tenurehq · jeffreyflynt · Jul 7, 2026 · Jul 7, 2026 · Jul 7, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -6,6 +6,48 @@ Versioning follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ---
 
+## [1.0.30] - 2026-07-07
+
+### Added
+
+- **Typed access token system for clients and agents** (`src/auth/tokenService.ts`, `src/routes/tokens.ts`, `src/types/token.ts`, `src/db/collections.ts`, `src/db/indexes.ts`, `src/server.ts`): Introduced token kinds for `root`, `client`, and `agent`, with capability-based authorization, per-token metadata, optional project scope restrictions, revocation support, and persisted token hashing. Admin APIs now support generating and managing client and agent tokens, and request handling now attaches token identity and capability context across the app.
+
+- **Token management UI in admin dashboard** (`src/routes/admin-ui.ts`): Added Access Tokens management to the admin UI with separate flows for client and agent tokens, capability selection, optional project scope restriction, optional expiry, one-time token display, copy support, and revocation actions.
+
+- **Project-scope token enforcement helpers** (`src/server.ts`, `src/helpers/scopeAccess.ts`, `src/routes/beliefs.ts`, `src/routes/chat.ts`, `src/routes/messages.ts`, `src/routes/beliefs-ws.ts`): Added helpers that validate requested project scopes against token-authorized scopes and applied them across chat, messages, beliefs APIs, import flows, and belief WebSocket operations.
+
+- **Token attribution in audit and extraction flows** (`src/audit/injectionAuditLogger.ts`, `src/types/injectionAudit.ts`, `src/types/job.ts`, `src/jobs/queue.ts`, `src/routes/shared/sideEffects.ts`, `src/extraction/beliefWriter.ts`): Added token ID, token name, and token kind to injection audit records, extraction jobs, and persisted beliefs so downstream actions can be traced back to the calling integration token.
+
+### Changed
+
+- **Authentication model shifted from bearer/PATs and team auth to access-token governance** (`src/server.ts`, `src/routes/admin.ts`, `src/config/runtime.ts`, `src/config/appConfig.ts`): Replaced the prior root token plus PAT flow with token-service validation and capability checks. Root-token-only admin access is now enforced centrally, while non-root tokens are limited by route type and declared capabilities.
+
+- **Bootstrap token behavior and docs updated** (`docs/quickstart.md`, `docs/clients.md`, `docs/clients/open-webui.md`, `docs/clients/vscode.md`, `docs/settings.md`, `README.md`): Documentation now distinguishes bootstrap tokens from client and agent tokens. External clients and IDEs must use client tokens generated from the Tenure UI, while bootstrap tokens are reserved for setup and admin access.
+
+- **Credential and config storage hardened** (`src/config/encryption.ts`, `src/config/appConfig.ts`, `src/app.ts`): API tokens are now stored encrypted in config, token files are written in encrypted form, and belief encryption keys are derived from `master.key` when no legacy `belief.key` file exists.
+
+- **Context assembly simplified** (`src/context/contextBuilder.ts`, `src/context/systemPromptBuilder.ts`, `src/context/beliefsReader.ts`): Removed org summary and team belief injection paths from context building and system prompt construction, leaving persona, pinned facts, relevant beliefs, and open questions as the primary injected memory surfaces.
+
+- **IDE and sidecar scope behavior tightened** (`src/extraction/worker.ts`, `src/sidecar/idePrompt.ts`, `src/sidecar/prompt.ts`, `src/helpers/scopeDetector.ts`): Scope generation is now more restrictive, project scopes are enforced from resolved workspace context, and sidecar guidance no longer permits inventing new scope labels in these flows.
+
+- **Belief and runtime schemas simplified** (`src/types/belief.ts`, `src/config/runtime.ts`, `src/backup/types.ts`): Removed team/org visibility fields, compaction note persistence, memory mode settings, managed history token cap, and several team-specific runtime fields from active schemas and export/import payloads.
+
+### Removed
+
+- **Team and SCIM administration surfaces** (`src/routes/scim.ts`, `src/routes/team-admin-ui.ts`, `src/routes/admin-setup.ts`, `src/config/teamResolution.ts`): Removed SCIM routes, team admin UI, admin setup wizard, team resolution config, and associated team membership and SCIM collection/index handling.
+
+- **Telemetry dependencies and bootstrap** (`src/telemetry.ts`, `package.json`, `package-lock.json`, `src/index.ts`): Removed OpenTelemetry startup and related dependency tree from the application package set.
+
+- **Enterprise and teams documentation set** (`docs/teams/auth-guide.md`, `docs/teams/backup.md`, `docs/teams/deployment.md`, `docs/teams/idp-integration.md`, `docs/teams/observability.md`, `docs/roadmap.md`): Deleted the dedicated teams, SCIM, backup, IdP integration, observability, and roadmap docs from the repository.
+
+### Fixed
+
+- **Belief encryption verification target** (`src/app.ts`): Updated encryption verification to inspect stored ciphertext in the `beliefs` collection instead of a temporary check collection, making the verification path match real storage behavior.
+
+- **Import and backup compatibility with the new data model** (`src/backup/exporter.ts`, `src/backup/importer.ts`, `src/backup/types.ts`, `src/routes/backup.ts`): Removed compaction-log export/import handling and aligned exported runtime and belief fields with the simplified schema.
+
+---
+
 ## [1.0.29] - 2026-07-01
 
