@stravica-ai/digital-operator-pa 0.1.19 → 0.1.21

package/dist/engineering-pa-cli/docs/secrets.md

@@ -8,7 +8,7 @@ Dave uses SOPS with age encryption for secrets management. Secrets are encrypted
 
 Implemented: `init`, `get`, `set`, `list`, `delete`, `rotate`, `status`, `backup`, `vaults`, `find` (alias `which`), `verify`. No npm dependencies — shells out to `sops` and `age` via `node:child_process.spawn`.
 
-`set` additionally supports `--canonical-clone PATH` (write a canonical clone's vault file first, then the resolved workspace copy — aborts before touching the workspace copy if the canonical write fails). `verify --values --against PATH` does a byte-level comparison of DECRYPTED values between the resolved vault and a reference vault at PATH — never a decrypt-only pass. See "Value-compare verification" and "Canonical-first writes" below.
+**Canonical-first dual-write is the DEFAULT for scoped `set` since 0.1.20.** A plain `secrets set` on a scoped vault writes canonical FIRST and workspace SECOND whenever a canonical clone for the scope is discoverable on this host (via `~/.config/stravica-pa/defaults.json`'s `canonicalClone` key or the `~/stravica-canonical/*/vault/<scope>.enc.json` estate convention). Absence of a canonical clone is a stderr NOTICE, never a failure. Explicit `--canonical-clone PATH` still wins over auto-discovery (and bootstraps a missing file); `--no-canonical` opts out entirely and suppresses the notice. `verify --values --against PATH` does a byte-level comparison of DECRYPTED values between the resolved vault and a reference vault at PATH — never a decrypt-only pass. See "Value-compare verification" and "Canonical-first writes" below.
 
 `get`/`set` run without `--scope`/`--file` now resolve a **default scope** — `$SECRETS_DEFAULT_SCOPE` env var, then `"defaultScope"` in `~/.config/stravica-pa/defaults.json`, then the calling PA's own `agents/<name>/identity.json`, then the legacy single-file vault as a last resort. Every such invocation prints a one-line stderr notice naming the target vault BEFORE the operation runs, including the legacy-fallback case ("no scope specified and no default configured") — see `secrets --help` → "Default scope" for the full precedence and example notices.
 
@@ -67,11 +67,17 @@ node core/tools/secrets/bin/secrets status
 # Open a browser with a QR code of the master key for backup
 node core/tools/secrets/bin/secrets backup
 
-# Write a canonical clone's vault FIRST, then the workspace copy second.
-# Aborts (exit 2) before touching the workspace copy if the canonical
-# write fails (e.g. the existing canonical store can't be decrypted).
+# Force a specific canonical file (wins over auto-discovery; bootstraps
+# a missing file). Aborts (exit 2) before touching the workspace copy if
+# the canonical write fails (e.g. the existing canonical store can't be
+# decrypted). Auto-discovery is on by default since 0.1.20 — this flag
+# is only for pointing at a specific target.
 node core/tools/secrets/bin/secrets set API_KEY "sk-abc123" --canonical-clone /path/to/canonical/vault/scope.enc.json
 
+# Opt out of canonical dual-write entirely (suppresses the absence
+# notice too). Mutually exclusive with --canonical-clone.
+node core/tools/secrets/bin/secrets set API_KEY "sk-abc123" --no-canonical
+
 # Byte-level comparison of DECRYPTED values against a reference vault.
 # --values is required — there is no decrypt-only verification mode
 # (decrypt-only false-passes a vault that decrypts cleanly but holds the
@@ -79,29 +85,66 @@ node core/tools/secrets/bin/secrets set API_KEY "sk-abc123" --canonical-clone /p
 node core/tools/secrets/bin/secrets verify --values --against /path/to/other/vault/scope.enc.json
 ```
 
-### Canonical-first writes (`set --canonical-clone`)
+### Canonical-first writes
+
+Canonical-first dual-write is the DEFAULT for scoped `set` since 0.1.20 —
+a plain `secrets set` on a scoped vault writes canonical FIRST and the
+workspace SECOND whenever a canonical clone for the scope is discoverable
+on this host. The abort-before-workspace ordering is identical to the
+explicit-flag path it grew out of: if the canonical write fails for any
+reason (existing canonical store undecryptable, sops encrypt failure),
+the command exits 2 and the workspace copy is never touched.
+
+**Resolution order** (first hit wins; every miss recorded in the absence
+notice's tried-tier detail):
+
+1. **Explicit `--canonical-clone PATH`** — always wins, bootstraps a
+   missing file (this is the flag's historical behaviour).
+2. **`"canonicalClone"` in `~/.config/stravica-pa/defaults.json`** — the
+   same file (already read for `workspaceRoot` and `defaultScope`); the
+   CLI never writes it. Two shapes supported:
+   - **Object (scope → file map):**
+     ```json
+     { "canonicalClone": { "seo-ops": "/Users/thefoot/stravica-canonical/stravica-operator-barry/vault/seo-ops.enc.json" } }
+     ```
+   - **String (root dir)** — derives `<root>/vault/<scope>.enc.json`,
+     which fits the estate's operator-repo layout:
+     ```json
+     { "canonicalClone": "/Users/thefoot/stravica-canonical/stravica-operator-barry" }
+     ```
+3. **Estate convention** — `~/stravica-canonical/<repo>/vault/<scope>.enc.json`
+   (glob shape `~/stravica-canonical/*/vault/…enc.json`). This reuses the
+   root the rest of the estate already uses (see
+   `library-sync-cycle`'s `--repos-root` default and
+   `dex-cutover-driver`'s `reposRoot`). Exactly one match wins; ambiguity
+   (multiple matches) or zero matches skips this tier.
+
+**Absence** is a stderr notice, never a failure — a host with no
+canonical layout keeps writing to workspace only:
+
+```
+notice: no canonical clone configured for scope 'seo-ops' on this host — workspace-only write (tried: …)
+```
+
+The `tried:` tail names every tier that missed and why, so an operator on
+a host that ought to have a canonical knows exactly where to configure it
+(or that `--no-canonical` is the intended answer for a host that never
+had one).
 
-Without the flag, `set` behaves exactly as before — it writes only the
-resolved workspace copy. With `--canonical-clone PATH`, `set`:
+**Flags:**
 
-1. Resolves `PATH` the same way `--file` resolves any other vault (its
-   own `.sops.yaml` expected alongside it), reusing this host's own key
-   material (`keyDir`/`keyFile`) — the canonical clone and the workspace
-   copy are expected to share recipients in practice (same operator,
-   same device).
