@remembrance-ai/opencode-plugin 0.1.53 → 0.1.60

package/servers/remembrance-mcp.mjs

@@ -38,11 +38,13 @@ function defaultAgentKeyIdForPublicKey(publicKey) {
 }
 function buildAgentKeyRegistrationSigningPayload(args) {
   const signedAt = args.signedAt instanceof Date ? args.signedAt.toISOString() : args.signedAt;
+  const ownerBinding = args.ownerBinding?.trim() || null;
   return canonicalJson({
-    version: "v1",
+    version: ownerBinding ? "v2" : "v1",
     purpose: "remembrance-agent-key-registration",
     provider: args.provider,
     key_id: args.keyId ?? defaultAgentKeyIdForPublicKey(args.publicKey),
+    ...ownerBinding ? { owner_binding: ownerBinding } : {},
     public_key_hash: hashValue(args.publicKey),
     subject: args.subject ?? null,
     signed_at: signedAt
@@ -90,7 +92,14 @@ var AGENT_HOSTS = [
     public_mirror: true,
     client_release: true,
     release_smoke: true,
-    release_gate: "host",
+    release_evidence: [
+      "artifact_exact",
+      "adapter_contract",
+      "transport_contract",
+      "host_discovery",
+      "host_process",
+      "authenticated_tool"
+    ],
     plugin: true,
     hooks: {
       session_start: true,
@@ -110,7 +119,12 @@ var AGENT_HOSTS = [
     public_mirror: true,
     client_release: true,
     release_smoke: true,
-    release_gate: "host",
+    release_evidence: [
+      "artifact_exact",
+      "adapter_contract",
+      "transport_contract",
+      "host_discovery"
+    ],
     plugin: true,
     hooks: {
       session_start: true,
@@ -130,7 +144,12 @@ var AGENT_HOSTS = [
     public_mirror: true,
     client_release: true,
     release_smoke: true,
-    release_gate: "source_contract",
+    release_evidence: [
+      "artifact_exact",
+      "adapter_contract",
+      "transport_contract",
+      "source_contract"
+    ],
     plugin: true,
     hooks: {
       session_start: true,
@@ -150,7 +169,12 @@ var AGENT_HOSTS = [
     public_mirror: true,
     client_release: true,
     release_smoke: true,
-    release_gate: "host",
+    release_evidence: [
+      "artifact_exact",
+      "adapter_contract",
+      "transport_contract",
+      "host_discovery"
+    ],
     plugin: true,
     hooks: {
       session_start: true,
@@ -170,7 +194,12 @@ var AGENT_HOSTS = [
     public_mirror: true,
     client_release: true,
     release_smoke: true,
-    release_gate: "source_contract",
+    release_evidence: [
+      "artifact_exact",
+      "adapter_contract",
+      "transport_contract",
+      "source_contract"
+    ],
     plugin: true,
     hooks: {
       session_start: true,
@@ -190,7 +219,14 @@ var AGENT_HOSTS = [
     public_mirror: true,
     client_release: true,
     release_smoke: true,
-    release_gate: "host",
+    release_evidence: [
+      "artifact_exact",
+      "adapter_contract",
+      "transport_contract",
+      "host_discovery",
+      "host_process",
+      "authenticated_tool"
+    ],
     plugin: true,
     hooks: {
       session_start: true,
@@ -210,7 +246,7 @@ var AGENT_HOSTS = [
     public_mirror: false,
     client_release: true,
     release_smoke: true,
-    release_gate: "transport",
+    release_evidence: ["artifact_exact", "transport_contract"],
     plugin: false,
     hooks: {
       session_start: false,
@@ -230,7 +266,7 @@ var AGENT_HOSTS = [
     public_mirror: false,
     client_release: false,
     release_smoke: true,
-    release_gate: "transport",
+    release_evidence: ["transport_contract"],
     plugin: false,
     hooks: {
       session_start: false,
@@ -4397,6 +4433,182 @@ var clientHealthReportSchema = external_exports.object({
   }
 });
 
+// ../core/src/client-release.ts
+var CLIENT_RELEASE_SCHEMA_VERSION = "1";
+var CODEX_UPDATE_COMMAND = [
+  'CODEX_CLI="${CODEX_CLI:-$(command -v codex || true)}"',
+  '[ -x "$CODEX_CLI" ] || CODEX_CLI="/Applications/ChatGPT.app/Contents/Resources/codex"',
+  '[ -x "$CODEX_CLI" ] || CODEX_CLI="/Applications/Codex.app/Contents/Resources/codex"',
+  `[ -x "$CODEX_CLI" ] || { printf '%s\\n' "Codex CLI not found. Install the Codex CLI, or update the ChatGPT desktop app, then try again." >&2; exit 1; }`,
+  '"$CODEX_CLI" plugin marketplace upgrade remembrance',
+  '"$CODEX_CLI" plugin add remembrance@remembrance --json'
+].join("\n");
+var CLIENT_UPDATE_GUIDANCE = {
+  codex: {
+    surface: "codex",
+    host_name: "Codex",
+    command: CODEX_UPDATE_COMMAND,
+    update_action: "Ask the user for permission to update Remembrance. If approved, run the bundled Codex update command exactly as shown.",
+    restart_action: "After the command succeeds, tell the user to fully quit and reopen Codex. The current process continues using the installed version until restart."
+  },
+  claude_code: {
+    surface: "claude_code",
+    host_name: "Claude Code",
+    command: "claude plugin marketplace update remembrance\nclaude plugin update remembrance@remembrance",
+    update_action: "Ask the user for permission to update Remembrance. If approved, run the bundled Claude Code update command exactly as shown.",
+    restart_action: "After the command succeeds, tell the user to run /reload-plugins or fully quit and reopen Claude Code. The current plugin process remains on the installed version until reload or restart."
+  },
+  cursor: {
+    surface: "cursor",
+    host_name: "Cursor",
+    command: null,
+    update_action: "Tell the user to open Cursor settings, refresh the marketplace that provides Remembrance, and choose Update for the Remembrance plugin.",
+    restart_action: "After Cursor reports that the update completed, tell the user to fully quit and reopen Cursor. The current process continues using the installed version until restart."
+  },
+  openclaw: {
+    surface: "openclaw",
+    host_name: "OpenClaw",
+    command: "openclaw plugins update remembrance\nopenclaw remembrance setup",
+    update_action: "Ask the user for permission to update Remembrance. If approved, run the bundled OpenClaw update and setup commands exactly as shown.",
+    restart_action: "After the commands succeed, tell the user to restart the OpenClaw Gateway unless its managed reload already restarted it, then begin a new agent session."
+  },
+  vs_code: {
+    surface: "vs_code",
+    host_name: "VS Code",
+    command: null,
+    update_action: "Tell the user to refresh the marketplace or managed source that provides Remembrance and update the Remembrance plugin there.",
+    restart_action: "After the update completes, tell the user to reload the VS Code window or fully quit and reopen VS Code. The current extension host continues using the installed version until reload or restart."
+  },
+  opencode: {
+    surface: "opencode",
+    host_name: "opencode",
+    command: "npx -y @remembrance-ai/opencode-plugin@latest setup",
+    update_action: "Ask the user for permission to update Remembrance. If approved, run the bundled opencode setup command exactly as shown.",
+    restart_action: "After the command succeeds, tell the user to fully quit and reopen opencode. The current process continues using the installed version until restart."
+  },
+  mcp: {
+    surface: "mcp",
+    host_name: "MCP client",
+    command: null,
+    update_action: "Ask the user for permission to update the Remembrance MCP registration. If approved, inspect only that registration: an unpinned npx @remembrance-ai/mcp-server command needs no edit, while a pinned package version should be changed to the published latest version. Do not edit unrelated MCP configuration.",
+    restart_action: "After updating the registration, tell the user to fully restart the host that launches the MCP server. The current MCP process continues using the installed version until restart."
+  }
+};
+var CLIENT_RELEASE_SURFACES = AGENT_HOSTS.filter(
+  (host) => host.client_release
+).map((host) => host.surface);
+function parseStableClientVersion(value) {
+  if (typeof value !== "string") return null;
+  const match = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.exec(value);
+  if (!match) return null;
+  const parts = match.slice(1).map(Number);
+  if (parts.length !== 3 || parts.some((part) => !Number.isSafeInteger(part) || part > 9999)) {
+    return null;
+  }
+  return parts;
+}
+function compareClientVersions(left, right) {
+  const leftParts = parseStableClientVersion(left);
+  const rightParts = parseStableClientVersion(right);
+  if (!leftParts || !rightParts) {
+    throw new Error(
+      "Client versions must use stable major.minor.patch syntax."
+    );
+  }
+  for (let index = 0; index < 3; index += 1) {
+    const difference = leftParts[index] - rightParts[index];
+    if (difference !== 0) return Math.sign(difference);
+  }
+  return 0;
+}
+function parseClientReleaseManifest(value) {
+  if (!isRecord(value)) return null;
+  if (value.schema_version !== CLIENT_RELEASE_SCHEMA_VERSION) return null;
+  const latestVersion = value.latest_version;
+  if (typeof latestVersion !== "string" || !parseStableClientVersion(latestVersion)) {
+    return null;
+  }
+  if (typeof value.published_at !== "string" || !isCanonicalIsoTimestamp(value.published_at)) {
+    return null;
+  }
+  if (!Array.isArray(value.surfaces)) return null;
+  const validSurfaces = new Set(CLIENT_RELEASE_SURFACES);
+  const surfaces = value.surfaces.filter(
+    (surface) => typeof surface === "string" && validSurfaces.has(surface)
+  );
+  if (surfaces.length !== value.surfaces.length || new Set(surfaces).size !== surfaces.length) {
+    return null;
+  }
+  return {
+    schema_version: CLIENT_RELEASE_SCHEMA_VERSION,
+    latest_version: latestVersion,
+    published_at: new Date(value.published_at).toISOString(),
+    surfaces
+  };
+}
+function resolveClientUpdateStatus(input) {
+  if (!parseStableClientVersion(input.currentVersion)) {
+    return {
+      status: "unavailable",
+      current_version: input.currentVersion,
+      reason: "invalid_current_version"
+    };
+  }
+  const manifest = parseClientReleaseManifest(input.manifest);
+  if (!manifest) {
+    return {
+      status: "unavailable",
+      current_version: input.currentVersion,
+      reason: "invalid_manifest"
+    };
+  }
+  if (!manifest.surfaces.includes(input.surface)) {
+    return {
+      status: "unavailable",
+      current_version: input.currentVersion,
+      reason: "surface_not_published"
+    };
+  }
+  if (compareClientVersions(manifest.latest_version, input.currentVersion) <= 0) {
+    return {
+      status: "current",
+      current_version: input.currentVersion,
+      latest_version: manifest.latest_version
+    };
+  }
+  const guidance = CLIENT_UPDATE_GUIDANCE[input.surface];
+  return {
+    status: "update_available",
+    current_version: input.currentVersion,
+    latest_version: manifest.latest_version,
+    guidance,
+    notice: clientUpdateNotice({
+      currentVersion: input.currentVersion,
+      latestVersion: manifest.latest_version,
+      guidance
+    })
+  };
+}
+function clientUpdateNotice(input) {
+  const command = input.guidance.command ? `
+Trusted update command bundled with this installed client:
+${input.guidance.command}` : "";
+  return [
+    `Remembrance update available: installed ${input.currentVersion}, published ${input.latestVersion}.`,
+    input.guidance.update_action,
+    command,
+    input.guidance.restart_action,
+    "Do not claim the new version is active until a fresh process reports it."
+  ].filter(Boolean).join("\n");
+}
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function isCanonicalIsoTimestamp(value) {
+  const timestamp = Date.parse(value);
+  return Number.isFinite(timestamp) && new Date(timestamp).toISOString() === value;
+}
+
 // ../core/src/client-health-alerts.ts
 var secureWebhookUrlSchema = external_exports.string().trim().url().max(2048).superRefine((value, context) => {
   let parsed;
@@ -4486,6 +4698,13 @@ function isUnsafeDestinationHostname(hostname) {
 }
 
