@papi-ai/server 0.7.83 → 0.7.84

package/dist/backfill-cycle-metrics.js

@@ -214,6 +214,7 @@ __export(git_exports, {
   listGroupedCycleBranches: () => listGroupedCycleBranches,
   listOpenPullRequests: () => listOpenPullRequests,
   listOrphanFeatBranches: () => listOrphanFeatBranches,
+  memberBranchSlug: () => memberBranchSlug,
   mergePullRequest: () => mergePullRequest,
   normalizeGitUrl: () => normalizeGitUrl,
   pickModuleCycleBranch: () => pickModuleCycleBranch,
@@ -1106,9 +1107,20 @@ function detectUnrecordedCommits(cwd, baseBranch) {
 function taskBranchName(taskId) {
   return `feat/${taskId}`;
 }
-function cycleBranchName(cycleNumber, module) {
+function cycleBranchName(cycleNumber, module, memberSlug) {
   const slug = module.toLowerCase().replace(/&/g, "and").replace(/&/g, "and").replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-  return `feat/cycle-${cycleNumber}-${slug}`;
+  const member = memberSlug ? `-${memberSlug}` : "";
+  return `feat/cycle-${cycleNumber}-${slug}${member}`;
+}
+function memberBranchSlug(member) {
+  const sanitise = (raw) => raw.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 20).replace(/-+$/g, "");
+  const fromName = member.displayName ? sanitise(member.displayName) : "";
+  if (fromName) return fromName;
+  const localPart = member.email ? member.email.split("@")[0] : "";
+  const fromEmail = localPart ? sanitise(localPart) : "";
+  if (fromEmail) return fromEmail;
+  const fromId = member.userId ? sanitise(member.userId).slice(0, 8) : "";
+  return fromId || void 0;
 }
 function getHeadCommitSha(cwd) {
   try {
@@ -1231,9 +1243,9 @@ function isBranchContentAlreadyInBase(cwd, branch, baseBranch) {
     return false;
   }
 }
-function pickModuleCycleBranch(candidates, cycleNumber, module) {
+function pickModuleCycleBranch(candidates, cycleNumber, module, memberSlug) {
   if (candidates.length === 0) return void 0;
-  const expected = cycleBranchName(cycleNumber, module);
+  const expected = cycleBranchName(cycleNumber, module, memberSlug);
   return candidates.find((b) => b === expected);
 }
 function listOrphanFeatBranches(cwd, baseBranch) {
@@ -2431,8 +2443,8 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
       async listContributors() {
         return this.invoke("listContributors", []);
       }
-      async addContributorByEmail(email) {
-        return this.invoke("addContributorByEmail", [email]);
+      async addContributorByEmail(email, role) {
+        return this.invoke("addContributorByEmail", [email, role]);
       }
       async removeContributorByEmail(email) {
         return this.invoke("removeContributorByEmail", [email]);

package/dist/index.js

@@ -760,7 +760,7 @@ function parsePhaseBlock(block) {
   if (isNaN(order)) return null;
   return { id, slug, label, description, status, order };
 }
-var CAPABILITY_REGISTRY, CAPABILITY_KEYS, SENSITIVE_CHANGELOG_PATTERNS, CONTRIBUTOR_PRICING_URL, HOSTED_APP_URL, HOSTED_MCP_URL, HOSTED_SUPABASE_URL, SEVERITY_ORDER, NONE_RE, AD_HOC_PLACEHOLDER_RE, MIN_REASON_LENGTH, LOW_SEVERITIES, WAB_WINDOW_DAYS, WAB_DEFAULT_WEEKS, WAB_WEEK_MS, PRODUCT_MARKER, MECHANICS_MARKER, CHECK_VALUE_MAX, VALID_EFFORT_SIZES, SECTION_HEADERS, VALID_EFFORT_SIZES2, EFFORT_SCALE, NONE_PATTERN, NONE_PATTERN2, VALID_STATUSES, PHASES_START, PHASES_END;
+var CAPABILITY_REGISTRY, CAPABILITY_KEYS, ASSIGNABLE_CONTRIBUTOR_ROLES, SENSITIVE_CHANGELOG_PATTERNS, CONTRIBUTOR_PRICING_URL, HOSTED_APP_URL, HOSTED_MCP_URL, HOSTED_SUPABASE_URL, SEVERITY_ORDER, NONE_RE, AD_HOC_PLACEHOLDER_RE, MIN_REASON_LENGTH, LOW_SEVERITIES, WAB_WINDOW_DAYS, WAB_DEFAULT_WEEKS, WAB_WEEK_MS, PRODUCT_MARKER, MECHANICS_MARKER, CHECK_VALUE_MAX, VALID_EFFORT_SIZES, SECTION_HEADERS, VALID_EFFORT_SIZES2, EFFORT_SCALE, NONE_PATTERN, NONE_PATTERN2, VALID_STATUSES, PHASES_START, PHASES_END;
 var init_dist = __esm({
   "../shared/dist/index.js"() {
     "use strict";
@@ -803,6 +803,7 @@ var init_dist = __esm({
       { key: "papiMetaFraming", label: "PAPI self-referential framing", description: "Includes PAPI-meta build-discipline framing in handoff output.", step: "build" }
     ];
     CAPABILITY_KEYS = CAPABILITY_REGISTRY.map((c) => c.key);
+    ASSIGNABLE_CONTRIBUTOR_ROLES = ["editor", "viewer"];
     SENSITIVE_CHANGELOG_PATTERNS = [
       // ── Test-user machinery ────────────────────────────────────────────────
       /@test\.papi\.dev/i,
@@ -949,6 +950,7 @@ __export(git_exports, {
   listGroupedCycleBranches: () => listGroupedCycleBranches,
   listOpenPullRequests: () => listOpenPullRequests,
   listOrphanFeatBranches: () => listOrphanFeatBranches,
+  memberBranchSlug: () => memberBranchSlug,
   mergePullRequest: () => mergePullRequest,
   normalizeGitUrl: () => normalizeGitUrl,
   pickModuleCycleBranch: () => pickModuleCycleBranch,
@@ -1841,9 +1843,20 @@ function detectUnrecordedCommits(cwd, baseBranch) {
 function taskBranchName(taskId) {
   return `feat/${taskId}`;
 }
-function cycleBranchName(cycleNumber, module) {
+function cycleBranchName(cycleNumber, module, memberSlug) {
   const slug = module.toLowerCase().replace(/&/g, "and").replace(/&/g, "and").replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-  return `feat/cycle-${cycleNumber}-${slug}`;
+  const member = memberSlug ? `-${memberSlug}` : "";
+  return `feat/cycle-${cycleNumber}-${slug}${member}`;
+}
+function memberBranchSlug(member) {
+  const sanitise = (raw) => raw.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 20).replace(/-+$/g, "");
+  const fromName = member.displayName ? sanitise(member.displayName) : "";
+  if (fromName) return fromName;
+  const localPart = member.email ? member.email.split("@")[0] : "";
+  const fromEmail = localPart ? sanitise(localPart) : "";
+  if (fromEmail) return fromEmail;
+  const fromId = member.userId ? sanitise(member.userId).slice(0, 8) : "";
+  return fromId || void 0;
 }
 function getHeadCommitSha(cwd) {
   try {
@@ -1966,9 +1979,9 @@ function isBranchContentAlreadyInBase(cwd, branch, baseBranch) {
     return false;
   }
 }
-function pickModuleCycleBranch(candidates, cycleNumber, module) {
+function pickModuleCycleBranch(candidates, cycleNumber, module, memberSlug) {
   if (candidates.length === 0) return void 0;
-  const expected = cycleBranchName(cycleNumber, module);
+  const expected = cycleBranchName(cycleNumber, module, memberSlug);
   return candidates.find((b2) => b2 === expected);
 }
 function listOrphanFeatBranches(cwd, baseBranch) {
@@ -3232,8 +3245,8 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
       async listContributors() {
         return this.invoke("listContributors", []);
       }
-      async addContributorByEmail(email) {
-        return this.invoke("addContributorByEmail", [email]);
+      async addContributorByEmail(email, role) {
+        return this.invoke("addContributorByEmail", [email, role]);
       }
       async removeContributorByEmail(email) {
         return this.invoke("removeContributorByEmail", [email]);
@@ -10155,6 +10168,38 @@ function computeCarryForwardStaleness(log2, doneTaskIds) {
   ].join("\n");
 }
 
