halfcycle 0.3.8 → 0.3.9

package/dist/bin.js

@@ -10,346 +10,6 @@ import { existsSync as existsSync3, mkdirSync as mkdirSync4, readFileSync as rea
 import { dirname as dirname2, join as join5, relative } from "node:path";
 import { fileURLToPath } from "node:url";
 
-// dist/engagement-credential.js
-import { chmodSync as chmodSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
-import { platform as platform2 } from "node:os";
-import { join as join2 } from "node:path";
-
-// dist/account-credential.js
-import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { homedir, platform } from "node:os";
-import { dirname, join } from "node:path";
-function halfcycleHome(home) {
-  return join(home ?? homedir(), ".halfcycle");
-}
-function accountStorePath(home) {
-  return join(halfcycleHome(home), "account.json");
-}
-function normaliseOrigin(serviceUrl) {
-  return serviceUrl.trim().replace(/\/+$/, "").toLowerCase();
-}
-function readStore(home) {
-  let raw;
-  try {
-    raw = readFileSync(accountStorePath(home), "utf-8");
-  } catch {
-    return { version: 1, accounts: {} };
-  }
-  try {
-    const parsed = JSON.parse(raw);
-    if (!parsed || typeof parsed !== "object" || typeof parsed.accounts !== "object") {
-      return { version: 1, accounts: {} };
-    }
-    return { version: 1, accounts: parsed.accounts ?? {} };
-  } catch {
-    return { version: 1, accounts: {} };
-  }
-}
-function writeStore(store, home) {
-  const path = accountStorePath(home);
-  mkdirSync(dirname(path), { recursive: true, mode: 448 });
-  writeFileSync(path, `${JSON.stringify(store, null, 2)}
-`, { mode: 384 });
-  if (platform() !== "win32") {
-    chmodSync(path, 384);
-    try {
-      chmodSync(dirname(path), 448);
-    } catch {
-    }
-  }
-}
-function readStoredCredential(serviceUrl, home) {
-  const entry = readStore(home).accounts[normaliseOrigin(serviceUrl)];
-  if (!entry || typeof entry.credential !== "string" || entry.credential.trim() === "") {
-    return void 0;
-  }
-  return entry;
-}
-function writeStoredCredential(serviceUrl, entry, home) {
-  const store = readStore(home);
-  store.accounts[normaliseOrigin(serviceUrl)] = {
-    accountId: entry.accountId,
-    credential: entry.credential,
-    expiresAt: entry.expiresAt,
-    signedInAt: entry.signedInAt ?? (/* @__PURE__ */ new Date()).toISOString()
-  };
-  writeStore(store, home);
-}
-function forgetStoredCredential(serviceUrl, home) {
-  const store = readStore(home);
-  const key = normaliseOrigin(serviceUrl);
-  if (!(key in store.accounts))
-    return false;
-  delete store.accounts[key];
-  writeStore(store, home);
-  return true;
-}
-
-// dist/engagement-credential.js
-var ENGAGEMENTS_DIR = "engagements";
-var ENV_FILENAME = "env";
-var PIN_ENGAGEMENT_ID_FIELD = "engagementId";
-function engagementStateDir(engagementId, home) {
-  return join2(halfcycleHome(home), ENGAGEMENTS_DIR, engagementId);
-}
-function engagementEnvPath(engagementId, home) {
-  return join2(engagementStateDir(engagementId, home), ENV_FILENAME);
-}
-var GUARD_ENV_KEYS = [
-  "GUARD_SERVICE_URL",
-  "GUARD_SERVICE_TOKEN",
-  "GUARD_ENGAGEMENT_ID"
-];
-var ENGAGEMENT_ENV_KEYS = [
-  "HALFCYCLE_SERVICE_URL",
-  "HALFCYCLE_MCP_URL",
-  "HALFCYCLE_TOKEN",
-  "HALFCYCLE_ENGAGEMENT_ID",
-  ...GUARD_ENV_KEYS,
-  "CONTROL_TELEMETRY_URL"
-];
-var ENV_HEADER = "# Halfcycle per-engagement credential \u2014 machine level, owner-only, never in a repository.";
-function shq(value) {
-  return `'${value.replace(/'/g, `'\\''`)}'`;
-}
-function unquote(value) {
-  const v = value.trim();
-  if (v.length >= 2 && v.startsWith("'") && v.endsWith("'")) {
-    return v.slice(1, -1).split(`'\\''`).join(`'`);
-  }
-  if (v.length >= 2 && v.startsWith('"') && v.endsWith('"'))
-    return v.slice(1, -1);
-  return v;
-}
-function parseEnvText(raw) {
-  const out = {};
-  for (const line of raw.split("\n")) {
-    const eq = line.indexOf("=");
-    if (eq === -1)
-      continue;
-    const key = line.slice(0, eq).replace(/^\s*export\s+/, "").trim();
-    if (key === "" || key.startsWith("#"))
-      continue;
-    out[key] = unquote(line.slice(eq + 1));
-  }
-  return out;
-}
-function reconcileEnvText(existing, values, keys = ENGAGEMENT_ENV_KEYS) {
-  const desired = new Map(keys.map((k) => [k, values[k] ?? ""]));
-  const line = (k) => `${k}=${shq(desired.get(k) ?? "")}`;
-  if (existing === null) {
-    return `${ENV_HEADER}
-` + keys.map(line).join("\n") + "\n";
-  }
-  const seen = /* @__PURE__ */ new Set();
-  const out = existing.split("\n").map((existingLine) => {
-    const eq = existingLine.indexOf("=");
-    if (eq === -1)
-      return existingLine;
-    const lhs = existingLine.slice(0, eq);
-    const exported = /^\s*export\s+/.exec(lhs);
-    const prefix = exported === null ? "" : exported[0];
-    const key = lhs.slice(prefix.length).trim();
-    if (desired.has(key)) {
-      seen.add(key);
-      return `${prefix}${line(key)}`;
-    }
-    return existingLine;
-  });
-  const missing = keys.filter((k) => !seen.has(k));
-  if (missing.length > 0) {
-    const trailingBlank = out.length > 0 && out[out.length - 1] === "";
-    const prefix = trailingBlank ? "" : existing.endsWith("\n") ? "" : "\n";
-    out.push(`${prefix}${ENV_HEADER}
-` + missing.map(line).join("\n"));
-  }
-  let result = out.join("\n");
-  if (existing.endsWith("\n") && !result.endsWith("\n"))
-    result += "\n";
-  return result;
-}
-function readEngagementEnv(engagementId, home) {
-  try {
-    return parseEnvText(readFileSync2(engagementEnvPath(engagementId, home), "utf-8"));
-  } catch {
-    return null;
-  }
-}
-function writeEngagementEnv(engagementId, values, home) {
-  const path = engagementEnvPath(engagementId, home);
-  const dir = engagementStateDir(engagementId, home);
-  mkdirSync2(dir, { recursive: true, mode: 448 });
-  let existing;
-  try {
-    existing = readFileSync2(path, "utf-8");
-  } catch {
-    existing = null;
-  }
-  const reconciled = reconcileEnvText(existing, values);
-  const outcome = existing === reconciled ? "skipped" : "written";
-  if (outcome === "written") {
-    writeFileSync2(path, reconciled, { mode: 384 });
-  }
-  applyOwnerOnly(path, dir);
-  return outcome;
-}
-function applyOwnerOnly(path, dir) {
-  if (platform2() === "win32")
-    return;
-  try {
-    chmodSync2(path, 384);
-  } catch {
-  }
-  try {
-    chmodSync2(dir, 448);
-  } catch {
-  }
-}
-function engagementResolutionShell() {
-  return `# --- Halfcycle credential resolution (generated; do not edit) ----------------
-# THE CREDENTIAL IS NOT IN THIS REPOSITORY. It lives at
-#   $HOME/.halfcycle/${ENGAGEMENTS_DIR}/<engagement-id>/${ENV_FILENAME}
-# written owner-only by \`npx halfcycle\`. What this repository holds is the
-# engagement id, in the committed .halfcycle/bundle.json. So: read the id out of
-# the pin, then name the file. There is no jq here and node is not dependable on a
-# desktop session's PATH, so the id is cut out with sed \u2014 after flattening the
-# file, because sed is line-oriented and the pin's line breaks are not a contract.
