halfcycle 0.3.8 → 0.3.10

package/dist/bin.js

@@ -10,346 +10,6 @@ import { existsSync as existsSync3, mkdirSync as mkdirSync4, readFileSync as rea
 import { dirname as dirname2, join as join5, relative } from "node:path";
 import { fileURLToPath } from "node:url";
 
-// dist/engagement-credential.js
-import { chmodSync as chmodSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
-import { platform as platform2 } from "node:os";
-import { join as join2 } from "node:path";
-
-// dist/account-credential.js
-import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { homedir, platform } from "node:os";
-import { dirname, join } from "node:path";
-function halfcycleHome(home) {
-  return join(home ?? homedir(), ".halfcycle");
-}
-function accountStorePath(home) {
-  return join(halfcycleHome(home), "account.json");
-}
-function normaliseOrigin(serviceUrl) {
-  return serviceUrl.trim().replace(/\/+$/, "").toLowerCase();
-}
-function readStore(home) {
-  let raw;
-  try {
-    raw = readFileSync(accountStorePath(home), "utf-8");
-  } catch {
-    return { version: 1, accounts: {} };
-  }
-  try {
-    const parsed = JSON.parse(raw);
-    if (!parsed || typeof parsed !== "object" || typeof parsed.accounts !== "object") {
-      return { version: 1, accounts: {} };
-    }
-    return { version: 1, accounts: parsed.accounts ?? {} };
-  } catch {
-    return { version: 1, accounts: {} };
-  }
-}
-function writeStore(store, home) {
-  const path = accountStorePath(home);
-  mkdirSync(dirname(path), { recursive: true, mode: 448 });
-  writeFileSync(path, `${JSON.stringify(store, null, 2)}
-`, { mode: 384 });
-  if (platform() !== "win32") {
-    chmodSync(path, 384);
-    try {
-      chmodSync(dirname(path), 448);
-    } catch {
-    }
-  }
-}
-function readStoredCredential(serviceUrl, home) {
-  const entry = readStore(home).accounts[normaliseOrigin(serviceUrl)];
-  if (!entry || typeof entry.credential !== "string" || entry.credential.trim() === "") {
-    return void 0;
-  }
-  return entry;
-}
-function writeStoredCredential(serviceUrl, entry, home) {
-  const store = readStore(home);
-  store.accounts[normaliseOrigin(serviceUrl)] = {
-    accountId: entry.accountId,
-    credential: entry.credential,
-    expiresAt: entry.expiresAt,
-    signedInAt: entry.signedInAt ?? (/* @__PURE__ */ new Date()).toISOString()
-  };
-  writeStore(store, home);
-}
-function forgetStoredCredential(serviceUrl, home) {
-  const store = readStore(home);
-  const key = normaliseOrigin(serviceUrl);
-  if (!(key in store.accounts))
-    return false;
-  delete store.accounts[key];
-  writeStore(store, home);
-  return true;
-}
-
-// dist/engagement-credential.js
-var ENGAGEMENTS_DIR = "engagements";
-var ENV_FILENAME = "env";
-var PIN_ENGAGEMENT_ID_FIELD = "engagementId";
-function engagementStateDir(engagementId, home) {
-  return join2(halfcycleHome(home), ENGAGEMENTS_DIR, engagementId);
-}
-function engagementEnvPath(engagementId, home) {
-  return join2(engagementStateDir(engagementId, home), ENV_FILENAME);
-}
-var GUARD_ENV_KEYS = [
-  "GUARD_SERVICE_URL",
-  "GUARD_SERVICE_TOKEN",
-  "GUARD_ENGAGEMENT_ID"
-];
-var ENGAGEMENT_ENV_KEYS = [
-  "HALFCYCLE_SERVICE_URL",
-  "HALFCYCLE_MCP_URL",
-  "HALFCYCLE_TOKEN",
-  "HALFCYCLE_ENGAGEMENT_ID",
-  ...GUARD_ENV_KEYS,
-  "CONTROL_TELEMETRY_URL"
-];
-var ENV_HEADER = "# Halfcycle per-engagement credential \u2014 machine level, owner-only, never in a repository.";
-function shq(value) {
-  return `'${value.replace(/'/g, `'\\''`)}'`;
-}
-function unquote(value) {
-  const v = value.trim();
-  if (v.length >= 2 && v.startsWith("'") && v.endsWith("'")) {
-    return v.slice(1, -1).split(`'\\''`).join(`'`);
-  }
-  if (v.length >= 2 && v.startsWith('"') && v.endsWith('"'))
-    return v.slice(1, -1);
-  return v;
-}
-function parseEnvText(raw) {
-  const out = {};
-  for (const line of raw.split("\n")) {
-    const eq = line.indexOf("=");
-    if (eq === -1)
-      continue;
-    const key = line.slice(0, eq).replace(/^\s*export\s+/, "").trim();
-    if (key === "" || key.startsWith("#"))
-      continue;
-    out[key] = unquote(line.slice(eq + 1));
-  }
-  return out;
-}
-function reconcileEnvText(existing, values, keys = ENGAGEMENT_ENV_KEYS) {
-  const desired = new Map(keys.map((k) => [k, values[k] ?? ""]));
-  const line = (k) => `${k}=${shq(desired.get(k) ?? "")}`;
-  if (existing === null) {
-    return `${ENV_HEADER}
-` + keys.map(line).join("\n") + "\n";
-  }
-  const seen = /* @__PURE__ */ new Set();
-  const out = existing.split("\n").map((existingLine) => {
-    const eq = existingLine.indexOf("=");
-    if (eq === -1)
-      return existingLine;
-    const lhs = existingLine.slice(0, eq);
-    const exported = /^\s*export\s+/.exec(lhs);
-    const prefix = exported === null ? "" : exported[0];
-    const key = lhs.slice(prefix.length).trim();
-    if (desired.has(key)) {
-      seen.add(key);
-      return `${prefix}${line(key)}`;
-    }
-    return existingLine;
-  });
-  const missing = keys.filter((k) => !seen.has(k));
-  if (missing.length > 0) {
-    const trailingBlank = out.length > 0 && out[out.length - 1] === "";
-    const prefix = trailingBlank ? "" : existing.endsWith("\n") ? "" : "\n";
-    out.push(`${prefix}${ENV_HEADER}
-` + missing.map(line).join("\n"));
-  }
-  let result = out.join("\n");
-  if (existing.endsWith("\n") && !result.endsWith("\n"))
-    result += "\n";
-  return result;
-}
-function readEngagementEnv(engagementId, home) {
-  try {
-    return parseEnvText(readFileSync2(engagementEnvPath(engagementId, home), "utf-8"));
-  } catch {
-    return null;
-  }
-}
-function writeEngagementEnv(engagementId, values, home) {
-  const path = engagementEnvPath(engagementId, home);
-  const dir = engagementStateDir(engagementId, home);
-  mkdirSync2(dir, { recursive: true, mode: 448 });
-  let existing;
-  try {
-    existing = readFileSync2(path, "utf-8");
-  } catch {
-    existing = null;
-  }
-  const reconciled = reconcileEnvText(existing, values);
-  const outcome = existing === reconciled ? "skipped" : "written";
-  if (outcome === "written") {
-    writeFileSync2(path, reconciled, { mode: 384 });
-  }
-  applyOwnerOnly(path, dir);
-  return outcome;
-}
-function applyOwnerOnly(path, dir) {
-  if (platform2() === "win32")
-    return;
-  try {
-    chmodSync2(path, 384);
-  } catch {
-  }
-  try {
-    chmodSync2(dir, 448);
-  } catch {
-  }
-}
-function engagementResolutionShell() {
-  return `# --- Halfcycle credential resolution (generated; do not edit) ----------------
-# THE CREDENTIAL IS NOT IN THIS REPOSITORY. It lives at
-#   $HOME/.halfcycle/${ENGAGEMENTS_DIR}/<engagement-id>/${ENV_FILENAME}
-# written owner-only by \`npx halfcycle\`. What this repository holds is the
-# engagement id, in the committed .halfcycle/bundle.json. So: read the id out of
-# the pin, then name the file. There is no jq here and node is not dependable on a
-# desktop session's PATH, so the id is cut out with sed \u2014 after flattening the
-# file, because sed is line-oriented and the pin's line breaks are not a contract.
