halfcycle 0.3.18 → 0.3.20

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "halfcycle",
-  "version": "0.3.18",
+  "version": "0.3.20",
   "description": "Halfcycle Method bundle — resolution-stub slash commands, remote method-delivery registration, and governance-hook wiring for a Halfcycle engagement repo. It ships NO worker role files: a project's roles are authored from that project's own recorded decisions at orchestration kickoff (FX-2, W3-F-27).",
   "commands": [
     {

package/README.md

@@ -42,7 +42,7 @@ A method document cannot fix that, because a document cannot interrupt you. This
 
 Credit where it is due, and it is due. GStack, Matt Pocock's skills, GitHub Spec Kit, BMAD, OpenSpec and claude-flow are genuinely good, and between them they taught this whole category that the bottleneck is discipline rather than model intelligence. We took two things from them deliberately and say so: the one-question-at-a-time interrogation shape, and an install that is one command and then stays out of your way.
 
-If you are one person on a two week project, install one of those instead. They are excellent at exactly that, and you may not need any of this yet.
+The objection this usually meets is that it must be too much for a small project. It would be, if there were one setting. A folder you download has exactly one, so whoever wrote it had to choose who to disappoint, and it is usually the small project that gets buried and quietly drops the process in week three. This reads the work instead and sizes itself to it, which is the section further down.
 
 Writing the process down was never the hard part. What a folder you download structurally cannot have is these four things.
 

package/bin/bin.bundle.mjs

@@ -39,6 +39,9 @@ function readConfig() {
     }
   };
 }
+function readNeverConfiguredReason() {
+  return process.env["HALFCYCLE_NOT_THIS_ACCOUNT"] === "1" ? "not-this-account" : "no-credential-yet";
+}
 function readExcerptConfig() {
   const raw = process.env["HALFCYCLE_SOURCE_EXCERPTS"];
   const enabled = (raw ?? "").trim().toLowerCase() === "true";
@@ -14781,6 +14784,8 @@ function renderPhaseSegment(identity) {
   return `${PHASE_SEGMENT_PREFIX}${identity}`;
 }
 function describeIdentity(identity) {
+  if (identity === "")
+    return "(empty)";
   if (typeof identity === "string")
     return identity;
   if (identity === null)
@@ -16194,8 +16199,8 @@ This is not a service outage: the guard service answered. The suspect is this re
 }
 var UNCONFIGURED_EXIT_TOOL_USE = 2;
 var UNCONFIGURED_EXIT_STOP_FAMILY = 1;
-function emitNeverConfigured(missing, exitCode) {
-  writeSync(2, neverConfiguredMessage(missing, HOOK_REMEDY));
+function emitNeverConfigured(missing, exitCode, reason) {
+  writeSync(2, neverConfiguredReport(missing, reason));
   process.exitCode = exitCode;
 }
 var HOOK_REMEDY = `Fix it by running "npx halfcycle" in this repository: it may open your browser to sign in first, then writes this engagement's credentials to ~/.halfcycle \u2014 outside the repository \u2014 and the hook loads them itself.`;
@@ -16207,6 +16212,18 @@ This is not a service outage. It means the guard has never run here \u2014 not o
 ${remedy}
 `;
 }
+function notThisAccountReport(label) {
+  return `${label} This project belongs to another Halfcycle account. Halfcycle is Solo today \u2014 one person works on a project at a time \u2014 so no credential exists for this machine and none will be issued. Nothing here needs fixing; this copy simply is not checked. Ask the project's owner for view access, or \u2014 if this account is wrong \u2014 sign in as the one that owns the project and run "npx halfcycle" again.
