@stravica-ai/digital-operator-pa 0.1.50 → 0.1.52

package/dist/engineering-pa-cli/src/pa/cli.mjs

@@ -15,6 +15,9 @@ import {
   computeDistillationHealth,
   renderHealthLine,
 } from '../../../engineering-pa-core/src/distill/health.mjs';
+import { vaultState } from '../../../engineering-pa-core/src/vault/require.mjs';
+import { enabledToolsNeedingSecrets } from '../../../engineering-pa-core/src/vault/tool-needs.mjs';
+import { resolveDefaultScope } from '../secrets/vault.mjs';
 import { main as runMigrateInspect } from '../../../engineering-pa-migrate-inspect/src/cli.mjs';
 import { doOnboard } from './onboard.mjs';
 
@@ -126,9 +129,11 @@ async function doStatus(opts = {}) {
   const out = opts.stdout ?? process.stdout;
   const err = opts.stderr ?? process.stderr;
   const cwd = opts.cwd ?? process.cwd();
+  const env = opts.env ?? process.env;
+  const home = opts.home;
   const repoRoot = opts.repoRoot
-    ?? process.env.DAVE_REPO_ROOT
-    ?? process.env.PA_REPO_ROOT
+    ?? env.DAVE_REPO_ROOT
+    ?? env.PA_REPO_ROOT
     ?? cwd;
   const workspacePort = resolveWorkspacePort(repoRoot, opts);
 
@@ -199,7 +204,46 @@ async function doStatus(opts = {}) {
   // Workspace-not-running is OK — operators may run pa status before
   // starting the workspace server.
 
-  // 4. Distillation health — schedule installed?, last run, staging
+  // 4. Vault state — three states rendered on one line (initialised /
+  // not needed / NOT INITIALISED). Load-bearing because 0.1.50 shipped
+  // a scaffold that created an empty `.vault/` for every colleague and
+  // then never initialised it: a jira/confluence call after onboard
+  // hit `secrets get` against a vault that did not exist, and the
+  // failure mode was silent misdirection. `not needed` renders when no
+  // enabled tool in operator/extensions/manifest.json declares any
+  // secret keys (via packages/core/src/vault/tool-needs.mjs).
+  out.write('\nVault:\n');
+  try {
+    const needs = enabledToolsNeedingSecrets(repoRoot);
+    // 0.1.51 fix round (w-2026-09-18-dave-007): consult the SAME
+    // default-scope resolver the credentialed tools use so the Vault
+    // line can never say `initialised` while `secrets get` would miss.
+    // In solo mode the resolver returns scope=null (its defaults.json
+    // and identity.json branches are gated off), so `vaultPaths`
+    // targets the instance's own legacy vault — matching what init
+    // seeded. In HQ mode a resolved scope steers `vaultState` at the
+    // scoped file the tools will actually read.
+    const scoped = resolveDefaultScope({ cwd: repoRoot, env, home });
+    const state = vaultState({ repoRoot, home, env, scope: scoped.scope || undefined });
+    if (state.ok) {
+      const n = state.keyCount == null ? '?' : state.keyCount;
+      const scopeSuffix = scoped.scope ? `; scope '${scoped.scope}' from ${scoped.source}` : '';
+      out.write(`  initialised (${n} keys${scopeSuffix})\n`);
+    } else if (needs.length === 0) {
+      out.write('  not needed (no enabled tool declares secret needs)\n');
+    } else if (state.state === 'partial') {
+      const gaps = state.missing.join(', ');
+      const toolLabels = needs.map((t) => t.toolId).join(', ');
+      out.write(`  NOT INITIALISED (partial; missing: ${gaps}) - enabled tools needing secrets: ${toolLabels}. Run: pnpm exec secrets init\n`);
+    } else {
+      const toolLabels = needs.map((t) => t.toolId).join(', ');
+      out.write(`  NOT INITIALISED - enabled tools needing secrets: ${toolLabels}. Run: pnpm exec secrets init\n`);
+    }
+  } catch (e) {
+    out.write(`  vault probe failed: ${e?.message || e}\n`);
+  }
+
+  // 5. Distillation health — schedule installed?, last run, staging
   // count. Load-bearing because the whole self-learning loop dies
   // silently otherwise (the estate has already been bitten: on the
   // WSD-laptop cold-install proof of 0.1.41, staged observations piled

package/dist/engineering-pa-cli/src/pa/onboard.mjs

@@ -7,12 +7,15 @@
 // step is done it stamps `completedAt` with an ISO string (UTC, second-precision)
 // and preserves the 2-space indent of the file so subsequent diffs stay clean.
 //
-// Mandatory steps (as of 0.1.50): librarianSchedule. See
-// packages/core/docs/commands/onboard.md §Completion.
+// Mandatory steps (as of 0.1.51): librarianSchedule, plus vault when
+// any enabled tool declares a secrets need (see
+// packages/core/src/vault/tool-needs.mjs::enabledToolsNeedingSecrets).
+// See packages/core/docs/commands/onboard.md §Completion.
 
