monomind 1.9.17 → 1.10.0

package/.claude/helpers/graphify-freshen.cjs

@@ -30,10 +30,22 @@ function resolveMonographEntry(dir) {
     return null;
   })();
 
+  // Global npm installation (covers `npm install -g @monomind/cli` and homebrew installs)
+  const globalNpmMonograph = (() => {
+    try {
+      const { execSync } = require('child_process');
+      const globalRoot = execSync('npm root -g', { encoding: 'utf-8', timeout: 5000 }).trim();
+      const p = path.join(globalRoot, '@monoes', 'monograph', 'dist', 'src', 'index.js');
+      return p;
+    } catch { return null; }
+  })();
+
   const candidates = [
     // pnpm store version (most reliable — pre-built, isolated from workspace source changes)
     pnpmStore,
-    // Monorepo: monobrain root is the monograph package
+    // Global npm / homebrew install of @monomind/cli (most common for npx/global users)
+    globalNpmMonograph,
+    // Monorepo: monomind root is the monograph package
     path.join(dir, 'dist', 'src', 'index.js'),
     // Monorepo: monograph lives under packages/@monomind/monograph (pnpm workspace)
     path.join(dir, 'packages', '@monomind', 'monograph', 'dist', 'src', 'index.js'),

package/.claude/helpers/hook-handler.cjs

@@ -1581,7 +1581,7 @@ const handlers = {
         var isArchitectLevel = ['architect', 'system-architect', 'software-architect'].includes(taskAgent)
           || /\b(architecture|design decision|adr|trade-?off|migration strategy)\b/.test(taskDescAdr);
         if (isArchitectLevel && taskDescAdr.length > 30) {
-          var adrDir = path.join(CWD, adrCfg.directory || 'docs/adr');
+          var adrDir = path.join(CWD, adrCfg.directory || 'docs/adrs');
           fs.mkdirSync(adrDir, { recursive: true });
           var adrNum = (fs.readdirSync(adrDir).filter(function(f) { return f.endsWith('.md'); }).length + 1)
             .toString().padStart(4, '0');

package/.claude/helpers/router.cjs

@@ -425,7 +425,10 @@ function loadExtrasAgent(slug) {
   );
   if (!entry) return null;
   try {
-    return { ...entry, content: fs.readFileSync(entry.filePath, 'utf8') };
+    const resolvedPath = path.isAbsolute(entry.filePath)
+      ? entry.filePath
+      : path.resolve(__dirname, entry.filePath);
+    return { ...entry, content: fs.readFileSync(resolvedPath, 'utf8') };
   } catch (e) { return null; }
 }
 

package/.claude/scheduled_tasks.lock

@@ -1 +1 @@
-{"sessionId":"ac358524-6a0b-4ee2-aecb-f4d1c5e3bf56","pid":65105,"procStart":"Fri May  8 19:38:11 2026","acquiredAt":1778277393307}
+{"sessionId":"322617a3-3a89-45a6-8ab7-f97e9e88bcc3","pid":57797,"procStart":"Tue May 12 10:20:23 2026","acquiredAt":1778656565005}

package/.claude/settings.json

@@ -280,7 +280,7 @@
     },
     "adr": {
       "autoGenerate": true,
-      "directory": "/docs/adr",
+      "directory": "docs/adrs",
       "template": "madr"
     },
     "security": {
@@ -304,9 +304,9 @@
   },
   "mcpServers": {
     "monomind": {
-      "command": "node",
+      "command": "npx",
       "args": [
-        "/Users/morteza/Desktop/tools/monomind/packages/@monomind/cli/bin/cli.js",
+        "monomind@latest",
         "mcp",
         "start"
       ]

