@agenticprimitives/fabric 0.0.0-alpha.3 → 0.0.0-alpha.30

package/dist/interaction-profile.js

@@ -0,0 +1,212 @@
+// The profile mechanism (spec 340 W4) — what replaces the frozen `MessageKind`/`CaseState` enums.
+//
+// A profile declares what one KIND of interaction permits: its roles, its acts, the context every
+// exchange in it must pin, which acts can create an obligation, and how it ends. A new interaction
+// type is therefore a new profile — data — rather than a new enum member and a schema change. That is
+// the whole extensibility story for anyone outside this repo.
+//
+// A PROFILE PERMITS NOTHING. `checkExchangeAgainstProfile` answers "is this move well-formed FOR THIS
+// KIND of interaction", which is a shape question. Whether the actor was allowed to make it is
+// `delegation` + `entitlements` + `tool-policy`, re-evaluated at the moment of acting (ADR-0041).
+// The two are easy to conflate precisely because both can say no, so: a profile refusal means the
+// record would be uninterpretable; an authority refusal means the party had no right. A profile
+// saying yes has granted nothing.
+//
+// Versioning is the anti-downgrade control (spec 340 §6). `<name>/<semver>`, pinned onto every
+// Exchange, and both halves required — a bare name would make the pin unfalsifiable.
+import { isProfileVersion } from './interaction-record.js';
+/**
+ * Every violation, not the first.
+ *
+ * A caller fixing one at a time needs N round trips to learn the exchange was never valid, and the
+ * usual outcome of that is a caller who stops checking.
+ */
+export function checkExchangeAgainstProfile(profile, exchange) {
+    const violations = [];
+    if (!isProfileVersion(exchange.profileVersion)) {
+        violations.push({ reason: 'malformed-profile-version', value: exchange.profileVersion });
+    }
+    else if (exchange.profileVersion !== profile.profileVersion) {
+        // Not automatically an attack — an interaction whose profile versioned mid-flight legitimately
+        // contains exchanges under both. It IS the signal, and the only thing that disagrees afterwards.
+        violations.push({
+            reason: 'profile-version-mismatch',
+            pinned: exchange.profileVersion,
+            expected: profile.profileVersion,
+        });
+    }
+    for (const act of exchange.acts) {
+        if (!profile.permittedActs.includes(act))
+            violations.push({ reason: 'act-not-permitted', act });
+    }
+    for (const kind of profile.requiredContextKinds) {
+        if (!exchange.contextKinds.includes(kind))
+            violations.push({ reason: 'missing-required-context', kind });
+    }
+    if (exchange.createsCommitment) {
+        const creating = exchange.acts.filter((a) => profile.commitmentCreatingActs.includes(a));
+        if (creating.length === 0) {
+            // The structural half of "an Offer is not a Commitment": an exchange cannot claim to have
+            // created an obligation without realizing an act this profile says can create one.
+            violations.push({ reason: 'commitment-from-non-creating-act', act: exchange.acts[0] ?? 'INFORM' });
+        }
+    }
+    return violations;
+}
+// ─── The library ─────────────────────────────────────────────────────────────
+/** Plain conversation. Creates no obligations, requires no context — and saying so explicitly is the
+ *  point: the overwhelming majority of exchanges are this, and they should not carry ceremony. */
+export const DIRECT_PROFILE = {
+    version: 'ap.interaction-profile.v1',
+    profileVersion: 'direct/1.0.0',
+    purpose: 'A conversation between two agents. Carries no obligation and evaluates no authority.',
+    roles: ['participant'],
+    permittedActs: ['INFORM', 'QUERY', 'NOTIFY', 'ACKNOWLEDGE'],
+    requiredContextKinds: [],
+    commitmentCreatingActs: [],
+    closeReasons: ['concluded', 'abandoned'],
+};
+/** Terms are proposed, countered and accepted. The only profile in this starter set where an ACCEPT
+ *  can create an obligation, which is exactly why ACCEPT is not in the others. */
+export const NEGOTIATION_PROFILE = {
+    version: 'ap.interaction-profile.v1',
+    profileVersion: 'negotiation/1.0.0',
+    purpose: 'Offer, counter-offer and acceptance over terms. A valid, authorized ACCEPT creates a Commitment.',
+    roles: ['proposer', 'counterparty'],
+    permittedActs: ['INFORM', 'QUERY', 'PROPOSE', 'COUNTER', 'ACCEPT', 'REJECT', 'RETRACT', 'ACKNOWLEDGE'],
+    requiredContextKinds: [],
+    commitmentCreatingActs: ['ACCEPT'],
+    closeReasons: ['agreed', 'declined', 'withdrawn', 'expired', 'abandoned'],
+};
+/** A question routed to a member and answered. `structured-only` by construction: the permitted acts
+ *  contain no PROPOSE, so a consultation cannot quietly become a negotiation. */
+export const CONSULTATION_PROFILE = {
+    version: 'ap.interaction-profile.v1',
+    profileVersion: 'consultation/1.0.0',
+    purpose: 'A routed question and its answers. Advice, never an offer — and structurally incapable of becoming one.',
+    roles: ['requester', 'router', 'consultant'],
+    permittedActs: ['QUERY', 'INFORM', 'ACKNOWLEDGE', 'REJECT'],
+    requiredContextKinds: ['delegation'],
+    commitmentCreatingActs: [],
+    closeReasons: ['answered', 'declined', 'expired', 'no-consultant-available'],
+};
+/**
+ * Spec 336's pre-task provider qualification, expressed as a profile of this model rather than as a
+ * parallel one. This is the profile mechanism's actual test: an existing, independently-designed
+ * chain either fits or it does not.
+ *
+ * IT MOSTLY FITS, AND WHERE IT DOES NOT, THE FINDING IS REAL — see `ENGAGEMENT_RESPONSE_KIND_AXES`
+ * below. `requiredContextKinds` is `['intent-projection']` because §3.1's rule is that an offer binds
+ * to the projection the provider REVIEWED, not to undisclosed facts in the intent; an engagement
+ * exchange that pins no projection cannot later be checked against what was actually disclosed.