-#
-# Sets HALFCYCLE_ENV_FILE, HALFCYCLE_ENV_ENGAGEMENT and HALFCYCLE_ENV_PROBLEM in
-# the CALLER's shell and returns a status. Call it as \`if halfcycle_env_file \u2026\`,
-# never as \`$(halfcycle_env_file \u2026)\` \u2014 a command substitution is a subshell and
-# would discard everything it set.
-halfcycle_env_file() {
-  HALFCYCLE_ENV_FILE=""
-  HALFCYCLE_ENV_ENGAGEMENT=""
-  HALFCYCLE_ENV_PROBLEM=""
-  hc_pin="$1/.halfcycle/bundle.json"
-  if [ ! -f "$hc_pin" ]; then
-    HALFCYCLE_ENV_PROBLEM="no-pin"
-    return 1
-  fi
-  hc_id=$(tr -d '\\n' < "$hc_pin" | sed -n 's/.*"${PIN_ENGAGEMENT_ID_FIELD}"[[:space:]]*:[[:space:]]*"\\([^"]*\\)".*/\\1/p')
-  if [ -z "$hc_id" ]; then
-    HALFCYCLE_ENV_PROBLEM="no-id"
-    return 1
-  fi
-  HALFCYCLE_ENV_ENGAGEMENT="$hc_id"
-  if [ -z "\${HOME:-}" ]; then
-    HALFCYCLE_ENV_PROBLEM="no-home"
-    return 1
-  fi
-  hc_env="$HOME/.halfcycle/${ENGAGEMENTS_DIR}/$hc_id/${ENV_FILENAME}"
-  if [ ! -f "$hc_env" ]; then
-    HALFCYCLE_ENV_PROBLEM="no-credential"
-    return 1
-  fi
-  HALFCYCLE_ENV_FILE="$hc_env"
-  return 0
-}
-# --- end Halfcycle credential resolution ------------------------------------`;
-}
-
-// dist/identity.js
-import { execFileSync } from "node:child_process";
-import { existsSync, readFileSync as readFileSync3 } from "node:fs";
-import { join as join3 } from "node:path";
-import { randomUUID } from "node:crypto";
-var PROJECT_IDENTITY_NOTE = 'projectId is NOT the engagement id \u2014 it identifies this repository/worktree to Halfcycle, not an engagement. The engagement id lives in .halfcycle/bundle.json, in its "engagementId" field.';
-function git(targetRepoRoot, args2) {
-  try {
-    const out = execFileSync("git", ["-C", targetRepoRoot, ...args2], {
-      encoding: "utf-8",
-      stdio: ["ignore", "pipe", "ignore"]
-    });
-    const trimmed = out.trim();
-    return trimmed.length > 0 ? trimmed : null;
-  } catch {
-    return null;
-  }
-}
-function readRootCommit(targetRepoRoot) {
-  const roots = git(targetRepoRoot, ["rev-list", "--max-parents=0", "HEAD"]);
-  if (!roots)
-    return null;
-  const lines = roots.split("\n").filter((l) => l.length > 0);
-  return lines.length > 0 ? lines[lines.length - 1] : null;
-}
-function readRemote(targetRepoRoot) {
-  return git(targetRepoRoot, ["remote", "get-url", "origin"]);
-}
-function mintOrReadIdentity(targetRepoRoot) {
-  const path = join3(targetRepoRoot, ".halfcycle", "project.json");
-  if (existsSync(path)) {
-    const onDisk = JSON.parse(readFileSync3(path, "utf-8"));
-    const identity2 = {
-      projectId: onDisk.projectId ?? "",
-      rootCommit: onDisk.rootCommit ?? null,
-      remote: onDisk.remote ?? null,
-      note: PROJECT_IDENTITY_NOTE
-    };
-    return { identity: identity2, minted: false };
-  }
-  const identity = {
-    projectId: randomUUID(),
-    rootCommit: readRootCommit(targetRepoRoot),
-    remote: readRemote(targetRepoRoot),
-    note: PROJECT_IDENTITY_NOTE
-  };
-  return { identity, minted: true };
-}
-
-// dist/mcp-endpoint.js
-var MCP_ENDPOINT_PATH = "/mcp";
-function mcpEndpointUrl(origin) {
-  return `${origin.trim().replace(/\/+$/, "")}${MCP_ENDPOINT_PATH}`;
-}
-
-// dist/merge-settings.js
-function isHalfcycleEntry(entry, halfcycleCommands) {
-  return entry.hooks.some((h) => halfcycleCommands.has(h.command));
-}
-function mergeSettings(existing, generated) {
-  const merged = { ...existing };
-  if (generated.$schema !== void 0) {
-    merged.$schema = generated.$schema;
-  }
-  const generatedHooks = generated.hooks ?? {};
-  const halfcycleCommands = /* @__PURE__ */ new Set();
-  for (const entries of Object.values(generatedHooks)) {
-    for (const entry of entries) {
-      for (const h of entry.hooks)
-        halfcycleCommands.add(h.command);
-    }
-  }
-  const existingHooks = existing.hooks ?? {};
-  const mergedHooks = {};
-  const events = /* @__PURE__ */ new Set([...Object.keys(existingHooks), ...Object.keys(generatedHooks)]);
-  for (const event of events) {
-    const developerEntries = (existingHooks[event] ?? []).filter((entry) => !isHalfcycleEntry(entry, halfcycleCommands));
-    const halfcycleEntries = generatedHooks[event] ?? [];