+// src/lib/refs.ts
+var MAX_LABEL = 55;
+function truncateLabel(title, max = MAX_LABEL) {
+  if (title.length <= max) return title;
+  return `${title.slice(0, max - 1).trimEnd()}\u2026`;
+}
+function formatRef(id, title) {
+  const label = title?.trim();
+  if (!label) return id;
+  if (label.toLowerCase() === id.toLowerCase()) return id;
+  return `${id} (${truncateLabel(label)})`;
+}
+function formatRefList(ids, titles) {
+  return ids.map((id) => formatRef(id, lookupTitle(id, titles))).join(", ");
+}
+function lookupTitle(id, titles) {
+  if (!titles) return void 0;
+  return titles.get(id) ?? titles.get(id.toLowerCase()) ?? titles.get(id.toUpperCase());
+}
+function titleMap(entities) {
+  const map = /* @__PURE__ */ new Map();
+  for (const e of entities) {
+    if (!e.title) continue;
+    for (const key of [e.id, e.displayId]) {
+      if (!key) continue;
+      map.set(key, e.title);
+      map.set(key.toLowerCase(), e.title);
+    }
+  }
+  return map;
+}
+
 // src/lib/blocker.ts
 function idMatches(candidate, ref) {
   if (!candidate) return false;
@@ -10188,16 +10233,31 @@ function isBlockerResolved(blocker, ctx) {
       return false;
   }
 }
-function formatBlockerWaiting(blocker) {
+function formatBlockerWaiting(blocker, refTitle) {
+  const ref = formatRef(blocker.ref, refTitle);
   switch (blocker.type) {
     case "depends-on":
-      return `waiting on ${blocker.ref} \u2014 clears when that task is Done`;
+      return `waiting on ${ref} \u2014 clears when that task is Done`;
     case "owner-action":
-      return `waiting on owner action ${blocker.ref} \u2014 clears when you complete it`;
+      return `waiting on owner action ${ref} \u2014 clears when you complete it`;
+    case "decision-gate":
+      return `waiting on decision ${ref} \u2014 clears when that decision is resolved`;
+    default:
+      return `waiting on ${ref}`;
+  }
+}
+function resolveBlockerTitle(blocker, ctx) {
+  switch (blocker.type) {
+    case "depends-on":
+      return ctx.tasks.find(
+        (t) => idMatches(t.displayId, blocker.ref) || idMatches(t.id, blocker.ref)
+      )?.title;
     case "decision-gate":
-      return `waiting on decision ${blocker.ref} \u2014 clears when that decision is resolved`;
+      return ctx.decisions.find(
+        (d) => idMatches(d.displayId, blocker.ref) || idMatches(d.id, blocker.ref)
+      )?.title;
     default:
-      return `waiting on ${blocker.ref}`;
+      return void 0;
   }
 }
 
@@ -10428,11 +10488,22 @@ async function parkDecisionConflicts(adapter2, conflicts, newTaskIdMap, blockedC
   if (conflicts.length === 0) return [];
   const scheduled = new Set(scheduledTaskIds.map((id) => id.toLowerCase()));
   const results = [];
+  let adTitles = /* @__PURE__ */ new Map();
+  try {
+    if (adapter2.getActiveDecisions) adTitles = titleMap(await adapter2.getActiveDecisions());
+  } catch {
+  }
   for (const conflict of conflicts) {
     const resolvedTaskId = newTaskIdMap.get(conflict.taskId) ?? conflict.taskId;
-    const base = { ...conflict, resolvedTaskId, parked: false };
+    const adTitle = lookupTitle(conflict.adId, adTitles);
+    const base = { ...conflict, resolvedTaskId, parked: false, adTitle };
     if (scheduled.has(resolvedTaskId.toLowerCase())) {
-      results.push({ ...base, skipReason: "scheduled in this cycle \u2014 left in the cycle, conflict still surfaced" });
+      const [scheduledTask] = await adapter2.getTasks([resolvedTaskId]).catch(() => []);
+      results.push({
+        ...base,
+        taskTitle: scheduledTask?.title,
+        skipReason: "scheduled in this cycle \u2014 left in the cycle, conflict still surfaced"
+      });
       continue;
     }
     try {
@@ -10441,6 +10512,7 @@ async function parkDecisionConflicts(adapter2, conflicts, newTaskIdMap, blockedC
         results.push({ ...base, skipReason: "task not found" });
         continue;
       }
+      base.taskTitle = task.title;
       if (!PARKABLE_STATUSES.has(task.status)) {
         results.push({ ...base, skipReason: `status is ${task.status} \u2014 left as-is` });
         continue;
@@ -10453,7 +10525,7 @@ async function parkDecisionConflicts(adapter2, conflicts, newTaskIdMap, blockedC
         blocker: {
           type: "decision-gate",
           ref: conflict.adId,
-          reason: conflict.conflict || `Contradicts ${conflict.adId} \u2014 awaiting the owner's decision.`,
+          reason: conflict.conflict || `Contradicts ${formatRef(conflict.adId, adTitle)} \u2014 awaiting the owner's decision.`,
           blockedCycle
         }
       });
@@ -10780,7 +10852,8 @@ async function computeResurfacedBlockers(adapter2, tasks, decisions, currentCycl
   const resolvedLines = [];
   for (const t of blocked) {
     if (t.blocker && isBlockerResolved(t.blocker, ctx)) {
-      resolvedLines.push(`- **${t.displayId}** (${t.title}) \u2014 ${formatBlockerWaiting(t.blocker)} \u2192 now RESOLVED, ready to unblock`);
+      const waiting = formatBlockerWaiting(t.blocker, resolveBlockerTitle(t.blocker, ctx));
+      resolvedLines.push(`- **${t.displayId}** (${t.title}) \u2014 ${waiting} \u2192 now RESOLVED, ready to unblock`);
     }
   }
   return resolvedLines.length > 0 ? resolvedLines.join("\n") : void 0;
@@ -13085,6 +13158,22 @@ var planTool = {
     ]
   }
 };
+function formatDecisionConflicts(conflicts) {
+  if (conflicts.length === 0) return [];
+  const lines = [""];
+  lines.push(`\u{1F500} **${conflicts.length} decision(s) need your call \u2014 work was NOT dropped.**`);
+  lines.push("These tasks cut against a live Active Decision. An AD is *active* \u2014 it can be superseded, so the planner parked the work instead of shelving it:");
+  for (const c of conflicts) {
+    const ad = formatRef(c.adId, c.adTitle);
+    const state = c.parked ? `Blocked behind ${ad}` : `still ${c.skipReason ?? "unparked"}`;
+    lines.push(`- **${formatRef(c.resolvedTaskId, c.taskTitle)} vs ${ad}** \u2014 ${c.conflict} _(${state})_`);
+    if (c.options.length > 0) lines.push(`  Options: ${c.options.join(" | ")}`);
+    if (c.recommendation) lines.push(`  Planner recommends: ${c.recommendation}`);
+  }
+  lines.push("");
+  lines.push('Decide: `strategy_change` with `mode: "capture"` to supersede or modify the AD (parked tasks auto-unblock once it moves), or `board_edit` to cancel the task if the AD stands.');
+  return lines;
+}
 function formatPlanResult(result) {
   const modeLabel = result.mode === "bootstrap" ? "Bootstrap" : "Full";
   const cycleLabel = `Cycle ${result.cycleNumber + 1}`;
@@ -13131,20 +13220,7 @@ function formatPlanResult(result) {
     lines.push('To apply these cancellations, re-run `plan` with `mode: "apply"` and `confirm_cancellations: true`.');
     lines.push("To keep these tasks, do nothing \u2014 they remain on the board.");
   }
-  const conflicts = result.decisionConflicts ?? [];
-  if (conflicts.length > 0) {
-    lines.push("");
-    lines.push(`\u{1F500} **${conflicts.length} decision(s) need your call \u2014 work was NOT dropped.**`);
-    lines.push("These tasks cut against a live Active Decision. An AD is *active* \u2014 it can be superseded, so the planner parked the work instead of shelving it:");
-    for (const c of conflicts) {
-      const state = c.parked ? `Blocked behind ${c.adId}` : `still ${c.skipReason ?? "unparked"}`;
-      lines.push(`- **${c.resolvedTaskId} vs ${c.adId}** \u2014 ${c.conflict} _(${state})_`);
-      if (c.options.length > 0) lines.push(`  Options: ${c.options.join(" | ")}`);
-      if (c.recommendation) lines.push(`  Planner recommends: ${c.recommendation}`);
-    }
-    lines.push("");
-    lines.push('Decide: `strategy_change` with `mode: "capture"` to supersede or modify the AD (parked tasks auto-unblock once it moves), or `board_edit` to cancel the task if the AD stands.');
-  }
+  lines.push(...formatDecisionConflicts(result.decisionConflicts ?? []));
   if (result.skipHandoffs) {
     const taskCount = result.writeSummary?.taskIds.length ?? 0;
     lines.push("", `Next: run \`handoff_generate\` to create BUILD HANDOFFs for your ${taskCount} cycle task(s), then \`build_list\` to start building.`);
@@ -13381,6 +13457,85 @@ ${result.userMessage}
   }
 }
 