package/.claude/settings.local.json

@@ -43,9 +43,9 @@
       "Bash(rmdir .monomind/graph)",
       "Bash(rm -rf .claude/agents/dual-mode .claude/skills/dual-mode .claude/agents/sona/sona-learning-optimizer.md AGENTS.md)",
       "Bash(rm -rf .agents/skills/__TRACKED_VAR__)",
-      "Bash(mv monobrain-help.md monomind-help.md)",
-      "Bash(mv monobrain-memory.md monomind-memory.md)",
-      "Bash(mv monobrain-swarm.md monomind-swarm.md)"
+      "Bash(mv monomind-help.md monomind-help.md)",
+      "Bash(mv monomind-memory.md monomind-memory.md)",
+      "Bash(mv monomind-swarm.md monomind-swarm.md)"
     ]
   },
   "model": "sonnet"

package/.claude/skills/.monomind/sessions/current.json

@@ -2,7 +2,7 @@
   "id": "session-1777897390154",
   "startedAt": "2026-05-04T12:23:10.154Z",
   "platform": "darwin",
-  "cwd": "/Users/morteza/Desktop/tools/monobrain/.claude/skills",
+  "cwd": "/Users/morteza/Desktop/tools/monomind/.claude/skills",
   "context": {},
   "metrics": {
     "edits": 24,

package/.claude/skills/.monomind/sessions/session-1777829336455.json

@@ -2,7 +2,7 @@
   "id": "session-1777829336455",
   "startedAt": "2026-05-03T17:28:56.455Z",
   "platform": "darwin",
-  "cwd": "/Users/morteza/Desktop/tools/monobrain/.claude/skills",
+  "cwd": "/Users/morteza/Desktop/tools/monomind/.claude/skills",
   "context": {},
   "metrics": {
     "edits": 2,

package/.claude/skills/.monomind/sessions/session-1777831614725.json

@@ -2,7 +2,7 @@
   "id": "session-1777831614725",
   "startedAt": "2026-05-03T18:06:54.725Z",
   "platform": "darwin",
-  "cwd": "/Users/morteza/Desktop/tools/monobrain/.claude/skills",
+  "cwd": "/Users/morteza/Desktop/tools/monomind/.claude/skills",
   "context": {},
   "metrics": {
     "edits": 32,

package/.claude/skills/.monomind/sessions/session-1777832095857.json

@@ -2,7 +2,7 @@
   "id": "session-1777832095857",
   "startedAt": "2026-05-03T18:14:55.857Z",
   "platform": "darwin",
-  "cwd": "/Users/morteza/Desktop/tools/monobrain/.claude/skills",
+  "cwd": "/Users/morteza/Desktop/tools/monomind/.claude/skills",
   "context": {},
   "metrics": {
     "edits": 16,

package/.claude/skills/.monomind/sessions/session-1777839814183.json

@@ -2,7 +2,7 @@
   "id": "session-1777839814183",
   "startedAt": "2026-05-03T20:23:34.183Z",
   "platform": "darwin",
-  "cwd": "/Users/morteza/Desktop/tools/monobrain/.claude/skills",
+  "cwd": "/Users/morteza/Desktop/tools/monomind/.claude/skills",
   "context": {},
   "metrics": {
     "edits": 20,

package/.claude/skills/.monomind/sessions/session-1777841847131.json

@@ -2,7 +2,7 @@
   "id": "session-1777841847131",
   "startedAt": "2026-05-03T20:57:27.131Z",
   "platform": "darwin",
-  "cwd": "/Users/morteza/Desktop/tools/monobrain/.claude/skills",
+  "cwd": "/Users/morteza/Desktop/tools/monomind/.claude/skills",
   "context": {},
   "metrics": {
     "edits": 35,

package/.claude/skills/.monomind/sessions/session-1777843309463.json

@@ -2,7 +2,7 @@
   "id": "session-1777843309463",
   "startedAt": "2026-05-03T21:21:49.463Z",
   "platform": "darwin",
-  "cwd": "/Users/morteza/Desktop/tools/monobrain/.claude/skills",
+  "cwd": "/Users/morteza/Desktop/tools/monomind/.claude/skills",
   "context": {},
   "metrics": {
     "edits": 22,