-#
-# Sets HALFCYCLE_ENV_FILE, HALFCYCLE_ENV_ENGAGEMENT and HALFCYCLE_ENV_PROBLEM in
-# the CALLER's shell and returns a status. Call it as \`if halfcycle_env_file \u2026\`,
-# never as \`$(halfcycle_env_file \u2026)\` \u2014 a command substitution is a subshell and
-# would discard everything it set.
-halfcycle_env_file() {
-  HALFCYCLE_ENV_FILE=""
-  HALFCYCLE_ENV_ENGAGEMENT=""
-  HALFCYCLE_ENV_PROBLEM=""
-  hc_pin="$1/.halfcycle/bundle.json"
-  if [ ! -f "$hc_pin" ]; then
-    HALFCYCLE_ENV_PROBLEM="no-pin"
-    return 1
-  fi
-  hc_id=$(tr -d '\\n' < "$hc_pin" | sed -n 's/.*"${PIN_ENGAGEMENT_ID_FIELD}"[[:space:]]*:[[:space:]]*"\\([^"]*\\)".*/\\1/p')
-  if [ -z "$hc_id" ]; then
-    HALFCYCLE_ENV_PROBLEM="no-id"
-    return 1
-  fi
-  HALFCYCLE_ENV_ENGAGEMENT="$hc_id"
-  if [ -z "\${HOME:-}" ]; then
-    HALFCYCLE_ENV_PROBLEM="no-home"
-    return 1
-  fi
-  hc_env="$HOME/.halfcycle/${ENGAGEMENTS_DIR}/$hc_id/${ENV_FILENAME}"
-  if [ ! -f "$hc_env" ]; then
-    HALFCYCLE_ENV_PROBLEM="no-credential"
-    return 1
-  fi
-  HALFCYCLE_ENV_FILE="$hc_env"
-  return 0
-}
-# --- end Halfcycle credential resolution ------------------------------------`;
-}
-
-// dist/identity.js
-import { execFileSync } from "node:child_process";
-import { existsSync, readFileSync as readFileSync3 } from "node:fs";
-import { join as join3 } from "node:path";
-import { randomUUID } from "node:crypto";
-var PROJECT_IDENTITY_NOTE = 'projectId is NOT the engagement id \u2014 it identifies this repository/worktree to Halfcycle, not an engagement. The engagement id lives in .halfcycle/bundle.json, in its "engagementId" field.';
-function git(targetRepoRoot, args2) {
-  try {
-    const out = execFileSync("git", ["-C", targetRepoRoot, ...args2], {
-      encoding: "utf-8",
-      stdio: ["ignore", "pipe", "ignore"]
-    });
-    const trimmed = out.trim();
-    return trimmed.length > 0 ? trimmed : null;
-  } catch {
-    return null;
-  }
-}
-function readRootCommit(targetRepoRoot) {
-  const roots = git(targetRepoRoot, ["rev-list", "--max-parents=0", "HEAD"]);
-  if (!roots)
-    return null;
-  const lines = roots.split("\n").filter((l) => l.length > 0);
-  return lines.length > 0 ? lines[lines.length - 1] : null;
-}
-function readRemote(targetRepoRoot) {
-  return git(targetRepoRoot, ["remote", "get-url", "origin"]);
-}
-function mintOrReadIdentity(targetRepoRoot) {
-  const path = join3(targetRepoRoot, ".halfcycle", "project.json");
-  if (existsSync(path)) {
-    const onDisk = JSON.parse(readFileSync3(path, "utf-8"));
-    const identity2 = {
-      projectId: onDisk.projectId ?? "",
-      rootCommit: onDisk.rootCommit ?? null,
-      remote: onDisk.remote ?? null,
-      note: PROJECT_IDENTITY_NOTE
-    };
-    return { identity: identity2, minted: false };
-  }
-  const identity = {
-    projectId: randomUUID(),
-    rootCommit: readRootCommit(targetRepoRoot),
-    remote: readRemote(targetRepoRoot),
-    note: PROJECT_IDENTITY_NOTE
-  };
-  return { identity, minted: true };
-}
-
-// dist/mcp-endpoint.js
-var MCP_ENDPOINT_PATH = "/mcp";
-function mcpEndpointUrl(origin) {
-  return `${origin.trim().replace(/\/+$/, "")}${MCP_ENDPOINT_PATH}`;
-}
-
-// dist/merge-settings.js
-function isHalfcycleEntry(entry, halfcycleCommands) {
-  return entry.hooks.some((h) => halfcycleCommands.has(h.command));
-}
-function mergeSettings(existing, generated) {
-  const merged = { ...existing };
-  if (generated.$schema !== void 0) {
-    merged.$schema = generated.$schema;
-  }
-  const generatedHooks = generated.hooks ?? {};
-  const halfcycleCommands = /* @__PURE__ */ new Set();
-  for (const entries of Object.values(generatedHooks)) {
-    for (const entry of entries) {
-      for (const h of entry.hooks)
-        halfcycleCommands.add(h.command);
-    }
-  }
-  const existingHooks = existing.hooks ?? {};
-  const mergedHooks = {};
-  const events = /* @__PURE__ */ new Set([...Object.keys(existingHooks), ...Object.keys(generatedHooks)]);
-  for (const event of events) {
-    const developerEntries = (existingHooks[event] ?? []).filter((entry) => !isHalfcycleEntry(entry, halfcycleCommands));
-    const halfcycleEntries = generatedHooks[event] ?? [];
-    mergedHooks[event] = [...developerEntries, ...halfcycleEntries];
-  }
-  merged.hooks = mergedHooks;
-  merged.permissions = mergePermissions(existing.permissions, generated.permissions);
-  return merged;
-}
-function mergePermissions(existing, generated) {
-  if (existing === void 0 && generated === void 0)
-    return void 0;
-  const result = { ...existing ?? {} };
-  const generatedDeny = generated?.deny ?? [];
-  if (generatedDeny.length > 0) {
-    const theirs = existing?.deny ?? [];
-    const seen = new Set(theirs);
-    result.deny = [...theirs, ...generatedDeny.filter((p) => !seen.has(p))];
-  }
-  return result;
-}
-
-// dist/scan.js
-import { existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "node:fs";
-import { join as join4 } from "node:path";
-
 // ../events/dist/result.js
 import { z as z2 } from "zod";
 
@@ -544,171 +204,567 @@ var coeFindingRequestSchema = z4.object({
   addRateTag: z4.enum(["seam-new", "seam-repeat", "model-limitation"]),
   mappedPatternRef: z4.string().nullable()
 }).strict();
-var coeFindingResponseSchema = z4.object({
-  findingId: z4.string(),
-  engagementId: z4.string(),
-  phase: z4.string(),
-  description: z4.string(),
-  addRateTag: z4.enum(["seam-new", "seam-repeat", "model-limitation"]),
-  mappedPatternRef: z4.string().nullable(),
-  createdAt: utcIso86012
+var coeFindingResponseSchema = z4.object({
+  findingId: z4.string(),
+  engagementId: z4.string(),
+  phase: z4.string(),
+  description: z4.string(),
+  addRateTag: z4.enum(["seam-new", "seam-repeat", "model-limitation"]),
+  mappedPatternRef: z4.string().nullable(),
+  createdAt: utcIso86012
+}).strict();
+var phaseEntryDecisionSchema = z4.discriminatedUnion("decision", [
+  z4.object({
+    decision: z4.literal("entry-condition-met"),
+    /** Who attests. */
+    actor: z4.string(),
+    /** What makes the entry condition hold, in the attester's own words. */