+// src/lib/capabilities.ts
+init_dist();
+
+// src/lib/directive-builders.ts
+function buildPrReviewerDirective(caps) {
+  if (!isCapabilityEnabled(caps, "prReviewer")) return null;
+  return `
+
+**Quality Gate:** no auto-review attached. PAPI's standard pre-accept step is a code review of the branch diff \u2014 run \`review_submit\` with \`dispatch:"subagent"\` to auto-review, or attach \`auto_review\` findings. Risk-tier work (auth, data, migrations, CI) should always carry one.`;
+}
+function buildChangelogDirective(caps, inner) {
+  if (!isCapabilityEnabled(caps, "changelog")) return null;
+  return inner;
+}
+function buildDiscoveredIssuesDirective(caps, issueLines) {
+  if (!isCapabilityEnabled(caps, "discoveredIssues")) return null;
+  if (issueLines.length === 0) return null;
+  return [
+    "",
+    "---",
+    "",
+    `## Discovered Issues (${issueLines.length})`,
+    "",
+    ...issueLines,
+    "",
+    "*These issues were logged during builds \u2014 triage them in the next plan.*"
+  ].join("\n");
+}
+function buildModelRecommendationDirective(caps, tierBlock) {
+  if (!isCapabilityEnabled(caps, "modelRecommendation")) return null;
+  return tierBlock;
+}
+function buildVerifyHealthCheckDirective(caps) {
+  if (!isCapabilityEnabled(caps, "verifyHealthCheck")) return null;
+  return `
+
+**Health check:** before you consider the cycle shipped, verify cycle state (plan validity, review coverage, branch hygiene) \u2014 run the \`papi-verify\` skill or a quick \`board_view\` pass.`;
+}
+function buildGestaltPreBuildDirective(caps) {
+  if (!isCapabilityEnabled(caps, "gestaltPreBuild")) return null;
+  return `
+
+**Gestalt pre-build:** on the first task of a multi-task cycle, read every task's BUILD HANDOFF together (shared files, sequencing, module split) before building \u2014 one-time check at cycle start.`;
+}
+function buildBatchBuildRollupDirective(caps) {
+  if (!isCapabilityEnabled(caps, "batchBuildRollup")) return null;
+  return `
+
+**Batch rollup:** after the final task of a batch, emit a cycle-level rollup \u2014 build summary table + discovered issues grouped by severity + next action.`;
+}
+function buildSecurityScanDirective(caps) {
+  if (!isCapabilityEnabled(caps, "securityScan")) return null;
+  return `
+
+**Security scan:** risk-tier changes (auth, data, migrations, secrets, endpoints) should carry a security pass \u2014 OWASP top-10 + secret-exposure check on the changed surface before merge.`;
+}
+function buildDeployHookDirective(caps, deployCommand) {
+  if (!isCapabilityEnabled(caps, "deployHook")) return null;
+  const command = deployCommand?.trim() || void 0;
+  if (!command) return null;
+  return `
+
+---
+
+## Deploy \u2014 run after this release
+
+The post-release deploy hook is on and a deploy command is configured, so ship the merged release now.
+
+Run your deploy command yourself:
+\`\`\`
+${command}
+\`\`\`
+PAPI never runs this command itself (AD-58) \u2014 you run it in your own environment. Turn the "Post-release deploy" capability off in the dashboard, or unset PAPI_DEPLOY, to stop this reminder.`;
+}
+function buildPapiMetaFramingDirective(caps, inner) {
+  if (!isCapabilityEnabled(caps, "papiMetaFraming")) return null;
+  return inner;
+}
+
 // src/services/strategy.ts
 import { randomUUID as randomUUID5, createHash as createHash4 } from "crypto";
 import { execFileSync as execFileSync2 } from "child_process";
@@ -13737,8 +13892,10 @@ ${lines.join("\n")}
   }
   let notesWithAlignment = input.notes || "";
   let detectedAdIds = [];
+  let adTitles = /* @__PURE__ */ new Map();
   try {
     const ads = await adapter2.getActiveDecisions();
+    adTitles = titleMap(ads);
     const ideaCombined = `${input.text} ${input.notes ?? ""}`;
     const alignmentMatches = findAdAlignmentMatches(ideaCombined, ads);
     if (alignmentMatches.length > 0) {
@@ -13828,7 +13985,7 @@ AD-CONFLICT: ${conflictsWithAd} \u2014 submitter flagged this as cutting against
         blocker: {
           type: "decision-gate",
           ref: conflictsWithAd,
-          reason: `Submitted as cutting against ${conflictsWithAd}. Awaiting the owner's decision.`,
+          reason: `Submitted as cutting against ${formatRef(conflictsWithAd, lookupTitle(conflictsWithAd, adTitles))}. Awaiting the owner's decision.`,
           blockedCycle: health.totalCycles
         }
       });
@@ -13847,21 +14004,36 @@ AD-CONFLICT: ${conflictsWithAd} \u2014 submitter flagged this as cutting against
     routing: "task",
     task,
     message: `${task.id}: "${task.title}" \u2014 ${landing}${typeNote}${visibilityNote}${mismatchNote}`,
-    ...adIds.length > 0 ? { adConflicts: { adIds, explicit: Boolean(conflictsWithAd), gated } } : {}
+    ...adIds.length > 0 ? {
+      adConflicts: {
+        adIds,
+        explicit: Boolean(conflictsWithAd),
+        gated,
+        // task-3347: id → title for exactly the ADs named above, so the tool
+        // layer renders `AD-12 (Single board view)` without a second read.
+        adTitles: Object.fromEntries(
+          adIds.flatMap((id) => {
+            const title = lookupTitle(id, adTitles);
+            return title ? [[id, title]] : [];
+          })
+        )
+      }
+    } : {}
   };
 }
-function buildAdConflictNote(conflictsWithAd, detectedAdIds, gated) {
+function buildAdConflictNote(conflictsWithAd, detectedAdIds, gated, adTitles) {
   if (conflictsWithAd) {
-    const state = gated ? `Parked as **Blocked** behind a decision gate on ${conflictsWithAd} \u2014 it auto-unblocks once that AD is superseded, modified, or reaffirmed.` : `Recorded against ${conflictsWithAd} (gate could not be applied \u2014 the AD-CONFLICT note is on the task).`;
+    const ref = formatRef(conflictsWithAd, lookupTitle(conflictsWithAd, adTitles));
+    const state = gated ? `Parked as **Blocked** behind a decision gate on ${ref} \u2014 it auto-unblocks once that AD is superseded, modified, or reaffirmed.` : `Recorded against ${ref} (gate could not be applied \u2014 the AD-CONFLICT note is on the task).`;
     return `
 
-\u{1F500} **Conflicts with ${conflictsWithAd}.** ${state}
+\u{1F500} **Conflicts with ${ref}.** ${state}
 **Tell the user now** \u2014 an AD is *active*, so this is their call to make, not yours. Offer both paths: supersede the AD via \`strategy_change\`, or leave the AD standing and drop the task.`;
   }
   if (detectedAdIds.length > 0) {
     return `
 
-\u{1F500} **Possible conflict with ${detectedAdIds.join(", ")}** (keyword match \u2014 verify it is real).
+\u{1F500} **Possible conflict with ${formatRefList(detectedAdIds, adTitles)}** (keyword match \u2014 verify it is real).
 If it IS a real contradiction, **do not shelve the idea on those grounds**: surface it to the user and re-submit with \`conflicts_with_ad\` so the task is gated on the decision instead of quietly competing in the backlog.`;
   }
   return "";
@@ -14332,7 +14504,8 @@ async function assembleContext2(adapter2, cycleNumber, cyclesSinceLastReview, pr
     pendingRecs,
     registeredDocs,
     docsWithPendingActions,
-    decisionScores
+    decisionScores,
+    allClosedTasks
   ] = await Promise.all([
     adapter2.readProductBrief(),
     // Strategy review needs to see retired ADs to triage/restore them as needed.
@@ -14361,7 +14534,15 @@ async function assembleContext2(adapter2, cycleNumber, cyclesSinceLastReview, pr
     // Doc registry — docs with pending actions for staleness audit
     adapter2.searchDocs?.({ hasPendingActions: true, limit: 20 })?.catch(() => []) ?? Promise.resolve([]),
     // task-2264: decision risk scores + movement, so the review can show trajectory.
-    adapter2.getDecisionScorePatterns?.()?.catch(() => []) ?? Promise.resolve([])
+    adapter2.getDecisionScorePatterns?.()?.catch(() => []) ?? Promise.resolve([]),
+    // task-3331 (C363): UNWINDOWED closed-task ids, purely to exclude already-closed
+    // tasks from the repeat-deferral detector. Deliberately NOT reusing
+    // recentDoneTasks: that set is windowed with `cycleSince: lastReviewCycleNum`
+    // because the surfaces it feeds (review-window comments) genuinely want the
+    // window. Carry-forward history spans many cycles, so a task that shipped BEFORE
+    // the window was invisible to the exclusion and kept being flagged. Compact +
+    // Cancelled, matching what services/plan.ts already does correctly.
+    adapter2.queryBoard({ status: ["Done", "Cancelled"], compact: true }).catch(() => [])
   ]);
   const pendingAgendaTopics = await (adapter2.getPendingAgendaTopics?.().catch(() => []) ?? Promise.resolve([]));
   const tasks = [...activeTasks, ...recentDoneTasks];
@@ -14643,7 +14824,7 @@ ${lines.join("\n")}`;
     { label: "docActionStaleness", hasData: docActionStalenessText !== void 0 }
   ]);
   const doneTaskIds = new Set(
-    recentDoneTasks.map((t) => t.displayId ?? t.id).filter((id) => !!id)
+    allClosedTasks.map((t) => t.displayId ?? t.id).filter((id) => !!id)
   );
   const earnedPushback = computeEarnedPushback({ reports, log: recentLog, doneTaskIds });
   const context = {
@@ -15792,6 +15973,35 @@ function toDateLabel(value) {
   const d = value instanceof Date ? value : new Date(value);
   return Number.isNaN(d.getTime()) ? "" : d.toISOString().slice(0, 10);
 }
+var STRATEGY_REVIEW_CHANNEL_ENV = "DISCORD_STRATEGY_REVIEW_CHANNEL_ID";
+function buildStrategyReviewPostDirective(cycleNumber) {
+  const channelId = process.env[STRATEGY_REVIEW_CHANNEL_ENV]?.trim();
+  if (!channelId) return null;
+  return [
+    "",
+    "---",
+    "## \u{1F4E3} Post the patch notes to Discord #papi-strategy-review",
+    "",
+    `This review closed **Cycle ${cycleNumber}**. Post a curated, safety-gated **rich embed** (NOT plain content, so links do not unfurl) to #papi-strategy-review (id \`${channelId}\`) via \`mcp__discord__send_embed\`. Run \`/patch-notes\` \u2014 it owns the mechanics.`,
+    "",
+    "**LOCKED TEMPLATE \u2014 every patch note uses this exact shape (do NOT improvise the structure):**",
+    "- `title`: `PAPI Patch Notes v<version>`",
+    "- `description`: `Covering Cycles <start>\u2013<end>`",
+    "- `color`: `#6C5CE7` (PAPI purple)",
+    "- `fields`: one per non-empty category, `inline: false`, `\u2022 ` bullets \u2014 \u{1F680} New Features, \u{1F6E0} Improvements, \u{1F41B} Bug Fixes, \u2699\uFE0F Under the Hood, \u{1F52E} What's Coming (always included)",
+    "- `footer`: `PAPI v<version> \xB7 <date>`",
+    "",
+    "This is the DEEP multi-cycle note covering the whole review window, not a single release. Aim for 5-7 items in the strong sections. Strip task-IDs, branch names and internal framing; only changes an existing user would notice.",
+    "",
+    "Then:",
+    "1. Run the build-in-public safety gate: NO external usernames, NO contributor or private work, NO owner cost/commercial data, NO failure-rate or funnel percentages.",
+    "2. Show the draft embed for approval BEFORE posting.",
+    `3. On approval, send the embed to channel \`${channelId}\`.`,
+    "4. Then run `/content-pack --source=strategy_review` \u2014 a review is the richest content source PAPI produces, and it is the cadence the Blog and Substack lanes exist for.",
+    "",
+    "Skip only if nothing user-facing shipped in the whole window, and say so explicitly rather than moving on silently."
+  ].join("\n");
+}
 var reviewPrepareCache = new PerCallerCache();
 var strategyReviewTool = {
   name: "strategy_review",
@@ -15973,6 +16183,19 @@ ${recLines.join("\n")}
         }
       } catch {
       }
+      let caps = {};
+      try {
+        const info = adapter2.getProjectInfo ? await adapter2.getProjectInfo() : null;
+        caps = info?.capabilities ?? {};
+      } catch {
+        caps = {};
+      }
+      const postDirective = buildChangelogDirective(
+        caps,
+        buildStrategyReviewPostDirective(result.cycleNumber)
+      );
+      const postStep = postDirective ? `4. Post the patch notes to Discord \u2014 see the directive at the end of this output.
+5. Then run \`plan\` for the next cycle.` : `4. Then run \`plan\` for the next cycle.`;
       const actionReminder = `
 