package/.claude/skills/.monomind/sessions/session-1777880867159.json

@@ -2,7 +2,7 @@
   "id": "session-1777880867159",
   "startedAt": "2026-05-04T07:47:47.159Z",
   "platform": "darwin",
-  "cwd": "/Users/morteza/Desktop/tools/monobrain/.claude/skills",
+  "cwd": "/Users/morteza/Desktop/tools/monomind/.claude/skills",
   "context": {},
   "metrics": {
     "edits": 15,

package/.claude/skills/.monomind/sessions/session-1777881884593.json

@@ -2,7 +2,7 @@
   "id": "session-1777881884593",
   "startedAt": "2026-05-04T08:04:44.593Z",
   "platform": "darwin",
-  "cwd": "/Users/morteza/Desktop/tools/monobrain/.claude/skills",
+  "cwd": "/Users/morteza/Desktop/tools/monomind/.claude/skills",
   "context": {},
   "metrics": {
     "edits": 12,

package/.claude/skills/.monomind/sessions/session-1777884090471.json

@@ -2,7 +2,7 @@
   "id": "session-1777884090471",
   "startedAt": "2026-05-04T08:41:30.471Z",
   "platform": "darwin",
-  "cwd": "/Users/morteza/Desktop/tools/monobrain/.claude/skills",
+  "cwd": "/Users/morteza/Desktop/tools/monomind/.claude/skills",
   "context": {},
   "metrics": {
     "edits": 2,

package/.claude/skills/.monomind/sessions/session-1777884808221.json

@@ -2,7 +2,7 @@
   "id": "session-1777884808221",
   "startedAt": "2026-05-04T08:53:28.221Z",
   "platform": "darwin",
-  "cwd": "/Users/morteza/Desktop/tools/monobrain/.claude/skills",
+  "cwd": "/Users/morteza/Desktop/tools/monomind/.claude/skills",
   "context": {},
   "metrics": {
     "edits": 183,

package/.claude/skills/.monomind/sessions/session-1777885672155.json

@@ -2,7 +2,7 @@
   "id": "session-1777885672155",
   "startedAt": "2026-05-04T09:07:52.155Z",
   "platform": "darwin",
-  "cwd": "/Users/morteza/Desktop/tools/monobrain/.claude/skills",
+  "cwd": "/Users/morteza/Desktop/tools/monomind/.claude/skills",
   "context": {},
   "metrics": {
     "edits": 80,

package/.claude/skills/.monomind/sessions/session-1777886852818.json

@@ -2,7 +2,7 @@
   "id": "session-1777886852818",
   "startedAt": "2026-05-04T09:27:32.818Z",
   "platform": "darwin",
-  "cwd": "/Users/morteza/Desktop/tools/monobrain/.claude/skills",
+  "cwd": "/Users/morteza/Desktop/tools/monomind/.claude/skills",
   "context": {},
   "metrics": {
     "edits": 19,

package/.claude/skills/.monomind/sessions/session-1777896532690.json

@@ -2,7 +2,7 @@
   "id": "session-1777896532690",
   "startedAt": "2026-05-04T12:08:52.690Z",
   "platform": "darwin",
-  "cwd": "/Users/morteza/Desktop/tools/monobrain/.claude/skills",
+  "cwd": "/Users/morteza/Desktop/tools/monomind/.claude/skills",
   "context": {},
   "metrics": {
     "edits": 8,

package/.claude/skills/mastermind/_protocol.md

@@ -15,17 +15,17 @@ This file is a reference loaded by mastermind domain skills and master. It is NE
 Execute at the START of every mastermind run (master or standalone domain command). Load in this order:
 
 **Step A — Tier 3 core principles (all domains):**
-Try `mcp__monobrain__agentdb_hierarchical-recall` with query `"mastermind principles"`, topK 20.
+Try `mcp__monomind__agentdb_hierarchical-recall` with query `"mastermind principles"`, topK 20.
 If it returns `"AgentDB bridge not available"` or any error, fall back to:
-`mcp__monobrain__memory_search` with query `"mastermind principles"`, namespace `"mastermind:principles"`, limit 20.
+`mcp__monomind__memory_search` with query `"mastermind principles"`, namespace `"mastermind:principles"`, limit 20.
 