+    evidence: z4.string()
+  }).strict(),
+  z4.object({
+    decision: z4.literal("override"),
+    /** Who is opening it anyway. */
+    actor: z4.string(),
+    /** Why, in the operator's own words. */
+    reason: z4.string()
+  }).strict()
+]);
+var PHASE_ENTRY_DECISION_KINDS = [
+  "entry-condition-met",
+  "override"
+];
+var PHASE_CLOSE_DECISION_KINDS = ["phase-closed", "phase-close-override"];
+var phaseDecisionKindSchema = z4.enum([
+  ...PHASE_ENTRY_DECISION_KINDS,
+  ...PHASE_CLOSE_DECISION_KINDS
+]);
+var openPhaseRequestSchema = z4.object({
+  phase: z4.string().nullable(),
+  entry: phaseEntryDecisionSchema
+}).strict();
+var phaseEntryDecisionRecordSchema = z4.object({
+  decisionId: z4.string(),
+  decision: z4.enum(PHASE_ENTRY_DECISION_KINDS),
+  actor: z4.string(),
+  /** The evidence (attestation) or the reason (override) — one basis per row. */
+  justification: z4.string(),
+  blockingFinding: z4.string().nullable(),
+  decidedAt: utcIso86012
+}).strict();
+var openPhaseResponseSchema = z4.object({
+  engagement: engagementStatusResponseSchema,
+  /** What is open now. `null` is project scope. */
+  phase: z4.string().nullable(),
+  /** What was open before this decision. `null` is project scope. */
+  previousPhase: z4.string().nullable(),
+  decision: phaseEntryDecisionRecordSchema
+}).strict();
+
+// ../events/dist/crew.js
+import { z as z5 } from "zod";
+var crewGroupSchema = z5.enum(["builder", "reviewer", "always-on"]);
+var crewTierSchema = z5.enum(["deep", "standard", "fast"]);
+var CREW_DISCIPLINE_MAX = 64;
+var crewMemberSchema = z5.object({
+  // The agent's name. The same twenty-one on every project, so a name is a
+  // vocabulary a returning client already knows.
+  callsign: z5.string().min(1).max(32),
+  // Which of the three headings this member reads under.
+  group: crewGroupSchema,
+  // The kind of work this member takes. A task names a discipline, and only
+  // agents holding it can be dispatched to it.
+  discipline: z5.string().min(1).max(CREW_DISCIPLINE_MAX),
+  // How much thinking this member brings. There is no field naming the supplier
+  // behind it, on this shape or on any other.
+  tier: crewTierSchema
+}).strict();
+var CREW_ROSTER = [
+  // ── builders: code ──────────────────────────────────────────────────────────
+  { callsign: "ADA", group: "builder", discipline: "implementation", tier: "deep" },
+  { callsign: "OTTO", group: "builder", discipline: "implementation", tier: "deep" },
+  { callsign: "MILO", group: "builder", discipline: "implementation", tier: "standard" },
+  { callsign: "NOVA", group: "builder", discipline: "implementation", tier: "standard" },
+  { callsign: "KAI", group: "builder", discipline: "implementation", tier: "standard" },
+  { callsign: "HUGO", group: "builder", discipline: "infrastructure", tier: "standard" },
+  { callsign: "WREN", group: "builder", discipline: "refactor", tier: "fast" },
+  { callsign: "PIP", group: "builder", discipline: "refactor", tier: "fast" },
+  // ── builders: specs and docs ────────────────────────────────────────────────
+  { callsign: "IRIS", group: "builder", discipline: "feature spec", tier: "deep" },
+  { callsign: "JUNO", group: "builder", discipline: "feature spec", tier: "standard" },
+  { callsign: "LEX", group: "builder", discipline: "context & docs", tier: "fast" },
+  // ── reviewers ───────────────────────────────────────────────────────────────
+  { callsign: "VERA", group: "reviewer", discipline: "spec consistency", tier: "deep" },
+  { callsign: "ODIN", group: "reviewer", discipline: "cross-spec audit", tier: "deep" },
+  { callsign: "CASS", group: "reviewer", discipline: "code review", tier: "deep" },
+  { callsign: "THEO", group: "reviewer", discipline: "code review", tier: "standard" },
+  { callsign: "ECHO", group: "reviewer", discipline: "test quality", tier: "standard" },
+  { callsign: "MAVIS", group: "reviewer", discipline: "suites & coverage", tier: "standard" },
+  { callsign: "ZARA", group: "reviewer", discipline: "smoke & walk aid", tier: "standard" },
+  { callsign: "NORA", group: "reviewer", discipline: "evidence & provenance", tier: "fast" },
+  // ── always on: continuous, takes no task ────────────────────────────────────
+  { callsign: "ARGUS", group: "always-on", discipline: "guard \xB7 every diff", tier: "standard" },
+  { callsign: "ATLAS", group: "always-on", discipline: "coordinator", tier: "deep" }
+];
+var CREW_ROSTER_SIZE = CREW_ROSTER.length;
+var CREW_CALLSIGNS = CREW_ROSTER.map((member) => member.callsign);
+
+// ../events/dist/device-auth.js
+import { z as z6 } from "zod";
+var utcIso86013 = z6.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/, "must be a UTC ISO-8601 timestamp ending in Z (INV-015)");
+var DEVICE_AUTH_STATUS = {
+  /** The poll: minted, nobody has acted yet. Keep polling. 200. */
+  PENDING: "pending",
+  /** The poll: approved, and the credential is in this body. Once only. 200. */
+  APPROVED: "approved",
+  /** Confirm: the decision was recorded (approve or decline). 200. */
+  RECORDED: "recorded",
+  /** The human refused at the confirmation page. 400 on the poll. */
+  DECLINED: "declined",
+  /** The code's absolute expiry has passed. 400. */
+  EXPIRED: "expired",
+  /** Never minted, or already spent. 400. */
+  UNKNOWN: "unknown",
+  /** Confirm: neither `approve` nor `decline` was named. Nothing was bound. 400. */
+  INVALID_DECISION: "invalid-decision",
+  /** Confirm: an approval arrived with no signed-in identity. 400. */
+  IDENTITY_REQUIRED: "identity-required",
+  /** This deployment has no `SIGNIN_BASE_URL` / `DEVICE_AUTH_CONFIRM_SECRET`. 503. */
+  NOT_CONFIGURED: "not-configured",
+  /** Confirm: the shared confirmation secret was missing or wrong. 401. */
+  UNAUTHORIZED: "unauthorized",
+  /** Confirm: the code was already approved, declined or claimed. 409. */
+  ALREADY_DECIDED: "already-decided",
+  /**
+   * Confirm: an approval named a signed-in identity whose account has not accepted
+   * the terms of service and privacy policy currently in force (T-18, #588). 400.
