@bevel-software/platform-core-backend 0.22.0 → 0.23.0

package/src/modules/write-access/__tests__/write-access.test.ts

@@ -0,0 +1,248 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import express from 'express';
+import type { Server } from 'node:http';
+import type { AddressInfo } from 'node:net';
+import type { Request, Response } from 'express';
+import {
+  alwaysWritable,
+  createWriteAccessRoutes,
+  createWriteGateMiddleware,
+  isAlwaysWritable,
+  READ_ONLY_CODE,
+  type IWriteAccess,
+} from '../write-access.js';
+import { createToolHandlerFactory } from '../../tool-helpers/tool-handler.js';
+import type { ResolveToolContext } from '../../tool-helpers/tool-context.js';
+
+const READ_ONLY_MESSAGE = 'This workspace has 5 people switched on and room for 3.';
+const readOnly: IWriteAccess = { canWrite: async () => ({ ok: false, message: READ_ONLY_MESSAGE }) };
+
+const servers: Server[] = [];
+afterEach(async () => {
+  await Promise.all(servers.splice(0).map((s) => new Promise<void>((resolve) => s.close(() => resolve()))));
+});
+
+async function listen(app: express.Express): Promise<string> {
+  const server = app.listen(0);
+  servers.push(server);
+  await new Promise<void>((resolve) => server.once('listening', () => resolve()));
+  const { port } = server.address() as AddressInfo;
+  return `http://127.0.0.1:${port}`;
+}
+
+describe('isAlwaysWritable', () => {
+  it.each([
+    ['GET', '/api/workspace/w1/file'],
+    ['HEAD', '/api/workspace/w1/file'],
+    ['POST', '/health'],
+    ['POST', '/api/auth/login'],
+    ['POST', '/api/mcp'],
+    ['POST', '/api/mcp/external-api-keys'],
+    ['POST', '/api/agent/tools/write_file'],
+    ['POST', '/api/admin/accounts'],
+    ['POST', '/api/admin/accounts/u1/deactivate'],
+    ['DELETE', '/api/admin/accounts/u1'],
+    ['POST', '/api/sync'],
+    ['POST', '/api/setup/settings'],
+    ['POST', '/api/workspace/w1/access/batch'],
+    ['POST', '/api/workspace/w1/workflow/locks/heartbeat'],
+    ['POST', '/api/events/s1/focus'],
+  ])('lets %s %s through', (method, path) => {
+    expect(isAlwaysWritable(method, path)).toBe(true);
+  });
+
+  it.each([
+    ['PUT', '/api/workspace/w1/file'],
+    ['DELETE', '/api/workspace/w1/file'],
+    ['POST', '/api/workspace/w1/workflow/changes'],
+    ['POST', '/api/workflow/change-requests/7/merge'],
+    ['POST', '/api/workspace/w1/workflow/locks'],
+    ['POST', '/api/plugins'],
+    ['POST', '/api/admin/groups'],
+    // A look-alike of an allowed path is not that path.
+    ['POST', '/api/admin/accountsx'],
+    ['POST', '/api/workspace/w1/access/batch/extra'],
+    // A route nobody listed is refused by default.
+    ['POST', '/api/some-new-route'],
+    // The API root is inside the gated namespace too.
+    ['POST', '/api'],
+  ])('holds %s %s for the port', (method, path) => {
+    expect(isAlwaysWritable(method, path)).toBe(false);
+  });
+
+  it("lets the host's own paths through", () => {
+    expect(isAlwaysWritable('PUT', '/api/cloud/workspace/billing/seats', ['/api/cloud/workspace/billing'])).toBe(true);
+    expect(isAlwaysWritable('PUT', '/api/cloud/workspace/sign-in/domains', ['/api/cloud/workspace/billing'])).toBe(false);
+  });
+});
+
+describe('createWriteGateMiddleware', () => {
+  function appWith(writeAccess: IWriteAccess) {
+    const app = express();
+    app.use(createWriteGateMiddleware(writeAccess));
+    app.all('/{*any}', (_req, res) => {
+      res.json({ reached: true });
+    });
+    return app;
+  }
+