 ---
@@ -15981,8 +16204,10 @@ ${recLines.join("\n")}
 1. Review the AD changes above \u2014 are any resolved/modified ADs still referenced by active tasks?
 2. Act on strategic recommendations \u2014 cancel, defer, or reprioritise tasks as suggested.
 3. Run \`strategy_change\` if any recommendation requires an AD update not already captured.
-4. Then run \`plan\` for the next cycle.`;
-      const response = textResponse(header + result.displayText + slackNote + recsCloseOut + actionReminder);
+` + postStep;
+      const response = textResponse(
+        header + result.displayText + slackNote + recsCloseOut + actionReminder + (postDirective ?? "")
+      );
       return {
         ...response,
         ...contextBytes !== void 0 ? { _contextBytes: contextBytes } : {},
@@ -16386,7 +16611,17 @@ var BOARD_COLUMNS = [
   { name: "createdAt", header: "Created", value: (t) => t.createdAt ?? "-" },
   { name: "source", header: "Source", value: (t) => t.source ?? "-" }
 ];
-var BOARD_FIELDS = BOARD_COLUMNS.map((c) => c.name);
+var ASSIGNEE_FIELD = "assignee";
+function assigneeColumn(nameOf) {
+  return {
+    name: ASSIGNEE_FIELD,
+    header: "Assignee",
+    // An unresolved id still renders as a short id rather than blank: "someone holds
+    // this" is the fact that matters, and a blank cell reads as unclaimed.
+    value: (t) => t.assigneeId ? nameOf.get(t.assigneeId) ?? t.assigneeId.slice(0, 8) : "\u2014"
+  };
+}
+var BOARD_FIELDS = [...BOARD_COLUMNS.map((c) => c.name), ASSIGNEE_FIELD];
 var BOARD_SINGLE_LABELS = {
   id: "Task",
   title: "Title",
@@ -16445,6 +16680,11 @@ var boardViewTool = {
         enum: ["full", "summary"],
         description: 'Output mode: "full" (default) shows task table, "summary" shows counts only.'
       },
+      assignee: {
+        type: "string",
+        enum: ["me", "unclaimed"],
+        description: 'Filter by who holds the task on a shared project. "me" shows only your own claims; "unclaimed" shows the open pool nobody has taken. Omit to see everything. On a multi-member project the board also gains an Assignee column showing who holds each task.'
+      },
       fields: {
         type: "string",
         description: `Optional sparse-field projection \u2014 comma-separated column names, e.g. "title,status". Returns ONLY those columns (id is always included so rows stay addressable) which is far cheaper on session context than the full table. Allowed: ${BOARD_FIELDS.join(", ")}. An unknown name is an error.`
@@ -16657,11 +16897,16 @@ function formatSingleTask(t, fields) {
   if (t.why?.trim()) lines.push(`- **Why:** ${t.why.trim()}`);
   return lines.join("\n");
 }
-function formatBoard(result, fields) {
+function formatBoard(result, fields, assignee) {
   if (result.tasks.length === 0) {
     return "No tasks found.";
   }
-  const columns = selectColumns(BOARD_COLUMNS, fields);
+  const available = assignee ? [
+    ...BOARD_COLUMNS.slice(0, 4),
+    assignee,
+    ...BOARD_COLUMNS.slice(4)
+  ] : BOARD_COLUMNS;
+  const columns = selectColumns(available, fields);
   const headers = columns.map((c) => c.header);
   const rows = result.tasks.map((t) => columns.map((c) => c.value(t)));
   const lines = [];
@@ -16690,6 +16935,38 @@ function formatSummary(summary) {
   }
   return lines.join("\n");
 }
+async function resolveBoardMembership(adapter2) {
+  const empty = { isMultiMember: false, nameOf: /* @__PURE__ */ new Map(), callerUserId: null };
+  if (!adapterSupports(adapter2, "listContributors")) return empty;
+  let contributors;
+  try {
+    contributors = await adapter2.listContributors();
+  } catch {
+    return empty;
+  }
+  if (contributors.length <= 1) return empty;
+  const nameOf = new Map(
+    contributors.map((c) => [c.userId, c.displayName || c.email || c.userId.slice(0, 8)])
+  );
+  let callerUserId = null;
+  try {
+    if (adapterSupports(adapter2, "getOwnerIdentity")) {
+      callerUserId = (await adapter2.getOwnerIdentity()).callerUserId ?? null;
+    } else if (adapterSupports(adapter2, "getProjectOwnerUserId")) {
+      callerUserId = await adapter2.getProjectOwnerUserId();
+    }
+  } catch {
+    callerUserId = null;
+  }
+  return { isMultiMember: true, nameOf, callerUserId };
+}
+function applyAssigneeFilter(result, filter, callerUserId) {
+  if (!filter) return result;
+  const tasks = result.tasks.filter(
+    (t) => filter === "unclaimed" ? !t.assigneeId : t.assigneeId === callerUserId
+  );
+  return { ...result, tasks, returned: tasks.length, total: tasks.length, hasMore: false };
+}
 async function handleBoardView(adapter2, args) {
   const mode = args.mode;
   const projection = resolveFields(args.fields, BOARD_FIELDS, "board_view");
@@ -16708,6 +16985,18 @@ async function handleBoardView(adapter2, args) {
     const meta2 = emitMeta ? { total: 1, filtered: 1, returned: 1, limit: null, offset: 0 } : null;
     return textResponse(withMeta(formatSingleTask(task, fields), meta2));
   }
+  const membership = await resolveBoardMembership(adapter2);
+  const assigneeFilterRaw = typeof args.assignee === "string" ? args.assignee.trim().toLowerCase() : void 0;
+  if (assigneeFilterRaw !== void 0 && assigneeFilterRaw !== "me" && assigneeFilterRaw !== "unclaimed") {
+    return errorResponse(
+      `Unknown assignee filter "${args.assignee}". Use assignee="me" for your own claims, or assignee="unclaimed" for the open pool.`
+    );
+  }
+  if (assigneeFilterRaw === "me" && !membership.callerUserId) {
+    return errorResponse(
+      'assignee="me" needs an identified caller, and this connection has none. Use assignee="unclaimed" to see the open pool.'
+    );
+  }
   const result = await viewBoard(adapter2, void 0, {
     phase: args.phase,
     status: args.status,
@@ -16716,7 +17005,12 @@ async function handleBoardView(adapter2, args) {
     query: args.query,
     cycle: args.cycle
   });
-  let output = formatBoard(result, fields);
+  const filtered = applyAssigneeFilter(result, assigneeFilterRaw, membership.callerUserId);
+  let output = formatBoard(
+    filtered,
+    fields,
+    membership.isMultiMember ? assigneeColumn(membership.nameOf) : null
+  );
   if (!fields) {
     try {
       const comments = await adapter2.getRecentTaskComments?.(30);
@@ -18658,6 +18952,118 @@ async function ensureMcpJsonGitignored(projectRoot) {
   }
 }
 