+ *
+ * `commitmentCreatingActs` is EMPTY, and that is the load-bearing line. Nine of the chain's ten steps
+ * grant nothing; only the Mandate authorizes, and a Mandate is issued by `delegation`, not created by
+ * an act in this interaction. An engagement that could mint an obligation would be spec 336's central
+ * claim undone by its own profile.
+ */
+export const ENGAGEMENT_PROFILE = {
+    version: 'ap.interaction-profile.v1',
+    profileVersion: 'engagement/1.0.0',
+    purpose: 'Pre-task provider qualification (spec 336): probe a candidate against a minimized intent projection and receive terms. Grants nothing — only the Mandate authorizes.',
+    roles: ['requester', 'candidate-provider'],
+    permittedActs: ['QUERY', 'INFORM', 'PROPOSE', 'COUNTER', 'REJECT', 'ACKNOWLEDGE', 'RETRACT'],
+    requiredContextKinds: ['intent-projection'],
+    commitmentCreatingActs: [],
+    closeReasons: [
+        'offer-selected',
+        'declined',
+        'referred',
+        'temporarily-unavailable',
+        'not-selected',
+        'expired',
+        'cancelled',
+    ],
+};
+/**
+ * An org topic — the first profile that describes something already in production (spec 340 W11).
+ *
+ * Org topics were an Interaction in everything but name: the org SA owns the board, members join and
+ * leave, `facilitator`/`contributor` are its roles, and it opens and closes. This profile names that
+ * rather than building anything new.
+ *
+ * `commitmentCreatingActs` is empty and `PROPOSE`/`ACCEPT` are absent from the permitted set: a topic
+ * is a discussion board. If a negotiation happens in one, it belongs in its own Interaction under the
+ * negotiation profile — which is exactly ADR-0058 §14's rule that a thread is promoted only when it
+ * acquires an independent property, applied to the case that actually occurs.
+ */
+export const TOPIC_PROFILE = {
+    version: 'ap.interaction-profile.v1',
+    profileVersion: 'topic/1.0.0',
+    purpose: 'An organization discussion board. Members post, facilitators manage. Carries no obligation and is structurally incapable of becoming a negotiation.',
+    roles: ['facilitator', 'contributor'],
+    permittedActs: ['INFORM', 'QUERY', 'NOTIFY', 'ACKNOWLEDGE'],
+    requiredContextKinds: [],
+    commitmentCreatingActs: [],
+    // `archived` is deliberately NOT here. Shelving a board is an inbox/display concern and already
+    // exists as `InboxState.archived`; an interaction that is archived has still concluded or not.
+    closeReasons: ['concluded', 'abandoned'],
+};
+/**
+ * Spec 410 §10 — A DISPUTE. The governed situation between "I disagree with what this receipt says happened" and a
+ * determination someone was named to make. The disputing party opens it citing the receipt; the counterparty
+ * answers; a STEWARD — named in the public steward record for the term or capability in question, never chosen
+ * by either party at the time — records a determination as a signed Exchange, and the run's provenance links it
+ * (`apexec:disputedBy`). It grants nothing and reverses nothing by itself: a reversal is a new act under a new
+ * mandate. `commitmentCreatingActs` is empty for that reason, and `requiredContextKinds` pins the receipt so a
+ * dispute cannot be about nothing in particular.
+ */
+export const DISPUTE_PROFILE = {
+    version: 'ap.interaction-profile.v1',
+    profileVersion: 'dispute/1.0.0',
+    purpose: 'A disagreement about a receipt, answered by the counterparty and determined by a named steward. Evidence and a determination; never a reversal.',
+    roles: ['disputant', 'counterparty', 'steward'],
+    permittedActs: ['REQUEST', 'INFORM', 'QUERY', 'ACKNOWLEDGE', 'ISSUE', 'REJECT'],
+    requiredContextKinds: ['receipt'],
+    commitmentCreatingActs: [],
+    closeReasons: ['determined', 'withdrawn', 'declined-by-steward', 'expired'],
+};
+export const PROFILE_LIBRARY = [
+    DIRECT_PROFILE,
+    NEGOTIATION_PROFILE,
+    CONSULTATION_PROFILE,
+    ENGAGEMENT_PROFILE,
+    TOPIC_PROFILE,
+    DISPUTE_PROFILE,
+];
+export function profileFor(version) {
+    return PROFILE_LIBRARY.find((p) => p.profileVersion === version);
+}
+// ─── The finding W4 was run to produce ───────────────────────────────────────
+/**
+ * Spec 336 §3.5's six "response kinds" are NOT one axis.
+ *
+ * Four are performatives — WHAT the act does, its illocutionary force. Two are classifications of the
+ * CONTENT an INFORM carries. Modelling all six as one enumeration is the same defect spec 336 itself
+ * diagnosed one level up, when it split probe "mode" into three orthogonal axes because one
+ * enumeration doing three jobs made ordinary positions unsayable.
+ *
+ * The consequence if left merged: `human-ux-required` would need a performative of its own, and the
+ * scheme would grow a concept per business outcome until it was a catalog — exactly what SKOS act
+ * kinds exist to prevent. Keeping the split means a provider saying "I need a human channel" is an
+ * INFORM whose content says so, which is what it actually is.
+ *
+ * This is a finding against spec 336 §3.5, recorded here because the profile is where it surfaced.
+ * It changes no wire format: the response kind stays on the content, where it already lives.
+ */
+export const ENGAGEMENT_RESPONSE_KIND_AXES = {
+    offer: { axis: 'performative', performative: 'PROPOSE' },
+    decline: { axis: 'performative', performative: 'REJECT' },
+    'needs-clarification': { axis: 'performative', performative: 'QUERY' },
+    acknowledgement: { axis: 'performative', performative: 'ACKNOWLEDGE' },
+    // A referral is not a distinct force — it is an INFORM whose content names another provider.
+    // Promoting it would make "who to ask instead" an act rather than a fact.
+    referral: { axis: 'content', carriedBy: 'INFORM' },
+    // A fact about TIME, and the one spec 336 is most careful about: it must never be cached as
+    // absence, because a resolver that can only handle "yes" reads "not right now" as "no such provider".