 ### Changed

diff --git a/README.md b/README.md
@@ -1,11 +1,13 @@
 # Tenure
 
-**Shared memory for AI tools, with scope, provenance, and auditability.**
+**Shared memory and governance for AI clients and agents, with scope, provenance, auditability, and access control.**
 
-Tenure gives your AI tools one governed memory layer across VS Code, Open WebUI, and other AI tools and clients.
+Tenure gives your AI clients and agents one governed memory layer between them and the upstream model.
 
 It remembers durable project decisions like architecture choices, coding conventions, database preferences, and team rules, then injects only the relevant scoped state into each request.
 
+As more clients and agents route through Tenure, it becomes the shared memory system and governance layer for AI across your tools, teams, and environments.
+
 No more re-explaining the same repo decisions.
 No more stale context from another project.
 No more guessing why the model used a piece of memory.
@@ -22,7 +24,7 @@ Claude Code may learn something in one session. VS Code does not know it. Cursor
 
 Tenure fixes that by making memory explicit, scoped, and inspectable.
 
-Use Tenure when AI needs durable context across tools, sessions, and teams:
+Use Tenure when AI needs durable context, enforced boundaries, and a shared control layer across tools, sessions, clients, agents, and teams:
 
 - Decisions: what was chosen, rejected, or replaced
 - Preferences: how a person, team, or organization works

diff --git a/docs/clients.md b/docs/clients.md
@@ -1,6 +1,6 @@
 # Client Setup
 
-Tenure works with any OpenAI-compatible client. Point it at `http://localhost:5757/v1` with your bearer token and it routes through Tenure automatically.
+Tenure works with any OpenAI-compatible or Anthorpic client. Point it at `http://localhost:5757/v1` with the appropriate Tenure access token and it routes through Tenure automatically.
 
 > **Docker networking note:** If your client runs in Docker, `localhost` won't resolve to your host machine. Use `http://host.docker.internal:5757/v1` instead (Docker Desktop on Mac/Windows) or your host's LAN IP on Linux.
 
@@ -14,7 +14,7 @@ Chat interfaces are where Tenure does its best work. Brainstorming, deciding, re
 | [LibreChat](clients/librechat.md)   | Point and shoot | Coming soon |
 | [Onyx](clients/onyx.md)             | Point and shoot | Coming soon |
 
-**Point and shoot setup:** In your client's API settings, set the base URL to `http://localhost:5757/v1` and paste your bearer token. Select any model and start chatting.
+**Point and shoot setup:** In your client's API settings, set the base URL to `http://localhost:5757/v1` and paste a **client token** generated from the Tenure UI. Select any model and start chatting.
 
 ## IDE
 
@@ -31,11 +31,15 @@ The [VS Code extension](clients/vscode.md) adds real-time workspace scope resolu
 | [Continue](clients/continue.md)       | Native extension | Supported   |
 | [Claude Code](clients/claude-code.md) | Point and shoot  | Coming soon |
 
-**Point and shoot setup:** In your IDE's AI settings, replace the base URL with `http://localhost:5757/v1` and add your bearer token.
+**Point and shoot setup:** In your IDE's AI settings, replace the base URL with `http://localhost:5757/v1` and add a **client token** generated from the Tenure UI.
+
+> The bootstrap token created on first install is for setup and admin access. External clients and IDEs need to use a client token created from the Tenure UI.
 