+  it("refuses a change with the port's words and a code the app recognises", async () => {
+    const base = await listen(appWith(readOnly));
+    const res = await fetch(`${base}/api/workspace/w1/file`, { method: 'PUT' });
+    expect(res.status).toBe(403);
+    expect(await res.json()).toEqual({ error: READ_ONLY_MESSAGE, code: READ_ONLY_CODE });
+  });
+
+  /**
+   * The router matches a path whatever its letter case, so the gate has to
+   * read it the same way: here the route is mounted as the server mounts
+   * its own, under `/api`, and a spelling the gate did not recognise as
+   * that namespace would reach it.
+   */
+  it('refuses a change however the path is cased, since the router matches it either way', async () => {
+    const app = express();
+    app.use(createWriteGateMiddleware(readOnly));
+    const routes = express.Router();
+    const wrote = vi.fn();
+    routes.put('/workspace/:id/file', (_req, res) => {
+      wrote();
+      res.json({ wrote: true });
+    });
+    app.use('/api', routes);
+    const base = await listen(app);
+    for (const path of ['/api/workspace/w1/file', '/API/workspace/w1/file', '/Api/Workspace/w1/File']) {
+      const res = await fetch(`${base}${path}`, { method: 'PUT' });
+      expect({ path, status: res.status }).toEqual({ path, status: 403 });
+    }
+    expect(wrote).not.toHaveBeenCalled();
+  });
+
+  it('keeps an open route open however it is cased', async () => {
+    const base = await listen(appWith(readOnly));
+    expect((await fetch(`${base}/API/Auth/login`, { method: 'POST' })).status).toBe(200);
+  });
+
+  it('still serves reads, and the routes that sign people in and manage accounts', async () => {
+    const base = await listen(appWith(readOnly));
+    expect((await fetch(`${base}/api/workspace/w1/file`)).status).toBe(200);
+    expect((await fetch(`${base}/api/auth/login`, { method: 'POST' })).status).toBe(200);
+    expect((await fetch(`${base}/api/admin/accounts/u1/deactivate`, { method: 'POST' })).status).toBe(200);
+  });
+
+  it('does not ask the port about a request it lets through anyway', async () => {
+    const canWrite = vi.fn(readOnly.canWrite);
+    const base = await listen(appWith({ canWrite }));
+    await fetch(`${base}/api/workspace/w1/file`);
+    await fetch(`${base}/api/auth/login`, { method: 'POST' });
+    expect(canWrite).not.toHaveBeenCalled();
+  });
+
+  it('lets a change through while the port says yes', async () => {
+    const base = await listen(appWith({ canWrite: async () => ({ ok: true }) }));
+    expect((await fetch(`${base}/api/workspace/w1/file`, { method: 'PUT' })).status).toBe(200);
+  });
+
+  it('lets a change through when the port itself fails, rather than freezing the workspace', async () => {
+    const base = await listen(appWith({ canWrite: async () => Promise.reject(new Error('billing down')) }));
+    expect((await fetch(`${base}/api/workspace/w1/file`, { method: 'PUT' })).status).toBe(200);
+  });
+
+  it('is a no-op on core, which is always writable', async () => {
+    const base = await listen(appWith(alwaysWritable));
+    expect((await fetch(`${base}/api/workspace/w1/file`, { method: 'PUT' })).status).toBe(200);
+  });
+});
+
+describe('the tool layer', () => {
+  /**
+   * One tool, mounted the way the server mounts it and called over HTTP: a
+   * parsed body, then an auth step that does not wait for anything, then the
+   * handler. A request closes once its body has been read, so only a real
+   * request shows what the handler makes of that.
+   */