+// src/tools/join.ts
+var joinTool = {
+  name: "join",
+  description: "Join a project that already exists, as a new team member. Run this instead of `setup` when someone else already set the project up \u2014 setup is for creating a project, and running it as a joiner writes scaffolding into a repo that already has it. `join` confirms which project you are bound to, shows the Active Decisions and canon docs you are expected to read, and shows the task pool you can claim from. It writes NOTHING to your repo. Does not call the Anthropic API.",
+  annotations: { title: "Join Project", readOnlyHint: true, destructiveHint: false, openWorldHint: false },
+  inputSchema: {
+    type: "object",
+    properties: {
+      limit: {
+        type: "integer",
+        description: "Maximum claimable tasks to list (default 10)."
+      }
+    },
+    required: []
+  }
+};
+function formatDecisions(decisions) {
+  if (decisions.length === 0) {
+    return "_No Active Decisions recorded yet._";
+  }
+  const shown = decisions.slice(0, 15);
+  const lines = shown.map((d) => `- **${d.id}** \u2014 ${d.title ?? "(untitled)"}${d.confidence ? ` _(${d.confidence})_` : ""}`);
+  const more = decisions.length > shown.length ? `
+- _\u2026and ${decisions.length - shown.length} more. Run \`ad_view\` for the full set._` : "";
+  return lines.join("\n") + more;
+}
+function formatDocs(docs) {
+  if (docs.length === 0) {
+    return "_No registered canon docs. Ask the project owner what to read._";
+  }
+  return docs.slice(0, 12).map((d) => `- \`${d.path}\`${d.title ? ` \u2014 ${d.title}` : ""}`).join("\n");
+}
+function formatPool(tasks, limit) {
+  if (tasks.length === 0) {
+    return "_The shared backlog is empty right now \u2014 ask the owner what to pick up._";
+  }
+  const rows = tasks.slice(0, limit).map(
+    (t) => `| ${t.id} | ${t.title} | ${t.priority ?? "-"} | ${t.complexity ?? "-"} |`
+  );
+  const more = tasks.length > limit ? `
+
+_\u2026and ${tasks.length - limit} more in the pool._` : "";
+  return `| Task | Summary | Priority | Effort |
+|---|---|---|---|
+${rows.join("\n")}${more}`;
+}
+var JOIN_POINTER = "Run `join` instead \u2014 it shows you the project, its Active Decisions, the docs to read, and the tasks you can claim, without writing anything to the repo.";
+async function handleJoin(adapter2, config2, args) {
+  const limit = typeof args.limit === "number" && args.limit > 0 ? Math.floor(args.limit) : 10;
+  let projectLabel = "this project";
+  try {
+    const brief = adapterSupports(adapter2, "readProductBrief") ? await adapter2.readProductBrief() : "";
+    const heading = brief.match(/^#\s+(.+)$/m)?.[1]?.trim();
+    if (heading) projectLabel = heading;
+  } catch {
+  }
+  const gate = await resolveOwnerGate(adapter2, config2);
+  const [decisions, docs, pool] = await Promise.all([
+    adapter2.getActiveDecisions().catch(() => []),
+    // SECURITY: visibility scoping is delegated to searchDocs' requesterUserId
+    // (task-1977) rather than reading rows directly — a contributors-tier or
+    // private doc must not become readable just because someone joined. Passing
+    // the caller means a non-owner sees public docs plus the contributors-tier
+    // docs they are actually a cohort member of; private is excluded fail-closed.
+    adapterSupports(adapter2, "searchDocs") ? adapter2.searchDocs({ requesterUserId: gate.callerUserId ?? void 0, limit: 12 }).catch(() => []) : Promise.resolve([]),
+    // The claimable pool is the shared backlog: unassigned AND not yet pulled into
+    // anyone's cycle. Same invariant task_claim enforces (assigneeId == null &&
+    // cycle == null), so nothing is listed here that a claim would then refuse.
+    adapter2.queryBoard({ status: ["Backlog"] }).catch(() => [])
+  ]);
+  const claimable = pool.filter((t) => !t.assigneeId && t.cycle == null);
+  let conventionLine = "";
+  try {
+    if (adapterSupports(adapter2, "listConventions")) {
+      const conventions = await adapter2.listConventions();
+      if (conventions.length > 0) {
+        conventionLine = `
+
+## Conventions that ride every build
+` + conventions.slice(0, 8).map((c) => `- ${c.rule}`).join("\n");
+      }
+    }
+  } catch {
+  }
+  const roleLine = gate.callerIsOwner ? `You are the **owner** of this project.` : `You are a **member** of this project.`;
+  return textResponse(
+    `# Joined \u2014 ${projectLabel}
+
+${roleLine} Nothing has been written to your repo \u2014 \`join\` is read-only, and this project's harness files are already committed by whoever set it up.
+
+**If that is not the project you expected, stop here.** Your connection is bound to the wrong project; fix \`PAPI_PROJECT_ID\` (local) or the \`x-papi-project-id\` header (remote), or run \`project_switch\`, before writing anything.
+
+## Decisions already made
+These are settled stances, not suggestions. Read them before proposing a different approach \u2014 if you disagree with one, say so rather than working around it.
+
+${formatDecisions(decisions)}
+
+## Canon docs to read
+${formatDocs(docs)}` + conventionLine + `
+
+## Work you can claim
+${claimable.length} task(s) in the shared backlog. Claim one with \`task_claim <task-id>\` \u2014 it becomes yours and shows against your name on the board.
+
+${formatPool(claimable, limit)}
+
+## Your next move
+Run \`orient\` to see where the project stands and what your own cycle looks like. You get your OWN cycle numbering \u2014 your cycle 1 is independent of everyone else's.
+
+Do NOT run \`setup\`. It is for creating a project, and this one already exists.`
+  );
+}
+
 // src/tools/setup.ts
 var setupTool = {
   name: "setup",
@@ -18875,8 +19281,36 @@ function formatSetupNarration(result) {
     ...steps.map((s, i) => `${i + 1}. ${s}`)
   ];
 }
+async function refuseIfJoiner(adapter2, config2) {
+  let gate;
+  try {
+    gate = await resolveOwnerGate(adapter2, config2);
+  } catch {
+    return null;
+  }
+  if (!gate.enforced || gate.callerIsOwner) return null;
+  if (gate.resolutionError || !gate.callerUserId) return null;
+  let alreadySetUp = false;
+  try {
+    if (adapterSupports(adapter2, "readProductBrief")) {
+      alreadySetUp = (await adapter2.readProductBrief()).trim().length > 0;
+    }
+  } catch {
+    return null;
+  }
+  if (!alreadySetUp) return null;
+  return `This project is already set up, and you are joining it rather than creating it.
+
+\`setup\` writes the project harness \u2014 AGENTS.md, CLAUDE.md, .claude/settings.json, docs/ \u2014 into your repo. Those files are already here and committed by whoever set the project up, so running setup would rewrite shared files and record "first" Active Decisions into a registry that already has them.
+
+${JOIN_POINTER}
+
+If you genuinely need to re-scaffold this project, ask its owner to run setup.`;
+}
 async function handleSetup(adapter2, config2, args, clientName) {
   const toolMode = args.mode;
+  const joinerRefusal = await refuseIfJoiner(adapter2, config2);
+  if (joinerRefusal) return errorResponse(joinerRefusal);
   const REQUIRED_FIELDS = ["project_name"];
   const missing = REQUIRED_FIELDS.filter((f) => !args[f] || typeof args[f] === "string" && !args[f].trim());
   if (missing.length > 0) {
@@ -19154,89 +19588,10 @@ Examples (use whichever provider you have): ${spec.examples}.
 _Recommendation only \u2014 PAPI never selects or runs a model. Policy: XS/S \u2192 cheap, M/L \u2192 capable, XL \u2192 frontier._`;
 }
 
-// src/lib/capabilities.ts
-init_dist();
-
 // src/tools/build.ts
 init_dist();
 init_dist();
 