 ## Agents
 
-Agent integrations run Tenure as a plugin inside the agent framework itself, with automatic per-agent memory isolation. Memory written in one agent never surfaces in another.
+Agent integrations run through Tenure with automatic per-agent memory isolation. Memory written in one agent never surfaces in another unless you explicitly design for shared scope.
+
+This model applies to any agent framework that routes through Tenure. Some integrations are native plugins, while others can connect over Tenure's supported API surfaces.
 
 | Client                          | Integration   | Status    |
 | ------------------------------- | ------------- | --------- |

diff --git a/docs/clients/open-webui.md b/docs/clients/open-webui.md
@@ -16,7 +16,7 @@ This is not RAG over your chat history. Tenure extracts structured beliefs from
 
 ## Setup
 
-**Prerequisites:** Tenure running locally. If you haven't installed it yet, see [quickstart.md](quickstart.md). Your bearer token is in `~/.tenure/token` (Linux/macOS) or `%USERPROFILE%\.tenure\token` (Windows), or printed at the end of installation.
+**Prerequisites:** Tenure running locally. If you haven't installed it yet, see [quickstart.md](quickstart.md). Before connecting Open WebUI, generate a client token from the Tenure UI.
 
 **In Open WebUI:**
 
@@ -25,7 +25,7 @@ This is not RAG over your chat history. Tenure extracts structured beliefs from
    ```
    http://localhost:5757/v1
    ```
-3. Set the API key to your Tenure bearer token
+3. Set the API key to a Tenure client token generated from the UI
 4. Save and reload the model list
 
 Open WebUI will now show all models from your configured upstream provider, routed through Tenure.

diff --git a/docs/clients/vscode.md b/docs/clients/vscode.md
@@ -9,18 +9,18 @@ The extension also synchronizes workspace state with your Tenure server on every
 ## Requirements
 
 - **Local mode:** Docker Desktop (the extension can install Tenure automatically)
-- **Enterprise mode:** A running Tenure server and a valid API token
+- **Enterprise mode:** A running Tenure server and a valid client token generated from the Tenure UI
 - VS Code 1.80 or later
 - A workspace folder open. The extension does not activate in single-file mode.
 
 ## First-time setup
 
 The first time you activate the extension, it checks the server configured in `tenure.baseUrl`. If nothing is reachable and you have not yet configured a deployment, a **Configure Tenure** picker appears automatically:
 
-| Option                       | What it does                                                                                                                                             |
-| ---------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **Local (Docker)**           | Installs and starts Tenure in a local Docker container. The extension handles the entire setup.                                                          |
-| **Enterprise / Self-hosted** | Prompts for your Tenure server base URL (e.g. `https://tenure.company.com:5757`) and API token, then stores them in VS Code settings and secret storage. |
+| Option                       | What it does                                                                                                                                                  |
+| ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **Local (Docker)**           | Installs and starts Tenure in a local Docker container. The extension handles the entire setup.                                                               |
+| **Enterprise / Self-hosted** | Prompts for your Tenure server base URL (e.g. `https://tenure.company.com:5757`) and a client token, then stores them in VS Code settings and secret storage. |
 
 If you dismissed the picker, you can reopen it at any time via **Tenure: Configure Deployment** in the command palette.
 
@@ -44,13 +44,13 @@ The extension continuously synchronizes workspace state with your Tenure server,
 
 ## Adding your token
 
-If you are connecting to an enterprise server, you are prompted for a token during setup. You can also set or update it manually at any time:
+If you are connecting to an enterprise server, you are prompted for a client token during setup. You can also set or update it manually at any time:
 
 1. Open the command palette (`Ctrl+Shift+P` / `Cmd+Shift+P`)
 2. Run **Tenure: Set API Token**
 3. Paste your token
 
-The token is stored in VS Code's secret storage. You only need to do this once.
+The client token is stored in VS Code's secret storage. You only need to do this once.
 
 If no token is configured, the extension shows a warning on startup and the status bar displays **Tenure: Token Missing**. Clicking it opens the token prompt.
 
@@ -110,7 +110,7 @@ Clicking the status bar item when synced opens your Beliefs Dashboard at your co
 | Command                                | Description                                       |
 | -------------------------------------- | ------------------------------------------------- |
 | `Tenure: Configure Deployment`         | Choose local Docker install or enterprise server  |
-| `Tenure: Set API Token`                | Store your Tenure bearer token                    |
+| `Tenure: Set API Token`                | Store your Tenure client token                    |
 | `Tenure: Sync Workspace State`         | Trigger a manual sync                             |
 | `Tenure: Open Beliefs Dashboard`       | Open your Tenure dashboard in a browser           |
 | `Tenure: Record Project Belief`        | Record a belief directly from the command palette |

diff --git a/docs/contributing.md b/docs/contributing.md
@@ -1,14 +1,12 @@
 # Contributing to Tenure
 
-Tenure is early and the surface area is intentionally small. The best contributions right now are:
+The best contributions right now are:
 
 - Retrieval gaps documented as failing eval cases
 - Provider compatibility fixes
 - Client setup guides for clients not yet in [docs/clients.md](docs/clients.md)
 - Bug reports with reproduction steps
 
----
-
 ## Design Principles
 
 - **Conservative writes, liberal reads.** When extraction signals disagree, don't write. When assembling context, include generously.
@@ -18,8 +16,6 @@ Tenure is early and the surface area is intentionally small. The best contributi
 - **Extraction never blocks responses.** The worker runs asynchronously; your session is never held waiting for belief writes.
 - **No hardcoded model lists.** `/v1/models` queries upstream providers directly.
 
