CB-561: require member registry for architects

MemberRegistry.bind() had 18 call sites, every one in its own unit test.
Nothing in production ever bound a terminal to a slot, so CallerResolver's
architect branch was unreachable, every spawned architect resolved as WORKER,
and Authz's architect row was dead code. Since SEND is granted to
isPrimary() || isArchitect(), no architect could message anyone.

The spawn lifecycle now binds on both acquire paths and unbinds on release,
through a MemberLifecycle seam with a no-op default, so all six SessionManager
constructors are unchanged.

The escalation guard is deliberately double-sided. MemberRegistry flattens
every pool, so dev:* and reviewer:* slots sit in the same map the architect
resolver reads. The lifecycle binds only ARCHITECT roles, AND CallerResolver
independently checks roleForSlot(slot) == ARCHITECT before granting. Either
alone would be enough today; together, a regression in one cannot escalate a
worker. A reviewer confirmed a third barrier already existed: Authz gates
SPAWN on isPrimary(), so only a lead can request role=ARCHITECT at all.

Verified by the primary: mvn clean install, 640 tests, 0 failures.

Two findings recorded, neither blocking:

1. Known race, low severity. registry.put() and memberLifecycle.acquired()
   are not atomic. A release landing between them unbinds nothing (no binding
   exists yet), then acquire binds a dead terminal that no later release will
   ever clear - the slot leaks. Only the shutdown drain can reach a SPAWNING
   session (the idle reaper skips it, and an explicit stop needs a paneId the
   spawn has not returned), so the leak dies with the process. Note that
   binding before put does NOT fix it: the drain then iterates a roster the
   session is not in yet. A real fix needs atomicity.

2. The legacy Supplier-based withLeadsAndMembers overload and the Map-form
   constructors now silently disable architect resolution: memberSlotRoles
   defaults to _ -> null, so the architect branch can never be taken there.
   Production uses the registry form, and the tests were migrated, so nothing
   fails - but a future caller gets workers with no error.

.claude/skills/port-to-opencode/SKILL.md

@@ -92,24 +92,32 @@ route by who launches opencode:
 
 | Launcher | Route |
 |---|---|
-| a human, from a terminal | `{file:…}` — see below |
+| a human, from a terminal | one central store, sourced by the login shell |
 | a spawner (bridge, CI, IDE) | `{env:…}`, with the spawner injecting the variable |
 
-For the human case prefer **`{file:…}` with a workspace-relative path**, kept in a gitignored
-`.secrets/` directory beside `opencode.json`:
+**For the human case, keep every credential in one file the login shell sources.** Here that file
+is `${SHARED_ENV}/tools/secrets.sh`, sourced from `${SHARED_ENV}/.ltms`, kept at mode 600 and never
+committed. `opencode.json` then names variables and holds no values:
 
 ```json
-"headers": { "Authorization": "Bearer {file:.secrets/api-token}" }
+"headers": { "Authorization": "Bearer {env:CONTEXT7_TOKEN}" }
 ```
 
-Verified: opencode resolves relative `{file:}` paths against the project root, so this needs no
-shell setup at all — no rc export leaking the secret to every process, no direnv dependency.
+Both routes end at the same syntax, and that is the point. The file does not change when a human
+launches opencode instead of the bridge.
 
-**The catch, and state it out loud:** `.secrets/` is gitignored, so a peer running in a git worktree
-does **not** get it — worktrees receive tracked files only, the same rule that makes `opencode.json`
-itself worth committing. Spawned peers must therefore be fed through `{env:…}` by whatever launches
-them. Check the variable *names* match: a spawner often injects under a different name than your
-shell uses, and the config has no fallback.
+**`{file:…}` also works, and this project moved away from it.** Opencode resolves a relative
+`{file:}` path against the project root, so a gitignored `.secrets/` beside `opencode.json` needs no
+shell setup at all. It did not fail; the problem is that it makes a second copy of the token. The
+same secret then lives in two places, and the copy you forget is the one that leaks or goes stale.
+One store with many references is easier to rotate and to audit.
+
+**One catch survives either choice, so state it out loud:** what a human's shell exports does not
+reach a spawned peer, and neither does a gitignored `.secrets/` — a git worktree receives tracked
+files only. Spawned peers must be fed through `{env:…}` by whatever launches them. Check the
+variable *names* match: a spawner often injects under a different name than your shell uses, and
+the config has no fallback. In this repo the bridge goes further: it neutralizes a worktree's
+`opencode.json`, so a member cannot inherit the primary's credentials by accident.
 