 // ../core/src/connection-doctor.ts
+var HOST_POLICY_OPERATION_CLASSES = /* @__PURE__ */ new Set([
+  "query",
+  "private_contribution",
+  "contribution",
+  "feedback",
+  "other"
+]);
 var CODEX_HOOK_REVIEW_COMMAND = `CODEX_CLI="\${CODEX_CLI:-$(command -v codex || true)}"; [ -x "$CODEX_CLI" ] || CODEX_CLI="/Applications/ChatGPT.app/Contents/Resources/codex"; [ -x "$CODEX_CLI" ] || CODEX_CLI="/Applications/Codex.app/Contents/Resources/codex"; [ -x "$CODEX_CLI" ] || { printf '%s\\n' "Codex CLI not found. Install the Codex CLI, or install or update the ChatGPT desktop app on macOS, then try again." >&2; exit 1; }; "$CODEX_CLI"`;
 function codexHookReviewAction(followupTool) {
   return `Open Terminal and launch Codex with the command below. If Codex shows a Hooks need review screen, choose Review hooks and trust only the Remembrance SessionStart, UserPromptSubmit, PostToolUse, and Stop hooks. If no review screen appears, continue: Codex may be reusing an existing valid trust decision. Fully restart Codex, submit one prompt, use one Remembrance tool, complete one turn, and call ${followupTool} again. If the lifecycle warning remains, update or reinstall Remembrance and repeat this check.`;
@@ -4498,6 +4717,7 @@ function buildConnectionDoctorReport(input) {
   const capabilities = record(authentication.capabilities);
   const sharedConfig = record(transport.shared_config);
   const pluginHealth = record(status.plugin_health);
+  const hostPolicy = record(pluginHealth.host_policy);
   const identity = record(status.local_signing_identity);
   const destination = destinationFromTransport(transport);
   const credentialSource = stringValue(transport.credential_source) ?? "none";
@@ -4629,6 +4849,22 @@ function buildConnectionDoctorReport(input) {
     )
   );
   checks.push(signingIdentityCheck(identity, input.transport));
+  checks.push(clientUpdateCheck(input.client_update ?? null));
+  const hostPolicyStatus = hostPolicyStatusValue(hostPolicy.status);
+  checks.push(
+    hostPolicyStatus === "recent_denial" ? warning(
+      "host_policy_observability",
+      "The host recently blocked a Remembrance operation before transport; no content was sent.",
+      "review_host_policy",
+      "Review the host's trusted-service or data-export policy. Querying remains available."
+    ) : hostPolicyStatus === "no_recent_denial" ? pass(
+      "host_policy_observability",
+      "This plugin can observe host policy denials; none were observed recently. This does not grant permission for future submissions."
+    ) : notApplicable(
+      "host_policy_observability",
+      "This host does not expose a reliable pre-transport policy-denial event to the plugin."
+    )
+  );
   const blockingIds = /* @__PURE__ */ new Set([
     "configuration",
     "credential_security",
@@ -4644,6 +4880,7 @@ function buildConnectionDoctorReport(input) {
     (check) => check.status === "warning" || check.status === "fail"
   );
   const readSucceeded = !input.active_read_probe.requested || input.active_read_probe.succeeded === true;
+  const registrySubmissionAuthorized = scope === "organization" && submitAuthorized;
   return {
     schema_version: "1",
     status: blocked ? "blocked" : attention ? "attention" : "healthy",
@@ -4651,12 +4888,88 @@ function buildConnectionDoctorReport(input) {
     scope,
     destination,
     safe_to_query: !blocked && registryReady && queryAuthorized && readSucceeded,
-    organization_write_authorized: scope === "organization" && submitAuthorized,
+    registry_submission_authorized: registrySubmissionAuthorized,
+    organization_write_authorized: registrySubmissionAuthorized,
+    host_policy: {
+      status: hostPolicyStatus,
+      observable: hostPolicy.observable === true,
+      ...hostPolicyOperationClassValue(hostPolicy.operation_class) ? {
+        operation_class: hostPolicyOperationClassValue(
+          hostPolicy.operation_class
+        )
+      } : {},
+      ...isoTimestampValue(hostPolicy.last_denial_at) ? { last_denial_at: isoTimestampValue(hostPolicy.last_denial_at) } : {}
+    },
+    client_update: clientUpdateSummary(input.client_update ?? null),
     signed_contributions_ready: input.transport === "hosted_http_mcp" ? null : identity.status === "ready",
     active_read_probe: input.active_read_probe,
     checks
   };
 }
+function clientUpdateCheck(update) {
+  if (!update) {
+    return notApplicable(
+      "client_update",
+      "The published client release could not be checked. This does not affect querying."
+    );
+  }
+  if (update.status === "update_available") {
+    return warning(
+      "client_update",
+      `Remembrance ${update.latest_version} is published; this process is running ${update.current_version}.`,
+      "update_remembrance_client",
+      `${update.guidance.update_action} ${update.guidance.restart_action} Do not claim the new version is active until a fresh process reports it.`,
+      void 0,
+      false,
+      update.guidance.command ?? void 0
+    );
+  }
+  if (update.status === "current") {
+    return pass(
+      "client_update",
+      `This process is current at Remembrance ${update.current_version}.`
+    );
+  }
+  return notApplicable(
+    "client_update",
+    "The installed or published client version could not be compared safely."
+  );
+}
+function clientUpdateSummary(update) {
+  if (!update) {
+    return {
+      status: "unavailable",
+      current_version: null,
+      latest_version: null
+    };
+  }
+  if (update.status === "current" || update.status === "update_available") {
+    return {
+      status: update.status,
+      current_version: update.current_version,
+      latest_version: update.latest_version
+    };
+  }
+  return {
+    status: "unavailable",
+    current_version: update.current_version,
+    latest_version: null
+  };
+}
+function hostPolicyOperationClassValue(value) {
+  if (typeof value !== "string" || !HOST_POLICY_OPERATION_CLASSES.has(value)) {
+    return void 0;
+  }
+  return value;
+}
+function isoTimestampValue(value) {
+  if (typeof value !== "string") return void 0;
+  const parsed = Date.parse(value);
+  return Number.isFinite(parsed) ? new Date(parsed).toISOString() : void 0;
+}
+function hostPolicyStatusValue(value) {
+  return value === "recent_denial" || value === "no_recent_denial" ? value : "not_observable";
+}
 function readProbeCheck(probe) {
   if (!probe.requested) {
     return notApplicable(
@@ -4809,11 +5122,229 @@ function stringValue(value) {
   return typeof value === "string" && value ? value : null;
 }
 
+// ../core/src/agent-preferences.ts
+var MAX_EFFECTIVE_PREFERENCES = 32;
+var MAX_SKILL_PREFERENCE_TRAITS = 40;
+var preferenceIdentifierSchema = external_exports.string().trim().toLowerCase().min(1).max(96).regex(/^[a-z][a-z0-9]*(?:[._-][a-z0-9]+)*$/);
+var preferenceKeySchema = preferenceIdentifierSchema;
+var preferenceValueSchema = preferenceIdentifierSchema;
+var preferenceEffectSchema = external_exports.enum([
+  "presentation",
+  "workflow",
+  "strategy_selection"
+]);
+var preferenceStrengthSchema = external_exports.enum(["prefer", "avoid"]);
+var BUILT_IN_PREFERENCE_DEFINITIONS = {
+  comment_density: {
+    label: "Comment density",
+    effect: "presentation",
+    values: {
+      sparse: "Use few comments and reserve them for decisions that code cannot explain.",
+      balanced: "Use comments selectively for intent and non-obvious behavior.",
+      detailed: "Use detailed comments where they improve maintainability."
+    }
+  },
+  comment_focus: {
+    label: "Comment focus",
+    effect: "presentation",
+    values: {
+      intent_only: "Comment intent and tradeoffs rather than restating code.",
+      tricky_logic: "Prioritize comments around tricky or non-obvious logic.",
+      api_contracts: "Prioritize comments that clarify API and data contracts.",
+      comprehensive: "Comment intent, tricky logic, and important contracts comprehensively."
+    }
+  },
+  explanation_depth: {
+    label: "Explanation depth",
+    effect: "presentation",
+    values: {
+      concise: "Keep explanations concise and focused on decisions and outcomes.",
+      balanced: "Balance concise conclusions with enough rationale to verify the work.",
+      detailed: "Provide detailed rationale, tradeoffs, and verification context."
+    }
+  },
+  output_organization: {
+    label: "Output organization",
+    effect: "presentation",
+    values: {
+      compact: "Use a compact response with minimal structural overhead.",
+      structured: "Use clear sections when they improve scanability.",
+      step_by_step: "Present the work as an ordered sequence of steps."
+    }
+  }
+};
+var PREFERENCE_KEYS = Object.keys(
+  BUILT_IN_PREFERENCE_DEFINITIONS
+);
+var PREFERENCE_VALUE_OPTIONS = Object.fromEntries(
+  Object.entries(BUILT_IN_PREFERENCE_DEFINITIONS).map(([key, definition]) => [
+    key,
+    Object.keys(definition.values)
+  ])
+);
+var preferenceSettingBaseSchema = external_exports.object({
+  key: preferenceKeySchema,
+  value: preferenceValueSchema,
+  // Built-in definitions can omit these fields. Extensible definitions carry
+  // their complete bounded meaning with the observation so no hot-path lookup
+  // or code release is needed to understand a new preference type.
+  label: external_exports.string().trim().min(1).max(96).optional(),
+  behavior: external_exports.string().trim().min(1).max(320).optional(),
+  effect: preferenceEffectSchema.optional(),
+  strength: preferenceStrengthSchema.optional(),
+  definition_version: external_exports.number().int().min(1).max(1e6).optional()
+}).strict();
+var preferenceSettingSchema = preferenceSettingBaseSchema.superRefine(
+  (setting, ctx) => {
+    const builtIn = builtInPreferenceDefinition(setting.key);
+    if (builtIn) {
+      const builtInBehavior = builtIn.values[setting.value];
+      if (!builtInBehavior) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["value"],
+          message: `Unsupported ${setting.key} value`
+        });
+      }
+      if (setting.label && setting.label !== builtIn.label) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["label"],
+          message: `${setting.key} uses its canonical label`
+        });
+      }
+      if (setting.behavior && setting.behavior !== builtInBehavior) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["behavior"],
+          message: `${setting.key} uses the canonical behavior for ${setting.value}`
+        });
+      }
+      if (setting.effect && setting.effect !== builtIn.effect) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["effect"],
+          message: `${setting.key} is a ${builtIn.effect} preference`
+        });
+      }
+      if (setting.strength && setting.strength !== "prefer") {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["strength"],
+          message: `${setting.key} uses prefer; define a custom key for inverse behavior`
+        });
+      }
+      if (setting.definition_version !== void 0 && setting.definition_version !== 1) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["definition_version"],
+          message: `${setting.key} uses definition version 1`
+        });
+      }
+      return;
+    }
+    for (const field of ["label", "behavior", "effect"]) {
+      if (!setting[field]) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: [field],
+          message: `${field} is required for an extensible preference`
+        });
+      }
+    }
+  }
+);
+var preferenceScopeSchema = external_exports.enum([
+  "task",
+  "organization",
+  "member",
+  "member_runtime",
+  "installation",
+  "project",
+  "skill",
+  "domain"
+]);
+var preferenceSourceSchema = external_exports.enum([
+  "mandatory_org",
+  "explicit_task",
+  "explicit_project",
+  "explicit_member_runtime",
+  "explicit_member",
+  "learned_member_runtime",
+  "learned_member",
+  "explicit_installation",
+  "learned_installation",
+  "recommended_org",
+  "skill_default"
+]);
+var preferenceObservationSchema = external_exports.object({
+  setting: preferenceSettingSchema,
+  scope: preferenceScopeSchema,
+  source: external_exports.enum([
+    "explicit_user",
+    "agent_observed",
+    "admin_override",
+    "admin_required"
+  ]),
+  task_hash: external_exports.string().min(1).max(128),
+  project_key: external_exports.string().min(1).max(128).nullable().default(null),
+  skill_slug: external_exports.string().min(1).max(512).nullable().default(null),
+  domain: external_exports.string().min(1).max(512).nullable().default(null),
+  confidence: external_exports.number().min(0).max(1),
+  observed_at: external_exports.string().datetime()
+}).strict();
+function boundedUniquePreferenceSettingsSchema(duplicateMessage) {
+  return external_exports.array(preferenceSettingSchema).max(MAX_EFFECTIVE_PREFERENCES).superRefine((settings, ctx) => {
+    const seen = /* @__PURE__ */ new Set();
+    settings.forEach((setting, index) => {
+      if (seen.has(setting.key)) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: [index, "key"],
+          message: duplicateMessage
+        });
+      }
+      seen.add(setting.key);
+    });
+  });
+}
+var taskPreferenceSettingsSchema = boundedUniquePreferenceSettingsSchema(
+  "Task preferences must use each key at most once"
+);
+var skillPreferenceDefaultsSchema = boundedUniquePreferenceSettingsSchema(
+  "Skill preference defaults must use each key at most once"
+);
+var skillPreferenceTraitSchema = external_exports.object({
+  key: preferenceKeySchema,
+  value: preferenceValueSchema,
+  relationship: external_exports.enum(["supports", "conflicts"]).default("supports"),
+  locked: external_exports.boolean().default(false),