 import { readFile, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 
+import { enabledToolsNeedingSecrets } from '../../../engineering-pa-core/src/vault/tool-needs.mjs';
 import { findRepoRoot } from './repo-root.mjs';
 
 const HELP = `pa onboard - Onboarding walkthrough state
@@ -30,13 +33,31 @@ Exit codes:
   0 ok | 1 usage or a mandatory step is pending | 2 IO failure
 `;
 
-const MANDATORY_STEPS = [
+const BASE_MANDATORY_STEPS = [
   {
     id: 'librarianSchedule',
     remediation: 'run /onboard and complete the librarianSchedule step (installs the mandatory distillation sweep)',
   },
 ];
 
+// The vault step is conditionally mandatory: required only when at
+// least one enabled tool declares a secrets need. See
+// packages/core/src/vault/tool-needs.mjs. A `notNeeded` value on this
+// step is a clean pass through the gate; `pending` refuses completion.
+function mandatoryStepsFor(steps, enabledNeedingSecrets) {
+  const list = [...BASE_MANDATORY_STEPS];
+  const vault = steps ? steps.vault : undefined;
+  if (vault === 'notNeeded') return list;
+  if (enabledNeedingSecrets && enabledNeedingSecrets.length > 0) {
+    const toolLabels = enabledNeedingSecrets.map((t) => t.toolId).join(', ');
+    list.push({
+      id: 'vault',
+      remediation: `run /onboard and complete the vault step (initialise the SOPS+age vault used by: ${toolLabels})`,
+    });
+  }
+  return list;
+}
+
 export async function doOnboard(argv) {
   if (argv.length === 0 || argv[0] === '-h' || argv[0] === '--help') {
     process.stdout.write(HELP);
@@ -95,9 +116,18 @@ export async function onboardComplete(argv, deps = {}) {
     return 2;
   }
   const steps = parsed.steps || {};
+  const enabledNeedingSecrets = deps.enabledToolsNeedingSecrets
+    ? deps.enabledToolsNeedingSecrets(repoRoot)
+    : enabledToolsNeedingSecrets(repoRoot);
+  const mandatory = mandatoryStepsFor(steps, enabledNeedingSecrets);
   const pending = [];
-  for (const step of MANDATORY_STEPS) {
-    if (steps[step.id] !== 'done') pending.push(step);
+  for (const step of mandatory) {
+    // `notNeeded` on the vault step passes; every other terminal value
+    // that is not `done` is pending. Skipped is never valid for a
+    // mandatory step (mirrors librarianSchedule's contract).
+    if (steps[step.id] === 'done') continue;
+    if (step.id === 'vault' && steps.vault === 'notNeeded') continue;
+    pending.push(step);
   }
   if (pending.length > 0) {
     for (const step of pending) {

package/dist/engineering-pa-cli/src/pa/work-cli.mjs

@@ -36,6 +36,11 @@ Usage:
 
 Notes:
   - status=done stamps \`completedAt\` to today (only if not already set).
+  - \`list\` defaults to the active-only scope (excludes done + archived).
+    An explicit \`--status <s>\` REPLACES that default and returns only
+    items with that status (so \`--status done\` prints done items).
+    \`--all\` means no status filter; \`--mine\`/\`--theirs\` compose with
+    either. \`--status\` wins over \`--all\` when both are given.
   - --mine resolves the PA name from operator/config/preferences.json
     (paName / agentName). Default: "pa".
   - --author sets the writer-scoped id's author token. Precedence:

package/dist/engineering-pa-cli/src/pa/work.mjs

@@ -228,6 +228,15 @@ export async function setWorkStatus(id, status) {
  * mine, theirs, all, paName (used for --mine resolution).
  * By default excludes done + archived (mirrors desk-list semantics).
  *
+ * An explicit `status` filter REPLACES the active-only default rather
+ * than being AND-ed with it: `--status done` returns only done items,
+ * `--status archived` returns only archived items, `--status in-progress`
+ * is unchanged (the AND was harmless for non-terminal statuses). The
+ * pre-0.1.52 AND made any terminal-status request unconditionally
+ * empty ("no work items match" for `--status done`), a confident false
+ * negative. `--all` still means "no status filter at all"; if both
+ * `--all` and `--status` are given, `--status` wins.
+ *
  * Reads any well-formed work item (both id forms). Skips files whose
  * filename does not parse as a work-item id at all — the same
  * skip-unparseable posture the original had, restated against the
@@ -248,10 +257,11 @@ export async function listWork(filters = {}) {
     }
   }
   let filtered = items;
-  if (!filters.all) {
+  if (filters.status) {
+    filtered = filtered.filter((w) => w.status === filters.status);
+  } else if (!filters.all) {
     filtered = filtered.filter((w) => !['done', 'archived'].includes(w.status));
   }
-  if (filters.status) filtered = filtered.filter((w) => w.status === filters.status);
   if (filters.category) filtered = filtered.filter((w) => w.category === filters.category);
   if (filters.project) filtered = filtered.filter((w) => w.projectId === filters.project);
   if (filters.owner) filtered = filtered.filter((w) => w.owner === filters.owner);

package/dist/engineering-pa-cli/src/scheduler/cli.mjs

@@ -33,10 +33,14 @@ Usage:
 Schedule files live at <repoRoot>/schedules/<id>.json. The canonical
 schema is bundled at @stravica-ai/engineering-pa-core/schema/schedule.json.
 
---agent (launchd only) targets a specific agent's label prefix
-(com.<agent>.<id>). A schedule file's own top-level "agent" field drives
-install; list/remove take it explicitly since they don't read a schedule
-file. Defaults to "dave" everywhere — omitting it is unchanged behaviour.
+--agent targets a specific agent's label / tag prefix. Install reads
+the agent from the schedule file's own top-level "agent" field. Since
+0.1.52 (w-2026-09-19-dave-001), list/remove resolve the agent from the
+invoking instance's "paName" in operator/config/preferences.json when
+--agent is omitted, and REFUSE (exit 2) when neither source produces a
+value — there is no hard-coded "dave" fallback. This is the fix for the
+colleague-laptop bug where the tools would list and touch another
+estate's schedules under a silent default.
 
 Host enforcement (install): a schedule's "host" field is matched against
 this machine's hostname (exact, then short-name-before-first-dot). A

package/dist/engineering-pa-cli/src/secrets/cli.mjs

@@ -22,7 +22,10 @@ import { resolveScopePaths, VaultError } from './vault.mjs';
 const HELP = `secrets — SOPS+age secrets management
 
 Usage:
-  secrets init              Initialise the vault (generate keys, create empty secrets file)
+  secrets init              Initialise the vault (generate keys, create empty secrets file).
+                             --empty: explicit no-seed init (current default shape).
+                             --stdin-json: after init, seed KEYs from a JSON object
+                             read on stdin (values never echoed; refuses a TTY stdin).
   secrets get KEY           Retrieve a secret (add --exists for a present/absent check that never prints the value)
   secrets set KEY VALUE     Store or update a secret (use \`-\` as VALUE to read from stdin)
                              Since 0.1.20, canonical-first dual-write is
@@ -53,7 +56,18 @@ Usage:
                              --values is required — decrypt-only is never
                              a valid pass (see below). Never prints values.
 
-Private key:      ~/.config/stravica-pa/age-key.txt  (never committed)
+Age private key resolution (0.1.51, w-2026-09-18-dave-007). One shared
+order every verb + pa status + the atlassian resolver consult:
+  1. $SOPS_AGE_KEY_FILE          Explicit override, always wins.
+  2. <repo>/.vault/age-key.txt   Solo-mode key, gitignored. Wins when
+                                 present in either mode.
+  3. ~/.config/stravica-pa/age-key.txt
+                                 Per-user key. Used only when the
+                                 instance is in HQ mode
+                                 (library.mode: remote). Solo mode
+                                 with no in-instance key resolves back
+                                 to #2, init writes there.
+
 Public key:       .vault/recipients.txt       (committed to repo)
 Encrypted store:  .vault/secrets.enc.json     (committed to repo)
 SOPS config:      .vault/.sops.yaml           (committed to repo)
@@ -330,7 +344,7 @@ export async function run(argv, overrides = {}) {
   const cmdOverrides = paths ? { ...overrides, paths } : overrides;
 