 ## 4. Do not port machine-local MCP servers
 

.gitignore

@@ -1,5 +1,6 @@
-# Workspace-scoped secrets for tools that read no settings cascade of their own
-# (opencode resolves these via {file:.secrets/...} in opencode.json).
+# No secret belongs in this repo any more: every credential lives in one shell-level store
+# (${SHARED_ENV}/tools/secrets.sh), and opencode.json reads it as {env:...}. This line stays as a
+# backstop, so a workspace-scoped copy that someone re-creates by habit still cannot be committed.
 .secrets/
 
 # Settings backups inherit the env block — and secrets with it.

bridged/src/main/java/dev/ltms/bridged/Bridged.java

@@ -243,6 +243,7 @@ public final class Bridged {
         // what CallerResolver resolves against and what that lifecycle will read profiles from;
         // nothing here spawns a slot.
         MemberRegistry members = new MemberRegistry(cfg.fleet());
+        sessions.setMemberLifecycle(members);
         if (!members.slots().isEmpty()) {
             log.info("member slots: {} configured {} — none bound yet (a slot is idle until the "
                             + "spawn lifecycle binds a live terminal to it)",
@@ -375,13 +376,11 @@ public final class Bridged {
                 throw new IllegalStateException("auth.mode=token but env var " + cfg.auth().tokenEnv()
                         + " is unset or empty — export it before starting bridged");
             }
-            callers = CallerResolver.withLeadsAndMembers(identity, true, token, leads,
-                    members::snapshot);
+            callers = CallerResolver.withLeadsAndMembers(identity, true, token, leads, members);
             log.info("auth: token mode (bearer required for non-worker callers, env {})",
                     cfg.auth().tokenEnv());
         } else {
-            callers = CallerResolver.withLeadsAndMembers(identity, false, null, leads,
-                    members::snapshot);
+            callers = CallerResolver.withLeadsAndMembers(identity, false, null, leads, members);
             log.info("auth: loopback-trust (any loopback non-worker caller is the primary)");
         }
 

bridged/src/main/java/dev/ltms/bridged/auth/CallerResolver.java

@@ -1,10 +1,12 @@
 package dev.ltms.bridged.auth;
 
 import dev.ltms.bridged.mcp.ConnectionIdentity;
+import dev.ltms.bridged.peer.MemberRole;
 
 import java.nio.charset.StandardCharsets;
 import java.security.MessageDigest;
 import java.util.Map;
+import java.util.function.Function;
 import java.util.function.Supplier;
 
 /**
@@ -60,14 +62,16 @@ public final class CallerResolver {
      * in {@code Bridged} reads a constant from config, which is the degenerate live case.
      */
     private final Supplier<Map<String, String>> architectTerminals;
+    private final Function<String, MemberRole> memberSlotRoles;
+    private final Function<String, String> memberSlotNames;
 
-    /** Loopback-trust resolver: no token required, historical behaviour. */
-    public CallerResolver(ConnectionIdentity identity) {
+    /** Loopback-trust resolver: no token required, historical behaviour. Test-only. */
+    CallerResolver(ConnectionIdentity identity) {
         this(identity, false, null, Map.of());
     }
 
-    /** As {@link #CallerResolver(ConnectionIdentity, boolean, String, Map)} with no leads pinned. */
-    public CallerResolver(ConnectionIdentity identity, boolean tokenMode, String token) {
+    /** As {@link #CallerResolver(ConnectionIdentity, boolean, String, Map)} with no leads pinned. Test-only. */
+    CallerResolver(ConnectionIdentity identity, boolean tokenMode, String token) {
         this(identity, tokenMode, token, Map.of());
     }
 
@@ -82,8 +86,8 @@ public final class CallerResolver {
      * @param pinnedPrimaryTerminal the primary's own herdr {@code terminal_id}
      *                              ({@code null}/blank = unpinned)
      */
-    public static CallerResolver pinnedTo(ConnectionIdentity identity, boolean tokenMode,
-                                          String token, String pinnedPrimaryTerminal) {
+    static CallerResolver pinnedTo(ConnectionIdentity identity, boolean tokenMode,
+                                   String token, String pinnedPrimaryTerminal) {
         return new CallerResolver(identity, tokenMode, token,
                 pinnedPrimaryTerminal == null || pinnedPrimaryTerminal.isBlank()
                         ? Map.of() : Map.of(pinnedPrimaryTerminal, "primary"));
@@ -98,21 +102,11 @@ public final class CallerResolver {
      *                       {@link Role#PRIMARY} — rather than a worker. Empty = nothing pinned,
      *                       so every pane resolves as a worker.
      */
-    public CallerResolver(ConnectionIdentity identity, boolean tokenMode, String token,
-                          Map<String, String> leadTerminals) {
+    CallerResolver(ConnectionIdentity identity, boolean tokenMode, String token,
+                   Map<String, String> leadTerminals) {
         this(identity, tokenMode, token, fixed(leadTerminals), null);
     }
 
-    /**
-     * Map-form of both registries (CB-548): lead terminals and the initial architect terminal
-     * bindings, each snapshotted at construction (a handed-over map is not offered as live state).
-     */
-    public CallerResolver(ConnectionIdentity identity, boolean tokenMode, String token,
-                          Map<String, String> leadTerminals,
-                          Map<String, String> architectTerminals) {
-        this(identity, tokenMode, token, fixed(leadTerminals), fixed(architectTerminals));
-    }
-
     /**
      * Live-registry form: {@code leadTerminals} is consulted on every resolve, so leads discovered
      * after startup (CB-531's tab scan) take effect without a restart.
@@ -121,26 +115,26 @@ public final class CallerResolver {
      * {@link #pinnedTo}: {@code Map} and {@code Supplier} overloads are ambiguous for a literal
      * {@code null}.
      */
-    public static CallerResolver withLeads(ConnectionIdentity identity, boolean tokenMode,
-                                           String token,
-                                           Supplier<Map<String, String>> leadTerminals) {
+    static CallerResolver withLeads(ConnectionIdentity identity, boolean tokenMode,
+                                    String token,
+                                    Supplier<Map<String, String>> leadTerminals) {
         return new CallerResolver(identity, tokenMode, token, leadTerminals, null);
     }
 