 **Step B — Tier 2 weekly summary for this domain:**
-Try `mcp__monobrain__agentdb_context-synthesize` with query `[current prompt keywords]`, maxEntries 10.
+Try `mcp__monomind__agentdb_context-synthesize` with query `[current prompt keywords]`, maxEntries 10.
 If it fails, fall back to:
-`mcp__monobrain__memory_search` with query `[current prompt keywords]`, namespace `"mastermind:<domain>:weekly"`, limit 10.
+`mcp__monomind__memory_search` with query `[current prompt keywords]`, namespace `"mastermind:<domain>:weekly"`, limit 10.
 
 **Step C — Relevant graph nodes:**
-Call `mcp__monobrain__graphify_query` with question `[3-5 keywords extracted from current prompt]`, depth 2.
+Call `mcp__monomind__monograph_query` with question `[3-5 keywords extracted from current prompt]`, depth 2.
 If the graph is not built yet (error: "No graph found"), skip this tier — continue without graph context.
 
 Combine all results into a **BRAIN CONTEXT** block. Insert this block before any planning, decomposition, or agent spawning step. Format:
@@ -55,20 +55,20 @@ score = confidence × (1 / (days_since_run + 1)) × log(uses + 1)
 - `uses`: 1 (first write)
 
 **Step 2 — Append to Tier 1 raw log:**
-Try `mcp__monobrain__agentdb_hierarchical-store` with:
+Try `mcp__monomind__agentdb_hierarchical-store` with:
 - namespace: `mastermind:<domain>:raw`
 - content: [full unified output schema YAML from this run, as a string]
 - metadata: `{ score, project, run_id, date: ISO8601, domain }`
 
-If AgentDB is unavailable, fall back to `mcp__monobrain__memory_store`:
+If AgentDB is unavailable, fall back to `mcp__monomind__memory_store`:
 - key: `mastermind:<domain>:run:<run_id>`
 - value: [JSON-encoded unified output schema]
 - namespace: `mastermind:<domain>:raw`
 - tags: `["mastermind", "<domain>", "run"]`
 
 **Step 3 — Check weekly compaction trigger:**
-Try `mcp__monobrain__agentdb_health` on namespace `mastermind:<domain>:raw`.
-If unavailable, call `mcp__monobrain__memory_stats` and check entry count manually.
+Try `mcp__monomind__agentdb_health` on namespace `mastermind:<domain>:raw`.
+If unavailable, call `mcp__monomind__memory_stats` and check entry count manually.
 If `entry_count >= 20` OR `days_since_last_compaction >= 7`:
 1. Retrieve all Tier 1 entries since last compaction
 2. Produce a per-domain weekly summary (use LLM synthesis: "Summarize the key decisions, patterns, and lessons from these run logs in under 300 words")
@@ -130,9 +130,10 @@ score = confidence × (1 / (days_since_run + 1)) × log(uses + 1)
 
 ## Real-Time Dashboard Event Logging
 
-Every mastermind run MUST emit structured events to the live dashboard via WebFetch. The dashboard at `docs/mastermind-diagram.html` listens on SSE and animates each event in real time.
+Every mastermind run MUST emit structured events to the live dashboard via curl (NOT WebFetch — WebFetch is blocked for localhost in Claude Code runtimes). The dashboard at `docs/mastermind-diagram.html` listens on SSE and animates each event in real time.
 