   switch (cmd) {
-    case 'init':   return runInit(cmdOverrides);
+    case 'init':   return runInit({ ...cmdOverrides, argv: cmdArgs });
     case 'get':    return runGet(cmdArgs, cmdOverrides);
     case 'set':    return runSet(cmdArgs, cmdOverrides);
     case 'list':   return runList(cmdOverrides);
@@ -353,6 +367,15 @@ export async function run(argv, overrides = {}) {
 }
 
 export async function main(argv, overrides = {}) {
+  // 0.1.51 fix round 2 (w-2026-09-18-dave-007): env defaulted at the
+  // BIN entry so every downstream defaultPaths / resolveScopePaths /
+  // resolveKeyFile call sees the operator's real environment
+  // (SOPS_AGE_KEY_FILE, DAVE_ROOT, etc). The vault.mjs resolvers do NOT
+  // default env from process.env themselves — that leak was breaking
+  // scoped-fixture tests when the developer's shell carried
+  // SOPS_AGE_KEY_FILE. run() is exported for tests to call with an
+  // explicit env; main() is what the packaged bin invokes.
+  if (overrides.env === undefined) overrides = { ...overrides, env: process.env };
   try {
     const code = await run(argv, overrides);
     process.exit(code ?? 0);

package/dist/engineering-pa-cli/src/secrets/commands/init.mjs

@@ -1,6 +1,23 @@
 // init — generate age keypair, write recipients, write SOPS config,
 // create an empty encrypted secrets file if none exists.
+//
+// Two non-interactive paths are exposed for the guided onboarding
+// vault step AND the e2e test to share ONE code path:
+//
+//   secrets init --empty
+//     Explicit "create the key and the empty store, no seeded keys".
+//     The default behaviour has always produced this shape; the flag
+//     is a self-documenting affirmation the caller wanted it.
+//
+//   secrets init --stdin-json
+//     Read {"KEY": "value", ...} from stdin and seed those keys after
+//     the vault is created (never writes to canonical clones — a fresh
+//     init lands values in the workspace vault only). Values are never
+//     echoed to stdout or stderr and never appear in any log line the
+//     tool writes; the tool refuses if stdin is a TTY (no accidental
+//     paste-into-prompt where the value would land in shell history).
 
+import { readFileSync } from 'node:fs';
 import {
   defaultPaths,
   checkDeps,
@@ -14,12 +31,127 @@ import {
   writeSopsConfig,
   keyFileExists,
   secretsFileExists,
+  sopsDecrypt,
   sopsEncrypt,
   VaultError,
 } from '../vault.mjs';
 