+  reason: external_exports.string().trim().min(1).max(200).nullable().default(null)
+}).strict();
+var skillPreferenceTraitsSchema = external_exports.array(skillPreferenceTraitSchema).max(MAX_SKILL_PREFERENCE_TRAITS).superRefine((traits, ctx) => {
+  const seen = /* @__PURE__ */ new Set();
+  traits.forEach((trait, index) => {
+    const identity = `${trait.key}:${trait.value}:${trait.relationship}`;
+    if (seen.has(identity)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [index],
+        message: "Skill preference traits must be unique"
+      });
+    }
+    seen.add(identity);
+  });
+});
+var INFERRED_MAX_AGE_MS = 180 * 864e5;
+function builtInPreferenceDefinition(key) {
+  return BUILT_IN_PREFERENCE_DEFINITIONS[key] ?? null;
+}
+
 // ../core/src/agent-guidance.ts
 var REMEMBRANCE_QUERY_TOOL_DESCRIPTION = "Call before non-trivial service, API, tool, library, workflow, UI, review, test, security, or deployment work to find relevant Remembrance skills and resources. For short context-dependent follow-ups, infer the concrete task from the full conversation, preserve any plugin-supplied client_context.directive_id/runtime/trigger_reason, and query anyway. Compare each candidate's bounded why_matched evidence and applicability conditions before opening it; discard stated unlikely or corner-case mismatches. High matches should be fetched before custom work; possible and exploratory matches remain optional. Do not use for broad web search or one-off facts.";
 var REMEMBRANCE_CONNECTION_STATUS_TOOL_DESCRIPTION = "Inspect the active Remembrance transport, credential source, and authenticated registry scope without exposing credentials. Call this before diagnosing authentication, checking environment variables, or making anonymous REST/browser probes. Local or bundled MCP can read REMEMBRANCE_API_KEY or ~/.config/remembrance/config.json; hosted MCP cannot read local files and authenticates from its request header. When a declared native lifecycle is degraded, local MCP may submit bounded, content-free health evidence unless REMEMBRANCE_HEALTH_REPORTING=0. Never infer the plugin's scope from REMEMBRANCE_API_KEY alone.";
 var REMEMBRANCE_CONNECTION_DOCTOR_TOOL_DESCRIPTION = "Run a bounded, non-mutating Remembrance connection diagnostic. It verifies the active transport, a redacted registry destination, authenticated scope, query authorization, a real catalog read, and organization submission capability. Local MCP also checks shared-config permissions, destination consistency, native plugin lifecycle, and signing identity; hosted MCP marks local-only checks unavailable. It never submits content, creates query demand, opens a review item, or returns credentials, absolute paths, private registry URLs, prompts, or repository data.";
-var REMEMBRANCE_MCP_SERVER_INSTRUCTIONS = "Remembrance is shared operational memory for agents. Before claiming that Remembrance is anonymous, unconfigured, partially active, or missing an organization key, call run_connection_doctor for the transport you will actually use. It performs a safe catalog read and returns exact bounded remediation without submitting content. Use get_connection_status only when you need the underlying transport and lifecycle fields. An unset REMEMBRANCE_API_KEY does not prove that a local plugin is anonymous because local hooks and bundled MCP may read ~/.config/remembrance/config.json. Conversely, hosted MCP cannot read that local file. Anonymous curl or browser probes describe only those requests, not plugin authentication. Never print or request the raw key. When the user explicitly names an authorized Remembrance skill or supplies a remembrance://skills/{slug} URI, resolve ambiguous names with list_skills using its normalized slug-prefix filter, then call invoke_skill with an exact returned slug. Never guess a slug. list_skills is catalog resolution, not relevance search; use query_skills when the user wants relevant candidates rather than a known selection. invoke_skill rechecks authorization and organization policy, resolves the current reviewed version, and returns the only full instruction body. Catalog listings and MCP resource reads are lightweight handles, not skill use. Do not run query_skills merely to rediscover that explicit selection, and do not submit query-fit feedback for it. After meaningful direct use, follow the returned task-outcome and post-use feedback instructions once. BEFORE non-trivial service/API/tool/library/workflow/UI/review/test/security/deployment work, call query_skills to reuse proven skills and resources instead of rediscovering them. A local repository change still qualifies when it involves a reusable workflow or lesson; skip only genuinely trivial throwaway edits and one-off facts. For short follow-ups such as 'fix these issues', 'continue', or 'try again', infer the concrete task, domain, and constraints from the full conversation and still call query_skills; do not wait for the current prompt to repeat trigger keywords. Treat match_tier as a decision aid, then inspect why_matched and applicability before opening a result. These fields show bounded matched terms/capabilities, satisfied and missed constraints, qualitative lexical/semantic evidence, declared scope, use conditions, and exclusions without exposing unstable raw ranking scores. Discard an unlikely or irrelevant corner-case result and report fit: poor; do not force its use. For a remaining high match, call get_skill or get_resource before custom work and pass the returned query_id/result_id so the surfaced-to-fetch funnel closes; possible and exploratory matches are optional. The response also includes approximate context tokens, verified uses, risk, tags, permissions, dependencies, and contraindications so you can weigh the detour safely. Honor query_skills.skill_access on every response. When policy is org_only, use only returned organization skills and never substitute bundled or live public skill references; if an organization key is configured and the query is unavailable, fail closed because the policy cannot be confirmed. AFTER query_skills, call submit_query_feedback once with one complete set of explicit good/partial/poor judgments using the returned query_id and result_id values; leave unrated results neutral, and remember that a poor query match is not the same as a globally bad skill. Reuse the same organization or anonymous auth scope as the query. AFTER you actually use a skill or resource, close the post-use loop with submit_feedback (useful true/false plus a one-line lesson and the originating query_id/result_id; it returns a ready submit_remembrance payload), then submit_remembrance if the lesson is reusable. If nothing fit and you built a new workflow, use propose_private_skill for an organization-private candidate. With an organization key, propose_skill_idea also remains organization-private. Never remove, suppress, or bypass that key to force a public submission; submit privately, then use the reviewed public-propagation flow when the organization chooses to share it. When delegating, pass the selected slug, exact version, query_id, and result_id to the subagent; it should invoke/fetch that result or run its own full-context query. The parent reports the terminal outcome unless the subagent creates its own invocation. Before finishing any reusable task, self-check for a missed query. If you catch your own mistake, the user catches one, CI/deploy fails, a security issue appears, or you fix a release/versioning miss, submit a failure_report remembrance even if no skill was used; raw MCP clients have no plugin Stop hook to remind you later. A host privacy or tenant-policy denial happens before Remembrance receives the request. Do not retry private repository content through another transport or claim submission. If the blocked contribution is an organization skill, use the local-only queue_private_skill_import tool or bundled handoff script, then wait for an organization admin import receipt. Attach evidence (reproduction detail, artifact hashes, or an attestation); evidence-less public reports wait in unverified intake until corroborated. Redact secrets, private URLs, credentials, raw logs, and proprietary content; submit summaries and hashes, not raw traces.";
+var REMEMBRANCE_MCP_SERVER_INSTRUCTIONS = "Remembrance is shared operational memory for agents. Before claiming that Remembrance is anonymous, unconfigured, partially active, or missing an organization key, call run_connection_doctor for the transport you will actually use. It performs a safe catalog read and returns exact bounded remediation without submitting content. Use get_connection_status only when you need the underlying transport and lifecycle fields. An unset REMEMBRANCE_API_KEY does not prove that a local plugin is anonymous because local hooks and bundled MCP may read ~/.config/remembrance/config.json. Conversely, hosted MCP cannot read that local file. Anonymous curl or browser probes describe only those requests, not plugin authentication. Never print or request the raw key. When the user explicitly names an authorized Remembrance skill or supplies a remembrance://skills/{slug} URI, resolve ambiguous names with list_skills using its normalized slug-prefix filter, then call invoke_skill with an exact returned slug. Never guess a slug. list_skills is catalog resolution, not relevance search; use query_skills when the user wants relevant candidates rather than a known selection. invoke_skill rechecks authorization and organization policy, resolves the current reviewed version, and returns the only full instruction body. Catalog listings and MCP resource reads are lightweight handles, not skill use. Do not run query_skills merely to rediscover that explicit selection, and do not submit query-fit feedback for it. After meaningful direct use, follow the returned task-outcome and post-use feedback instructions once. BEFORE non-trivial service/API/tool/library/workflow/UI/review/test/security/deployment work, call query_skills to reuse proven skills and resources instead of rediscovering them. A local repository change still qualifies when it involves a reusable workflow or lesson; skip only genuinely trivial throwaway edits and one-off facts. For short follow-ups such as 'fix these issues', 'continue', or 'try again', infer the concrete task, domain, and constraints from the full conversation and still call query_skills; do not wait for the current prompt to repeat trigger keywords. Treat match_tier as a decision aid, then inspect why_matched and applicability before opening a result. These fields show bounded matched terms/capabilities, satisfied and missed constraints, qualitative lexical/semantic evidence, declared scope, use conditions, and exclusions without exposing unstable raw ranking scores. Discard an unlikely or irrelevant corner-case result and report fit: poor; do not force its use. For a remaining high match, call get_skill or get_resource before custom work and pass the returned query_id/result_id so the surfaced-to-fetch funnel closes; possible and exploratory matches are optional. The response also includes approximate context tokens, verified uses, risk, tags, permissions, dependencies, and contraindications so you can weigh the detour safely. Honor query_skills.skill_access on every response. When policy is org_only, use only returned organization skills and never substitute bundled or live public skill references; if an organization key is configured and the query is unavailable, fail closed because the policy cannot be confirmed. AFTER query_skills, call submit_query_feedback once with one complete set of explicit good/partial/poor judgments using the returned query_id and result_id values; leave unrated results neutral, and remember that a poor query match is not the same as a globally bad skill. Reuse the same organization or anonymous auth scope as the query. AFTER you actually use a skill or resource, close the post-use loop with submit_feedback (useful true/false plus a one-line lesson and the originating query_id/result_id; it returns a ready submit_remembrance payload), then submit_remembrance if the lesson is reusable. If nothing fit and you built a new workflow, use propose_private_skill for an organization-private candidate. With an organization key, propose_skill_idea also remains organization-private. Never remove, suppress, or bypass that key to force a public submission; submit privately, then use the reviewed public-propagation flow when the organization chooses to share it. When delegating, pass the selected slug, exact version, query_id, and result_id to the subagent; it should invoke/fetch that result or run its own full-context query. The parent reports the terminal outcome unless the subagent creates its own invocation. Before finishing any reusable task, self-check for a missed query. If you catch your own mistake, the user catches one, CI/deploy fails, a security issue appears, or you fix a release/versioning miss, submit a failure_report remembrance even if no skill was used; raw MCP clients have no plugin Stop hook to remind you later. A host privacy or tenant-policy denial happens before Remembrance receives the request. Tell the user: 'Remembrance was blocked by host policy before reaching Remembrance. Nothing was sent. Querying remains available.' Do not retry the blocked content through another transport or claim submission. Attach evidence (reproduction detail, artifact hashes, or an attestation); evidence-less public reports wait in unverified intake until corroborated. Redact secrets, private URLs, credentials, raw logs, and proprietary content; submit summaries and hashes, not raw traces.";
 