+`;
+}
+function neverConfiguredReport(missing, reason, label = "[Halfcycle]") {
+  switch (reason) {
+    case "no-credential-yet":
+      return neverConfiguredMessage(missing, HOOK_REMEDY, label);
+    case "not-this-account":
+      return notThisAccountReport(label);
+  }
+}
 var CREDENTIAL_REJECTED_STATUSES = /* @__PURE__ */ new Set([401, 403]);
 function classifyFailure(failure) {
   if (failure.kind === "contract-error") {
@@ -16430,7 +16447,7 @@ async function runPostToolUse() {
   const configResult = readConfig();
   if (!configResult.config) {
     await emitRunRecord({ runType: "hook", outcome: "unconfigured", changeSet });
-    emitNeverConfigured(configResult.missing, UNCONFIGURED_EXIT_TOOL_USE);
+    emitNeverConfigured(configResult.missing, UNCONFIGURED_EXIT_TOOL_USE, readNeverConfiguredReason());
     return;
   }
   const { guardServiceUrl, guardServiceToken, guardEngagementId } = configResult.config;
@@ -16696,7 +16713,7 @@ async function runSessionDiff(input, kind) {
   const configResult = readConfig();
   if (!configResult.config) {
     await emitRunRecord({ runType: "hook", outcome: "unconfigured", changeSet, diffBase });
-    emitNeverConfigured(configResult.missing, UNCONFIGURED_EXIT_STOP_FAMILY);
+    emitNeverConfigured(configResult.missing, UNCONFIGURED_EXIT_STOP_FAMILY, readNeverConfiguredReason());
     return;
   }
   const { guardServiceUrl, guardServiceToken, guardEngagementId } = configResult.config;

package/dist/bin.js

@@ -441,11 +441,26 @@ function loopbackVerificationUrl(verificationUrl, target) {
   return url.toString();
 }
 
-// ../events/dist/account-identity.js
+// ../events/dist/join-refusal.js
 import { z as z7 } from "zod";
-var accountIdentitySchema = z7.object({
-  accountId: z7.string().min(1),
-  email: z7.string().min(1).optional()
+var NOT_THIS_ACCOUNT_REASON = "not-this-account";
+var JOIN_REFUSAL_STATUS = 403;
+var notThisAccountRefusalSchema = z7.object({
+  statusCode: z7.literal(JOIN_REFUSAL_STATUS),
+  error: z7.string(),
+  message: z7.string(),
+  reason: z7.literal(NOT_THIS_ACCOUNT_REASON)
+}).strict();
+var joinRefusalSchema = z7.union([notThisAccountRefusalSchema, wireErrorSchema]);
+function isNotThisAccountRefusal(body) {
+  return typeof body === "object" && body !== null && body.reason === NOT_THIS_ACCOUNT_REASON;
+}
+
+// ../events/dist/account-identity.js
+import { z as z8 } from "zod";
+var accountIdentitySchema = z8.object({
+  accountId: z8.string().min(1),
+  email: z8.string().min(1).optional()
 }).strict();
 function safeParseAccountIdentity(payload) {
   return accountIdentitySchema.safeParse(payload);
@@ -495,6 +510,8 @@ function renderPhaseSegment(identity) {
   return `${PHASE_SEGMENT_PREFIX}${identity}`;
 }
 function describeIdentity(identity) {
+  if (identity === "")
+    return "(empty)";
   if (typeof identity === "string")
     return identity;
   if (identity === null)
@@ -595,6 +612,18 @@ function engagementStateDir(engagementId, home) {
 function engagementEnvPath(engagementId, home) {
   return join2(engagementStateDir(engagementId, home), ENV_FILENAME);
 }
+var NOT_THIS_ACCOUNT_MARKER_FILENAME = "not-this-account";
+function notThisAccountMarkerPath(engagementId, home) {
+  return join2(engagementStateDir(engagementId, home), NOT_THIS_ACCOUNT_MARKER_FILENAME);
+}
+function writeNotThisAccountMarker(engagementId, home) {
+  const dir = engagementStateDir(engagementId, home);
+  mkdirSync2(dir, { recursive: true, mode: 448 });
+  const path = notThisAccountMarkerPath(engagementId, home);
+  writeFileSync2(path, `${(/* @__PURE__ */ new Date()).toISOString()}
+`, { mode: 384 });
+  applyOwnerOnly(path, dir);
+}
 var GUARD_ENV_KEYS = [
   "GUARD_SERVICE_URL",
   "GUARD_SERVICE_TOKEN",
@@ -736,14 +765,15 @@ function engagementResolutionShell() {
 # desktop session's PATH, so the id is cut out with sed \u2014 after flattening the
 # file, because sed is line-oriented and the pin's line breaks are not a contract.
 #
-# Sets HALFCYCLE_ENV_FILE, HALFCYCLE_ENV_ENGAGEMENT and HALFCYCLE_ENV_PROBLEM in
-# the CALLER's shell and returns a status. Call it as \`if halfcycle_env_file \u2026\`,
-# never as \`$(halfcycle_env_file \u2026)\` \u2014 a command substitution is a subshell and
-# would discard everything it set.
