halfcycle 0.3.22 → 0.3.24

package/dist/bin.js

@@ -30,6 +30,107 @@ var matcherSchema = z.discriminatedUnion("kind", [
   llmMatcherSchema
 ]);
 
+// ../core/dist/credential-format.js
+var HALFCYCLE_DIR_NAME = ".halfcycle";
+var ENGAGEMENTS_DIR_NAME = "engagements";
+var ENGAGEMENT_ENV_FILENAME = "env";
+var NOT_THIS_ACCOUNT_MARKER_FILENAME = "not-this-account";
+var ACCOUNT_STORE_FILENAME = "account.json";
+var ENGAGEMENT_ENV_HEADER = "# Halfcycle per-engagement credential \u2014 machine level, owner-only, never in a repository.";
+function shq(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function unquote(value) {
+  const v = value.trim();
+  if (v.length >= 2 && v.startsWith("'") && v.endsWith("'")) {
+    return v.slice(1, -1).split(`'\\''`).join(`'`);
+  }
+  if (v.length >= 2 && v.startsWith('"') && v.endsWith('"'))
+    return v.slice(1, -1);
+  return v;
+}
+function parseEnvText(raw) {
+  const out = {};
+  for (const line of raw.split("\n")) {
+    const eq = line.indexOf("=");
+    if (eq === -1)
+      continue;
+    const key = line.slice(0, eq).replace(/^\s*export\s+/, "").trim();
+    if (key === "" || key.startsWith("#"))
+      continue;
+    out[key] = unquote(line.slice(eq + 1));
+  }
+  return out;
+}
+function reconcileEnvText(existing, values, keys) {
+  const desired = new Map(keys.map((k) => {
+    const value = values[k];
+    return [k, value === void 0 ? "" : value];
+  }));
+  const line = (k) => `${k}=${shq(desired.get(k) ?? "")}`;
+  const written = keys.filter((k) => desired.get(k) !== null);
+  if (existing === null) {
+    if (written.length === 0)
+      return "";
+    return `${ENGAGEMENT_ENV_HEADER}
+` + written.map(line).join("\n") + "\n";
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const existingLine of existing.split("\n")) {
+    const eq = existingLine.indexOf("=");
+    if (eq === -1) {
+      out.push(existingLine);
+      continue;
+    }
+    const lhs = existingLine.slice(0, eq);
+    const exported = /^\s*export\s+/.exec(lhs);
+    const prefix = exported === null ? "" : exported[0];
+    const key = lhs.slice(prefix.length).trim();
+    if (!desired.has(key)) {
+      out.push(existingLine);
+      continue;
+    }
+    seen.add(key);
+    if (desired.get(key) === null)
+      continue;
+    out.push(`${prefix}${line(key)}`);
+  }
+  const missing = written.filter((k) => !seen.has(k));
+  if (missing.length > 0) {
+    const header = existing.includes(ENGAGEMENT_ENV_HEADER) ? "" : `${ENGAGEMENT_ENV_HEADER}
+`;
+    const block = header + missing.map(line).join("\n");
+    const trailingBlank = out.length > 0 && out[out.length - 1] === "";
+    if (trailingBlank)
+      out.splice(out.length - 1, 0, block);
+    else
+      out.push(`
+${block}`);
+  }
+  let result = out.join("\n");
+  if (existing.endsWith("\n") && !result.endsWith("\n"))
+    result += "\n";
+  return result;
+}
+function normaliseOrigin(serviceUrl) {
+  return serviceUrl.trim().replace(/\/+$/, "").toLowerCase();
+}
+function parseAccountStoreText(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || typeof parsed.accounts !== "object") {
+      return { version: 1, accounts: {} };
+    }
+    return {
+      version: 1,
+      accounts: parsed.accounts ?? {}
+    };
+  } catch {
+    return { version: 1, accounts: {} };
+  }
+}
+
 // ../events/dist/result.js
 var firedGuardSchema = z2.object({
   guardId: z2.string(),
@@ -90,7 +191,7 @@ var wireErrorSchema = z2.object({
 
 // ../events/dist/telemetry.js
 import { z as z3 } from "zod";
-var utcIso8601 = z3.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/, "must be a UTC ISO-8601 timestamp ending in Z (INV-015)");
+var utcIso8601 = z3.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/, "must be a UTC ISO-8601 timestamp ending in Z");
 var guardEvalOutcomeSchema = z3.enum([
   "evaluated",
   "infra-error",
@@ -146,7 +247,7 @@ var guardEvalRunSchema = z3.object({
 
 // ../events/dist/engagement-lifecycle.js
 import { z as z4 } from "zod";
-var utcIso86012 = z4.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/, "must be a UTC ISO-8601 timestamp ending in Z (INV-015)");
+var utcIso86012 = z4.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/, "must be a UTC ISO-8601 timestamp ending in Z");
 var engagementTypeSchema = z4.enum(["client"]);
 var lifecycleStatusSchema = z4.enum(["active", "delivering", "closed"]);
 var createEngagementRequestSchema = z4.object({
@@ -275,57 +376,371 @@ var openPhaseResponseSchema = z4.object({
   decision: phaseEntryDecisionRecordSchema
 }).strict();
 
-// ../events/dist/crew.js
+// ../events/dist/state.js
 import { z as z5 } from "zod";
-var crewGroupSchema = z5.enum(["builder", "reviewer", "always-on"]);
-var crewTierSchema = z5.enum(["deep", "standard", "fast"]);
+var utcIso86013 = z5.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/, "must be a UTC ISO-8601 timestamp ending in Z");
+var STATE_RECORD_FORMAT = "halfcycle-state-record/v1";
+var stepIdSchema = z5.string().regex(/^(l[0-5](-l[0-5])?|xl)\.[a-z0-9-]+$/);
+var methodVersionSchema = z5.string().regex(/^\d+\.\d+\.\d+$/);
+var anchorPathRegex = /^(?!\/)(?!.*#)(?!method\/)(?!(.*\/)?docs\/method\/).+$/;
+var recordKindSchema = z5.enum(["artefact", "step-run", "gate", "intervention"]);
+var methodLayerSchema = z5.enum(["l0", "l1", "l2", "l3", "l3-l4", "l4", "l5", "xl"]);
+var evidenceKindSchema = z5.enum(["anchor", "diff", "repro", "question-answer", "no-op"]);
+var declarableEvidenceKindSchema = z5.enum(["anchor", "diff", "repro", "question-answer"]);
+var dispositionSchema = z5.enum([
+  "prevented",
+  "corrected-in-spec",
+  "corrected-in-scope",
+  "blocked-in-code",
+  "flagged",
+  "auto-fixed",
+  "surfaced",
+  "filed-forward"
+]);
+var mechanismSchema = z5.enum(["guard", "verdict", "served-step", "method-step"]);
+var artefactStateSchema = z5.enum(["created", "updated"]);
+var QUALIFIED_OUTCOMES = ["declined", "parked"];
+var qualifiedOutcomeSchema = z5.enum(QUALIFIED_OUTCOMES);
+function isQualifiedOutcome(outcome) {
+  return QUALIFIED_OUTCOMES.includes(outcome);
+}
+var runOutcomeSchema = z5.enum([
+  "completed",
+  "attempted-failed",
+  ...QUALIFIED_OUTCOMES
+]);
+var gateKindSchema = z5.enum(["approval", "mechanical"]);
+var gateVerdictSchema = z5.enum(["pass", "fail", ...QUALIFIED_OUTCOMES]);
+function outcomeReasonIssue(outcome, reason) {
+  if (isQualifiedOutcome(outcome) && reason === void 0) {
+    return { message: `outcomeReason is required when the outcome is '${outcome}'` };
+  }
+  if (!isQualifiedOutcome(outcome) && reason !== void 0) {
+    return {
+      message: `outcomeReason is only present on a qualified outcome (${QUALIFIED_OUTCOMES.join(" | ")})`
+    };
+  }
+  return null;
+}
+var anchorEvidenceSchema = z5.object({
+  kind: z5.literal("anchor"),
+  path: z5.string().regex(anchorPathRegex),
+  // Optional 1-based line number within the file at `path`. Present when the
+  // writer knows the exact line; omitted — never `0`, never `null` — when it
+  // does not, because a line number is not always obtainable. Absence is a
+  // valid, permanent state here, not a gap meant to be filled in later.
+  line: z5.number().optional()
+}).strict();
+var diffEvidenceSchema = z5.object({
+  kind: z5.literal("diff"),
+  ref: z5.string()
+}).strict();
+var reproEvidenceSchema = z5.object({
+  kind: z5.literal("repro"),
+  steps: z5.string().max(2e3)
+}).strict();
+var questionAnswerEvidenceSchema = z5.object({
+  kind: z5.literal("question-answer"),
+  question: z5.string().max(2e3),
+  before: z5.string().max(2e3),
+  after: z5.string().max(2e3)
+}).strict();
+var noOpEvidenceSchema = z5.object({
+  kind: z5.literal("no-op"),
+  inspected: z5.string().max(2e3),
+  unchangedBecause: z5.string().max(2e3)
+}).strict();
+var evidenceSchema = z5.discriminatedUnion("kind", [
+  anchorEvidenceSchema,
+  diffEvidenceSchema,
+  reproEvidenceSchema,
+  questionAnswerEvidenceSchema,
+  noOpEvidenceSchema
+]);
+var stateRecordEnvelopeSchema = z5.object({
+  format: z5.literal(STATE_RECORD_FORMAT),
+  recordKind: recordKindSchema,
+  recordId: z5.string().uuid(),
+  methodVersion: methodVersionSchema,
+  engagementId: z5.string(),
+  stepId: stepIdSchema,
+  // Immutable: names when the thing happened, never when a later disposition
+  // moved.
+  occurredAt: utcIso86013,
+  // Equal to `occurredAt` on first write; advances on each re-emit OF A FINDING.
+  // Carried on the shared envelope so a "when did this last change" query is
+  // kind-agnostic. Kept rather than generalised to `updatedAt` because
+  // `disposition` is the only field any re-emit may change (§5.3).