+    'temporarily-unavailable': { axis: 'content', carriedBy: 'INFORM' },
+    // No performative, and it should not get one: needing a human channel is a property of HOW the
+    // answer must arrive, not of what was said.
+    'human-ux-required': { axis: 'content', carriedBy: 'INFORM' },
+};
+//# sourceMappingURL=interaction-profile.js.map

package/dist/interaction-profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interaction-profile.js","sourceRoot":"","sources":["../src/interaction-profile.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,EAAE;AACF,kGAAkG;AAClG,mGAAmG;AACnG,sGAAsG;AACtG,8DAA8D;AAC9D,EAAE;AACF,sGAAsG;AACtG,+FAA+F;AAC/F,kGAAkG;AAClG,kGAAkG;AAClG,gGAAgG;AAChG,kCAAkC;AAClC,EAAE;AACF,+FAA+F;AAC/F,qFAAqF;AAGrF,OAAO,EAAE,gBAAgB,EAAuB,MAAM,yBAAyB,CAAC;AA+ChF;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,OAA6B,EAC7B,QAA8B;IAE9B,MAAM,UAAU,GAAuB,EAAE,CAAC;IAE1C,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAC/C,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,2BAA2B,EAAE,KAAK,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC;IAC3F,CAAC;SAAM,IAAI,QAAQ,CAAC,cAAc,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC;QAC9D,+FAA+F;QAC/F,iGAAiG;QACjG,UAAU,CAAC,IAAI,CAAC;YACd,MAAM,EAAE,0BAA0B;YAClC,MAAM,EAAE,QAAQ,CAAC,cAAc;YAC/B,QAAQ,EAAE,OAAO,CAAC,cAAc;SACjC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,EAAE,CAAC,CAAC;IAClG,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;QAChD,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3G,CAAC;IAED,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACzF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,0FAA0F;YAC1F,mFAAmF;YACnF,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,kCAAkC,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,gFAAgF;AAEhF;kGACkG;AAClG,MAAM,CAAC,MAAM,cAAc,GAAyB;IAClD,OAAO,EAAE,2BAA2B;IACpC,cAAc,EAAE,cAAc;IAC9B,OAAO,EAAE,sFAAsF;IAC/F,KAAK,EAAE,CAAC,aAAa,CAAC;IACtB,aAAa,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,CAAC;IAC3D,oBAAoB,EAAE,EAAE;IACxB,sBAAsB,EAAE,EAAE;IAC1B,YAAY,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC;CACzC,CAAC;AAEF;kFACkF;AAClF,MAAM,CAAC,MAAM,mBAAmB,GAAyB;IACvD,OAAO,EAAE,2BAA2B;IACpC,cAAc,EAAE,mBAAmB;IACnC,OAAO,EAAE,kGAAkG;IAC3G,KAAK,EAAE,CAAC,UAAU,EAAE,cAAc,CAAC;IACnC,aAAa,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,CAAC;IACtG,oBAAoB,EAAE,EAAE;IACxB,sBAAsB,EAAE,CAAC,QAAQ,CAAC;IAClC,YAAY,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,CAAC;CAC1E,CAAC;AAEF;iFACiF;AACjF,MAAM,CAAC,MAAM,oBAAoB,GAAyB;IACxD,OAAO,EAAE,2BAA2B;IACpC,cAAc,EAAE,oBAAoB;IACpC,OAAO,EAAE,yGAAyG;IAClH,KAAK,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,YAAY,CAAC;IAC5C,aAAa,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,CAAC;IAC3D,oBAAoB,EAAE,CAAC,YAAY,CAAC;IACpC,sBAAsB,EAAE,EAAE;IAC1B,YAAY,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,yBAAyB,CAAC;CAC7E,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAyB;IACtD,OAAO,EAAE,2BAA2B;IACpC,cAAc,EAAE,kBAAkB;IAClC,OAAO,EACL,sKAAsK;IACxK,KAAK,EAAE,CAAC,WAAW,EAAE,oBAAoB,CAAC;IAC1C,aAAa,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,CAAC;IAC5F,oBAAoB,EAAE,CAAC,mBAAmB,CAAC;IAC3C,sBAAsB,EAAE,EAAE;IAC1B,YAAY,EAAE;QACZ,gBAAgB;QAChB,UAAU;QACV,UAAU;QACV,yBAAyB;QACzB,cAAc;QACd,SAAS;QACT,WAAW;KACZ;CACF,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,aAAa,GAAyB;IACjD,OAAO,EAAE,2BAA2B;IACpC,cAAc,EAAE,aAAa;IAC7B,OAAO,EACL,qJAAqJ;IACvJ,KAAK,EAAE,CAAC,aAAa,EAAE,aAAa,CAAC;IACrC,aAAa,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,CAAC;IAC3D,oBAAoB,EAAE,EAAE;IACxB,sBAAsB,EAAE,EAAE;IAC1B,gGAAgG;IAChG,+FAA+F;IAC/F,YAAY,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC;CACzC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAyB;IACnD,OAAO,EAAE,2BAA2B;IACpC,cAAc,EAAE,eAAe;IAC/B,OAAO,EAAE,iJAAiJ;IAC1J,KAAK,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,SAAS,CAAC;IAC/C,aAAa,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,CAAC;IAC/E,oBAAoB,EAAE,CAAC,SAAS,CAAC;IACjC,sBAAsB,EAAE,EAAE;IAC1B,YAAY,EAAE,CAAC,YAAY,EAAE,WAAW,EAAE,qBAAqB,EAAE,SAAS,CAAC;CAC5E,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAoC;IAC9D,cAAc;IACd,mBAAmB;IACnB,oBAAoB;IACpB,kBAAkB;IAClB,aAAa;IACb,eAAe;CAChB,CAAC;AAEF,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,OAAO,CAAC,CAAC;AACnE,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAEtC;IACF,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,SAAS,EAAE;IACxD,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,QAAQ,EAAE;IACzD,qBAAqB,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE;IACtE,eAAe,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE;IACtE,6FAA6F;IAC7F,0EAA0E;IAC1E,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE;IAClD,4FAA4F;IAC5F,sGAAsG;IACtG,yBAAyB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE;IACnE,+FAA+F;IAC/F,4CAA4C;IAC5C,mBAAmB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE;CAC9D,CAAC"}

package/dist/interaction-record.d.ts

@@ -0,0 +1,168 @@
+import type { CanonicalAgentId } from '@agenticprimitives/types';
+import type { Hex32 } from './messaging/index.js';
+import type { ProtocolBindingV1 } from './protocol-binding.js';
+import type { InteractionState } from './interaction-machines.js';
+/** The interaction spine id. Ours, never a protocol's — an A2A `contextId` or a DIDComm `thid` is a
+ *  foreign key into someone else's namespace and is carried alongside, never used as this (spec 340 §11). */
+export type InteractionId = `ixn_${string}`;
+/** Content address of a `ContextSnapshotV1`. A snapshot is identified BY its bytes. */
+export type ContextDigest = Hex32;
+/**
+ * The version of an `InteractionProfile`, pinned onto every Exchange.