+   *
+   * NOT BOUND TO THE DEVICE CODE. Unlike every other refusal in this const, this one
+   * says nothing about the code itself — the code is still `pending` after this
+   * response, exactly as it was before the request, so the SAME userCode can be
+   * confirmed again once the caller has recorded acceptance. `deviceConfirmRequestSchema`'s
+   * `acceptTerms` is how a second confirm says it did.
+   */
+  TERMS_REQUIRED: "terms-required"
+};
+var DEVICE_POLL_REFUSALS = [
+  DEVICE_AUTH_STATUS.DECLINED,
+  DEVICE_AUTH_STATUS.EXPIRED,
+  DEVICE_AUTH_STATUS.UNKNOWN
+];
+var deviceAuthStartResponseSchema = z6.object({
+  deviceCode: z6.string().min(1),
+  userCode: z6.string().min(1),
+  verificationUrl: z6.string().min(1),
+  expiresAt: utcIso86013,
+  pollIntervalMs: z6.number().int().positive()
+}).strict();
+var devicePollPendingSchema = z6.object({
+  status: z6.literal(DEVICE_AUTH_STATUS.PENDING),
+  pollIntervalMs: z6.number().int().positive()
 }).strict();
-var phaseEntryDecisionSchema = z4.discriminatedUnion("decision", [
-  z4.object({
-    decision: z4.literal("entry-condition-met"),
-    /** Who attests. */
-    actor: z4.string(),
-    /** What makes the entry condition hold, in the attester's own words. */
-    evidence: z4.string()
-  }).strict(),
-  z4.object({
-    decision: z4.literal("override"),
-    /** Who is opening it anyway. */
-    actor: z4.string(),
-    /** Why, in the operator's own words. */
-    reason: z4.string()
-  }).strict()
-]);
-var openPhaseRequestSchema = z4.object({
-  phase: z4.string().nullable(),
-  entry: phaseEntryDecisionSchema
+var devicePollApprovedSchema = z6.object({
+  status: z6.literal(DEVICE_AUTH_STATUS.APPROVED),
+  accountId: z6.string().min(1),
+  credential: z6.string().min(1),
+  expiresAt: utcIso86013
 }).strict();
-var phaseEntryDecisionRecordSchema = z4.object({
-  decisionId: z4.string(),
-  decision: z4.enum(["entry-condition-met", "override"]),
-  actor: z4.string(),
-  /** The evidence (attestation) or the reason (override) — one basis per row. */
-  justification: z4.string(),
-  blockingFinding: z4.string().nullable(),
-  decidedAt: utcIso86012
+var deviceAuthRefusalSchema = z6.object({
+  status: z6.enum([
+    DEVICE_AUTH_STATUS.DECLINED,
+    DEVICE_AUTH_STATUS.EXPIRED,
+    DEVICE_AUTH_STATUS.UNKNOWN,
+    DEVICE_AUTH_STATUS.INVALID_DECISION,
+    DEVICE_AUTH_STATUS.IDENTITY_REQUIRED,
+    DEVICE_AUTH_STATUS.NOT_CONFIGURED,
+    DEVICE_AUTH_STATUS.UNAUTHORIZED,
+    DEVICE_AUTH_STATUS.ALREADY_DECIDED,
+    DEVICE_AUTH_STATUS.TERMS_REQUIRED
+  ]),
+  message: z6.string().min(1)
 }).strict();
-var openPhaseResponseSchema = z4.object({
-  engagement: engagementStatusResponseSchema,
-  /** What is open now. `null` is project scope. */
-  phase: z4.string().nullable(),
-  /** What was open before this decision. `null` is project scope. */
-  previousPhase: z4.string().nullable(),
-  decision: phaseEntryDecisionRecordSchema
+var devicePollResponseSchema = z6.union([
+  devicePollPendingSchema,
+  devicePollApprovedSchema,
+  deviceAuthRefusalSchema
+]);
+var deviceConfirmRequestSchema = z6.object({
+  userCode: z6.string().min(1),
+  decision: z6.enum(["approve", "decline"]),
+  externalAuthId: z6.string().min(1).optional(),
+  email: z6.string().optional(),
+  acceptTerms: z6.boolean().optional()
 }).strict();
+var deviceConfirmRecordedSchema = z6.object({
+  status: z6.literal(DEVICE_AUTH_STATUS.RECORDED),
+  accountId: z6.string().min(1).optional()
+}).strict();
+var deviceConfirmResponseSchema = z6.union([
+  deviceConfirmRecordedSchema,
+  deviceAuthRefusalSchema
+]);
+var LOOPBACK_REDIRECT_HOST = "127.0.0.1";
+var LOOPBACK_PORT_MIN = 1024;
+var LOOPBACK_PORT_MAX = 65535;
+var LOOPBACK_CALLBACK_PATH = "/halfcycle-cli-callback";
+var LOOPBACK_QUERY_PORT = "loopback_port";
+var LOOPBACK_QUERY_STATE = "loopback_state";
+var LOOPBACK_QUERY_RESULT = "result";
+var LOOPBACK_RESULT = {
+  APPROVED: "approved",
+  DECLINED: "declined"
+};
+function loopbackVerificationUrl(verificationUrl, target) {
+  let url;
+  try {
+    url = new URL(verificationUrl);
+  } catch {
+    return verificationUrl;
+  }
+  url.searchParams.set(LOOPBACK_QUERY_PORT, String(target.port));
+  url.searchParams.set(LOOPBACK_QUERY_STATE, target.state);
+  return url.toString();
+}
+
+// dist/engagement-credential.js
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { platform as platform2 } from "node:os";
+import { join as join2 } from "node:path";
+
+// dist/account-credential.js
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir, platform } from "node:os";
+import { dirname, join } from "node:path";
+function halfcycleHome(home) {
+  return join(home ?? homedir(), ".halfcycle");
+}
+function accountStorePath(home) {
+  return join(halfcycleHome(home), "account.json");
+}
+function normaliseOrigin(serviceUrl) {
+  return serviceUrl.trim().replace(/\/+$/, "").toLowerCase();
+}
+function readStore(home) {
+  let raw;
+  try {
+    raw = readFileSync(accountStorePath(home), "utf-8");
+  } catch {
+    return { version: 1, accounts: {} };
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || typeof parsed.accounts !== "object") {
+      return { version: 1, accounts: {} };
+    }
+    return { version: 1, accounts: parsed.accounts ?? {} };
+  } catch {
+    return { version: 1, accounts: {} };
+  }
+}
+function writeStore(store, home) {
+  const path = accountStorePath(home);
+  mkdirSync(dirname(path), { recursive: true, mode: 448 });
+  writeFileSync(path, `${JSON.stringify(store, null, 2)}
+`, { mode: 384 });
+  if (platform() !== "win32") {
+    chmodSync(path, 384);
+    try {
+      chmodSync(dirname(path), 448);
+    } catch {
+    }
+  }
+}