+  dispositionAt: utcIso86013,
+  evidence: evidenceSchema,
+  // Which phase of the project this record belongs to, if any. Present on
+  // records written during phase-scoped work; absent on records that run once
+  // for the whole project rather than per phase. Absence is meaningful on its
+  // own — it is never replaced with a placeholder value, and it is read as
+  // "satisfies any phase", not as "unknown".
+  phase: z5.string().optional()
+});
+var artefactRefSchema = z5.object({
+  name: z5.string(),
+  parent: z5.string()
+}).strict();
+var artefactRecordSchema = stateRecordEnvelopeSchema.extend({
+  recordKind: z5.literal("artefact"),
+  artefactRef: artefactRefSchema,
+  // Some layer wrote it, by construction — an empty array is not a legitimate
+  // state, so the schema says so.
+  writtenByLayers: z5.array(methodLayerSchema).min(1),
+  state: artefactStateSchema
+}).strict();
+var stepRunRecordSchema = stateRecordEnvelopeSchema.extend({
+  recordKind: z5.literal("step-run"),
+  runOutcome: runOutcomeSchema,
+  failureReason: z5.string().optional(),
+  outcomeReason: z5.string().max(2e3).optional()
+}).strict().superRefine((rec, ctx) => {
+  if (rec.runOutcome === "attempted-failed" && rec.failureReason === void 0) {
+    ctx.addIssue({
+      code: z5.ZodIssueCode.custom,
+      path: ["failureReason"],
+      message: "failureReason is required when runOutcome is 'attempted-failed'"
+    });
+  }
+  if (rec.runOutcome !== "attempted-failed" && rec.failureReason !== void 0) {
+    ctx.addIssue({
+      code: z5.ZodIssueCode.custom,
+      path: ["failureReason"],
+      message: "failureReason is only present when runOutcome is 'attempted-failed'"
+    });
+  }
+  const issue = outcomeReasonIssue(rec.runOutcome, rec.outcomeReason);
+  if (issue) {
+    ctx.addIssue({ code: z5.ZodIssueCode.custom, path: ["outcomeReason"], ...issue });
+  }
+});
+var gateRecordSchema = stateRecordEnvelopeSchema.extend({
+  recordKind: z5.literal("gate"),
+  gateKind: gateKindSchema,
+  verdict: gateVerdictSchema,
+  actor: z5.string(),
+  outcomeReason: z5.string().max(2e3).optional()
+}).strict().superRefine((rec, ctx) => {
+  const issue = outcomeReasonIssue(rec.verdict, rec.outcomeReason);
+  if (issue) {
+    ctx.addIssue({ code: z5.ZodIssueCode.custom, path: ["outcomeReason"], ...issue });
+  }
+});
+var interventionRecordSchema = stateRecordEnvelopeSchema.extend({
+  recordKind: z5.literal("intervention"),
+  layer: methodLayerSchema,
+  mechanism: mechanismSchema,
+  severity: severitySchema,
+  disposition: dispositionSchema,
+  summary: z5.string().max(2e3)
+}).strict();
+var stateRecordSchema = z5.discriminatedUnion("recordKind", [
+  artefactRecordSchema,
+  stepRunRecordSchema,
+  gateRecordSchema,
+  interventionRecordSchema
+]);
+
+// ../events/dist/crew.js
+import { z as z6 } from "zod";
+var crewGroupSchema = z6.enum(["builder", "reviewer", "always-on"]);
+var crewTierSchema = z6.enum(["deep", "standard", "fast"]);
 var CREW_DISCIPLINE_MAX = 64;
-var crewMemberSchema = z5.object({
+var crewFaceHeadSchema = z6.enum(["sq", "sqr", "rnd", "dome", "hex"]);
+var crewFaceAntennaSchema = z6.enum(["none", "stalk", "twin", "dish"]);
+var crewFaceEyesSchema = z6.enum(["dots", "bars", "visor", "cyclops"]);
+var crewFaceMouthSchema = z6.enum(["line", "grid", "dots", "wave"]);
+var crewFaceSchema = z6.object({
+  // The outline of the head. Members who do the same kind of work share one, so a
+  // team is recognisable before any name is read.
+  head: crewFaceHeadSchema,
+  // What sits on top of the head, if anything.
+  antenna: crewFaceAntennaSchema,
+  // The eyes.
+  eyes: crewFaceEyesSchema,
+  // The mouth.
+  mouth: crewFaceMouthSchema,
+  // Whether this member is drawn with ears.
+  ears: z6.boolean()
+}).strict();
+var crewMemberSchema = z6.object({
   // The agent's name. The same twenty-one on every project, so a name is a
   // vocabulary a returning client already knows.
-  callsign: z5.string().min(1).max(32),
+  callsign: z6.string().min(1).max(32),
   // Which of the three headings this member reads under.
   group: crewGroupSchema,
   // The kind of work this member takes. A task names a discipline, and only
   // agents holding it can be dispatched to it.
-  discipline: z5.string().min(1).max(CREW_DISCIPLINE_MAX),
+  discipline: z6.string().min(1).max(CREW_DISCIPLINE_MAX),
   // How much thinking this member brings. There is no field naming the supplier
   // behind it, on this shape or on any other.
-  tier: crewTierSchema
+  tier: crewTierSchema,
+  // How this member's face is drawn. The same face on every project, so a
+  // returning client recognises a member before reading the name.
+  face: crewFaceSchema
 }).strict();
 var CREW_ROSTER = [
   // ── builders: code ──────────────────────────────────────────────────────────
-  { callsign: "ADA", group: "builder", discipline: "implementation", tier: "deep" },
-  { callsign: "OTTO", group: "builder", discipline: "implementation", tier: "deep" },
-  { callsign: "MILO", group: "builder", discipline: "implementation", tier: "standard" },
-  { callsign: "NOVA", group: "builder", discipline: "implementation", tier: "standard" },
-  { callsign: "KAI", group: "builder", discipline: "implementation", tier: "standard" },
-  { callsign: "HUGO", group: "builder", discipline: "infrastructure", tier: "standard" },
-  { callsign: "WREN", group: "builder", discipline: "refactor", tier: "fast" },
-  { callsign: "PIP", group: "builder", discipline: "refactor", tier: "fast" },
+  {
+    callsign: "ADA",
+    group: "builder",
+    discipline: "implementation",
+    tier: "deep",
+    face: { head: "sq", antenna: "stalk", eyes: "dots", mouth: "line", ears: false }
+  },
+  {
+    callsign: "OTTO",
+    group: "builder",
+    discipline: "implementation",
+    tier: "deep",
+    face: { head: "sq", antenna: "twin", eyes: "bars", mouth: "grid", ears: true }
+  },
+  {
+    callsign: "MILO",
+    group: "builder",
+    discipline: "implementation",
+    tier: "standard",
+    face: { head: "sqr", antenna: "stalk", eyes: "dots", mouth: "dots", ears: false }
+  },
+  {
+    callsign: "NOVA",
+    group: "builder",
+    discipline: "implementation",
+    tier: "standard",
+    face: { head: "sq", antenna: "dish", eyes: "cyclops", mouth: "line", ears: false }
+  },
+  {
+    callsign: "KAI",
+    group: "builder",
+    discipline: "implementation",
+    tier: "standard",
+    face: { head: "sqr", antenna: "none", eyes: "bars", mouth: "line", ears: true }
+  },
+  {
+    callsign: "HUGO",
+    group: "builder",
+    discipline: "infrastructure",
+    tier: "standard",
+    face: { head: "sq", antenna: "twin", eyes: "dots", mouth: "grid", ears: true }
+  },
+  {
+    callsign: "WREN",
+    group: "builder",
+    discipline: "refactor",
+    tier: "fast",
+    face: { head: "sqr", antenna: "stalk", eyes: "bars", mouth: "wave", ears: false }
+  },
+  {
+    callsign: "PIP",
+    group: "builder",
+    discipline: "refactor",
+    tier: "fast",
+    face: { head: "sqr", antenna: "none", eyes: "dots", mouth: "dots", ears: false }
+  },
   // ── builders: specs and docs ────────────────────────────────────────────────
-  { callsign: "IRIS", group: "builder", discipline: "feature spec", tier: "deep" },
-  { callsign: "JUNO", group: "builder", discipline: "feature spec", tier: "standard" },
-  { callsign: "LEX", group: "builder", discipline: "context & docs", tier: "fast" },
+  {
+    callsign: "IRIS",
+    group: "builder",
+    discipline: "feature spec",
+    tier: "deep",
+    face: { head: "dome", antenna: "stalk", eyes: "visor", mouth: "line", ears: false }
+  },
+  {
+    callsign: "JUNO",
+    group: "builder",
+    discipline: "feature spec",
+    tier: "standard",
+    face: { head: "dome", antenna: "none", eyes: "dots", mouth: "wave", ears: false }
+  },
+  {
+    callsign: "LEX",
+    group: "builder",
+    discipline: "context & docs",
+    tier: "fast",
+    face: { head: "dome", antenna: "twin", eyes: "bars", mouth: "dots", ears: false }
+  },
   // ── reviewers ───────────────────────────────────────────────────────────────
-  { callsign: "VERA", group: "reviewer", discipline: "spec consistency", tier: "deep" },
-  { callsign: "ODIN", group: "reviewer", discipline: "cross-spec audit", tier: "deep" },
-  { callsign: "CASS", group: "reviewer", discipline: "code review", tier: "deep" },
-  { callsign: "THEO", group: "reviewer", discipline: "code review", tier: "standard" },
-  { callsign: "ECHO", group: "reviewer", discipline: "test quality", tier: "standard" },
-  { callsign: "MAVIS", group: "reviewer", discipline: "suites & coverage", tier: "standard" },