     /**
-     * Live-registry form for both {@code leadTerminals} and the CB-548 architect registry: both
-     * are consulted on every resolve, so a slot binding injected after startup takes effect
-     * without a restart.
+     * Live registry form that can confirm a bound slot is an architect slot.
      *
-     * <p>A static factory rather than a constructor overload, for the same reason as
-     * {@link #pinnedTo}: too many {@code Map}/{@code Supplier} combinations to make {@code null}
-     * unambiguous.
+     * <p>This is the only public construction path. It keeps terminal bindings and slot roles in
+     * the same {@link MemberRegistry}, so a configured architect can resolve as an architect.
      */
     public static CallerResolver withLeadsAndMembers(ConnectionIdentity identity,
-                                                        boolean tokenMode, String token,
-                                                        Supplier<Map<String, String>> leadTerminals,
-                                                        Supplier<Map<String, String>> architectTerminals) {
-        return new CallerResolver(identity, tokenMode, token, leadTerminals, architectTerminals);
+                                                       boolean tokenMode, String token,
+                                                       Supplier<Map<String, String>> leadTerminals,
+                                                       MemberRegistry members) {
+        return new CallerResolver(identity, tokenMode, token, leadTerminals,
+                members == null ? null : members::snapshot,
+                members == null ? null : members::roleForSlot,
+                members == null ? null : members::nameForSlot);
     }
 
     private static Supplier<Map<String, String>> fixed(Map<String, String> leadTerminals) {
@@ -151,6 +145,21 @@ public final class CallerResolver {
     private CallerResolver(ConnectionIdentity identity, boolean tokenMode, String token,
                            Supplier<Map<String, String>> leadTerminals,
                            Supplier<Map<String, String>> architectTerminals) {
+        this(identity, tokenMode, token, leadTerminals, architectTerminals, null);
+    }
+
+    private CallerResolver(ConnectionIdentity identity, boolean tokenMode, String token,
+                           Supplier<Map<String, String>> leadTerminals,
+                           Supplier<Map<String, String>> architectTerminals,
+                           Function<String, MemberRole> memberSlotRoles) {
+        this(identity, tokenMode, token, leadTerminals, architectTerminals, memberSlotRoles, null);
+    }
+
+    private CallerResolver(ConnectionIdentity identity, boolean tokenMode, String token,
+                           Supplier<Map<String, String>> leadTerminals,
+                           Supplier<Map<String, String>> architectTerminals,
+                           Function<String, MemberRole> memberSlotRoles,
+                           Function<String, String> memberSlotNames) {
         if (tokenMode && (token == null || token.isBlank())) {
             throw new IllegalArgumentException(
                     "auth.mode=token requires a non-empty token; check that the env var named by "
@@ -161,6 +170,8 @@ public final class CallerResolver {
         this.expectedToken = tokenMode ? token.getBytes(StandardCharsets.UTF_8) : null;
         this.leadTerminals = leadTerminals == null ? Map::of : leadTerminals;
         this.architectTerminals = architectTerminals == null ? Map::of : architectTerminals;
+        this.memberSlotRoles = memberSlotRoles == null ? _ -> null : memberSlotRoles;
+        this.memberSlotNames = memberSlotNames == null ? Function.identity() : memberSlotNames;
     }
 
     /**
@@ -206,11 +217,12 @@ public final class CallerResolver {
                 return Principal.leader(lead, c.terminal(), c.pid());
             }
             String slot = architectTerminals.get().get(c.terminal());
-            if (slot != null) {
+            if (slot != null && memberSlotRoles.apply(slot) == MemberRole.ARCHITECT) {
                 // The config/live binding names this pane as an architect slot's own. Same
                 // unforgeable pane mapping; the live binding, never a request argument, decides.
-                // Checked before the generic worker fallback, per the CB-548 precedence order.
-                return Principal.architect(slot, c.terminal(), c.pid());
+                // Check the slot role too: this defence in depth prevents a bad lifecycle bind from
+                // escalating a dev or reviewer into an architect. Checked before the worker fallback.
+                return Principal.architect(memberSlotNames.apply(slot), c.terminal(), c.pid());
             }
             return Principal.worker(c.terminal(), c.pid()); // unforgeable; never token-gated
         }

bridged/src/main/java/dev/ltms/bridged/auth/MemberLifecycle.java

@@ -0,0 +1,21 @@
+package dev.ltms.bridged.auth;
+
+import dev.ltms.bridged.peer.MemberRole;
+
+/** Optional session lifecycle hook for live member-slot bindings. */
+public interface MemberLifecycle {
+
+    MemberLifecycle NONE = new MemberLifecycle() {
+        @Override
+        public void acquired(MemberRole role, String profile, String terminal) {
+        }
+
+        @Override
+        public void released(String terminal) {
+        }
+    };
+
+    void acquired(MemberRole role, String profile, String terminal);
+
+    void released(String terminal);
+}

bridged/src/main/java/dev/ltms/bridged/auth/MemberRegistry.java

@@ -2,11 +2,14 @@ package dev.ltms.bridged.auth;
 
 import dev.ltms.bridged.config.BridgedConfig;
 import dev.ltms.bridged.peer.MemberRole;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.LinkedHashMap;
 import java.util.Map;
+import java.util.Objects;
 