+ *
+ * A profile declares its own roles, permitted acts, required contexts, state machine and authority
+ * requirements — so a new interaction type is a NEW PROFILE, not a new `MessageKind` member and not a
+ * schema change (spec 340 §6). That is the extensibility mechanism external adopters get.
+ *
+ * `<name>/<semver>` and both halves are required. A bare name would make the pin unfalsifiable, which
+ * is the whole reason the pin exists.
+ */
+export type ProfileVersion = `${string}/${number}.${number}.${number}`;
+export declare function isProfileVersion(value: string): value is ProfileVersion;
+export declare function isFloatingVersion(value: string): boolean;
+/**
+ * ONE reference inside a snapshot — a delegation, an entitlement, a policy, a credential status.
+ *
+ * All four fields are required, and that is the point. A reference carrying only an id resolves to
+ * whatever exists when someone later asks, which means a historical record describes the present
+ * instead of the past. The failure is quiet and forensic: nothing breaks at write time, and a year
+ * later nobody can say what the evaluator actually saw.
+ */
+export interface ContextReferenceV1 {
+    /** What kind of thing this is — `delegation`, `entitlement`, `policy`, `status`, … */
+    kind: string;
+    /** Its canonical id in its OWN namespace. */
+    id: string;
+    /** The EXACT version. Never `current`/`latest` (see `assertReproducible`). */
+    version: string;
+    /** Digest of the referenced artifact as it stood. */
+    digest: Hex32;
+    /** When this reference was observed — not when the artifact was created. */
+    observedAt: string;
+}
+/**
+ * An immutable, digest-addressed bundle of exactly what was known and evaluated when an Exchange was
+ * made. Replaces `contextRefs[]`, which were floating pointers at live state.
+ */
+export interface ContextSnapshotV1 {
+    version: 'ap.context-snapshot.v1';
+    /** sha256 over the canonical body (every field except `digest` itself). */
+    digest: ContextDigest;
+    /** The profile version in force when this was taken. */
+    profileVersion: ProfileVersion;
+    refs: readonly ContextReferenceV1[];
+    takenAt: string;
+}
+export type ContextReproducibilityFailure = {
+    reason: 'floating_version';
+    ref: ContextReferenceV1;
+} | {
+    reason: 'floating_profile_version';
+    value: string;
+} | {
+    reason: 'malformed_profile_version';
+    value: string;
+} | {
+    reason: 'missing_field';
+    ref: ContextReferenceV1;
+    field: keyof ContextReferenceV1;
+};
+/**
+ * The reproducibility gate, as a TOTAL function over the failures rather than a boolean.
+ *
+ * Returns every problem, not the first: a caller fixing one floating ref at a time would otherwise
+ * need N round trips to learn the record was never reproducible.
+ */
+export declare function checkReproducible(input: Pick<ContextSnapshotV1, 'profileVersion' | 'refs'>): readonly ContextReproducibilityFailure[];
+/** Throwing form, for the write path. Fail-closed: an unreproducible snapshot is never stored. */
+export declare function assertReproducible(input: Pick<ContextSnapshotV1, 'profileVersion' | 'refs'>): void;
+/** Digest over the canonical body — every field except `digest`. */
+export declare function hashContextSnapshot(snapshot: Omit<ContextSnapshotV1, 'digest'> | ContextSnapshotV1): Promise<ContextDigest>;
+/** Build + seal. Refs are sorted so two callers observing the same context produce the same digest —
+ *  a content address that depended on insertion order would not be one. */
+export declare function buildContextSnapshot(input: {
+    profileVersion: ProfileVersion;
+    refs: readonly ContextReferenceV1[];
+    takenAt: string;
+}): Promise<ContextSnapshotV1>;
+/** Recompute and compare. A snapshot whose digest does not match its bytes is not evidence. */
+export declare function verifyContextSnapshot(snapshot: ContextSnapshotV1): Promise<boolean>;
+/**
+ * An agent's standing in an Interaction under a profile-defined role, over a time window.
+ *
+ * The role is a plain string BECAUSE the profile defines the role set. Enumerating roles here would
+ * reintroduce the frozen taxonomy profiles exist to replace — and a role, unlike a state, has no
+ * substrate-wide meaning to enumerate against.
+ */
+export interface ParticipationV1 {
+    agent: CanonicalAgentId;
+    /** Defined by the interaction's profile, not by this package. */
+    role: string;
+    joinedAt: string;
+    /** Absent while participating. Set on leaving; the record is never deleted. */
+    leftAt?: string;
+}
+/** Participants at an instant — a projection over join/leave windows, never a stored second copy. */
+export declare function participantsAt(participations: readonly ParticipationV1[], at: string): readonly ParticipationV1[];
+/**
+ * The durable governed situation. Deliberately does NOT carry its exchanges: they live in their own
+ * records and point INWARD via `ExchangeRecordV1.interactionId`. An aggregate that inlined its
+ * exchanges would have to be rewritten on every message, which is how an "immutable signed unit"
+ * quietly becomes a mutable row.