+const KEY_NAME_RE = /^[A-Z0-9_]+$/;
+
+function extractInitFlags(argv) {
+  const out = { empty: false, stdinJson: false };
+  for (const a of argv || []) {
+    if (a === '--empty') out.empty = true;
+    else if (a === '--stdin-json') out.stdinJson = true;
+    else if (a === '-h' || a === '--help') out.help = true;
+    else out.unknown = a;
+  }
+  return out;
+}
+
+function readStdinSync() {
+  // Read raw bytes from stdin synchronously. Never printed anywhere.
+  try {
+    return readFileSync(0, 'utf8');
+  } catch (err) {
+    throw new VaultError(`Error: could not read stdin for --stdin-json: ${err && err.message ? err.message : err}`, 1);
+  }
+}
+
+function parseStdinJson(raw) {
+  if (typeof raw !== 'string' || raw.trim().length === 0) {
+    throw new VaultError('Error: --stdin-json received empty input; expected a JSON object of KEY/value pairs.', 1);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new VaultError(`Error: --stdin-json input is not valid JSON: ${err && err.message ? err.message : err}`, 1);
+  }
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+    throw new VaultError('Error: --stdin-json input must be a JSON OBJECT of KEY/value pairs.', 1);
+  }
+  const out = {};
+  for (const [key, value] of Object.entries(parsed)) {
+    if (!KEY_NAME_RE.test(key)) {
+      throw new VaultError(`Error: --stdin-json key "${key}" must match ${KEY_NAME_RE} (upper snake case).`, 1);
+    }
+    if (typeof value !== 'string') {
+      throw new VaultError(`Error: --stdin-json value for "${key}" must be a string.`, 1);
+    }
+    out[key] = value;
+  }
+  return out;
+}
+
 export async function runInit(overrides = {}) {
-  const paths = overrides.paths || defaultPaths({ ...overrides, allowGitRootWithoutVault: true });
+  // 0.1.52 fix (w-2026-09-19-dave-001): `secrets init` CREATES an age
+  // key. The shared resolver in core/vault/require.mjs honours
+  // SOPS_AGE_KEY_FILE first, so with the variable exported the previous
+  // init generated the new key AT the env path — a stray key landed
+  // outside the instance, and on a colleague laptop that carried
+  // another estate's SOPS_AGE_KEY_FILE it would have written the new
+  // key into that estate's key file. The env override is a READ-path
+  // escape hatch; init must generate at the instance path (solo mode)
+  // or the per-user path (HQ mode) regardless of the variable.
+  //
+  // Strip SOPS_AGE_KEY_FILE from the env passed to `defaultPaths` only
+  // — every OTHER env-derived resolution (DAVE_ROOT / PA_ROOT walk,
+  // etc.) still uses the caller's real env. Print a one-line notice
+  // when the operator had the override set and the resolved
+  // key path does not match it, so subsequent reads that continue to
+  // consult the env override are not silently pointed at the old file.
+  const rawEnv = overrides.env;
+  const envOverride = rawEnv && typeof rawEnv.SOPS_AGE_KEY_FILE === 'string' && rawEnv.SOPS_AGE_KEY_FILE.length > 0
+    ? rawEnv.SOPS_AGE_KEY_FILE
+    : null;
+  let envForPaths = rawEnv;
+  if (envOverride !== null && !overrides.paths) {
+    envForPaths = { ...rawEnv };
+    delete envForPaths.SOPS_AGE_KEY_FILE;
+  }
+  const paths = overrides.paths || defaultPaths({
+    ...overrides,
+    env: envForPaths,
+    allowGitRootWithoutVault: true,
+  });
+  if (envOverride !== null && envOverride !== paths.keyFile) {
+    console.log(
+      `Note: SOPS_AGE_KEY_FILE is set to ${envOverride}; init writes the new key to ${paths.keyFile}. Reads will not see the new key until the variable is unset or repointed.`,
+    );
+  }
+  const argv = overrides.argv || [];
+  const flags = extractInitFlags(argv);
+
+  if (flags.help) {
+    console.log([
+      'Usage: secrets init [--empty | --stdin-json]',
+      '',
+      '  --empty        Create the key and an empty encrypted store (default shape).',
+      '  --stdin-json   After init, seed KEYs from a JSON object read on stdin.',
+      '                 Refuses when stdin is a TTY. Values are never echoed.',
+    ].join('\n'));
+    return 0;
+  }
+
+  if (flags.empty && flags.stdinJson) {
+    console.error('Error: --empty and --stdin-json are mutually exclusive.');
+    throw new VaultError('mutually exclusive flags', 1);
+  }
+
+  // Read stdin BEFORE running the init side effects — a malformed
+  // payload should not leave a partially-initialised vault on disk when
+  // the caller was going to seed it in one shot.
+  let seedPairs = null;
+  if (flags.stdinJson) {
+    const stdinStream = overrides.stdinStream || process.stdin;
+    if (stdinStream && stdinStream.isTTY && !overrides.allowTtyStdin) {
+      console.error('Error: --stdin-json requires piped JSON on stdin; refusing to prompt (would land the value in shell history).');
+      throw new VaultError('stdin is a TTY', 1);
+    }
+    const raw = overrides.stdinRead ? overrides.stdinRead() : readStdinSync();
+    seedPairs = parseStdinJson(raw);
+  }
 
   const missing = await checkDeps();
   if (missing.length > 0) {
@@ -33,6 +165,13 @@ export async function runInit(overrides = {}) {
   ensureKeyDir(paths);
 
   if (keyFileExists(paths)) {
+    // 0.1.51 fix round 2 (w-2026-09-18-dave-007): the shared resolver
+    // routes solo instances to `<repoRoot>/.vault/age-key.txt` and HQ
+    // instances to `~/.config/stravica-pa/age-key.txt`. A pre-existing
+    // key at the resolved path is intentional reuse (init is
+    // idempotent). A foreign per-user key on a fresh solo laptop no
+    // longer meets this check — the solo resolver returns the instance
+    // path, which does not exist, and init generates a NEW key there.
     console.log(`Age private key already exists at ${paths.keyFile}`);
   } else {
     await ageKeygen(paths);
@@ -59,6 +198,29 @@ export async function runInit(overrides = {}) {
     console.log('Encrypted secrets file already exists.');
   }
 