-**Dashboard endpoint:** `http://localhost:4242/api/mastermind/event`
+**Dashboard endpoint:** `<CTRL_URL>/api/mastermind/event`
+Resolve `CTRL_URL` at runtime: `jq -r '.url // "http://localhost:4242"' "$REPO_ROOT/.monomind/control.json" 2>/dev/null || echo "http://localhost:4242"` — the control server port auto-increments on collision and writes the actual URL to `.monomind/control.json`.
 **Method:** POST, `Content-Type: application/json`
 
 ### Event Types and When to Emit
@@ -210,10 +211,12 @@ Every mastermind run MUST emit structured events to the live dashboard via WebFe
 
 ### How to Emit (curl-first — WebFetch is blocked for localhost in Claude Code runtimes)
 
-**Always use curl via Bash.** WebFetch is restricted for `localhost` URLs in Claude Code agent runtimes and will return ECONNREFUSED even when the server is running. Use this pattern:
+**Always use curl via Bash.** WebFetch is restricted for `localhost` URLs in Claude Code agent runtimes and will return ECONNREFUSED even when the server is running. **Always resolve the control URL dynamically** — the server auto-increments the port on collision. Use this pattern:
 
 ```bash
-curl -s -o /dev/null -X POST "http://localhost:4242/api/mastermind/event" \
+REPO_ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
+CTRL_URL=$(jq -r '.url // "http://localhost:4242"' "$REPO_ROOT/.monomind/control.json" 2>/dev/null || echo "http://localhost:4242")
+curl -s -o /dev/null -X POST "${CTRL_URL}/api/mastermind/event" \
   -H "Content-Type: application/json" \
   -d "$(jq -cn \
     --arg sid "$SESSION_ID" \
@@ -279,7 +282,8 @@ space_id=$(monotask space list 2>/dev/null | awk -F'|' '{gsub(/^ +| +$/,"",$1);g
 [ -z "$space_id" ] && { echo "ERROR: Could not find or create space '$project_name' — verify monotask is installed (monotask --version)"; exit 1; }
 
 # Step 2 — Find existing board by canonical name or create
-board_id=$(monotask board list 2>/dev/null | awk -F'|' '{gsub(/^ +| +$/,"",$1);gsub(/^ +| +$/,"",$2);if($2==n)print $1}' n="$canonical" | head -1)
+# board list format is "uuid: name" (colon-space separator, NOT pipe)
+board_id=$(monotask board list 2>/dev/null | awk -F': ' '{gsub(/^ +| +$/,"",$1);gsub(/^ +| +$/,"",$2);if($2==n)print $1}' n="$canonical" | head -1)
 if [ -n "$board_id" ]; then
   # Step 3a — Fetch column IDs from existing board
   cols_json=$(monotask column list "$board_id" --json 2>/dev/null || echo '[]')
@@ -291,9 +295,10 @@ else
   board_id=$(monotask board create --space "$space_id" "$canonical" --json | jq -r '.id // empty')
   [ -z "$board_id" ] && { echo "ERROR: Failed to create board '$canonical'"; exit 1; }
   monotask space boards add "$space_id" "$board_id" >/dev/null 2>&1 || true
-  todo_col=$(monotask column create "$board_id" "Todo"  --json | jq -r '.id')
-  doing_col=$(monotask column create "$board_id" "Doing" --json | jq -r '.id')
-  done_col=$(monotask column create "$board_id" "Done"  --json | jq -r '.id')
+  todo_col=$(monotask column create "$board_id" "Todo"  --json | jq -r '.id // empty')
+  doing_col=$(monotask column create "$board_id" "Doing" --json | jq -r '.id // empty')
+  done_col=$(monotask column create "$board_id" "Done"  --json | jq -r '.id // empty')
+  [ -z "$todo_col" ] && { echo "ERROR: Failed to create Todo column for $canonical"; exit 1; }
 fi
 ```
 