-2. Decrypts the existing canonical store (if any) and writes the new key
-   into it. **If this fails for any reason — the existing canonical
-   store can't be decrypted, or the encrypt itself fails — `set` aborts
-   with exit 2 and the workspace copy is never touched.**
-3. Only on canonical success does it proceed to the existing
-   decrypt-mutate-encrypt cycle against the resolved workspace copy.
+- `--canonical-clone PATH` — force a specific canonical file (wins over
+  auto-discovery; bootstraps a missing file). Backwards-compatible with
+  every prior release.
+- `--no-canonical` — opt out of dual-write entirely, and suppress the
+  absence notice. Mutually exclusive with `--canonical-clone`.
 
 This closes the "device-side vault mutation only round-trips halfway"
-class: a device-side `secrets set` that updates the workspace copy but
-never reaches canonical leaves the two vaults silently diverged until the
-next down-path materialisation clobbers the device's fresher value.
-`--canonical-clone` makes the canonical write the FIRST, gating step —
-the workspace never ends up ahead of canonical.
+class BY DEFAULT rather than opt-in: any workspace write that a
+canonical layout could catch, it now does — no flag required.
+
+Legacy vaults (no scope) never trigger canonical resolution — the notice
+would be pure noise for a fallback that has no natural canonical mirror.
 
 ### Value-compare verification (`verify --values --against`)
 

package/dist/engineering-pa-cli/src/pa/work-cli.mjs

@@ -1,12 +1,23 @@
 // work-cli.mjs — argv router for `pa work <verb>`.
 //
 // Verbs:
-//   pa work create [--project <id>] --title "..." --category <c> [--priority N] [--summary "..."] [--owner ...] [--assignee ...]
+//   pa work create [--project <id>] --title "..." --category <c> [--priority N] [--summary "..."] [--owner ...] [--assignee ...] [--author <token>]
 //   pa work status <id> <status>
 //   pa work list   [--project <id>] [--status ...] [--mine] [--theirs] [--all] [--json]
 //
 // PA name (for --mine resolution) is read from
 // operator/config/preferences.json. Falls back to 'pa' if missing.
+//
+// The `paName` field ALSO doubles as the fallback author-token source
+// for `pa work create` (writer-scoped id allocation, R1 of the
+// 2026-08-11 library remediation train). Precedence, highest first:
+//   1. --author flag (or opts.author from a programmatic caller)
+//   2. PA_AUTHOR_TOKEN env var
+//   3. preferences.json `paName`
+// If none resolve, `pa work create` hard-errors — the whole point of
+// R1 is that a mint with no author identity is a defect, not a
+// fall-back-to-default case. Full rationale + tests in
+// `@stravica-ai/engineering-pa-core/src/workItemId/index.mjs`.
 
 import { readPreferences } from '../../../engineering-pa-core/src/preferences.mjs';
 
@@ -18,6 +29,7 @@ const USAGE = `pa work — manage operator-repo work items
 Usage:
   pa work create [--project <id>] --title "..." --category <feature|bug|chore|discussion|research>
                  [--priority 0|1|2|3] [--summary "..."] [--owner ...] [--assignee ...]
+                 [--author <token>]
   pa work status <id> <draft|planned|in-progress|blocked|done|archived>
   pa work list   [--project <id>] [--status ...] [--category ...] [--mine] [--theirs] [--all] [--json]
   pa work -h, --help
@@ -26,6 +38,9 @@ Notes:
   - status=done stamps \`completedAt\` to today (only if not already set).
   - --mine resolves the PA name from operator/config/preferences.json
     (paName / agentName). Default: "pa".
+  - --author sets the writer-scoped id's author token. Precedence:
+    --author > PA_AUTHOR_TOKEN env > preferences.json paName. Must
+    match /^[a-z]{2,12}$/ and be present in operator/config/authors.json.
 
 Exit codes:
   0 ok | 1 usage/not-found | 2 operational failure
@@ -89,11 +104,29 @@ async function getPaName() {
   }
 }
 
+/**
+ * Read the raw `paName` (device-local overlay merged over shared). Unlike
+ * `getPaName`, this returns null if the field is unset — createWork's
+ * author-resolver treats null as "skip this source", not "fall back to
+ * literal 'pa'" (which would silently mask a missing token).
+ */
+async function readPreferencesPaName() {
+  try {
+    const repoRoot = await getRepoRoot();
+    const config = await readPreferences(repoRoot);
+    if (!config) return null;
+    return config.paName || config.agentName || null;
+  } catch {
+    return null;
+  }
+}
+
 async function doCreate(args) {
   const { flags } = parseFlags(args);
   const priority = flags.priority != null && flags.priority !== true
     ? Number(flags.priority)
     : null;
+  const preferencesPaName = await readPreferencesPaName();
   const res = await createWork({
     projectId: typeof flags.project === 'string' ? flags.project : null,
     title: typeof flags.title === 'string' ? flags.title : null,
@@ -102,6 +135,8 @@ async function doCreate(args) {
     summary: typeof flags.summary === 'string' ? flags.summary : null,
     owner: typeof flags.owner === 'string' ? flags.owner : null,
     assignee: typeof flags.assignee === 'string' ? flags.assignee : null,
+    author: typeof flags.author === 'string' ? flags.author : null,
+    preferencesPaName,
   });
   process.stdout.write(`created ${res.id}\n`);
   process.stdout.write(`  ${res.path}\n`);

package/dist/engineering-pa-cli/src/pa/work.mjs

@@ -1,18 +1,30 @@
 // work.mjs — write-side commands for `pa work <verb>`.
 //
-// Source of truth is work/w-YYYY-MM-DD-NNN.json. We never cache.
+// Source of truth is work/w-YYYY-MM-DD-*.json. We never cache.
 //
 // What lives here:
-//   - create: scaffold a new work item with the next-free NNN for today
+//   - create: scaffold a new work item with the next-free NNN in the
+//             CURRENT WRITER'S per-day sequence
 //   - status: change status (stamps `completedAt` on done)
 //   - list:   list work items, optionally filtered
 //
-// ID format and status/category enums match
-// packages/core/schema/work-item.json.
+// Id format, parsing, and author resolution all live in
+// `@stravica-ai/engineering-pa-core/src/workItemId/index.mjs` — the
+// single-source primitive for the whole estate. See its header for the
+// two legal forms (legacy + writer-scoped), the R1 remediation
+// background, and the author-token precedence rules.