 // ../core/src/redaction.ts
 var SECRET_PATTERN_SPECS = [
@@ -4935,6 +5466,7 @@ var REMEMBRANCE_MCP_READ_TOOLS = [
   "query_skills",
   "list_skills",
   "invoke_skill",
+  "get_effective_preferences",
   "get_skill",
   "get_resource",
   "get_value_proof"
@@ -4947,7 +5479,9 @@ var REMEMBRANCE_MCP_FEEDBACK_TOOLS = [
 var REMEMBRANCE_MCP_PRIVATE_CONTRIBUTION_TOOLS = [
   "submit_remembrance",
   "propose_private_skill",
-  "submit_suggestion"
+  "submit_suggestion",
+  "record_preference",
+  "link_current_installation"
 ];
 var REMEMBRANCE_MCP_OPTIONAL_SHARED_CONTRIBUTION_TOOLS = [
   "propose_skill_idea",
@@ -5025,6 +5559,49 @@ function remembranceSkillResourceHandle(entry) {
   );
 }
 
+// ../core/src/skill-topology.ts
+var skillTopologyActionSchema = external_exports.enum([
+  "amend",
+  "specialize",
+  "strategy_fork",
+  "independent_skill",
+  "preference",
+  "evidence_only",
+  "hold"
+]);
+var SKILL_TOPOLOGY_ACTIONS = skillTopologyActionSchema.options;
+var skillScopePredicateSchema = external_exports.object({
+  dimension: external_exports.enum([
+    "runtime",
+    "runtime_version",
+    "platform",
+    "language",
+    "framework",
+    "dependency",
+    "scale",
+    "task_stage"
+  ]),
+  operator: external_exports.enum(["equals", "includes", "at_least", "at_most"]),
+  value: external_exports.string().trim().min(1).max(256)
+}).strict();
+var skillTopologyAssessmentSchema = external_exports.object({
+  action: skillTopologyActionSchema,
+  confidence: external_exports.number().min(0).max(1),
+  subjectivity: external_exports.number().min(0).max(1),
+  generalizability: external_exports.number().min(0).max(1),
+  specificity_delta: external_exports.number().min(-1).max(1),
+  approach_divergence: external_exports.number().min(0).max(1),
+  stable_conditions: external_exports.array(skillScopePredicateSchema).max(12).default([]),
+  use_when: external_exports.array(external_exports.string().trim().min(1).max(512)).max(20).default([]),
+  avoid_when: external_exports.array(external_exports.string().trim().min(1).max(512)).max(20).default([]),
+  preference_setting: preferenceSettingSchema.nullable().default(null),
+  rationale: external_exports.string().trim().min(1).max(2e3)
+}).strict();
+var skillTopologyRoutingHintSchema = external_exports.object({
+  suggested_action: skillTopologyActionSchema,
+  conditions: external_exports.array(skillScopePredicateSchema).max(12).default([])
+}).strict();
+
 // ../core/src/schemas.ts
 var DEFAULT_MUTATION_BODY_LIMIT_BYTES = 256 * 1024;
 var MAX_SHORT_TEXT_LENGTH = 512;
@@ -5243,7 +5820,11 @@ var agentSchema = external_exports.object({
 var queryTaskSchema = external_exports.object({
   domain: boundedString(MAX_SHORT_TEXT_LENGTH),
   summary: boundedString(MAX_LONG_TEXT_LENGTH),
-  constraints: external_exports.array(boundedString(MAX_SHORT_TEXT_LENGTH)).max(40).default([])
+  constraints: external_exports.array(boundedString(MAX_SHORT_TEXT_LENGTH)).max(40).default([]),
+  // Explicit task-local preferences are normalized data, not raw prompt text.
+  // They are resolved for this request only and are never persisted as a
+  // durable member preference unless the caller separately records them.
+  preferences: taskPreferenceSettingsSchema.optional()
 });
 var queryRuntimeSchema = external_exports.enum([
   "codex",
@@ -5255,12 +5836,23 @@ var queryRuntimeSchema = external_exports.enum([
   "other",
   "unknown"
 ]);
+var runtimeHostSurfaceSchema = external_exports.enum([
+  "desktop",
+  "cli",
+  "extension",
+  "gateway",
+  "unknown"
+]);
+var runtimeProfileVersionSchema = external_exports.string().trim().min(1).max(64).regex(/^[A-Za-z0-9][A-Za-z0-9._+-]*$/);
 var queryDirectiveIdSchema = external_exports.string().regex(/^dir_[A-Za-z0-9_-]{16,80}$/);
 var queryClientContextSchema = external_exports.object({
   surface: external_exports.enum(["plugin_hook", "mcp", "rest", "unknown"]).default("unknown"),
   runtime: queryRuntimeSchema.optional(),
   trigger_reason: boundedString(MAX_SHORT_TEXT_LENGTH).optional(),
-  directive_id: queryDirectiveIdSchema.optional()
+  directive_id: queryDirectiveIdSchema.optional(),
+  // A local, installation-keyed digest. It lets one engineer retain
+  // project-scoped preferences without disclosing a path or repository.
+  project_key: external_exports.string().regex(/^prj_[A-Za-z0-9_-]{12,120}$/).optional()
 }).strict();
 var reasoningEffortSchema = external_exports.enum([
   "none",
@@ -5483,31 +6075,145 @@ var agentTaskOutcomeRequestSchema = external_exports.object({
     });
   }
 });
-var economicsSessionChallengeSchema = external_exports.object({
+var runtimeProfileRegistrationSchema = external_exports.object({
+  runtime: queryRuntimeSchema,
+  surface: external_exports.enum(["plugin_hook", "mcp", "rest", "unknown"]),
+  host_surface: runtimeHostSurfaceSchema.default("unknown"),
+  client_name: external_exports.string().trim().min(1).max(64).regex(/^[A-Za-z0-9][A-Za-z0-9 ._+-]*$/),
+  client_version: runtimeProfileVersionSchema.nullable().optional(),
+  runtime_version: runtimeProfileVersionSchema.nullable().optional(),
+  profile_key: external_exports.string().regex(/^rpf_[A-Za-z0-9_-]{16,120}$/)
+}).strict();
+var principalSessionChallengeSchema = external_exports.object({
   action: external_exports.literal("challenge"),
   provider: economicsSessionProviderSchema,
-  key_id: boundedString(MAX_SHORT_TEXT_LENGTH)
+  key_id: boundedString(MAX_SHORT_TEXT_LENGTH),
+  runtime_profile: runtimeProfileRegistrationSchema.nullable().optional(),
+  member_link_token: external_exports.string().regex(/^mlink_[A-Za-z0-9_-]{24,160}$/).nullable().optional()
 }).strict();
-var economicsSessionExchangeSchema = external_exports.object({
+var principalSessionExchangeSchema = external_exports.object({
   action: external_exports.literal("exchange"),
   provider: economicsSessionProviderSchema,
   key_id: boundedString(MAX_SHORT_TEXT_LENGTH),
   challenge_id: boundedString(MAX_SHORT_TEXT_LENGTH),
   signature: boundedString(MAX_LONG_TEXT_LENGTH)
 }).strict();
-var economicsSessionRequestSchema = external_exports.discriminatedUnion("action", [
-  economicsSessionChallengeSchema,
-  economicsSessionExchangeSchema
+var principalSessionRequestSchema = external_exports.discriminatedUnion("action", [
+  principalSessionChallengeSchema,
+  principalSessionExchangeSchema
 ]);
+var recordPreferenceRequestSchema = external_exports.object({
+  setting: preferenceSettingSchema,
+  // Organization guidance is dashboard-owned policy. Agent transports may
+  // record only identity-bound or task-context preference observations.
+  scope: external_exports.enum([
+    "auto",
+    "member",
+    "member_runtime",
+    "installation",
+    "project",
+    "skill",
+    "domain"
+  ]),
+  source_category: external_exports.enum(["explicit_user", "agent_observed"]),
+  evidence_hash: external_exports.string().regex(/^[a-f0-9]{32,128}$/i),
+  task_hash: external_exports.string().regex(/^[a-f0-9]{32,128}$/i),
+  project_key: external_exports.string().regex(/^prj_[A-Za-z0-9_-]{12,120}$/).nullable().optional(),
+  skill_slug: boundedString(MAX_SHORT_TEXT_LENGTH).nullable().optional(),
+  domain: boundedString(MAX_SHORT_TEXT_LENGTH).nullable().optional(),
+  confidence: external_exports.number().min(0).max(1)
+}).strict().superRefine((value, ctx) => {
+  const required = value.scope === "project" ? "project_key" : value.scope === "skill" ? "skill_slug" : value.scope === "domain" ? "domain" : null;
+  if (required && !value[required]) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: [required],
+      message: `${required} is required for ${value.scope} preferences`
+    });
+  }
+  if (value.source_category === "agent_observed" && value.confidence >= 1) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["confidence"],
+      message: "Inferred observations cannot claim absolute confidence"
+    });
+  }
+});
+var effectivePreferencesRequestSchema = external_exports.object({
+  // Omit or send [] to resolve every active bounded preference. Supplying
+  // keys is an optional projection for clients that need only a subset.
+  keys: external_exports.array(preferenceKeySchema).max(MAX_EFFECTIVE_PREFERENCES).default([]),
+  task_preferences: taskPreferenceSettingsSchema.optional(),
+  project_key: external_exports.string().regex(/^prj_[A-Za-z0-9_-]{12,120}$/).nullable().optional(),
+  skill_slug: boundedString(MAX_SHORT_TEXT_LENGTH).nullable().optional(),
+  domains: external_exports.array(boundedString(MAX_SHORT_TEXT_LENGTH)).max(20).default([])
+}).strict();
 var agentPrincipalRegistrationRequestSchema = external_exports.object({
   display_name: boundedString(MAX_SHORT_TEXT_LENGTH),
   provider: agentProviderSchema,
   runtime_version: boundedString(MAX_SHORT_TEXT_LENGTH).nullable().optional(),
   parent_principal_id: boundedString(MAX_SHORT_TEXT_LENGTH).nullable().optional()
 }).strict();
-var agentPrincipalUpdateRequestSchema = external_exports.object({
-  principal_id: boundedString(MAX_SHORT_TEXT_LENGTH),
-  action: external_exports.enum(["deactivate", "reactivate"])
+var agentPrincipalUpdateRequestSchema = external_exports.discriminatedUnion(
+  "action",
+  [
+    external_exports.object({
+      principal_id: boundedString(MAX_SHORT_TEXT_LENGTH),
+      action: external_exports.enum(["deactivate", "reactivate"])
+    }).strict(),
+    external_exports.object({
+      principal_id: boundedString(MAX_SHORT_TEXT_LENGTH),
+      action: external_exports.literal("rename"),
+      display_name: boundedString(MAX_SHORT_TEXT_LENGTH)
+    }).strict()
+  ]
+);
+var agentInstallationManagementRequestSchema = external_exports.discriminatedUnion(
+  "action",
+  [
+    external_exports.object({
+      action: external_exports.literal("rename"),
+      installation_id: boundedString(MAX_SHORT_TEXT_LENGTH),
+      display_name: boundedString(MAX_SHORT_TEXT_LENGTH)
+    }).strict(),
+    external_exports.object({
+      action: external_exports.literal("rename_runtime_profile"),
+      runtime_profile_id: boundedString(MAX_SHORT_TEXT_LENGTH),
+      display_name: boundedString(MAX_SHORT_TEXT_LENGTH)
+    }).strict(),
+    external_exports.object({
+      action: external_exports.literal("set_status"),
+      installation_id: boundedString(MAX_SHORT_TEXT_LENGTH),
+      status: external_exports.enum(["active", "inactive"])
+    }).strict(),
+    external_exports.object({
+      action: external_exports.literal("assign_member"),
+      installation_id: boundedString(MAX_SHORT_TEXT_LENGTH),
+      member_principal_id: boundedString(MAX_SHORT_TEXT_LENGTH)
+    }).strict(),
+    external_exports.object({
+      action: external_exports.literal("unlink_member"),
+      installation_id: boundedString(MAX_SHORT_TEXT_LENGTH)
+    }).strict()
+  ]
+);
+var dashboardPreferenceMutationSchema = external_exports.discriminatedUnion(
+  "action",
+  [
+    external_exports.object({
+      action: external_exports.literal("set"),
+      setting: preferenceSettingSchema,
+      scope: external_exports.enum(["member", "organization"]),
+      enforcement: external_exports.enum(["recommended", "required"]).default("recommended")
+    }).strict(),
+    external_exports.object({
+      action: external_exports.enum(["reset", "undo"]),
+      revision_id: boundedString(MAX_SHORT_TEXT_LENGTH)
+    }).strict()
+  ]
+);
+var agentMemberLinkRequestSchema = external_exports.object({
+  member_link_token: external_exports.string().regex(/^mlink_[A-Za-z0-9_-]{24,160}$/)
 }).strict();
 var agentPrincipalKeyBindingRequestSchema = external_exports.object({
   principal_id: boundedString(MAX_SHORT_TEXT_LENGTH),
@@ -5590,6 +6296,7 @@ var remembrancePayloadSchema = external_exports.object({
   }).strict().optional(),
   enterprise_encryption: enterpriseEncryptedPayloadEnvelopeSchema.optional(),
   suggested_update: suggestedUpdateSchema.default({ kind: "none" }),
+  routing_hint: skillTopologyRoutingHintSchema.optional(),
   evidence: evidenceSchema.default({ artifact_hashes: [] }),
   // Client-only directive: "sign this with my local TOFU key" (the MCP
   // submit_remembrance tool exposes it, and feedback-next-step tells REST
@@ -5624,6 +6331,8 @@ var skillMetadataSchema = external_exports.object({
   permissions: external_exports.record(external_exports.boolean()).default({}),
   contraindications: external_exports.array(external_exports.string().max(MAX_LONG_TEXT_LENGTH)).max(80).default([]),
   applicability: skillApplicabilitySchema.optional(),
+  preference_defaults: skillPreferenceDefaultsSchema.optional(),
+  preference_traits: skillPreferenceTraitsSchema.optional(),
   feedback_url: external_exports.string().url(),
   install_command: external_exports.string().min(1),
   stats: external_exports.object({
@@ -5656,6 +6365,7 @@ var skillIdeaRequestSchema = external_exports.object({
   domain_slug: boundedString(MAX_SHORT_TEXT_LENGTH).nullable().optional(),
   proposed_skill_md: external_exports.string().max(MAX_LONG_TEXT_LENGTH).nullable().optional(),
   proposed_metadata: boundedJsonRecord().default({}),
+  routing_hint: skillTopologyRoutingHintSchema.optional(),
   enterprise_encryption: enterpriseEncryptedPayloadEnvelopeSchema.optional(),
   idempotency_key: boundedString(MAX_SHORT_TEXT_LENGTH).optional()
 });
@@ -5668,6 +6378,7 @@ var suggestionRequestSchema = external_exports.object({
   summary: boundedString(MAX_LONG_TEXT_LENGTH),
   diff_text: external_exports.string().max(MAX_LONG_TEXT_LENGTH).nullable().optional(),
   payload: boundedJsonRecord().default({}),
+  routing_hint: skillTopologyRoutingHintSchema.optional(),
   enterprise_encryption: enterpriseEncryptedPayloadEnvelopeSchema.optional(),
   idempotency_key: boundedString(MAX_SHORT_TEXT_LENGTH).optional()
 });
@@ -5748,6 +6459,7 @@ var attestationKeyRegistrationRequestSchema = external_exports.object({
   agent: agentSchema.optional(),
   proof: external_exports.object({
     algorithm: external_exports.enum(["ed25519"]).default("ed25519"),
+    owner_binding: external_exports.string().regex(/^areg_[A-Za-z0-9_-]{24,120}$/).optional(),
     signed_at: external_exports.string().datetime(),
     signature: boundedString(MAX_LONG_TEXT_LENGTH)
   }),
@@ -5946,7 +6658,7 @@ var seedSkills = [
     summary: "Operational setup and troubleshooting workflow for Remembrance across Claude Code, Codex, OpenClaw, Cursor, Gemini, MCP, REST, skill-only installs, enterprise keys, and local agent identity.",
     status: "active",
     visibility: "public",
-    version: "0.1.14",
+    version: "0.1.18",
     domains: ["agent-skills", "mcp", "resource-discovery"],
     tags: [
       "remembrance",
@@ -5997,7 +6709,7 @@ var seedSkills = [
         "gemini",
         "rest"
       ],
-      version: "0.1.14",
+      version: "0.1.18",
       status: "active",
       visibility: "public",
       providers: ["codex", "claude", "cursor", "openclaw", "generic"],
@@ -6406,7 +7118,8 @@ The MCP annotation for \`propose_private_skill\` is non-read-only and
 closed-world: it makes a network request, but can change only the authenticated
 organization's private review queue and cannot change publicly visible internet
 state. Closed-world does not mean zero-network. Only
-\`queue_private_skill_import\` is the local, zero-network fallback.
+\`queue_private_skill_import\` is a local, zero-network handoff tool, and it
+should run only when an organization admin explicitly requests that handoff.
 
 Example text to merge into the tenant-specific guardian policy:
 
@@ -6441,12 +7154,14 @@ over a user's local \`[auto_review].policy\`. See the official Codex
 [managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration#configure-automatic-review-policy)
 documentation for the current schema and deployment options.
 
-If the organization does not approve direct egress, keep the host denial. Use
-\`queue_private_skill_import\` locally, or run the bundled
-\`scripts/queue-private-skill-import.mjs\` helper, then have an organization
-admin upload the mode-0600 JSON at **Dashboard > Skills > Import**. The handoff
-never contains an API key or organization id, never contacts Remembrance, and
-does not count as submitted until the dashboard returns an import batch receipt.
+If the organization does not approve direct egress, keep the host denial. The
+plugin reports one content-free local alert, does not retry, and does not create
+a handoff automatically. Only when an organization admin explicitly requests a
+handoff, use \`queue_private_skill_import\` locally or run the bundled
+\`scripts/queue-private-skill-import.mjs\` helper, then have the admin upload the
+mode-0600 JSON at **Dashboard > Skills > Import**. The handoff never contains an
+API key or organization id, never contacts Remembrance, and does not count as
+submitted until the dashboard returns an import batch receipt.
 
 If Codex still sees \`<your org key>\` after restart, remove stale
 \`REMEMBRANCE_API_KEY\` exports from shell profiles such as \`~/.zshrc\` and
@@ -6783,6 +7498,17 @@ npx skills add dreamarkinc/remembrance-skills --skill remembrancer
 The entry skill is REST-only and self-contained. The same skill directory can
 be copied to ".agents/skills/remembrancer/SKILL.md" for compatible providers.
 
+## Verified client updates
+
+Native plugins and local MCP check the credential-free public release manifest
+at startup and through \`run_connection_doctor\`. The check sends no API key,
+fails open when the registry is unavailable, and never runs a command returned
+by the network. When a newer verified release exists, the agent must ask before
+running the update command bundled with its installed client, then tell the user
+which Codex, Claude Code, Cursor, OpenClaw, VS Code, OpenCode, or MCP host must
+be reloaded, reopened, or fully restarted. Set
+\`REMEMBRANCE_CLIENT_UPDATE_CHECK=0\` to disable only this advisory check.
+
 ## Validate after setup
 
 1. Start a fresh agent session.
@@ -6837,10 +7563,12 @@ be copied to ".agents/skills/remembrancer/SKILL.md" for compatible providers.
    that should not appear anonymously.
 13. With an organization submission key, submit one disposable redacted skill
    through propose_private_skill and verify it appears only in that
-   organization's review queue. If host policy denies the export, run
-   queue_private_skill_import instead, upload its JSON in the dashboard, and
-   verify the agent reports a local queue receipt separately from the server
-   import receipt.
+   organization's review queue. In a separate negative scenario, simulate a
+   host-policy denial and verify the plugin reports the fixed content-free alert
+   once, persists no blocked content, performs no retry, and creates no handoff.
+   Test queue_private_skill_import only as a separate administrator-requested
+   manual handoff, with its local receipt distinguished from a server import
+   receipt.
 14. If using local MCP, verify local_signing_identity in get_connection_status.
    A missing opaque identity initializes automatically on the first signed
    contribution; bootstrap_agent_identity with no arguments is an optional
@@ -7647,7 +8375,14 @@ var verifierOutputSchema = external_exports.object({
   }).nullable().default(null),
   // Advisory retrieval enrichment (see proposedSkillMetadataSchema). Optional
   // and defaults to null so existing verifier outputs remain valid.
-  proposed_metadata: proposedSkillMetadataSchema.nullable().default(null)
+  proposed_metadata: proposedSkillMetadataSchema.nullable().default(null),
+  // Advisory evidence-routing assessment. Deterministic routing and the
+  // existing safety/review gates decide whether it can create a candidate.
+  // Topology is advisory and newer than the base verifier contract. A legacy
+  // or malformed topology fragment must not discard an otherwise valid safety
+  // verdict; it degrades to null, which the topology router retains as
+  // evidence-only rather than allowing an unclassified mutation.
+  topology_assessment: skillTopologyAssessmentSchema.nullable().default(null).catch(null)
 });
 