-  { callsign: "ZARA", group: "reviewer", discipline: "smoke & walk aid", tier: "standard" },
-  { callsign: "NORA", group: "reviewer", discipline: "evidence & provenance", tier: "fast" },
+  {
+    callsign: "VERA",
+    group: "reviewer",
+    discipline: "spec consistency",
+    tier: "deep",
+    face: { head: "rnd", antenna: "stalk", eyes: "visor", mouth: "line", ears: false }
+  },
+  {
+    callsign: "ODIN",
+    group: "reviewer",
+    discipline: "cross-spec audit",
+    tier: "deep",
+    face: { head: "rnd", antenna: "dish", eyes: "cyclops", mouth: "line", ears: false }
+  },
+  {
+    callsign: "CASS",
+    group: "reviewer",
+    discipline: "code review",
+    tier: "deep",
+    face: { head: "rnd", antenna: "none", eyes: "visor", mouth: "grid", ears: true }
+  },
+  {
+    callsign: "THEO",
+    group: "reviewer",
+    discipline: "code review",
+    tier: "standard",
+    face: { head: "rnd", antenna: "twin", eyes: "bars", mouth: "line", ears: false }
+  },
+  {
+    callsign: "ECHO",
+    group: "reviewer",
+    discipline: "test quality",
+    tier: "standard",
+    face: { head: "rnd", antenna: "stalk", eyes: "dots", mouth: "wave", ears: false }
+  },
+  {
+    callsign: "MAVIS",
+    group: "reviewer",
+    discipline: "suites & coverage",
+    tier: "standard",
+    face: { head: "rnd", antenna: "none", eyes: "visor", mouth: "dots", ears: false }
+  },
+  {
+    callsign: "ZARA",
+    group: "reviewer",
+    discipline: "smoke & walk aid",
+    tier: "standard",
+    face: { head: "rnd", antenna: "dish", eyes: "bars", mouth: "wave", ears: false }
+  },
+  {
+    callsign: "NORA",
+    group: "reviewer",
+    discipline: "evidence & provenance",
+    tier: "fast",
+    face: { head: "rnd", antenna: "twin", eyes: "dots", mouth: "line", ears: false }
+  },
   // ── always on: continuous, takes no task ────────────────────────────────────
-  { callsign: "ARGUS", group: "always-on", discipline: "guard \xB7 every diff", tier: "standard" },
-  { callsign: "ATLAS", group: "always-on", discipline: "coordinator", tier: "deep" }
+  {
+    callsign: "ARGUS",
+    group: "always-on",
+    discipline: "guard \xB7 every diff",
+    tier: "standard",
+    face: { head: "hex", antenna: "dish", eyes: "visor", mouth: "grid", ears: true }
+  },
+  {
+    callsign: "ATLAS",
+    group: "always-on",
+    discipline: "coordinator",
+    tier: "deep",
+    face: { head: "hex", antenna: "twin", eyes: "cyclops", mouth: "line", ears: true }
+  }
 ];
 var CREW_ROSTER_SIZE = CREW_ROSTER.length;
 var CREW_CALLSIGNS = CREW_ROSTER.map((member) => member.callsign);
 
 // ../events/dist/device-auth.js
-import { z as z6 } from "zod";
-var utcIso86013 = z6.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/, "must be a UTC ISO-8601 timestamp ending in Z (INV-015)");
+import { z as z7 } from "zod";
+var utcIso86014 = z7.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/, "must be a UTC ISO-8601 timestamp ending in Z");
 var DEVICE_AUTH_STATUS = {
   /** The poll: minted, nobody has acted yet. Keep polling. 200. */
   PENDING: "pending",
@@ -351,7 +766,7 @@ var DEVICE_AUTH_STATUS = {
   ALREADY_DECIDED: "already-decided",
   /**
    * Confirm: an approval named a signed-in identity whose account has not accepted
-   * the terms of service and privacy policy currently in force (T-18, #588). 400.
+   * the terms of service and privacy policy currently in force. 400.
    *
    * NOT BOUND TO THE DEVICE CODE. Unlike every other refusal in this const, this one
    * says nothing about the code itself — the code is still `pending` after this
@@ -366,25 +781,25 @@ var DEVICE_POLL_REFUSALS = [
   DEVICE_AUTH_STATUS.EXPIRED,
   DEVICE_AUTH_STATUS.UNKNOWN
 ];
-var deviceAuthStartResponseSchema = z6.object({
-  deviceCode: z6.string().min(1),
-  userCode: z6.string().min(1),
-  verificationUrl: z6.string().min(1),
-  expiresAt: utcIso86013,
-  pollIntervalMs: z6.number().int().positive()
+var deviceAuthStartResponseSchema = z7.object({
+  deviceCode: z7.string().min(1),
+  userCode: z7.string().min(1),
+  verificationUrl: z7.string().min(1),
+  expiresAt: utcIso86014,
+  pollIntervalMs: z7.number().int().positive()
 }).strict();
-var devicePollPendingSchema = z6.object({
-  status: z6.literal(DEVICE_AUTH_STATUS.PENDING),
-  pollIntervalMs: z6.number().int().positive()
+var devicePollPendingSchema = z7.object({
+  status: z7.literal(DEVICE_AUTH_STATUS.PENDING),
+  pollIntervalMs: z7.number().int().positive()
 }).strict();
-var devicePollApprovedSchema = z6.object({
-  status: z6.literal(DEVICE_AUTH_STATUS.APPROVED),
-  accountId: z6.string().min(1),
-  credential: z6.string().min(1),
-  expiresAt: utcIso86013
+var devicePollApprovedSchema = z7.object({
+  status: z7.literal(DEVICE_AUTH_STATUS.APPROVED),
+  accountId: z7.string().min(1),
+  credential: z7.string().min(1),
+  expiresAt: utcIso86014
 }).strict();
-var deviceAuthRefusalSchema = z6.object({
-  status: z6.enum([
+var deviceAuthRefusalSchema = z7.object({
+  status: z7.enum([
     DEVICE_AUTH_STATUS.DECLINED,
     DEVICE_AUTH_STATUS.EXPIRED,
     DEVICE_AUTH_STATUS.UNKNOWN,
@@ -395,25 +810,25 @@ var deviceAuthRefusalSchema = z6.object({
     DEVICE_AUTH_STATUS.ALREADY_DECIDED,
     DEVICE_AUTH_STATUS.TERMS_REQUIRED
   ]),
-  message: z6.string().min(1)
+  message: z7.string().min(1)
 }).strict();
-var devicePollResponseSchema = z6.union([
+var devicePollResponseSchema = z7.union([
   devicePollPendingSchema,
   devicePollApprovedSchema,
   deviceAuthRefusalSchema
 ]);
-var deviceConfirmRequestSchema = z6.object({
-  userCode: z6.string().min(1),
-  decision: z6.enum(["approve", "decline"]),
-  externalAuthId: z6.string().min(1).optional(),
-  email: z6.string().optional(),
-  acceptTerms: z6.boolean().optional()
+var deviceConfirmRequestSchema = z7.object({
+  userCode: z7.string().min(1),
+  decision: z7.enum(["approve", "decline"]),
+  externalAuthId: z7.string().min(1).optional(),
+  email: z7.string().optional(),
+  acceptTerms: z7.boolean().optional()
 }).strict();
-var deviceConfirmRecordedSchema = z6.object({
-  status: z6.literal(DEVICE_AUTH_STATUS.RECORDED),
-  accountId: z6.string().min(1).optional()
+var deviceConfirmRecordedSchema = z7.object({
+  status: z7.literal(DEVICE_AUTH_STATUS.RECORDED),
+  accountId: z7.string().min(1).optional()
 }).strict();
-var deviceConfirmResponseSchema = z6.union([
+var deviceConfirmResponseSchema = z7.union([
   deviceConfirmRecordedSchema,
   deviceAuthRefusalSchema
 ]);
@@ -442,25 +857,25 @@ function loopbackVerificationUrl(verificationUrl, target) {
 }
 
 // ../events/dist/join-refusal.js
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 var NOT_THIS_ACCOUNT_REASON = "not-this-account";
 var JOIN_REFUSAL_STATUS = 403;
-var notThisAccountRefusalSchema = z7.object({
-  statusCode: z7.literal(JOIN_REFUSAL_STATUS),
-  error: z7.string(),
-  message: z7.string(),
-  reason: z7.literal(NOT_THIS_ACCOUNT_REASON)
+var notThisAccountRefusalSchema = z8.object({
+  statusCode: z8.literal(JOIN_REFUSAL_STATUS),
+  error: z8.string(),
+  message: z8.string(),
+  reason: z8.literal(NOT_THIS_ACCOUNT_REASON)
 }).strict();
-var joinRefusalSchema = z7.union([notThisAccountRefusalSchema, wireErrorSchema]);
+var joinRefusalSchema = z8.union([notThisAccountRefusalSchema, wireErrorSchema]);
 function isNotThisAccountRefusal(body) {
   return typeof body === "object" && body !== null && body.reason === NOT_THIS_ACCOUNT_REASON;
 }
 
 // ../events/dist/account-identity.js
-import { z as z8 } from "zod";
-var accountIdentitySchema = z8.object({
-  accountId: z8.string().min(1),
-  email: z8.string().min(1).optional()
+import { z as z9 } from "zod";
+var accountIdentitySchema = z9.object({
+  accountId: z9.string().min(1),
+  email: z9.string().min(1).optional()
 }).strict();
 function safeParseAccountIdentity(payload) {
   return accountIdentitySchema.safeParse(payload);
@@ -527,6 +942,21 @@ function describeIdentity(identity) {
   return `(a ${typeof identity})`;
 }
 
+// ../events/dist/credential-wire.js
+import { z as z10 } from "zod";
+var engagementCredentialResponseSchema = z10.object({
+  engagementId: z10.string(),
+  sessionToken: z10.string(),
+  mcpUrl: z10.string(),
+  guardUrl: z10.string(),
+  controlTelemetryUrl: z10.string()
+}).strict();
+var ciTokenExchangeResponseSchema = z10.object({
+  token: z10.string(),
+  expiresAt: utcIso86013,
+  engagementId: z10.string()
+}).strict();
+
 // dist/engagement-credential.js
 import { chmodSync as chmodSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import { platform as platform2 } from "node:os";