 
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 
+import {
+  parseWorkItemId,
+  isValidWorkItemId,
+  buildWorkItemId,
+  resolveAuthorToken,
+  maxNForAuthorOnDate,
+} from '../../../engineering-pa-core/src/workItemId/index.mjs';
+
 import { getRepoRoot } from './repo-root.mjs';
 import { readJson, writeJson, ensureDir, listJsonFiles, today } from './io.mjs';
 
@@ -20,8 +32,6 @@ const STATUSES = new Set(['draft', 'planned', 'in-progress', 'blocked', 'done',
 
 const CATEGORIES = new Set(['feature', 'bug', 'chore', 'discussion', 'research']);
 
-const ID_RE = /^w-(\d{4}-\d{2}-\d{2})-(\d{3})$/;
-
 function validateStatus(status) {
   if (!STATUSES.has(status)) {
     const err = new Error(
@@ -53,38 +63,44 @@ function validatePriority(priority) {
 }
 
 /**
- * Scan work/*.json for the highest NNN with today's date. Returns the
- * next free NNN, zero-padded to 3 digits. Result is always "001"–"999".
+ * Highest NNN already allocated for `dateStr` in THIS author's per-day
+ * sequence. Legacy items (`w-YYYY-MM-DD-NNN` with no author segment)
+ * do not count toward any author's sequence — each writer starts from
+ * 001 on the day writer-scoping takes effect and existing legacy items
+ * simply occupy a separate, older space.
  *
  * If 999 is already taken, throws — callers should treat as an
- * operational failure and report. In practice this is unreachable.
+ * operational failure and report. In practice this is unreachable
+ * because NNN is per-author-per-day, not shared.
  */
-async function nextWorkNumber(repoRoot, dateStr) {
+async function nextWorkNumber(repoRoot, dateStr, author) {
   const dir = join(repoRoot, 'work');
   const files = await listJsonFiles(dir);
-  let max = 0;
-  const prefix = `w-${dateStr}-`;
-  for (const file of files) {
-    if (!file.startsWith(prefix)) continue;
-    const m = file.match(/^w-\d{4}-\d{2}-\d{2}-(\d{3})\.json$/);
-    if (!m) continue;
-    const n = parseInt(m[1], 10);
-    if (Number.isFinite(n) && n > max) max = n;
-  }
+  const max = maxNForAuthorOnDate(files, dateStr, author);
   const next = max + 1;
   if (next > 999) {
-    const err = new Error(`no free work-item slot for ${dateStr} (NNN exhausted)`);
+    const err = new Error(
+      `no free work-item slot for ${dateStr} in author=${author} sequence (NNN exhausted)`,
+    );
     err.exitCode = 2;
     throw err;
   }
-  return String(next).padStart(3, '0');
+  return next;
 }
 
 /**
  * Create a new work item. Returns { id, path }.
  *
  * Status defaults to "draft" per the brief. Date and NNN are
- * auto-derived from today; we do not accept overrides.
+ * auto-derived; we do not accept overrides.
+ *
+ * Author token comes from `opts.author` (explicit; wins over anything
+ * else), the `PA_AUTHOR_TOKEN` env var, or the `paName` field of
+ * `operator/config/preferences.json` (passed in as
+ * `opts.preferencesPaName` by the CLI entry). If none resolve, throws
+ * with an actionable message naming all three sources — a mint with no
+ * author identity is the exact defect R1 exists to close, so we refuse
+ * to fall back to any hard-coded default.
  */
 export async function createWork(opts) {
   if (!opts.title) {
@@ -95,13 +111,24 @@ export async function createWork(opts) {
   validateCategory(opts.category);
   validatePriority(opts.priority);
 
+  let author;
+  try {
+    author = resolveAuthorToken({
+      explicit: opts.author,
+      preferencesPaName: opts.preferencesPaName,
+    });
+  } catch (e) {
+    e.exitCode = 1;
+    throw e;
+  }
+
   const repoRoot = await getRepoRoot();
   const workDir = join(repoRoot, 'work');
   await ensureDir(workDir);
 
   const dateStr = today();
-  const nnn = await nextWorkNumber(repoRoot, dateStr);
-  const id = `w-${dateStr}-${nnn}`;
+  const nnn = await nextWorkNumber(repoRoot, dateStr, author);
+  const id = buildWorkItemId({ date: dateStr, author, nnn });
   const path = join(workDir, `${id}.json`);
 
   const item = {
@@ -127,10 +154,16 @@ export async function createWork(opts) {
 /**
  * Set work-item status. Stamps `completedAt` to today's date when
  * status=done (only if not already set). Always bumps `updated`.
+ *
+ * Accepts both legacy `w-YYYY-MM-DD-NNN` and writer-scoped
+ * `w-YYYY-MM-DD-<author>-NNN` ids — every existing item in the estate
+ * predates R1 and must remain mutable through this command.
  */
 export async function setWorkStatus(id, status) {
-  if (!ID_RE.test(id)) {
-    const err = new Error(`invalid work id: ${id} (expected w-YYYY-MM-DD-NNN)`);
+  if (!isValidWorkItemId(id)) {
+    const err = new Error(
+      `invalid work id: ${id} (expected w-YYYY-MM-DD-NNN or w-YYYY-MM-DD-<author>-NNN)`,
+    );
     err.exitCode = 1;
     throw err;
   }
@@ -157,6 +190,12 @@ export async function setWorkStatus(id, status) {
  * List work items. Filters: status, category, project, owner, assignee,
  * mine, theirs, all, paName (used for --mine resolution).
  * By default excludes done + archived (mirrors desk-list semantics).
+ *
+ * Reads any well-formed work item (both id forms). Skips files whose
+ * filename does not parse as a work-item id at all — the same
+ * skip-unparseable posture the original had, restated against the
+ * shared parser so an in-directory README or a stray temp file cannot
+ * poison the listing.
  */
 export async function listWork(filters = {}) {
   const repoRoot = await getRepoRoot();
@@ -164,10 +203,11 @@ export async function listWork(filters = {}) {
   const files = await listJsonFiles(dir);
   const items = [];
   for (const f of files) {
+    if (!parseWorkItemId(f)) continue;
     try {
       items.push(await readJson(join(dir, f)));
     } catch {
-      // Skip unparseable.
+      // Skip unparseable JSON contents.
