[amirkhakshour]

Problem

Installing the launchd agent with the default CN_AGENT_ENV_FILE
(~/.contextnest/tenant-auth/server.env) silently changed the API's security
posture. That file contains CONTEXTNEST_TENANTS_FILE, and
Registry::from_env — let Ok(file) = std::env::var(...) else { return Ok(None) }
— turns that into tenant mode: every route now requires Authorization.

Observed live after the agent install: the process booted, armed the watchdog,
restored 543 k fragments, and then answered

GET /api/v1/substrate/health → HTTP 401 {"error":"unauthorized scope"}

to the contextnest MCP server (which sends no auth headers at all), and would
do the same to the dashboard and the docs/usage.md curl recipes.

server.env is a client file: besides the tenant registry it holds
CONTEXTNEST_OPERATOR_HEADERS (a curl --header @file path) and
CONTEXTNEST_LIBWIT_TOKEN. The agent needs exactly one thing from it — the
embedding key.

Change

• CN_AGENT_ENV_FILE now defaults to ~/.contextnest/tenant-auth/agent.env,
  documented as server-side secrets only.
• The plist template says the same, and names the failure mode so a future
  install cannot regress it.
• CLAUDE.md's CONTEXTNEST_VOLUME_WATCH row now describes the sentinel
  descriptor from fix(watchdog): detect a remount that keeps its device number #230, not just st_dev/st_ino.

Operators who want tenant mode can still point CN_AGENT_ENV_FILE at a
tenant-bearing file — but then every client must be taught to present the
operator header first.

Verification

• Live: agent re-installed with agent.env; /api/v1/substrate/health → 200
  without headers; cn_health MCP tool returns the subtree counts again.
• The rendered plist passes plutil -lint.
• No Rust changed; CI runs the usual gates.

🤖 Generated with Claude Code