@awebai/oats 0.30.0 → 0.30.1

package/capabilities/oats-aweb/lib/grant-custody.mjs

@@ -1,38 +0,0 @@
-export function parseAwJson(text, what) {
-  const trimmed = String(text ?? '').trim();
-  if (!trimmed) throw new Error(`${what} returned no JSON result`);
-  try { return JSON.parse(trimmed); } catch { /* may have progress before JSON */ }
-  const lines = trimmed.split(/\r?\n/);
-  for (let i = 0; i < lines.length; i++) {
-    if (!lines[i].trimStart().startsWith('{')) continue;
-    try { return JSON.parse(lines.slice(i).join('\n')); } catch { /* keep looking */ }
-  }
-  throw new Error(`${what} returned no JSON result`);
-}
-
-export function custodyPreflight({ custody, resident, team, e2eeRequired = true, runAw, fatalOnError = true, fatal }) {
-  const failNow = (message) => { if (fatalOnError && typeof fatal === 'function') fatal(message); throw new Error(message); };
-  let status;
-  try { status = parseAwJson(runAw(['aw', 'custody', 'status', '--json'], custody, { unsetEnv: ['AWEB_IDENTITY_HOME'] }), 'aw custody status'); }
-  catch (e) { failNow(`custody preflight failed for ${resident}: aw custody status --json could not run (${e.message || e}); start aw custody serve for ${resident}`); }
-  const state = String(status.status || 'unknown');
-  const firstError = Array.isArray(status.errors) && status.errors.length ? status.errors[0] : undefined;
-  const firstErrorCode = typeof firstError === 'string' ? firstError : firstError?.code;
-  const code = firstErrorCode ? ` error=${firstErrorCode}` : '';
-  const fail = (why) => failNow(`custody preflight failed for ${resident}: status=${state}${code}; ${why}; start aw custody serve for ${resident}`);
-  if (state !== 'running') fail('custody service is not running');
-  const teamRow = (Array.isArray(status.teams) ? status.teams : []).find((t) => t && (t.team_id || t.id) === team);
-  if (!teamRow) fail(`team ${team} is not present in custody status`);
-  if (teamRow.ready !== true) fail(`team ${team} is not ready in custody status`);
-  if (teamRow.certificate_present === false) fail(`team ${team} certificate is not present in custody status`);
-  if (teamRow.grant_status_endpoint_ready !== undefined && teamRow.grant_status_endpoint_ready !== true) fail(`the aweb server serving team ${team} does not provide grant status yet; hosted grants wait for that deployment`);
-  if (status.keys?.signing_ready !== true) fail('keys.signing_ready is false');
-  const ops = new Set(Array.isArray(status.ops) ? status.ops.map(String) : []);
-  const requiredOps = ['sign_plain_message.v1', ...(e2eeRequired ? ['unwrap_e2ee_message.v1', 'create_e2ee_envelope.v1'] : [])];
-  const missingOps = requiredOps.filter((op) => !ops.has(op));
-  if (missingOps.length) fail(`required custody operations are missing: ${missingOps.join(', ')}`);
-  if (e2eeRequired && status.keys?.encryption_ready !== true) fail('keys.encryption_ready is false');
-  const warnings = [];
-  if (!e2eeRequired && status.keys?.encryption_ready !== true) warnings.push('E2E encryption is disabled for this grant and custody encryption is not ready; encrypted mail/chat will not be available in this session.');
-  return { status, warnings };
-}

package/capabilities/oats-aweb/lib/invocation-shape.mjs

@@ -1,135 +0,0 @@
-// Provider-side consumption checks for the kernel-owned CapturedInvocationContext1.
-// Decoded JSON only: no source/config parsing, artifact lookup or authorization.
-// The kernel must verify retained authority before invoking provider code.
