpF,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IACpD,uEAAuE;IACvE,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACnD,mFAAmF;IACnF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AA8CD;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GACjD,SAAS,MAAM,EAAE,CAkBnB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,GAAE,gBAAqB,GAAG,kBAAkB,CAqExF"}

package/dist/lib/coordination-token.js

@@ -4,36 +4,49 @@
  * Ports the security-reviewed KV-fetch logic from the agent-config hook
  * `coordination-brief.sh` into the CLI so that a bare `mx-agent coordination
  * brief` (and drain/escalate/history) resolves its own token when none is
- * configured, instead of failing with "token not set" and falling back to the
- * old channel. The isolation properties the security review required are
- * preserved 1:1:
+ * configured. MULTI-TENANT (Phase 1): identity is (project, team). `project`
+ * comes from resolveProductSlug() (config-derived, default 'memnexus'); `team`
+ * from the authoritative worktree marker. The isolation properties the security
+ * review required are preserved 1:1, now project-aware:
  *
  *   - MF-2  The team slug is read from the authoritative worktree marker
  *           (.mx-coordination-team). It is NEVER derived from CLAUDE_TEAM_NAME
- *           or the worktree name.
- *   - SF-2  The slug is validated against the exact roster BEFORE any `az` call.
- *           A non-member fails CLOSED (no fetch) so the caller falls back.
- *   - MF-1  The token cache filename embeds the slug
- *           (.mx-coordination-token-<slug>), per worktree. A worktree recycled
- *           to a different team can never read another team's cached token.
+ *           or the worktree name. The PROJECT is the committed project-config
+ *           signal (resolveProductSlug), never a queue-mode client assertion.
+ *   - SF-2  The (project, team) is validated against the per-project roster
+ *           BEFORE any `az` call. A non-member fails CLOSED (no fetch).
+ *   - MF-1  The token cache filename embeds BOTH slugs
+ *           (.mx-coordination-token--<project>--<team>), per worktree. A worktree
+ *           recycled to a different team/project can never read another tenant's
+ *           cached token.
  *   - SF-3  The cache is created born 0600 (mode on create — no readable window).
- *   - No shell: the roster-validated slug is passed to `az` via execFile with an
+ *   - No shell: the roster-validated slugs are passed to `az` via execFile with an
  *           args array, never interpolated into a shell string.
- *   - The token is NEVER written to the global ~/.mx-agent config (that clobbers
- *           across worktrees — the MF-2 defect) and is NEVER logged.
+ *   - The token is NEVER written to the global ~/.mx-agent config and NEVER logged.
  *   - Fail-OPEN on infra errors (no marker, az not logged in, KV unreachable):
  *           report "unprovisioned" so the caller degrades, never crash.
  *   - Fail-CLOSED only on a roster mismatch.
+ *
+ * ZERO-ORPHAN KV shim (Phase 1): the secret name is the parse-safe double-hyphen
+ * `coordination-token--<project>--<team>` (ND-1). For the DEFAULT project
+ * (memnexus) the live Key Vault still holds the PRE-migration single-hyphen
+ * `coordination-token-<team>` secrets, so the fetch falls back to the legacy name
+ * when the double-hyphen name is absent (the PRD migration grace-window dual-read).
+ * This keeps memnexus session-start working IDENTICALLY against the un-migrated
+ * vault; Phase 2 renames the secrets and the fallback is removed.
  */
 import { execFileSync } from 'node:child_process';
 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { getConfigValue } from './config.js';
 import { CONFIG_KEY_TOKEN } from './coordination-client.js';
+import { resolveProductSlug, DEFAULT_PRODUCT_SLUG } from './coordination-memory.js';
 /**
- * SF-2 canonical roster — mirror of coordination-brief.sh's COORD_ROSTER. The
- * marker slug MUST be an exact member of this list before it is ever passed to
- * `az`. Aliases (mx-agent / mx-agent-system) are intentionally excluded.
+ * BUILTIN memnexus provisioned-team roster — the OFFLINE fallback used only when
+ * the generated roster file cannot be read. Mirrors PROVISIONED_ROSTERS in
+ * coordination-service/src/config/rosters.ts. Keeping it here preserves
+ * offline-safety (a missing file never breaks the memnexus gate) without a live
+ * HTTP dependency. Aliases mx-agent / mx-agent-system are intentionally excluded.