     }
   }
   let filtered = items;

package/dist/engineering-pa-cli/src/secrets/cli.mjs

@@ -25,10 +25,17 @@ Usage:
   secrets init              Initialise the vault (generate keys, create empty secrets file)
   secrets get KEY           Retrieve a secret
   secrets set KEY VALUE     Store or update a secret (use \`-\` as VALUE to read from stdin)
-                             --canonical-clone PATH: write the canonical
-                             clone's vault file FIRST, then this workspace
-                             copy. If the canonical write fails, aborts
-                             before touching the workspace copy at all.
+                             Since 0.1.20, canonical-first dual-write is
+                             the DEFAULT for scoped writes when a canonical
+                             clone for the scope is discoverable on this
+                             host. See "Canonical-first writes" below.
+                             --canonical-clone PATH: force a specific
+                             canonical clone's vault file (bootstraps a
+                             missing file; wins over auto-discovery).
+                             --no-canonical: opt out of the dual-write and
+                             the absence notice.
+                             If the canonical write fails, aborts before
+                             touching the workspace copy at all.
   secrets list              List all secret key names (not values)
   secrets delete KEY        Remove a secret
   secrets rotate            Re-encrypt with current recipients
@@ -111,16 +118,30 @@ Default scope (get/set only, when neither --scope nor --file is given):
     note: writing to '(legacy)' pot — no scope specified and no default configured. Use --scope <name> or configure a default.
 
 Canonical-first writes (set only):
-  --canonical-clone PATH    Write PATH (a canonical clone's encrypted
-                             vault file) FIRST, then the resolved
-                             workspace copy SECOND. If the canonical
-                             write fails for any reason (existing store
-                             undecryptable, sops encrypt failure), the
-                             command aborts with exit 2 BEFORE touching
-                             the workspace copy at all — a device-side
-                             vault mutation never round-trips only
-                             halfway. Without this flag, 'set' behaves
-                             exactly as before (workspace copy only).
+  Canonical-first dual-write is DEFAULT for scoped writes since 0.1.20 —
+  a plain 'secrets set' on a scoped vault writes canonical FIRST and
+  workspace SECOND whenever a canonical clone for the scope is
+  discoverable on this host. Discovery order, first hit wins:
+    1. Explicit --canonical-clone PATH (always wins, bootstraps a
+       missing file).
+    2. "canonicalClone" in ~/.config/stravica-pa/defaults.json — either:
+         object (scope → file map):
+           { "canonicalClone": { "seo-ops": "/abs/vault/seo-ops.enc.json" } }
+         string (root dir), derives <root>/vault/<scope>.enc.json:
+           { "canonicalClone": "/Users/thefoot/stravica-canonical/stravica-operator-barry" }
+    3. Estate convention: ~/stravica-canonical/*/vault/<scope>.enc.json
+       (exactly one match; ambiguity or zero matches skips this tier).
+  Absence is a NOTICE, never a failure — a host with no canonical layout
+  keeps writing to workspace only, with a one-line stderr line naming why
+  nothing resolved. If any canonical write fails (existing store
+  undecryptable, sops encrypt failure), the command aborts with exit 2
+  BEFORE touching the workspace copy — the ordering invariant is
+  identical to the flag path since it always was.
+
+  --canonical-clone PATH    Force PATH as the canonical target (wins over
+                             auto-discovery; bootstraps a missing file).
+  --no-canonical            Opt out of dual-write entirely, and suppress
+                             the absence notice.
 
 Value-compare verification:
   secrets verify --values --against <path>
@@ -139,7 +160,7 @@ const USAGE = `Usage: secrets {init|get|set|list|delete|rotate|status|backup|vau
 Commands:
   init              Initialise the vault (generate keys, create config)
   get KEY           Retrieve a secret value
-  set KEY VALUE     Store or update a secret (--canonical-clone PATH: write canonical first)
+  set KEY VALUE     Store or update a secret (canonical-first by default; --no-canonical to opt out)
   list              List all secret key names
   delete KEY        Remove a secret
   rotate            Re-encrypt with current recipients

package/dist/engineering-pa-cli/src/secrets/commands/set.mjs

@@ -2,18 +2,29 @@
 // Passing `-` as VALUE reads the secret from stdin (trailing newline stripped),
 // which keeps the value out of argv / process listings / shell history.
 //
-// --canonical-clone PATH: write the canonical clone's vault file FIRST,
-// then this workspace copy SECOND. If the canonical write fails for any
-// reason, the command aborts (exit 2) BEFORE touching the workspace copy
-// at all — a device-side vault mutation never round-trips only halfway
-// (see up-path-single-writer-ownership's vault follow-up: "device-side
-// vault mutations must round-trip to canonical immediately"). Without the
-// flag, behaviour is exactly as before (workspace copy only).
+// Canonical-first dual-write is the DEFAULT for scoped writes since 0.1.20:
+// when a canonical clone for the target scope is discoverable on this host
+// (via ~/.config/stravica-pa/defaults.json "canonicalClone" or the
+// ~/stravica-canonical/*/vault/<scope>.enc.json convention — see
+// resolveCanonicalCloneTarget in ../vault.mjs), set writes canonical FIRST
+// and workspace SECOND, with the same abort-before-workspace ordering the
+// explicit --canonical-clone flag has always had. Absence of a canonical
+// clone is a NOTICE, never a failure (a host that never had a canonical
+// keeps working); --no-canonical opts out (and suppresses the notice).
+// Explicit --canonical-clone PATH still wins over any auto-discovery.
+//
+// Ordering invariant (pinned by tests): if the canonical write fails for
+// any reason (existing canonical store undecryptable, sops encrypt
+// failure), the command aborts with exit 2 BEFORE touching the workspace
+// copy at all — a device-side vault mutation never round-trips only
+// halfway (see up-path-single-writer-ownership's vault follow-up:
+// "device-side vault mutations must round-trip to canonical immediately").
 
 import { readFileSync } from 'node:fs';
 import {
   resolveCommandPaths,
   resolveScopePaths,
+  resolveCanonicalCloneTarget,
   checkDeps,
   depInstallMessage,
   checkVault,
@@ -25,19 +36,21 @@ import {
   VaultError,
 } from '../vault.mjs';
 
-// --canonical-clone may appear anywhere in argv, matching the --scope/
-// --file convention in cli.mjs. Local to `set` (not a global flag) since
-// no other command writes to a second target.
-function extractCanonicalCloneFlag(argv) {
+// --canonical-clone / --no-canonical may appear anywhere in argv, matching
+// the --scope/--file convention in cli.mjs. Local to `set` (not global
+// flags) since no other command writes to a second target.