 // src/server.ts
@@ -7655,6 +8390,8 @@ import { existsSync as existsSync3 } from "node:fs";
 import { mkdir as mkdir2, writeFile as writeFile2 } from "node:fs/promises";
 import { dirname as dirname2 } from "node:path";
 import {
+  createHash as createHash3,
+  createHmac,
   createPrivateKey as createPrivateKey2,
   generateKeyPairSync,
   sign as signPayload
@@ -9016,6 +9753,24 @@ var toolDefinitions = [
     "/api/v1/agent/skill-invocations",
     agentSkillInvocationRequestSchema
   ),
+  tool(
+    "get_effective_preferences",
+    "Return bounded, task-relevant working preferences for this verified installation and optional linked member/runtime profile. project_key is an opaque local project-context hash; paths and repository names are never transmitted. A clear current-task preference overrides every non-mandatory stored preference; Required organization guidance remains authoritative. Preferences may steer among already-relevant skills and surgically alter discretionary presentation, workflow, or strategy choices. They never change relevance tiers or weaken applicability, safety, authorization, privacy, required skill steps, validation, or review. Clients without a valid principal session remain organization-level and receive no personal preferences.",
+    "/api/v1/agent/preferences/effective",
+    effectivePreferencesRequestSchema
+  ),
+  tool(
+    "record_preference",
+    "Record a bounded, privacy-safe preference observation for the current verified installation. Built-in settings need only key and value; a custom setting also supplies its plain-language label, behavior, presentation/workflow/strategy_selection effect, prefer/avoid direction, and definition version. Send normalized settings and hashes only, never prompt text. A valid principal session is required. Explicit user preferences apply immediately; inferred observations activate only after Remembrance's consistency and confidence thresholds are met.",
+    "/api/v1/agent/preferences",
+    recordPreferenceRequestSchema
+  ),
+  tool(
+    "link_current_installation",
+    "Link this verified installation to the signed-in organization member using a single-use dashboard token. The token expires after ten minutes and is consumed exactly once. A valid organization principal session is required; this never changes the organization API key or creates another billed agent.",
+    "/api/v1/agent/member-links",
+    agentMemberLinkRequestSchema
+  ),
   tool(
     "get_skill",
     "Fetch the exact active reviewed skill body and version after query_skills returns a known slug. The response includes skill_md, version_id, and source. Pass query_id and result_id from that response so Remembrance can measure whether surfaced guidance was opened. Do not guess private or inactive slugs.",
@@ -9069,19 +9824,19 @@ var toolDefinitions = [
   ),
   tool(
     "submit_remembrance",
-    "Submit a full remembrance payload with detailed reusable evidence, including high-value self-corrections, user-caught mistakes, CI/deploy failures, and release/versioning misses as type failure_report. Never include credentials, secrets, raw logs, or unrelated repository content. Repository-derived private instructions may be sent only when the user or organization has approved Remembrance as a destination; if the host blocks that export, use the local queue_private_skill_import fallback instead of retrying through another transport.",
+    "Submit a full remembrance payload with detailed reusable evidence, including high-value self-corrections, user-caught mistakes, CI/deploy failures, and release/versioning misses as type failure_report. Never include credentials, secrets, raw logs, or unrelated repository content. Repository-derived private instructions may be sent only when the user or organization has approved Remembrance as a destination. If the host blocks that export, report that nothing was sent and do not retry through another transport or create a handoff unless an organization admin explicitly requests one.",
     "/api/v1/agent/remembrances",
     remembranceToolSchema
   ),
   tool(
     "propose_skill_idea",
-    "Propose a missing reusable skill when query_skills has no useful result. THIS TOOL'S VISIBILITY IS NOT FIXED: an active organization API key keeps the candidate inside that organization's review queue, while intentionally calling without a key creates a PUBLIC candidate. A supplied invalid/inactive key fails with 401 and a valid key without submission:create fails with 403; neither failure creates a candidate. Prefer propose_private_skill for anything repository-derived, organization-specific, or otherwise not intended for the public registry because that endpoint structurally requires organization auth. Use propose_skill_idea only when a public candidate is an acceptable outcome. Check `visibility` (organization_private or public_candidate) and `owner_scope` in the successful response, and report where the candidate landed. Never remove or bypass an organization key to force public submission: submit privately, then use the reviewed public-propagation flow. Send repository-derived private instructions only when Remembrance is an organization-approved destination. If host policy blocks the export, queue_private_skill_import locally and do not claim submission.",
+    "Propose a missing reusable skill when query_skills has no useful result. THIS TOOL'S VISIBILITY IS NOT FIXED: an active organization API key keeps the candidate inside that organization's review queue, while intentionally calling without a key creates a PUBLIC candidate. A supplied invalid/inactive key fails with 401 and a valid key without submission:create fails with 403; neither failure creates a candidate. Prefer propose_private_skill for anything repository-derived, organization-specific, or otherwise not intended for the public registry because that endpoint structurally requires organization auth. Use propose_skill_idea only when a public candidate is an acceptable outcome. Check `visibility` (organization_private or public_candidate) and `owner_scope` in the successful response, and report where the candidate landed. Never remove or bypass an organization key to force public submission: submit privately, then use the reviewed public-propagation flow. Send repository-derived private instructions only when Remembrance is an organization-approved destination. If host policy blocks the export, report that nothing was sent, do not retry, and do not create a handoff unless an organization admin explicitly requests one.",
     "/api/v1/agent/skill-ideas",
     skillIdeaRequestSchema
   ),
   tool(
     "propose_private_skill",
-    "Submit a proposed skill only to the authenticated organization's private review queue. Privacy here is STRUCTURAL, not credential-dependent: this endpoint rejects anonymous use and never creates a public candidate, so unlike propose_skill_idea it cannot silently fall through to public when a key fails to resolve \u2014 it fails closed with 401/403 instead. Prefer it whenever the content is repository-derived, organization-specific, or must not reach the public registry; that preference is about removing the credential from the privacy decision, not about propose_skill_idea being unsafe when a key is present. Use it for repository-derived instructions only when Remembrance is an organization-approved destination. The response reports `visibility` (always organization_private here) \u2014 a rejection means nothing was submitted. If host policy blocks the export, queue_private_skill_import locally instead; never retry through another transport or claim submission without a receipt.",
+    "Submit a proposed skill only to the authenticated organization's private review queue. Privacy here is STRUCTURAL, not credential-dependent: this endpoint rejects anonymous use and never creates a public candidate, so unlike propose_skill_idea it cannot silently fall through to public when a key fails to resolve \u2014 it fails closed with 401/403 instead. Prefer it whenever the content is repository-derived, organization-specific, or must not reach the public registry; that preference is about removing the credential from the privacy decision, not about propose_skill_idea being unsafe when a key is present. Use it for repository-derived instructions only when Remembrance is an organization-approved destination. The response reports `visibility` (always organization_private here) \u2014 a rejection means nothing was submitted. If host policy blocks the export, report that nothing was sent, never retry through another transport, and do not create a handoff unless an organization admin explicitly requests one.",
     "/api/v1/agent/private-skill-ideas",
     skillIdeaRequestSchema
   ),
@@ -9138,7 +9893,7 @@ function localTool(name, description, local, schema) {
   };
 }
 function annotationsForTool(name) {
-  const readOnly = name === "list_skills" || name === "get_value_proof" || name === "run_connection_doctor";
+  const readOnly = name === "list_skills" || name === "get_effective_preferences" || name === "get_value_proof" || name === "run_connection_doctor";
   const openWorld = name === "submit_feedback" || name === "submit_remembrance" || name === "propose_skill_idea" || name === "submit_suggestion" || name === "submit_resource" || name === "submit_resource_review";
   return {
     readOnlyHint: readOnly,
@@ -9365,7 +10120,7 @@ function localAgentIdentityPath(env = process.env, homeDirectory = homedir2()) {
   );
 }
 function parseStoredIdentity(value) {
-  if (!isRecord(value)) return null;
+  if (!isRecord2(value)) return null;
   if (!supportedProviders.has(value.provider)) {
     return null;
   }
@@ -9500,7 +10255,7 @@ function identityStatus(args) {
     } : null
   };
 }
-function isRecord(value) {
+function isRecord2(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
 
@@ -9514,6 +10269,20 @@ var PLUGIN_HEALTH_COMPONENTS = [
 ];
 var PLUGIN_HEALTH_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1e3;
 var PLUGIN_HEALTH_MAX_FUTURE_SKEW_MS = 5 * 60 * 1e3;
+var HOST_POLICY_OBSERVATION_MAX_AGE_MS = 30 * 24 * 60 * 60 * 1e3;
+var HOST_POLICY_OBSERVABLE_SURFACES = /* @__PURE__ */ new Set([
+  "claude_code",
+  "cursor",
+  "openclaw",
+  "opencode"
+]);
+var HOST_POLICY_OPERATION_CLASSES2 = /* @__PURE__ */ new Set([
+  "query",
+  "private_contribution",
+  "contribution",
+  "feedback",
+  "other"
+]);
 var nodeFileSystem2 = {
   exists: existsSync2,
   read: (path, maxBytes = MAX_LOCAL_CONFIG_BYTES) => readSecureLocalText(path, { maxBytes }),
@@ -9525,107 +10294,104 @@ function remembranceConfigPath(env = process.env, homeDirectory = homedir3()) {
   return join3(configRoot, "remembrance", "config.json");
 }
 function resolveApiCredential(env = process.env, fileSystem = nodeFileSystem2) {
-  const apiConfiguration2 = resolveApiConfiguration(env, fileSystem);
+  return resolveApiAccess(env, fileSystem).credential;
+}
+function resolveApiAccess(env = process.env, fileSystem = nodeFileSystem2) {
+  const shared = readSharedConfigSnapshot(env, fileSystem);
+  const configuration = resolveApiConfigurationFromSnapshot(env, shared);
   const environmentKey = env.REMEMBRANCE_API_KEY?.trim();
+  let credential;
   if (environmentKey) {
     const explicitBinding = env.REMEMBRANCE_API_KEY_ORIGIN?.trim();
     const binding = explicitBinding ? normalizeApiUrl(explicitBinding, env) : { baseUrl: DEFAULT_API_URL, issue: null };
     if (!binding.baseUrl || binding.issue) {
-      return unusableDestinationBinding();
+      credential = unusableDestinationBinding();
+    } else {
+      credential = credentialForDestination(
+        {
+          apiKey: environmentKey,
+          source: "environment",
+          boundBaseUrl: binding.baseUrl
+        },
+        configuration
+      );
+    }
+  } else if (!shared.present) {
+    credential = { apiKey: "", source: "none" };
+  } else if (!shared.parsed || Object.prototype.hasOwnProperty.call(shared.parsed, "apiKey") && (typeof shared.parsed.apiKey !== "string" || !shared.parsed.apiKey.trim())) {
+    credential = unusableSharedConfig();
+  } else if (!shared.config.apiKey) {
+    credential = { apiKey: "", source: "none" };
+  } else {
+    const binding = shared.config.apiUrl ? normalizeApiUrl(shared.config.apiUrl, env) : { baseUrl: DEFAULT_API_URL, issue: null };
+    if (!binding.baseUrl || binding.issue) {
+      credential = unusableSharedConfig();
+    } else {
+      credential = credentialForDestination(
+        {
+          apiKey: shared.config.apiKey,
+          source: "shared_config",
+          boundBaseUrl: binding.baseUrl
+        },
+        configuration
+      );
     }
-    return credentialForDestination(
-      {
-        apiKey: environmentKey,
-        source: "environment",
-        boundBaseUrl: binding.baseUrl
-      },
-      apiConfiguration2
-    );
   }
+  return {
+    configuration,
+    credential,
+    memberLinkToken: env.REMEMBRANCE_MEMBER_LINK_TOKEN?.trim() ?? shared.config.memberLinkToken ?? ""
+  };
+}
+function isUnusableCredentialSource(source) {
+  return source.startsWith("unusable_");
+}
+function readSharedConfigSnapshot(env, fileSystem) {
   const path = remembranceConfigPath(env);
   if (!fileSystem.exists(path)) {
-    return { apiKey: "", source: "none" };
+    return { present: false, parsed: null, config: {} };
   }
   try {
     const parsed = JSON.parse(
       fileSystem.read(path, MAX_LOCAL_CONFIG_BYTES)
     );
-    if (!isRecord2(parsed)) {
-      return unusableSharedConfig();
-    }
-    if (Object.prototype.hasOwnProperty.call(parsed, "apiKey") && (typeof parsed.apiKey !== "string" || !parsed.apiKey.trim())) {
-      return unusableSharedConfig();
-    }
-    const config = normalizeConfig(parsed);
-    if (!config.apiKey) {
-      return { apiKey: "", source: "none" };
-    }
-    const binding = config.apiUrl ? normalizeApiUrl(config.apiUrl, env) : { baseUrl: DEFAULT_API_URL, issue: null };
-    if (!binding.baseUrl || binding.issue) {
-      return unusableSharedConfig();
-    }
-    return credentialForDestination(
-      {
-        apiKey: config.apiKey,
-        source: "shared_config",
-        boundBaseUrl: binding.baseUrl
-      },
-      apiConfiguration2
-    );
+    return isRecord3(parsed) ? { present: true, parsed, config: normalizeConfig(parsed) } : { present: true, parsed: null, config: {} };
   } catch {
-    return unusableSharedConfig();
+    return { present: true, parsed: null, config: {} };
   }
 }
-function resolveApiKey(env = process.env, fileSystem = nodeFileSystem2) {
-  return resolveApiCredential(env, fileSystem).apiKey;
-}
-function resolveApiConfiguration(env = process.env, fileSystem = nodeFileSystem2) {
+function resolveApiConfigurationFromSnapshot(env, shared) {
   const environmentUrl = env.REMEMBRANCE_API_URL?.trim();
   if (environmentUrl) {
-    const normalized = normalizeApiUrl(environmentUrl, env);
-    if (normalized.baseUrl !== null) {
-      return { baseUrl: normalized.baseUrl, source: "environment" };
+    const normalized2 = normalizeApiUrl(environmentUrl, env);
+    if (normalized2.baseUrl !== null) {
+      return { baseUrl: normalized2.baseUrl, source: "environment" };
     }
     return {
       baseUrl: DEFAULT_API_URL,
       source: "unusable_environment",
-      issue: normalized.issue
+      issue: normalized2.issue
     };
   }
-  const path = remembranceConfigPath(env);
-  if (!fileSystem.exists(path)) {
+  if (!shared.present) {
     return { baseUrl: DEFAULT_API_URL, source: "default" };
   }
-  try {
-    const parsed = JSON.parse(
-      fileSystem.read(path, MAX_LOCAL_CONFIG_BYTES)
-    );
-    if (!isRecord2(parsed)) {
-      return {
-        baseUrl: DEFAULT_API_URL,
-        source: "unusable_shared_config",
-        issue: "invalid_url"
-      };
-    }
-    if (!Object.prototype.hasOwnProperty.call(parsed, "apiUrl")) {
-      return { baseUrl: DEFAULT_API_URL, source: "default" };
-    }
-    const normalized = normalizeApiUrl(parsed.apiUrl, env);
-    if (normalized.baseUrl !== null) {
-      return { baseUrl: normalized.baseUrl, source: "shared_config" };
-    }
-    return {
-      baseUrl: DEFAULT_API_URL,
-      source: "unusable_shared_config",
-      issue: normalized.issue
-    };
-  } catch {
+  if (!shared.parsed) {
     return {
       baseUrl: DEFAULT_API_URL,
       source: "unusable_shared_config",
       issue: "invalid_url"
     };
   }
+  if (!Object.prototype.hasOwnProperty.call(shared.parsed, "apiUrl")) {
+    return { baseUrl: DEFAULT_API_URL, source: "default" };
+  }
+  const normalized = normalizeApiUrl(shared.parsed.apiUrl, env);
+  return normalized.baseUrl !== null ? { baseUrl: normalized.baseUrl, source: "shared_config" } : {
+    baseUrl: DEFAULT_API_URL,
+    source: "unusable_shared_config",
+    issue: normalized.issue
+  };
 }
 function sharedConfigStatus(env = process.env, fileSystem = nodeFileSystem2) {
   const path = remembranceConfigPath(env);
@@ -9655,7 +10421,7 @@ function sharedConfigStatus(env = process.env, fileSystem = nodeFileSystem2) {
     const parsed = JSON.parse(
       fileSystem.read(path, MAX_LOCAL_CONFIG_BYTES)
     );
-    validJson = isRecord2(parsed);
+    validJson = isRecord3(parsed);
     config = normalizeConfig(parsed);
   } catch {
   }
@@ -9670,7 +10436,7 @@ function sharedConfigStatus(env = process.env, fileSystem = nodeFileSystem2) {
   };
 }
 function localConnectionStatus(result, options) {
-  const response = isRecord2(result) ? result : {};
+  const response = isRecord3(result) ? result : {};
   const env = options.env ?? process.env;
   const fileSystem = options.fileSystem ?? nodeFileSystem2;
   const credential = resolveApiCredential(env, fileSystem);
@@ -9688,6 +10454,11 @@ function localConnectionStatus(result, options) {
     apiDestinationSource: options.apiUrlSource,
     now: options.now
   });
+  const hostPolicy = localHostPolicyStatus({
+    env,
+    fileSystem,
+    now: options.now
+  });
   const registryReady = response.ok === true;
   const insecureCredential = sharedConfig.api_key_present && sharedConfig.secure_permissions === false;
   const unknownCredentialPermissions = sharedConfig.api_key_present && sharedConfig.secure_permissions === null;
@@ -9708,7 +10479,79 @@ function localConnectionStatus(result, options) {
     },
     registry: response.body ?? (response.error ? { error: String(response.error) } : null),
     local_signing_identity: localAgentIdentityStatus(env, fileSystem),
-    plugin_health: pluginHealth
+    plugin_health: { ...pluginHealth, host_policy: hostPolicy }
+  };
+}
+function localHostPolicyStatus(options) {
+  const env = options.env ?? process.env;
+  const fileSystem = options.fileSystem ?? nodeFileSystem2;
+  const rawSurface = String(env.REMEMBRANCE_PLUGIN_HOST ?? "").trim().toLowerCase();
+  if (!isPluginHostSurface(rawSurface)) {
+    return {
+      status: "not_observable",
+      observable: false,
+      explanation: "This connection cannot observe a host policy decision made before MCP transport."
+    };
+  }
+  const surface = rawSurface;
+  if (!HOST_POLICY_OBSERVABLE_SURFACES.has(surface)) {
+    return {
+      status: "not_observable",
+      observable: false,
+      explanation: "This host does not expose a reliable failed-tool or permission event to the plugin."
+    };
+  }
+  const directory = env.REMEMBRANCE_PLUGIN_ALERT_DIR ? String(env.REMEMBRANCE_PLUGIN_ALERT_DIR) : join3(homedir3(), ".cache", "remembrance", "plugin-alerts");
+  const names = fileSystem.list ? (() => {
+    try {
+      return fileSystem.list?.(directory) ?? [];
+    } catch {
+      return [];
+    }
+  })() : [];
+  const nowMs = (options.now ?? /* @__PURE__ */ new Date()).getTime();
+  let latest = null;
+  let latestMs = Number.NEGATIVE_INFINITY;
+  for (const name of names.filter(
+    (value) => new RegExp(`^${surface}\\.[a-f0-9]{24}\\.json$`).test(value)
+  ).slice(0, MAX_LOCAL_LIFECYCLE_MARKERS)) {
+    try {
+      const sessionHash = name.split(".")[1];
+      const parsed = JSON.parse(
+        fileSystem.read(
+          join3(directory, name),
+          MAX_LOCAL_LIFECYCLE_MARKER_BYTES
+        )
+      );
+      if (!isRecord3(parsed) || parsed.schema_version !== 1 || parsed.surface !== surface || parsed.session_hash !== sessionHash || !Array.isArray(parsed.observations)) {
+        continue;
+      }
+      for (const candidate of parsed.observations) {
+        if (!isRecord3(candidate)) continue;
+        const seenMs = typeof candidate.last_seen_at === "string" ? Date.parse(candidate.last_seen_at) : Number.NaN;
+        if (Number.isFinite(seenMs) && seenMs <= nowMs + PLUGIN_HEALTH_MAX_FUTURE_SKEW_MS && nowMs - seenMs <= HOST_POLICY_OBSERVATION_MAX_AGE_MS && seenMs > latestMs) {
+          latest = candidate;
+          latestMs = seenMs;
+        }
+      }
+    } catch {
+    }
+  }
+  if (!latest) {
+    return {
+      status: "no_recent_denial",
+      observable: true,
+      explanation: "No recent host policy denial has been observed. This is not proof that future submissions are permitted."
+    };
+  }
+  return {
+    status: "recent_denial",
+    observable: true,
+    operation_class: HOST_POLICY_OPERATION_CLASSES2.has(
+      String(latest.operation_class ?? "")
+    ) ? latest.operation_class : "other",
+    last_denial_at: new Date(latestMs).toISOString(),
+    explanation: "The host recently blocked a Remembrance operation before transport; no content was sent."
   };
 }
 function localPluginLifecycleHealth(options) {
@@ -9752,7 +10595,7 @@ function localPluginLifecycleHealth(options) {
       const parsed = JSON.parse(
         fileSystem.read(path, MAX_LOCAL_LIFECYCLE_MARKER_BYTES)
       );
-      if (!isRecord2(parsed) || parsed.surface !== surface) {
+      if (!isRecord3(parsed) || parsed.surface !== surface) {
         continue;
       }
       const candidateMs = typeof parsed.last_seen_at === "string" ? Date.parse(parsed.last_seen_at) : Number.NEGATIVE_INFINITY;
@@ -9774,7 +10617,7 @@ function localPluginLifecycleHealth(options) {
       ]
     };
   }
-  const componentRecord = isRecord2(marker.components) ? marker.components : {};
+  const componentRecord = isRecord3(marker.components) ? marker.components : {};
   const nowMs = (options.now ?? /* @__PURE__ */ new Date()).getTime();
   const sessionStartMs = validLifecycleTimestamp(
     componentRecord.session_start,
@@ -9927,12 +10770,14 @@ function lifecycleMarkerPaths(surface, healthDir, fileSystem) {
   return [...new Set(sessionPaths)].slice(0, MAX_LOCAL_LIFECYCLE_MARKERS);
 }
 function normalizeConfig(value) {
-  if (!isRecord2(value)) return {};
+  if (!isRecord3(value)) return {};
   const apiKey = typeof value.apiKey === "string" ? value.apiKey.trim() : "";
   const apiUrl = typeof value.apiUrl === "string" ? value.apiUrl.trim() : "";
+  const memberLinkToken = typeof value.memberLinkToken === "string" ? value.memberLinkToken.trim() : "";
   return {
     ...apiKey ? { apiKey } : {},
-    ...apiUrl ? { apiUrl } : {}
+    ...apiUrl ? { apiUrl } : {},
+    ...memberLinkToken && /^mlink_[A-Za-z0-9_-]{24,160}$/.test(memberLinkToken) ? { memberLinkToken } : {}
   };
 }
 function normalizeApiUrl(value, env) {
@@ -10018,22 +10863,93 @@ function validLifecycleTimestamp(value, nowMs) {
   }
   return parsed;
 }
-function isRecord2(value) {
+function isRecord3(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
 