@@ -537,27 +967,14 @@ import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir, platform } from "node:os";
 import { dirname, join } from "node:path";
 function halfcycleHome(home) {
-  return join(home ?? homedir(), ".halfcycle");
+  return join(home ?? homedir(), HALFCYCLE_DIR_NAME);
 }
 function accountStorePath(home) {
-  return join(halfcycleHome(home), "account.json");
-}
-function normaliseOrigin(serviceUrl) {
-  return serviceUrl.trim().replace(/\/+$/, "").toLowerCase();
+  return join(halfcycleHome(home), ACCOUNT_STORE_FILENAME);
 }
 function readStore(home) {
-  let raw;
   try {
-    raw = readFileSync(accountStorePath(home), "utf-8");
-  } catch {
-    return { version: 1, accounts: {} };
-  }
-  try {
-    const parsed = JSON.parse(raw);
-    if (!parsed || typeof parsed !== "object" || typeof parsed.accounts !== "object") {
-      return { version: 1, accounts: {} };
-    }
-    return { version: 1, accounts: parsed.accounts ?? {} };
+    return parseAccountStoreText(readFileSync(accountStorePath(home), "utf-8"));
   } catch {
     return { version: 1, accounts: {} };
   }
@@ -603,8 +1020,9 @@ function forgetStoredCredential(serviceUrl, home) {
 }
 
 // dist/engagement-credential.js
-var ENGAGEMENTS_DIR = "engagements";
-var ENV_FILENAME = "env";
+var ENGAGEMENTS_DIR = ENGAGEMENTS_DIR_NAME;
+var ENV_FILENAME = ENGAGEMENT_ENV_FILENAME;
+var HALFCYCLE_DIR = HALFCYCLE_DIR_NAME;
 var PIN_ENGAGEMENT_ID_FIELD = "engagementId";
 function engagementStateDir(engagementId, home) {
   return join2(halfcycleHome(home), ENGAGEMENTS_DIR, engagementId);
@@ -612,7 +1030,6 @@ function engagementStateDir(engagementId, home) {
 function engagementEnvPath(engagementId, home) {
   return join2(engagementStateDir(engagementId, home), ENV_FILENAME);
 }
-var NOT_THIS_ACCOUNT_MARKER_FILENAME = "not-this-account";
 function notThisAccountMarkerPath(engagementId, home) {
   return join2(engagementStateDir(engagementId, home), NOT_THIS_ACCOUNT_MARKER_FILENAME);
 }
@@ -639,82 +1056,8 @@ var ENGAGEMENT_ENV_KEYS = [
   "CONTROL_TELEMETRY_URL"
 ];
 var PHASE_STAMP_ENV_KEY = "HALFCYCLE_PHASE";
-var ENV_HEADER = "# Halfcycle per-engagement credential \u2014 machine level, owner-only, never in a repository.";
-function shq(value) {
-  return `'${value.replace(/'/g, `'\\''`)}'`;
-}
-function unquote(value) {
-  const v = value.trim();
-  if (v.length >= 2 && v.startsWith("'") && v.endsWith("'")) {
-    return v.slice(1, -1).split(`'\\''`).join(`'`);
-  }
-  if (v.length >= 2 && v.startsWith('"') && v.endsWith('"'))
-    return v.slice(1, -1);
-  return v;
-}
-function parseEnvText(raw) {
-  const out = {};
-  for (const line of raw.split("\n")) {
-    const eq = line.indexOf("=");
-    if (eq === -1)
-      continue;
-    const key = line.slice(0, eq).replace(/^\s*export\s+/, "").trim();
-    if (key === "" || key.startsWith("#"))
-      continue;
-    out[key] = unquote(line.slice(eq + 1));
-  }
-  return out;
-}
-function reconcileEnvText(existing, values, keys = ENGAGEMENT_ENV_KEYS) {
-  const desired = new Map(keys.map((k) => {
-    const value = values[k];
-    return [k, value === void 0 ? "" : value];
-  }));
-  const line = (k) => `${k}=${shq(desired.get(k) ?? "")}`;
-  const written = keys.filter((k) => desired.get(k) !== null);
-  if (existing === null) {
-    if (written.length === 0)
-      return "";
-    return `${ENV_HEADER}
-` + written.map(line).join("\n") + "\n";
-  }
-  const seen = /* @__PURE__ */ new Set();
-  const out = [];
-  for (const existingLine of existing.split("\n")) {
-    const eq = existingLine.indexOf("=");
-    if (eq === -1) {
-      out.push(existingLine);
-      continue;
-    }
-    const lhs = existingLine.slice(0, eq);
-    const exported = /^\s*export\s+/.exec(lhs);
-    const prefix = exported === null ? "" : exported[0];
-    const key = lhs.slice(prefix.length).trim();
-    if (!desired.has(key)) {
-      out.push(existingLine);
-      continue;
-    }
-    seen.add(key);
-    if (desired.get(key) === null)
-      continue;
-    out.push(`${prefix}${line(key)}`);
-  }
-  const missing = written.filter((k) => !seen.has(k));
-  if (missing.length > 0) {
-    const header = existing.includes(ENV_HEADER) ? "" : `${ENV_HEADER}
-`;
-    const block = header + missing.map(line).join("\n");
-    const trailingBlank = out.length > 0 && out[out.length - 1] === "";
-    if (trailingBlank)
-      out.splice(out.length - 1, 0, block);
-    else
-      out.push(`
-${block}`);
-  }
-  let result = out.join("\n");
-  if (existing.endsWith("\n") && !result.endsWith("\n"))
-    result += "\n";
-  return result;
+function reconcileEnvText2(existing, values, keys = ENGAGEMENT_ENV_KEYS) {
+  return reconcileEnvText(existing, values, keys);
 }
 function readEngagementEnv(engagementId, home) {
   try {
@@ -732,7 +1075,7 @@ function writeEngagementEnv(engagementId, values, home, keys = ENGAGEMENT_ENV_KE
   } catch {
     existing = null;
   }
-  const reconciled = reconcileEnvText(existing, values, keys);
+  const reconciled = reconcileEnvText2(existing, values, keys);
   if (existing === null && reconciled === "")
     return "skipped";
   mkdirSync2(dir, { recursive: true, mode: 448 });
@@ -758,7 +1101,7 @@ function applyOwnerOnly(path, dir) {
 function engagementResolutionShell() {
   return `# --- Halfcycle credential resolution (generated; do not edit) ----------------
 # THE CREDENTIAL IS NOT IN THIS REPOSITORY. It lives at
-#   $HOME/.halfcycle/${ENGAGEMENTS_DIR}/<engagement-id>/${ENV_FILENAME}
+#   $HOME/${HALFCYCLE_DIR}/${ENGAGEMENTS_DIR}/<engagement-id>/${ENV_FILENAME}
 # written owner-only by \`npx halfcycle\`. What this repository holds is the
 # engagement id, in the committed .halfcycle/bundle.json. So: read the id out of
 # the pin, then name the file. There is no jq here and node is not dependable on a
@@ -789,10 +1132,10 @@ halfcycle_env_file() {
     HALFCYCLE_ENV_PROBLEM="no-home"
     return 1
   fi
-  if [ -f "$HOME/.halfcycle/${ENGAGEMENTS_DIR}/$hc_id/${NOT_THIS_ACCOUNT_MARKER_FILENAME}" ]; then
+  if [ -f "$HOME/${HALFCYCLE_DIR}/${ENGAGEMENTS_DIR}/$hc_id/${NOT_THIS_ACCOUNT_MARKER_FILENAME}" ]; then
     HALFCYCLE_ENV_NOT_THIS_ACCOUNT=1
   fi
-  hc_env="$HOME/.halfcycle/${ENGAGEMENTS_DIR}/$hc_id/${ENV_FILENAME}"
+  hc_env="$HOME/${HALFCYCLE_DIR}/${ENGAGEMENTS_DIR}/$hc_id/${ENV_FILENAME}"
   if [ ! -f "$hc_env" ]; then
     HALFCYCLE_ENV_PROBLEM="no-credential"
     return 1
@@ -983,7 +1326,7 @@ function resolveVendoredBinary() {
     if (existsSync3(candidate))
       return candidate;
   }
-  throw new Error(`[bundle install] Cannot find the self-contained guard binary bin.bundle.mjs. Run the runner's "bundle" script (pnpm --filter @halfcycle/runner run build) so the vendored artefact exists before installing. Looked in: ${candidates.join(", ")}.`);
+  throw new Error(`[bundle install] Cannot find the self-contained guard binary bin.bundle.mjs. This copy of the halfcycle package is incomplete \u2014 reinstall it, or rebuild it if you are working on it. Looked in: ${candidates.join(", ")}.`);
 }
 var WRITE_ALLOWLIST = [
   ".claude/commands",
@@ -1044,11 +1387,15 @@ function writeCollisionSafe(targetAbsPath, targetRepoRoot, content) {
   writeFileSync4(targetAbsPath, content, "utf-8");
   return "written";
 }
+var INSTALLER_OWNED_DIR = ".halfcycle/";
 function writeOwned(targetAbsPath, targetRepoRoot, content) {
   const rel = relative(targetRepoRoot, targetAbsPath).replace(/\\/g, "/");
   if (!isAllowlisted(rel)) {
     throw new Error(`[bundle install] Write-allowlist violation: attempted to write "${rel}". Only the method surface and scaffolding paths are writable.`);
   }
+  if (!rel.startsWith(INSTALLER_OWNED_DIR)) {
+    throw new Error(`[bundle install] Path-ownership violation: attempted to claim "${rel}" by path. Only ${INSTALLER_OWNED_DIR} is owned outright by this installer; everywhere else a differing file may be a developer's, so ownership must be proved from the file's own contents (writeOwnedGenerated) rather than assumed from where it sits.`);
+  }
   if (existsSync3(targetAbsPath) && readFileSync5(targetAbsPath, "utf-8") === content) {
     return "skipped";
   }
@@ -1056,6 +1403,39 @@ function writeOwned(targetAbsPath, targetRepoRoot, content) {
   writeFileSync4(targetAbsPath, content, "utf-8");
   return "written";
 }
+var GENERATED_HEADER_LINE_INDEX = 1;
+function writeOwnedGenerated(targetAbsPath, targetRepoRoot, content, generatedMarker) {
+  const rel = relative(targetRepoRoot, targetAbsPath).replace(/\\/g, "/");
+  if (!isAllowlisted(rel)) {
+    throw new Error(`[bundle install] Write-allowlist violation: attempted to write "${rel}". Only the method surface and scaffolding paths are writable.`);