+function extractCanonicalFlags(argv) {
   const rest = [];
   let canonicalClone;
+  let noCanonical = false;
   for (let i = 0; i < argv.length; i += 1) {
     const a = argv[i];
     if (a === '--canonical-clone') { canonicalClone = argv[i + 1]; i += 1; continue; }
     if (a.startsWith('--canonical-clone=')) { canonicalClone = a.slice('--canonical-clone='.length); continue; }
+    if (a === '--no-canonical') { noCanonical = true; continue; }
     rest.push(a);
   }
-  return { canonicalClone, rest };
+  return { canonicalClone, noCanonical, rest };
 }
 
 export async function runSet(args, overrides = {}) {
@@ -45,15 +58,20 @@ export async function runSet(args, overrides = {}) {
   // target vault) whenever --scope/--file wasn't given upstream in
   // cli.mjs — see vault.mjs's default-scope resolution section.
   const paths = resolveCommandPaths(overrides);
-  const { canonicalClone, rest } = extractCanonicalCloneFlag(args);
+  const { canonicalClone, noCanonical, rest } = extractCanonicalFlags(args);
   const key = rest[0];
   let value = rest[1];
 
   if (!key || value == null || value === '') {
-    console.error('Usage: secrets set KEY VALUE [--canonical-clone PATH]   (use `-` as VALUE to read from stdin)');
+    console.error('Usage: secrets set KEY VALUE [--canonical-clone PATH | --no-canonical]   (use `-` as VALUE to read from stdin)');
     throw new VaultError('usage', 1);
   }
 
+  if (canonicalClone && noCanonical) {
+    console.error('Error: --canonical-clone and --no-canonical are mutually exclusive.');
+    throw new VaultError('mutually exclusive canonical flags', 1);
+  }
+
   if (value === '-') {
     const readStdin = overrides.readStdin ?? (() => readFileSync(0, 'utf-8'));
     const raw = readStdin();
@@ -79,16 +97,54 @@ export async function runSet(args, overrides = {}) {
     throw new VaultError(vaultState.reason || 'vault not initialised', vaultState.exitCode ?? 1);
   }
 
+  // Canonical-first resolution order (BEFORE any workspace write):
+  //   1. Explicit --canonical-clone PATH → wins, always. Bootstraps a
+  //      missing canonical file (matches the flag's historical behaviour).
+  //   2. --no-canonical → skip canonical entirely, no notice, no discovery.
+  //   3. Scoped write (paths.scope set) → auto-discover via
+  //      resolveCanonicalCloneTarget. Hit → dual-write canonical-first,
+  //      SAME output lines as the explicit-flag path. Miss → workspace-only
+  //      PLUS a one-line stderr notice naming why nothing resolved.
+  //   4. Legacy fallback (no scope) → no canonical resolution, no notice —
+  //      legacy has no natural canonical mirror.
+  let effectiveCanonical = null;
+  let canonicalPathsFromOverride = overrides.canonicalPaths || null;
+  if (canonicalClone) {
+    effectiveCanonical = { file: canonicalClone, source: 'flag' };
+  } else if (!noCanonical && paths.scope) {
+    // Honour the paths' own `home` first — it carries the caller's
+    // injected home end-to-end so test isolation cannot leak into the
+    // real ~/stravica-canonical/ scan. Falls back to overrides.home for
+    // callers that build paths themselves and only pass home via
+    // overrides, then to homedir() for the real CLI at run time.
+    const canonicalHome = paths.home ?? overrides.home;
+    const resolved = overrides.resolveCanonicalCloneTarget
+      ? overrides.resolveCanonicalCloneTarget({ scope: paths.scope, home: canonicalHome, env: overrides.env })
+      : resolveCanonicalCloneTarget({ scope: paths.scope, home: canonicalHome, env: overrides.env });
+    if (resolved.file) {
+      effectiveCanonical = { file: resolved.file, source: resolved.source, detail: resolved.detail };
+    } else {
+      // Absence notice — never a failure. Explains WHY nothing resolved so
+      // an operator on a host without a canonical layout knows whether to
+      // provision one, pass --no-canonical to silence, or ignore.
+      const tail = resolved.tried && resolved.tried.length > 0
+        ? ` (tried: ${resolved.tried.join('; ')})`
+        : '';
+      console.error(`notice: no canonical clone configured for scope '${paths.scope}' on this host — workspace-only write${tail}`);
+    }
+  }
+
   // Canonical FIRST. Resolved the same way `--file` already works for
   // every other scope-aware command — an arbitrary path, its own
   // .sops.yaml expected alongside it, reusing THIS host's key material
   // (same recipients in practice for a workspace/canonical-clone pair).
   // Any failure here (existing canonical store undecryptable, sops
   // encrypt failure) throws and propagates straight out of runSet —
-  // the workspace write below is never reached.
-  if (canonicalClone) {
-    const canonicalPaths = overrides.canonicalPaths || resolveScopePaths({
-      file: canonicalClone,
+  // the workspace write below is never reached. Ordering pinned by
+  // canonical-clone.test.mjs — do not reorder.
+  if (effectiveCanonical) {
+    const canonicalPaths = canonicalPathsFromOverride || resolveScopePaths({
+      file: effectiveCanonical.file,
       keyDir: paths.keyDir,
       keyFile: paths.keyFile,
     });

package/dist/engineering-pa-cli/src/secrets/vault.mjs

@@ -165,6 +165,11 @@ export function defaultPaths(overrides = {}) {
     sopsConfig: join(vaultDir, '.sops.yaml'),
     keyDir,
     keyFile: join(keyDir, 'age-key.txt'),
+    // Retained on the paths object so downstream consumers (canonical-
+    // clone auto-discovery in commands/set.mjs) can honour the SAME home
+    // the caller injected, instead of falling back to the real user's
+    // homedir() and cross-contaminating test isolation.