-    mergedHooks[event] = [...developerEntries, ...halfcycleEntries];
-  }
-  merged.hooks = mergedHooks;
-  merged.permissions = mergePermissions(existing.permissions, generated.permissions);
-  return merged;
-}
-function mergePermissions(existing, generated) {
-  if (existing === void 0 && generated === void 0)
-    return void 0;
-  const result = { ...existing ?? {} };
-  const generatedDeny = generated?.deny ?? [];
-  if (generatedDeny.length > 0) {
-    const theirs = existing?.deny ?? [];
-    const seen = new Set(theirs);
-    result.deny = [...theirs, ...generatedDeny.filter((p) => !seen.has(p))];
-  }
-  return result;
-}
-
-// dist/scan.js
-import { existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "node:fs";
-import { join as join4 } from "node:path";
-
 // ../events/dist/result.js
 import { z as z2 } from "zod";
 
@@ -538,177 +198,572 @@ var acceptPhaseRequestSchema = z4.object({
   acceptanceOutcome: acceptanceOutcomeSchema,
   close: phaseCloseDecisionSchema.optional()
 }).strict();
-var coeFindingRequestSchema = z4.object({
-  phase: z4.string(),
-  description: z4.string(),
-  addRateTag: z4.enum(["seam-new", "seam-repeat", "model-limitation"]),
-  mappedPatternRef: z4.string().nullable()
+var coeFindingRequestSchema = z4.object({
+  phase: z4.string(),
+  description: z4.string(),
+  addRateTag: z4.enum(["seam-new", "seam-repeat", "model-limitation"]),
+  mappedPatternRef: z4.string().nullable()
+}).strict();
+var coeFindingResponseSchema = z4.object({
+  findingId: z4.string(),
+  engagementId: z4.string(),
+  phase: z4.string(),
+  description: z4.string(),
+  addRateTag: z4.enum(["seam-new", "seam-repeat", "model-limitation"]),
+  mappedPatternRef: z4.string().nullable(),
+  createdAt: utcIso86012
+}).strict();
+var phaseEntryDecisionSchema = z4.discriminatedUnion("decision", [
+  z4.object({
+    decision: z4.literal("entry-condition-met"),
+    /** Who attests. */
+    actor: z4.string(),
+    /** What makes the entry condition hold, in the attester's own words. */
+    evidence: z4.string()
+  }).strict(),
+  z4.object({
+    decision: z4.literal("override"),
+    /** Who is opening it anyway. */
+    actor: z4.string(),
+    /** Why, in the operator's own words. */
+    reason: z4.string()
+  }).strict()
+]);
+var PHASE_ENTRY_DECISION_KINDS = [
+  "entry-condition-met",
+  "override"
+];
+var PHASE_CLOSE_DECISION_KINDS = ["phase-closed", "phase-close-override"];
+var phaseDecisionKindSchema = z4.enum([
+  ...PHASE_ENTRY_DECISION_KINDS,
+  ...PHASE_CLOSE_DECISION_KINDS
+]);
+var openPhaseRequestSchema = z4.object({
+  phase: z4.string().nullable(),
+  entry: phaseEntryDecisionSchema
+}).strict();
+var phaseEntryDecisionRecordSchema = z4.object({
+  decisionId: z4.string(),
+  decision: z4.enum(PHASE_ENTRY_DECISION_KINDS),
+  actor: z4.string(),
+  /** The evidence (attestation) or the reason (override) — one basis per row. */
+  justification: z4.string(),
+  blockingFinding: z4.string().nullable(),
+  decidedAt: utcIso86012
+}).strict();
+var openPhaseResponseSchema = z4.object({
+  engagement: engagementStatusResponseSchema,
+  /** What is open now. `null` is project scope. */
+  phase: z4.string().nullable(),
+  /** What was open before this decision. `null` is project scope. */
+  previousPhase: z4.string().nullable(),
+  decision: phaseEntryDecisionRecordSchema
+}).strict();
+
+// ../events/dist/crew.js
+import { z as z5 } from "zod";
+var crewGroupSchema = z5.enum(["builder", "reviewer", "always-on"]);
+var crewTierSchema = z5.enum(["deep", "standard", "fast"]);
+var CREW_DISCIPLINE_MAX = 64;
+var crewMemberSchema = z5.object({
+  // The agent's name. The same twenty-one on every project, so a name is a
+  // vocabulary a returning client already knows.
+  callsign: z5.string().min(1).max(32),
+  // Which of the three headings this member reads under.
+  group: crewGroupSchema,
+  // The kind of work this member takes. A task names a discipline, and only
+  // agents holding it can be dispatched to it.
+  discipline: z5.string().min(1).max(CREW_DISCIPLINE_MAX),
+  // How much thinking this member brings. There is no field naming the supplier
+  // behind it, on this shape or on any other.