+function readStoredCredential(serviceUrl, home) {
+  const entry = readStore(home).accounts[normaliseOrigin(serviceUrl)];
+  if (!entry || typeof entry.credential !== "string" || entry.credential.trim() === "") {
+    return void 0;
+  }
+  return entry;
+}
+function writeStoredCredential(serviceUrl, entry, home) {
+  const store = readStore(home);
+  store.accounts[normaliseOrigin(serviceUrl)] = {
+    accountId: entry.accountId,
+    credential: entry.credential,
+    expiresAt: entry.expiresAt,
+    signedInAt: entry.signedInAt ?? (/* @__PURE__ */ new Date()).toISOString()
+  };
+  writeStore(store, home);
+}
+function forgetStoredCredential(serviceUrl, home) {
+  const store = readStore(home);
+  const key = normaliseOrigin(serviceUrl);
+  if (!(key in store.accounts))
+    return false;
+  delete store.accounts[key];
+  writeStore(store, home);
+  return true;
+}
+
+// dist/engagement-credential.js
+var ENGAGEMENTS_DIR = "engagements";
+var ENV_FILENAME = "env";
+var PIN_ENGAGEMENT_ID_FIELD = "engagementId";
+function engagementStateDir(engagementId, home) {
+  return join2(halfcycleHome(home), ENGAGEMENTS_DIR, engagementId);
+}
+function engagementEnvPath(engagementId, home) {
+  return join2(engagementStateDir(engagementId, home), ENV_FILENAME);
+}
+var GUARD_ENV_KEYS = [
+  "GUARD_SERVICE_URL",
+  "GUARD_SERVICE_TOKEN",
+  "GUARD_ENGAGEMENT_ID"
+];
+var GUARD_COVERAGE_REQUIRED_KEYS = GUARD_ENV_KEYS.filter((key) => key !== "GUARD_SERVICE_URL");
+var ENGAGEMENT_ENV_KEYS = [
+  "HALFCYCLE_SERVICE_URL",
+  "HALFCYCLE_MCP_URL",
+  "HALFCYCLE_TOKEN",
+  "HALFCYCLE_ENGAGEMENT_ID",
+  ...GUARD_ENV_KEYS,
+  "CONTROL_TELEMETRY_URL"
+];
+var ENV_HEADER = "# Halfcycle per-engagement credential \u2014 machine level, owner-only, never in a repository.";
+function shq(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function unquote(value) {
+  const v = value.trim();
+  if (v.length >= 2 && v.startsWith("'") && v.endsWith("'")) {
+    return v.slice(1, -1).split(`'\\''`).join(`'`);
+  }
+  if (v.length >= 2 && v.startsWith('"') && v.endsWith('"'))
+    return v.slice(1, -1);
+  return v;
+}
+function parseEnvText(raw) {
+  const out = {};
+  for (const line of raw.split("\n")) {
+    const eq = line.indexOf("=");
+    if (eq === -1)
+      continue;
+    const key = line.slice(0, eq).replace(/^\s*export\s+/, "").trim();
+    if (key === "" || key.startsWith("#"))
+      continue;
+    out[key] = unquote(line.slice(eq + 1));
+  }
+  return out;
+}
+function reconcileEnvText(existing, values, keys = ENGAGEMENT_ENV_KEYS) {
+  const desired = new Map(keys.map((k) => [k, values[k] ?? ""]));
+  const line = (k) => `${k}=${shq(desired.get(k) ?? "")}`;
+  if (existing === null) {
+    return `${ENV_HEADER}
+` + keys.map(line).join("\n") + "\n";
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const out = existing.split("\n").map((existingLine) => {
+    const eq = existingLine.indexOf("=");
+    if (eq === -1)
+      return existingLine;
+    const lhs = existingLine.slice(0, eq);
+    const exported = /^\s*export\s+/.exec(lhs);
+    const prefix = exported === null ? "" : exported[0];
+    const key = lhs.slice(prefix.length).trim();
+    if (desired.has(key)) {
+      seen.add(key);
+      return `${prefix}${line(key)}`;
+    }
+    return existingLine;
+  });
+  const missing = keys.filter((k) => !seen.has(k));
+  if (missing.length > 0) {
+    const trailingBlank = out.length > 0 && out[out.length - 1] === "";
+    const prefix = trailingBlank ? "" : existing.endsWith("\n") ? "" : "\n";
+    out.push(`${prefix}${ENV_HEADER}
+` + missing.map(line).join("\n"));
+  }
+  let result = out.join("\n");
+  if (existing.endsWith("\n") && !result.endsWith("\n"))
+    result += "\n";
+  return result;
+}
+function readEngagementEnv(engagementId, home) {
+  try {
+    return parseEnvText(readFileSync2(engagementEnvPath(engagementId, home), "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function writeEngagementEnv(engagementId, values, home) {
+  const path = engagementEnvPath(engagementId, home);
+  const dir = engagementStateDir(engagementId, home);
+  mkdirSync2(dir, { recursive: true, mode: 448 });
+  let existing;
+  try {
+    existing = readFileSync2(path, "utf-8");
+  } catch {
+    existing = null;
+  }
+  const reconciled = reconcileEnvText(existing, values);
+  const outcome = existing === reconciled ? "skipped" : "written";
+  if (outcome === "written") {
+    writeFileSync2(path, reconciled, { mode: 384 });
+  }
+  applyOwnerOnly(path, dir);
+  return outcome;
+}
+function applyOwnerOnly(path, dir) {
+  if (platform2() === "win32")
+    return;
+  try {
+    chmodSync2(path, 384);
+  } catch {
+  }
+  try {
+    chmodSync2(dir, 448);
+  } catch {
+  }
+}
+function engagementResolutionShell() {
+  return `# --- Halfcycle credential resolution (generated; do not edit) ----------------
+# THE CREDENTIAL IS NOT IN THIS REPOSITORY. It lives at
+#   $HOME/.halfcycle/${ENGAGEMENTS_DIR}/<engagement-id>/${ENV_FILENAME}
+# written owner-only by \`npx halfcycle\`. What this repository holds is the
+# engagement id, in the committed .halfcycle/bundle.json. So: read the id out of
+# the pin, then name the file. There is no jq here and node is not dependable on a
+# desktop session's PATH, so the id is cut out with sed \u2014 after flattening the
+# file, because sed is line-oriented and the pin's line breaks are not a contract.
+#
+# Sets HALFCYCLE_ENV_FILE, HALFCYCLE_ENV_ENGAGEMENT and HALFCYCLE_ENV_PROBLEM in
+# the CALLER's shell and returns a status. Call it as \`if halfcycle_env_file \u2026\`,
+# never as \`$(halfcycle_env_file \u2026)\` \u2014 a command substitution is a subshell and
+# would discard everything it set.