 /**
  * The architect-slot registry (CB-548): every gateway-local architect name and the strong-model
@@ -29,7 +32,9 @@ import java.util.Map;
  * exposes the map the resolver resolves against plus the profile lookup lifecycle will call.
  * Nothing here creates or manages an architect session.
  */
-public final class MemberRegistry {
+public final class MemberRegistry implements MemberLifecycle {
+
+    private static final Logger log = LoggerFactory.getLogger(MemberRegistry.class);
 
     /**
      * One flattened {@code fleet:} entry.
@@ -125,6 +130,12 @@ public final class MemberRegistry {
         return e == null ? null : e.role();
     }
 
+    /** The unqualified configured name for a slot, or {@code null} if it is unknown. */
+    public String nameForSlot(String slotName) {
+        Entry e = slots.get(slotName);
+        return e == null ? null : e.name();
+    }
+
     /** True when {@code slotName} is a configured architect slot. */
     public boolean isSlot(String slotName) {
         return slots.containsKey(slotName);
@@ -189,4 +200,33 @@ public final class MemberRegistry {
             return true;
         }
     }
+
+    /**
+     * Bind only architect sessions to a free slot with the resolved profile.
+     *
+     * <p>The role check is lifecycle policy. {@link CallerResolver} repeats it when resolving a
+     * binding, so a later lifecycle regression cannot turn a worker into an architect.
+     */
+    @Override
+    public void acquired(MemberRole role, String profile, String terminal) {
+        if (role != MemberRole.ARCHITECT || terminal == null || terminal.isBlank()) {
+            return;
+        }
+        // slotsFor preserves definition order, so duplicate-profile slots use the first free one.
+        for (Entry entry : slotsFor(MemberRole.ARCHITECT).values()) {
+            if (Objects.equals(profile, entry.profile()) && bind(entry.key(), terminal)) {
+                return;
+            }
+        }
+        log.info("member slot: no free architect slot for profile={}; session remains a worker", profile);
+    }
+
+    /** Unbind a released terminal using the compare-safe registry operation. */
+    @Override
+    public void released(String terminal) {
+        String slot = slotForTerminal(terminal);
+        if (slot != null) {
+            unbind(slot, terminal);
+        }
+    }
 }

bridged/src/main/java/dev/ltms/bridged/config/BridgedConfig.java

@@ -210,8 +210,14 @@ public record BridgedConfig(
             // worker the primary's IDE servers, which are bound to the primary's checkout — so its
             // navigation returned paths outside its own worktree. GitWorktrees now neutralizes that
             // file instead; a worker's tools are whatever its launcher mounts.
+            // .claude/settings.local.json is the sibling that was left behind: it pre-approves tools
+            // (mcp__context7__*, mcp__jetbrains, mcp__intellij-index, Workflow(code-review)) a worker
+            // must never hold, and enables MCP servers by name. Its grants are currently INERT because
+            // GitWorktrees.isolateToolSurface strips every worktree's server map to empty — the named
+            // servers do not exist there to be enabled. This is defence in depth, not a live fix: the
+            // worker stays isolated only because this separate mechanism already removes the servers.
             parityOverlay = (parityOverlay == null || parityOverlay.isEmpty())
-                    ? List.of(".claude/settings.local.json", ".env", ".envrc")
+                    ? List.of(".env", ".envrc")
                     : List.copyOf(parityOverlay);
             // gitTokenEnv stays null when unset (opt-in). gitHostEnv defaults so operators enabling
             // checkpoints need only set gitTokenEnv; it is injected only alongside a resolved token.

bridged/src/main/java/dev/ltms/bridged/session/GitWorktrees.java

@@ -35,10 +35,17 @@ public final class GitWorktrees implements Worktrees {
     /** What {@link #isolateToolSurface} writes for {@code .mcp.json}: a valid, explicitly empty server map. */
     private static final String NEUTRAL_MCP_CONFIG = "{\n  \"mcpServers\": {}\n}\n";
 
-    /** OpenCode's repo-level config. Tracked here, so it lands in every worktree; it carries
-     *  {@code {file:.secrets/...}} references to gitignored secrets that never reach a worktree, and
-     *  opencode refuses to start on a dangling reference — so it is neutralized and the worker gets
-     *  only the config its launcher writes via {@code OPENCODE_CONFIG}. */
+    /** OpenCode's repo-level config. Tracked here, so it lands in every worktree, and it mounts the
+     *  primary's gitea and context7 servers with the primary's credentials. Neutralized so the worker
+     *  gets only the config its launcher writes via {@code OPENCODE_CONFIG}.
+     *
+     *  <p>The reason has changed shape and is now stronger. It used to be a crash: the file carried
+     *  {@code {file:.secrets/...}} references to gitignored files that never reached a worktree, and
+     *  opencode refuses to start on a dangling reference (CB-543). Those credentials now live in one
+     *  shell-level store and the file reads them as {@code {env:...}}, so in a worktree the reference
+     *  resolves instead of failing. That is worse, not better: a member would silently inherit the
+     *  primary's admin-scoped {@code GITEA_ACCESS_TOKEN}. A loud crash became a quiet privilege leak,
+     *  so this entry protects a boundary now rather than papering over a startup error. */
     private static final String OPENCODE_CONFIG = "opencode.json";
 