+    home,
   };
 }
 
@@ -220,6 +225,7 @@ export function resolveScopePaths(opts = {}) {
       scope: opts.scope ?? null,
       scoped: true,
       layout: 'file',
+      home,
     };
   }
 
@@ -260,6 +266,7 @@ export function resolveScopePaths(opts = {}) {
       scope: opts.scope,
       scoped: true,
       layout: 'workspace',
+      home,
     };
   }
 
@@ -275,6 +282,7 @@ export function resolveScopePaths(opts = {}) {
       scope: opts.scope,
       scoped: true,
       layout: 'canonical',
+      home,
     };
   }
 
@@ -332,6 +340,138 @@ function readDefaultsDefaultScope(home) {
   }
 }
 
+// ── Canonical-clone target resolution (set only) ─────────────────────
+//
+// When `set` runs on a scoped vault WITHOUT --canonical-clone (and WITHOUT
+// --no-canonical), auto-discover the canonical clone's vault file for the
+// resolved scope. Resolution order (each tier tried in turn, first hit
+// wins; every miss recorded in `tried` for the absence-notice detail):
+//
+//   1. "canonicalClone" in ~/.config/stravica-pa/defaults.json — two
+//      shapes supported:
+//        - object (scope → file map):
+//            { "canonicalClone": { "seo-ops": "/abs/path/seo-ops.enc.json" } }
+//        - string (root dir): derives <root>/vault/<scope>.enc.json:
+//            { "canonicalClone": "/Users/thefoot/stravica-canonical/stravica-operator-barry" }
+//      This CLI never writes defaults.json.
+//   2. Estate convention discovery under ~/stravica-canonical/*/vault/
+//      <scope>.enc.json — the ~/stravica-canonical/ layout is the
+//      established root for canonical clones on every host (see
+//      library-sync-cycle's default --repos-root, dex-cutover-driver's
+//      reposRoot, and the routine references across projects/). Exactly
+//      one match wins; zero matches or multiple matches skips this tier
+//      (multiple is recorded as ambiguity so the notice explains WHY the
+//      auto-write did not happen).
+//
+// A resolved-but-nonexistent file (config points at a path that isn't
+// there) is treated as a miss with a `tried` line, not a bootstrap — the
+// auto-write path only ever writes to canonicals that already exist.
+// Explicit --canonical-clone still bootstraps missing files (it always did).
+
+function readDefaultsCanonicalClone(home) {
+  const file = defaultsFilePath(home);
+  if (!existsSync(file)) return { file, shape: null, value: null, reason: 'file not present' };
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(file, 'utf-8'));
+  } catch {
+    return { file, shape: null, value: null, reason: 'file is not valid JSON' };
+  }
+  if (!parsed || typeof parsed !== 'object' || !('canonicalClone' in parsed)) {
+    return { file, shape: null, value: null, reason: 'canonicalClone key not set' };
+  }
+  const v = parsed.canonicalClone;
+  if (typeof v === 'string' && v.trim() !== '') {
+    return { file, shape: 'root', value: resolve(v.trim()), reason: null };
+  }
+  if (v && typeof v === 'object' && !Array.isArray(v)) {
+    return { file, shape: 'map', value: v, reason: null };
+  }
+  return { file, shape: null, value: null, reason: 'canonicalClone must be a non-empty string or a scope→file object' };
+}
+
+// Directory scan for the estate convention: ~/stravica-canonical/<repo>/
+// vault/<scope>.enc.json (glob-shape ~/stravica-canonical/*/vault/…enc.json;
+// slash-star notation avoided in this comment because JSDoc closes on */).
+// Returns { file, source, detail } on exactly-one hit, or
+// { file: null, reason } describing the miss (none / ambiguous / root
+// absent / unreadable). Never throws — a scan failure is a miss, not a
+// secrets-set failure.
+function discoverConventionalCanonical(home, scope) {
+  const root = join(home, 'stravica-canonical');
+  if (!existsSync(root)) {
+    return { file: null, reason: `no ${root} directory` };
+  }
+  let entries;
+  try {
+    entries = readdirSync(root, { withFileTypes: true });
+  } catch (err) {
+    return { file: null, reason: `${root} unreadable (${err && err.code ? err.code : 'error'})` };
+  }
+  const hits = [];
+  for (const ent of entries) {
+    if (!ent.isDirectory()) continue;
+    const candidate = join(root, ent.name, 'vault', `${scope}.enc.json`);
+    if (existsSync(candidate)) hits.push(candidate);
+  }
+  if (hits.length === 1) {
+    return { file: hits[0], source: 'convention', detail: `~/stravica-canonical/*/vault/${scope}.enc.json` };
+  }
+  if (hits.length === 0) {
+    return { file: null, reason: `no ~/stravica-canonical/*/vault/${scope}.enc.json` };
+  }
+  return { file: null, reason: `ambiguous — ${hits.length} matches under ~/stravica-canonical: ${hits.join(', ')}` };
+}
+
+/**
+ * Resolve the canonical clone's vault file for `scope`. Returns
+ *   { file, source, detail, tried }  on hit  — file is an absolute path,
+ *                                             source is 'defaults-map' |
+ *                                             'defaults-root' | 'convention'.
+ *   { file: null, tried }             on miss — tried is a list of the
+ *                                             per-tier miss reasons, in
+ *                                             priority order.
+ * Never throws. Never a failure — absence is a notice case, not an error.
+ * Scope is required; callers must not invoke this on the legacy vault
+ * fall-through (no scope → no natural canonical mirror).
+ */
+export function resolveCanonicalCloneTarget(opts = {}) {
+  const home = opts.home ?? homedir();
+  const scope = opts.scope;
+  const tried = [];
+  if (!scope) return { file: null, tried: ['no scope resolved (legacy fallback)'] };
+
+  const defaults = readDefaultsCanonicalClone(home);
+  if (defaults.shape === 'map') {
+    const entry = defaults.value[scope];
+    if (typeof entry === 'string' && entry.trim() !== '') {
+      const file = resolve(entry.trim());
+      if (existsSync(file)) {
+        return { file, source: 'defaults-map', detail: `${defaults.file} → canonicalClone["${scope}"]`, tried };
+      }
+      tried.push(`${defaults.file} → canonicalClone["${scope}"] = ${file} (path not present)`);
+    } else {
+      tried.push(`${defaults.file} → canonicalClone map has no entry for "${scope}"`);
+    }
+  } else if (defaults.shape === 'root') {
+    const file = join(defaults.value, 'vault', `${scope}.enc.json`);
+    if (existsSync(file)) {
+      return { file, source: 'defaults-root', detail: `${defaults.file} → canonicalClone root ${defaults.value}`, tried };
+    }
+    tried.push(`${defaults.file} → canonicalClone root ${defaults.value} → ${file} (path not present)`);
+  } else {
+    tried.push(`${defaults.file} canonicalClone: ${defaults.reason}`);
+  }
+
+  const conv = discoverConventionalCanonical(home, scope);
+  if (conv.file) {
+    return { file: conv.file, source: conv.source, detail: conv.detail, tried };
+  }
+  tried.push(`convention: ${conv.reason}`);
+
+  return { file: null, tried };
+}
+
 /**
  * Walk up from `cwd` for the nearest ancestor directory that sits under
  * an "agents" path segment AND contains identity.json. Returns the file

package/dist/engineering-pa-core/schema/work-item.json

@@ -9,8 +9,8 @@
   "properties": {
     "id": {
       "type": "string",
-      "pattern": "^w-\\d{4}-\\d{2}-\\d{2}-\\d{3}$",
-      "description": "Work item identifier in the format w-YYYY-MM-DD-NNN"
+      "pattern": "^w-\\d{4}-\\d{2}-\\d{2}(?:-[a-z]{2,12})?-\\d{3}$",
+      "description": "Work item identifier. Two forms are permanently valid: legacy `w-YYYY-MM-DD-NNN` (pre-2026-08-12 items) and writer-scoped `w-YYYY-MM-DD-<author>-NNN` (post-R1 mints; author = /^[a-z]{2,12}$/ from operator/config/authors.json). New allocators must always emit the writer-scoped form — see packages/core/src/workItemId/index.mjs."