-import { isAbsolute, join, resolve } from 'node:path';
-export const INVOCATION_LIMITS=Object.freeze({bytes:512*1024,depth:32,entries:16384});
-export const PRIOR_RECEIPT_LIMITS=Object.freeze({bytes:128*1024,depth:24,entries:8192});
-const fail=()=>{throw Object.assign(new Error('invalid captured invocation'),{code:'invalid-binding'});};
-const obj=value=>value!==null && typeof value==='object' && !Array.isArray(value);
-const canonical=value=>value===null || typeof value!=='object'?JSON.stringify(value):Array.isArray(value)?`[${value.map(canonical).join(',')}]`:`{${Object.keys(value).sort().map(key=>`${JSON.stringify(key)}:${canonical(value[key])}`).join(',')}}`;
-export const sameInvocationJson=(a,b)=>canonical(a)===canonical(b);
-const same=sameInvocationJson;
-function keys(value,allowed,required=allowed) {if(!obj(value)) fail();for(const key of Object.keys(value)) if(!allowed.includes(key)) fail();for(const key of required) if(!Object.hasOwn(value,key)) fail();}
-function text(value,empty=false) {if(typeof value!=='string' || (!empty && !value.length) || value.includes('\0')) fail();}
-function list(value) {if(!Array.isArray(value)) fail();return value;}
-function absolute(value) {text(value);if(!isAbsolute(value) || resolve(value)!==value) fail();}
-function path(value,root=false) {text(value);if(root && value==='.') return;if(value.startsWith('/') || value.includes('\\') || value.split('/').some(part=>!part || part==='.' || part==='..')) fail();}
-function hash(value) {if(typeof value!=='string' || !/^sha256-[a-f0-9]{64}$/.test(value)) fail();}
-function integrity(value,format) {keys(value,['format','value']);if(value.format!==format) fail();hash(value.value);}
-function capability(value) {text(value);if(!/^(?:@?[a-z0-9][a-z0-9._-]*[./])[a-z0-9][a-z0-9._/-]*$/.test(value)) fail();}
-function repository(value) {
-  if(value?.kind==='canonical-remote') {keys(value,['kind','remote']);text(value.remote);}
-  else if(value?.kind==='provider-repository') {keys(value,['kind','provider','host','id']);text(value.provider);text(value.host);text(value.id);}
-  else fail();
-}
-function soulIdentity(value) {
-  if(value?.kind==='git-soul') {keys(value,['kind','repository','exportPath']);repository(value.repository);path(value.exportPath);}
-  else if(value?.kind==='local-soul') {keys(value,['kind','source','exportPath']);text(value.source);if(!value.source.startsWith('path:')) fail();path(value.exportPath,true);}
-  else fail();
-}
-function artifact(value) {
-  if(value?.kind==='soul') {keys(value,['kind','identity','integrity']);soulIdentity(value.identity);}
-  else if(value?.kind==='capability') {keys(value,['kind','capability','integrity']);capability(value.capability);}
-  else if(value?.kind==='resource') keys(value,['kind','integrity']);
-  else fail();
-  integrity(value.integrity,'oats.tree-exec.v1');
-}
-function resolution(value) {keys(value,['schemaVersion','id']);if(value.schemaVersion!==1) fail();hash(value.id);}
-function incarnation(value) {if(typeof value!=='string' || !/^[a-f0-9]{8}-[a-f0-9]{4}-4[a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/.test(value)) fail();}
-function intent(value,instance) {
-  if(value===null) return;
-  keys(value,['schemaVersion','executionId','incarnationId','attempt']);incarnation(value.incarnationId);
-  if(value.schemaVersion!==1 || typeof value.executionId!=='string' || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(value.executionId) || !Number.isSafeInteger(value.attempt) || value.attempt<1) fail();
-  if(instance===null || value.incarnationId!==instance.incarnationId) fail();
-}
-function origin(value) {
-  keys(value,['kind','document','pointer','span'],['kind','document','pointer']);
-  if(!['soul-requirement','soul-default','workspace-default','import-adoption','operator','package-dependency','work-target','migration-evidence','provider-binding','workspace-admission','member-backlink','source-export','manifest-default'].includes(value.kind)) fail();
-  text(value.pointer,true);if(!/^(?:\/(?:[^~]|~[01])*)*$/.test(value.pointer)) fail();
-  const doc=value.document;
-  if(doc?.kind==='source') {keys(doc,['kind','source','revision','path','integrity']);text(doc.source);text(doc.revision);path(doc.path);integrity(doc.integrity,'oats.bytes.v1');}
-  else if(doc?.kind==='deployment') {keys(doc,['kind','path','integrity']);path(doc.path);integrity(doc.integrity,'oats.bytes.v1');}
-  else if(doc?.kind==='operator') {keys(doc,['kind','id']);text(doc.id);}
-  else if(doc?.kind==='record') {keys(doc,['kind','ref']);resolution(doc.ref);}
-  else if(doc?.kind==='artifact') {keys(doc,['kind','owner','path','integrity']);artifact(doc.owner);path(doc.path);integrity(doc.integrity,'oats.bytes.v1');}
-  else fail();
-  if(Object.hasOwn(value,'span')) {keys(value.span,['start','end']);if(!Number.isSafeInteger(value.span.start) || !Number.isSafeInteger(value.span.end) || value.span.start<0 || value.span.end<value.span.start) fail();}
-}