+  async function mounted(writeAccess: IWriteAccess, write: boolean) {
+    const resolve = (async () => ({})) as unknown as ResolveToolContext;
+    const handler = vi.fn(async () => ({ done: true }));
+    const closed = { count: 0 };
+    const app = express();
+    app.use(express.json());
+    app.use((req: Request, res: Response, next) => {
+      req.toolAuth = { source: 'external', userId: 'u1', scope: 'write' } as Request['toolAuth'];
+      res.on('close', () => {
+        closed.count += 1;
+      });
+      next();
+    });
+    app.post('/api/agent/tools/a_tool', createToolHandlerFactory(resolve, writeAccess)(handler as never, { write }));
+    const url = `${await listen(app)}/api/agent/tools/a_tool`;
+    const post = (signal?: AbortSignal) =>
+      fetch(url, { method: 'POST', headers: { 'content-type': 'application/json' }, body: '{}', signal });
+    return { post, handler, closed };
+  }
+
+  it('refuses a write tool while the deployment is read-only', async () => {
+    const { post, handler } = await mounted(readOnly, true);
+    const res = await post();
+    expect(res.status).toBe(403);
+    expect(await res.json()).toEqual({ error: READ_ONLY_MESSAGE, code: READ_ONLY_CODE });
+    expect(handler).not.toHaveBeenCalled();
+  });
+
+  /**
+   * The verdict is awaited, and by then the request has closed: its body was
+   * read. Taken for the client leaving, that left every write tool on a
+   * deployment with a port unanswered, for as long as the caller would wait.
+   */
+  it('answers a write tool the port allows, with the client still there', async () => {
+    const { post, handler } = await mounted({ canWrite: async () => ({ ok: true }) }, true);
+    const res = await post();
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({ done: true });
+    expect(handler).toHaveBeenCalledTimes(1);
+  });
+
+  it('does not run a write tool whose client left while the verdict was awaited', async () => {
+    const asked = { count: 0 };
+    let allow: () => void = () => undefined;
+    const { post, handler, closed } = await mounted(
+      {
+        canWrite: () => {
+          asked.count += 1;
+          return new Promise((resolve) => {
+            allow = () => resolve({ ok: true });
+          });
+        },
+      },
+      true,
+    );
+    const leaving = new AbortController();
+    const call = post(leaving.signal).catch(() => undefined);
+    await vi.waitFor(() => expect(asked.count).toBe(1));
+    leaving.abort();
+    await call;
+    await vi.waitFor(() => expect(closed.count).toBe(1));
+    allow();
+    await new Promise((resolve) => setTimeout(resolve, 20));
+    expect(handler).not.toHaveBeenCalled();
+  });
+
+  it('still runs a read tool', async () => {
+    const { post, handler } = await mounted(readOnly, false);
+    expect((await post()).status).toBe(200);
+    expect(handler).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe('GET /write-access', () => {
+  it("says whether the deployment can be changed, and the port's words when not", async () => {
+    const app = express();
+    app.use('/api', createWriteAccessRoutes(readOnly));
+    const base = await listen(app);
+    expect(await (await fetch(`${base}/api/write-access`)).json()).toEqual({ writable: false, message: READ_ONLY_MESSAGE });
+
+    const open = express();
+    open.use('/api', createWriteAccessRoutes(alwaysWritable));
+    const openBase = await listen(open);
+    expect(await (await fetch(`${openBase}/api/write-access`)).json()).toEqual({ writable: true });
+  });
+});