+  }
+  let replacedExisting = false;
+  if (existsSync3(targetAbsPath)) {
+    const current = readFileSync5(targetAbsPath, "utf-8");
+    if (current === content)
+      return { outcome: "skipped", replacedExisting: false };
+    const headerLine = current.split("\n")[GENERATED_HEADER_LINE_INDEX] ?? "";
+    if (!headerLine.startsWith(generatedMarker))
+      return { outcome: "collided", replacedExisting: false };
+    replacedExisting = true;
+  }
+  mkdirSync4(dirname2(targetAbsPath), { recursive: true });
+  writeFileSync4(targetAbsPath, content, "utf-8");
+  return { outcome: "written", replacedExisting };
+}
+function recordOwnedGenerated(report, targetAbsPath, targetRepoRoot, content, generatedMarker, rel) {
+  const { outcome, replacedExisting } = writeOwnedGenerated(targetAbsPath, targetRepoRoot, content, generatedMarker);
+  record(report, outcome, rel);
+  if (replacedExisting)
+    report.replacedPaths.push(rel);
+}
+function recordOwned(report, targetAbsPath, targetRepoRoot, content, rel) {
+  const existedBefore = existsSync3(targetAbsPath);
+  const outcome = writeOwned(targetAbsPath, targetRepoRoot, content);
+  record(report, outcome, rel);
+  if (outcome === "written" && existedBefore)
+    report.replacedPaths.push(rel);
+}
 function record(report, outcome, rel) {
   const bucket = {
     written: report.writtenPaths,
@@ -1095,6 +1475,15 @@ function generateSettingsJson() {
               timeout: 5
             }
           ]
+        },
+        {
+          hooks: [
+            {
+              type: "command",
+              command: "bash ./.claude/hooks/guard-runner.sh refresh-credential",
+              timeout: 10
+            }
+          ]
         }
       ],
       UserPromptSubmit: [
@@ -1120,6 +1509,17 @@ function generateSettingsJson() {
           ]
         }
       ],
+      Stop: [
+        {
+          hooks: [
+            {
+              type: "command",
+              command: "bash ./.claude/hooks/guard-runner.sh hook stop",
+              timeout: 60
+            }
+          ]
+        }
+      ],
       SubagentStop: [
         {
           hooks: [
@@ -1130,20 +1530,32 @@ function generateSettingsJson() {
             }
           ]
         }
+      ],
+      SessionEnd: [
+        {
+          hooks: [
+            {
+              type: "command",
+              command: "bash ./.claude/hooks/session-end-marker.sh",
+              timeout: 5
+            }
+          ]
+        }
       ]
     }
   };
   return JSON.stringify(settings, null, 2) + "\n";
 }
 var VENDORED_BIN_REL = ".halfcycle/bin/bin.bundle.mjs";
+var GENERATED_GUARD_RUNNER_HEADER = "# Governance hook wrapper \u2014 generated by";
 function generateGuardRunnerWrapper() {
   return `#!/usr/bin/env bash
-# Governance hook wrapper \u2014 generated by the Halfcycle installer.
+${GENERATED_GUARD_RUNNER_HEADER} the Halfcycle installer.
 #
 # Loads this engagement's credentials so the guard runner has its GUARD_SERVICE_*
-# values when Claude Code fires PostToolUse / SubagentStop, then exec's the
-# SELF-CONTAINED binary vendored at ${VENDORED_BIN_REL} \u2014 a path inside this
-# project, so the hook resolves in any checkout of it.
+# values when Claude Code fires SessionStart / PostToolUse / Stop / SubagentStop,
+# then exec's the SELF-CONTAINED binary vendored at ${VENDORED_BIN_REL} \u2014 a path
+# inside this project, so the hook resolves in any checkout of it.
 #
 # The runner itself reads only process.env, so env loading lives here in the hook
 # wiring rather than inside the binary.
@@ -1158,6 +1570,16 @@ ${engagementResolutionShell()}
 # the runner say what it found \u2014 its never-configured branch is loud and non-zero
 # on purpose, and a wrapper that exited quietly here would hide it.
 if halfcycle_env_file "$PROJECT_DIR"; then
+  # EXPORTED, NOT MERELY SET \u2014 one word, and without it a whole feature is off.
+  # \`set -a\` exports what is assigned AFTER it, and the resolution above assigned
+  # this variable BEFORE it, so the exec'd binary would never see the name of the
+  # file these credentials came from. It needs that name: when the service says
+  # this engagement's credential has timed out, the binary renews it by rewriting
+  # that file. With nothing naming the file it renews nothing \u2014 and it says
+  # nothing and exits 0 while doing so, because there is no session in which that
+  # silence is wrong on its own. So a wrapper missing this line looks perfectly
+  # healthy at every session start and renews nothing, forever.
+  export HALFCYCLE_ENV_FILE
   set -a
   . "$HALFCYCLE_ENV_FILE"
   set +a
@@ -1173,15 +1595,28 @@ fi
 exec node "$PROJECT_DIR/${VENDORED_BIN_REL}" "$@"
 `;
 }
+var GENERATED_SESSION_START_HEADER = "# Session-start marker \u2014 generated by";
+var SESSION_ID_FROM_HOOK_INPUT_SH = `SESSION_ID="$(printf '%s' "$INPUT" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{try{const j=JSON.parse(s);process.stdout.write(typeof j.session_id==="string"?j.session_id:"")}catch{process.stdout.write("")}})' 2>/dev/null || true)"`;
 function generateSessionStartMarker() {
   return `#!/usr/bin/env bash
-# Session-start marker \u2014 generated by the Halfcycle installer.
-# Writes the current git HEAD SHA to a temp file so SubagentStop can
-# diff against session-start rather than just HEAD at stop time.
+${GENERATED_SESSION_START_HEADER} the Halfcycle installer.
+# Records the git HEAD sha this session starts from, in a file named after this
+# session, so the stop-time check can compare what the session did against where
+# it began instead of only against the latest commit. The session id comes in on
+# stdin with the hook input; without one, the older session-less name is written
+# and the stop-time check compares against the latest commit as it used to.
+INPUT="$(cat 2>/dev/null || true)"
 REPO_ROOT="\${CLAUDE_PROJECT_DIR:-$(git rev-parse --show-toplevel 2>/dev/null)}"
 if [ -z "$REPO_ROOT" ]; then exit 0; fi
-HASH="$(echo -n "$REPO_ROOT" | shasum -a 256 | cut -c1-12)"
-MARKER_FILE="\${TMPDIR%/}/halfcycle-session-\${HASH}.ref"
+HASH="$(printf '%s' "$REPO_ROOT" | shasum -a 256 | cut -c1-12)"
+${SESSION_ID_FROM_HOOK_INPUT_SH}
+MARKER_DIR="\${TMPDIR:-/tmp}"
+MARKER_DIR="\${MARKER_DIR%/}"    # strip trailing slash (macOS TMPDIR ends in /)
+if [ -n "$SESSION_ID" ]; then
+  MARKER_FILE="\${MARKER_DIR}/halfcycle-session-\${HASH}-\${SESSION_ID}.ref"
+else
+  MARKER_FILE="\${MARKER_DIR}/halfcycle-session-\${HASH}.ref"
+fi
 git -C "$REPO_ROOT" rev-parse HEAD > "$MARKER_FILE" 2>/dev/null || true
 
 # ---------------------------------------------------------------------------
@@ -1244,9 +1679,41 @@ ${engagementResolutionShell()}
 exit 0
 `;
 }
+var GENERATED_SESSION_END_HEADER = "# Session-end marker cleanup \u2014 generated by";
+function generateSessionEndMarker() {
+  return `#!/usr/bin/env bash
+${GENERATED_SESSION_END_HEADER} the Halfcycle installer.
+# Removes this session's marker file (and the evaluation-state file beside it)
+# written at session start. Deletion happens HERE and not at stop time: the stop
+# hook runs at the end of every turn, and deleting the marker there would throw
+# away the session's starting point for every later turn.
+INPUT="$(cat 2>/dev/null || true)"
+
+REPO_ROOT="\${CLAUDE_PROJECT_DIR:-$(git rev-parse --show-toplevel 2>/dev/null)}"
+if [ -z "$REPO_ROOT" ]; then exit 0; fi
+HASH="$(printf '%s' "$REPO_ROOT" | shasum -a 256 | cut -c1-12)"
+
+# The session id arrives on stdin as part of the hook payload. Empty when absent.
+${SESSION_ID_FROM_HOOK_INPUT_SH}
+
+MARKER_DIR="\${TMPDIR:-/tmp}"
+MARKER_DIR="\${MARKER_DIR%/}"    # strip trailing slash (macOS TMPDIR ends in /)
+
+# Exact names only \u2014 never a wildcard. A pattern would match another session
+# running in this same repository and delete the point it started from.
+rm -f "\${MARKER_DIR}/halfcycle-session-\${HASH}.ref" 2>/dev/null || true
+rm -f "\${MARKER_DIR}/halfcycle-session-\${HASH}.eval" 2>/dev/null || true
+if [ -n "$SESSION_ID" ]; then
+  rm -f "\${MARKER_DIR}/halfcycle-session-\${HASH}-\${SESSION_ID}.ref" 2>/dev/null || true
+  rm -f "\${MARKER_DIR}/halfcycle-session-\${HASH}-\${SESSION_ID}.eval" 2>/dev/null || true
+fi
+exit 0
+`;
+}
+var GENERATED_USER_PROMPT_REMINDER_HEADER = "# UserPromptSubmit house-rule reminder \u2014 generated by";
 function generateUserPromptReminderHook() {
   return `#!/usr/bin/env bash
-# UserPromptSubmit house-rule reminder \u2014 generated by the Halfcycle installer.
+${GENERATED_USER_PROMPT_REMINDER_HEADER} the Halfcycle installer.