     /** What {@link #isolateToolSurface} writes for {@code opencode.json}: a valid, empty JSON object. */
@@ -112,8 +119,8 @@ public final class GitWorktrees implements Worktrees {
      * paths outside its own worktree. That is not hypothetical: a CB-523 worker made all 59 of its
      * edits in the primary checkout while compiling its worktree, so every build it ran was of code
      * that did not contain its changes. {@code opencode.json} is the same trap one tool over — tracked,
-     * so it lands in every worktree, referencing gitignored {@code .secrets/} files that never do, and
-     * opencode refuses to start on the dangling reference. {@code .autoenv} extends the principle to a
+     * so it lands in every worktree, and it mounts gitea and context7 with the primary's own
+     * credentials, which a member must never hold. {@code .autoenv} extends the principle to a
      * config that is not tracked today: autoenv authorizes by path, so a fresh worktree path is always
      * unauthorized and its interactive prompt would block every spawn, so re-landing one must be safe.
      *

bridged/src/main/java/dev/ltms/bridged/session/SessionManager.java

@@ -1,5 +1,6 @@
 package dev.ltms.bridged.session;
 
+import dev.ltms.bridged.auth.MemberLifecycle;
 import dev.ltms.bridged.herdr.Agent;
 import dev.ltms.bridged.inject.TurnListener;
 import dev.ltms.bridged.inject.MemberPresence;
@@ -49,6 +50,7 @@ public final class SessionManager implements TurnListener {
     private final LongSupplier nowNanos;
     private final int contextCap;
     private final boolean clearAfterTurn;
+    private volatile MemberLifecycle memberLifecycle = MemberLifecycle.NONE;
 
     /** CB-520: notified with a terminalId on every acquire; no-op until wired. */
     private final List<Consumer<String>> acquireListeners = new java.util.concurrent.CopyOnWriteArrayList<>();
@@ -157,6 +159,7 @@ public final class SessionManager implements TurnListener {
                     null,
                     null);
             registry.put(handle.id(), session);
+            memberLifecycle.acquired(session.role(), session.profile(), session.terminalId());
             log.debug("acquired session id={} terminal={} profile={} owner={}",
                     handle.id(), handle.terminalId(), session.profile(), session.ownerTerminal());
             notifyAcquired(session.terminalId());
@@ -187,6 +190,7 @@ public final class SessionManager implements TurnListener {
         MemberSession removed = registry.remove(paneId);
         boolean preserveWorktree = cause == ReleaseCause.SHUTDOWN;
         if (removed != null) {
+            memberLifecycle.released(removed.terminalId());
             log.debug("releasing session pane={} terminal={} state={} cause={}",
                     removed.paneId(), removed.terminalId(), removed.state(), cause);
             if (preserveWorktree && removed.worktree() != null) {
@@ -257,6 +261,11 @@ public final class SessionManager implements TurnListener {
         }
     }
 
+    /** Inject the optional member-slot lifecycle after construction without changing constructors. */
+    public void setMemberLifecycle(MemberLifecycle memberLifecycle) {
+        this.memberLifecycle = memberLifecycle == null ? MemberLifecycle.NONE : memberLifecycle;
+    }
+
     /** A listener failure must never prevent the acquisition it is reacting to. */
     private void notifyAcquired(String terminalId) {
         if (terminalId == null) {
@@ -330,6 +339,7 @@ public final class SessionManager implements TurnListener {
                 path,
                 branch);
         registry.put(handle.id(), session);
+        memberLifecycle.acquired(session.role(), session.profile(), session.terminalId());
         log.debug("acquired worktree session id={} terminal={} profile={} branch={} path={}",
                 handle.id(), handle.terminalId(), session.profile(), session.branch(), session.worktree());
         notifyAcquired(session.terminalId());

bridged/src/test/java/dev/ltms/bridged/auth/CallerResolverTest.java

@@ -3,6 +3,8 @@ package dev.ltms.bridged.auth;
 import dev.ltms.bridged.herdr.FakeHerdr;
 import dev.ltms.bridged.herdr.PaneLocator;
 import dev.ltms.bridged.mcp.ConnectionIdentity;
+import dev.ltms.bridged.config.BridgedConfig;
+import dev.ltms.bridged.peer.MemberRole;
 import org.junit.jupiter.api.Test;
 
 import java.util.Map;
@@ -32,6 +34,17 @@ class CallerResolverTest {
         return identity(999_999);
     }
 
+    private static MemberRegistry boundMembers(String slot, MemberRole role) {
+        Map<String, BridgedConfig.Slot> architects = role == MemberRole.ARCHITECT
+                ? Map.of("lead-designer", new BridgedConfig.Slot("sonnet")) : Map.of();
+        Map<String, BridgedConfig.Slot> devs = role == MemberRole.DEV
+                ? Map.of("builder", new BridgedConfig.Slot("sonnet")) : Map.of();
+        MemberRegistry members = new MemberRegistry(
+                new BridgedConfig.Fleet(Map.of(), architects, devs, Map.of(), null));
+        assertTrue(members.bind(slot, "term_a"));
+        return members;
+    }
+
     @Test
     void aLoopbackWorkerPaneResolvesToWorkerRegardlessOfAuthMode() {
         Principal underTrust = new CallerResolver(workerIdentity()).resolve("127.0.0.1", 42, null);
@@ -302,8 +315,9 @@ class CallerResolverTest {
 