+  // Seed non-interactively. Merge (do not replace) any keys that were
+  // already in the store — this verb is idempotent by design and a
+  // re-run with a new key/value should not clobber the operator's
+  // existing set. Values are never echoed; the summary line at the end
+  // prints only key NAMES and the pair count.
+  if (seedPairs && Object.keys(seedPairs).length > 0) {
+    let data = {};
+    if (secretsFileExists(paths)) {
+      try {
+        data = await sopsDecrypt(paths, paths.secretsFile);
+      } catch (err) {
+        console.error(`Error: could not decrypt ${paths.secretsFile} to merge seeded keys: ${err && err.message ? err.message : err}`);
+        throw new VaultError('seed merge decrypt failed', 2);
+      }
+    }
+    for (const [k, v] of Object.entries(seedPairs)) data[k] = v;
+    await sopsEncrypt(paths, pubKey, data);
+    const names = Object.keys(seedPairs).sort();
+    console.log(`Seeded ${names.length} key(s): ${names.join(', ')}`);
+  } else if (flags.stdinJson) {
+    console.log('--stdin-json input carried no keys; vault created empty.');
+  }
+
   console.log('');
   console.log('Vault initialised.');
   console.log(`  Private key: ${paths.keyFile} (NEVER commit this)`);

package/dist/engineering-pa-cli/src/secrets/commands/set.mjs

@@ -21,6 +21,7 @@
 // "device-side vault mutations must round-trip to canonical immediately").
 
 import { readFileSync } from 'node:fs';
+import { isSoloMode } from '../../../../engineering-pa-core/src/vault/mode.mjs';
 import {
   resolveCommandPaths,
   resolveScopePaths,
@@ -153,19 +154,38 @@ export async function runSet(args, overrides = {}) {
     // callers that build paths themselves and only pass home via
     // overrides, then to homedir() for the real CLI at run time.
     const canonicalHome = paths.home ?? overrides.home;
-    const resolved = overrides.resolveCanonicalCloneTarget
-      ? overrides.resolveCanonicalCloneTarget({ scope: paths.scope, home: canonicalHome, env: overrides.env })
-      : resolveCanonicalCloneTarget({ scope: paths.scope, home: canonicalHome, env: overrides.env });
-    if (resolved.file) {
-      effectiveCanonical = { file: resolved.file, source: resolved.source, detail: resolved.detail };
+
+    // Solo-mode gate (0.1.51, w-2026-09-18-dave-007). Auto-discovery of
+    // a canonical clone via ~/.config/stravica-pa/defaults.json or the
+    // ~/stravica-canonical/*/vault/<scope>.enc.json convention is the
+    // co-existence hazard the fix closes: on a colleague laptop that
+    // already carries ANOTHER instance's vault, a solo `secrets set`
+    // must never silently dual-write across the estate boundary.
+    // Explicit --canonical-clone PATH still wins (above); the gate only
+    // suppresses the AUTO-discovery tier. HQ mode (preferences.library.
+    // mode === 'remote') keeps today's behaviour because there the auto-
+    // discovery IS the desired behaviour — the operator owns every vault
+    // the scan can find. See packages/core/src/vault/mode.mjs.
+    const soloGate = overrides.isSoloMode
+      ? overrides.isSoloMode({ repoRoot: paths.root })
+      : isSoloMode({ repoRoot: paths.root });
+    if (soloGate) {
+      console.error(`notice: solo mode - canonical-clone auto-discovery is off for scope '${paths.scope}'. Workspace-only write. Pass --canonical-clone PATH to force a dual-write.`);
     } else {
-      // Absence notice — never a failure. Explains WHY nothing resolved so
-      // an operator on a host without a canonical layout knows whether to
-      // provision one, pass --no-canonical to silence, or ignore.
-      const tail = resolved.tried && resolved.tried.length > 0
-        ? ` (tried: ${resolved.tried.join('; ')})`
-        : '';
-      console.error(`notice: no canonical clone configured for scope '${paths.scope}' on this host — workspace-only write${tail}`);
+      const resolved = overrides.resolveCanonicalCloneTarget
+        ? overrides.resolveCanonicalCloneTarget({ scope: paths.scope, home: canonicalHome, env: overrides.env })
+        : resolveCanonicalCloneTarget({ scope: paths.scope, home: canonicalHome, env: overrides.env });
+      if (resolved.file) {
+        effectiveCanonical = { file: resolved.file, source: resolved.source, detail: resolved.detail };
+      } else {
+        // Absence notice — never a failure. Explains WHY nothing resolved so
+        // an operator on a host without a canonical layout knows whether to
+        // provision one, pass --no-canonical to silence, or ignore.
+        const tail = resolved.tried && resolved.tried.length > 0
+          ? ` (tried: ${resolved.tried.join('; ')})`
+          : '';
+        console.error(`notice: no canonical clone configured for scope '${paths.scope}' on this host — workspace-only write${tail}`);
+      }
     }
   }
 