-// src/lib/directive-builders.ts
-function buildPrReviewerDirective(caps) {
-  if (!isCapabilityEnabled(caps, "prReviewer")) return null;
-  return `
-
-**Quality Gate:** no auto-review attached. PAPI's standard pre-accept step is a code review of the branch diff \u2014 run \`review_submit\` with \`dispatch:"subagent"\` to auto-review, or attach \`auto_review\` findings. Risk-tier work (auth, data, migrations, CI) should always carry one.`;
-}
-function buildChangelogDirective(caps, inner) {
-  if (!isCapabilityEnabled(caps, "changelog")) return null;
-  return inner;
-}
-function buildDiscoveredIssuesDirective(caps, issueLines) {
-  if (!isCapabilityEnabled(caps, "discoveredIssues")) return null;
-  if (issueLines.length === 0) return null;
-  return [
-    "",
-    "---",
-    "",
-    `## Discovered Issues (${issueLines.length})`,
-    "",
-    ...issueLines,
-    "",
-    "*These issues were logged during builds \u2014 triage them in the next plan.*"
-  ].join("\n");
-}
-function buildModelRecommendationDirective(caps, tierBlock) {
-  if (!isCapabilityEnabled(caps, "modelRecommendation")) return null;
-  return tierBlock;
-}
-function buildVerifyHealthCheckDirective(caps) {
-  if (!isCapabilityEnabled(caps, "verifyHealthCheck")) return null;
-  return `
-
-**Health check:** before you consider the cycle shipped, verify cycle state (plan validity, review coverage, branch hygiene) \u2014 run the \`papi-verify\` skill or a quick \`board_view\` pass.`;
-}
-function buildGestaltPreBuildDirective(caps) {
-  if (!isCapabilityEnabled(caps, "gestaltPreBuild")) return null;
-  return `
-
-**Gestalt pre-build:** on the first task of a multi-task cycle, read every task's BUILD HANDOFF together (shared files, sequencing, module split) before building \u2014 one-time check at cycle start.`;
-}
-function buildBatchBuildRollupDirective(caps) {
-  if (!isCapabilityEnabled(caps, "batchBuildRollup")) return null;
-  return `
-
-**Batch rollup:** after the final task of a batch, emit a cycle-level rollup \u2014 build summary table + discovered issues grouped by severity + next action.`;
-}
-function buildSecurityScanDirective(caps) {
-  if (!isCapabilityEnabled(caps, "securityScan")) return null;
-  return `
-
-**Security scan:** risk-tier changes (auth, data, migrations, secrets, endpoints) should carry a security pass \u2014 OWASP top-10 + secret-exposure check on the changed surface before merge.`;
-}
-function buildDeployHookDirective(caps, deployCommand) {
-  if (!isCapabilityEnabled(caps, "deployHook")) return null;
-  const command = deployCommand?.trim() || void 0;
-  if (!command) return null;
-  return `
-
----
-
-## Deploy \u2014 run after this release
-
-The post-release deploy hook is on and a deploy command is configured, so ship the merged release now.
-
-Run your deploy command yourself:
-\`\`\`
-${command}
-\`\`\`
-PAPI never runs this command itself (AD-58) \u2014 you run it in your own environment. Turn the "Post-release deploy" capability off in the dashboard, or unset PAPI_DEPLOY, to stop this reminder.`;
-}
-function buildPapiMetaFramingDirective(caps, inner) {
-  if (!isCapabilityEnabled(caps, "papiMetaFraming")) return null;
-  return inner;
-}
-
 // src/services/build.ts
 init_dist();
 import { randomUUID as randomUUID6 } from "crypto";
@@ -21335,6 +21690,20 @@ async function safeUpdateBlocker(adapter2, taskId, blocker) {
   } catch {
   }
 }
+async function resolveMemberBranchSlug(adapter2) {
+  if (!adapterSupports(adapter2, "listContributors")) return void 0;
+  try {
+    const members = await adapter2.listContributors();
+    if (members.length <= 1) return void 0;
+    const callerUserId = adapterSupports(adapter2, "getOwnerIdentity") ? (await adapter2.getOwnerIdentity()).callerUserId ?? null : adapterSupports(adapter2, "getProjectOwnerUserId") ? await adapter2.getProjectOwnerUserId() : null;
+    if (!callerUserId) return void 0;
+    const me = members.find((m) => m.userId === callerUserId);
+    if (!me) return void 0;
+    return memberBranchSlug({ displayName: me.displayName, email: me.email, userId: me.userId });
+  } catch {
+    return void 0;
+  }
+}
 async function startBuild(adapter2, config2, taskId, options = {}, clientName) {
   const task = await adapter2.getTask(taskId);
   if (!task) {
@@ -21437,13 +21806,14 @@ async function startBuild(adapter2, config2, taskId, options = {}, clientName) {
     }
     const inFlightTaskBranch = !depBranchReuse && branchExists(config2.projectRoot, taskBranchName(taskId)) ? taskBranchName(taskId) : void 0;
     const useSharedBranch = !depBranchReuse && !inFlightTaskBranch && !!task.module && cycleNumber > 0;
+    const memberSlug = useSharedBranch ? await resolveMemberBranchSlug(adapter2) : void 0;
     let originCycleBranch;
     if (useSharedBranch && hasRemote(config2.projectRoot)) {
       const baseBranch = resolveBaseBranch(config2.projectRoot, config2.baseBranch);
       const remoteCycleBranches = listGroupedCycleBranches(config2.projectRoot, cycleNumber, baseBranch);
-      originCycleBranch = pickModuleCycleBranch(remoteCycleBranches, cycleNumber, task.module);
+      originCycleBranch = pickModuleCycleBranch(remoteCycleBranches, cycleNumber, task.module, memberSlug);
     }
-    const featureBranch = depBranchReuse ? depBranchReuse.branch : inFlightTaskBranch ? inFlightTaskBranch : useSharedBranch ? originCycleBranch ?? cycleBranchName(cycleNumber, task.module) : taskBranchName(taskId);
+    const featureBranch = depBranchReuse ? depBranchReuse.branch : inFlightTaskBranch ? inFlightTaskBranch : useSharedBranch ? originCycleBranch ?? cycleBranchName(cycleNumber, task.module, memberSlug) : taskBranchName(taskId);
     if (depBranchReuse) {
       branchLines.push(
         `Reusing branch '${depBranchReuse.branch}' from dependency ${depBranchReuse.upstreamId} \u2014 commits will stack for a single PR.`
@@ -24749,7 +25119,10 @@ Re-submit with \`notes: "... Reference: <path>"\` to link one, or ignore if none
     const conflictNote = result.adConflicts ? buildAdConflictNote(
       result.adConflicts.explicit ? result.adConflicts.adIds[0] : void 0,
       result.adConflicts.explicit ? [] : result.adConflicts.adIds,
-      result.adConflicts.gated
+      result.adConflicts.gated,
+      // task-3347: resolved alongside the ids, so the directive names the
+      // decision the user is being asked to rule on.
+      new Map(Object.entries(result.adConflicts.adTitles ?? {}))
     ) : "";
     return textResponse(`${result.message}${overrideNote}${branchNote}${truncateWarning}${refNudge}${conflictNote}`);
   }
@@ -27972,6 +28345,29 @@ ${writeNote}
   return textResponse(output);
 }
 