  */
 export const COORD_ROSTER = [
     'platform',
@@ -45,9 +58,31 @@ export const COORD_ROSTER = [
     'eval',
     'product',
 ];
+const BUILTIN_ROSTERS = {
+    [DEFAULT_PRODUCT_SLUG]: COORD_ROSTER,
+};
 export const KEYVAULT_NAME = 'mx-dev-eastus2-kv-001';
+/** Env override for the offline roster file path (test seam / operator override). */
+export const ENV_KEY_ROSTER_FILE = 'MX_COORD_ROSTER_FILE';
+/** Repo-relative location of the committed generated offline roster file (ND-2). */
+const ROSTER_FILE_REL = join('mx-agent-system', 'agent-config', 'coordination-rosters.generated.json');
 const MARKER_FILE = '.mx-coordination-team';
-const CACHE_PREFIX = '.mx-coordination-token-';
+/**
+ * ND-1 single-source KV secret name shape — reproduced here (the CLI is a
+ * separate package from coordination-service). MUST stay byte-identical to
+ * kvSecretName() in coordination-service/src/types.ts.
+ */
+export function kvSecretName(project, team) {
+    return `coordination-token--${project}--${team}`;
+}
+/** Legacy (pre-migration) single-hyphen name — memnexus dual-read fallback only. */
+function legacyKvSecretName(team) {
+    return `coordination-token-${team}`;
+}
+/** Per-worktree token cache filename, embedding BOTH slugs (MF-1). */
+function cacheFileName(project, team) {
+    return `.mx-coordination-token--${project}--${team}`;
+}
 /** Default marker/cache reader: undefined on missing or unreadable file. */
 function defaultReadFileText(path) {
     try {
@@ -60,11 +95,9 @@ function defaultReadFileText(path) {
     }
 }
 /**
- * Default KV fetch. The slug embedded in `secretName` is roster-validated by the
- * caller; it is passed to `az` as a single argv element via execFile (no shell),
- * so a metacharacter in a slug could never inject a command even if the roster
- * gate were bypassed. Any failure (az not logged in, KV unreachable, missing
- * secret) returns undefined → fail-open.
+ * Default KV fetch. The slugs embedded in `secretName` are roster-validated by
+ * the caller; the name is passed to `az` as a single argv element via execFile
+ * (no shell). Any failure returns undefined → fail-open.
  */
 function defaultFetchSecret(vault, secretName) {
     try {
@@ -79,9 +112,6 @@ function defaultFetchSecret(vault, secretName) {
 /** SF-3 born-0600 cache write. A write failure is tolerated (fail-open). */
 function defaultWriteCache(path, value) {
     try {
-        // mode 0600 on create — 0600 has no group/other bits, so no umask can widen
-        // it. The cache is only written when absent (see resolveCoordinationToken),
-        // so this is always a create.
         writeFileSync(path, value, { mode: 0o600 });
     }
     catch {
@@ -93,6 +123,36 @@ function firstLineNoSpace(raw) {
     const firstLine = raw.split(/\r?\n/, 1)[0] ?? '';
     return firstLine.replace(/\s+/g, '');
 }
+/**
+ * Resolve the per-project provisioned-team roster from the OFFLINE generated file
+ * (ND-2), falling back to the builtin roster when the file is unreadable or does
+ * not list the project. This is deliberately OFFLINE-SAFE: it never makes a
+ * session-start HTTP call to the coordination service (the shared SPOF).
+ */
+export function resolveRoster(project, env, readFileText) {
+    const candidates = [];
+    const override = env[ENV_KEY_ROSTER_FILE];
+    if (override)
+        candidates.push(override);
+    const worktree = env.CLAUDE_WORKTREE_PATH;
+    if (worktree)
+        candidates.push(join(worktree, ROSTER_FILE_REL));
+    for (const path of candidates) {
+        const raw = readFileText(path);
+        if (!raw)
+            continue;
+        try {
+            const parsed = JSON.parse(raw);
+            const teams = parsed.projects?.[project];
+            if (Array.isArray(teams))
+                return teams;
+        }
+        catch {
+            /* malformed file → fall through to the builtin fallback (offline-safe) */
+        }
+    }
+    return BUILTIN_ROSTERS[project] ?? [];
+}
 /**
  * Resolve the coordination token, self-provisioning from Key Vault when none is
  * configured. Never throws — every failure is a typed result the caller acts on.
@@ -103,15 +163,9 @@ export function resolveCoordinationToken(deps = {}) {
     const env = deps.env ?? process.env;
     const readFileText = deps.readFileText ?? defaultReadFileText;
     // 1. Already configured → use it, skip KV. Env preferred, then global config.