+# Sets HALFCYCLE_ENV_FILE, HALFCYCLE_ENV_ENGAGEMENT, HALFCYCLE_ENV_PROBLEM and
+# HALFCYCLE_ENV_NOT_THIS_ACCOUNT in the CALLER's shell and returns a status. Call
+# it as \`if halfcycle_env_file \u2026\`, never as \`$(halfcycle_env_file \u2026)\` \u2014 a
+# command substitution is a subshell and would discard everything it set.
 halfcycle_env_file() {
   HALFCYCLE_ENV_FILE=""
   HALFCYCLE_ENV_ENGAGEMENT=""
   HALFCYCLE_ENV_PROBLEM=""
+  HALFCYCLE_ENV_NOT_THIS_ACCOUNT=""
   hc_pin="$1/.halfcycle/bundle.json"
   if [ ! -f "$hc_pin" ]; then
     HALFCYCLE_ENV_PROBLEM="no-pin"
@@ -759,6 +789,9 @@ halfcycle_env_file() {
     HALFCYCLE_ENV_PROBLEM="no-home"
     return 1
   fi
+  if [ -f "$HOME/.halfcycle/${ENGAGEMENTS_DIR}/$hc_id/${NOT_THIS_ACCOUNT_MARKER_FILENAME}" ]; then
+    HALFCYCLE_ENV_NOT_THIS_ACCOUNT=1
+  fi
   hc_env="$HOME/.halfcycle/${ENGAGEMENTS_DIR}/$hc_id/${ENV_FILENAME}"
   if [ ! -f "$hc_env" ]; then
     HALFCYCLE_ENV_PROBLEM="no-credential"
@@ -1130,6 +1163,13 @@ if halfcycle_env_file "$PROJECT_DIR"; then
   set +a
 fi
 
+# Pass along WHY this machine has no credential, as a plain variable \u2014 the
+# marker check above already answered it, and this is the one bit of that
+# answer the runner binary needs to say the right thing on every edit.
+if [ "$HALFCYCLE_ENV_NOT_THIS_ACCOUNT" = "1" ]; then
+  export HALFCYCLE_NOT_THIS_ACCOUNT=1
+fi
+
 exec node "$PROJECT_DIR/${VENDORED_BIN_REL}" "$@"
 `;
 }
@@ -1145,13 +1185,20 @@ MARKER_FILE="\${TMPDIR%/}/halfcycle-session-\${HASH}.ref"
 git -C "$REPO_ROOT" rev-parse HEAD > "$MARKER_FILE" 2>/dev/null || true
 
 # ---------------------------------------------------------------------------
-# STANDING GUARD-COVERAGE STATEMENT (T-27).
+# STANDING GUARD-COVERAGE STATEMENT (T-27; two arms since T-02b).
 #
 # A repository with no credential on this machine is UNGUARDED: the PostToolUse
 # hook will find nothing to evaluate with, and it says so once per edit, after
 # the edit. This says it once, up front, before anything is written \u2014 which is
 # the one thing a session-start hook can do that nothing else can.
 #
+# TWO REASONS TO HAVE NO CREDENTIAL, TWO DIFFERENT THINGS TO SAY (T-02b,
+# solo-project-ownership \u2014 outcome B). "You have not signed in here yet" is
+# fixed by re-running the installer; "this is not your project" is permanent,
+# and the same remedy would send the reader in a circle forever. The two are
+# told apart by HALFCYCLE_ENV_NOT_THIS_ACCOUNT, set by \`halfcycle_env_file\`
+# below from a machine-level marker beside the credential store.
+#
 # Everything below runs in a SUBSHELL: it sources a credential store, and a
 # session-start hook must not leak an engagement's variables into whatever the
 # editor runs next. Any failure inside it is swallowed; this script's exit
@@ -1165,18 +1212,33 @@ ${engagementResolutionShell()}
     . "$HALFCYCLE_ENV_FILE"
     set +a
   fi
-  hc_missing=""
-  for hc_key in ${GUARD_COVERAGE_REQUIRED_KEYS.join(" ")}; do
-    eval "hc_value=\\\${$hc_key:-}"
-    if [ -z "$hc_value" ]; then hc_missing="$hc_missing $hc_key"; fi
-  done
-  if [ -n "$hc_missing" ]; then
-    echo "[halfcycle] NO GUARD COVERAGE IN THIS REPOSITORY. Nothing will evaluate the edits made in"
-    echo "[halfcycle] this session: this machine has no Halfcycle credential for it, so the guard hook"
-    echo "[halfcycle] has nothing to call with (missing:$hc_missing)."