package/src/modules/write-access/write-access.ts

@@ -0,0 +1,153 @@
+import express, { type RequestHandler } from 'express';
+import { logger } from '../../shared/logging.js';
+
+const log = logger('write-access');
+
+/**
+ * Whether the deployment may be CHANGED right now. The seam a host that
+ * sells seats needs for a workspace that has more people on it than its plan
+ * allows: nobody is removed and everyone can still sign in and read, but
+ * nothing can be edited until an admin brings the count down or the plan up
+ * — the way Notion handles a lapsed workspace.
+ *
+ * Core is always writable. The port is asked on every request that would
+ * change something (a mutating HTTP route, a write tool), so a host answers
+ * from something cheap — its own cached view of the plan.
+ */
+export type WriteAccessVerdict = { ok: true } | { ok: false; message: string };
+
+export interface IWriteAccess {
+  canWrite(): Promise<WriteAccessVerdict>;
+  /**
+   * Paths of the host's own routes that must stay usable while the
+   * deployment is read-only — above all, the ones that END it (buying
+   * seats, the billing portal). Matched as prefixes of the request path.
+   */
+  readonly alwaysWritablePaths?: readonly string[];
+}
+
+/** Core's default: always writable. */
+export const alwaysWritable: IWriteAccess = {
+  canWrite: async () => ({ ok: true }),
+};
+
+/** The `code` a refused write answers with, so a client can tell it from a permission error. */
+export const READ_ONLY_CODE = 'workspace_read_only';
+
+const MUTATING_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
+
+/**
+ * The mutating routes that stay open while the deployment is read-only.
+ * EVERY OTHER mutating route under `/api` is refused, so a route added
+ * later is read-only until someone decides otherwise — the safe default for
+ * a list nobody re-reads when adding a route.
+ *
+ * What stays open, and why:
+ *  - Signing in and out of everything: sessions, agent connections and
+ *    their keys. A read-only workspace is still one people read.
+ *  - Account administration: the way an admin brings the number of people
+ *    down. Erasing an account with `removeFromAccess` commits to the
+ *    knowledge base, and that commit is part of the same act.
+ *  - The tool surface: every tool call is judged by the tool layer itself,
+ *    which knows a read tool from a write tool (see `toolHandler`); the MCP
+ *    endpoint only relays to it.
+ *  - Deployment setup, tool secrets and pulling remote changes in: the
+ *    deployment's configuration, not its content, and what an admin needs
+ *    to keep it working.
+ *  - Requests that are POST only because they carry a body: permission
+ *    queries, previews, probes, focus and heartbeat signals, fetching
+ *    remotes, accepting a review baseline. None of them changes content.
+ */
+const ALWAYS_WRITABLE: readonly RegExp[] = [
+  /^\/api\/auth\//,
+  /^\/api\/mcp(\/|$)/,
+  /^\/api\/agent\//,
+  /^\/api\/admin\/accounts(\/|$)/,
+  /^\/api\/admin\/connection-keys\//,
+  /^\/api\/audit\//,
+  /^\/api\/sync(\/|$)/,
+  /^\/api\/setup\//,
+  /^\/api\/secrets\//,
+  /^\/api\/admin\/github-facade\//,
+  /^\/api\/workspace\/[^/]+\/access\/batch$/,
+  /^\/api\/workspace\/[^/]+\/review\/accept$/,
+  /^\/api\/workspace\/[^/]+\/flush$/,
+  /^\/api\/workspace\/[^/]+\/workflow\/refresh-remotes$/,
+  /^\/api\/workspace\/[^/]+\/workflow\/locks\/heartbeat$/,
+  /^\/api\/events\/[^/]+\/focus$/,
+  /^\/api\/tools\/preview$/,
+];
+
+/**
+ * Whether a request may go ahead while the deployment is read-only, without asking.
+ *
+ * Judged on the path in LOWER CASE, because that is how the router reads
+ * it: routes match whatever the letter case, so `/API/workspace/…` reaches
+ * the same handler as `/api/workspace/…`. Judged as written, it would be
+ * outside the gated namespace and walk past the gate.
+ */
+export function isAlwaysWritable(method: string, path: string, hostPaths: readonly string[] = []): boolean {
+  if (!MUTATING_METHODS.has(method.toUpperCase())) return true;
+  const asRouted = path.toLowerCase();
+  if (asRouted !== '/api' && !asRouted.startsWith('/api/')) return true;
+  return (
+    ALWAYS_WRITABLE.some((rule) => rule.test(asRouted)) ||
+    hostPaths.some((prefix) => asRouted.startsWith(prefix.toLowerCase()))
+  );
+}
+
+/**
+ * Refuse every change to the deployment while the port says it is
+ * read-only, with a 403 the app recognises by {@link READ_ONLY_CODE}.
+ * Mounted ahead of every route under `/api`; a request the port is not
+ * asked about costs nothing. A port that fails is treated as writable —
+ * a billing lookup that is down must not freeze every workspace.
+ */
+export function createWriteGateMiddleware(writeAccess: IWriteAccess): RequestHandler {
+  if (writeAccess === alwaysWritable) return (_req, _res, next) => next();
+  return async (req, res, next) => {
+    if (isAlwaysWritable(req.method, req.path, writeAccess.alwaysWritablePaths)) return next();
+    let verdict: WriteAccessVerdict;
+    try {
+      verdict = await writeAccess.canWrite();
+    } catch (err) {
+      log.warn('the write-access port failed; letting the request through:', { err });
+      return next();
+    }
+    if (verdict.ok) return next();
+    res.status(403).json({ error: verdict.message, code: READ_ONLY_CODE });
+  };
+}
+
+/**
+ * The verdict for a write tool, the tool layer's half of the gate: `null`
+ * when it may run, the refusal otherwise. Same failure rule as the HTTP gate.
+ */
+export async function refuseWriteTool(writeAccess: IWriteAccess): Promise<string | null> {
+  if (writeAccess === alwaysWritable) return null;
+  try {
+    const verdict = await writeAccess.canWrite();
+    return verdict.ok ? null : verdict.message;
+  } catch (err) {
+    log.warn('the write-access port failed; letting the tool run:', { err });
+    return null;
+  }
+}
+
+/**
+ * GET /api/write-access — whether the deployment can be changed right now,
+ * and if not, the host's words for why. The app reads it to say so once, in
+ * a banner, instead of letting every save fail on its own.
+ */
+export function createWriteAccessRoutes(writeAccess: IWriteAccess): express.Router {
+  const router = express.Router();
+  router.get('/write-access', async (_req, res) => {
+    try {
+      const verdict = await writeAccess.canWrite();
+      res.json(verdict.ok ? { writable: true } : { writable: false, message: verdict.message });
+    } catch {
+      res.json({ writable: true });
+    }
+  });
+  return router;
+}

