@coreplane/switchboard 0.0.0 → 1.18.0

package/dist/assets/package.json

@@ -0,0 +1,104 @@
+{
+  "name": "switchboard",
+  "version": "1.18.0",
+  "private": true,
+  "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
+  "license": "Apache-2.0",
+  "homepage": "https://github.com/coreplanelabs/switchboard#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/coreplanelabs/switchboard.git"
+  },
+  "bugs": {
+    "url": "https://github.com/coreplanelabs/switchboard/issues"
+  },
+  "type": "module",
+  "engines": {
+    "node": ">=22"
+  },
+  "main": "dist/index.js",
+  "bin": {
+    "switchboard": "dist/cli.js"
+  },
+  "workspaces": [
+    "web",
+    "docs",
+    "deploy/cloudflare",
+    "deploy/cloudflare-memory",
+    "deploy/cloudflare-resident",
+    "deploy/cloudflare-sandbox",
+    "deploy/cloudflare-docs",
+    "packages/switchboard"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "start": "node dist/index.js",
+    "dev": "tsx src/index.ts",
+    "typecheck": "tsc --noEmit && tsc -p tsconfig.scripts.json",
+    "test": "npm run --silent deploy:gen && vitest run",
+    "cli": "tsx src/cli.ts",
+    "verify": "npm run verify:root && npm run verify --workspaces --if-present && npm run check:site",
+    "verify:root": "npm run check:consistency && npm run typecheck && npm run lint && npm run format:check && npm test && npm run check:dist",
+    "check:consistency": "npm run check:lockfile && npm run check:sandbox-pair && npm run skills:check && npm run licenses:check && npm run docs:check && npm run specs:check && npm run decisions:check && npm run hygiene:check && npm run check:project-facts && npm run agents:check && npm run clock:check && npm run screenshots:check",
+    "ci:gate": "node scripts/ci-gate.mjs",
+    "fix": "npm run docs:gen && npm run agents:gen && npm run clock:gen && npm run hygiene:gen && npm run deploy:gen && npm run skills:sync && npm run lint:fix && npm run format",
+    "deploy:gen": "npm run --silent cli -- deploy init",
+    "deploy:check": "npm run --silent cli -- deploy init --check",
+    "check:lockfile": "node scripts/check-lockfile.mjs",
+    "check:sandbox-pair": "node scripts/check-sandbox-pair.mjs",
+    "check:pr-title": "node scripts/check-pr-title.mjs",
+    "check:project-facts": "node scripts/check-project-facts.mjs",
+    "agents:gen": "tsx scripts/agents-gen.ts",
+    "clock:gen": "tsx scripts/clock-allowlist.mts --write",
+    "clock:check": "tsx scripts/clock-allowlist.mts",
+    "agents:check": "tsx scripts/agents-gen.ts --check",
+    "lint": "eslint .",
+    "lint:fix": "eslint . --fix",
+    "format": "prettier --write .",
+    "format:check": "prettier --check .",
+    "check:dist": "npm run build && node scripts/check-dist.mjs",
+    "check:site": "node scripts/check-site.mjs",
+    "check:image": "npm run check:image --workspaces --if-present",
+    "skills:sync": "tsx scripts/skills-sync.ts",
+    "skills:check": "tsx scripts/skills-sync.ts --check",
+    "licenses:check": "node scripts/licenses-check.mjs",
+    "docs:gen": "tsx scripts/docs-gen.ts",
+    "docs:check": "tsx scripts/docs-gen.ts --check",
+    "specs:check": "node scripts/specs-check.mjs",
+    "specs:coverage": "tsx scripts/specs-coverage.ts",
+    "decisions:check": "tsx scripts/decisions-check.ts",
+    "hygiene:check": "node scripts/public-hygiene.mjs",
+    "hygiene:gen": "node scripts/public-hygiene.mjs --write",
+    "docs:changed": "node scripts/docs-changed.mjs",
+    "deploy:targets": "node scripts/deploy-targets.mjs",
+    "docs:dev": "npm run dev -w docs --",
+    "docs:build": "npm run build -w docs",