package/dist/engineering-pa-cli/src/secrets/vault.mjs

@@ -16,6 +16,8 @@ import { join, dirname, resolve, basename, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { mkdtempSync } from 'node:fs';
 import { tmpdir } from 'node:os';
+import { isSoloMode } from '../../../engineering-pa-core/src/vault/mode.mjs';
+import { resolveKeyFile as coreResolveKeyFile } from '../../../engineering-pa-core/src/vault/require.mjs';
 
 // ── Path resolution ──────────────────────────────────────────────────
 
@@ -155,8 +157,34 @@ export function defaultPaths(overrides = {}) {
       allowGitRootWithoutVault: overrides.allowGitRootWithoutVault,
     }).root;
   const home = overrides.home ?? homedir();
+  // Pass caller-supplied env only. The resolver treats undefined env as
+  // empty (no SOPS_AGE_KEY_FILE consulted) so `defaultPaths` under a
+  // test harness that never passed `env` is never subject to a leaked
+  // env-override from the developer's shell. Real CLI invocations
+  // thread `env: process.env` in via `main()` in cli.mjs.
+  const env = overrides.env;
   const vaultDir = overrides.vaultDir ?? join(root, '.vault');
-  const keyDir = overrides.keyDir ?? join(home, '.config', 'stravica-pa');
+  // 0.1.51 fix round 2 (w-2026-09-18-dave-007): the key file resolves
+  // through the ONE shared resolver in core/vault so init, get, set,
+  // status, requireVault, and the atlassian resolver all agree on the
+  // active key path. Solo mode → in-instance `.vault/age-key.txt`;
+  // HQ mode → per-user `~/.config/stravica-pa/age-key.txt`; explicit
+  // `SOPS_AGE_KEY_FILE` env override always wins. Callers that hand-
+  // craft `overrides.keyFile` or `overrides.keyDir` bypass the resolver
+  // entirely so the existing test helpers keep their isolated key dir.
+  let keyFile;
+  let keyDir;
+  if (overrides.keyFile) {
+    keyFile = overrides.keyFile;
+    keyDir = overrides.keyDir ?? dirname(keyFile);
+  } else if (overrides.keyDir) {
+    keyDir = overrides.keyDir;
+    keyFile = join(keyDir, 'age-key.txt');
+  } else {
+    const keyResolved = coreResolveKeyFile({ repoRoot: root, home, env, mode: overrides.mode });
+    keyFile = keyResolved.keyFile;
+    keyDir = dirname(keyFile);
+  }
   return {
     root,
     vaultDir,
@@ -164,7 +192,7 @@ export function defaultPaths(overrides = {}) {
     recipientsFile: join(vaultDir, 'recipients.txt'),
     sopsConfig: join(vaultDir, '.sops.yaml'),
     keyDir,
-    keyFile: join(keyDir, 'age-key.txt'),
+    keyFile,
     // Retained on the paths object so downstream consumers (canonical-
     // clone auto-discovery in commands/set.mjs) can honour the SAME home
     // the caller injected, instead of falling back to the real user's
@@ -208,12 +236,26 @@ function scopeError(message, exitCode = 1) {
  */
 export function resolveScopePaths(opts = {}) {
   const home = opts.home ?? homedir();
-  const keyDir = opts.keyDir ?? join(home, '.config', 'stravica-pa');
-  const keyFile = opts.keyFile ?? join(keyDir, 'age-key.txt');
+  // See defaultPaths above — env is threaded from the CLI entry point,
+  // never defaulted to process.env at this layer, so a test harness
+  // that never passed env does not inherit SOPS_AGE_KEY_FILE.
+  const env = opts.env;
 