package/src/shared/domain-errors.ts

@@ -377,6 +377,37 @@ export class PathNotFoundError extends WorkflowDomainError {
   }
 }
 
+/**
+ * The one sentence every read of a past save answers when that save is not in
+ * the history of the branch being viewed.
+ *
+ * Written once, here, because four surfaces have to give the same answer: the
+ * bytes route (`?ref=`), the patch route (`show-file`), the before/after
+ * contents route (`file-at-change`), and anything later that serves a file at
+ * a commit. A save the history panel listed came off `git log` on this
+ * workspace's own branch, so it can never be refused this way — what this
+ * refuses is a sha from someone else's branch, or one that was invented.
+ */
+export const VERSION_NOT_ON_BRANCH_MESSAGE =
+  "This version is not in this file's history on this branch.";
+
+/**
+ * The caller named a save that is not an ancestor of the branch this
+ * workspace has checked out.
+ *
+ * 404, and DELIBERATELY the same 404 for a sha that exists on another branch
+ * as for one that exists nowhere: telling the two apart would turn the route
+ * into an oracle for "does this commit exist in the repository", which is
+ * exactly the reading a branch-scoped rule exists to prevent.
+ */
+export class VersionNotOnBranchError extends WorkflowDomainError {
+  readonly kind = 'version-not-on-branch' as const;
+  constructor() {
+    super(VERSION_NOT_ON_BRANCH_MESSAGE, 404, { kind: 'version-not-on-branch' });
+    this.name = 'VersionNotOnBranchError';
+  }
+}
+
 /**
  * An archive the caller uploaded that the zip reader cannot open. 422, not
  * 400: the request is well-formed and the path is fine — the BYTES are not a

package/src/shared/git.contract.ts

@@ -209,6 +209,33 @@ export class GitRunError extends Error {
   }
 }
 
+/**
+ * Refuse a `cat-file --batch` spec that is not ONE line.
+ *
+ * `--batch` reads one object name per LINE, so a spec carrying a `\n` is two
+ * requests. For a single-spec read that means git answers about the part
+ * before the break — bytes the caller then presents as the whole path's,
+ * having had its access gates answered about a string that names nothing. For
+ * a batch it is worse: the extra answer shifts every result after it, and a
+ * walk that steps one header at a time hands each caller the object that
+ * belonged to the next one.
+ *
+ * A path is refused a control character long before this — by
+ * `assertValidRelativePath` and by `normalizeWorkspacePath`, which is where
+ * the rule belongs because it protects every route and tool at once. This is
+ * the fence AT the protocol, for a spec assembled from somewhere neither of
+ * those covers (a ref, a branch name, a path from a future caller). Nothing
+ * should ever trip it, so it throws rather than filtering: a request that
+ * cannot be expressed in this protocol has no correct truncation.
+ */
+export function assertOneSpecPerLine(specs: readonly string[]): void {
+  for (const spec of specs) {
+    if (/[\r\n]/.test(spec)) {
+      throw new Error('git cat-file --batch spec contains a line break');
+    }
+  }
+}
+
 /** Whether a failure came from the deadline rather than from git's own answer. */
 export function isGitTimeout(err: unknown): boolean {
   return err instanceof GitRunError && err.timedOut;