+// src/client-update.ts
+var MAX_MANIFEST_BYTES = 16 * 1024;
+var DEFAULT_TIMEOUT_MS = 1200;
+var CACHE_TTL_MS = 5 * 60 * 1e3;
+var cache = /* @__PURE__ */ new Map();
+async function checkClientUpdate(input) {
+  const env = input.env ?? process.env;
+  if (/^(0|false|no)$/i.test(env.REMEMBRANCE_CLIENT_UPDATE_CHECK ?? "")) {
+    return null;
+  }
+  if (!parseStableClientVersion(input.currentVersion)) return null;
+  const now = input.now ?? Date.now();
+  const url = `${input.apiBase.replace(/\/+$/, "")}/.well-known/remembrance-client-release.json`;
+  const cached = cache.get(url);
+  let manifest;
+  if (cached && cached.expiresAt > now) {
+    manifest = cached.value;
+  } else {
+    const controller = new AbortController();
+    const timer = setTimeout(
+      () => controller.abort(),
+      input.timeoutMs ?? DEFAULT_TIMEOUT_MS
+    );
+    try {
+      const response = await (input.fetchImpl ?? fetch)(url, {
+        headers: { accept: "application/json" },
+        signal: controller.signal
+      });
+      if (!response.ok) return null;
+      const text = await response.text();
+      if (Buffer.byteLength(text, "utf8") > MAX_MANIFEST_BYTES) return null;
+      try {
+        manifest = JSON.parse(text);
+      } catch {
+        return null;
+      }
+      cache.set(url, { value: manifest, expiresAt: now + CACHE_TTL_MS });
+    } catch {
+      return null;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  const status = resolveClientUpdateStatus({
+    currentVersion: input.currentVersion,
+    manifest,
+    surface: input.surface
+  });
+  return status.status === "unavailable" ? null : status;
+}
+
 // src/server.ts
-var apiConfiguration = resolveApiConfiguration();
-var apiBase = apiConfiguration.baseUrl;
 var MAX_REMOTE_RESPONSE_BYTES = 4 * 1024 * 1024;
 var DOCTOR_PROBE_TIMEOUT_MS = 7500;
-var SERVER_VERSION = true ? "0.1.53" : "0.0.0-dev";
+var SERVER_VERSION = true ? "0.1.60" : "0.0.0-dev";
 var tools = toolDefinitions;
 var doctorCliRequested = process.argv[2] === "doctor";
 var inputBuffer = Buffer.alloc(0);
 var clientFraming = "ndjson";
-var cachedEconomicsSession = null;
+var cachedPrincipalSession = null;
+var connectedClientInfo = null;
 var cachedValueProofKeys = null;
+var PRINCIPAL_SESSION_REQUIRED_TOOLS = /* @__PURE__ */ new Set([
+  "record_preference",
+  "link_current_installation"
+]);
+var PRINCIPAL_SESSION_AWAITED_TOOLS = /* @__PURE__ */ new Set([
+  ...PRINCIPAL_SESSION_REQUIRED_TOOLS,
+  "report_task_outcome"
+]);
+function apiAccessKey(access) {
+  return createHash3("sha256").update(
+    [
+      access.configuration.baseUrl,
+      access.credential.source,
+      access.credential.apiKey
+    ].join("\0"),
+    "utf8"
+  ).digest("hex");
+}
+function resetPrincipalSessionCacheForTests() {
+  cachedPrincipalSession = null;
+}
 if (!doctorCliRequested) {
   process.stdin.on("data", (chunk) => {
     inputBuffer = Buffer.concat([inputBuffer, chunk]);
@@ -10123,6 +11039,10 @@ async function handleRequest(request) {
 }
 async function dispatchJsonRpcRequest(request) {
   if (request.method === "initialize") {
+    connectedClientInfo = normalizedMcpClientInfo(request.params?.clientInfo);
+    const access = resolveApiAccess();
+    void ensurePrincipalSessionToken(access).catch(() => null);
+    const clientUpdate = await currentClientUpdate(access);
     return {
       id: request.id,
       result: {
@@ -10132,7 +11052,9 @@ async function dispatchJsonRpcRequest(request) {
           name: "@remembrance-ai/mcp-server",
           version: SERVER_VERSION
         },
-        instructions: REMEMBRANCE_MCP_SERVER_INSTRUCTIONS
+        instructions: clientUpdate?.status === "update_available" ? `${REMEMBRANCE_MCP_SERVER_INSTRUCTIONS}
+
+${clientUpdate.notice}` : REMEMBRANCE_MCP_SERVER_INSTRUCTIONS
       }
     };
   }
@@ -10237,47 +11159,54 @@ function messageLooksLikeZodError(message) {
 }
 async function callTool(definition, rawArguments) {
   const payload = definition.schema.parse(rawArguments ?? {});
+  const access = resolveApiAccess();
   if (definition.local === "bootstrap_agent_identity") {
-    return bootstrapAgentIdentity(payload);
+    return bootstrapAgentIdentity(payload, access);
   }
   if (definition.local === "queue_private_skill_import") {
-    return queuePrivateSkillHandoff(payload, { uploadBaseUrl: apiBase });
+    return queuePrivateSkillHandoff(payload, {
+      uploadBaseUrl: access.configuration.baseUrl
+    });
   }
   if (definition.name === "run_connection_doctor") {
-    return runLocalConnectionDoctor(payload);
+    return runLocalConnectionDoctor(
+      payload,
+      "mcp_tool",
+      access
+    );
   }
   if (definition.name === "submit_feedback") {
-    return submitFeedback(payload);
+    return submitFeedback(payload, access);
   }
   if (definition.name === "submit_remembrance") {
-    return submitRemembrance(payload);
+    return submitRemembrance(payload, access);
   }
   const localConfigurationError = remoteConfigurationError(
-    apiConfiguration.source,
-    resolveApiCredential().source,
-    apiConfiguration.issue
+    access.configuration.source,
+    access.credential.source,
+    access.configuration.issue
   );
-  const result = definition.name === "get_connection_status" && localConfigurationError ? { ok: false, status: 0, error: localConfigurationError } : await callRemembrance(definition, payload);
+  const result = definition.name === "get_connection_status" && localConfigurationError ? { ok: false, status: 0, error: localConfigurationError } : await callRemembrance(definition, payload, { access });
   if (definition.name === "get_connection_status") {
     const status = localConnectionStatus(result, {
-      apiBase,
-      apiUrlSource: apiConfiguration.source,
+      apiBase: access.configuration.baseUrl,
+      apiUrlSource: access.configuration.source,
       pluginVersion: SERVER_VERSION
     });
     if (!localConfigurationError) {
-      void reportDegradedClientHealth(status).catch(() => void 0);
+      void reportDegradedClientHealth(status, access).catch(() => void 0);
     }
     return status;
   }
   return result;
 }
 function remoteConfigurationError(apiUrlSource, credentialSource, apiUrlIssue) {
-  if (credentialSource === "unusable_destination_binding") {
-    return "The Remembrance API key is not bound to the configured registry destination. For a custom registry, store apiKey and apiUrl together in the shared config, or set REMEMBRANCE_API_KEY_ORIGIN to the exact REMEMBRANCE_API_URL value. Remote tools remain paused so the key cannot be forwarded elsewhere.";
-  }
   if (apiUrlSource === "unusable_environment") {
     return apiConfigurationErrorMessage(apiUrlIssue, "REMEMBRANCE_API_URL");
   }
+  if (credentialSource === "unusable_destination_binding") {
+    return "The Remembrance API key is not bound to the configured registry destination. For a custom registry, store apiKey and apiUrl together in the shared config, or set REMEMBRANCE_API_KEY_ORIGIN to the exact REMEMBRANCE_API_URL value. Remote tools remain paused so the key cannot be forwarded elsewhere.";
+  }
   if (apiUrlSource === "unusable_shared_config" || credentialSource === "unusable_shared_config") {
     return "The shared Remembrance config exists but is unreadable or invalid. Fix or intentionally remove ~/.config/remembrance/config.json before using remote Remembrance tools.";
   }
@@ -10293,7 +11222,7 @@ function apiConfigurationErrorMessage(issue, setting) {
   return `${setting} is invalid. Set it to an absolute HTTP(S) registry URL without credentials, query parameters, or fragments, or intentionally remove it before using remote Remembrance tools.`;
 }
 function clientHealthReportFromConnectionStatus(status) {
-  const health = isRecord3(status.plugin_health) ? status.plugin_health : null;
+  const health = isRecord4(status.plugin_health) ? status.plugin_health : null;
   if (!health || health.expected !== true || health.status !== "degraded") {
     return null;
   }
@@ -10303,9 +11232,9 @@ function clientHealthReportFromConnectionStatus(status) {
   }
   const host = agentHostBySurface(surface);
   if (!host || !host.plugin) return null;
-  const components = isRecord3(health.components) ? health.components : {};
-  const observed = (name) => isRecord3(components[name]) && components[name]?.observed === true ? "active" : "not_observed";
-  const issueCodes2 = Array.isArray(health.issues) ? health.issues.map((issue) => isRecord3(issue) ? issue.code : null).filter((code) => typeof code === "string") : [];
+  const components = isRecord4(health.components) ? health.components : {};
+  const observed = (name) => isRecord4(components[name]) && components[name]?.observed === true ? "active" : "not_observed";
+  const issueCodes2 = Array.isArray(health.issues) ? health.issues.map((issue) => isRecord4(issue) ? issue.code : null).filter((code) => typeof code === "string") : [];
   const allowedIssueCodes = /* @__PURE__ */ new Set([
     "native_hooks_not_observed",
     "session_start_not_observed",
@@ -10357,7 +11286,7 @@ function isSafePluginVersion(value) {
 function isSafeHostVersion(value) {
   return value === null || typeof value === "string" && value.length <= 64 && /^[0-9A-Za-z._+ -]*$/.test(value.trim());
 }
-async function reportDegradedClientHealth(status) {
+async function reportDegradedClientHealth(status, access = resolveApiAccess()) {
   if (/^(0|false|no)$/i.test(process.env.REMEMBRANCE_HEALTH_REPORTING ?? "")) {
     return;
   }
@@ -10366,25 +11295,30 @@ async function reportDegradedClientHealth(status) {
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), 1500);
   try {
-    const apiKey = resolveApiKey();
-    await fetch(`${apiBase}/api/v1/agent/client-health-reports`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        ...apiKey ? { "X-Remembrance-API-Key": apiKey } : {},
-        "User-Agent": `@remembrance-ai/mcp-server/${SERVER_VERSION}`
-      },
-      body: JSON.stringify(report),
-      signal: controller.signal
-    });
+    const apiKey = access.credential.apiKey;
+    await fetch(
+      `${access.configuration.baseUrl}/api/v1/agent/client-health-reports`,
+      {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          ...apiKey ? { "X-Remembrance-API-Key": apiKey } : {},
+          "User-Agent": `@remembrance-ai/mcp-server/${SERVER_VERSION}`
+        },
+        body: JSON.stringify(report),
+        signal: controller.signal
+      }
+    );
   } finally {
     clearTimeout(timeout);
   }
 }
-async function submitRemembrance(payload) {
+async function submitRemembrance(payload, access) {
   const { verified_attestation: verifiedAttestation, ...request } = payload;
   if (!verifiedAttestation) {
-    return callRemembrance(mustFindTool("submit_remembrance"), request);
+    return callRemembrance(mustFindTool("submit_remembrance"), request, {
+      access
+    });
   }
   const skillSlug = request.skill?.slug;
   if (!skillSlug) {
@@ -10400,20 +11334,27 @@ async function submitRemembrance(payload) {
   };
   const attestation = await signedRemembranceAttestation(
     remembrancePayload,
-    skillSlug
+    skillSlug,
+    access
+  );
+  return callRemembrance(
+    mustFindTool("submit_remembrance"),
+    {
+      ...remembrancePayload,
+      evidence: {
+        ...evidence,
+        attestation
+      }
+    },
+    { access }
   );
-  return callRemembrance(mustFindTool("submit_remembrance"), {
-    ...remembrancePayload,
-    evidence: {
-      ...evidence,
-      attestation
-    }
-  });
 }
-async function submitFeedback(payload) {
+async function submitFeedback(payload, access) {
   const { verified_attestation: verifiedAttestation, ...request } = payload;
   if (!verifiedAttestation) {
-    return callRemembrance(mustFindTool("submit_feedback"), request);
+    return callRemembrance(mustFindTool("submit_feedback"), request, {
+      access
+    });
   }
   const identity = await ensureSigningIdentity();
   const agent = request.agent ?? {
@@ -10448,18 +11389,23 @@ async function submitFeedback(payload) {
   };
   const attestation = await signedRemembranceAttestation(
     remembrancePayload,
-    request.skill_slug
+    request.skill_slug,
+    access
+  );
+  return callRemembrance(
+    mustFindTool("submit_feedback"),
+    {
+      ...request,
+      agent,
+      evidence: {
+        ...evidence,
+        attestation
+      }
+    },
+    { access }
   );
-  return callRemembrance(mustFindTool("submit_feedback"), {
-    ...request,
-    agent,
-    evidence: {
-      ...evidence,
-      attestation
-    }
-  });
 }
-async function signedRemembranceAttestation(remembrancePayload, skillSlug) {