   if (opts.file) {
     const secretsFile = resolve(opts.file);
     const vaultDir = dirname(secretsFile);
+    // --file bypasses workspace resolution: there is no instance to
+    // detect solo/HQ mode from. The env override still wins; otherwise
+    // fall back to the per-user path (unchanged 0.1.50 behaviour). A
+    // caller that wants the in-instance key file explicitly can pass
+    // `keyFile` here or via SOPS_AGE_KEY_FILE.
+    const envOverride = env && typeof env.SOPS_AGE_KEY_FILE === 'string' && env.SOPS_AGE_KEY_FILE.length > 0
+      ? env.SOPS_AGE_KEY_FILE
+      : null;
+    const keyFile = opts.keyFile
+      ?? envOverride
+      ?? join(opts.keyDir ?? join(home, '.config', 'stravica-pa'), 'age-key.txt');
+    const keyDir = opts.keyDir ?? dirname(keyFile);
     return {
       root: vaultDir,
       vaultDir,
@@ -237,6 +279,10 @@ export function resolveScopePaths(opts = {}) {
   }
 
   const { root } = resolveWorkspaceRoot({ cwd: opts.cwd, env: opts.env, home: opts.home });
+  // 0.1.51 fix round 2: the ONE shared resolver, same as defaultPaths.
+  const keyResolved = coreResolveKeyFile({ repoRoot: root, home, env, mode: opts.mode });
+  const keyFile = opts.keyFile ?? keyResolved.keyFile;
+  const keyDir = opts.keyDir ?? dirname(keyFile);
   const workspaceDir = join(root, '.vault', 'scopes');
   const workspaceFile = join(workspaceDir, `${opts.scope}.enc.json`);
   const canonicalDir = join(root, 'vault');
@@ -524,6 +570,43 @@ export function resolveDefaultScope(opts = {}) {
     return { scope: env.SECRETS_DEFAULT_SCOPE.trim(), source: 'env', detail: 'SECRETS_DEFAULT_SCOPE env var' };
   }
 
+  // Solo-mode gate (0.1.51 fix round, w-2026-09-18-dave-007). On a
+  // colleague laptop that carries ANOTHER estate's `defaultScope` in
+  // ~/.config/stravica-pa/defaults.json (or an agents/<name>/identity.json
+  // authored by a teammate), a fresh solo instance's `secrets init` seeds
+  // the legacy `.vault/secrets.enc.json` while a subsequent bare
+  // `secrets get` follows the resolver into `.vault/scopes/<scope>.enc.json`
+  // — a scope this instance never created — and the credentialed tools
+  // fail on "could not read JIRA_DOMAIN". In solo mode we therefore
+  // ignore both the defaults.json AND identity.json branches so init,
+  // get, set, status and the atlassian resolver all agree on the
+  // instance's own legacy vault. HQ mode (`library.mode === 'remote'`)
+  // is unchanged: the scoped estate vault IS what tools should target.
+  //
+  // Explicit `SECRETS_DEFAULT_SCOPE` (above) always wins in every mode
+  // — an env-var override is a caller decision and never gets rewritten.
+  //
+  // repoRoot resolution is silent: an explicit `opts.repoRoot` wins,
+  // else a quiet walk from cwd looks for the vault-bearing workspace
+  // marker (`.vault/` or `vault/*.enc.json`). No stderr notice, no
+  // throw — a caller outside any workspace (unusual, but possible in
+  // ad-hoc test setups) falls through to the pre-gate behaviour so the
+  // rest of the resolver stays testable in isolation.
+  let repoRoot = opts.repoRoot ?? null;
+  if (!repoRoot) {
+    try {
+      const { root: walked } = walkForWorkspace(cwd);
+      if (walked) repoRoot = walked;
+    } catch {
+      repoRoot = null;
+    }
+  }
+  const soloModeImpl = opts.isSoloMode ?? isSoloMode;
+  const inSoloMode = repoRoot ? soloModeImpl({ repoRoot }) : false;
+  if (inSoloMode) {
+    return { scope: null, source: null, detail: null };
+  }
+
   const defaults = readDefaultsDefaultScope(home);
   if (defaults.scope) {
     return { scope: defaults.scope, source: 'defaults', detail: defaults.file };