     @Test
     void aBoundArchitectPaneResolvesToArchitectBeforeTheWorkerFallback() {
+        // This is the production construction path used by Bridged.
         Principal p = CallerResolver.withLeadsAndMembers(workerIdentity(), false, null,
-                Map::of, () -> Map.of("term_a", "lead-designer"))
+                Map::of, boundMembers("architect:lead-designer", MemberRole.ARCHITECT))
                 .resolve("127.0.0.1", 42, null);
 
         assertEquals(Role.ARCHITECT, p.role(),
@@ -316,7 +330,7 @@ class CallerResolverTest {
     @Test
     void anArchitectNeedsNoTokenEvenInTokenMode() {
         Principal p = CallerResolver.withLeadsAndMembers(workerIdentity(), true, "s3cret",
-                Map::of, () -> Map.of("term_a", "lead-designer"))
+                Map::of, boundMembers("architect:lead-designer", MemberRole.ARCHITECT))
                 .resolve("127.0.0.1", 42, null);
 
         assertEquals(Role.ARCHITECT, p.role(),
@@ -325,9 +339,10 @@ class CallerResolverTest {
 
     @Test
     void anUnboundPaneStillResolvesAsAWorker() {
-        Map<String, String> arch = Map.of("term_elsewhere", "reviewer");
+        MemberRegistry members = new MemberRegistry(new BridgedConfig.Fleet(Map.of(),
+                Map.of("lead-designer", new BridgedConfig.Slot("sonnet")), Map.of(), Map.of(), null));
         Principal p = CallerResolver.withLeadsAndMembers(workerIdentity(), false, null,
-                Map::of, () -> arch).resolve("127.0.0.1", 42, null);
+                Map::of, members).resolve("127.0.0.1", 42, null);
 
         assertEquals(Role.WORKER, p.role());
         assertNull(p.name());
@@ -337,7 +352,8 @@ class CallerResolverTest {
     @Test
     void aLeadWinsOverAnArchitectBindingForTheSamePane() {
         Principal p = CallerResolver.withLeadsAndMembers(workerIdentity(), false, null,
-                () -> Map.of("term_a", "opus-5.0"), () -> Map.of("term_a", "lead-designer"))
+                () -> Map.of("term_a", "opus-5.0"),
+                boundMembers("architect:lead-designer", MemberRole.ARCHITECT))
                 .resolve("127.0.0.1", 42, null);
 
         assertEquals(Role.PRIMARY, p.role(),
@@ -349,26 +365,17 @@ class CallerResolverTest {
     /** The registry is live, like leads: a binding injected after construction is honoured. */
     @Test
     void anArchitectBoundAfterConstructionIsHonouredWithoutRebuildingTheResolver() {
-        Map<String, String> live = new java.util.HashMap<>();
+        MemberRegistry members = new MemberRegistry(new BridgedConfig.Fleet(Map.of(),
+                Map.of("lead-designer", new BridgedConfig.Slot("sonnet")), Map.of(), Map.of(), null));
         CallerResolver r = CallerResolver.withLeadsAndMembers(workerIdentity(), false, null,
-                Map::of, () -> live);
+                Map::of, members);
 
         assertEquals(Role.WORKER, r.resolve("127.0.0.1", 42, null).role());
 
-        live.put("term_a", "lead-designer"); // the later lifecycle binds the slot
+        assertTrue(members.bind("architect:lead-designer", "term_a")); // the later lifecycle binds the slot
 
         assertEquals(Role.ARCHITECT, r.resolve("127.0.0.1", 42, null).role());
-        assertEquals("lead-designer", r.members().get("term_a"));
-    }
-
-    @Test
-    void theArchitectMapFormIsCopiedSoLaterMutationCannotGrantArchitect() {
-        Map<String, String> mutable = new java.util.LinkedHashMap<>();
-        CallerResolver r = new CallerResolver(workerIdentity(), false, null, Map.of(), mutable);
-
-        mutable.put("term_a", "sneaky");
-
-        assertEquals(Role.WORKER, r.resolve("127.0.0.1", 42, null).role());
+        assertEquals("architect:lead-designer", r.members().get("term_a"));
     }
 
     @Test
@@ -381,7 +388,8 @@ class CallerResolverTest {
     @Test
     void anArchitectOwnsItsOwnPaneAndNoOther() {
         Principal arch = CallerResolver.withLeadsAndMembers(workerIdentity(), false, null,
-                Map::of, () -> Map.of("term_a", "lead-designer")).resolve("127.0.0.1", 42, null);
+                Map::of, boundMembers("architect:lead-designer", MemberRole.ARCHITECT))
+                .resolve("127.0.0.1", 42, null);
 
         assertTrue(arch.ownsSession("term_a"));
         assertTrue(Authz.permits(arch, Authz.Action.REPLY, "term_a"));
@@ -389,6 +397,15 @@ class CallerResolverTest {
         assertFalse(Authz.permits(arch, Authz.Action.REPLY, "term_b"));
     }
 