+async function signedRemembranceAttestation(remembrancePayload, skillSlug, access) {
   const identity = await ensureSigningIdentity();
   const evidenceHash = attestationEvidenceHashForRemembrance(remembrancePayload);
   const challenge = await callRemembrance(
@@ -10471,7 +11417,8 @@ async function signedRemembranceAttestation(remembrancePayload, skillSlug) {
       subject: identity.subject,
       skill_slug: skillSlug,
       evidence_hash: evidenceHash
-    }
+    },
+    { access }
   );
   if (challenge.ok === false) {
     throw new Error("Unable to create Remembrance attestation challenge.");
@@ -10498,7 +11445,7 @@ async function signedRemembranceAttestation(remembrancePayload, skillSlug) {
     signature
   };
 }
-async function bootstrapAgentIdentity(args) {
+async function bootstrapAgentIdentity(args, access = resolveApiAccess()) {
   const keyPath = identityPath(args.key_path);
   let reusedExistingIdentity = !args.force_rotate && existsSync3(keyPath);
   let identity = reusedExistingIdentity ? await readIdentity(keyPath) : null;
@@ -10521,10 +11468,14 @@ async function bootstrapAgentIdentity(args) {
       mismatchedFields.push("key_id");
     }
   }
+  const ownerBinding = await agentRegistrationOwnerBinding(access).catch(
+    () => null
+  );
   const signedAt = (/* @__PURE__ */ new Date()).toISOString();
   const proofPayload = buildAgentKeyRegistrationSigningPayload({
     provider: identity.provider,
     keyId: identity.key_id,
+    ownerBinding,
     publicKey: identity.public_key,
     subject: identity.subject,
     signedAt
@@ -10543,13 +11494,15 @@ async function bootstrapAgentIdentity(args) {
       subject: identity.subject,
       proof: {
         algorithm: "ed25519",
+        ...ownerBinding ? { owner_binding: ownerBinding } : {},
         signed_at: signedAt,
         signature: proofSignature
       },
       metadata: {
         registered_by: "@remembrance-ai/mcp-server"
       }
-    }
+    },
+    { access }
   );
   if (registration.ok !== true) {
     throw new McpPublicError(
@@ -10567,6 +11520,33 @@ async function bootstrapAgentIdentity(args) {
     registration
   };
 }
+async function agentRegistrationOwnerBinding(access) {
+  const credential = access.credential;
+  const configurationError = remoteConfigurationError(
+    access.configuration.source,
+    credential.source,
+    access.configuration.issue
+  );
+  if (configurationError) throw new McpPublicError(configurationError);
+  const headers = {
+    accept: "application/json",
+    "user-agent": `@remembrance-ai/mcp-server/${SERVER_VERSION}`
+  };
+  if (credential.apiKey) {
+    headers["x-remembrance-api-key"] = credential.apiKey;
+  }
+  const response = await fetch(
+    `${access.configuration.baseUrl}/api/v1/agent/keys/register`,
+    {
+      method: "GET",
+      headers
+    }
+  );
+  if (!response.ok) return null;
+  const payload = await response.json();
+  const candidate = String(payload.owner_binding ?? "").trim();
+  return /^areg_[A-Za-z0-9_-]{24,120}$/.test(candidate) ? candidate : null;
+}
 async function createAndPersistIdentity(args, keyPath) {
   const { privateKey, publicKey } = generateKeyPairSync("ed25519");
   const publicKeyPem = String(
@@ -10624,43 +11604,56 @@ async function readIdentity(path = identityPath()) {
 }
 var automaticIdentityBootstrap = null;
 async function ensureSigningIdentity() {
-  if (automaticIdentityBootstrap) return automaticIdentityBootstrap;
-  const existing = await readIdentity();
-  if (automaticIdentityBootstrap) return automaticIdentityBootstrap;
+  const keyPath = identityPath();
+  if (automaticIdentityBootstrap?.keyPath === keyPath) {
+    return automaticIdentityBootstrap.promise;
+  }
+  const existing = await readIdentity(keyPath);
+  if (automaticIdentityBootstrap?.keyPath === keyPath) {
+    return automaticIdentityBootstrap.promise;
+  }
   if (existing) return existing;
-  if (!automaticIdentityBootstrap) {
-    automaticIdentityBootstrap = (async () => {
-      await bootstrapAgentIdentity({});
-      const created = await readIdentity();
-      if (!created) {
-        throw new McpPublicError(
-          "Remembrance could not initialize the local signing identity. Run bootstrap_agent_identity and retry."
-        );
-      }
-      return created;
-    })().finally(() => {
+  const promise = (async () => {
+    await bootstrapAgentIdentity({ key_path: keyPath });
+    const created = await readIdentity(keyPath);
+    if (!created) {
+      throw new McpPublicError(
+        "Remembrance could not initialize the local signing identity. Run bootstrap_agent_identity and retry."
+      );
+    }
+    return created;
+  })();
+  automaticIdentityBootstrap = { keyPath, promise };
+  const clearBootstrap = () => {
+    if (automaticIdentityBootstrap?.promise === promise) {
       automaticIdentityBootstrap = null;
-    });
-  }
-  return automaticIdentityBootstrap;
+    }
+  };
+  void promise.then(clearBootstrap, clearBootstrap);
+  return promise;
 }
 async function callRemembrance(definition, rawArguments, options = {}) {
+  const access = options.access ?? resolveApiAccess();
   const parsed = definition.schema.parse(rawArguments ?? {});
+  const projectKey = definition.name === "query_skills" || definition.name === "invoke_skill" ? await localProjectKey().catch(() => null) : null;
+  const callerClientContext = parsed.client_context ?? {};
   const payload = definition.name === "query_skills" || definition.name === "invoke_skill" ? {
     ...parsed,
     client_context: {
-      ...parsed.client_context ?? {},
-      surface: "mcp"
+      ...callerClientContext,
+      surface: "mcp",
+      ...callerClientContext.project_key || !projectKey ? {} : { project_key: projectKey }
     }
   } : parsed;
   const headers = {
-    "content-type": "application/json"
+    "content-type": "application/json",
+    "user-agent": `@remembrance-ai/mcp-server/${SERVER_VERSION}`
   };
-  const credential = resolveApiCredential();
+  const credential = access.credential;
   const configurationError = remoteConfigurationError(
-    apiConfiguration.source,
+    access.configuration.source,
     credential.source,
-    apiConfiguration.issue
+    access.configuration.issue
   );
   if (configurationError && definition.name !== "get_connection_status") {
     throw new McpPublicError(configurationError);
@@ -10670,11 +11663,21 @@ async function callRemembrance(definition, rawArguments, options = {}) {
     headers["x-remembrance-api-key"] = apiKey;
   }
   if (!options.skipEconomicsSession && definition.name !== "register_agent_key" && definition.name !== "request_attestation_challenge" && definition.name !== "get_connection_status") {
-    const economicsSession = await ensureEconomicsSessionToken().catch(
-      () => null
-    );
-    if (economicsSession) {
-      headers["x-remembrance-economics-session"] = economicsSession;
+    let principalSession = currentPrincipalSessionToken(access);
+    if (!principalSession && PRINCIPAL_SESSION_AWAITED_TOOLS.has(definition.name)) {
+      principalSession = await ensurePrincipalSessionToken(access).catch(
+        () => null
+      );
+    }
+    if (!principalSession && PRINCIPAL_SESSION_REQUIRED_TOOLS.has(definition.name)) {
+      throw new McpPublicError(
+        "This operation requires a verified local installation session. Check the organization key and local TOFU identity, then retry."
+      );
+    }
+    if (principalSession) {
+      headers["x-remembrance-principal-session"] = principalSession;
+    } else if (definition.name === "query_skills" || definition.name === "invoke_skill") {
+      void ensurePrincipalSessionToken(access).catch(() => null);
     }
   }
   const endpoint = endpointFor(definition, payload);
@@ -10686,25 +11689,48 @@ async function callRemembrance(definition, rawArguments, options = {}) {
   let response;
   let body;
   try {
-    response = await fetch(`${apiBase}${endpoint}`, {
-      method: definition.method ?? "POST",
-      headers,
-      body: definition.method === "GET" ? void 0 : JSON.stringify(payload),
-      signal: controller.signal
-    });
-    try {
-      body = await readBoundedResponseJson(response);
-    } catch {
-      if (controller.signal.aborted) {
-        return {
-          ok: false,
-          status: 0,
-          error: "Remembrance API request timed out."
+    const execute = async () => {
+      const nextResponse = await fetch(
+        `${access.configuration.baseUrl}${endpoint}`,
+        {
+          method: definition.method ?? "POST",
+          headers,
+          body: definition.method === "GET" ? void 0 : JSON.stringify(payload),
+          signal: controller.signal
+        }
+      );
+      let nextBody;
+      try {
+        nextBody = await readBoundedResponseJson(nextResponse);
+      } catch {
+        if (controller.signal.aborted) {
+          throw new DOMException("Request timed out", "AbortError");
+        }
+        nextBody = {
+          error: nextResponse.ok ? "Remembrance API returned an unreadable or oversized response." : "Remembrance API request failed."
         };
       }
-      body = {
-        error: response.ok ? "Remembrance API returned an unreadable or oversized response." : "Remembrance API request failed."
-      };
+      return { response: nextResponse, body: nextBody };
+    };
+    ({ response, body } = await execute());
+    const sentPrincipalSession = headers["x-remembrance-principal-session"] ?? null;
+    const refreshSignaled = response.headers.get("x-remembrance-principal-session-status") === "refresh_required";
+    const authenticationFailed = principalSessionAuthenticationFailed(
+      response,
+      body
+    );
+    if (sentPrincipalSession && refreshSignaled && !authenticationFailed) {
+      cachedPrincipalSession = null;
+      void ensurePrincipalSessionToken(access).catch(() => null);
+    } else if (sentPrincipalSession && authenticationFailed) {
+      cachedPrincipalSession = null;
+      const refreshed = await ensurePrincipalSessionToken(access).catch(
+        () => null
+      );
+      if (refreshed && refreshed !== sentPrincipalSession) {
+        headers["x-remembrance-principal-session"] = refreshed;
+        ({ response, body } = await execute());
+      }
     }
   } catch (error) {
     return {
@@ -10715,7 +11741,10 @@ async function callRemembrance(definition, rawArguments, options = {}) {
   } finally {
     clearTimeout(timeout);
   }
-  const verifiedBody = definition.name === "get_value_proof" && response.ok ? await verifySignedValueProofWithKeyRefresh(body, fetchValueProofKeySet) : body;
+  const verifiedBody = definition.name === "get_value_proof" && response.ok ? await verifySignedValueProofWithKeyRefresh(
+    body,
+    (forceRefresh) => fetchValueProofKeySet(forceRefresh, access)
+  ) : body;
   return {
     ok: response.ok,
     status: response.status,
@@ -10725,26 +11754,52 @@ async function callRemembrance(definition, rawArguments, options = {}) {
     body: verifiedBody
   };
 }
-async function runLocalConnectionDoctor(options, execution = "mcp_tool") {
+var cachedLocalProjectKey;
+async function localProjectKey() {
+  const configured = process.env.REMEMBRANCE_PROJECT_KEY?.trim() ?? "";
+  if (/^prj_[A-Za-z0-9_-]{12,120}$/.test(configured)) return configured;
+  const projectPath = (process.env.REMEMBRANCE_PROJECT_PATH ?? process.env.PWD ?? process.cwd()).trim();
+  if (!projectPath) return null;
+  const identity = await ensureSigningIdentity();
+  if (cachedLocalProjectKey?.identityKeyId === identity.key_id && cachedLocalProjectKey.projectPath === projectPath) {
+    return cachedLocalProjectKey.value;
+  }
+  const value = `prj_${createHmac("sha256", identity.private_key).update(`remembrance-project-v1:${projectPath}`, "utf8").digest("base64url").slice(0, 32)}`;
+  cachedLocalProjectKey = {
+    identityKeyId: identity.key_id,
+    projectPath,
+    value
+  };
+  return value;
+}
+function principalSessionAuthenticationFailed(response, body) {
+  if (response.status !== 401 && response.status !== 403) return false;
+  if (!isRecord4(body) || typeof body.error !== "string") return false;
+  return /principal session|economics session|installation session/i.test(
+    body.error
+  );
+}
+async function runLocalConnectionDoctor(options, execution = "mcp_tool", access = resolveApiAccess()) {
   const connectionDefinition = mustFindTool("get_connection_status");
   const localConfigurationError = remoteConfigurationError(
-    apiConfiguration.source,
-    resolveApiCredential().source,
-    apiConfiguration.issue
+    access.configuration.source,
+    access.credential.source,
+    access.configuration.issue
   );