+halfcycle_env_file() {
+  HALFCYCLE_ENV_FILE=""
+  HALFCYCLE_ENV_ENGAGEMENT=""
+  HALFCYCLE_ENV_PROBLEM=""
+  hc_pin="$1/.halfcycle/bundle.json"
+  if [ ! -f "$hc_pin" ]; then
+    HALFCYCLE_ENV_PROBLEM="no-pin"
+    return 1
+  fi
+  hc_id=$(tr -d '\\n' < "$hc_pin" | sed -n 's/.*"${PIN_ENGAGEMENT_ID_FIELD}"[[:space:]]*:[[:space:]]*"\\([^"]*\\)".*/\\1/p')
+  if [ -z "$hc_id" ]; then
+    HALFCYCLE_ENV_PROBLEM="no-id"
+    return 1
+  fi
+  HALFCYCLE_ENV_ENGAGEMENT="$hc_id"
+  if [ -z "\${HOME:-}" ]; then
+    HALFCYCLE_ENV_PROBLEM="no-home"
+    return 1
+  fi
+  hc_env="$HOME/.halfcycle/${ENGAGEMENTS_DIR}/$hc_id/${ENV_FILENAME}"
+  if [ ! -f "$hc_env" ]; then
+    HALFCYCLE_ENV_PROBLEM="no-credential"
+    return 1
+  fi
+  HALFCYCLE_ENV_FILE="$hc_env"
+  return 0
+}
+# --- end Halfcycle credential resolution ------------------------------------`;
+}
 
-// ../events/dist/device-auth.js
-import { z as z5 } from "zod";
-var utcIso86013 = z5.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/, "must be a UTC ISO-8601 timestamp ending in Z (INV-015)");
-var DEVICE_AUTH_STATUS = {
-  /** The poll: minted, nobody has acted yet. Keep polling. 200. */
-  PENDING: "pending",
-  /** The poll: approved, and the credential is in this body. Once only. 200. */
-  APPROVED: "approved",
-  /** Confirm: the decision was recorded (approve or decline). 200. */
-  RECORDED: "recorded",
-  /** The human refused at the confirmation page. 400 on the poll. */
-  DECLINED: "declined",
-  /** The code's absolute expiry has passed. 400. */
-  EXPIRED: "expired",
-  /** Never minted, or already spent. 400. */
-  UNKNOWN: "unknown",
-  /** Confirm: neither `approve` nor `decline` was named. Nothing was bound. 400. */
-  INVALID_DECISION: "invalid-decision",
-  /** Confirm: an approval arrived with no signed-in identity. 400. */
-  IDENTITY_REQUIRED: "identity-required",
-  /** This deployment has no `SIGNIN_BASE_URL` / `DEVICE_AUTH_CONFIRM_SECRET`. 503. */
-  NOT_CONFIGURED: "not-configured",
-  /** Confirm: the shared confirmation secret was missing or wrong. 401. */
-  UNAUTHORIZED: "unauthorized",
-  /** Confirm: the code was already approved, declined or claimed. 409. */
-  ALREADY_DECIDED: "already-decided",
-  /**
-   * Confirm: an approval named a signed-in identity whose account has not accepted
-   * the terms of service and privacy policy currently in force (T-18, #588). 400.
-   *
-   * NOT BOUND TO THE DEVICE CODE. Unlike every other refusal in this const, this one
-   * says nothing about the code itself — the code is still `pending` after this
-   * response, exactly as it was before the request, so the SAME userCode can be
-   * confirmed again once the caller has recorded acceptance. `deviceConfirmRequestSchema`'s
-   * `acceptTerms` is how a second confirm says it did.
-   */
-  TERMS_REQUIRED: "terms-required"
-};
-var DEVICE_POLL_REFUSALS = [
-  DEVICE_AUTH_STATUS.DECLINED,
-  DEVICE_AUTH_STATUS.EXPIRED,
-  DEVICE_AUTH_STATUS.UNKNOWN
-];
-var deviceAuthStartResponseSchema = z5.object({
-  deviceCode: z5.string().min(1),
-  userCode: z5.string().min(1),
-  verificationUrl: z5.string().min(1),
-  expiresAt: utcIso86013,
-  pollIntervalMs: z5.number().int().positive()
-}).strict();
-var devicePollPendingSchema = z5.object({
-  status: z5.literal(DEVICE_AUTH_STATUS.PENDING),
-  pollIntervalMs: z5.number().int().positive()
-}).strict();
-var devicePollApprovedSchema = z5.object({
-  status: z5.literal(DEVICE_AUTH_STATUS.APPROVED),
-  accountId: z5.string().min(1),
-  credential: z5.string().min(1),
-  expiresAt: utcIso86013
-}).strict();
-var deviceAuthRefusalSchema = z5.object({
-  status: z5.enum([
-    DEVICE_AUTH_STATUS.DECLINED,
-    DEVICE_AUTH_STATUS.EXPIRED,
-    DEVICE_AUTH_STATUS.UNKNOWN,
-    DEVICE_AUTH_STATUS.INVALID_DECISION,
-    DEVICE_AUTH_STATUS.IDENTITY_REQUIRED,
-    DEVICE_AUTH_STATUS.NOT_CONFIGURED,
-    DEVICE_AUTH_STATUS.UNAUTHORIZED,
-    DEVICE_AUTH_STATUS.ALREADY_DECIDED,
-    DEVICE_AUTH_STATUS.TERMS_REQUIRED
-  ]),
-  message: z5.string().min(1)
-}).strict();
-var devicePollResponseSchema = z5.union([
-  devicePollPendingSchema,
-  devicePollApprovedSchema,
-  deviceAuthRefusalSchema
-]);
-var deviceConfirmRequestSchema = z5.object({
-  userCode: z5.string().min(1),
-  decision: z5.enum(["approve", "decline"]),
-  externalAuthId: z5.string().min(1).optional(),
-  email: z5.string().optional(),
-  acceptTerms: z5.boolean().optional()
-}).strict();
-var deviceConfirmRecordedSchema = z5.object({
-  status: z5.literal(DEVICE_AUTH_STATUS.RECORDED),
-  accountId: z5.string().min(1).optional()
-}).strict();
-var deviceConfirmResponseSchema = z5.union([
-  deviceConfirmRecordedSchema,
-  deviceAuthRefusalSchema
-]);
-var LOOPBACK_REDIRECT_HOST = "127.0.0.1";
-var LOOPBACK_PORT_MIN = 1024;
-var LOOPBACK_PORT_MAX = 65535;
-var LOOPBACK_CALLBACK_PATH = "/halfcycle-cli-callback";
-var LOOPBACK_QUERY_PORT = "loopback_port";
-var LOOPBACK_QUERY_STATE = "loopback_state";
-var LOOPBACK_QUERY_RESULT = "result";
-var LOOPBACK_RESULT = {
-  APPROVED: "approved",
-  DECLINED: "declined"
-};
-function loopbackVerificationUrl(verificationUrl, target) {
-  let url;
+// dist/identity.js
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync as readFileSync3 } from "node:fs";
+import { join as join3 } from "node:path";
+import { randomUUID } from "node:crypto";
+var PROJECT_IDENTITY_NOTE = 'projectId is NOT the engagement id \u2014 it identifies this repository/worktree to Halfcycle, not an engagement. The engagement id lives in .halfcycle/bundle.json, in its "engagementId" field.';
+function git(targetRepoRoot, args2) {
   try {
-    url = new URL(verificationUrl);
+    const out = execFileSync("git", ["-C", targetRepoRoot, ...args2], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    const trimmed = out.trim();
+    return trimmed.length > 0 ? trimmed : null;
   } catch {
-    return verificationUrl;
+    return null;
   }
-  url.searchParams.set(LOOPBACK_QUERY_PORT, String(target.port));
-  url.searchParams.set(LOOPBACK_QUERY_STATE, target.state);
-  return url.toString();
+}
+function readRootCommit(targetRepoRoot) {
+  const roots = git(targetRepoRoot, ["rev-list", "--max-parents=0", "HEAD"]);
+  if (!roots)
+    return null;
+  const lines = roots.split("\n").filter((l) => l.length > 0);
+  return lines.length > 0 ? lines[lines.length - 1] : null;