 #
 # Injects ONE plain-text sentence into context on every prompt (F-2(c),
 # W8-T-05b) \u2014 the per-turn twin of the house rule W8-T-05a put in the client's
@@ -1344,17 +1811,31 @@ function generateCiStanza() {
 #
 # The job prints the diff base it used and how many files it evaluated, on every
 # run. If that line says 0 files on a commit that changed something, the base is
-# wrong \u2014 set HALFCYCLE_DIFF_BASE in the env block above to name it explicitly
-# (on a GitHub push event, \${{ github.event.before }} is the right value).
+# wrong \u2014 set HALFCYCLE_DIFF_BASE in the env block OF YOUR COPY, beside the two
+# secrets, to name it explicitly (on a GitHub push event, \${{ github.event.before }}
+# is the right value).
+#
+# EDIT YOUR COPY, NOT THIS FILE. This one is regenerated by the installer and your
+# changes to it would be replaced the next time you run \`npx halfcycle\`. It is
+# also inert where it sits: no CI system reads this path. Copy the job above into
+# your own workflow and change it there.
 `;
 }
 var MCP_REGISTRATION_REL = ".mcp.json";
 var MCP_SERVER_KEY = "halfcycle";
 var MCP_HEADERS_HELPER_REL = ".halfcycle/mcp-headers.sh";
 var MCP_HEADERS_HELPER_COMMAND = `/bin/sh -c 'd=$(pwd); while [ ! -f "$d/${MCP_HEADERS_HELPER_REL}" ] && [ "$d" != / ]; do d=$(dirname "$d"); done; [ -f "$d/${MCP_HEADERS_HELPER_REL}" ] || { echo "halfcycle: ${MCP_HEADERS_HELPER_REL} not found at or above $(pwd); re-run npx halfcycle" >&2; exit 1; }; exec /bin/sh "$d/${MCP_HEADERS_HELPER_REL}"'`;
+var GENERATED_MCP_HEADERS_HEADER = "# Halfcycle MCP connection headers \u2014 generated by";
+var OWNED_GENERATED_HEADERS = {
+  ".claude/hooks/guard-runner.sh": GENERATED_GUARD_RUNNER_HEADER,
+  ".claude/hooks/user-prompt-reminder.sh": GENERATED_USER_PROMPT_REMINDER_HEADER,
+  ".claude/hooks/session-end-marker.sh": GENERATED_SESSION_END_HEADER,
+  ".claude/hooks/session-start-marker.sh": GENERATED_SESSION_START_HEADER,
+  ".halfcycle/mcp-headers.sh": GENERATED_MCP_HEADERS_HEADER
+};
 function generateMcpHeadersHelper() {
   return `#!/bin/sh
-# Halfcycle MCP connection headers \u2014 generated by the Halfcycle installer.
+${GENERATED_MCP_HEADERS_HEADER} the Halfcycle installer.
 #
 # Claude Code runs this at MCP connection time, from the session's cwd, and merges
 # its stdout into the connection headers for the "halfcycle" server in .mcp.json.
@@ -1539,7 +2020,7 @@ function writeCrewRoster(targetRepoRoot, report) {
   const rendered = `${JSON.stringify(doc, null, 2)}
 `;
   const crewPath = join5(targetRepoRoot, ".halfcycle", "crew.json");
-  record(report, writeOwned(crewPath, targetRepoRoot, rendered), ".halfcycle/crew.json");
+  recordOwned(report, crewPath, targetRepoRoot, rendered, ".halfcycle/crew.json");
 }
 function readBundlePin(targetRepoRoot) {
   const pinPath = join5(targetRepoRoot, ".halfcycle", "bundle.json");
@@ -1690,7 +2171,8 @@ async function install(options) {
     writtenPaths: [],
     skippedPaths: [],
     mergedPaths: [],
-    collidedPaths: []
+    collidedPaths: [],
+    replacedPaths: []
   };
   copyManifestCommands(manifest, targetRepo, report);
   const capturedDir = join5(targetRepo, "test", "fixtures", "captured");
@@ -1703,7 +2185,7 @@ async function install(options) {
   }
   const vendoredBinSrc = resolveVendoredBinary();
   const vendoredBinDest = join5(targetRepo, ".halfcycle", "bin", "bin.bundle.mjs");
-  record(report, writeOwned(vendoredBinDest, targetRepo, readFileSync5(vendoredBinSrc, "utf-8")), ".halfcycle/bin/bin.bundle.mjs");
+  recordOwned(report, vendoredBinDest, targetRepo, readFileSync5(vendoredBinSrc, "utf-8"), ".halfcycle/bin/bin.bundle.mjs");
   const settingsPath = join5(targetRepo, ".claude", "settings.json");
   const settingsPreexisted = existsSync3(settingsPath);
   const generatedSettings = JSON.parse(generateSettingsJson());
@@ -1715,17 +2197,19 @@ async function install(options) {
   (settingsPreexisted ? report.mergedPaths : report.writtenPaths).push(".claude/settings.json");
   for (const [name, content] of [
     ["guard-runner.sh", generateGuardRunnerWrapper()],
-    ["session-start-marker.sh", generateSessionStartMarker()],
-    ["user-prompt-reminder.sh", generateUserPromptReminderHook()]
+    ["session-end-marker.sh", generateSessionEndMarker()],
+    ["user-prompt-reminder.sh", generateUserPromptReminderHook()],
+    ["session-start-marker.sh", generateSessionStartMarker()]
   ]) {
+    const rel = `.claude/hooks/${name}`;
     const hookPath = join5(targetRepo, ".claude", "hooks", name);
-    record(report, writeCollisionSafe(hookPath, targetRepo, content), `.claude/hooks/${name}`);
+    recordOwnedGenerated(report, hookPath, targetRepo, content, OWNED_GENERATED_HEADERS[rel], rel);
   }
   const ciStanzaPath = join5(targetRepo, ".halfcycle", "ci-stanza.yml");
-  record(report, writeCollisionSafe(ciStanzaPath, targetRepo, generateCiStanza()), ".halfcycle/ci-stanza.yml");
+  recordOwned(report, ciStanzaPath, targetRepo, generateCiStanza(), ".halfcycle/ci-stanza.yml");
   if (credential) {
     const helperPath = join5(targetRepo, MCP_HEADERS_HELPER_REL);
-    record(report, writeCollisionSafe(helperPath, targetRepo, generateMcpHeadersHelper()), MCP_HEADERS_HELPER_REL);
+    recordOwnedGenerated(report, helperPath, targetRepo, generateMcpHeadersHelper(), OWNED_GENERATED_HEADERS[MCP_HEADERS_HELPER_REL], MCP_HEADERS_HELPER_REL);
     const mcpPath = join5(targetRepo, MCP_REGISTRATION_REL);
     const existingMcp = existsSync3(mcpPath) ? readFileSync5(mcpPath, "utf-8") : null;
     const mcpContent = generateMcpRegistration(existingMcp, credential.mcpUrl);
@@ -1779,6 +2263,7 @@ async function install(options) {
     skippedPaths: report.skippedPaths,
     mergedPaths: report.mergedPaths,
     collidedPaths: report.collidedPaths,
+    replacedPaths: report.replacedPaths,
     bootstrapScanRan: scanResult.ran,
     legacyCredentialKept: migration.outcome === "kept" ? { keys: migration.unbacked, missing: migration.missingForAdoption } : null
   };
@@ -1944,6 +2429,7 @@ var SIGN_IN_TIMEOUT_MESSAGE = "Sign-in timed out: the Halfcycle service stopped
 var SIGN_IN_NON_INTERACTIVE_MESSAGE = "Halfcycle needs a signed-in account and this looks like a non-interactive run (CI is set), so there is no browser to sign in with. Set HALFCYCLE_TOKEN in the environment to a Halfcycle credential and run this again. Nothing was created.";
 var DEADLINE_SLACK_INTERVALS = 1;
 var STILL_WAITING_MS = 15e3;
+var DEFAULT_SIGN_IN_REASON = "create an engagement";
 function defaultWrite(text) {
   process.stdout.write(text);
 }
@@ -2133,7 +2619,7 @@ async function signIn(serviceUrl, deps = {}) {
   if (isNonInteractive(env)) {
     throw new SignInRefused(SIGN_IN_TIMED_OUT, SIGN_IN_NON_INTERACTIVE_MESSAGE);
   }
-  write(`[halfcycle] Halfcycle needs an account before it can create an engagement \u2014 signing you in through your browser.
+  write(`[halfcycle] Halfcycle needs an account before it can ${deps.reason ?? DEFAULT_SIGN_IN_REASON} \u2014 signing you in through your browser.