+    @Test
+    void aBoundNonArchitectSlotStillResolvesAsAWorker() {
+        Principal p = CallerResolver.withLeadsAndMembers(workerIdentity(), false, null,
+                Map::of, boundMembers("dev:builder", MemberRole.DEV))
+                .resolve("127.0.0.1", 42, null);
+
+        assertEquals(Role.WORKER, p.role(), "a dev binding must never grant architect rights");
+    }
+
     @Test
     void tokenModeRequiresANonEmptyConfiguredToken() {
         ConnectionIdentity id = nonWorkerIdentity();

bridged/src/test/java/dev/ltms/bridged/config/BridgedConfigTest.java

@@ -1167,6 +1167,41 @@ class BridgedConfigTest {
                 "a profile without the key stays off-subscription (the default)");
     }
 
+    @Test
+    void parityOverlayDefaultsToEnvFilesOnly(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("no-overlay.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  gx10:
+                    baseUrl: http://gx10.gw:8000
+                """);
+
+        BridgedConfig cfg = BridgedConfig.load(f);
+        assertEquals(List.of(".env", ".envrc"),
+                cfg.profiles().get("gx10").parityOverlay(),
+                "the default parity overlay is the env files; settings.local.json is no longer copied by default");
+    }
+
+    @Test
+    void parityOverlayExplicitListIsPreservedVerbatim(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("explicit-overlay.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  gx10:
+                    baseUrl: http://gx10.gw:8000
+                    parityOverlay: [".claude/settings.local.json", ".env"]
+                """);
+
+        BridgedConfig cfg = BridgedConfig.load(f);
+        assertEquals(List.of(".claude/settings.local.json", ".env"),
+                cfg.profiles().get("gx10").parityOverlay(),
+                "an operator's explicit list survives verbatim — the default only changes when unset");
+    }
+
     // ── CB-542: subscription:true must not smuggle an unguarded endpoint via env: ───────────────
 
     @Test

bridged/src/test/java/dev/ltms/bridged/mcp/BridgeMcpAuthzTest.java

@@ -2,6 +2,7 @@ package dev.ltms.bridged.mcp;
 
 import dev.ltms.bridged.auth.Authz;
 import dev.ltms.bridged.auth.CallerResolver;
+import dev.ltms.bridged.auth.MemberRegistry;
 import dev.ltms.bridged.auth.Principal;
 import dev.ltms.bridged.auth.Role;
 import dev.ltms.bridged.config.BridgedConfig;
@@ -69,7 +70,8 @@ class BridgeMcpAuthzTest {
 
         mcp = new BridgeMcp(messages, workers, sessions, identity, sessions.asPresence(),
                 new PrimaryRegistry(null),
-                enforce ? new CallerResolver(identity) : null,
+                enforce ? CallerResolver.withLeadsAndMembers(identity, false, null,
+                Map::of, new MemberRegistry(null)) : null,
                 metrics);
         return mcp;
     }

bridged/src/test/java/dev/ltms/bridged/rest/BridgedAppAuthTest.java

@@ -1,6 +1,7 @@
 package dev.ltms.bridged.rest;
 
 import dev.ltms.bridged.auth.CallerResolver;
+import dev.ltms.bridged.auth.MemberRegistry;
 import dev.ltms.bridged.config.BridgedConfig;
 import dev.ltms.bridged.guard.SubscriptionGuard;
 import dev.ltms.bridged.herdr.AgentControl;
@@ -65,9 +66,8 @@ class BridgedAppAuthTest {
         MessageService messages = new MessageService(agents, injector, new Rendezvous());
 
         ConnectionIdentity identity = new ConnectionIdentity(new PaneLocator(herdr), _ -> pid);
-        CallerResolver callers = tokenMode
-                ? new CallerResolver(identity, true, token)
-                : new CallerResolver(identity);
+        CallerResolver callers = CallerResolver.withLeadsAndMembers(identity, tokenMode, token,
+                Map::of, new MemberRegistry(null));
         metrics = BridgedMetrics.create(sessions, new dev.ltms.bridged.msg.InMemoryReplyInbox());
 
         app = new BridgedApp(herdr, workers, sessions, messages, sessions.asPresence(), null,

bridged/src/test/java/dev/ltms/bridged/session/WorktreeSessionManagerTest.java

@@ -1,11 +1,13 @@
 package dev.ltms.bridged.session;
 
+import dev.ltms.bridged.auth.MemberRegistry;
 import dev.ltms.bridged.config.BridgedConfig;
 import dev.ltms.bridged.guard.SubscriptionGuard;
 import dev.ltms.bridged.herdr.AgentControl;
 import dev.ltms.bridged.herdr.FakeHerdr;
 import dev.ltms.bridged.herdr.WorkspaceControl;
 import dev.ltms.bridged.member.ClaudeCodeLauncher;
+import dev.ltms.bridged.peer.MemberRole;
 import org.junit.jupiter.api.Test;
 
 import java.util.List;
@@ -22,6 +24,13 @@ import static org.junit.jupiter.api.Assertions.*;
  */
 class WorktreeSessionManagerTest {
 