-function origins(value) {list(value).forEach(origin);}
-function subject(value) {
-  if(value?.kind==='helper') {
-    keys(value,['kind','provider','definition','name']);artifact(value.provider);
-    keys(value.definition,['owner','path','kind']);artifact(value.definition.owner);path(value.definition.path,true);
-    if(value.provider.kind!=='capability' || !same(value.provider,value.definition.owner) || !['file','directory','manifest','skill','runtime-package'].includes(value.definition.kind)) fail();
-    if(typeof value.name!=='string' || !/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(value.name)) fail();return value.name;
-  }
-  if(value?.kind!=='persistent') fail();keys(value,['kind','soul']);const s=value.soul;
-  keys(s,['identity','revision','alias','sourceArtifact','definition','projection']);soulIdentity(s.identity);artifact(s.sourceArtifact);
-  if(s.sourceArtifact.kind!=='soul' || !same(s.identity,s.sourceArtifact.identity)) fail();
-  if(typeof s.alias!=='string' || !/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(s.alias)) fail();path(s.definition);
-  keys(s.projection,['roots']);list(s.projection.roots).forEach(value=>path(value,true));
-  if(!s.projection.roots.length || !s.projection.roots.some(root=>root==='.' || s.definition===root || s.definition.startsWith(`${root}/`))) fail();
-  for(let i=1;i<s.projection.roots.length;i++) if(Buffer.compare(Buffer.from(s.projection.roots[i-1]),Buffer.from(s.projection.roots[i]))>=0) fail();
-  if(s.identity.exportPath!=='.' && !s.definition.startsWith(`${s.identity.exportPath}/`)) fail();
-  const r=s.revision;
-  if(r?.kind==='local') {
-    keys(r,['kind','source','integrity','provenance','repository'],['kind','source','integrity','provenance']);text(r.source);if(!r.source.startsWith('path:')) fail();integrity(r.integrity,'oats.tree-exec.v1');
-    if(!same(r.integrity,s.sourceArtifact.integrity)) fail();
-    if(s.identity.kind==='local-soul') {if(r.source!==s.identity.source || Object.hasOwn(r,'repository')) fail();}
-    else {repository(r.repository);if(!same(r.repository,s.identity.repository)) fail();}
-  } else {
-    keys(r,['identity','remote','selector','commit','provenance']);repository(r.identity);text(r.remote);text(r.selector);
-    if(s.identity.kind!=='git-soul' || !same(r.identity,s.identity.repository) || !/^[a-f0-9]{40}$/.test(r.commit)) fail();
-    if(r.identity.kind==='canonical-remote' && r.identity.remote!==r.remote) fail();
-  }
-  origins(r.provenance);if(!r.provenance.length) fail();return s.alias;
-}
-function context(value) {
-  if(value?.kind==='workspace') {keys(value,['kind','identity','observation']);keys(value.identity,['repository','path']);repository(value.identity.repository);if(value.identity.path!=='oats-workspace.yaml') fail();origin(value.observation);return {kind:'workspace',identity:value.identity};}
-  if(value?.kind==='standalone') {keys(value,['kind','key']);if(value.key!==null) text(value.key);return value;}
-  fail();
-}
-function human(value) {if(value===null) return;keys(value,['provider','id']);text(value.provider);text(value.id);}
-function messaging(value,selectedContext,responsibleHuman) {
-  if(value?.enabled===false) {keys(value,['schemaVersion','enabled']);if(responsibleHuman!==null) fail();}
-  else {
-    keys(value,['schemaVersion','enabled','privateKey','wider','provenance']);if(value.enabled!==true) fail();
-    keys(value.privateKey,['provider','human','context']);capability(value.privateKey.provider);human(value.privateKey.human);
-    if(value.privateKey.human===null || !same(value.privateKey.human,responsibleHuman) || !same(value.privateKey.context,selectedContext) || (selectedContext.kind==='standalone' && selectedContext.key===null)) fail();
-    list(value.wider).forEach(row=>{keys(row,['provider','id']);text(row.id);if(row.provider!==value.privateKey.provider) fail();});
-    for(let i=1;i<value.wider.length;i++) if(Buffer.compare(Buffer.from(canonical(value.wider[i-1])),Buffer.from(canonical(value.wider[i])))>=0) fail();
-    origins(value.provenance);
-  }
-  if(value.schemaVersion!==1) fail();
-}
-function action(value) {
-  if(!obj(value)) fail();
-  if(value.kind==='command') {keys(value,['kind','capability','namespace','name'],['kind','name']);if(Object.hasOwn(value,'capability')===Object.hasOwn(value,'namespace')) fail();if(value.capability!==undefined) capability(value.capability);else text(value.namespace);text(value.name);}
-  else if(value.kind==='hook') {keys(value,['kind','capability','name']);capability(value.capability);text(value.name);}
-  else if(value.kind==='operation') {keys(value,['kind','slot','name']);if(!['knowledge','messaging','tasks'].includes(value.slot)) fail();text(value.name);}
-  else if(['inspect','compose'].includes(value.kind)) keys(value,['kind']);
-  else fail();
-}
-export function assertInvocationBounds(value,limits=INVOCATION_LIMITS) {
-  let entries=0;const active=new Set();
-  const visit=(v,depth)=>{