+    "web:preview": "tsx scripts/web-preview.ts",
+    "screenshots:gen": "tsx scripts/screenshots.mts",
+    "screenshots:check": "tsx scripts/screenshots.mts --check",
+    "load": "tsx scripts/load.ts"
+  },
+  "dependencies": {
+    "@anthropic-ai/sdk": "^0.124.0",
+    "@slack/bolt": "^5.1.0",
+    "e2b": "^2.46.1",
+    "mdast-util-from-markdown": "^2.0.3",
+    "undici": "^8.10.2",
+    "yaml": "^2.7.0",
+    "zod": "^4.5.4"
+  },
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "@types/node": "^24.0.0",
+    "eslint": "^10.10.0",
+    "eslint-config-prettier": "^10.1.8",
+    "eslint-plugin-vue": "^10.11.0",
+    "globals": "^17.12.0",
+    "prettier": "^3.9.6",
+    "tsx": "^4.23.13",
+    "typescript": "^5.9.3",
+    "typescript-eslint": "^8.69.0",
+    "vitest": "^5.0.0",
+    "vue-eslint-parser": "^10.4.1"
+  }
+}

package/dist/assets/project.json

@@ -0,0 +1,219 @@
+{
+  "$comment": "The one place the project says who it is. Everything that names the project, its home, its docs, or its contact reads this file or is checked against it (npm run check:project-facts). Change a value here and the check names every copy that has to follow.",
+  "name": "switchboard",
+  "displayName": "OpenSwitchboard",
+  "npmPackage": "@coreplane/switchboard",
+  "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
+  "organization": "coreplanelabs",
+  "repository": "https://github.com/coreplanelabs/switchboard",
+  "image": "ghcr.io/coreplanelabs/switchboard",
+  "images": {
+    "bot": "ghcr.io/coreplanelabs/switchboard",
+    "resident": "ghcr.io/coreplanelabs/switchboard-resident",
+    "sandbox": "ghcr.io/coreplanelabs/switchboard-sandbox"
+  },
+  "docs": "https://openswitchboard.dev",
+  "topics": [
+    "ai-agents",
+    "coding-agent",
+    "code-review",
+    "slack-bot",
+    "github-app",
+    "mcp-server",
+    "cloudflare-workers",
+    "llm",
+    "typescript"
+  ],
+  "contact": "dev@coreplane.ai",
+  "steward": {
+    "name": "Coreplane Labs",
+    "url": "https://coreplane.ai"
+  },
+  "commands": {
+    "$comment": "What each root npm script does and when to run it — the source of the Commands table in AGENTS.md (npm run agents:gen). A script without an entry fails agents:check, so a new script cannot ship undocumented.",
+    "verify": {
+      "does": "The whole gate: every root check, every workspace's verify, the site check — exactly what CI runs.",
+      "when": "Before requesting review. ~4 min."
+    },
+    "verify:root": {
+      "does": "The bot package's gate: consistency checks, typecheck, lint, format, tests, dist.",
+      "when": "When only the bot changed."
+    },
+    "check:consistency": {
+      "does": "The sub-second checks that generated and declared things equal the code (lockfile, sandbox pairs, skills, licenses, docs tables, specs, project facts, this table).",
+      "when": "After touching a generated or declared artifact; one CI leg."
+    },
+    "test": {
+      "does": "The whole vitest suite (bot, web, the plain-Node Worker tests) from one entry, after `deploy:gen`.",
+      "when": "Before pushing."
+    },
+    "typecheck": {
+      "does": "TypeScript over the bot and its scripts, no emit.",
+      "when": "After type-level changes; `verify:root` runs it."
+    },
+    "lint": {
+      "does": "ESLint over the whole tree.",
+      "when": "`npm run fix` repairs what it can."
+    },
+    "lint:fix": {
+      "does": "ESLint with autofix.",
+      "when": "Part of `fix`."
+    },
+    "format": {
+      "does": "Prettier over the whole tree (not Markdown).",
+      "when": "Part of `fix`."