+  tier: crewTierSchema
+}).strict();
+var CREW_ROSTER = [
+  // ── builders: code ──────────────────────────────────────────────────────────
+  { callsign: "ADA", group: "builder", discipline: "implementation", tier: "deep" },
+  { callsign: "OTTO", group: "builder", discipline: "implementation", tier: "deep" },
+  { callsign: "MILO", group: "builder", discipline: "implementation", tier: "standard" },
+  { callsign: "NOVA", group: "builder", discipline: "implementation", tier: "standard" },
+  { callsign: "KAI", group: "builder", discipline: "implementation", tier: "standard" },
+  { callsign: "HUGO", group: "builder", discipline: "infrastructure", tier: "standard" },
+  { callsign: "WREN", group: "builder", discipline: "refactor", tier: "fast" },
+  { callsign: "PIP", group: "builder", discipline: "refactor", tier: "fast" },
+  // ── builders: specs and docs ────────────────────────────────────────────────
+  { callsign: "IRIS", group: "builder", discipline: "feature spec", tier: "deep" },
+  { callsign: "JUNO", group: "builder", discipline: "feature spec", tier: "standard" },
+  { callsign: "LEX", group: "builder", discipline: "context & docs", tier: "fast" },
+  // ── reviewers ───────────────────────────────────────────────────────────────
+  { callsign: "VERA", group: "reviewer", discipline: "spec consistency", tier: "deep" },
+  { callsign: "ODIN", group: "reviewer", discipline: "cross-spec audit", tier: "deep" },
+  { callsign: "CASS", group: "reviewer", discipline: "code review", tier: "deep" },
+  { callsign: "THEO", group: "reviewer", discipline: "code review", tier: "standard" },
+  { callsign: "ECHO", group: "reviewer", discipline: "test quality", tier: "standard" },
+  { callsign: "MAVIS", group: "reviewer", discipline: "suites & coverage", tier: "standard" },
+  { callsign: "ZARA", group: "reviewer", discipline: "smoke & walk aid", tier: "standard" },
+  { callsign: "NORA", group: "reviewer", discipline: "evidence & provenance", tier: "fast" },
+  // ── always on: continuous, takes no task ────────────────────────────────────
+  { callsign: "ARGUS", group: "always-on", discipline: "guard \xB7 every diff", tier: "standard" },
+  { callsign: "ATLAS", group: "always-on", discipline: "coordinator", tier: "deep" }
+];
+var CREW_ROSTER_SIZE = CREW_ROSTER.length;
+var CREW_CALLSIGNS = CREW_ROSTER.map((member) => member.callsign);
+
+// ../events/dist/device-auth.js
+import { z as z6 } from "zod";
+var utcIso86013 = z6.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/, "must be a UTC ISO-8601 timestamp ending in Z (INV-015)");
+var DEVICE_AUTH_STATUS = {
+  /** The poll: minted, nobody has acted yet. Keep polling. 200. */
+  PENDING: "pending",
+  /** The poll: approved, and the credential is in this body. Once only. 200. */
+  APPROVED: "approved",
+  /** Confirm: the decision was recorded (approve or decline). 200. */
+  RECORDED: "recorded",
+  /** The human refused at the confirmation page. 400 on the poll. */
+  DECLINED: "declined",
+  /** The code's absolute expiry has passed. 400. */
+  EXPIRED: "expired",
+  /** Never minted, or already spent. 400. */
+  UNKNOWN: "unknown",
+  /** Confirm: neither `approve` nor `decline` was named. Nothing was bound. 400. */
+  INVALID_DECISION: "invalid-decision",
+  /** Confirm: an approval arrived with no signed-in identity. 400. */
+  IDENTITY_REQUIRED: "identity-required",
+  /** This deployment has no `SIGNIN_BASE_URL` / `DEVICE_AUTH_CONFIRM_SECRET`. 503. */
+  NOT_CONFIGURED: "not-configured",
+  /** Confirm: the shared confirmation secret was missing or wrong. 401. */
+  UNAUTHORIZED: "unauthorized",
+  /** Confirm: the code was already approved, declined or claimed. 409. */
+  ALREADY_DECIDED: "already-decided",
+  /**
+   * Confirm: an approval named a signed-in identity whose account has not accepted
+   * the terms of service and privacy policy currently in force (T-18, #588). 400.
+   *
+   * NOT BOUND TO THE DEVICE CODE. Unlike every other refusal in this const, this one
+   * says nothing about the code itself — the code is still `pending` after this
+   * response, exactly as it was before the request, so the SAME userCode can be
+   * confirmed again once the caller has recorded acceptance. `deviceConfirmRequestSchema`'s
+   * `acceptTerms` is how a second confirm says it did.
+   */
+  TERMS_REQUIRED: "terms-required"
+};
+var DEVICE_POLL_REFUSALS = [
+  DEVICE_AUTH_STATUS.DECLINED,
+  DEVICE_AUTH_STATUS.EXPIRED,
+  DEVICE_AUTH_STATUS.UNKNOWN
+];
+var deviceAuthStartResponseSchema = z6.object({
+  deviceCode: z6.string().min(1),
+  userCode: z6.string().min(1),
+  verificationUrl: z6.string().min(1),
+  expiresAt: utcIso86013,
+  pollIntervalMs: z6.number().int().positive()
+}).strict();
+var devicePollPendingSchema = z6.object({
+  status: z6.literal(DEVICE_AUTH_STATUS.PENDING),
+  pollIntervalMs: z6.number().int().positive()
 }).strict();
-var coeFindingResponseSchema = z4.object({
-  findingId: z4.string(),
-  engagementId: z4.string(),
-  phase: z4.string(),
-  description: z4.string(),
-  addRateTag: z4.enum(["seam-new", "seam-repeat", "model-limitation"]),
-  mappedPatternRef: z4.string().nullable(),
-  createdAt: utcIso86012
+var devicePollApprovedSchema = z6.object({
+  status: z6.literal(DEVICE_AUTH_STATUS.APPROVED),
+  accountId: z6.string().min(1),
+  credential: z6.string().min(1),
+  expiresAt: utcIso86013
 }).strict();
-var phaseEntryDecisionSchema = z4.discriminatedUnion("decision", [
-  z4.object({
-    decision: z4.literal("entry-condition-met"),
-    /** Who attests. */
-    actor: z4.string(),
-    /** What makes the entry condition hold, in the attester's own words. */
-    evidence: z4.string()
-  }).strict(),
-  z4.object({
-    decision: z4.literal("override"),
-    /** Who is opening it anyway. */
-    actor: z4.string(),
-    /** Why, in the operator's own words. */
-    reason: z4.string()
-  }).strict()
-]);
-var openPhaseRequestSchema = z4.object({
-  phase: z4.string().nullable(),
-  entry: phaseEntryDecisionSchema
+var deviceAuthRefusalSchema = z6.object({
+  status: z6.enum([
+    DEVICE_AUTH_STATUS.DECLINED,