package/src/tenancy/__tests__/static-tenant-source.test.ts

@@ -12,7 +12,6 @@ const settings: TenantHostSettings = {
   workspacesRoot: path.resolve('/srv/hexis/workspaces'),
   kbTemplateDir: '/srv/hexis/template',
   gitTimeoutMs: 120_000,
-  ontologySessionBlock: true,
   updateCheckEnabled: false,
   masterKey: 'a-master-key-that-is-long-enough-to-count-as-random',
 };

package/src/tenancy/static-tenant-source.ts

@@ -23,7 +23,6 @@ export interface TenantHostSettings {
   readonly workspacesRoot: string;
   readonly kbTemplateDir: string;
   readonly gitTimeoutMs: number;
-  readonly ontologySessionBlock: boolean;
   readonly updateCheckEnabled: boolean;
   /** See `tenant-secrets.ts`. */
   readonly masterKey: string;
@@ -182,7 +181,6 @@ export function tenantConfigFrom(record: TenantRecord, settings: TenantHostSetti
     gitUsername,
     gitToken: (record.gitToken ?? '').trim(),
     kbTemplateDir: settings.kbTemplateDir,
-    ontologySessionBlock: settings.ontologySessionBlock,
     updateCheckEnabled: settings.updateCheckEnabled,
     allowedEmailDomains,
     trustProxy: settings.trustProxy,
@@ -289,7 +287,6 @@ export function tenantHostEnv(env: NodeJS.ProcessEnv = process.env): TenantHostE
     kbTemplateDir: env.KB_TEMPLATE_DIR || defaultKbTemplateDir(),
     gitTimeoutMs:
       Number.isFinite(gitTimeout) && gitTimeout > 0 && gitTimeout <= MAX_TIMER_MS ? gitTimeout : DEFAULT_GIT_TIMEOUT_MS,
-    ontologySessionBlock: (env.ONTOLOGY_SESSION_BLOCK ?? 'true').trim().toLowerCase() !== 'false',
     updateCheckEnabled: (env.UPDATE_CHECK ?? 'true').trim().toLowerCase() !== 'false',
     idleMinutes: Number.isFinite(idle) && idle > 0 ? idle : 30,
   };

package/dist/modules/workflow/session-ontology.policy.d.ts

@@ -1,52 +0,0 @@
-/**
- * Ontology-session boundary — the PURE decision core (no IO, no DB).
- *
- * Model: each run/session accumulates the SET of named ontologies it has
- * touched (via any read or write). The rule is asymmetric:
- *
- *   READS  — always allowed. A read that touches a named ontology RECORDS it
- *            into the session's touched set (so it can poison later writes).
- *   WRITES — allowed only while the session is confined to a SINGLE named
- *            ontology and the write targets that same ontology. The moment a
- *            session has touched two or more named ontologies (typically by
- *            reading across them), EVERY subsequent write is blocked — "read
- *            across ontologies → you can't write anymore at all."
- *
- * Neutral touches (`ontologyOf` → null: root config, Skills, root-level
- * Knowledge, non-KB) never record and never block. See
- * `docs/rp4-ontology-boundary-plan-v2.md`.
- *
- * `SessionOntologyService` (Postgres-backed) persists the touched set and calls
- * these helpers; this module keeps the rule itself testable in isolation.
- */
-import type { Ontology } from '@bevel-software/platform-shared';
-/** Outcome of a write check against the session's touched-ontology set. */
-export type WriteDecision = {
-    allow: true;
-} | {
-    allow: false;
-    reason: 'multi-ontology' | 'different-ontology';
-    touched: string[];
-    attempted: string;
-};
-/**
- * The set of NAMED ontologies a session has touched after this operation. A
- * neutral operation (`ontology === null`) adds nothing. Pure — returns a new
- * set, never mutates the input.
- */
-export declare function recordTouch(touched: ReadonlySet<string>, ontology: Ontology): Set<string>;
-/**
- * Decide whether a WRITE to `attempted` is allowed given the ontologies the
- * session has already touched (NOT counting this write yet).
- *
- *   - A write to a neutral path (`attempted === null`) is always allowed.
- *   - If the session has already touched two or more named ontologies, the
- *     write is blocked (`multi-ontology`) — reading across ontologies poisoned
- *     the session's write ability.
- *   - If the session has touched exactly one named ontology and it differs from
- *     the write target, the write is blocked (`different-ontology`).
- *   - If the session is unpinned (touched none) or its single touched ontology
- *     equals the target, the write is allowed.
- */
-export declare function decideWrite(touched: ReadonlySet<string>, attempted: Ontology): WriteDecision;
-//# sourceMappingURL=session-ontology.policy.d.ts.map