+}
+function readRemote(targetRepoRoot) {
+  return git(targetRepoRoot, ["remote", "get-url", "origin"]);
+}
+function mintOrReadIdentity(targetRepoRoot) {
+  const path = join3(targetRepoRoot, ".halfcycle", "project.json");
+  if (existsSync(path)) {
+    const onDisk = JSON.parse(readFileSync3(path, "utf-8"));
+    const identity2 = {
+      projectId: onDisk.projectId ?? "",
+      rootCommit: onDisk.rootCommit ?? null,
+      remote: onDisk.remote ?? null,
+      note: PROJECT_IDENTITY_NOTE
+    };
+    return { identity: identity2, minted: false };
+  }
+  const identity = {
+    projectId: randomUUID(),
+    rootCommit: readRootCommit(targetRepoRoot),
+    remote: readRemote(targetRepoRoot),
+    note: PROJECT_IDENTITY_NOTE
+  };
+  return { identity, minted: true };
+}
+
+// dist/mcp-endpoint.js
+var MCP_ENDPOINT_PATH = "/mcp";
+function mcpEndpointUrl(origin) {
+  return `${origin.trim().replace(/\/+$/, "")}${MCP_ENDPOINT_PATH}`;
+}
+
+// dist/merge-settings.js
+function isHalfcycleEntry(entry, halfcycleCommands) {
+  return entry.hooks.some((h) => halfcycleCommands.has(h.command));
+}
+function mergeSettings(existing, generated) {
+  const merged = { ...existing };
+  if (generated.$schema !== void 0) {
+    merged.$schema = generated.$schema;
+  }
+  const generatedHooks = generated.hooks ?? {};
+  const halfcycleCommands = /* @__PURE__ */ new Set();
+  for (const entries of Object.values(generatedHooks)) {
+    for (const entry of entries) {
+      for (const h of entry.hooks)
+        halfcycleCommands.add(h.command);
+    }
+  }
+  const existingHooks = existing.hooks ?? {};
+  const mergedHooks = {};
+  const events = /* @__PURE__ */ new Set([...Object.keys(existingHooks), ...Object.keys(generatedHooks)]);
+  for (const event of events) {
+    const developerEntries = (existingHooks[event] ?? []).filter((entry) => !isHalfcycleEntry(entry, halfcycleCommands));
+    const halfcycleEntries = generatedHooks[event] ?? [];
+    mergedHooks[event] = [...developerEntries, ...halfcycleEntries];
+  }
+  merged.hooks = mergedHooks;
+  merged.permissions = mergePermissions(existing.permissions, generated.permissions);
+  return merged;
+}
+function mergePermissions(existing, generated) {
+  if (existing === void 0 && generated === void 0)
+    return void 0;
+  const result = { ...existing ?? {} };
+  const generatedDeny = generated?.deny ?? [];
+  if (generatedDeny.length > 0) {
+    const theirs = existing?.deny ?? [];
+    const seen = new Set(theirs);
+    result.deny = [...theirs, ...generatedDeny.filter((p) => !seen.has(p))];
+  }
+  return result;
 }
 
 // dist/scan.js
+import { existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "node:fs";
+import { join as join4 } from "node:path";
 var HALFCYCLE_STATE_FORMAT = "halfcycle-state-file/v1";
 var HALFCYCLE_STATE_NOTE = [
   "This file is a local cache written ONCE when Halfcycle was installed. It is not a",
@@ -999,7 +1055,7 @@ ${engagementResolutionShell()}
     set +a
   fi
   hc_missing=""
-  for hc_key in ${GUARD_ENV_KEYS.join(" ")}; do
+  for hc_key in ${GUARD_COVERAGE_REQUIRED_KEYS.join(" ")}; do
     eval "hc_value=\\\${$hc_key:-}"
     if [ -z "$hc_value" ]; then hc_missing="$hc_missing $hc_key"; fi
   done
@@ -1092,7 +1148,10 @@ function generateCiStanza() {
 #         node-version: '20'
 #     - name: Halfcycle guard CI check
 #       env:
-#         GUARD_SERVICE_URL: \${{ secrets.GUARD_SERVICE_URL }}
+#         # TWO SECRETS, AND THEY ARE THE TWO THAT ARE YOURS: the engagement's
+#         # token and its id. Both were printed by the installer that generated
+#         # this file. There is no address to configure \u2014 the guard service this
+#         # job talks to ships inside the binary below.
 #         GUARD_SERVICE_TOKEN: \${{ secrets.GUARD_SERVICE_TOKEN }}
 #         GUARD_ENGAGEMENT_ID: \${{ secrets.GUARD_ENGAGEMENT_ID }}
 #       run: node ./.halfcycle/bin/bin.bundle.mjs ci
@@ -1104,24 +1163,21 @@ function generateCiStanza() {
 `;
 }
 var ENV_EXAMPLE_NAMES = [
-  "GUARD_SERVICE_URL",
+  // The engagement's own secret, under the name the guard runner reads. A CI job
+  // has no per-user credential store, so this is one of the two it must supply.
   "GUARD_SERVICE_TOKEN",
+  // Which engagement this repository is. Per-engagement by construction; the same
+  // CI job supplies it beside the token.
   "GUARD_ENGAGEMENT_ID",
-  "HALFCYCLE_SERVICE_URL",
-  "HALFCYCLE_MCP_URL",
-  "HALFCYCLE_TOKEN",
-  // T-10 — declared because it is now WRITTEN into the credential store, and
-  // `install-guard-config.test.ts`'s INV-004 check requires every written name to
-  // be named here too (`HALFCYCLE_ENGAGEMENT_ID` is the one deliberate exception,
-  // recorded in the spec). Optional at runtime — the runner's own telemetry
-  // emission is fail-open when it is absent — but a name that is written and never
-  // declared is exactly what this generated section exists to prevent.
-  "CONTROL_TELEMETRY_URL"
+  // The same credential under the name every other Halfcycle surface reads. Set in
+  // the environment it takes precedence over the stored credential, which is the
+  // escape hatch for running as a specific identity.
+  "HALFCYCLE_TOKEN"
 ];
 function generateEnvExampleSection() {
   return `
 # ---------------------------------------------------------------------------
-# Halfcycle runner (generated by the Halfcycle installer \u2014 names only, no values)
+# Halfcycle (generated by the Halfcycle installer \u2014 names only, no values)
 # ---------------------------------------------------------------------------
 # YOU DO NOT NEED TO SET ANY OF THESE ON YOUR OWN MACHINE, and there is nowhere in
 # this repository to put them. \`npx halfcycle\` writes this engagement's credential
@@ -1129,33 +1185,18 @@ function generateEnvExampleSection() {
 # MCP headers helper read it from there. Nothing Halfcycle writes a secret into
 # this tree, so there is no file here to leak, ignore or clean up.
 #
-# These names are declared because they ARE read from the environment in one
-# place: a CI job, which has no browser and no per-user store and supplies them as
-# workflow secrets (see .halfcycle/ci-stanza.yml). HALFCYCLE_TOKEN set in the
-# environment also takes precedence over the stored credential everywhere, which is
-# the escape hatch for running as a specific identity.