+// src/lib/workspace-mode.ts
+init_git();
+var cache3 = /* @__PURE__ */ new Map();
+function resolveWorkspaceMode(projectRoot) {
+  const cached2 = cache3.get(projectRoot);
+  if (cached2) return cached2;
+  let result;
+  if (!isGitAvailable()) {
+    result = { mode: "no-git", gitBacked: false, reason: "git-not-installed" };
+  } else if (!isGitRepo(projectRoot)) {
+    result = { mode: "no-git", gitBacked: false, reason: "not-a-repo" };
+  } else {
+    result = { mode: "git", gitBacked: true, reason: null };
+  }
+  cache3.set(projectRoot, result);
+  return result;
+}
+function formatWorkspaceModeLine(result) {
+  if (result.gitBacked) return void 0;
+  const because = result.reason === "git-not-installed" ? "no version control was detected on this machine" : "this folder is not under version control";
+  return `**Mode:** running without version control \u2014 ${because}. The full loop works: plan, build, review and release all run normally, and your work is saved to PAPI either way. Version control would add branch-per-task, change history and pull-request review on top.`;
+}
+
 // src/services/health.ts
 function computeZoomOutWarning(cycleNumber, lastZoomOutCycle) {
   if (cycleNumber <= 0) return "";
@@ -28309,15 +28705,16 @@ async function findUnblockCandidates(adapter2, currentCycle) {
     const blocker = blocked.blocker;
     if (!blocker) continue;
     const resolved = isBlockerResolved(blocker, ctx);
+    const blockerTitle = resolveBlockerTitle(blocker, ctx) ?? "";
     candidates.push({
       blockedId: blocked.displayId ?? blocked.id,
       blockedTitle: blocked.title,
       blockerId: blocker.ref,
-      blockerTitle: "",
+      blockerTitle,
       blockerCycle: blocker.blockedCycle,
       typed: {
         kind: blocker.type,
-        waiting: formatBlockerWaiting(blocker),
+        waiting: formatBlockerWaiting(blocker, blockerTitle),
         resolved
       }
     });
@@ -28383,9 +28780,9 @@ function formatUnblockSection(candidates) {
     lines.push("");
     for (const c of resolved) {
       if (c.typed) {
-        lines.push(`- **${c.blockedId}** (${c.blockedTitle}) \u2014 ${c.typed.kind}: ${c.blockerId} now resolved \u2705`);
+        lines.push(`- **${c.blockedId}** (${c.blockedTitle}) \u2014 ${c.typed.kind}: ${formatRef(c.blockerId, c.blockerTitle)} now resolved \u2705`);
       } else {
-        lines.push(`- **${c.blockedId}** (${c.blockedTitle}) \u2014 blocker **${c.blockerId}** Done in C${c.blockerCycle}`);
+        lines.push(`- **${c.blockedId}** (${c.blockedTitle}) \u2014 blocker **${formatRef(c.blockerId, c.blockerTitle)}** Done in C${c.blockerCycle}`);
       }
     }
   }
@@ -29005,6 +29402,13 @@ function formatOrientSummary(health, buildInfo, hierarchy, latestTag, projectRoo
     lines.push(`**Connection:** ${statusIcon} ${statusLabel}`);
     lines.push("");
   }
+  if (projectRoot) {
+    const modeLine = formatWorkspaceModeLine(resolveWorkspaceMode(projectRoot));
+    if (modeLine) {
+      lines.push(modeLine);
+      lines.push("");
+    }
+  }
   const harness = detectHarness(clientName);
   const roleNote = connectOnlyRoleNote(harness);
   if (roleNote) {
@@ -29349,6 +29753,41 @@ async function computeTeamSummary(adapter2, contributorsInput) {
   const reviewQueue = tasks.filter((t) => t.status === "In Review").length;
   return `**Team:** ${members} members \xB7 ${pool} in pool \xB7 ${inFlight} in flight \xB7 ${reviewQueue} in review`;
 }
+async function computeCohortVisibility(adapter2, config2, contributorsInput) {
+  if (!adapterSupports(adapter2, "listContributors")) return void 0;
+  let members;
+  try {
+    members = (await (contributorsInput ?? adapter2.listContributors())).length;
+  } catch {
+    return void 0;
+  }
+  if (members <= 1) return void 0;
+  let gate;
+  try {
+    gate = await resolveOwnerGate(adapter2, config2);
+  } catch {
+    return void 0;
+  }
+  if (gate.enforced && !gate.callerIsOwner) return void 0;
+  let tasks;
+  try {
+    tasks = await adapter2.queryBoard({ compact: true });
+  } catch {
+    return void 0;
+  }
+  const open = tasks.filter(
+    (t) => t.status !== "Done" && t.status !== "Cancelled" && t.status !== "Archived"
+  );
+  if (open.length === 0) return void 0;
+  const publicCount = open.filter((t) => !t.visibility || t.visibility === "public").length;
+  const contributorCount = publicCount + open.filter((t) => t.visibility === "contributors").length;
+  const hiddenFromContributors = open.length - contributorCount;
+  if (hiddenFromContributors === 0) {
+    return `**Cohort visibility:** your ${members - 1} teammate(s) can see the whole active board (${open.length} tasks).`;
+  }
+  const pct = Math.round(hiddenFromContributors / open.length * 100);
+  return `**Cohort visibility:** of ${open.length} active tasks, a contributor sees ${contributorCount} and a public-tier viewer sees ${publicCount} \u2014 **${hiddenFromContributors} (${pct}%) are private and invisible to your team.**`;
+}
 async function computeReleaseHistory(adapter2, contributorsInput) {
   if (!adapterSupports(adapter2, "listContributors")) return void 0;
   let contributors;
@@ -29654,7 +30093,7 @@ async function handleOrient(rawAdapter, config2, args = {}, clientName, serverVe
             return adWords.some((w) => docText.includes(w));
           });
           const cycleLabel = `C${doc.cycleUpdated ?? doc.cycleCreated}`;
-          const adRef = relatedAds.length > 0 ? ` \u2014 may relate to ${relatedAds.map((a) => a.displayId).join(", ")}` : "";
+          const adRef = relatedAds.length > 0 ? ` \u2014 may relate to ${relatedAds.map((a) => formatRef(a.displayId, a.title)).join(", ")}` : "";
           const pendingActions = doc.actions?.filter((a) => a.status === "pending") ?? [];
           lines.push(`- **${doc.title}** [${cycleLabel}${adRef}]`);
           for (const action of pendingActions.slice(0, 2)) {
@@ -29761,8 +30200,8 @@ async function handleOrient(rawAdapter, config2, args = {}, clientName, serverVe
           const mismatches = detectBoardMismatches(config2.projectRoot, allTasks);
           if (mismatches.codeAhead.length > 0 || mismatches.staleInProgress.length > 0) {
             const lines = ["\n\n## Reconciliation"];
-            for (const m of mismatches.codeAhead) lines.push(`\u26A0\uFE0F **${m.displayId}** \u2014 branch \`${m.branch}\` merged to main but task is still Backlog. Run \`board_edit\` to mark Done.`);
-            for (const m of mismatches.staleInProgress) lines.push(`\u26A0\uFE0F **${m.displayId}** \u2014 In Progress but no feature branch found. May be stale or built without \`build_execute\`.`);
+            for (const m of mismatches.codeAhead) lines.push(`\u26A0\uFE0F **${formatRef(m.displayId, m.title)}** \u2014 branch \`${m.branch}\` merged to main but task is still Backlog. Run \`board_edit\` to mark Done.`);
+            for (const m of mismatches.staleInProgress) lines.push(`\u26A0\uFE0F **${formatRef(m.displayId, m.title)}** \u2014 In Progress but no feature branch found. May be stale or built without \`build_execute\`.`);
             reconciliationNote2 = lines.join("\n");
           }
         } catch {
@@ -29776,7 +30215,7 @@ async function handleOrient(rawAdapter, config2, args = {}, clientName, serverVe
               lines.push(`${merged.length} In-Progress task(s) already merged to the default branch \u2014 close them out with \`build_execute\` complete (or \`board_edit\` to mark Done):`);
               for (const m of merged) {
                 const ref = m.pr ? `${m.pr} (\`${m.commit}\`)` : `\`${m.commit}\``;
-                lines.push(`- \u26A0\uFE0F **${m.displayId}** \u2014 merged via ${ref}: ${m.subject}`);
+                lines.push(`- \u26A0\uFE0F **${formatRef(m.displayId, m.title)}** \u2014 merged via ${ref}: ${m.subject}`);
               }
               mergedInProgressNote2 = lines.join("\n");
             }
@@ -29909,7 +30348,7 @@ ${versionDrift}` : "";
     }
     tracker.mark("parallel-tail");
     const sharedContributorsPromise = adapterSupports(adapter2, "listContributors") ? adapter2.listContributors().catch(() => []) : Promise.resolve([]);
-    const [unblockCandidates, subAgents, teamSummaryLine, releaseHistoryLine, carryForwardRefs] = await Promise.all([
+    const [unblockCandidates, subAgents, teamSummaryLine, releaseHistoryLine, cohortVisibilityLine, carryForwardRefs] = await Promise.all([
       tracked("unblock-candidates", () => findUnblockCandidates(adapter2, currentCycle))().catch(() => []),
       // task-1866: discover project sub-agents for the orient surface (read-only, never throws).
       listAgents(config2.projectRoot),
@@ -29918,6 +30357,8 @@ ${versionDrift}` : "";
       // byte-identical there.
       tracked("team-summary", () => computeTeamSummary(adapter2, sharedContributorsPromise))().catch(() => void 0),
       tracked("release-history", () => computeReleaseHistory(adapter2, sharedContributorsPromise))().catch(() => void 0),
+      // task-3339 (C363): owner-only readout of how much of the board the cohort cannot see.
+      tracked("cohort-visibility", () => computeCohortVisibility(adapter2, config2, sharedContributorsPromise))().catch(() => void 0),
       // task-2751 (C332): resolve every task-NNNN mentioned in the Carry-Forward
       // prose to its title so orient can name it inline. Built from the board
       // already in hand — no extra query.
@@ -29927,7 +30368,7 @@ ${versionDrift}` : "";
     const unblockNote = unblockSection ? `
 
 ${unblockSection}` : "";
-    const teamSummary = [teamSummaryLine, releaseHistoryLine].filter(Boolean).join("\n") || void 0;
+    const teamSummary = [teamSummaryLine, releaseHistoryLine, cohortVisibilityLine].filter(Boolean).join("\n") || void 0;
     let deferredGateNote = "";
     if (deepHousekeeping) {
       try {
@@ -31059,15 +31500,36 @@ function readLlmResponse(args) {
 }
 