     },
     "projectId": {
       "type": ["string", "null"],

package/dist/engineering-pa-core/src/workItemId/index.mjs

@@ -0,0 +1,219 @@
+// workItemId/index.mjs — the canonical work-item-id primitive.
+//
+// One place, every rule. Every writer on the estate MUST parse work-item
+// ids through `parseWorkItemId` (accepts both legal forms) and MUST mint
+// new ids through `buildWorkItemId` (always the writer-scoped form).
+// Nothing outside this module gets to know the shape of an id, and
+// nothing outside this module gets to decide what the current writer's
+// author token is.
+//
+// ────────────────────────────────────────────────────────────────────────
+// Background — w-2026-08-12-001, R1 of the library remediation train.
+//
+// The estate has ≥5 autonomous writers competing for one filename space
+// (`work/w-YYYY-MM-DD-NNN.json`): Dave's macbook session, Dex's
+// wsd-laptop session, librarian-pr-intake on ops-01, upstream-triage on
+// smarthome01, Baz manual. Each allocated the next-free NNN from its own
+// locally-visible git state, and sync latency meant visible state lied.
+// Four dual-mint collisions in two weeks; the 2026-08-11 collision
+// wedged the ops-01 librarian sweep for 2+ hours (see incident
+// `2026-08-11-wedge-root-cause-d024.md` and library architecture review
+// `2026-08-11-library-architecture-review.md` §2.4 collision surface).
+//
+// Baz ratified the fix 2026-08-11: writer-scoped per-day sequences. Each
+// writer gets its own NNN space, keyed by an author token from the
+// authors registry (`operator/config/authors.json`). Cross-writer
+// collision is now structurally impossible with zero coordination.
+// Legacy ids without an author segment remain valid PARSE targets
+// forever (forward-only migration; existing items never renumbered) but
+// no allocator may ever MINT them again.
+//
+// ────────────────────────────────────────────────────────────────────────
+// The two legal forms
+//
+//   legacy:  w-YYYY-MM-DD-NNN                e.g. w-2026-08-11-025
+//   new:     w-YYYY-MM-DD-<author>-NNN       e.g. w-2026-08-12-dave-001
+//
+// Author token = /^[a-z]{2,12}$/ (lowercase letters only, 2–12 chars).
+// Deliberately all-alpha: keeps the parse alternation unambiguous
+// against the NNN segment (any middle segment starting with a digit is
+// legacy) and mirrors the registry's `dave`/`dex`/`sam`/`max`/`ian`/
+// `baz` shape without inviting alphanumeric drift.
+//
+// NNN = /^\d{3}$/, 001–999, zero-padded. NNN space is per-author-per-day,
+// which is why we never run out of headroom in practice.
+
+const AUTHOR_TOKEN_RE = /^[a-z]{2,12}$/;
+
+// Two-branch alternation — the ONE-line spec of every valid id in the
+// estate. Every other regex in this repo is either this one, or (for
+// filenames) this one with a `\.json` suffix.
+const WORK_ITEM_ID_RE = /^w-(\d{4}-\d{2}-\d{2})(?:-([a-z]{2,12}))?-(\d{3})$/;
+const WORK_ITEM_FILENAME_RE = /^w-(\d{4}-\d{2}-\d{2})(?:-([a-z]{2,12}))?-(\d{3})\.json$/;
+
+/**
+ * True iff `s` is a well-formed author token.
+ * @param {unknown} s
+ * @returns {boolean}
+ */
+export function isValidAuthorToken(s) {
+  return typeof s === 'string' && AUTHOR_TOKEN_RE.test(s);
+}
+
+/**
+ * Parse a work-item id (with or without `.json`). Accepts both the
+ * legacy `w-YYYY-MM-DD-NNN` form and the writer-scoped
+ * `w-YYYY-MM-DD-<author>-NNN` form. Returns `null` if the string is
+ * not a valid id in either form — callers decide how to handle that.
+ *
+ * @param {string} idOrFilename
+ * @returns {{ date: string, author: string | null, nnn: number, id: string, isLegacy: boolean } | null}
+ */
+export function parseWorkItemId(idOrFilename) {
+  if (typeof idOrFilename !== 'string') return null;
+  const bare = idOrFilename.endsWith('.json')
+    ? idOrFilename.slice(0, -'.json'.length)
+    : idOrFilename;
+  const m = bare.match(WORK_ITEM_ID_RE);
+  if (!m) return null;
+  const date = m[1];
+  const author = m[2] || null;
+  const nnn = parseInt(m[3], 10);
+  return { date, author, nnn, id: bare, isLegacy: author === null };
+}
+
+/**
+ * True iff `s` is a well-formed work-item id (either form). Convenience
+ * wrapper around `parseWorkItemId` for the many callers that only need
+ * a yes/no.
+ *
+ * @param {unknown} s
+ * @returns {boolean}
+ */
+export function isValidWorkItemId(s) {
+  return parseWorkItemId(String(s)) !== null;
+}
+
+/**
+ * Mint a writer-scoped id. NEW writes MUST always go through this
+ * function; the legacy form is parse-only and no allocator may re-emit
+ * it. Throws if `author` is not a valid token — that is a caller bug
+ * (an allocator with no resolved author identity), not a runtime input.