   const connectionPromise = localConfigurationError ? Promise.resolve({
     ok: false,
     status: 0,
     error: localConfigurationError
-  }) : callDoctorReadProbe(connectionDefinition, {});
-  const catalogPromise = options.active_read_probe && !localConfigurationError ? callDoctorReadProbe(mustFindTool("list_skills"), { limit: 1 }) : Promise.resolve(null);
-  const [connectionResult, catalogResult] = await Promise.all([
+  }) : callDoctorReadProbe(connectionDefinition, {}, access);
+  const catalogPromise = options.active_read_probe && !localConfigurationError ? callDoctorReadProbe(mustFindTool("list_skills"), { limit: 1 }, access) : Promise.resolve(null);
+  const [connectionResult, catalogResult, clientUpdate] = await Promise.all([
     connectionPromise,
-    catalogPromise
+    catalogPromise,
+    currentClientUpdate(access)
   ]);
   const connectionStatus = localConnectionStatus(connectionResult, {
-    apiBase,
-    apiUrlSource: apiConfiguration.source,
+    apiBase: access.configuration.baseUrl,
+    apiUrlSource: access.configuration.source,
     pluginVersion: SERVER_VERSION
   });
   const activeReadProbe = {
@@ -10753,8 +11808,8 @@ async function runLocalConnectionDoctor(options, execution = "mcp_tool") {
     item_count: null
   };
   if (options.active_read_probe && !localConfigurationError) {
-    const resultRecord = isRecord3(catalogResult) ? catalogResult : {};
-    const body = isRecord3(resultRecord.body) ? resultRecord.body : {};
+    const resultRecord = isRecord4(catalogResult) ? catalogResult : {};
+    const body = isRecord4(resultRecord.body) ? resultRecord.body : {};
     const skills = Array.isArray(body.skills) ? body.skills : null;
     activeReadProbe.succeeded = resultRecord.ok === true && skills !== null;
     activeReadProbe.item_count = skills ? skills.length : null;
@@ -10766,32 +11821,50 @@ async function runLocalConnectionDoctor(options, execution = "mcp_tool") {
     transport: execution === "standalone_cli" ? "standalone_cli" : "local_stdio_mcp",
     host_registration_observed: execution === "mcp_tool",
     active_read_probe: activeReadProbe,
-    check_organization_write_authorization: options.check_organization_write_authorization
+    check_organization_write_authorization: options.check_organization_write_authorization,
+    client_update: clientUpdate
   });
 }
-async function callDoctorReadProbe(definition, payload) {
+async function currentClientUpdate(access = resolveApiAccess()) {
+  const configuredSurface = process.env.REMEMBRANCE_PLUGIN_HOST?.trim().toLowerCase();
+  const surface = configuredSurface && isPluginHostSurface(configuredSurface) ? configuredSurface : "mcp";
+  return checkClientUpdate({
+    apiBase: access.configuration.baseUrl,
+    currentVersion: SERVER_VERSION,
+    surface
+  });
+}
+async function callDoctorReadProbe(definition, payload, access) {
   const first = await callRemembrance(definition, payload, {
     skipEconomicsSession: true,
-    timeoutMs: DOCTOR_PROBE_TIMEOUT_MS
+    timeoutMs: DOCTOR_PROBE_TIMEOUT_MS,
+    access
   });
   return isTransientDoctorProbeFailure(first) ? callRemembrance(definition, payload, {
     skipEconomicsSession: true,
-    timeoutMs: DOCTOR_PROBE_TIMEOUT_MS
+    timeoutMs: DOCTOR_PROBE_TIMEOUT_MS,
+    access
   }) : first;
 }
 function isTransientDoctorProbeFailure(result) {
-  if (!isRecord3(result) || result.ok === true) return false;
+  if (!isRecord4(result) || result.ok === true) return false;
   const status = typeof result.status === "number" ? result.status : 0;
   return status === 0 || status === 408 || status === 425 || status >= 500;
 }
 function formatConnectionDoctorReport(report) {
+  const clientUpdate = report.client_update ?? {
+    status: "unavailable",
+    latest_version: null
+  };
   const lines = [
     `Remembrance connection doctor: ${report.status.toUpperCase()}`,
     `Transport: ${report.transport}`,
     `Scope: ${report.scope}`,
     `Destination: ${report.destination.kind}`,
     `Query ready: ${report.safe_to_query ? "yes" : "no"}`,
-    `Organization submissions: ${report.organization_write_authorized ? "authorized" : "not authorized"}`,
+    `Registry submissions: ${report.registry_submission_authorized ? "authorized" : "not authorized"}`,
+    `Host policy observation: ${report.host_policy?.status ?? "not_observable"}`,
+    `Client update: ${clientUpdate.status}${clientUpdate.latest_version ? ` (published ${clientUpdate.latest_version})` : ""}`,
     `Signed contributions: ${report.signed_contributions_ready === null ? "not observable" : report.signed_contributions_ready ? "ready" : "not ready"}`,
     ""
   ];
@@ -10834,16 +11907,16 @@ async function runConnectionDoctorCli(args = process.argv.slice(3)) {
   );
   return report.status === "blocked" ? 1 : 0;
 }
-async function fetchValueProofKeySet(forceRefresh) {
+async function fetchValueProofKeySet(forceRefresh, access = resolveApiAccess()) {
   const now = Date.now();
-  if (!forceRefresh && cachedValueProofKeys && cachedValueProofKeys.expiresAt > now) {
+  if (!forceRefresh && cachedValueProofKeys && cachedValueProofKeys.apiBase === access.configuration.baseUrl && cachedValueProofKeys.expiresAt > now) {
     return cachedValueProofKeys.value;
   }
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), apiTimeoutMs());
   try {
     const response = await fetch(
-      `${apiBase}/.well-known/remembrance-value-proof-keys.json`,
+      `${access.configuration.baseUrl}/.well-known/remembrance-value-proof-keys.json`,
       {
         headers: { accept: "application/json" },
         signal: controller.signal
@@ -10857,7 +11930,8 @@ async function fetchValueProofKeySet(forceRefresh) {
     const value = await readBoundedResponseJson(response);
     cachedValueProofKeys = {
       value,
-      expiresAt: now + valueProofKeyCacheTtlMs(response.headers)
+      expiresAt: now + valueProofKeyCacheTtlMs(response.headers),
+      apiBase: access.configuration.baseUrl
     };
     return value;
   } finally {
@@ -10975,18 +12049,38 @@ async function fetchSkillCatalog(input) {
   }
   return skillCatalogResponseSchema.parse(response.body);
 }
-async function ensureEconomicsSessionToken() {
-  const identity = await readIdentity();
-  if (!identity) return null;
+async function ensurePrincipalSessionToken(access = resolveApiAccess()) {
+  if (isUnusableCredentialSource(access.configuration.source) || isUnusableCredentialSource(access.credential.source)) {
+    return null;
+  }
+  const identity = await ensureSigningIdentity();
   const identityKey = `${identity.provider}:${identity.key_id}`;
-  if (cachedEconomicsSession && cachedEconomicsSession.identityKey === identityKey && cachedEconomicsSession.expiresAt > Date.now() + 6e4) {
-    return cachedEconomicsSession.token;
+  const accessKey = apiAccessKey(access);
+  if (cachedPrincipalSession && cachedPrincipalSession.identityKey === identityKey && cachedPrincipalSession.accessKey === accessKey && cachedPrincipalSession.expiresAt > Date.now() + 6e4) {
+    return cachedPrincipalSession.token;
   }
-  const challengeResponse = await directEconomicsSessionRequest({
+  const memberLinkToken = access.memberLinkToken;
+  const challengePayload = {
     action: "challenge",
     provider: identity.provider,
-    key_id: identity.key_id
-  });
+    key_id: identity.key_id,
+    runtime_profile: localRuntimeProfile(identity),
+    ...memberLinkToken ? { member_link_token: memberLinkToken } : {}
+  };
+  let challengeResponse = await directPrincipalSessionRequest(
+    challengePayload,
+    access
+  );
+  if (!challengeResponse) {
+    await bootstrapAgentIdentity({}, access).catch(() => null);
+    challengeResponse = await directPrincipalSessionRequest(
+      {
+        ...challengePayload,
+        member_link_token: void 0
+      },
+      access
+    );
+  }
   const challenge = challengeResponse;
   if (!challenge.challenge_id || !challenge.signing_payload) return null;
   const signature = signPayload(
@@ -10994,38 +12088,100 @@ async function ensureEconomicsSessionToken() {
     Buffer.from(challenge.signing_payload),
     createPrivateKey2(identity.private_key)
   ).toString("base64url");
-  const exchangeResponse = await directEconomicsSessionRequest({
-    action: "exchange",
-    provider: identity.provider,
-    key_id: identity.key_id,
-    challenge_id: challenge.challenge_id,
-    signature
-  });
+  const exchangeResponse = await directPrincipalSessionRequest(
+    {
+      action: "exchange",
+      provider: identity.provider,
+      key_id: identity.key_id,
+      challenge_id: challenge.challenge_id,
+      signature
+    },
+    access
+  );
   const exchange = exchangeResponse;
   if (!exchange.session_token || !exchange.expires_at) return null;
-  cachedEconomicsSession = {
+  cachedPrincipalSession = {
     token: exchange.session_token,
     expiresAt: new Date(exchange.expires_at).getTime(),
-    identityKey
+    identityKey,
+    accessKey
   };
-  return cachedEconomicsSession.token;
+  return cachedPrincipalSession.token;
+}
+function currentPrincipalSessionToken(access) {
+  if (!cachedPrincipalSession) return null;
+  if (cachedPrincipalSession.accessKey !== apiAccessKey(access) || cachedPrincipalSession.expiresAt <= Date.now() + 6e4) {
+    cachedPrincipalSession = null;
+    return null;
+  }
+  return cachedPrincipalSession.token;
 }
-async function directEconomicsSessionRequest(payload) {
+async function directPrincipalSessionRequest(payload, access) {
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), apiTimeoutMs());
   try {
-    const response = await fetch(`${apiBase}/api/v1/agent/economics/session`, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify(payload),
-      signal: controller.signal
-    });
+    const response = await fetch(
+      `${access.configuration.baseUrl}/api/v1/agent/principal-sessions`,
+      {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(payload),
+        signal: controller.signal
+      }
+    );
     if (!response.ok) return null;
     return response.json();
   } finally {
     clearTimeout(timeout);
   }
 }
+function normalizedMcpClientInfo(value) {
+  if (!isRecord4(value)) return null;
+  const name = boundedLocalProfileField(value.name);
+  if (!name) return null;
+  return {
+    name,
+    version: boundedLocalProfileField(value.version)
+  };
+}
+function localRuntimeProfile(identity) {
+  const configuredSurface = String(process.env.REMEMBRANCE_PLUGIN_HOST ?? "").trim().toLowerCase();
+  const runtime = isPluginHostSurface(configuredSurface) ? configuredSurface : "other";
+  const clientName = connectedClientInfo?.name ?? agentHostBySurface(runtime)?.host_name ?? "MCP";
+  const hostSurface = localRuntimeHostSurface(runtime, clientName);
+  const profileDigest = createHash3("sha256").update(
+    [identity.key_id, runtime, hostSurface, clientName.toLowerCase()].join(
+      ":"
+    ),
+    "utf8"
+  ).digest("base64url");
+  return {
+    runtime,
+    surface: "mcp",
+    host_surface: hostSurface,
+    client_name: clientName,
+    client_version: SERVER_VERSION,
+    runtime_version: connectedClientInfo?.version ?? null,
+    profile_key: `rpf_${profileDigest}`
+  };
+}
+function localRuntimeHostSurface(runtime, clientName) {
+  const configured = String(process.env.REMEMBRANCE_HOST_SURFACE ?? "").trim().toLowerCase();
+  if (configured === "desktop" || configured === "cli" || configured === "extension" || configured === "gateway" || configured === "unknown") {
+    return configured;
+  }
+  if (/desktop|chatgpt|codex app/i.test(clientName)) return "desktop";
+  if (/cursor|visual studio|vscode/i.test(clientName)) return "extension";
+  if (runtime === "openclaw") return "gateway";
+  if (runtime === "cursor" || runtime === "vs_code") return "extension";
+  if (runtime === "claude_code" || runtime === "opencode") return "cli";
+  return "unknown";
+}
+function boundedLocalProfileField(value) {
+  if (typeof value !== "string") return null;
+  const normalized = value.trim().replace(/[\u0000-\u001f\u007f]/g, "");
+  return normalized ? normalized.slice(0, 512) : null;
+}
 function mustFindTool(name) {
   const tool2 = tools.find((item) => item.name === name);
   if (!tool2) {
@@ -11033,7 +12189,7 @@ function mustFindTool(name) {
   }
   return tool2;
 }
-function isRecord3(value) {
+function isRecord4(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
 function identityPath(explicit) {
@@ -11087,6 +12243,7 @@ export {
   readJsonRpcMessages,
   remoteConfigurationError,
   reportDegradedClientHealth,
+  resetPrincipalSessionCacheForTests,
   resetValueProofKeyCacheForTests,
   runConnectionDoctorCli,
   runLocalConnectionDoctor