 // src/tools/ad-view.ts
-var AD_COLUMNS = [
-  { name: "id", header: "AD", value: (d) => d.id },
-  { name: "title", header: "Title", value: (d) => d.title },
-  { name: "confidence", header: "Confidence", value: (d) => d.confidence },
-  { name: "superseded", header: "Superseded", value: (d) => d.superseded ? "yes" : "no" },
-  { name: "supersededBy", header: "Superseded By", value: (d) => d.supersededBy ?? "-" },
-  { name: "body", header: "Body", value: (d) => d.body.replace(/\s+/g, " ").trim() }
-];
-var AD_FIELDS = AD_COLUMNS.map((c) => c.name);
+function adColumns(all) {
+  const titles = titleMap(all);
+  return [
+    { name: "id", header: "AD", value: (d) => d.id },
+    { name: "title", header: "Title", value: (d) => d.title },
+    { name: "confidence", header: "Confidence", value: (d) => d.confidence },
+    { name: "superseded", header: "Superseded", value: (d) => d.superseded ? "yes" : "no" },
+    {
+      name: "supersededBy",
+      header: "Superseded By",
+      value: (d) => d.supersededBy ? formatRef(d.supersededBy, lookupTitle(d.supersededBy, titles)) : "-"
+    },
+    { name: "body", header: "Body", value: (d) => d.body.replace(/\s+/g, " ").trim() }
+  ];
+}
+var AD_FIELDS = adColumns([]).map((c) => c.name);
+function supersededNote(d, all) {
+  if (!d.superseded) return "";
+  const by = d.supersededBy;
+  if (!by) return " [SUPERSEDED by unknown]";
+  return ` [SUPERSEDED by ${formatRef(by, lookupTitle(by, titleMap(all)))}]`;
+}
+function formatAdBody(d, all) {
+  return `## ${d.id}: ${d.title} [${d.confidence}]${supersededNote(d, all)}
+
+${d.body}`;
+}
+function formatAdList(decisions, all) {
+  return decisions.map((d) => formatAdBody(d, all)).join("\n\n---\n\n");
+}
 var adViewTool = {
   name: "ad_view",
   description: "View one or all Active Decisions with full bodies. Use when you need to read the complete reasoning and evidence behind a specific AD before running strategy_change.",
@@ -31130,16 +31592,11 @@ async function handleAdView(adapter2, args) {
     }
     const meta2 = emitMeta ? { total: decisions.length, filtered: 1, returned: 1, limit: null, offset: 0 } : null;
     if (fields) {
-      const columns = selectColumns(AD_COLUMNS, fields);
+      const columns = selectColumns(adColumns(decisions), fields);
       const body = columns.map((c) => `- **${c.header}:** ${c.value(target)}`).join("\n");
       return textResponse(withMeta(body, meta2));
     }
-    const supersededNote = target.superseded ? ` [SUPERSEDED by ${target.supersededBy}]` : "";
-    return textResponse(
-      withMeta(`## ${target.id}: ${target.title} [${target.confidence}]${supersededNote}
-
-${target.body}`, meta2)
-    );
+    return textResponse(withMeta(formatAdBody(target, decisions), meta2));
   }
   const filtered = includeSuperseded ? decisions : decisions.filter((d) => !d.superseded);
   const paged = limit === null && offset === 0 ? filtered : filtered.slice(offset, limit === null ? void 0 : offset + limit);
@@ -31148,16 +31605,11 @@ ${target.body}`, meta2)
     return textResponse(withMeta("No active decisions found.", meta));
   }
   if (fields) {
-    const columns = selectColumns(AD_COLUMNS, fields);
+    const columns = selectColumns(adColumns(decisions), fields);
     const rows = paged.map((d) => columns.map((c) => c.value(d)));
     return textResponse(withMeta(renderTable(columns.map((c) => c.header), rows), meta));
   }
-  const formatted = paged.map((d) => {
-    const supersededNote = d.superseded ? ` [SUPERSEDED by ${d.supersededBy}]` : "";
-    return `## ${d.id}: ${d.title} [${d.confidence}]${supersededNote}
-
-${d.body}`;
-  }).join("\n\n---\n\n");
+  const formatted = formatAdList(paged, decisions);
   return textResponse(withMeta(`# Active Decisions (${paged.length})
 
 ${formatted}`, meta));
@@ -31478,14 +31930,24 @@ On hosted/remote sessions this is now your DEFAULT project \u2014 calls without
 }
 
 // src/tools/contributor.ts
+init_dist();
 var contributorAddTool = {
   name: "contributor_add",
-  description: "Add a contributor to the current project by email (owner-only). The person must already have a PAPI account. Grants cohort membership on project_contributors \u2014 contributors-tier visibility, no roles yet.",
+  description: `Add a contributor to a project by email, or change an existing member's role (owner-only). The person must already have a PAPI account. Grants membership on project_contributors. Pass role="editor" for a working teammate who needs to run the full cycle \u2014 the default, "viewer", cannot release. Calling it again with a different role promotes or demotes that member.`,
   annotations: { title: "Add Contributor", readOnlyHint: false, destructiveHint: false, openWorldHint: false },
   inputSchema: {
     type: "object",
     properties: {
-      email: { type: "string", description: 'Email of the PAPI account to add (e.g. "wes@example.com").' }
+      email: { type: "string", description: 'Email of the PAPI account to add (e.g. "wes@example.com").' },
+      role: {
+        type: "string",
+        enum: [...ASSIGNABLE_CONTRIBUTOR_ROLES],
+        description: `Membership role. "editor" can run the full build/review/release cycle; "viewer" has read-only visibility and is REFUSED by the release gate. Defaults to "viewer" for a new member; omit it when changing nothing to leave an existing member's role untouched. Project ownership cannot be granted here.`
+      },
+      project: {
+        type: "string",
+        description: "Project id (UUID) or slug to add this contributor to, overriding the session project for THIS call only. Must be a project on your account \u2014 fails closed otherwise. Does NOT change your default project."
+      }
     },
     required: ["email"]
   }
@@ -31550,21 +32012,37 @@ function requireEmail(args) {
   return EMAIL_SHAPE.test(email) ? email : null;
 }
 async function handleContributorAdd(adapter2, config2, args) {
-  const denied = await denyUnlessOwner(adapter2, config2);
-  if (denied) return errorResponse(denied);
   const email = requireEmail(args);
   if (!email) return errorResponse('A valid email is required. Example: contributor_add email="wes@example.com"');
+  const rawRole = typeof args.role === "string" ? args.role.trim().toLowerCase() : void 0;
+  if (rawRole !== void 0 && !ASSIGNABLE_CONTRIBUTOR_ROLES.includes(rawRole)) {
+    return errorResponse(
+      `Invalid role "${args.role}". Assignable roles: ${ASSIGNABLE_CONTRIBUTOR_ROLES.join(", ")}. Project ownership cannot be granted through contributor_add.`
+    );
+  }
+  let target = adapter2;
+  let overrideNote = "";
+  try {
+    ({ adapter: target, overrideNote } = await resolvePerCallProjectAdapter(adapter2, args));
+  } catch (err) {
+    if (err instanceof ProjectResolutionError) return errorResponse(err.message);
+    throw err;
+  }
+  const denied = await denyUnlessOwner(target, config2);
+  if (denied) return errorResponse(denied);
   try {
-    const entry = await adapter2.addContributorByEmail(email);
+    const entry = await target.addContributorByEmail(email, rawRole);
     const name = entry.displayName ? ` (${entry.displayName})` : "";
-    const upsell = await resolveContributorUpsell(adapter2);
+    const upsell = await resolveContributorUpsell(target);
     const upsellSuffix = upsell ? `
 
 ${upsell}` : "";
+    const where = overrideNote ? ` ${overrideNote}` : " on this project";
+    const roleLine = entry.role === "editor" ? `They can run the full cycle \u2014 plan, build, review and release.` : `**They are a "${entry.role}" and cannot run \`release\`.** Re-run with role="editor" if they are a working teammate rather than an observer.`;
     return textResponse(
-      `\u2705 Added **${entry.email ?? email}**${name} as a contributor.
+      `\u2705 **${entry.email ?? email}**${name} is now a **${entry.role}**${where}.
 
-They now have contributors-tier visibility on this project. Roles and invites land with MU-2 \u2014 today membership is the whole model.` + upsellSuffix
+` + roleLine + upsellSuffix
     );
   } catch (err) {
     return errorResponse(err instanceof Error ? err.message : String(err));
@@ -32069,12 +32547,13 @@ async function readPapiResource(adapter2, uri) {
       const ads = await adapter2.getActiveDecisions({ includeRetired: true });
       const target = ads.find((d) => d.id === adId);
       if (!target) throw new Error(`Active Decision not found in this project: ${adId}`);
-      const supersededNote = target.superseded ? ` [SUPERSEDED by ${target.supersededBy ?? "unknown"}]` : "";
+      const titles = titleMap(ads);
+      const supersededNote2 = target.superseded ? ` [SUPERSEDED by ${target.supersededBy ? formatRef(target.supersededBy, lookupTitle(target.supersededBy, titles)) : "unknown"}]` : "";
       const supersedes = ads.filter((d) => d.supersededBy === target.id).map((d) => d.id);
       const chain = supersedes.length > 0 ? `
 
-_Supersedes: ${supersedes.join(", ")}_` : "";
-      return md(`## ${target.id}: ${target.title} [${target.confidence}]${supersededNote}
+_Supersedes: ${formatRefList(supersedes, titles)}_` : "";
+      return md(`## ${target.id}: ${target.title} [${target.confidence}]${supersededNote2}
 
 ${target.body}${chain}`);
     }
@@ -32302,6 +32781,7 @@ var PAPI_TOOLS = [
   boardArchiveTool,
   boardEditTool,
   setupTool,
+  joinTool,
   buildListTool,
   buildDescribeTool,
   buildExecuteTool,
@@ -32467,6 +32947,8 @@ function createServer(adapter2, config2, observation) {
           return handleBoardEdit(adapter2, safeArgs);
         case "setup":
           return handleSetup(adapter2, config2, safeArgs, server2.getClientVersion()?.name);
+        case "join":
+          return handleJoin(adapter2, config2, safeArgs);
         case "build_list":
           return handleBuildList(adapter2, config2, safeArgs);
         case "build_describe":

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@papi-ai/server",
-  "version": "0.7.83",
+  "version": "0.7.84",
   "description": "PAPI MCP server — AI-powered sprint planning, build execution, and strategy review for software projects",
   "license": "Elastic-2.0",
   "mcpName": "io.github.getpapi/papi",
@@ -51,8 +51,8 @@
   "dependencies": {
     "@anthropic-ai/sdk": "^0.82.0",
     "@modelcontextprotocol/sdk": "^1.27.1",
-    "@papi-ai/adapter-pg": "^0.2.0",
-    "@papi-ai/shared": "^0.2.0",
+    "@papi-ai/adapter-pg": "^0.2.15",
+    "@papi-ai/shared": "^0.2.4",
     "@papi-ai/skills": "^0.1.0",
     "js-yaml": "^4.1.0"
   },