-    if(v===null || typeof v==='string' || typeof v==='boolean') return;
-    if(typeof v==='number') {if(!Number.isFinite(v)) fail();return;}
-    if(typeof v!=='object' || depth>limits.depth || active.has(v)) fail();
-    if(!Array.isArray(v) && Object.getPrototypeOf(v)!==Object.prototype && Object.getPrototypeOf(v)!==null) fail();
-    active.add(v);for(const child of Object.values(v)) {if(++entries>limits.entries) fail();visit(child,depth+1);}active.delete(v);
-  };
-  visit(value,1);if(Buffer.byteLength(JSON.stringify(value),'utf8')>limits.bytes) fail();
-}
-export function validateInvocationShape(value,expected={}) {
-  assertInvocationBounds(value);keys(value,['schemaVersion','executionBinding','subject','instance','intent','context','responsibleHuman','messagingChoice','capability','action','priorReceipt']);
-  if(value.schemaVersion!==1) fail();keys(value.executionBinding,['schemaVersion','deployment','resolution']);if(value.executionBinding.schemaVersion!==1) fail();absolute(value.executionBinding.deployment);resolution(value.executionBinding.resolution);
-  const alias=subject(value.subject);
-  if(value.instance!==null) {keys(value.instance,['home','work','name','agent','incarnationId']);incarnation(value.instance.incarnationId);absolute(value.instance.home);absolute(value.instance.work);text(value.instance.name);text(value.instance.agent);if(value.instance.agent!==alias || value.instance.work!==join(value.instance.home,'work')) fail();}
-  intent(value.intent,value.instance);
-  const selectedContext=context(value.context);human(value.responsibleHuman);messaging(value.messagingChoice,selectedContext,value.responsibleHuman);capability(value.capability);action(value.action);assertInvocationBounds(value.priorReceipt,PRIOR_RECEIPT_LIMITS);
-  if(value.action.capability!==undefined && value.action.capability!==value.capability) fail();
-  if(value.action.kind==='hook' && value.instance===null) fail();
-  for(const field of ['capability','context','action']) if(Object.hasOwn(expected,field) && !same(value[field],expected[field])) fail();
-  return value;
-}

package/capabilities/oats-aweb/lib/portable-binding.mjs

@@ -1,146 +0,0 @@
-import { validateInvocationShape, sameInvocationJson } from './invocation-shape.mjs';
-export const MESSAGING_CONTRACT='oats.aweb.messaging';
-export const MESSAGING_CONTRACT_VERSION=1;
-export const RESPONSIBLE_HUMAN_KEY='/bindings/messaging/responsibleHuman';
-export const PRIVATE_TEAM_KEY='/bindings/messaging/privateTeam';
-export const WIDER_KEY='/bindings/messaging/wider';
-const CAPABILITY='oats.aweb';
-const identifierPattern=/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,95}$/;
-const obj=value=>value!==null && typeof value==='object' && !Array.isArray(value);
-const clone=value=>JSON.parse(JSON.stringify(value));
-const canonical=value=>value===null || typeof value!=='object'?JSON.stringify(value):Array.isArray(value)?`[${value.map(canonical).join(',')}]`:`{${Object.keys(value).sort().map(key=>`${JSON.stringify(key)}:${canonical(value[key])}`).join(',')}}`;
-const same=(a,b)=>canonical(a)===canonical(b);
-const fail=(code,message)=>{throw Object.assign(new Error(message),{code});};
-function keys(value,allowed,required,label) {
-  if(!obj(value)) fail('invalid-binding',`${label} must be an object`);
-  for(const key of Object.keys(value)) if(!allowed.includes(key)) fail('invalid-binding',`unknown ${label} property: ${key}`);
-  for(const key of required) if(!Object.hasOwn(value,key)) fail('invalid-binding',`${label} requires ${key}`);
-  return value;
-}
-function identifier(value,label='identity') {if(typeof value!=='string' || !identifierPattern.test(value) || ['constructor','__proto__','prototype','toString','valueOf'].includes(value)) fail('invalid-binding',`invalid ${label}`);return value;}
-const pointerKey=value=>String(value).replace(/~/g,'~0').replace(/\//g,'~1');
-export const teamChoiceKey=alias=>`/bindings/messaging/teams/${pointerKey(identifier(alias,'team alias'))}`;
-function originAt(declaration,pointer,kind) {
-  const found=declaration.origins[pointer] ?? declaration.origin;
-  if(!obj(found)) fail('invalid-binding',`missing origin for ${pointer}`);
-  return clone({...found,kind});
-}
-function teamRef(value) {
-  keys(value,['provider','id'],['provider','id'],'aweb team reference');
-  if(value.provider!==CAPABILITY || typeof value.id!=='string' || !/^[^\s:]+:[^\s:]+$/.test(value.id)) fail('invalid-binding','aweb team reference requires provider oats.aweb and canonical team id');
-  return {provider:CAPABILITY,id:value.id};
-}
-function humanRef(value) {
-  keys(value,['provider','id'],['provider','id'],'responsible human');
-  if(value.provider!==CAPABILITY || typeof value.id!=='string' || !value.id.trim()) fail('invalid-binding','responsible human needs a provider-resolvable oats.aweb id');
-  return {provider:CAPABILITY,id:value.id.trim()};
-}
-function exactContext(value) {