-    echo "[halfcycle] Run \\"npx halfcycle\\" in this repository to fix it \u2014 it signs you in through your"
-    echo "[halfcycle] browser if needed, writes the credential to \\$HOME/.halfcycle outside this tree,"
-    echo "[halfcycle] and needs nothing configured first."
+  if [ "$HALFCYCLE_ENV_NOT_THIS_ACCOUNT" = "1" ]; then
+    # OUTCOME B (T-02b, solo-project-ownership). This is not the missing-keys
+    # case below wearing different words: there is nothing to fix, and the loop
+    # that follows is skipped entirely rather than run and then overridden \u2014 a
+    # repository whose credential is absent for THIS reason must never be told
+    # to re-run the installer, which can never obtain one for it.
+    echo "[halfcycle] This project belongs to another Halfcycle account, so nothing here is checked."
+    echo "[halfcycle] Your work carries on exactly as it would without Halfcycle \u2014 no edit is"
+    echo "[halfcycle] evaluated, and nothing you do is reported as having passed."
+    echo "[halfcycle] Halfcycle is Solo today \u2014 one developer per project \u2014 with Team plans coming."
+    echo "[halfcycle] Ask the project's owner for view access."
+    echo "[halfcycle] If this account is wrong, sign in as the one that owns the project and run"
+    echo "[halfcycle] \\"npx halfcycle\\" again."
+  else
+    hc_missing=""
+    for hc_key in ${GUARD_COVERAGE_REQUIRED_KEYS.join(" ")}; do
+      eval "hc_value=\\\${$hc_key:-}"
+      if [ -z "$hc_value" ]; then hc_missing="$hc_missing $hc_key"; fi
+    done
+    if [ -n "$hc_missing" ]; then
+      echo "[halfcycle] NO GUARD COVERAGE IN THIS REPOSITORY. Nothing will evaluate the edits made in"
+      echo "[halfcycle] this session: this machine has no Halfcycle credential for it, so the guard hook"
+      echo "[halfcycle] has nothing to call with (missing:$hc_missing)."
+      echo "[halfcycle] Run \\"npx halfcycle\\" in this repository to fix it \u2014 it signs you in through your"
+      echo "[halfcycle] browser if needed, writes the credential to \\$HOME/.halfcycle outside this tree,"
+      echo "[halfcycle] and needs nothing configured first."
+    fi
   fi
 ) 2>/dev/null || true
 exit 0
@@ -1336,8 +1398,20 @@ if [ -z "$TOKEN" ]; then
       no-home)
         echo "halfcycle: HOME is not set, so the credential store cannot be located." >&2 ;;
       *)
-        echo "halfcycle: this machine holds no credential for engagement $HALFCYCLE_ENV_ENGAGEMENT." >&2
-        echo "halfcycle: run \\"npx halfcycle\\" in this repository \u2014 it will sign you in through your browser if needed, and write the credential to $HOME/.halfcycle, outside this repository." >&2 ;;
+        # OUTCOME B (T-02b, solo-project-ownership) is a \`no-credential\` PROBLEM
+        # with a REASON attached, checked here rather than as a fifth case value
+        # \u2014 see \`engagementResolutionShell\`'s own docblock for why. Re-running
+        # this installer can never obtain a credential for this reason, so it is
+        # the one sentence in this file that must not say to.