+ */
+export interface InteractionRecordV1 {
+    version: 'ap.interaction.v1';
+    interactionId: InteractionId;
+    /** The profile IN FORCE. Individual exchanges pin the version they were made under, which may be an
+     *  older one — that difference is exactly what makes a downgrade detectable rather than invisible. */
+    profileVersion: ProfileVersion;
+    /** The gateway owner SA the interaction is custodied by. */
+    principal: CanonicalAgentId;
+    /** Where the interaction is in ITS OWN lifecycle — one of the six machines, and not the same
+     *  question as any exchange's `exec`/`case`. Required rather than defaulted: a record that omitted
+     *  it would be read as `forming` by whoever looked, including after it had concluded. */
+    lifecycleState: InteractionState;
+    /**
+     * HOW membership is determined — the distinction org topics forced into the model.
+     *
+     * `asserted`: the list below IS the membership. Someone joined, someone left, and the record says so.
+     *
+     * `derived`: membership is computed by the custodian from a source that already owns it — for an open
+     * org topic, the organization's own membership. `participations` MUST then stay EMPTY. Copying the
+     * member list per interaction is exactly the duplication `apmsg:openParticipation` forbids
+     * ("derived at read time — never stored per topic"), and a stale copy of a membership list is how a
+     * removed member keeps posting.
+     */
+    participationMode: 'asserted' | 'derived';
+    /** Empty when `participationMode` is `derived` — see above. */
+    participations: readonly ParticipationV1[];
+    /** Foreign keys into other protocols' namespaces (A2A contextId, DIDComm thid, Matrix event id).
+     *  NEVER the canonical id — see `InteractionId` (spec 340 §11). A LIST of typed bindings rather
+     *  than a `Record<protocol, value>`: one protocol contributes several distinct correlators
+     *  (`a2a:contextId` and `a2a:taskId` are not the same key), and each is a claim about a moment, so
+     *  it carries its own `observedAt` like every other reference in this model. */
+    protocolBindings?: readonly ProtocolBindingV1[];
+    createdAt: string;
+    updatedAt: string;
+    /** Monotonic revision, mirroring `ExchangeRecordV1.rev`. */
+    rev: number;
+}
+export type ProfileDowngrade = {
+    exchangeId: string;
+    pinned: ProfileVersion;
+    inForce: ProfileVersion;
+};
+/**
+ * Detect exchanges pinned to a profile version OLDER than the one now in force.
+ *
+ * This is not an error — an interaction whose profile versioned mid-flight legitimately contains
+ * exchanges under both. It is a REPORT, because the attack it surfaces has no network component: an
+ * adversary who can edit the interaction's `profileVersion` reinterprets a Negotiation as a generic
+ * Conversation and takes its acceptance semantics with it. The pin on each Exchange is what makes
+ * that visible, and this is the function that looks.
+ */
+export declare function detectProfileDowngrades(interaction: Pick<InteractionRecordV1, 'profileVersion'>, exchanges: readonly {
+    exchangeId: string;
+    profileVersion?: ProfileVersion;
+}[]): readonly ProfileDowngrade[];
+//# sourceMappingURL=interaction-record.d.ts.map

package/dist/interaction-record.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interaction-record.d.ts","sourceRoot":"","sources":["../src/interaction-record.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAIlD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAElE;6GAC6G;AAC7G,MAAM,MAAM,aAAa,GAAG,OAAO,MAAM,EAAE,CAAC;AAE5C,uFAAuF;AACvF,MAAM,MAAM,aAAa,GAAG,KAAK,CAAC;AAIlC;;;;;;;;;GASG;AACH,MAAM,MAAM,cAAc,GAAG,GAAG,MAAM,IAAI,MAAM,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;AAIvE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,cAAc,CAEvE;AAKD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAExD;AAID;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,EAAE,EAAE,MAAM,CAAC;IACX,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,MAAM,EAAE,KAAK,CAAC;IACd,4EAA4E;IAC5E,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,wBAAwB,CAAC;IAClC,2EAA2E;IAC3E,MAAM,EAAE,aAAa,CAAC;IACtB,wDAAwD;IACxD,cAAc,EAAE,cAAc,CAAC;IAC/B,IAAI,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACpC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,6BAA6B,GACrC;IAAE,MAAM,EAAE,kBAAkB,CAAC;IAAC,GAAG,EAAE,kBAAkB,CAAA;CAAE,GACvD;IAAE,MAAM,EAAE,0BAA0B,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,MAAM,EAAE,2BAA2B,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,GAAG,EAAE,kBAAkB,CAAC;IAAC,KAAK,EAAE,MAAM,kBAAkB,CAAA;CAAE,CAAC;AAE1F;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,IAAI,CAAC,iBAAiB,EAAE,gBAAgB,GAAG,MAAM,CAAC,GACxD,SAAS,6BAA6B,EAAE,CAkB1C;AAED,kGAAkG;AAClG,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,iBAAiB,EAAE,gBAAgB,GAAG,MAAM,CAAC,GAAG,IAAI,CAclG;AAED,oEAAoE;AACpE,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC,GAAG,iBAAiB,GAC9D,OAAO,CAAC,aAAa,CAAC,CAGxB;AAED;2EAC2E;AAC3E,wBAAsB,oBAAoB,CAAC,KAAK,EAAE;IAChD,cAAc,EAAE,cAAc,CAAC;IAC/B,IAAI,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACpC,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAY7B;AAED,+FAA+F;AAC/F,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,CAEzF;AAID;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,gBAAgB,CAAC;IACxB,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qGAAqG;AACrG,wBAAgB,cAAc,CAC5B,cAAc,EAAE,SAAS,eAAe,EAAE,EAC1C,EAAE,EAAE,MAAM,GACT,SAAS,eAAe,EAAE,CAE5B;AAID;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,mBAAmB,CAAC;IAC7B,aAAa,EAAE,aAAa,CAAC;IAC7B;0GACsG;IACtG,cAAc,EAAE,cAAc,CAAC;IAC/B,4DAA4D;IAC5D,SAAS,EAAE,gBAAgB,CAAC;IAC5B;;6FAEyF;IACzF,cAAc,EAAE,gBAAgB,CAAC;IACjC;;;;;;;;;;OAUG;IACH,iBAAiB,EAAE,UAAU,GAAG,SAAS,CAAC;IAC1C,+DAA+D;IAC/D,cAAc,EAAE,SAAS,eAAe,EAAE,CAAC;IAC3C;;;;oFAIgF;IAChF,gBAAgB,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,cAAc,CAAC;IACvB,OAAO,EAAE,cAAc,CAAC;CACzB,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,IAAI,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,EACxD,SAAS,EAAE,SAAS;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,cAAc,CAAA;CAAE,EAAE,GAC5E,SAAS,gBAAgB,EAAE,CAM7B"}

package/dist/interaction-record.js

@@ -0,0 +1,108 @@
+// The durable governed situation (spec 340 W2; ADR-0058) — the aggregate `ExchangeRecordV1` has been
+// living without.