-  if(value?.kind==='workspace') {keys(value,['kind','identity','observation'],['kind','identity','observation'],'workspace context');if(!obj(value.identity) || !obj(value.observation)) fail('invalid-binding','workspace context needs qualified identity and observation');return {kind:'workspace',identity:clone(value.identity)};}
-  if(value?.kind==='standalone') {keys(value,['kind','key'],['kind','key'],'standalone context');if(typeof value.key!=='string' || !value.key.trim()) fail('needs-configuration','messaging-enabled standalone preparation needs an explicit context key');return {kind:'standalone',key:value.key.trim()};}
-  fail('invalid-binding','unsupported messaging context');
-}
-function boundContext(value) {
-  if(value?.kind==='workspace') {keys(value,['kind','identity'],['kind','identity'],'bound workspace context');if(!obj(value.identity)) fail('invalid-binding','bound workspace context needs qualified identity');return clone(value);}
-  if(value?.kind==='standalone') {keys(value,['kind','key'],['kind','key'],'bound standalone context');if(typeof value.key!=='string' || !value.key.trim()) fail('invalid-binding','bound standalone context needs an explicit key');return {kind:'standalone',key:value.key.trim()};}
-  fail('invalid-binding','unsupported bound messaging context');
-}
-function declaration(value) {
-  keys(value,['kind','value','origin','origins'],['kind','value','origin','origins'],'messaging declaration');
-  if(!['soul','workspace','adoption','operator'].includes(value.kind) || !obj(value.value) || !obj(value.origin) || !obj(value.origins)) fail('invalid-binding','invalid messaging declaration');
-  return value;
-}
-
-/** Emit messaging provider fields for the kernel's single resolver. Team aliases
- * are availability data; only the explicit operator wider list is consent. */
-export function normalizeMessagingDeclarations({declarations,context}={}) {
-  if(!Array.isArray(declarations)) fail('invalid-binding','messaging declarations must be an array');
-  const exact=exactContext(context),contextOrigin=context?.kind==='workspace'?clone(context.observation):null,requirements=[],candidates=[],teams={},requested=[],requestedOrigins={},aliases={},aliasOrigins={};let soul=null,privatePolicy=false,privatePolicyOrigin=null;
-  for(const raw of declarations) {
-    const item=declaration(raw);
-    // The kernel supplies complete validated source/workspace/operator
-    // declarations, including other providers' fields. Consume only messaging
-    // fields here; do not impose a second closed schema on the whole document.
-    if(item.kind==='soul') {
-      if(soul) fail('requirement-conflict','multiple soul messaging declarations');soul=item;
-      const list=item.value.teams ?? [];
-      if(!Array.isArray(list) || new Set(list).size!==list.length) fail('invalid-binding','soul teams must be a unique array');
-      for(let index=0;index<list.length;index++) {const alias=identifier(list[index],'soul team alias');requested.push(alias);requestedOrigins[alias]=originAt(item,`/teams/${index}`,'soul-requirement');}
-    } else if(item.kind==='workspace') {
-      const value=item.value.teams;if(value===undefined) continue;if(!obj(value)) fail('invalid-binding','workspace teams must be an object');
-      for(const [alias,ref] of Object.entries(value)) {
-        if(alias==='private') {if(ref!=='per-human') fail('invalid-binding','workspace private team policy must be per-human');privatePolicy=true;privatePolicyOrigin=originAt(item,'/teams/private','workspace-default');continue;}
-        const key=teamChoiceKey(alias),origin=originAt(item,`/teams/${pointerKey(alias)}`,'workspace-default');
-        teams[alias]=key;candidates.push({key,kind:'workspace-default',value:teamRef(ref),origin});
-      }
-    } else if(item.kind==='adoption') {
-      const value=item.value.teamAliases;if(value===undefined) continue;if(!obj(value)) fail('invalid-binding','adoption teamAliases must be an object');
-      for(const [source,target] of Object.entries(value)) {
-        identifier(source,'source team alias');identifier(target,'workspace team alias');
-        if(Object.hasOwn(aliases,source) && aliases[source]!==target) fail('requirement-conflict','adoption team aliases have conflicting mappings');
-        aliases[source]=target;aliasOrigins[source]=originAt(item,`/teamAliases/${pointerKey(source)}`,'import-adoption');
-      }
-    } else {
-      const bindings=item.value.bindings;if(bindings===undefined) continue;
-      if(!obj(bindings)) fail('invalid-binding','operator bindings must be an object');
-      if(Object.hasOwn(bindings,'responsibleHuman')) candidates.push({key:RESPONSIBLE_HUMAN_KEY,kind:'operator',value:humanRef(bindings.responsibleHuman),origin:originAt(item,'/bindings/responsibleHuman','operator')});
-      if(Object.hasOwn(bindings,'privateTeam')) candidates.push({key:PRIVATE_TEAM_KEY,kind:'operator',value:teamRef(bindings.privateTeam),origin:originAt(item,'/bindings/privateTeam','operator')});
-      if(Object.hasOwn(bindings,'wider')) {