-GUARD_SERVICE_URL=<argType:runtime>
+# These three are declared because they ARE read from the environment in one place:
+# a CI job, which has no browser and no per-user store and supplies them as workflow
+# secrets (see .halfcycle/ci-stanza.yml). All three are yours \u2014 a credential and the
+# id of your engagement.
+#
+# THERE IS NO ADDRESS TO CONFIGURE ANYWHERE IN HALFCYCLE. Every service this
+# product talks to has one address, the same for every user, and it ships in the
+# tools you already have: the installer, the guard hook and the CI binary each know
+# where to go. If something tells you to set a Halfcycle URL, it is out of date.
 GUARD_SERVICE_TOKEN=<argType:runtime>
 GUARD_ENGAGEMENT_ID=<argType:runtime>
-# TWO ORIGINS, TWO SERVICES (T-22). HALFCYCLE_SERVICE_URL is the Halfcycle
-# CONTROL plane \u2014 it serves engagement creation and the board's first-visit
-# code. HALFCYCLE_MCP_URL is the method-delivery service, which serves /mcp and
-# nothing else here. The platform reports the second on create, so it is written
-# for you and .mcp.json carries the composed address.
-#
-# NEITHER IS SOMETHING YOU NEED TO SET (T-27). The installer talks to Halfcycle's
-# own control plane by default; HALFCYCLE_SERVICE_URL OVERRIDES that address and
-# exists for a self-hosted or development plane. It is not a prerequisite for
-# \`npx halfcycle\`, and nothing in the product asks you to find its value.
-HALFCYCLE_SERVICE_URL=<argType:runtime>
-HALFCYCLE_MCP_URL=<argType:runtime>
 HALFCYCLE_TOKEN=<argType:runtime>
-# CONTROL_TELEMETRY_URL (T-10) \u2014 the platform reports this on create/join, same as
-# HALFCYCLE_MCP_URL. OPTIONAL: absent, guard-eval telemetry is silently disabled
-# and the guard loop itself is unaffected \u2014 this name is declared only because it
-# is one this installer now writes to the machine-level store, same as every name
-# above it.
-CONTROL_TELEMETRY_URL=<argType:runtime>
 `;
 }
 var MCP_REGISTRATION_REL = ".mcp.json";
@@ -1332,6 +1373,16 @@ function writeBundlePin(targetRepoRoot, version, engagementId, engagementType, w
   const pinPath = join5(targetRepoRoot, ".halfcycle", "bundle.json");
   writeAllowlisted(pinPath, targetRepoRoot, JSON.stringify(pin, null, 2) + "\n", writtenPaths);
 }
+function writeCrewRoster(targetRepoRoot, report) {
+  const doc = {
+    $comment: "GENERATED by the Halfcycle installer \u2014 do not edit by hand. Re-run the installer to pick up a roster change.",
+    crew: CREW_ROSTER
+  };
+  const rendered = `${JSON.stringify(doc, null, 2)}
+`;
+  const crewPath = join5(targetRepoRoot, ".halfcycle", "crew.json");
+  record(report, writeOwned(crewPath, targetRepoRoot, rendered), ".halfcycle/crew.json");
+}
 function readBundlePin(targetRepoRoot) {
   const pinPath = join5(targetRepoRoot, ".halfcycle", "bundle.json");
   if (!existsSync3(pinPath))
@@ -1563,6 +1614,7 @@ async function install(options) {
       break;
   }
   writeBundlePin(targetRepo, manifest.version, engagementId, engagementType, report.writtenPaths);
+  writeCrewRoster(targetRepo, report);
   const scanResult = runBootstrapScan(targetRepo);
   return {
     version: manifest.version,
@@ -1584,7 +1636,7 @@ function resolveControlOrigin(env = process.env) {
   return { origin: DEFAULT_CONTROL_ORIGIN, source: "default" };
 }
 function controlOriginNote(resolved) {
-  return resolved.source === "environment" ? `${resolved.origin} (from HALFCYCLE_SERVICE_URL)` : `${resolved.origin} (the Halfcycle plane; set HALFCYCLE_SERVICE_URL to use another)`;
+  return resolved.source === "environment" ? `${resolved.origin} (from HALFCYCLE_SERVICE_URL)` : `${resolved.origin} (the Halfcycle plane)`;
 }
 
 // dist/create-engagement.js
@@ -1644,7 +1696,7 @@ function planeRefusal(detail) {
     error: typeof candidate.error === "string" ? candidate.error : void 0
   };
 }
-var CONTROL_ORIGIN_HINT = `With nothing configured this CLI talks to ${DEFAULT_CONTROL_ORIGIN}; HALFCYCLE_SERVICE_URL overrides that, and is only for a self-hosted or development plane. Whichever is in use, it must be the CONTROL origin \u2014 the one that serves /engagements and /board/enter-codes. The MCP server runs at a different address, and the platform supplies that one itself; you do not configure it.`;
+var CONTROL_ORIGIN_HINT = `This CLI talks to ${DEFAULT_CONTROL_ORIGIN}; it must be the CONTROL origin \u2014 the one that serves /engagements and /board/enter-codes. The MCP server runs at a different address, and the platform supplies that one itself; you configure neither.`;
 async function createEngagement(baseUrl, name, credential) {
   return requestEngagementValues(`${baseUrl.replace(/\/+$/, "")}/engagements`, name ? { name } : {}, credential, { action: "Create-engagement", nothingHappened: "No engagement was created", route: "POST /engagements" });
 }
@@ -3006,7 +3058,7 @@ ${USAGE}`);
 [halfcycle] The Halfcycle commands will have no method context until that address answers. This is the SECOND of two origins and the platform supplied it, so it is not the CONTROL origin (${credential.serviceUrl}) that is wrong \u2014 that one just worked. It is recorded as HALFCYCLE_MCP_URL in this engagement's credential store; re-run this installer once the service is up.
 `);
       }
-      process.stdout.write(`[halfcycle] Guard evaluation: ON \u2014 the hook evaluates against ${credential.guardUrl}. Credentials (${GUARD_ENV_KEYS.join(", ")}) are in ${engagementEnvPath(engagementId)}, outside this repository; the hook loads them itself, so you do not export anything and nothing here can be committed.
+      process.stdout.write(`[halfcycle] Guard evaluation: ON \u2014 the hook evaluates against ${credential.guardUrl}. Credentials (${GUARD_COVERAGE_REQUIRED_KEYS.join(", ")}) are in ${engagementEnvPath(engagementId)}, outside this repository; the hook loads them itself, so you do not export anything and nothing here can be committed.
 `);
       process.stdout.write(`[halfcycle] Your credential is at ${engagementEnvPath(engagementId)} \u2014 outside this repository, readable only by you. .mcp.json reads it at connection time through .halfcycle/mcp-headers.sh, so there is no token in this tree to commit and nothing for you to export.
 `);