 `);
   const bind = await bindLoopback(env);
   let closed = false;
@@ -2290,6 +2776,12 @@ async function joinEngagement(baseUrl, engagementId, credential) {
     route: "POST /engagements/:engagementId/join"
   });
 }
+function withDeclaredTelemetryKey(raw) {
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw))
+    return null;
+  const obj = raw;
+  return "controlTelemetryUrl" in obj ? obj : { ...obj, controlTelemetryUrl: "" };
+}
 async function requestEngagementValues(url, requestBody, credential, shape) {
   const bearer = credential?.trim();
   let res;
@@ -2314,7 +2806,9 @@ async function requestEngagementValues(url, requestBody, credential, shape) {
     const wrongOrigin = res.status === 404 ? `That address answered, but it does not serve ${shape.route} \u2014 so it is not the Halfcycle service. ` : "";
     throw new Error(`[bundle install] ${shape.action} failed: ${url} returned ${res.status}. ${wrongOrigin}${detail ? `Response: ${detail.slice(0, 300)}. ` : ""}${shape.nothingHappened}. ` + CONTROL_ORIGIN_HINT);
   }
-  const body = await res.json().catch(() => null);
+  const candidate = withDeclaredTelemetryKey(await res.json().catch(() => null));
+  const declared = engagementCredentialResponseSchema.safeParse(candidate);
+  const body = declared.success ? declared.data : candidate;
   if (!body || typeof body.engagementId !== "string" || typeof body.sessionToken !== "string") {
     throw new Error(`[bundle install] ${shape.action} response from ${url} did not carry {engagementId, sessionToken}. ${shape.nothingHappened}. ` + CONTROL_ORIGIN_HINT);
   }
@@ -2333,6 +2827,16 @@ async function requestEngagementValues(url, requestBody, credential, shape) {
     throw new Error(`[bundle install] The Halfcycle service at ${url} created an engagement but did not say where its guard service lives (no guardUrl on the response). Without that address the install would wire a guard hook that evaluates nothing, so nothing was written. Either that service is older than this installer, or ${url} is not a Halfcycle service.`);
   }
   const controlTelemetryUrl = typeof body.controlTelemetryUrl === "string" && body.controlTelemetryUrl.trim() !== "" ? body.controlTelemetryUrl.trim().replace(/\/+$/, "") : void 0;
+  if (!declared.success) {
+    const fields = declared.error.issues.map((issue) => {
+      const unrecognised = issue.keys;
+      if (unrecognised && unrecognised.length > 0) {
+        return `unexpected: ${unrecognised.map(String).join(", ")}`;
+      }
+      return issue.path.length > 0 ? issue.path.map(String).join(".") : "(the body itself)";
+    }).join(", ");
+    throw new Error(`[bundle install] ${shape.action} response from ${url} is not the credential response this CLI is built to read (${fields}). ${shape.nothingHappened}. Either that service is a different version from this installer, or ${url} is not a Halfcycle service.`);
+  }
   return {
     engagementId: body.engagementId,
     sessionToken: body.sessionToken,
@@ -2671,7 +3175,8 @@ function currentEnvironment(quiet2) {
 // dist/confirm-identity.js
 var IDENTITY_TIMEOUT_MS = 5e3;
 var IDENTITY_DECLINED = "identity-declined";
-async function describeAccount(serviceUrl, credential, fetchImpl = fetch) {
+var CREDENTIAL_REFUSED = 401;
+async function askAccount(serviceUrl, credential, fetchImpl = fetch) {
   const url = `${serviceUrl.replace(/\/+$/, "")}/account`;
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), IDENTITY_TIMEOUT_MS);
@@ -2681,15 +3186,18 @@ async function describeAccount(serviceUrl, credential, fetchImpl = fetch) {
       signal: controller.signal
     });
     if (!res.ok)
-      return void 0;
+      return { identity: void 0, refused: res.status === CREDENTIAL_REFUSED };
     const parsed = safeParseAccountIdentity(await res.json());
-    return parsed.success ? parsed.data : void 0;
+    return { identity: parsed.success ? parsed.data : void 0, refused: false };
   } catch {
-    return void 0;
+    return { identity: void 0, refused: false };
   } finally {
     clearTimeout(timer);
   }
 }
+async function describeAccount(serviceUrl, credential, fetchImpl = fetch) {
+  return (await askAccount(serviceUrl, credential, fetchImpl)).identity;
+}
 function accountLabel(identity, storedAccountId, verbose2 = false) {
   const accountId = identity?.accountId ?? storedAccountId;
   if (identity?.email !== void 0 && identity.email.trim() !== "") {
@@ -3143,7 +3651,7 @@ function renderBuildRecordMarkdown(record2) {
     "",
     `**Format:** \`${record2.format}\` (markdown + JSON pair; portable, readable without Halfcycle systems)`,
     "",
-    "> This Build Record was assembled automatically at phase close by the method bundle (`packages/bundle`). Every data field below is projected from the companion JSON \u2014 no record content is hand-authored.",
+    "> This Build Record was assembled automatically at phase close by `npx halfcycle close-phase`. Every data field below is projected from the companion JSON \u2014 no record content is hand-authored.",
     "",
     `**Engagement:** ${record2.engagement} (${record2.engagementType})`,
     `**Phase:** ${phase.id} \u2014 ${phase.name}`,
@@ -3163,7 +3671,7 @@ function renderBuildRecordMarkdown(record2) {
     `- **Tools:** ${record2.delivered.tools.join(", ")}`,
     `- **Dogfood:** ${record2.delivered.dogfood}`,
     "",
-    guardsList ? `Guards evaluated (INV-007-safe results): ${guardsList}. *(Guard \`channel\`/\`version\` are guard-asset metadata, excluded from the v1 record \u2014 INV-007/INV-001.)*` : "No guards fired during this phase.",
+    guardsList ? `Guards evaluated (results only): ${guardsList}. *(What a guard reported about this phase is recorded; the guard's own definition and its history are not.)*` : "No guards fired during this phase.",
     "",
     `## Acceptance (independent walk \u2014 walker ${record2.acceptance.walker})`,
     "",
@@ -3175,7 +3683,7 @@ function renderBuildRecordMarkdown(record2) {
     ""
   ];
   if (record2.acceptance.inv002ProdBypassProbe) {
-    lines.push(`**INV-002 production bypass probe:** ${record2.acceptance.inv002ProdBypassProbe.result} \u2014 ${record2.acceptance.inv002ProdBypassProbe.detail}`, "");
+    lines.push(`**Production bypass probe:** ${record2.acceptance.inv002ProdBypassProbe.result} \u2014 ${record2.acceptance.inv002ProdBypassProbe.detail}`, "");
   }
   lines.push("## Gates that earned their keep", "", `**${record2.gatesEarnedKeep.defectsCaughtPreHuman}** defects were caught by the gates before the human walk; the walk itself found **${record2.gatesEarnedKeep.bugsReachingHumanWalk}**. Named: ${record2.gatesEarnedKeep.named.join("; ")}.`, "", "## Instruments", "", `- **Marginal-cost self-accounting:** ${record2.instruments.marginalCostSelfAccounting}`, `- **COE add-rate:** seam-new ${record2.instruments.coeAddRate.seamNew}, seam-repeat ${record2.instruments.coeAddRate.seamRepeat}, model-limitation ${record2.instruments.coeAddRate.modelLimitation}. ${record2.instruments.coeAddRate.notes}`, "", "## Invariants exercised", "", record2.invariantsExercised.join(", "), "", "## Deviations & decisions recorded", "", ...record2.deviations.map((d) => `- ${d}`), "", "## Tasks", "", `- **Planned:** ${record2.tasks.planned} \xB7 **Landed:** ${record2.tasks.landed} \xB7 **Cancelled:** ${record2.tasks.cancelled.length > 0 ? record2.tasks.cancelled.join(", ") : "none"}`, "");
   return lines.join("\n");
@@ -3568,15 +4076,115 @@ async function closePhase(credential, phase, outcome, close, home, repoRoot) {
   return { engagementId: body.engagementId, status: body.status, stampFailure, closeRecord };
 }
 
+// dist/ci-bind.js
+function parseCiRepositoryArg(arg) {
+  const parts = arg.split("/");
+  if (parts.length !== 2)
+    return null;
+  const [owner, repo] = parts;
+  if (owner === void 0 || owner.trim() === "")
+    return null;
+  if (repo === void 0 || repo.trim() === "")
+    return null;
+  return { owner, repo };
+}
+var CiBindRefused = class extends Error {
+  status;
+  constructor(status, message) {
+    super(message);
+    this.status = status;
+    this.name = "CiBindRefused";
+  }
+  /** Is this the ONE arm signing in again can fix — see this file's header. */
+  get authRefused() {
+    return this.status === 401;
+  }
+  /**
+   * Is this "ours to fix, try again", not "yours to fix"? The question is not
+   * mechanical (did a handler run) — it is what a developer reading the message
+   * does next. `502`/`504` are the reverse proxy in front of the published origin
+   * answering for a control plane that is down or slow, with an HTML body this
+   * file's own `requestBinding` cannot parse, so the message would otherwise
+   * degrade to a bare "the URL returned 502". `503` is `resolveAccount`'s own
+   * fail-closed refusal when it could not reach the token store — the caller's
+   * credential was never actually checked, and its posture is emphatic this is NOT
+   * a "no". **`500` belongs beside them, not with the 4xx arms.** It is an
+   * unhandled throw: nothing decided the request's merits, and the bind may even
+   * have half-happened if the throw landed after a commit. On this route the
+   * body is the same degraded "the URL returned 500" a 502/504 produces — an
+   * internal path echoed back with no advice — so `refused (500)` would send a
+   * developer to re-check ownership, the repository name and whether it is bound
+   * elsewhere: every 4xx question, none of them this status's actual cause.
+   *
+   * So this is every `5xx`, not an enumerated set of three — the boundary is
+   * "did any handler decide yes or no", and a 4xx is the only family that ever did.
+   */
+  get unavailable() {
+    return this.status >= 500 && this.status < 600;
+  }
+};
+async function requestBinding(method, serviceUrl, engagementId, repository, credential, noun) {
+  const url = `${serviceUrl.replace(/\/+$/, "")}/engagements/${encodeURIComponent(engagementId)}/ci-bindings/${encodeURIComponent(repository.owner)}/${encodeURIComponent(repository.repo)}`;
+  let res;
+  try {
+    res = await fetch(url, { method, headers: { authorization: `Bearer ${credential}` } });
+  } catch (err) {
+    throw new Error(`[halfcycle] Could not reach the Halfcycle service at ${url}: ${err instanceof Error ? err.message : String(err)}. Nothing was ${noun}.`);
+  }
+  if (res.status === 204)
+    return;
+  const body = await res.json().catch(() => null);
+  const message = typeof body?.message === "string" ? body.message : `${url} returned ${res.status}.`;
+  throw new CiBindRefused(res.status, message);
+}
+async function setCiBinding(action, serviceUrl, engagementId, repository, deps = {}) {
+  const noun = action === "bind" ? "bound" : "unbound";
+  const signInDeps = {
+    ...deps,
+    reason: deps.reason ?? (action === "bind" ? "trust this repository for this engagement's CI" : "stop trusting this repository for this engagement's CI")
+  };
+  let credential = await obtainCredential(serviceUrl, signInDeps);
+  for (; ; ) {
+    try {
+      await requestBinding(action === "bind" ? "PUT" : "DELETE", serviceUrl, engagementId, repository, credential.credential, noun);
+      return;
+    } catch (err) {
+      if (!(err instanceof CiBindRefused) || !err.authRefused)
+        throw err;
+      const replacement = await replaceRefusedCredential(serviceUrl, credential, signInDeps);
+      if (replacement === null) {
+        throw new SignInRefused(`ci-${action}-${err.status}`, `${err.message} ${refusedCredentialRemedy(credential.source)} Nothing was ${noun}.`);
+      }
+      process.stdout.write(`[halfcycle] Your saved Halfcycle sign-in was refused \u2014 signing you in again.