+    DEVICE_AUTH_STATUS.EXPIRED,
+    DEVICE_AUTH_STATUS.UNKNOWN,
+    DEVICE_AUTH_STATUS.INVALID_DECISION,
+    DEVICE_AUTH_STATUS.IDENTITY_REQUIRED,
+    DEVICE_AUTH_STATUS.NOT_CONFIGURED,
+    DEVICE_AUTH_STATUS.UNAUTHORIZED,
+    DEVICE_AUTH_STATUS.ALREADY_DECIDED,
+    DEVICE_AUTH_STATUS.TERMS_REQUIRED
+  ]),
+  message: z6.string().min(1)
 }).strict();
-var phaseEntryDecisionRecordSchema = z4.object({
-  decisionId: z4.string(),
-  decision: z4.enum(["entry-condition-met", "override"]),
-  actor: z4.string(),
-  /** The evidence (attestation) or the reason (override) — one basis per row. */
-  justification: z4.string(),
-  blockingFinding: z4.string().nullable(),
-  decidedAt: utcIso86012
+var devicePollResponseSchema = z6.union([
+  devicePollPendingSchema,
+  devicePollApprovedSchema,
+  deviceAuthRefusalSchema
+]);
+var deviceConfirmRequestSchema = z6.object({
+  userCode: z6.string().min(1),
+  decision: z6.enum(["approve", "decline"]),
+  externalAuthId: z6.string().min(1).optional(),
+  email: z6.string().optional(),
+  acceptTerms: z6.boolean().optional()
 }).strict();
-var openPhaseResponseSchema = z4.object({
-  engagement: engagementStatusResponseSchema,
-  /** What is open now. `null` is project scope. */
-  phase: z4.string().nullable(),
-  /** What was open before this decision. `null` is project scope. */
-  previousPhase: z4.string().nullable(),
-  decision: phaseEntryDecisionRecordSchema
+var deviceConfirmRecordedSchema = z6.object({
+  status: z6.literal(DEVICE_AUTH_STATUS.RECORDED),
+  accountId: z6.string().min(1).optional()
 }).strict();
+var deviceConfirmResponseSchema = z6.union([
+  deviceConfirmRecordedSchema,
+  deviceAuthRefusalSchema
+]);
+var LOOPBACK_REDIRECT_HOST = "127.0.0.1";
+var LOOPBACK_PORT_MIN = 1024;
+var LOOPBACK_PORT_MAX = 65535;
+var LOOPBACK_CALLBACK_PATH = "/halfcycle-cli-callback";
+var LOOPBACK_QUERY_PORT = "loopback_port";
+var LOOPBACK_QUERY_STATE = "loopback_state";
+var LOOPBACK_QUERY_RESULT = "result";
+var LOOPBACK_RESULT = {
+  APPROVED: "approved",
+  DECLINED: "declined"
+};
+function loopbackVerificationUrl(verificationUrl, target) {
+  let url;
+  try {
+    url = new URL(verificationUrl);
+  } catch {
+    return verificationUrl;
+  }
+  url.searchParams.set(LOOPBACK_QUERY_PORT, String(target.port));
+  url.searchParams.set(LOOPBACK_QUERY_STATE, target.state);
+  return url.toString();
+}
+
+// dist/engagement-credential.js
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { platform as platform2 } from "node:os";
+import { join as join2 } from "node:path";
+
+// dist/account-credential.js
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir, platform } from "node:os";
+import { dirname, join } from "node:path";
+function halfcycleHome(home) {
+  return join(home ?? homedir(), ".halfcycle");
+}
+function accountStorePath(home) {
+  return join(halfcycleHome(home), "account.json");
+}
+function normaliseOrigin(serviceUrl) {
+  return serviceUrl.trim().replace(/\/+$/, "").toLowerCase();
+}
+function readStore(home) {
+  let raw;
+  try {
+    raw = readFileSync(accountStorePath(home), "utf-8");
+  } catch {
+    return { version: 1, accounts: {} };
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || typeof parsed.accounts !== "object") {
+      return { version: 1, accounts: {} };
+    }
+    return { version: 1, accounts: parsed.accounts ?? {} };
+  } catch {
+    return { version: 1, accounts: {} };
+  }
+}
+function writeStore(store, home) {
+  const path = accountStorePath(home);
+  mkdirSync(dirname(path), { recursive: true, mode: 448 });
+  writeFileSync(path, `${JSON.stringify(store, null, 2)}
+`, { mode: 384 });
+  if (platform() !== "win32") {
+    chmodSync(path, 384);
+    try {
+      chmodSync(dirname(path), 448);
+    } catch {
+    }
+  }
+}
+function readStoredCredential(serviceUrl, home) {
+  const entry = readStore(home).accounts[normaliseOrigin(serviceUrl)];
+  if (!entry || typeof entry.credential !== "string" || entry.credential.trim() === "") {
+    return void 0;
+  }
+  return entry;
+}
+function writeStoredCredential(serviceUrl, entry, home) {
+  const store = readStore(home);
+  store.accounts[normaliseOrigin(serviceUrl)] = {
+    accountId: entry.accountId,
+    credential: entry.credential,
+    expiresAt: entry.expiresAt,
+    signedInAt: entry.signedInAt ?? (/* @__PURE__ */ new Date()).toISOString()
+  };
+  writeStore(store, home);
+}
+function forgetStoredCredential(serviceUrl, home) {
+  const store = readStore(home);
+  const key = normaliseOrigin(serviceUrl);
+  if (!(key in store.accounts))
+    return false;
+  delete store.accounts[key];
+  writeStore(store, home);
+  return true;
+}
+
+// dist/engagement-credential.js
+var ENGAGEMENTS_DIR = "engagements";
+var ENV_FILENAME = "env";
+var PIN_ENGAGEMENT_ID_FIELD = "engagementId";
+function engagementStateDir(engagementId, home) {
+  return join2(halfcycleHome(home), ENGAGEMENTS_DIR, engagementId);
+}
+function engagementEnvPath(engagementId, home) {
+  return join2(engagementStateDir(engagementId, home), ENV_FILENAME);
+}
+var GUARD_ENV_KEYS = [
+  "GUARD_SERVICE_URL",
+  "GUARD_SERVICE_TOKEN",
+  "GUARD_ENGAGEMENT_ID"
+];
+var ENGAGEMENT_ENV_KEYS = [
+  "HALFCYCLE_SERVICE_URL",
+  "HALFCYCLE_MCP_URL",
+  "HALFCYCLE_TOKEN",
+  "HALFCYCLE_ENGAGEMENT_ID",
+  ...GUARD_ENV_KEYS,
+  "CONTROL_TELEMETRY_URL"
+];
+var ENV_HEADER = "# Halfcycle per-engagement credential \u2014 machine level, owner-only, never in a repository.";
+function shq(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function unquote(value) {
+  const v = value.trim();
+  if (v.length >= 2 && v.startsWith("'") && v.endsWith("'")) {
+    return v.slice(1, -1).split(`'\\''`).join(`'`);
+  }
+  if (v.length >= 2 && v.startsWith('"') && v.endsWith('"'))
+    return v.slice(1, -1);
+  return v;
+}
+function parseEnvText(raw) {
+  const out = {};
+  for (const line of raw.split("\n")) {
+    const eq = line.indexOf("=");
+    if (eq === -1)
+      continue;
+    const key = line.slice(0, eq).replace(/^\s*export\s+/, "").trim();
+    if (key === "" || key.startsWith("#"))
+      continue;