-        if(!Array.isArray(bindings.wider) || new Set(bindings.wider).size!==bindings.wider.length) fail('invalid-binding','operator wider consent must be a unique array');
-        candidates.push({key:WIDER_KEY,kind:'operator',value:bindings.wider.map(alias=>identifier(alias,'wider team alias')),origin:originAt(item,'/bindings/wider','operator')});
-      }
-    }
-  }
-  if(!soul) fail('needs-configuration','messaging binding needs one soul declaration');
-  if(exact.kind==='workspace' && !privatePolicy) fail('needs-configuration','messaging workspace must declare private: per-human');
-  const rootOrigin=originAt(soul,'','soul-requirement');
-  requirements.push({key:RESPONSIBLE_HUMAN_KEY,kind:'required',origin:rootOrigin},{key:WIDER_KEY,kind:'required',origin:rootOrigin});
-  return {requirements,candidates,model:{contract:MESSAGING_CONTRACT,version:MESSAGING_CONTRACT_VERSION,context:exact,contextOrigin,requested,requestedOrigins,aliases,aliasOrigins,teams,privatePolicy,privatePolicyOrigin}};
-}
-function selected(choices,key,{optional=false}={}) {
-  const choice=choices?.[key];if(!obj(choice) || !Object.hasOwn(choice,'value') || choice.value===null) {if(optional)return null;fail('needs-configuration',key===RESPONSIBLE_HUMAN_KEY?'an explicit responsible-human binding is required':key===WIDER_KEY?'an explicit wider-membership consent list is required':'a selected wider-team binding is required');}return choice;
-}
-
-export function bindMessagingDomain({model,choices}={}) {
-  if(!obj(model) || model.contract!==MESSAGING_CONTRACT || model.version!==MESSAGING_CONTRACT_VERSION) fail('invalid-binding','invalid normalized messaging model');
-  const humanChoice=selected(choices,RESPONSIBLE_HUMAN_KEY),widerChoice=selected(choices,WIDER_KEY),human=humanRef(humanChoice.value);
-  if(!Array.isArray(widerChoice.value) || new Set(widerChoice.value).size!==widerChoice.value.length) fail('invalid-binding','resolved wider consent must be a unique array');
-  const wider=[],provenance=[humanChoice.selectedBy,widerChoice.selectedBy,model.contextOrigin,model.privatePolicyOrigin].filter(obj).map(clone);
-  for(const sourceAlias of widerChoice.value) {
-    identifier(sourceAlias,'wider team alias');if(!model.requested.includes(sourceAlias)) fail('invalid-binding',`wider consent names undeclared soul alias: ${sourceAlias}`);
-    const workspaceAlias=model.aliases[sourceAlias] ?? sourceAlias,key=model.teams[workspaceAlias];if(!key) fail('needs-configuration','a selected wider alias needs an explicit workspace team mapping');
-    const choice=selected(choices,key),ref=teamRef(choice.value);wider.push(ref);if(obj(choice.selectedBy)) provenance.push(clone(choice.selectedBy));
-    if(obj(model.requestedOrigins[sourceAlias])) provenance.push(clone(model.requestedOrigins[sourceAlias]));
-    if(obj(model.aliasOrigins[sourceAlias])) provenance.push(clone(model.aliasOrigins[sourceAlias]));
-  }
-  wider.sort((a,b)=>Buffer.compare(Buffer.from(canonical(a)),Buffer.from(canonical(b))));
-  for(let index=1;index<wider.length;index++) if(same(wider[index-1],wider[index])) fail('invalid-binding','duplicate resolved wider team');
-  const privateChoice=selected(choices,PRIVATE_TEAM_KEY,{optional:true}),privateTeam=privateChoice?teamRef(privateChoice.value):null;if(privateTeam && wider.some(item=>same(item,privateTeam))) fail('invalid-binding','private team cannot also be a wider team');if(obj(privateChoice?.selectedBy)) provenance.push(clone(privateChoice.selectedBy));
-  const unique=[];for(const item of provenance) if(!unique.some(prior=>same(prior,item))) unique.push(item);
-  const privateKey={provider:CAPABILITY,human,context:clone(model.context)};
-  return {payloadContract:MESSAGING_CONTRACT,payloadVersion:MESSAGING_CONTRACT_VERSION,payload:{responsibleHuman:human,context:clone(model.context),privateTeam,wider},credentialRefs:{},provenance:unique,
-    messagingChoice:{schemaVersion:1,enabled:true,privateKey,wider:clone(wider),provenance:clone(unique)}};
-}
-
-export function validateAwebBinding(binding) {
-  keys(binding,['schemaVersion','capability','payloadContract','payloadVersion','payload','credentialRefs','provenance'],['schemaVersion','capability','payloadContract','payloadVersion','payload','credentialRefs','provenance'],'aweb provider binding');
-  if(binding.schemaVersion!==1 || binding.capability!==CAPABILITY || binding.payloadContract!==MESSAGING_CONTRACT || binding.payloadVersion!==MESSAGING_CONTRACT_VERSION || !obj(binding.payload) || !obj(binding.credentialRefs) || !Array.isArray(binding.provenance)) fail('invalid-binding','invalid aweb provider binding');
-  keys(binding.payload,['responsibleHuman','context','privateTeam','wider'],['responsibleHuman','context','privateTeam','wider'],'aweb binding payload');
-  humanRef(binding.payload.responsibleHuman);boundContext(binding.payload.context);if(!Array.isArray(binding.payload.wider)) fail('invalid-binding','aweb wider teams must be an array');