-    //    This keeps the hook path (which injects MX_COORD_SERVICE_TOKEN) and any
-    //    manual `mx-agent config set coordination-service-token` working unchanged.
     const envToken = env.MX_COORD_SERVICE_TOKEN;
     if (envToken)
         return { status: 'already-configured', token: envToken, source: 'env' };
-    // Belt-and-suspenders for the SF-A never-crash contract: getConfigValue →
-    // loadConfig → getConfigDir calls mkdirSync, which throws on an unwritable/
-    // read-only HOME (EACCES/EROFS/ENOSPC). Swallow it and treat the config token
-    // as absent so resolution continues to the marker/KV path instead of throwing.
     let configToken;
     try {
         configToken = getConfigValue(CONFIG_KEY_TOKEN);
@@ -121,41 +175,48 @@ export function resolveCoordinationToken(deps = {}) {
     }
     if (configToken)
         return { status: 'already-configured', token: configToken, source: 'config' };
-    // 2. MF-2: read the authoritative marker. No worktree path or no marker →
-    //    fail-OPEN. We do NOT derive the slug from any other signal.
+    // 2. Resolve the PROJECT (config-derived, default memnexus). Never throws.
+    const project = deps.project ?? resolveProductSlug();
+    // 3. MF-2: read the authoritative team marker. No worktree/marker → fail-OPEN.
     const worktree = env.CLAUDE_WORKTREE_PATH;
     if (!worktree) {
-        return { status: 'unprovisioned', detail: 'CLAUDE_WORKTREE_PATH is unset — cannot locate the coordination marker' };
+        return { status: 'unprovisioned', project, detail: 'CLAUDE_WORKTREE_PATH is unset — cannot locate the coordination marker' };
     }
     const markerRaw = readFileText(join(worktree, MARKER_FILE));
     if (markerRaw === undefined) {
-        return { status: 'unprovisioned', detail: 'no coordination marker (.mx-coordination-team) in this worktree' };
+        return { status: 'unprovisioned', project, detail: 'no coordination marker (.mx-coordination-team) in this worktree' };
     }
     const slug = firstLineNoSpace(markerRaw);
     if (!slug) {
-        return { status: 'unprovisioned', detail: 'coordination marker is empty' };
+        return { status: 'unprovisioned', project, detail: 'coordination marker is empty' };
     }
-    // 3. SF-2: roster-membership gate BEFORE any az call. Not a member → fail-CLOSED.
-    if (!COORD_ROSTER.includes(slug)) {
-        return { status: 'not-on-roster', slug };
+    // 4. SF-2: roster-membership gate for THIS project BEFORE any az call. The
+    //    roster comes from the OFFLINE file (single source), builtin fallback.
+    const roster = resolveRoster(project, env, readFileText);
+    if (!roster.includes(slug)) {
+        return { status: 'not-on-roster', project, slug };
     }
-    // 4. MF-1: slug-bound per-worktree cache. The slug is in the filename, so a
-    //    worktree recycled to another team (marker rewritten) can never read the
-    //    prior team's token — its cache path simply does not exist yet.
-    const cachePath = join(worktree, `${CACHE_PREFIX}${slug}`);
+    // 5. MF-1: (project, team)-bound per-worktree cache.
+    const cachePath = join(worktree, cacheFileName(project, slug));
     const cachedRaw = readFileText(cachePath);
     if (cachedRaw) {
         const cached = firstLineNoSpace(cachedRaw);
         if (cached)
-            return { status: 'resolved', token: cached, slug, source: 'cache' };
+            return { status: 'resolved', token: cached, project, slug, source: 'cache' };
     }
-    // 5. Fetch from Key Vault once. The roster-validated slug is the only variable
-    //    part of the secret name, passed via execFile args (no shell).
+    // 6. Fetch from Key Vault. Primary: parse-safe double-hyphen name (ND-1).
+    //    Fallback (memnexus only): legacy single-hyphen name — the zero-orphan
+    //    dual-read against the un-migrated live vault (Phase 2 removes it).
     const fetchSecret = deps.fetchSecret ?? defaultFetchSecret;
-    const fetched = fetchSecret(KEYVAULT_NAME, `coordination-token-${slug}`);
+    let fetched = fetchSecret(KEYVAULT_NAME, kvSecretName(project, slug));
+    let source = 'keyvault';
+    if (!fetched && project === DEFAULT_PRODUCT_SLUG) {
+        fetched = fetchSecret(KEYVAULT_NAME, legacyKvSecretName(slug));
+    }
     if (!fetched) {
         return {
             status: 'unprovisioned',
+            project,
             slug,
             detail: 'Key Vault returned no token (az not logged in, KV unreachable, or secret missing)',
         };
@@ -163,6 +224,6 @@ export function resolveCoordinationToken(deps = {}) {
     // SF-3: cache born 0600. NEVER persisted to the global config.
     const writeCache = deps.writeCache ?? defaultWriteCache;
     writeCache(cachePath, fetched);
-    return { status: 'resolved', token: fetched, slug, source: 'keyvault' };
+    return { status: 'resolved', token: fetched, project, slug, source };
 }
 //# sourceMappingURL=coordination-token.js.map