----
-
 ## Getting Started
 
 ```bash
@@ -37,8 +33,6 @@ npm test                  # unit + integration
 npm run test:eval         # retrieval eval suite (~90s first run)
 ```
 
----
-
 ## How to Contribute a Retrieval Fix
 
 The retrieval eval suite in `src/retrieval/retrieval.cases.json` is the most
@@ -55,8 +49,6 @@ This is the lowest-friction contribution path. A well-described failing case
 is as valuable as a fix because it documents a known blind spot precisely.
 See [docs/retrieval-eval.md](docs/retrieval-eval.md) for how the suite works.
 
----
-
 ## Areas That Need Help
 
 | Area                      | What's needed                                                     |
@@ -69,25 +61,13 @@ See [docs/retrieval-eval.md](docs/retrieval-eval.md) for how the suite works.
 | Direct Anthropic provider | Verify extraction and streaming work correctly                    |
 |                           | with a direct Anthropic API key and report results                |
 
----
-
-## What We're Not Looking For Right Now
-
-- Multi-user support: on the roadmap but the architecture needs to land first
-- Alternative storage backends: MongoDB Atlas Local is load-bearing
-- UI framework rewrites: the current HTML/JS is intentional for the scope
-
----
-
 ## Submitting a PR
 
-- Keep PRs focused — one fix or one feature per PR
+- Keep PRs focused - one fix or one feature per PR
 - If you're changing extraction behavior, include a test case
 - If you're changing retrieval behavior, include an eval case
 - The design principles above are the bar for architectural changes; if a change conflicts with one of them, explain why in the PR description
 
----
-
 ## Questions
 
 Open an issue. If you're unsure whether something is a bug or intended behavior, open an issue before writing code.
diff --git a/docs/quickstart.md b/docs/quickstart.md
@@ -69,11 +69,16 @@ Open `http://localhost:5757/onboarding` in your browser. You will be prompted to
 Onboarding is optional. If you skip it, Tenure builds your world model from chat
 extraction over time.
 
-## 3. Point your client
+## 3. Create access tokens for clients and agents
 
-Set your client's API base URL to `http://localhost:5757/v1` and use your bearer
-token for authentication. The model list is populated from your configured
-providers.
+Open the Tenure UI and generate the token type that matches your integration:
+
+- **Client tokens** for OpenAI-compatible chat clients, IDE clients, and other external tools
+- **Agent tokens** for agent integrations
+
+The first-run bootstrap token is for setup and admin access. It will not work for external clients or agents.
+
+Once you have created the appropriate token, set your client's API base URL to `http://localhost:5757/v1` and use that token for authentication. The model list is populated from your configured providers.
 
 For client-specific instructions, see [clients.md](clients.md).
 

diff --git a/docs/roadmap.md b/docs/roadmap.md
diff --git a/docs/settings.md b/docs/settings.md
@@ -152,11 +152,17 @@ These settings are hidden by default. Most users won't need to change them.
 
 **Strict model tiers**: when enabled, only verified models can be selected as the default. Disable this if you are running a self-hosted or custom model that isn't in the supported list.
 
-## API Token
+## Access Tokens
 
-Your bearer token for authenticating requests to Tenure. This is the token you paste into your client's API settings.
+Tenure uses different token types for different integration paths.
 
-**Rotate token**: generates a new token immediately and invalidates the current one. Your active session will end. Copy the new token before dismissing the confirmation dialog: it is also saved to `~/.tenure/token` (Linux/macOS) or `%USERPROFILE%\.tenure\token` (Windows).
+- **Bootstrap token**: created on first install and used for setup and admin access
+- **Client tokens**: used by chat clients, IDE clients, and other external tools
+- **Agent tokens**: used by agent integrations
+
+Create and revoke client and agent tokens from the Tenure UI. Use the token type that matches the integration you are connecting.
+
+The bootstrap token is not intended for external clients or agents.
 
 ## Maintenance