+ *
+ * @param {object} opts
+ * @param {string} opts.date    YYYY-MM-DD
+ * @param {string} opts.author  registry-validated author token
+ * @param {number} opts.nnn     1..999
+ * @returns {string}
+ */
+export function buildWorkItemId({ date, author, nnn }) {
+  if (!/^\d{4}-\d{2}-\d{2}$/.test(String(date))) {
+    throw new Error(`buildWorkItemId: bad date: ${date}`);
+  }
+  if (!isValidAuthorToken(author)) {
+    throw new Error(
+      `buildWorkItemId: bad author token: ${JSON.stringify(author)} (expected /^[a-z]{2,12}$/)`,
+    );
+  }
+  if (!Number.isInteger(nnn) || nnn < 1 || nnn > 999) {
+    throw new Error(`buildWorkItemId: nnn out of range: ${nnn} (expected 1..999)`);
+  }
+  return `w-${date}-${author}-${String(nnn).padStart(3, '0')}`;
+}
+
+/**
+ * Resolve the current caller's author token. Precedence, highest first:
+ *
+ *   1. `opts.explicit`         — an explicit token passed by the caller
+ *                                (e.g. a HQ tool that KNOWS it is `max`
+ *                                or `ian`). ALWAYS wins.
+ *   2. `PA_AUTHOR_TOKEN` env   — session/host default.
+ *   3. `opts.preferencesPaName` — `paName` from
+ *                                `operator/config/preferences.json`,
+ *                                the interactive-session fallback.
+ *
+ * Hard-errors with an actionable message naming every source if none
+ * resolves. Rationale: an allocator without a resolved author is a
+ * design bug — silently defaulting to a hard-coded token would put us
+ * back in the collision class this whole R1 exists to close.
+ *
+ * The precedence ordering is load-bearing: HQ tools deployed on ops-01
+ * (which shares $HOME across many launch contexts) MUST be able to pin
+ * their own token via the explicit param without an ambient
+ * `PA_AUTHOR_TOKEN` inherited from the parent shell silently
+ * overriding them. Tested by
+ * `test/workItemId/resolveAuthorToken.test.mjs`.
+ *
+ * @param {object} [opts]
+ * @param {string} [opts.explicit]
+ * @param {string} [opts.envToken]           — inject env for tests; defaults to process.env.PA_AUTHOR_TOKEN
+ * @param {string} [opts.preferencesPaName]  — `paName` field from preferences.json, if loaded
+ * @returns {string}
+ */
+export function resolveAuthorToken(opts = {}) {
+  const envToken = 'envToken' in opts ? opts.envToken : process.env.PA_AUTHOR_TOKEN;
+  const candidates = [
+    { source: 'explicit param', value: opts.explicit },
+    { source: 'PA_AUTHOR_TOKEN env var', value: envToken },
+    { source: 'preferences.json paName', value: opts.preferencesPaName },
+  ];
+  for (const { source, value } of candidates) {
+    if (value == null || value === '') continue;
+    if (!isValidAuthorToken(value)) {
+      throw new Error(
+        `resolveAuthorToken: ${source} is not a valid author token: ${JSON.stringify(value)} (expected /^[a-z]{2,12}$/)`,
+      );
+    }
+    return value;
+  }
+  throw new Error(
+    'resolveAuthorToken: no author token resolved. Set one of, in order of precedence: ' +
+      '(1) an explicit token via the caller\'s API, ' +
+      '(2) the PA_AUTHOR_TOKEN environment variable, ' +
+      '(3) `paName` in operator/config/preferences.json. ' +
+      'Token must match /^[a-z]{2,12}$/. Registry lives at operator/config/authors.json.',
+  );
+}
+
+/**
+ * Compute the highest NNN already allocated for a given `date` +
+ * `author` slot from a bag of parsed work-item filenames. Legacy ids
+ * (no author segment) DO NOT count toward any author's sequence — each
+ * writer's per-day NNN space starts from 001 on the day writer-scoping
+ * takes effect, and legacy items just occupy a separate, older space.
+ *
+ * Purpose: the arithmetic every allocator does is identical; keep the
+ * rule in one place so a new writer added to the registry doesn't need
+ * to re-implement it.
+ *
+ * @param {string[]} filenames  raw directory entries
+ * @param {string}   date       YYYY-MM-DD
+ * @param {string}   author     the author whose sequence is being read
+ * @returns {number}            0 if the author has no items yet today
+ */
+export function maxNForAuthorOnDate(filenames, date, author) {
+  if (!isValidAuthorToken(author)) {
+    throw new Error(
+      `maxNForAuthorOnDate: bad author: ${JSON.stringify(author)} (expected /^[a-z]{2,12}$/)`,
+    );
+  }
+  let max = 0;
+  for (const name of filenames) {
+    const parsed = parseWorkItemId(name);
+    if (!parsed) continue;
+    if (parsed.date !== date) continue;
+    if (parsed.author !== author) continue;
+    if (parsed.nnn > max) max = parsed.nnn;
+  }
+  return max;
+}
+
+/**
+ * The regex sources, exported for callers that MUST use a raw string
+ * (JSON Schema `pattern`, other language regexes). Do not reach into
+ * `.source` in JavaScript — call `parseWorkItemId`/`isValidWorkItemId`
+ * instead.
+ */
+export const WORK_ITEM_ID_PATTERN = WORK_ITEM_ID_RE.source;
+export const WORK_ITEM_FILENAME_PATTERN = WORK_ITEM_FILENAME_RE.source;
+export const AUTHOR_TOKEN_PATTERN = AUTHOR_TOKEN_RE.source;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@stravica-ai/digital-operator-pa",
-  "version": "0.1.19",
-  "description": "Digital Operator PA — single-bundled public package surface (bins + library) for the platform.",
+  "version": "0.1.21",
+  "description": "Digital Operator PA \u2014 single-bundled public package surface (bins + library) for the platform.",
   "type": "module",
   "main": "./index.mjs",
   "exports": {
@@ -49,10 +49,11 @@
   "engines": {
     "node": ">=24"
   },
-  "//": "test pins --test-isolation=none: default process-isolation mode silently undercounts (drops passed tests from totals) when a test awaits async work while stdout is patched by a capture() helper — see packages/cli/test/secrets. Counts must never lie.",
   "scripts": {
     "build": "node build.mjs",
+    "prepack": "node build.mjs",
     "test": "node --test --test-isolation=none test/*.test.mjs",
     "dry-publish": "node build.mjs && node scripts/dry-publish.mjs"
-  }
-}
+  },
+  "//": "test pins --test-isolation=none: default process-isolation mode silently undercounts (drops passed tests from totals) when a test awaits async work while stdout is patched by a capture() helper \u2014 see packages/cli/test/secrets. Counts must never lie."
+}