@@ -309,7 +314,8 @@ space_id=$(monotask space list 2>/dev/null | awk -F'|' '{gsub(/^ +| +$/,"",$1);g
 state_patch='{}'
 for domain in build marketing ops; do   # substitute actual domain list
   canonical="${project_name}-${domain}"
-  board_id=$(monotask board list 2>/dev/null | awk -F'|' '{gsub(/^ +| +$/,"",$1);gsub(/^ +| +$/,"",$2);if($2==n)print $1}' n="$canonical" | head -1)
+  # board list format is "uuid: name" (colon-space separator, NOT pipe)
+board_id=$(monotask board list 2>/dev/null | awk -F': ' '{gsub(/^ +| +$/,"",$1);gsub(/^ +| +$/,"",$2);if($2==n)print $1}' n="$canonical" | head -1)
   if [ -n "$board_id" ]; then
     cols_json=$(monotask column list "$board_id" --json 2>/dev/null || echo '[]')
     todo_col=$(echo "$cols_json" | jq -r '[.[] | select(.title=="Todo" or .title=="Backlog")] | .[0].id // empty')
@@ -319,9 +325,10 @@ for domain in build marketing ops; do   # substitute actual domain list
     board_id=$(monotask board create --space "$space_id" "$canonical" --json | jq -r '.id // empty')
     [ -z "$board_id" ] && { echo "ERROR: Failed to create $canonical board"; exit 1; }
     monotask space boards add "$space_id" "$board_id" >/dev/null 2>&1 || true
-    todo_col=$(monotask column create "$board_id" "Todo"  --json | jq -r '.id')
-    doing_col=$(monotask column create "$board_id" "Doing" --json | jq -r '.id')
-    done_col=$(monotask column create "$board_id" "Done"  --json | jq -r '.id')
+    todo_col=$(monotask column create "$board_id" "Todo"  --json | jq -r '.id // empty')
+    doing_col=$(monotask column create "$board_id" "Doing" --json | jq -r '.id // empty')
+    done_col=$(monotask column create "$board_id" "Done"  --json | jq -r '.id // empty')
+    [ -z "$todo_col" ] && { echo "ERROR: Failed to create Todo column for $canonical"; exit 1; }
   fi
   state_patch=$(echo "$state_patch" | jq \
     --arg d "$domain" --arg b "$board_id" \