+//
+// Today the model is Exchange-rooted: an exchange carries a `case?: CaseState` substate and there is no
+// record of the interaction ITSELF. That holds exactly as long as an interaction is one request-shaped
+// thing. It stops the moment participants join and leave, a profile versions, a context must be
+// reproducible, or a commitment outlives any single exchange.
+//
+//   Interaction   the governed situation      durable: participants, profile, state, commitments
+//     └── Exchange   one immutable signed unit crossing its boundary
+//
+// An Exchange without an Interaction is a message. An Interaction without Exchanges is an empty room.
+// Both are legitimate; neither is the other.
+//
+// WHAT THIS FILE CONFERS: nothing. An `InteractionRecordV1` records who is participating and under what
+// profile; it never decides whether an act is permitted. Participation is not authority — a role
+// explains WHY delegations were issued, it never substitutes for one (ADR-0048 §4). Authority stays in
+// `delegation` + `entitlements` + `tool-policy`, re-evaluated at the moment of acting.
+import { canonicalizeJson } from '@agenticprimitives/types';
+import { sha256Hex32 } from './messaging/index.js';
+const PROFILE_VERSION_RE = /^[a-z][a-z0-9-]*(?:\.[a-z0-9-]+)*\/\d+\.\d+\.\d+$/;
+export function isProfileVersion(value) {
+    return PROFILE_VERSION_RE.test(value);
+}
+/** Values that name "whatever exists now". Forbidden inside any historical record (spec 340 §7). */
+const FLOATING = new Set(['current', 'latest', 'head', 'main', 'tip', 'now']);
+export function isFloatingVersion(value) {
+    return FLOATING.has(value.trim().toLowerCase());
+}
+/**
+ * The reproducibility gate, as a TOTAL function over the failures rather than a boolean.
+ *
+ * Returns every problem, not the first: a caller fixing one floating ref at a time would otherwise
+ * need N round trips to learn the record was never reproducible.
+ */
+export function checkReproducible(input) {
+    const failures = [];
+    if (isFloatingVersion(input.profileVersion)) {
+        failures.push({ reason: 'floating_profile_version', value: input.profileVersion });
+    }
+    else if (!isProfileVersion(input.profileVersion)) {
+        failures.push({ reason: 'malformed_profile_version', value: input.profileVersion });
+    }
+    for (const ref of input.refs) {
+        for (const field of ['kind', 'id', 'version', 'digest', 'observedAt']) {
+            if (!ref[field])
+                failures.push({ reason: 'missing_field', ref, field });
+        }
+        if (ref.version && isFloatingVersion(ref.version)) {
+            failures.push({ reason: 'floating_version', ref });
+        }
+    }
+    return failures;
+}
+/** Throwing form, for the write path. Fail-closed: an unreproducible snapshot is never stored. */
+export function assertReproducible(input) {
+    const failures = checkReproducible(input);
+    if (failures.length === 0)
+        return;
+    throw new Error(`ContextSnapshot is not reproducible: ${failures
+        .map((f) => f.reason === 'floating_version'
+        ? `${f.ref.kind}:${f.ref.id} pins "${f.ref.version}"`
+        : f.reason === 'missing_field'
+            ? `${f.ref.kind}:${f.ref.id} missing ${f.field}`
+            : `profileVersion "${f.value}" (${f.reason})`)
+        .join('; ')}`);
+}
+/** Digest over the canonical body — every field except `digest`. */
+export async function hashContextSnapshot(snapshot) {
+    const { digest: _digest, ...body } = snapshot;
+    return sha256Hex32(canonicalizeJson(body));
+}
+/** Build + seal. Refs are sorted so two callers observing the same context produce the same digest —
+ *  a content address that depended on insertion order would not be one. */
+export async function buildContextSnapshot(input) {
+    assertReproducible(input);
+    const refs = [...input.refs].sort((a, b) => a.kind === b.kind ? (a.id === b.id ? a.digest.localeCompare(b.digest) : a.id.localeCompare(b.id)) : a.kind.localeCompare(b.kind));
+    const body = {
+        version: 'ap.context-snapshot.v1',
+        profileVersion: input.profileVersion,
+        refs,
+        takenAt: input.takenAt,
+    };
+    return { ...body, digest: await hashContextSnapshot(body) };
+}
+/** Recompute and compare. A snapshot whose digest does not match its bytes is not evidence. */
+export async function verifyContextSnapshot(snapshot) {
+    return (await hashContextSnapshot(snapshot)) === snapshot.digest;
+}
+/** Participants at an instant — a projection over join/leave windows, never a stored second copy. */
+export function participantsAt(participations, at) {
+    return participations.filter((p) => p.joinedAt <= at && (p.leftAt === undefined || p.leftAt > at));
+}
+/**
+ * Detect exchanges pinned to a profile version OLDER than the one now in force.
+ *
+ * This is not an error — an interaction whose profile versioned mid-flight legitimately contains
+ * exchanges under both. It is a REPORT, because the attack it surfaces has no network component: an
+ * adversary who can edit the interaction's `profileVersion` reinterprets a Negotiation as a generic
+ * Conversation and takes its acceptance semantics with it. The pin on each Exchange is what makes
+ * that visible, and this is the function that looks.
