fix(agent): source server-side secrets only from the launchd env file

CLAUDE.md

@@ -158,7 +158,7 @@ in order: `api_key` literal → `api_key_env` → `$DEEPINFRA_API_KEY` →
 | `CONTEXTNEST_RETRIEVE_CANDIDATE_POOL` | unset → `max(20 × top_k, 1000)` | Upper bound on candidates **materialized** into hits. Scoring stays exact over every candidate; only this many get text + metadata pulled from the sidecars. `0` = unbounded (the pre-knob behaviour) — the A/B escape hatch for a global query, which otherwise scores all ~527k active fragments. |
 | `CONTEXTNEST_EMBEDDING_CACHE_MAX_ENTRIES` | 4096 | LRU bound on the embedding response cache (~16 MB at 1024-d). `0` disables it. |
 | `CONTEXTNEST_VECTOR_ARENA_DIR` | unset (heap) | Put the operator's vector arena in a file-backed mapping under this dir (derived state, unlinked at boot). Use a volume with free space. |
-| `CONTEXTNEST_VOLUME_WATCH` | on | `0` disables the data-volume watchdog. Exits 75 after ~15 s if the data directory's `st_dev`/`st_ino` change (a USB detach + remount revokes every fd and never recovers). See `docs/architecture-honest.md` → "Data-volume resilience". |
+| `CONTEXTNEST_VOLUME_WATCH` | on | `0` disables the data-volume watchdog. Exits 75 after ~15 s if the data directory's `st_dev`/`st_ino` change **or** a write through the sentinel descriptor opened at arm time fails (a detach that remounts on the same device number leaves `st_dev` unchanged but revokes every fd, and neither recovers in-process). See `docs/architecture-honest.md` → "Data-volume resilience". |
 | `CONTEXTNEST_MIN_FREE_MB` | 5120 | Free-space floor on the data volume; below it the process refuses to boot (exit 74). `0` disables. |
 
 Full list in `docs/architecture-honest.md`.

Makefile

@@ -193,7 +193,15 @@ CN_AGENT_LOG      ?= /tmp/contextnest-agent.log
 # DEEPINFRA_API_KEY / OPENAI_API_KEY must live for the agent to embed. launchd
 # jobs inherit no interactive-shell environment, so a key exported in ~/.zshrc
 # will NOT reach the agent.
-CN_AGENT_ENV_FILE ?= $(HOME)/.contextnest/tenant-auth/server.env
+#
+# SERVER-SIDE secrets only. Do not point this at a file that also carries client
+# credentials: `CONTEXTNEST_TENANTS_FILE` alone flips the API into auth-enforced
+# mode, and every client that does not present `Authorization` — the contextnest
+# MCP server, the dashboard, the curl recipes in docs/usage.md — starts getting
+# `401 unauthorized scope` while the process otherwise looks healthy. The
+# operator's `server.env` is a client file (it also holds OPERATOR_HEADERS and
+# LIBWIT_TOKEN); the agent gets the embedding keys from `agent.env` instead.
+CN_AGENT_ENV_FILE ?= $(HOME)/.contextnest/tenant-auth/agent.env
 # Absolutised at render time: a launchd job starts with cwd `/`.
 CN_AGENT_BIN     ?= $(abspath $(CN_BIN))
 CN_AGENT_WORKDIR ?= $(abspath .)

deploy/ai.sourceshift.contextnest.plist.in

@@ -7,8 +7,14 @@
   ~/Library/LaunchAgents/<label>.plist with the absolute paths of the current
   checkout, then bootstraps it. This file holds no secrets: the program is a
   non-login shell that sources <envfile> (mode 600, operator-owned) before
-  exec'ing the binary, so the embedding and tenant credentials never enter this
-  file, the rendered plist, or the repo.
+  exec'ing the binary, so the embedding credentials never enter this file, the
+  rendered plist, or the repo.
+
+  <envfile> must hold SERVER-SIDE secrets only. `CONTEXTNEST_TENANTS_FILE` in
+  that file turns the API auth-enforced, and clients that do not present
+  `Authorization` (the contextnest MCP server, the dashboard, the curl recipes)
+  then fail with `401 unauthorized scope` against a process that otherwise
+  looks healthy. Keep client tokens in a separate file.
 
   KeepAlive is `SuccessfulExit=false`: the job restarts when the substrate exits
   *non-zero*, which is exactly what the data-volume watchdog (75) and the