+`);
+      credential = replacement;
+    }
+  }
+}
+function bindCiRepository(serviceUrl, engagementId, repository, deps = {}) {
+  return setCiBinding("bind", serviceUrl, engagementId, repository, deps);
+}
+function unbindCiRepository(serviceUrl, engagementId, repository, deps = {}) {
+  return setCiBinding("unbind", serviceUrl, engagementId, repository, deps);
+}
+
 // dist/cli-contract.js
-var CLI_VERBS = ["install", "check-drift", "build-record", "open-phase", "close-phase"];
+var CLI_VERBS = ["install", "check-drift", "build-record", "open-phase", "close-phase", "ci"];
 var CONTRACTS = [
-  // `install`, `check-drift` and `build-record` take positionals and no required
-  // flags. They are declared so the verb set has ONE home — a remedy naming a verb
-  // this CLI does not have is the same defect as one missing a flag.
+  // `install`, `check-drift`, `build-record` and `ci` take positionals and no
+  // required flags. They are declared so the verb set has ONE home — a remedy
+  // naming a verb this CLI does not have is the same defect as one missing a flag.
+  //
+  // `ci`'s two forms (`ci bind <owner>/<repo>`, `ci unbind <owner>/<repo>`) take a
+  // sub-action and a repository as POSITIONALS, not flags — this table answers only
+  // *which flags must an invocation carry*, and neither form has one (T-11,
+  // `ci-oidc-token-exchange`). The route it calls declares no wire shape either
+  // (path segments in, `204` out — T-05), so there is no schema for an argument
+  // here to disagree with.
   { verb: "install", required: [], conditional: [] },
   { verb: "check-drift", required: [], conditional: [] },
   { verb: "build-record", required: [], conditional: [] },
+  { verb: "ci", required: [], conditional: [] },
   {
     verb: "open-phase",
     required: [
@@ -3610,7 +4218,7 @@ var CONTRACTS = [
       {
         flag: "--verdict",
         takesValue: true,
-        missingMessage: `halfcycle close-phase: --verdict must be "clean" or "defects" \u2014 it is the acceptance walk's own verdict (INV-009) and nothing derives it for you.`
+        missingMessage: `halfcycle close-phase: --verdict must be "clean" or "defects" \u2014 it is the acceptance walk's own verdict and nothing derives it for you.`
       },
       {
         flag: "--actor",
@@ -3769,10 +4377,9 @@ function openingBannerContent(projectDir, env = process.env, probes = REAL_PROBE
     fact("Claude Code", probes.claudeCodeVersion()),
     fact("Project", project, name),
     fact("Status", status, installed === void 0 ? "new" : "installed"),
-    // `Website`, NOT `Plane` (W-3, #868). "Plane" is our internal word for the control
-    // plane; the developer reading this has never heard it, and raw method vocabulary
-    // reaching a client surface is a recorded finding class in this product. The row
-    // answers *which Halfcycle is this*, and an address is the answer they recognise.
+    // `Website`, NOT `Plane` — see this function's docblock. (No issue number here:
+    // a comment beside a property survives into the published entry, unlike a
+    // leading docblock, which esbuild drops.)
     fact("Website", probes.websiteHost(env))
   ].filter((f) => f !== void 0);
   return {
@@ -3852,6 +4459,8 @@ var USAGE = `  halfcycle [install] [target-repo] [engagement-id] [self-build|cli
   halfcycle build-record <phase> [--repo <root>]
   halfcycle open-phase <phase|--none> --actor "\u2026" (--evidence "\u2026" | --override --reason "\u2026") [--repo <root>]
   halfcycle close-phase <phase> --verdict <clean|defects> --actor "\u2026" [--finding "\u2026"]\u2026 [--override --reason "\u2026"] [--repo <root>]
+  halfcycle ci bind <owner>/<repo> [--repo <root>]
+  halfcycle ci unbind <owner>/<repo> [--repo <root>]
 
   --quiet / -q: print no opening banner (any command)
   --verbose / -v: print full run detail (paths written, merged, skipped) on install
@@ -3866,7 +4475,7 @@ function isHalfcycleMonorepo(dir) {
 }
 async function main() {
   const [cmd, ...rest] = args;
-  const bareTarget = cmd !== void 0 && !cmd.startsWith("-") && !/^(check-drift|build-record|open-phase|close-phase)$/.test(cmd);
+  const bareTarget = cmd !== void 0 && !cmd.startsWith("-") && !/^(check-drift|build-record|open-phase|close-phase|ci)$/.test(cmd);
   const installArm = cmd === "install" || cmd === void 0 || bareTarget;
   const positionals = cmd === "install" ? rest : args;
   const targetRepo = installArm ? positionals[0] ?? process.cwd() : process.cwd();
@@ -3907,7 +4516,9 @@ ${USAGE}`);
       }
       const pinned = readPinnedEngagement(targetRepo);
       const requestedId = engagementIdArg ?? pinned?.engagementId;
-      const reusable = pinned !== null && pinned.engagementId === requestedId ? pinned.credential : void 0;
+      const held = pinned !== null && pinned.engagementId === requestedId ? pinned.credential : void 0;
+      const heldAnswer = held !== void 0 ? await askAccount(held.serviceUrl, held.token) : void 0;
+      const reusable = heldAnswer?.refused === true ? void 0 : held;
       let engagementId;
       let credential;
       let notThisAccountMessage;
@@ -4007,6 +4618,12 @@ ${USAGE}`);
       }
       if (result.collidedPaths.length > 0) {
         process.stdout.write(`[halfcycle] Collided (a name you already use \u2014 NOT overwritten): ${result.collidedPaths.join(", ")}
+`);
+      }
+      if (result.replacedPaths.length > 0) {
+        process.stdout.write(`[halfcycle] Updated (files Halfcycle wrote earlier, now replaced): ${result.replacedPaths.join(", ")}
+`);
+        process.stdout.write(`[halfcycle]   If you had changed one of those: a change you had COMMITTED is still in your git history ("git log -p -- <path>"). A change you had not committed is gone \u2014 this command overwrote the file.
 `);
       }
       if (result.legacyCredentialKept !== null) {
@@ -4047,7 +4664,7 @@ ${USAGE}`);
 `);
       }
       reportClaudeCodeVersion(verbose);
-      const identity = actingIdentity ?? (credential ? await describeAccount(credential.serviceUrl, credential.token) : void 0);
+      const identity = actingIdentity ?? heldAnswer?.identity ?? (credential && heldAnswer === void 0 ? await describeAccount(credential.serviceUrl, credential.token) : void 0);
       const written = result.writtenPaths.length;
       const merged = result.mergedPaths.length;
       process.stdout.write(`[halfcycle] Signed in as ${accountLabel(identity, actingAccountId, verbose)}
@@ -4318,6 +4935,69 @@ halfcycle close-phase: until ${closed.stampFailure.path} can be written, guard e
         return;
       }
       process.stderr.write(`halfcycle close-phase failed: ${err instanceof Error ? err.message : String(err)}
+`);
+      process.exit(1);
+    }
+    return;
+  }
+  if (cmd === "ci") {
+    const repoRoot = flagValue(rest, "--repo") ?? process.cwd();
+    const positionals2 = rest.filter((token, i) => !token.startsWith("--") && !(i > 0 && rest[i - 1] === "--repo"));
+    const action = positionals2[0];
+    const repositoryArg = positionals2[1];
+    if (action !== "bind" && action !== "unbind") {
+      process.stderr.write("halfcycle ci: name bind or unbind.\n  halfcycle ci bind <owner>/<repo> [--repo <root>]\n  halfcycle ci unbind <owner>/<repo> [--repo <root>]\n");
+      process.exit(2);
+      return;
+    }
+    if (repositoryArg === void 0) {
+      process.stderr.write(`halfcycle ci ${action}: name the repository, as owner/repo.
+`);
+      process.exit(2);
+      return;
+    }
+    const repository = parseCiRepositoryArg(repositoryArg);
+    if (repository === null) {
+      process.stderr.write(`halfcycle ci ${action}: "${repositoryArg}" is not a repository \u2014 give it as owner/repo, exactly as GitHub spells it, for example acme/widgets.
+`);
+      process.exit(2);
+      return;
+    }
+    const pin = readBundlePin(repoRoot);
+    if (pin === null || pin.engagementId === "") {
+      process.stderr.write(`halfcycle ci ${action}: ${join11(repoRoot, ".halfcycle", "bundle.json")} names no Halfcycle engagement. Run \`npx halfcycle\` here first.
+`);
+      process.exit(1);
+      return;
+    }
+    try {
+      const controlOrigin = resolveControlOrigin(process.env);
+      const label = `${repository.owner}/${repository.repo}`;
+      if (action === "bind") {
+        await bindCiRepository(controlOrigin.origin, pin.engagementId, repository);
+        process.stdout.write(`[halfcycle] ${label} now trusts this engagement's CI \u2014 a workflow there granting both \`contents: read\` and \`id-token: write\` can authenticate with no stored secret. Both lines: declaring any permission replaces the defaults, so naming only the identity token stops a private repository checking out.
+`);
+      } else {
+        await unbindCiRepository(controlOrigin.origin, pin.engagementId, repository);
+        process.stdout.write(`[halfcycle] ${label} no longer trusts this engagement's CI.
+`);
+      }
+      process.exit(0);
+    } catch (err) {
+      if (err instanceof SignInRefused) {
+        process.stderr.write(`halfcycle ci ${action}: ${err.message}
+`);
+        process.exit(1);
+        return;
+      }
+      if (err instanceof CiBindRefused) {
+        const label = err.unavailable ? `temporarily unavailable (${err.status})` : `refused (${err.status})`;
+        process.stderr.write(`halfcycle ci ${action}: ${label}. ${err.message}
+`);
+        process.exit(1);
+        return;
+      }
+      process.stderr.write(`halfcycle ci ${action} failed: ${err instanceof Error ? err.message : String(err)}
 `);
       process.exit(1);
     }