-  const wider=binding.payload.wider.map(teamRef);for(let index=1;index<wider.length;index++) {if(same(wider[index-1],wider[index])) fail('invalid-binding','duplicate aweb wider team');if(Buffer.compare(Buffer.from(canonical(wider[index-1])),Buffer.from(canonical(wider[index])))>0) fail('invalid-binding','aweb wider teams are not canonical');}
-  if(binding.payload.privateTeam!==null) {
-    const privateTeam=teamRef(binding.payload.privateTeam);
-    if(wider.some(team=>same(team,privateTeam))) fail('invalid-binding','private team cannot also be a wider team');
-  }
-  if(Object.keys(binding.credentialRefs).length) fail('invalid-binding','no credential reference shape is supported by this binding version');
-  return binding;
-}
-
-export function validateAwebInvocationContext(value,binding,expected={}) {
-  validateAwebBinding(binding);
-  validateInvocationShape(value,{...expected,capability:CAPABILITY});
-  const selected=value.context.kind==='workspace'?{kind:'workspace',identity:value.context.identity}:value.context;
-  if(value.messagingChoice.enabled!==true || value.messagingChoice.privateKey.provider!==CAPABILITY || !sameInvocationJson(selected,binding.payload.context)
-    || !sameInvocationJson(value.responsibleHuman,binding.payload.responsibleHuman) || !sameInvocationJson(value.messagingChoice.wider,binding.payload.wider)) fail('invalid-binding','invocation contradicts messaging binding');
-  return value;
-}

package/capabilities/oats-aweb/lib/session-readiness.mjs

@@ -1,56 +0,0 @@
-// Capability-owned operational readiness for the existing HOME delivery route.
-// This is not human-account delegation, private-grant proof or model completion.
-import {execFileSync} from 'node:child_process';
-import {isAbsolute,resolve} from 'node:path';
-import {BINDING_WIRE_LIMITS,parseBindingJson} from './binding-wire.mjs';
-import {sameInvocationJson as same} from './invocation-shape.mjs';
-import {validateAwebBinding,validateAwebInvocationContext} from './portable-binding.mjs';
-// 0.24.1 supplies HOME custody; 0.24.2 also ships the required public projection
-// and same-kernel codec CLI locator. Source presence is not a released version.
-export const HOME_ROUTE_KERNEL_FLOOR='0.24.2';
-const obj=v=>v!==null&&typeof v==='object'&&!Array.isArray(v);
-const missing=message=>({status:'needs-configuration',problems:[{code:'needs-configuration',message}]});
-const error=()=>{throw Object.assign(new Error('selected kernel observation unavailable'),{code:'provider-unavailable'});};
-/** Preserve native HOME/profile/auth/Git; remove only the invoking instance's
- * OATS selectors so a read-only query cannot accidentally target its parent. */
-export function kernelQueryEnvironment(inherited){
-  const env={...inherited};
-  for(const key of Object.keys(env))if(/^(OATS_(?!HOME_DIR$)|OAS_|PI_AGENT_)/.test(key)||key==='PI_AGENTS_ROOT')delete env[key];
-  return env;
-}
-export function kernelMeetsHomeRouteFloor(version){
-  if(typeof version!=='string'||!/^\d+\.\d+\.\d+$/.test(version))return false;
-  const parts=version.split('.').map(Number),floor=HOME_ROUTE_KERNEL_FLOOR.split('.').map(Number);if(!parts.every(Number.isSafeInteger))return false;
-  for(let i=0;i<3;i++)if(parts[i]!==floor[i])return parts[i]>floor[i];
-  return true;
-}
-/** Use the caller-owned CLI location, never search PATH or import private kernel
- * indexes. Binding execution must receive the same OATS_CLI_BIN as hooks. */
-export function querySelectedKernel(args,{env=process.env}={}){
-  const cli=env.OATS_CLI_BIN;
-  if(typeof cli!=='string'||!isAbsolute(cli)||resolve(cli)!==cli||cli.includes('\0'))error();
-  let bytes;
-  try{bytes=execFileSync(process.execPath,[cli,...args],{env:kernelQueryEnvironment(env),timeout:10000,maxBuffer:BINDING_WIRE_LIMITS.bytes,stdio:['ignore','pipe','pipe']});}catch{error();}
-  try{return parseBindingJson(bytes,BINDING_WIRE_LIMITS);}catch{error();}
-}
-/** Reads only public version/retained selection. A missing profile projection
- * stays explicit; no source default, mutable home label or runtime guess. */
-export function assessCapturedSessionReadiness({binding,invocation,settings},{query=querySelectedKernel,env=process.env}={}){
-  if(!binding||!invocation)return missing('selected binding and inline captured invocation are required');
-  validateAwebBinding(binding);validateAwebInvocationContext(invocation,binding);
-  if(!invocation.instance)return missing('an explicit captured instance home is required');
-  if(binding.payload.privateTeam===null)return missing('an explicit private-team binding is required');
-  if(settings.delivery!=='session')return missing('captured messaging requires explicit delivery: session');
-  if(binding.payload.wider.length)return missing('selected wider memberships need their explicitly qualified native setup; they were not omitted');
-  let version,observed;
-  try{version=query(['--version','--json'],{env});}catch{return missing('caller-owned OATS_CLI_BIN and readable kernel version are required');}