+        if [ "$HALFCYCLE_ENV_NOT_THIS_ACCOUNT" = "1" ]; then
+          echo "halfcycle: this project belongs to another Halfcycle account, so this machine has no" >&2
+          echo "halfcycle: credential for it and the Halfcycle tools are not available here. Nothing is" >&2
+          echo "halfcycle: broken \u2014 ask the project's owner for view access, or sign in as the account" >&2
+          echo "halfcycle: that owns it and run \\"npx halfcycle\\" again." >&2
+        else
+          echo "halfcycle: this machine holds no credential for engagement $HALFCYCLE_ENV_ENGAGEMENT." >&2
+          echo "halfcycle: run \\"npx halfcycle\\" in this repository \u2014 it will sign you in through your browser if needed, and write the credential to $HOME/.halfcycle, outside this repository." >&2
+        fi ;;
     esac
     exit 1
   fi
@@ -2142,11 +2216,13 @@ var CreateEngagementRefused = class extends Error {
   status;
   serverMessage;
   errorCode;
-  constructor(status, serverMessage, errorCode, message) {
+  reason;
+  constructor(status, serverMessage, errorCode, reason, message) {
     super(message);
     this.status = status;
     this.serverMessage = serverMessage;
     this.errorCode = errorCode;
+    this.reason = reason;
     this.name = "CreateEngagementRefused";
   }
   /**
@@ -2191,7 +2267,8 @@ function planeRefusal(detail) {
     return void 0;
   return {
     message: candidate.message,
-    error: typeof candidate.error === "string" ? candidate.error : void 0
+    error: typeof candidate.error === "string" ? candidate.error : void 0,
+    reason: typeof candidate.reason === "string" ? candidate.reason : void 0
   };
 }
 var CONTROL_ORIGIN_HINT = `This CLI talks to ${DEFAULT_CONTROL_ORIGIN}; it must be the CONTROL origin \u2014 the one that serves /engagements and /board/enter-codes. The MCP server runs at a different address, and the platform supplies that one itself; you configure neither.`;
@@ -2232,7 +2309,7 @@ async function requestEngagementValues(url, requestBody, credential, shape) {
     const detail = await res.text().catch(() => "");
     const refusal = res.status === 404 ? void 0 : planeRefusal(detail);
     if (refusal) {
-      throw new CreateEngagementRefused(res.status, refusal.message, refusal.error, `[bundle install] ${shape.action} failed: ${url} returned ${res.status}. ${refusal.message} ${shape.nothingHappened}.`);
+      throw new CreateEngagementRefused(res.status, refusal.message, refusal.error, refusal.reason, `[bundle install] ${shape.action} failed: ${url} returned ${res.status}. ${refusal.message} ${shape.nothingHappened}.`);
     }
     const wrongOrigin = res.status === 404 ? `That address answered, but it does not serve ${shape.route} \u2014 so it is not the Halfcycle service. ` : "";
     throw new Error(`[bundle install] ${shape.action} failed: ${url} returned ${res.status}. ${wrongOrigin}${detail ? `Response: ${detail.slice(0, 300)}. ` : ""}${shape.nothingHappened}. ` + CONTROL_ORIGIN_HINT);
@@ -2622,6 +2699,9 @@ function accountLabel(identity, storedAccountId, verbose2 = false) {
     return `account ${accountId} (no email on record for it)`;
   return "the account this credential belongs to, which this service did not name";
 }
+function isInteractiveRun(env = process.env) {
+  return process.stdin.isTTY === true && !isNonInteractive(env);
+}
 function onlyDate(iso) {
   if (iso === void 0)
     return void 0;
@@ -2650,7 +2730,9 @@ function readDecision(answer) {
 }
 function actingAs(credential, identity) {
   const accountId = identity?.accountId ?? credential.accountId;
-  return accountId === void 0 ? credential : { ...credential, accountId };
+  if (accountId === void 0 && identity === void 0)
+    return credential;
+  return { ...credential, ...accountId !== void 0 ? { accountId } : {}, identity };
 }
 function question(colour) {
   return `[halfcycle] Continue as that account?  ${ink("good", "[y]", colour)} yes   ${ink("key", "[s]", colour)} sign in as someone else   ${ink("faint", "[anything else]", colour)} stop: `;
@@ -2713,6 +2795,10 @@ function armScript(credential, act, label, plainLabel, home) {
     }
   }
 }
+function identitySwitchRemedy(home, interactive) {
+  const setOrRemove = `set HALFCYCLE_TOKEN for that account, or remove ${accountStorePath(home)}`;