+    out[key] = unquote(line.slice(eq + 1));
+  }
+  return out;
+}
+function reconcileEnvText(existing, values, keys = ENGAGEMENT_ENV_KEYS) {
+  const desired = new Map(keys.map((k) => [k, values[k] ?? ""]));
+  const line = (k) => `${k}=${shq(desired.get(k) ?? "")}`;
+  if (existing === null) {
+    return `${ENV_HEADER}
+` + keys.map(line).join("\n") + "\n";
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const out = existing.split("\n").map((existingLine) => {
+    const eq = existingLine.indexOf("=");
+    if (eq === -1)
+      return existingLine;
+    const lhs = existingLine.slice(0, eq);
+    const exported = /^\s*export\s+/.exec(lhs);
+    const prefix = exported === null ? "" : exported[0];
+    const key = lhs.slice(prefix.length).trim();
+    if (desired.has(key)) {
+      seen.add(key);
+      return `${prefix}${line(key)}`;
+    }
+    return existingLine;
+  });
+  const missing = keys.filter((k) => !seen.has(k));
+  if (missing.length > 0) {
+    const trailingBlank = out.length > 0 && out[out.length - 1] === "";
+    const prefix = trailingBlank ? "" : existing.endsWith("\n") ? "" : "\n";
+    out.push(`${prefix}${ENV_HEADER}
+` + missing.map(line).join("\n"));
+  }
+  let result = out.join("\n");
+  if (existing.endsWith("\n") && !result.endsWith("\n"))
+    result += "\n";
+  return result;
+}
+function readEngagementEnv(engagementId, home) {
+  try {
+    return parseEnvText(readFileSync2(engagementEnvPath(engagementId, home), "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function writeEngagementEnv(engagementId, values, home) {
+  const path = engagementEnvPath(engagementId, home);
+  const dir = engagementStateDir(engagementId, home);
+  mkdirSync2(dir, { recursive: true, mode: 448 });
+  let existing;
+  try {
+    existing = readFileSync2(path, "utf-8");
+  } catch {
+    existing = null;
+  }
+  const reconciled = reconcileEnvText(existing, values);
+  const outcome = existing === reconciled ? "skipped" : "written";
+  if (outcome === "written") {
+    writeFileSync2(path, reconciled, { mode: 384 });
+  }
+  applyOwnerOnly(path, dir);
+  return outcome;
+}
+function applyOwnerOnly(path, dir) {
+  if (platform2() === "win32")
+    return;
+  try {
+    chmodSync2(path, 384);
+  } catch {
+  }
+  try {
+    chmodSync2(dir, 448);
+  } catch {
+  }
+}
+function engagementResolutionShell() {
+  return `# --- Halfcycle credential resolution (generated; do not edit) ----------------
+# THE CREDENTIAL IS NOT IN THIS REPOSITORY. It lives at
+#   $HOME/.halfcycle/${ENGAGEMENTS_DIR}/<engagement-id>/${ENV_FILENAME}
+# written owner-only by \`npx halfcycle\`. What this repository holds is the
+# engagement id, in the committed .halfcycle/bundle.json. So: read the id out of
+# the pin, then name the file. There is no jq here and node is not dependable on a
+# desktop session's PATH, so the id is cut out with sed \u2014 after flattening the
+# file, because sed is line-oriented and the pin's line breaks are not a contract.
+#
+# Sets HALFCYCLE_ENV_FILE, HALFCYCLE_ENV_ENGAGEMENT and HALFCYCLE_ENV_PROBLEM in
+# the CALLER's shell and returns a status. Call it as \`if halfcycle_env_file \u2026\`,
+# never as \`$(halfcycle_env_file \u2026)\` \u2014 a command substitution is a subshell and
+# would discard everything it set.
+halfcycle_env_file() {
+  HALFCYCLE_ENV_FILE=""
+  HALFCYCLE_ENV_ENGAGEMENT=""
+  HALFCYCLE_ENV_PROBLEM=""
+  hc_pin="$1/.halfcycle/bundle.json"
+  if [ ! -f "$hc_pin" ]; then
+    HALFCYCLE_ENV_PROBLEM="no-pin"
+    return 1
+  fi
+  hc_id=$(tr -d '\\n' < "$hc_pin" | sed -n 's/.*"${PIN_ENGAGEMENT_ID_FIELD}"[[:space:]]*:[[:space:]]*"\\([^"]*\\)".*/\\1/p')
+  if [ -z "$hc_id" ]; then
+    HALFCYCLE_ENV_PROBLEM="no-id"
+    return 1
+  fi
+  HALFCYCLE_ENV_ENGAGEMENT="$hc_id"
+  if [ -z "\${HOME:-}" ]; then
+    HALFCYCLE_ENV_PROBLEM="no-home"
+    return 1
+  fi
+  hc_env="$HOME/.halfcycle/${ENGAGEMENTS_DIR}/$hc_id/${ENV_FILENAME}"
+  if [ ! -f "$hc_env" ]; then
+    HALFCYCLE_ENV_PROBLEM="no-credential"
+    return 1
+  fi
+  HALFCYCLE_ENV_FILE="$hc_env"
+  return 0
+}
+# --- end Halfcycle credential resolution ------------------------------------`;
+}
 
-// ../events/dist/device-auth.js
-import { z as z5 } from "zod";
-var utcIso86013 = z5.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/, "must be a UTC ISO-8601 timestamp ending in Z (INV-015)");
-var DEVICE_AUTH_STATUS = {
-  /** The poll: minted, nobody has acted yet. Keep polling. 200. */
-  PENDING: "pending",
-  /** The poll: approved, and the credential is in this body. Once only. 200. */
-  APPROVED: "approved",
-  /** Confirm: the decision was recorded (approve or decline). 200. */
-  RECORDED: "recorded",
-  /** The human refused at the confirmation page. 400 on the poll. */
-  DECLINED: "declined",
-  /** The code's absolute expiry has passed. 400. */
-  EXPIRED: "expired",
-  /** Never minted, or already spent. 400. */
-  UNKNOWN: "unknown",
-  /** Confirm: neither `approve` nor `decline` was named. Nothing was bound. 400. */
-  INVALID_DECISION: "invalid-decision",
-  /** Confirm: an approval arrived with no signed-in identity. 400. */
-  IDENTITY_REQUIRED: "identity-required",
-  /** This deployment has no `SIGNIN_BASE_URL` / `DEVICE_AUTH_CONFIRM_SECRET`. 503. */
-  NOT_CONFIGURED: "not-configured",
-  /** Confirm: the shared confirmation secret was missing or wrong. 401. */
-  UNAUTHORIZED: "unauthorized",
-  /** Confirm: the code was already approved, declined or claimed. 409. */
-  ALREADY_DECIDED: "already-decided",
-  /**
-   * Confirm: an approval named a signed-in identity whose account has not accepted
-   * the terms of service and privacy policy currently in force (T-18, #588). 400.
-   *
-   * NOT BOUND TO THE DEVICE CODE. Unlike every other refusal in this const, this one
-   * says nothing about the code itself — the code is still `pending` after this
-   * response, exactly as it was before the request, so the SAME userCode can be
-   * confirmed again once the caller has recorded acceptance. `deviceConfirmRequestSchema`'s
-   * `acceptTerms` is how a second confirm says it did.