+ */
+export function detectProfileDowngrades(interaction, exchanges) {
+    return exchanges.flatMap((x) => x.profileVersion && x.profileVersion !== interaction.profileVersion
+        ? [{ exchangeId: x.exchangeId, pinned: x.profileVersion, inForce: interaction.profileVersion }]
+        : []);
+}
+//# sourceMappingURL=interaction-record.js.map

package/dist/interaction-record.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interaction-record.js","sourceRoot":"","sources":["../src/interaction-record.ts"],"names":[],"mappings":"AAAA,qGAAqG;AACrG,kBAAkB;AAClB,EAAE;AACF,wGAAwG;AACxG,uGAAuG;AACvG,gGAAgG;AAChG,8DAA8D;AAC9D,EAAE;AACF,iGAAiG;AACjG,qEAAqE;AACrE,EAAE;AACF,sGAAsG;AACtG,6CAA6C;AAC7C,EAAE;AACF,wGAAwG;AACxG,iGAAiG;AACjG,uGAAuG;AACvG,uFAAuF;AAEvF,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAG5D,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AA2BnD,MAAM,kBAAkB,GAAG,mDAAmD,CAAC;AAE/E,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACxC,CAAC;AAED,oGAAoG;AACpG,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAE9E,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AAClD,CAAC;AA6CD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAyD;IAEzD,MAAM,QAAQ,GAAoC,EAAE,CAAC;IAErD,IAAI,iBAAiB,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;QAC5C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,KAAK,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC;IACrF,CAAC;SAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;QACnD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,2BAA2B,EAAE,KAAK,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,CAAU,EAAE,CAAC;YAC/E,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,GAAG,CAAC,OAAO,IAAI,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,kBAAkB,CAAC,KAAyD;IAC1F,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAClC,MAAM,IAAI,KAAK,CACb,wCAAwC,QAAQ;SAC7C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACT,CAAC,CAAC,MAAM,KAAK,kBAAkB;QAC7B,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC,GAAG,CAAC,OAAO,GAAG;QACrD,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,eAAe;YAC5B,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC,CAAC,KAAK,EAAE;YAChD,CAAC,CAAC,mBAAmB,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,MAAM,GAAG,CAClD;SACA,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAA+D;IAE/D,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,QAA6B,CAAC;IACnE,OAAO,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED;2EAC2E;AAC3E,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAI1C;IACC,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACzC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CACjI,CAAC;IACF,MAAM,IAAI,GAAG;QACX,OAAO,EAAE,wBAAiC;QAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,IAAI;QACJ,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;IACF,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,QAA2B;IACrE,OAAO,CAAC,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAC,KAAK,QAAQ,CAAC,MAAM,CAAC;AACnE,CAAC;AAoBD,qGAAqG;AACrG,MAAM,UAAU,cAAc,CAC5B,cAA0C,EAC1C,EAAU;IAEV,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;AACrG,CAAC;AAsDD;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACrC,WAAwD,EACxD,SAA6E;IAE7E,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7B,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,cAAc,KAAK,WAAW,CAAC,cAAc;QACjE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,cAAc,EAAE,OAAO,EAAE,WAAW,CAAC,cAAc,EAAE,CAAC;QAC/F,CAAC,CAAC,EAAE,CACP,CAAC;AACJ,CAAC"}

package/dist/interactions/grant-scopes.d.ts

@@ -0,0 +1,21 @@
+/** Ops the record-scope gate distinguishes: a tombstone (`delete`) is a DISTINCT op from `write`. */
+export type RecordScopeOp = 'read' | 'write' | 'delete';
+/** A group of resources granted the same ops, before a server is named. */
+export interface RecordScopeSpec {
+    resources: ReadonlyArray<string>;
+    ops: ReadonlyArray<RecordScopeOp>;
+}
+/** One group bound to an MCP server — structurally the delegation package's `VaultRecordScopeGrant`, so it
+ *  feeds `buildVaultRecordScopeCaveat` directly; fabric does not depend on delegation (ADR-0047 boundary). */
+export interface RecordScopeGroup {
+    server: string;
+    resources: string[];
+    ops: RecordScopeOp[];
+}
+export declare const INTERACTIONS_GRANT_CORE_SCOPES: ReadonlyArray<RecordScopeSpec>;
+/**
+ * The grant's scope groups for one MCP server: the core, then the product's extensions (its own app
+ * namespaces — read-only for the agent's grounding, read+write for steward seeding), in that order.
+ */
+export declare function interactionsGrantScopes(server: string, extensions?: ReadonlyArray<RecordScopeSpec>): RecordScopeGroup[];
+//# sourceMappingURL=grant-scopes.d.ts.map

package/dist/interactions/grant-scopes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-scopes.d.ts","sourceRoot":"","sources":["../../src/interactions/grant-scopes.ts"],"names":[],"mappings":"AAgBA,qGAAqG;AACrG,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;AAExD,2EAA2E;AAC3E,MAAM,WAAW,eAAe;IAAG,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAAC,GAAG,EAAE,aAAa,CAAC,aAAa,CAAC,CAAA;CAAE;AAExG;8GAC8G;AAC9G,MAAM,WAAW,gBAAgB;IAAG,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAC;IAAC,GAAG,EAAE,aAAa,EAAE,CAAA;CAAE;AAE/F,eAAO,MAAM,8BAA8B,EAAE,aAAa,CAAC,eAAe,CA+EzE,CAAC;AAEF;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,GAAE,aAAa,CAAC,eAAe,CAAM,GAAG,gBAAgB,EAAE,CAE3H"}

package/dist/interactions/grant-scopes.js

@@ -0,0 +1,88 @@
+export const INTERACTIONS_GRANT_CORE_SCOPES = [
+    { resources: [
+            'vault:conversation.index', 'vault:conversation.topic:*', 'vault:message.body:topic:*',
+            'vault:inbox.data', 'vault:directory.data', 'vault:relationships.data', 'vault:member.profile:*',
+            'vault:org.membership:*', 'vault:org.applications', 'vault:impact-profile', 'vault:capabilities.data',
+            'vault:skills.data', 'vault:home.manifest', 'vault:control-events.data', 'vault:coordination.requests',
+            'vault:coordination.index', 'vault:coordination.endeavor:*', 'vault:content.*',
+            'vault:resolution.requests', 'vault:resolution.grants', 'vault:archetype.assignment', 'vault:payment.receipt:*',
+            'vault:household.data',
+            // Spec 370 P7 — the person's own recent asks, so "him" can mean whom they just meant.