+  return interactive ? `To act as a different account: run this again and answer "s" when asked, ${setOrRemove} to be asked for a sign-in next time.` : `To act as a different account: ${setOrRemove} and run this again with a terminal to sign in.`;
+}
 async function confirmActingIdentity(serviceUrl, credential, act, deps = {}) {
   const write = deps.write ?? ((text) => process.stdout.write(text));
   const colour = deps.colour ?? decideColour({ isTTY: process.stdout.isTTY === true, env: deps.env ?? process.env });
@@ -2729,7 +2815,7 @@ async function confirmActingIdentity(serviceUrl, credential, act, deps = {}) {
 `);
     return acting;
   }
-  const interactive = deps.interactive ?? (process.stdin.isTTY === true && !isNonInteractive(deps.env));
+  const interactive = deps.interactive ?? isInteractiveRun(deps.env);
   if (!interactive) {
     if (script.noTerminalNote !== "")
       write(script.noTerminalNote);
@@ -2778,13 +2864,19 @@ function deriveProjectName(targetRepoRoot) {
 }
 
 // dist/own-engagement.js
+function isOutcomeBRefusal(result) {
+  return "outcome" in result && result.outcome === "not-this-account";
+}
 async function createOwnedEngagement(serviceUrl, targetRepo, deps = {}) {
   let credential = await confirmActingIdentity(serviceUrl, await obtainCredential(serviceUrl, deps), { kind: "create", targetRepo }, deps);
   for (; ; ) {
     try {
       return {
         ...await createEngagement(serviceUrl, void 0, credential.credential, deriveProjectName(targetRepo)),
-        actingAccountId: credential.accountId
+        actingAccountId: credential.accountId,
+        // Carried from `confirmActingIdentity`'s own fetch (`ResolvedCredential.identity`'s
+        // docblock) — `bin.ts`'s final report reuses this instead of asking again.
+        actingIdentity: credential.identity
       };
     } catch (err) {
       if (!(err instanceof CreateEngagementRefused) || !err.authRefused)
@@ -2806,12 +2898,21 @@ async function joinPinnedEngagement(serviceUrl, engagementId, targetRepo, deps =
     try {
       return {
         ...await joinEngagement(serviceUrl, engagementId, credential.credential),
-        actingAccountId: credential.accountId
+        actingAccountId: credential.accountId,
+        // Same reuse as the create path above — see its comment.
+        actingIdentity: credential.identity
       };
     } catch (err) {
       if (!(err instanceof CreateEngagementRefused))
         throw err;
       if (err.status === 403) {
+        if (isNotThisAccountRefusal({ reason: err.reason })) {
+          return {
+            outcome: "not-this-account",
+            message: err.serverMessage,
+            actingAccountId: credential.accountId
+          };
+        }
         throw new SignInRefused(`join-${err.status}`, `${err.serverMessage} ${JOIN_REFUSED_LOCAL_REMEDY}`);
       }
       if (err.status !== 401) {
@@ -3806,7 +3907,9 @@ ${USAGE}`);
       const reusable = pinned !== null && pinned.engagementId === requestedId ? pinned.credential : void 0;
       let engagementId;
       let credential;
+      let notThisAccountMessage;
       let actingAccountId;
+      let actingIdentity;
       let foundLine = "";
       if (reusable !== void 0 && pinned !== null) {
         engagementId = pinned.engagementId;
@@ -3826,27 +3929,38 @@ ${USAGE}`);
         }
       } else if (requestedId !== void 0) {
         const joined = await joinPinnedEngagement(serviceUrl, requestedId, targetRepo, { assumeYes, verbose });
-        engagementId = joined.engagementId;
-        actingAccountId = joined.actingAccountId;
-        credential = {
-          serviceUrl,
-          token: joined.sessionToken,
-          mcpUrl: joined.mcpUrl,
-          guardUrl: joined.guardUrl,
-          // T-10 — optional; absent on a plane that has not configured
-          // CONTROL_TELEMETRY_URL yet. `writeEngagementCredential` writes '' for
-          // an absent value, never `undefined` verbatim.
-          controlTelemetryUrl: joined.controlTelemetryUrl
-        };
-        foundLine = `this repo is pinned to a shared project \u2014 joining it as you (${shortId(joined.engagementId)})`;
-        if (verbose) {
-          process.stdout.write(`[halfcycle] Joined engagement ${joined.engagementId} \u2014 this credential is yours. Everyone else's keeps working; nobody was signed out and nothing was pasted.