-   */
-  TERMS_REQUIRED: "terms-required"
-};
-var DEVICE_POLL_REFUSALS = [
-  DEVICE_AUTH_STATUS.DECLINED,
-  DEVICE_AUTH_STATUS.EXPIRED,
-  DEVICE_AUTH_STATUS.UNKNOWN
-];
-var deviceAuthStartResponseSchema = z5.object({
-  deviceCode: z5.string().min(1),
-  userCode: z5.string().min(1),
-  verificationUrl: z5.string().min(1),
-  expiresAt: utcIso86013,
-  pollIntervalMs: z5.number().int().positive()
-}).strict();
-var devicePollPendingSchema = z5.object({
-  status: z5.literal(DEVICE_AUTH_STATUS.PENDING),
-  pollIntervalMs: z5.number().int().positive()
-}).strict();
-var devicePollApprovedSchema = z5.object({
-  status: z5.literal(DEVICE_AUTH_STATUS.APPROVED),
-  accountId: z5.string().min(1),
-  credential: z5.string().min(1),
-  expiresAt: utcIso86013
-}).strict();
-var deviceAuthRefusalSchema = z5.object({
-  status: z5.enum([
-    DEVICE_AUTH_STATUS.DECLINED,
-    DEVICE_AUTH_STATUS.EXPIRED,
-    DEVICE_AUTH_STATUS.UNKNOWN,
-    DEVICE_AUTH_STATUS.INVALID_DECISION,
-    DEVICE_AUTH_STATUS.IDENTITY_REQUIRED,
-    DEVICE_AUTH_STATUS.NOT_CONFIGURED,
-    DEVICE_AUTH_STATUS.UNAUTHORIZED,
-    DEVICE_AUTH_STATUS.ALREADY_DECIDED,
-    DEVICE_AUTH_STATUS.TERMS_REQUIRED
-  ]),
-  message: z5.string().min(1)
-}).strict();
-var devicePollResponseSchema = z5.union([
-  devicePollPendingSchema,
-  devicePollApprovedSchema,
-  deviceAuthRefusalSchema
-]);
-var deviceConfirmRequestSchema = z5.object({
-  userCode: z5.string().min(1),
-  decision: z5.enum(["approve", "decline"]),
-  externalAuthId: z5.string().min(1).optional(),
-  email: z5.string().optional(),
-  acceptTerms: z5.boolean().optional()
-}).strict();
-var deviceConfirmRecordedSchema = z5.object({
-  status: z5.literal(DEVICE_AUTH_STATUS.RECORDED),
-  accountId: z5.string().min(1).optional()
-}).strict();
-var deviceConfirmResponseSchema = z5.union([
-  deviceConfirmRecordedSchema,
-  deviceAuthRefusalSchema
-]);
-var LOOPBACK_REDIRECT_HOST = "127.0.0.1";
-var LOOPBACK_PORT_MIN = 1024;
-var LOOPBACK_PORT_MAX = 65535;
-var LOOPBACK_CALLBACK_PATH = "/halfcycle-cli-callback";
-var LOOPBACK_QUERY_PORT = "loopback_port";
-var LOOPBACK_QUERY_STATE = "loopback_state";
-var LOOPBACK_QUERY_RESULT = "result";
-var LOOPBACK_RESULT = {
-  APPROVED: "approved",
-  DECLINED: "declined"
-};
-function loopbackVerificationUrl(verificationUrl, target) {
-  let url;
+// dist/identity.js
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync as readFileSync3 } from "node:fs";
+import { join as join3 } from "node:path";
+import { randomUUID } from "node:crypto";
+var PROJECT_IDENTITY_NOTE = 'projectId is NOT the engagement id \u2014 it identifies this repository/worktree to Halfcycle, not an engagement. The engagement id lives in .halfcycle/bundle.json, in its "engagementId" field.';
+function git(targetRepoRoot, args2) {
   try {
-    url = new URL(verificationUrl);
+    const out = execFileSync("git", ["-C", targetRepoRoot, ...args2], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    const trimmed = out.trim();
+    return trimmed.length > 0 ? trimmed : null;
   } catch {
-    return verificationUrl;
+    return null;
   }
-  url.searchParams.set(LOOPBACK_QUERY_PORT, String(target.port));
-  url.searchParams.set(LOOPBACK_QUERY_STATE, target.state);
-  return url.toString();
+}
+function readRootCommit(targetRepoRoot) {
+  const roots = git(targetRepoRoot, ["rev-list", "--max-parents=0", "HEAD"]);
+  if (!roots)
+    return null;
+  const lines = roots.split("\n").filter((l) => l.length > 0);
+  return lines.length > 0 ? lines[lines.length - 1] : null;
+}
+function readRemote(targetRepoRoot) {
+  return git(targetRepoRoot, ["remote", "get-url", "origin"]);
+}
+function mintOrReadIdentity(targetRepoRoot) {
+  const path = join3(targetRepoRoot, ".halfcycle", "project.json");
+  if (existsSync(path)) {
+    const onDisk = JSON.parse(readFileSync3(path, "utf-8"));
+    const identity2 = {
+      projectId: onDisk.projectId ?? "",
+      rootCommit: onDisk.rootCommit ?? null,
+      remote: onDisk.remote ?? null,
+      note: PROJECT_IDENTITY_NOTE
+    };
+    return { identity: identity2, minted: false };
+  }
+  const identity = {
+    projectId: randomUUID(),
+    rootCommit: readRootCommit(targetRepoRoot),
+    remote: readRemote(targetRepoRoot),
+    note: PROJECT_IDENTITY_NOTE
+  };
+  return { identity, minted: true };
+}
+
+// dist/mcp-endpoint.js
+var MCP_ENDPOINT_PATH = "/mcp";
+function mcpEndpointUrl(origin) {
+  return `${origin.trim().replace(/\/+$/, "")}${MCP_ENDPOINT_PATH}`;
+}
+
+// dist/merge-settings.js
+function isHalfcycleEntry(entry, halfcycleCommands) {
+  return entry.hooks.some((h) => halfcycleCommands.has(h.command));
+}
+function mergeSettings(existing, generated) {
+  const merged = { ...existing };
+  if (generated.$schema !== void 0) {
+    merged.$schema = generated.$schema;
+  }
+  const generatedHooks = generated.hooks ?? {};
+  const halfcycleCommands = /* @__PURE__ */ new Set();
+  for (const entries of Object.values(generatedHooks)) {
+    for (const entry of entries) {
+      for (const h of entry.hooks)
+        halfcycleCommands.add(h.command);
+    }
+  }
+  const existingHooks = existing.hooks ?? {};
+  const mergedHooks = {};
+  const events = /* @__PURE__ */ new Set([...Object.keys(existingHooks), ...Object.keys(generatedHooks)]);
+  for (const event of events) {
+    const developerEntries = (existingHooks[event] ?? []).filter((entry) => !isHalfcycleEntry(entry, halfcycleCommands));
+    const halfcycleEntries = generatedHooks[event] ?? [];
+    mergedHooks[event] = [...developerEntries, ...halfcycleEntries];