+            'vault:conversation.recent',
+            // Spec 381 — a run's provenance, kept where the authority was spent (the DO copy is the rebuild).
+            'vault:run.provenance:*',
+            // Spec 391 — a step's raw result, too large for the run's record, kept where the run ran.
+            'vault:run.artifact:*',
+            // Spec 410 §4.4 — where the run's bundle is anchored (chain-qualified), beside it: a Home in another estate reads it.
+            'vault:run.anchor:*',
+            // Spec 414 A2 — a run's measurements (numbers from its trace alone), beside its provenance.
+            'vault:run.measures:*',
+            // Spec 410 §8 — the countersigned form of a relationship, each party's copy in its own vault; and its revocation.
+            'vault:relationships.credential:*', 'vault:relationships.revocation:*',
+            // Spec 410 §1.2 — a wire re-issued for a rotation, in the delegator's own vault (`supersedes` links the lineage).
+            'vault:delegation.lineage:*',
+            // Spec 410 §10 — a dispute over a receipt (both parties' copies) and the run's pointer to it.
+            'vault:interaction.dispute:*', 'vault:run.dispute:*',
+            // Spec 438 §5 — a judgment of a run, signed by its evaluator, stored BESIDE the run and never as an
+            // edit to it. Additive at the estate (the household precedent): an older grant cannot write one until
+            // re-issued, and is told so, rather than every grant going stale for a record few will write.
+            'vault:run.assessment:*',
+            // Spec 398 §9 (ap-build B3) — what a build run left, in the workspace's vault; the PR opened from it names it.
+            'vault:build.run:*',
+            'vault:build.promotion:*',
+            // P1.4 — the agent's declared budget (asks and vault calls per day), set by its steward.
+            'vault:agent.budget',
+            // Spec 404 — the external MCP servers the holder attached as connectors (the token is elsewhere, never a record).
+            'vault:connector.mcp:*',
+            // Spec 385 — the person's scoped confirmation memory (which "David", per word + capability + argument).
+            'vault:confirmation.preferences',
+            // Spec 394 — the person's standing instructions (a declared default per room + capability + argument).
+            'vault:standing.instructions',
+            // Spec 422 §9.3 — the person's Security section: the LABELS of what signs for her (the chain holds the set) and the
+            // channels that open her home. ADDITIVE, deliberately not in demo-a2a's REQUIRED_SCOPES: a grant signed before this
+            // line keeps working and is denied only for these two records until its owner re-issues it.
+            'vault:security.credentials', 'vault:security.channels',
+            // Spec 402 W1 — what the person's agent remembers about THEM (their own facts, in their own words).
+            'vault:memory.facts',
+            // Spec 402 W3 / 323 W6 — the person's declared routines, the record the agent's schedule rows are rebuilt from.
+            'vault:routines.data',
+            // Spec 403 W2/W4 — the person's preferences (nudges, how to answer).
+            'vault:person.preferences',
+            // What the playbook remembers about the subjects of a skill family (counts a review folds in).
+            'vault:playbook.memory:*',
+            // Spec 436 §5.5 — the day's pulse a context agent keeps (`apinf:TownPulse`): one record a day, written by the
+            // town under a wire scoped to this family alone, read back when a stranger asks the agent how things are going.
+            // ADDITIVE, deliberately not in demo-a2a's REQUIRED_SCOPES: a grant signed before this line keeps working and is
+            // denied only for these records until its owner re-issues it — which is how it failed first, silently, because
+            // every reader of a denied record catches and reads it as "no record".
+            'vault:pulse.day:*',
+        ], ops: ['read', 'write'] },
+    // Spec 354 K3 — the PLAYBOOK may also be REMOVED, which is a real custodial act: an agent goes back to the
+    // bare harness. A tombstone is a DISTINCT op at the record-scope gate (spec 317 §3.2 / audit F1 — a
+    // write-only delegate must not be able to censor records), so the broad bucket above cannot express it.
+    { resources: ['vault:archetype.assignment'], ops: ['read', 'write', 'delete'] },
+    // Spec 322 W3f — dm bodies are READ-only here: the DO serves the owner's mail reads, while only the
+    // (write-only) delivery plane may create them. Planes stay disjoint on writes.
+    { resources: ['vault:message.body:dm:*'], ops: ['read'] },
+    // The org's own invitations, read-only — what makes membership-read's invited-member path live. Writes
+    // stay on the delivery plane.
+    { resources: ['vault:org.invite:*'], ops: ['read'] },
+    // A governed workspace's pointer to the organization that governs it (the owner's rule, 2026-10-02), READ-only:
+    // the workspace's board gate asks that organization whether a caller is a member, and the club's standing and the
+    // `org.recordMembership` guard resolve the governor from it. Written by the Home under the steward's wire, never
+    // here. ADDITIVE, deliberately not in demo-a2a's REQUIRED_SCOPES: a grant signed before this line keeps working
+    // and reads as "no governor" until its owner re-issues it.
+    { resources: ['vault:workspace.governor'], ops: ['read'] },
+    // Spec 401 — a PERSON's contacts: their own record of who they let in, written by their own agent under their own
+    // mandate (the act that mints the grant) and read back for their list and for standing. Read+write here because
+    // it is the person's own list in the person's own vault; nothing about it leaves it.
+    { resources: ['vault:contact:*'], ops: ['read', 'write'] },
+];
+/**
+ * The grant's scope groups for one MCP server: the core, then the product's extensions (its own app
+ * namespaces — read-only for the agent's grounding, read+write for steward seeding), in that order.
+ */
+export function interactionsGrantScopes(server, extensions = []) {
+    return [...INTERACTIONS_GRANT_CORE_SCOPES, ...extensions].map((g) => ({ server, resources: [...g.resources], ops: [...g.ops] }));
+}
+//# sourceMappingURL=grant-scopes.js.map