+        if (isOutcomeBRefusal(joined)) {
+          engagementId = requestedId;
+          actingAccountId = joined.actingAccountId;
+          credential = void 0;
+          notThisAccountMessage = joined.message;
+          foundLine = `this repo is pinned to a project that belongs to a different Halfcycle account`;
+          writeNotThisAccountMarker(engagementId);
+        } else {
+          engagementId = joined.engagementId;
+          actingAccountId = joined.actingAccountId;
+          actingIdentity = joined.actingIdentity;
+          credential = {
+            serviceUrl,
+            token: joined.sessionToken,
+            mcpUrl: joined.mcpUrl,
+            guardUrl: joined.guardUrl,
+            // T-10 — optional; absent on a plane that has not configured
+            // CONTROL_TELEMETRY_URL yet. `writeEngagementCredential` writes '' for
+            // an absent value, never `undefined` verbatim.
+            controlTelemetryUrl: joined.controlTelemetryUrl
+          };
+          foundLine = `this repo is pinned to a shared project \u2014 joining it as you (${shortId(joined.engagementId)})`;
+        }
+        if (verbose && credential !== void 0) {
+          process.stdout.write(`[halfcycle] Joined engagement ${engagementId} \u2014 this credential is yours. Everyone else's keeps working; nobody was signed out and nothing was pasted.
 `);
         }
       } else {
         const created = await createOwnedEngagement(serviceUrl, targetRepo, { assumeYes, verbose });
         engagementId = created.engagementId;
         actingAccountId = created.actingAccountId;
+        actingIdentity = created.actingIdentity;
         credential = {
           serviceUrl,
           token: created.sessionToken,
@@ -3901,18 +4015,20 @@ ${USAGE}`);
 [halfcycle] ${missing.length === 1 ? "it" : "them"}) and re-run, and the credential moves out of the tree.
 `);
       }
-      const probe = await probeMcpOrigin(credential.mcpUrl);
-      if (probe.reached) {
-        if (verbose) {
-          process.stdout.write(`[halfcycle] Method delivery (MCP): ${credential.mcpUrl} \u2014 reachable (${probe.serverName})
+      if (credential) {
+        const probe = await probeMcpOrigin(credential.mcpUrl);
+        if (probe.reached) {
+          if (verbose) {
+            process.stdout.write(`[halfcycle] Method delivery (MCP): ${credential.mcpUrl} \u2014 reachable (${probe.serverName})
 `);
-        }
-      } else {
-        process.stdout.write(`[halfcycle] Method delivery (MCP): ${credential.mcpUrl} \u2014 NOT reachable: ${probe.problem}.
+          }
+        } else {
+          process.stdout.write(`[halfcycle] Method delivery (MCP): ${credential.mcpUrl} \u2014 NOT reachable: ${probe.problem}.
 [halfcycle] The Halfcycle commands will have no method context until that address answers. This is the SECOND of two origins and the platform supplied it, so it is not the CONTROL origin (${credential.serviceUrl}) that is wrong \u2014 that one just worked. It is recorded as HALFCYCLE_MCP_URL in this engagement's credential store; re-run this installer once the service is up.
 `);
+        }
       }
-      if (verbose) {
+      if (credential && verbose) {
         process.stdout.write(`[halfcycle] Guard evaluation: ON \u2014 the hook evaluates against ${credential.guardUrl}. Credentials (${GUARD_COVERAGE_REQUIRED_KEYS.join(", ")}) are in ${engagementEnvPath(engagementId)}, outside this repository; the hook loads them itself, so you do not export anything and nothing here can be committed.
 `);
         process.stdout.write(`[halfcycle] Your credential is at ${engagementEnvPath(engagementId)} \u2014 outside this repository, readable only by you. .mcp.json reads it at connection time through .halfcycle/mcp-headers.sh, so there is no token in this tree to commit and nothing for you to export.
@@ -3920,30 +4036,38 @@ ${USAGE}`);
         process.stdout.write(`[halfcycle] Expect a workspace trust prompt the first time you open this folder \u2014 the helper is a shell command, and Claude Code will not run it until you accept. Needs Claude Code ${MIN_HEADERS_HELPER_VERSION} or newer (${MIN_HEADER_ROTATION_VERSION}+ to re-authenticate a rotated token without restarting).
 `);
         process.stdout.write(`[halfcycle] If Halfcycle tools appear but every call returns 401, the helper could not read HALFCYCLE_TOKEN from ${engagementEnvPath(engagementId)} \u2014 re-run this installer.