-  if(version?.schemaVersion!==1||version?.name!=='@awebai/oats'||!kernelMeetsHomeRouteFloor(version.version))return missing('oats >=0.24.2 is required for captured HOME custody and retained runtime inspection');
-  const b=invocation.executionBinding;
-  try{observed=query(['inspect','--deployment',b.deployment,'--resolution',b.resolution.id,'--json'],{env});}catch{return missing('the exact retained runtime profile must be readable');}
-  if(observed?.schemaVersion!==1||observed?.ok!==true||!same(observed.result?.resolution,b.resolution))return missing('the kernel must report the exact retained resolution');
-  const launch=observed.result.launchSelection;
-  if(!obj(launch)||Object.keys(launch).some(k=>!['runtime','model'].includes(k))||!Object.hasOwn(launch,'model')||(launch.model!==null&&(typeof launch.model!=='string'||!launch.model.trim())))return missing('a retained launchSelection runtime/model observation is required');
-  if(launch.runtime==='pi')return missing('Pi strict print does not support session input; retain messaging and configure an input-capable profile');
-  if(!['claude','codex'].includes(launch.runtime))return missing('a supported input-capable ordinary Claude/Codex profile is required');
-  return {status:'ready',problems:[]};
-}

package/capabilities/oats-aweb/lib/wake-receive.mjs

@@ -1,56 +0,0 @@
-// Live receive for joined teams through the host wake broker (oats.aweb 1.15).
-//
-// aw >= 1.36.7 accepts one registration per instance home carrying several
-// broker-owned receive identities (`aw wake register --registration-json -`):
-// - external-session homes (delivery: session): the broker owns every identity;
-//   the primary keeps the runtime controls, joined homes add mail/chat streams;
-// - native homes (delivery: channel): the Claude channel (native-channel) or the
-//   Pi extension (native-pi) keeps the primary identity, and the broker attaches
-//   only the joined homes, disjoint from the primary (aw's mixed mode).
-// A runtime with no native surface (Codex, unknown) is not registered: its
-// joined teams stay poll-only and readiness says so.
-import {realpathSync} from 'node:fs';
-import {resolve} from 'node:path';
-
-const JOINED_EVENT_CLASSES = ['mail', 'chat'];
-
-/** external-session | native-channel | native-pi | null (no broker receive). */
-export function runtimeDeliveryFor({delivery, runtime}) {
-  if (delivery === 'session') return 'external-session';
-  if (runtime === 'claude') return 'native-channel';
-  if (runtime === 'pi') return 'native-pi';
-  return null;
-}
-
-/** The registration document for this home, or null when the home needs none
- *  (native home with no joined team, or a runtime the broker cannot type into).
- *  A session home with no joined team keeps the legacy one-identity register. */
-export function wakeRegistration({home, primaryIdentityHome, delivery, runtime, joined = [], backend}) {
-  const rt = runtimeDeliveryFor({delivery, runtime});
-  if (!rt || !joined.length) return null;
-  const receive = joined.map((j) => ({identity_home: j.identityHome, label: j.label, event_classes: JOINED_EVENT_CLASSES}));
-  const doc = rt === 'external-session'
-    ? {home, delivery: 'session', runtime_delivery: rt, identity_home: primaryIdentityHome, receive_identities: [{identity_home: primaryIdentityHome, label: 'default', controls: true}, ...receive]}
-    : {home, delivery: rt, runtime_delivery: rt, primary_identity_home: primaryIdentityHome, receive_identities: receive};
-  if (backend) doc.backend = backend;
-  return doc;
-}
-
-const canon = (p) => { try { return realpathSync(p); } catch { return resolve(String(p || '')); } };
-
-/** Each joined team's actual receive mode from `aw wake status --json`:
- *  native only when the home is registered with that identity home AND the
- *  host daemon runs; otherwise poll with the reason. */
-export function joinedReceiveModes(status, {home, joined = []}) {
-  const running = status?.daemon_running === true || status?.daemon_version_state === 'reported';
-  const want = canon(home);
-  const row = (Array.isArray(status?.instances) ? status.instances : []).find((i) => i && canon(i.home) === want);
-  const identities = Array.isArray(row?.receive_identities) ? row.receive_identities : [];
-  return joined.map((j) => {
-    const hit = identities.find((r) => r && canon(r.identity_home) === canon(j.identityHome));
-    if (!hit) return {label: j.label, receive: 'poll', reason: row ? 'not-registered-with-broker' : 'home-not-registered'};
-    if (!running) return {label: j.label, receive: 'poll', reason: 'wake-daemon-not-running'};
-    if (hit.stream_error || hit.stream_admitted === false) return {label: j.label, receive: 'poll', reason: 'stream-not-admitted', detail: String(hit.stream_error || hit.stream_phase || 'not admitted').slice(0, 160)};
-    return {label: j.label, receive: 'native', phase: hit.stream_phase || row.phase || 'unknown'};
-  });
-}