+    private static MemberRegistry members() {
+        return new MemberRegistry(new BridgedConfig.Fleet(Map.of(),
+                Map.of("architect", new BridgedConfig.Slot("ltms-local")),
+                Map.of("dev", new BridgedConfig.Slot("ltms-local")),
+                Map.of("reviewer", new BridgedConfig.Slot("ltms-local")), null));
+    }
+
     private static ClaudeCodeLauncher workerService(FakeHerdr herdr) {
         BridgedConfig.Profile cfg = new BridgedConfig.Profile(
                 "ltms-local", "http://gx00.gw:8000", "coder", null, "BRIDGED_WORKER_TOKEN",
@@ -56,6 +65,36 @@ class WorktreeSessionManagerTest {
         assertEquals("/caller/proj", startCwd(herdr), "spawn receives the caller's cwd");
     }
 
+    @Test
+    void onlyArchitectsBindAndReleaseMakesTheirSlotReusable() {
+        FakeHerdr herdr = new FakeHerdr();
+        MemberRegistry members = members();
+        SessionManager sessions = new SessionManager(workerService(herdr), new FakeWorktrees());
+        sessions.setMemberLifecycle(members);
+
+        MemberSession architect = sessions.acquire("ltms-local", MemberRole.ARCHITECT,
+                null, "/caller/proj", null, null);
+        MemberSession dev = sessions.acquire("ltms-local", MemberRole.DEV,
+                null, "/caller/proj", null, null);
+        MemberSession reviewer = sessions.acquire("ltms-local", MemberRole.REVIEWER,
+                null, "/caller/proj", null, null);
+
+        assertEquals("architect:architect", members.slotForTerminal(architect.terminalId()));
+        assertNull(members.slotForTerminal(dev.terminalId()), "a dev must never receive architect rights");
+        assertNull(members.slotForTerminal(reviewer.terminalId()),
+                "a reviewer must never receive architect rights");
+
+        sessions.release(architect.paneId());
+        MemberSession replacement = sessions.acquire("ltms-local", MemberRole.ARCHITECT,
+                null, "/caller/proj", null, null);
+        assertEquals("architect:architect", members.slotForTerminal(replacement.terminalId()));
+
+        MemberSession overflow = sessions.acquire("ltms-local", MemberRole.ARCHITECT,
+                null, "/caller/proj", null, null);
+        assertNull(members.slotForTerminal(overflow.terminalId()),
+                "a full slot pool must not stop the architect spawn");
+    }
+
     @Test
     void worktreeAcquireProvisionsAndRecordsPathAndBranch() {
         FakeHerdr herdr = new FakeHerdr();
@@ -79,6 +118,19 @@ class WorktreeSessionManagerTest {
         assertEquals(expectedPath, s.cwd(), "session cwd is the worktree path");
     }
 
+    @Test
+    void worktreeArchitectAcquireAlsoBindsItsSlot() {
+        FakeHerdr herdr = new FakeHerdr();
+        MemberRegistry members = members();
+        SessionManager sessions = new SessionManager(workerService(herdr), new FakeWorktrees());
+        sessions.setMemberLifecycle(members);
+
+        MemberSession architect = sessions.acquire("ltms-local", MemberRole.ARCHITECT,
+                null, "/caller/proj", null, new WorktreeRequest("cb-548", null));
+
+        assertEquals("architect:architect", members.slotForTerminal(architect.terminalId()));
+    }
+
     @Test
     void worktreeAcquireRunsParityOverlayWithProfileDefaults() {
         FakeHerdr herdr = new FakeHerdr();
@@ -94,12 +146,12 @@ class WorktreeSessionManagerTest {
         FakeWorktrees.OverlayCall overlay = worktrees.lastOverlay();
         assertNotNull(overlay);
         assertEquals("/repo", overlay.repoRoot());
-        assertEquals(List.of(".claude/settings.local.json", ".env", ".envrc"),
+        assertEquals(List.of(".env", ".envrc"),
                 overlay.requested(), "default parity overlay is used when unset");
         assertFalse(overlay.requested().contains(".mcp.json"),
                 "CB-525: replicating the primary's MCP config gives a worker the primary's IDE "
                         + "servers, which navigate its edits out of its own worktree");
-        assertEquals(List.of(".claude/settings.local.json", ".envrc"), overlay.copied(),
+        assertEquals(List.of(".envrc"), overlay.copied(),
                 "existing paths are copied; missing paths are skipped");
         assertEquals(List.of(".envrc"), overlay.skipWorktree(),
                 "tracked copied paths are --skip-worktree'd");

opencode.json

@@ -14,7 +14,7 @@
       "url": "https://ct7.ltms.dev/mcp",
       "enabled": true,
       "headers": {
-        "Authorization": "Bearer {file:.secrets/context7-token}"
+        "Authorization": "Bearer {env:CONTEXT7_TOKEN}"
       }
     },
     "gitea": {
@@ -26,8 +26,8 @@
       ],
       "enabled": true,
       "environment": {
-        "GITEA_ACCESS_TOKEN": "{file:.secrets/gitea-token}",
-        "GITEA_HOST": "{file:.secrets/gitea-host}"
+        "GITEA_ACCESS_TOKEN": "{env:GITEA_ACCESS_TOKEN}",
+        "GITEA_HOST": "{env:GITEA_HOST}"
       }
     }
   }