+`);
+      }
+      if (credential === void 0 && notThisAccountMessage !== void 0) {
+        process.stdout.write(`[halfcycle] ${notThisAccountMessage} Your work carries on exactly as it would without Halfcycle: no edit is evaluated, and nothing you do here is reported as having passed. Ask the project's owner for view access. ${identitySwitchRemedy(void 0, isInteractiveRun())}
 `);
       }
       reportClaudeCodeVersion(verbose);
-      const identity = await describeAccount(credential.serviceUrl, credential.token);
+      const identity = actingIdentity ?? (credential ? await describeAccount(credential.serviceUrl, credential.token) : void 0);
       const written = result.writtenPaths.length;
       const merged = result.mergedPaths.length;
       process.stdout.write(`[halfcycle] Signed in as ${accountLabel(identity, actingAccountId, verbose)}
 `);
       process.stdout.write(`[halfcycle] Found: ${foundLine}
 `);
-      process.stdout.write(`[halfcycle] Set up: ${written} file${written === 1 ? "" : "s"} written${merged > 0 ? ` (${merged} merged)` : ""}, guards armed on every edit
+      process.stdout.write(`[halfcycle] Set up: ${written} file${written === 1 ? "" : "s"} written${merged > 0 ? ` (${merged} merged)` : ""}, ${credential ? "guards armed on every edit" : "not checked \u2014 this copy is not this account\u2019s project"}
 `);
-      process.stdout.write(`[halfcycle] Next: open this folder in Claude Code \u2014 accept the workspace-trust prompt, it is expected \u2014 then run /halfcycle-setup and answer what it asks about your project
+      if (credential) {
+        process.stdout.write(`[halfcycle] Next: open this folder in Claude Code \u2014 accept the workspace-trust prompt, it is expected \u2014 then run /halfcycle-setup and answer what it asks about your project
 `);
-      process.stdout.write(`[halfcycle] Claude Code will also ask permission the first time Halfcycle needs to look up your next step. Choose allow \u2014 without it nothing can run.
+        process.stdout.write(`[halfcycle] Claude Code will also ask permission the first time Halfcycle needs to look up your next step. Choose allow \u2014 without it nothing can run.
 `);
-      try {
-        const minted = await mintBoardEnterCode(credential.serviceUrl, credential.token);
-        process.stdout.write(`[halfcycle] Your project's page \u2014 how it is going, the agents working on it, and your other projects (first visit): ${minted.boardUrl}
+      }
+      if (credential) {
+        try {
+          const minted = await mintBoardEnterCode(credential.serviceUrl, credential.token);
+          process.stdout.write(`[halfcycle] Your project's page \u2014 how it is going, the agents working on it, and your other projects (first visit): ${minted.boardUrl}
 `);
-        process.stdout.write(`[halfcycle] First-visit code \u2014 single use, expires ${minted.expiresAt}; paste it on that page, and re-run this installer for a fresh one: ${minted.enterCode}
+          process.stdout.write(`[halfcycle] First-visit code \u2014 single use, expires ${minted.expiresAt}; paste it on that page, and re-run this installer for a fresh one: ${minted.enterCode}
 `);
-      } catch {
-        process.stdout.write("[halfcycle] Your project's page: no first-visit code was issued just now \u2014 re-run this installer to get one.\n");
+        } catch {
+          process.stdout.write("[halfcycle] Your project's page: no first-visit code was issued just now \u2014 re-run this installer to get one.\n");
+        }
       }
       process.exit(0);
     } catch (err) {
@@ -3988,13 +4112,14 @@ ${USAGE}`);
   if (cmd === "build-record") {
     const phaseArg = rest[0];
     const repoRoot = rest.includes("--repo") ? rest[rest.indexOf("--repo") + 1] : process.cwd();
-    if (!phaseArg) {
+    if (phaseArg === void 0) {
       process.stderr.write("halfcycle: usage: halfcycle build-record <phase> [--repo <root>]\n");
       process.exit(1);
       return;
     }
     const phaseId = phaseArg;
     try {
+      assertValidPhaseIdentity(phaseId, BUILD_RECORD_DIR);
       const inputPath = join11(repoRoot, BUILD_RECORD_ZONE_B_DIR, `${renderPhaseSegment(phaseId)}.input.json`);
       const input = JSON.parse(readFileSync9(inputPath, "utf-8"));
       const result = assemblePhaseBuildRecord({