package/.claude/skills/mastermind/access.md

@@ -0,0 +1,236 @@
+---
+name: mastermind-access
+description: Mastermind access — manage org membership roles (owner/admin/operator/viewer), granular permission grants, invite tokens, and pending join requests. Controls who can do what inside an org.
+type: domain-skill
+default_mode: confirm
+---
+
+# Mastermind Access
+
+This skill is invoked by `mastermind:access` or directly via `/mastermind:access`.
+
+---
+
+## Inputs
+
+- `brain_context`: BRAIN CONTEXT block (injected by command, or loaded below if standalone)
+- `org_name`: org to manage access for (required)
+- `action`: list | invite | set-role | grant | revoke | remove | suspend | join-requests | approve-join | reject-join
+- `member_id`: member slug/id (required for set-role/grant/revoke/remove/suspend)
+- `role`: owner | admin | operator | viewer (required for invite/set-role)
+- `permission`: permission key to grant/revoke (see Permission Keys below)
+- `request_id`: join request id (required for approve-join/reject-join)
+- `caller`: command | master
+
+---
+
+## Permission Keys
+
+| Key | Label | Implied by role |
+|-----|-------|-----------------|
+| `agents:create` | Create agents | owner, admin |
+| `users:invite` | Invite members | owner, admin |
+| `users:manage_permissions` | Manage members | owner |
+| `tasks:assign` | Assign tasks | owner, admin, operator |
+| `tasks:assign_scope` | Assign scoped tasks | — (explicit only) |
+| `tasks:manage_active_checkouts` | Manage active checkouts | — (explicit only) |
+| `joins:approve` | Approve join requests | owner, admin |
+| `environments:manage` | Manage environments | owner, admin |
+
+**Role implied grants:**
+- `owner` → all permissions
+- `admin` → agents:create, users:invite, tasks:assign, joins:approve, environments:manage
+- `operator` → tasks:assign
+- `viewer` → (none)
+
+---
+
+## Step 0 — Brain Load (standalone only)
+
+If `caller` is not "command", load brain context following _protocol.md Brain Load Procedure with namespace: `ops`.
+
+---
+
+## Step 1 — Load Members File
+
+```bash
+orgFile=".monomind/orgs/${org_name}.json"
+[ ! -f "$orgFile" ] && { echo "ERROR: Org '${org_name}' not found."; exit 1; }
+
+membersFile=".monomind/orgs/${org_name}-members.json"
+[ ! -f "$membersFile" ] && cat > "$membersFile" <<'EOF'
+{"members":[],"join_requests":[]}
+EOF
+```
+
+---
+
+## Step 2 — Execute Action
+
+### list (default)
+
+```bash
+echo "MEMBERS — org: $org_name"
+echo "────────────────────────────────────────────────────────"
+printf "%-20s %-10s %-12s %s\n" "ID" "ROLE" "STATUS" "EXPLICIT GRANTS"
+echo "────────────────────────────────────────────────────────"
+
+count=$(jq '.members | length' "$membersFile")
+if [ "$count" -eq 0 ]; then
+  echo "  No members. Use --action invite to add the first member."
+else
+  jq -r '.members[] |
+    [.id, (.role // "viewer"), (.status // "active"),
+     ((.grants // []) | join(", ") | if . == "" then "(none)" else . end)]
+    | @tsv' "$membersFile" | while IFS=$'\t' read -r id role status grants; do
+    printf "%-20s %-10s %-12s %s\n" "$id" "$role" "$status" "$grants"
+  done
+fi
+
+# Show pending join requests
+pending=$(jq '[.join_requests[] | select(.status == "pending")] | length' "$membersFile")
+[ "$pending" -gt 0 ] && echo "" && echo "  ⚠ $pending pending join request(s). Run --action join-requests to review."
+```
+
+### invite
+
+Generate an invite token for a new member:
+
+```bash
+[ -z "$role" ] && role="operator"
+case "$role" in owner|admin|operator|viewer) : ;; *)
+  echo "ERROR: --role must be one of: owner, admin, operator, viewer"; exit 1 ;;
+esac
+
+inviteToken=$(openssl rand -hex 16 2>/dev/null || python3 -c "import secrets; print(secrets.token_hex(16))")
+inviteUrl="https://monomind.local/invite?org=${org_name}&token=${inviteToken}&role=${role}"
+ts=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+
+tmp="${membersFile}.tmp"
+jq --arg token "$inviteToken" --arg role "$role" --arg ts "$ts" --arg url "$inviteUrl" \
+  '.join_requests += [{"id":$token,"type":"invite","role":$role,"status":"pending","token":$token,"inviteUrl":$url,"createdAt":$ts}]' \
+  "$membersFile" > "$tmp" && mv "$tmp" "$membersFile"
+
+echo "INVITE CREATED"
+echo "  Role:  $role"
+echo "  Token: $inviteToken"
+echo "  URL:   $inviteUrl"
+echo ""
+echo "Share this URL or token with the new member."
+```
+
+### set-role
+
+```bash