package/dist/modules/workflow/session-ontology.policy.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"session-ontology.policy.d.ts","sourceRoot":"","sources":["../../../src/modules/workflow/session-ontology.policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAEhE,2EAA2E;AAC3E,MAAM,MAAM,aAAa,GACrB;IAAE,KAAK,EAAE,IAAI,CAAA;CAAE,GACf;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,gBAAgB,GAAG,oBAAoB,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5G;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,CAIzF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,QAAQ,GAAG,aAAa,CAgB5F"}

package/dist/modules/workflow/session-ontology.policy.js

@@ -1,62 +0,0 @@
-/**
- * Ontology-session boundary — the PURE decision core (no IO, no DB).
- *
- * Model: each run/session accumulates the SET of named ontologies it has
- * touched (via any read or write). The rule is asymmetric:
- *
- *   READS  — always allowed. A read that touches a named ontology RECORDS it
- *            into the session's touched set (so it can poison later writes).
- *   WRITES — allowed only while the session is confined to a SINGLE named
- *            ontology and the write targets that same ontology. The moment a
- *            session has touched two or more named ontologies (typically by
- *            reading across them), EVERY subsequent write is blocked — "read
- *            across ontologies → you can't write anymore at all."
- *
- * Neutral touches (`ontologyOf` → null: root config, Skills, root-level
- * Knowledge, non-KB) never record and never block. See
- * `docs/rp4-ontology-boundary-plan-v2.md`.
- *
- * `SessionOntologyService` (Postgres-backed) persists the touched set and calls
- * these helpers; this module keeps the rule itself testable in isolation.
- */
-/**
- * The set of NAMED ontologies a session has touched after this operation. A
- * neutral operation (`ontology === null`) adds nothing. Pure — returns a new
- * set, never mutates the input.
- */
-export function recordTouch(touched, ontology) {
-    const next = new Set(touched);
-    if (ontology !== null)
-        next.add(ontology);
-    return next;
-}
-/**
- * Decide whether a WRITE to `attempted` is allowed given the ontologies the
- * session has already touched (NOT counting this write yet).
- *
- *   - A write to a neutral path (`attempted === null`) is always allowed.
- *   - If the session has already touched two or more named ontologies, the
- *     write is blocked (`multi-ontology`) — reading across ontologies poisoned
- *     the session's write ability.
- *   - If the session has touched exactly one named ontology and it differs from
- *     the write target, the write is blocked (`different-ontology`).
- *   - If the session is unpinned (touched none) or its single touched ontology
- *     equals the target, the write is allowed.
- */
-export function decideWrite(touched, attempted) {
-    if (attempted === null)
-        return { allow: true };
-    // The set of named ontologies the session would span if this write lands.
-    const spanned = new Set(touched);
-    spanned.add(attempted);
-    if (spanned.size <= 1)
-        return { allow: true };
-    // spanned.size >= 2 — the write would put the session across a boundary.
-    const touchedList = [...touched].sort();
-    if (touched.size >= 2) {
-        return { allow: false, reason: 'multi-ontology', touched: touchedList, attempted };
-    }
-    // Exactly one prior ontology, and it isn't the write target.
-    return { allow: false, reason: 'different-ontology', touched: touchedList, attempted };
-}
-//# sourceMappingURL=session-ontology.policy.js.map

package/dist/modules/workflow/session-ontology.policy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"session-ontology.policy.js","sourceRoot":"","sources":["../../../src/modules/workflow/session-ontology.policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AASH;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,OAA4B,EAAE,QAAkB;IAC1E,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,QAAQ,KAAK,IAAI;QAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CAAC,OAA4B,EAAE,SAAmB;IAC3E,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAE/C,0EAA0E;IAC1E,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACjC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAEvB,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAE9C,yEAAyE;IACzE,MAAM,WAAW,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;IACrF,CAAC;IACD,6DAA6D;IAC7D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;AACzF,CAAC"}