+  }
+  merged.hooks = mergedHooks;
+  merged.permissions = mergePermissions(existing.permissions, generated.permissions);
+  return merged;
+}
+function mergePermissions(existing, generated) {
+  if (existing === void 0 && generated === void 0)
+    return void 0;
+  const result = { ...existing ?? {} };
+  const generatedDeny = generated?.deny ?? [];
+  if (generatedDeny.length > 0) {
+    const theirs = existing?.deny ?? [];
+    const seen = new Set(theirs);
+    result.deny = [...theirs, ...generatedDeny.filter((p) => !seen.has(p))];
+  }
+  return result;
 }
 
 // dist/scan.js
+import { existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "node:fs";
+import { join as join4 } from "node:path";
 var HALFCYCLE_STATE_FORMAT = "halfcycle-state-file/v1";
 var HALFCYCLE_STATE_NOTE = [
   "This file is a local cache written ONCE when Halfcycle was installed. It is not a",
@@ -1107,6 +1162,13 @@ var ENV_EXAMPLE_NAMES = [
   "GUARD_SERVICE_URL",
   "GUARD_SERVICE_TOKEN",
   "GUARD_ENGAGEMENT_ID",
+  // Declared for ONE reason only: it is written into the credential store, and the
+  // INV-004 check below requires every written name to be named here. It is NOT
+  // read from a client's environment — the generated CI stanza sets the three
+  // GUARD_* names and not this one, and `packages/runner` never reads it at all.
+  // It is how an install REMEMBERS the plane it was created against, which matters
+  // only to our own development and CI planes (operator amendment, 2026-08-30);
+  // nothing tells a client to set it, and the generated prose says so.
   "HALFCYCLE_SERVICE_URL",
   "HALFCYCLE_MCP_URL",
   "HALFCYCLE_TOKEN",
@@ -1143,10 +1205,11 @@ GUARD_ENGAGEMENT_ID=<argType:runtime>
 # nothing else here. The platform reports the second on create, so it is written
 # for you and .mcp.json carries the composed address.
 #
-# NEITHER IS SOMETHING YOU NEED TO SET (T-27). The installer talks to Halfcycle's
-# own control plane by default; HALFCYCLE_SERVICE_URL OVERRIDES that address and
-# exists for a self-hosted or development plane. It is not a prerequisite for
-# \`npx halfcycle\`, and nothing in the product asks you to find its value.
+# NEITHER IS A SETTING. Both names are here because both are WRITTEN by the
+# installer into this engagement's credential, and every name it writes is declared
+# here \u2014 that is the rule this section exists for. Halfcycle's address ships in the
+# CLI and is the same one for everybody, so there is nothing to look up and nothing
+# to put in this file. Leave both lines exactly as they are.
 HALFCYCLE_SERVICE_URL=<argType:runtime>
 HALFCYCLE_MCP_URL=<argType:runtime>
 HALFCYCLE_TOKEN=<argType:runtime>
@@ -1332,6 +1395,16 @@ function writeBundlePin(targetRepoRoot, version, engagementId, engagementType, w
   const pinPath = join5(targetRepoRoot, ".halfcycle", "bundle.json");
   writeAllowlisted(pinPath, targetRepoRoot, JSON.stringify(pin, null, 2) + "\n", writtenPaths);
 }
+function writeCrewRoster(targetRepoRoot, report) {
+  const doc = {
+    $comment: "GENERATED by the Halfcycle installer \u2014 do not edit by hand. Re-run the installer to pick up a roster change.",
+    crew: CREW_ROSTER
+  };
+  const rendered = `${JSON.stringify(doc, null, 2)}
+`;
+  const crewPath = join5(targetRepoRoot, ".halfcycle", "crew.json");
+  record(report, writeOwned(crewPath, targetRepoRoot, rendered), ".halfcycle/crew.json");
+}
 function readBundlePin(targetRepoRoot) {
   const pinPath = join5(targetRepoRoot, ".halfcycle", "bundle.json");
   if (!existsSync3(pinPath))
@@ -1563,6 +1636,7 @@ async function install(options) {
       break;
   }
   writeBundlePin(targetRepo, manifest.version, engagementId, engagementType, report.writtenPaths);
+  writeCrewRoster(targetRepo, report);
   const scanResult = runBootstrapScan(targetRepo);
   return {
     version: manifest.version,
@@ -1584,7 +1658,7 @@ function resolveControlOrigin(env = process.env) {
   return { origin: DEFAULT_CONTROL_ORIGIN, source: "default" };
 }
 function controlOriginNote(resolved) {
-  return resolved.source === "environment" ? `${resolved.origin} (from HALFCYCLE_SERVICE_URL)` : `${resolved.origin} (the Halfcycle plane; set HALFCYCLE_SERVICE_URL to use another)`;
+  return resolved.source === "environment" ? `${resolved.origin} (from HALFCYCLE_SERVICE_URL)` : `${resolved.origin} (the Halfcycle plane)`;
 }
 
 // dist/create-engagement.js
@@ -1644,7 +1718,7 @@ function planeRefusal(detail) {
     error: typeof candidate.error === "string" ? candidate.error : void 0
   };
 }
-var CONTROL_ORIGIN_HINT = `With nothing configured this CLI talks to ${DEFAULT_CONTROL_ORIGIN}; HALFCYCLE_SERVICE_URL overrides that, and is only for a self-hosted or development plane. Whichever is in use, it must be the CONTROL origin \u2014 the one that serves /engagements and /board/enter-codes. The MCP server runs at a different address, and the platform supplies that one itself; you do not configure it.`;
+var CONTROL_ORIGIN_HINT = `This CLI talks to ${DEFAULT_CONTROL_ORIGIN}; it must be the CONTROL origin \u2014 the one that serves /engagements and /board/enter-codes. The MCP server runs at a different address, and the platform supplies that one itself; you configure neither.`;
 async function createEngagement(baseUrl, name, credential) {
   return requestEngagementValues(`${baseUrl.replace(/\/+$/, "")}/engagements`, name ? { name } : {}, credential, { action: "Create-engagement", nothingHappened: "No engagement was created", route: "POST /engagements" });
 }