+[ -z "$member_id" ] && { echo "ERROR: --member-id required."; exit 1; }
+[ -z "$role" ] && { echo "ERROR: --role required."; exit 1; }
+case "$role" in owner|admin|operator|viewer) : ;; *)
+  echo "ERROR: --role must be one of: owner, admin, operator, viewer"; exit 1 ;;
+esac
+
+tmp="${membersFile}.tmp"
+jq --arg id "$member_id" --arg role "$role" \
+  '.members = [.members[] | if .id == $id then .role = $role else . end]' \
+  "$membersFile" > "$tmp" && mv "$tmp" "$membersFile"
+echo "Member '$member_id' role → $role"
+```
+
+### grant / revoke
+
+```bash
+[ -z "$member_id" ] && { echo "ERROR: --member-id required."; exit 1; }
+[ -z "$permission" ] && { echo "ERROR: --permission required (e.g. agents:create)."; exit 1; }
+
+validKeys="agents:create users:invite users:manage_permissions tasks:assign tasks:assign_scope tasks:manage_active_checkouts joins:approve environments:manage"
+echo "$validKeys" | grep -qw "$permission" || { echo "ERROR: Unknown permission '$permission'."; exit 1; }
+
+tmp="${membersFile}.tmp"
+if [ "$action" = "grant" ]; then
+  jq --arg id "$member_id" --arg perm "$permission" \
+    '.members = [.members[] | if .id == $id then .grants = ((.grants // []) + [$perm] | unique) else . end]' \
+    "$membersFile" > "$tmp" && mv "$tmp" "$membersFile"
+  echo "Granted: $permission → $member_id"
+else
+  jq --arg id "$member_id" --arg perm "$permission" \
+    '.members = [.members[] | if .id == $id then .grants = ((.grants // []) | map(select(. != $perm))) else . end]' \
+    "$membersFile" > "$tmp" && mv "$tmp" "$membersFile"
+  echo "Revoked: $permission from $member_id"
+fi
+```
+
+### remove
+
+```bash
+[ -z "$member_id" ] && { echo "ERROR: --member-id required."; exit 1; }
+tmp="${membersFile}.tmp"
+jq --arg id "$member_id" '.members = [.members[] | select(.id != $id)]' \
+  "$membersFile" > "$tmp" && mv "$tmp" "$membersFile"
+echo "Removed member: $member_id"
+```
+
+### suspend
+
+```bash
+[ -z "$member_id" ] && { echo "ERROR: --member-id required."; exit 1; }
+tmp="${membersFile}.tmp"
+jq --arg id "$member_id" \
+  '.members = [.members[] | if .id == $id then .status = "suspended" else . end]' \
+  "$membersFile" > "$tmp" && mv "$tmp" "$membersFile"
+echo "Member '$member_id' suspended. They cannot perform org actions until reinstated."
+```
+
+### join-requests
+
+List pending join requests:
+
+```bash
+echo "JOIN REQUESTS — org: $org_name"
+echo "────────────────────────────────────────────────────────"
+jq -r '.join_requests[] | select(.status == "pending") |
+  "[\(.id)] type=\(.type // "join")  role=\(.role // "viewer")  created=\(.createdAt // "?")
+   → /mastermind:access --org '"$org_name"' --action approve-join --request-id \(.id)
+   → /mastermind:access --org '"$org_name"' --action reject-join  --request-id \(.id)"
+' "$membersFile" 2>/dev/null || echo "  No pending join requests."
+```
+
+### approve-join / reject-join
+
+```bash
+[ -z "$request_id" ] && { echo "ERROR: --request-id required."; exit 1; }
+newStatus=$([ "$action" = "approve-join" ] && echo "approved" || echo "rejected")
+
+tmp="${membersFile}.tmp"
+if [ "$action" = "approve-join" ]; then
+  # Get role from request, create member record
+  requestRole=$(jq -r --arg id "$request_id" '.join_requests[] | select(.id == $id) | .role // "viewer"' "$membersFile")
+  jq --arg id "$request_id" --arg status "$newStatus" --arg role "$requestRole" --arg ts "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+    '.join_requests = [.join_requests[] | if .id == $id then .status = $status | .resolvedAt = $ts else . end] |
+     .members += [{"id":$id,"role":$role,"status":"active","grants":[],"joinedAt":$ts}]' \
+    "$membersFile" > "$tmp" && mv "$tmp" "$membersFile"
+  echo "Approved join request $request_id (role: $requestRole). Member added."
+else
+  jq --arg id "$request_id" --arg status "$newStatus" --arg ts "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+    '.join_requests = [.join_requests[] | if .id == $id then .status = $status | .resolvedAt = $ts else . end]' \
+    "$membersFile" > "$tmp" && mv "$tmp" "$membersFile"
+  echo "Rejected join request $request_id."
+fi
+```
+
+---
+
+## Step 3 — Return Output
+
+```yaml
+domain: ops
+status: complete
+action: <action>
+org: <org_name>
+members_count: <N>
+pending_requests: <N>
+```
+
+---
+
+## Step 4 — Brain Write (standalone only)
+
+If `caller` is not "command", follow _protocol.md Brain Write Procedure for domain `ops`.