+    },
+    "format:check": {
+      "does": "Prettier in check mode.",
+      "when": "Part of `verify:root`."
+    },
+    "fix": {
+      "does": "Regenerates every generated artifact and repairs lint and formatting.",
+      "when": "Before committing; whenever `check:consistency` reports drift."
+    },
+    "build": {
+      "does": "Compiles the bot to `dist/`.",
+      "when": "`check:dist` and the Docker image run it; rarely by hand."
+    },
+    "start": {
+      "does": "Runs the compiled bot from `dist/`.",
+      "when": "Production entry (the container's CMD)."
+    },
+    "dev": {
+      "does": "Runs the bot from source with tsx.",
+      "when": "Local development against a real Slack app."
+    },
+    "cli": {
+      "does": "The operator CLI over the command registry (`-- <group> <verb> …`), plus `ask` to drive the full pipeline without Slack.",
+      "when": "Smoke tests, deploys, config, run history."
+    },
+    "ci:gate": {
+      "does": "Reads the `needs` context of a CI fan-out and passes only when every leg succeeded.",
+      "when": "CI only — the `bot` and `workers` gate jobs."
+    },
+    "check:lockfile": {
+      "does": "Native packages carry Linux x64 and macOS arm64 variants; records mirror their `package.json`.",
+      "when": "After a manifest edit or `npm install`; failures name the fix."
+    },
+    "check:sandbox-pair": {
+      "does": "Each Worker on the `cloudflare/sandbox` image pins `@cloudflare/sandbox` to exactly its Dockerfile tag.",
+      "when": "After bumping either half of a pair."
+    },
+    "check:pr-title": {
+      "does": "Judges one PR title as the changelog line it becomes: grammar, type, scope, the migration note behind `!`.",
+      "when": "`-- \"feat(scope): …\"` before opening a PR; CI's `title` check runs it."
+    },
+    "check:dist": {
+      "does": "Builds, then proves the compiled entry points and the web bundle the image needs exist.",
+      "when": "Part of `verify:root`."
+    },
+    "check:site": {
+      "does": "Every page the dashboard links to is in the built site, and its home page reads `displayName`.",
+      "when": "After a docs change; part of `verify`."
+    },
+    "check:image": {
+      "does": "Builds every Worker's image.",
+      "when": "After touching a Dockerfile; needs Docker. One CI leg per image."
+    },
+    "check:project-facts": {
+      "does": "Every copy of the project's names, repository, docs URL and contact address equals `project.json`; its description, topics and npm package fit their rules.",
+      "when": "After editing `project.json` or a community file; part of `check:consistency`."
+    },
+    "skills:sync": {
+      "does": "Vendors the skills listed in `skills/manifest.yaml`.",
+      "when": "After changing the manifest; part of `fix`."
+    },
+    "skills:check": {
+      "does": "The vendored skills match the manifest byte for byte.",
+      "when": "Part of `check:consistency`."
+    },
+    "licenses:check": {
+      "does": "Every production dependency's license is on the allowlist.",
+      "when": "After adding a dependency."
+    },
+    "docs:gen": {
+      "does": "Writes the generated regions of the reference docs from the command registry.",
+      "when": "After changing a command, flag, route, or config key; part of `fix`."
+    },
+    "docs:check": {
+      "does": "The generated doc regions equal what the code would generate.",
+      "when": "Part of `check:consistency`."
+    },
+    "specs:check": {
+      "does": "Every `file::describe::it` proof in `docs/reference/specs/*.md` names a real test; header paths exist.",
+      "when": "After renaming a test or editing a spec; `-- --fix` makes truncated titles explicit."
+    },
+    "specs:coverage": {
+      "does": "Maps a change's paths to the specs whose `Code`/`Tests` headers cover them, then lists changed source paths no spec covers.",
+      "when": "`-- --changed origin/main...HEAD` before review; `-- --require` fails on an uncovered path (warn-only today); `-- --json` for machines."
+    },
+    "decisions:check": {
+      "does": "Every record under `docs/decisions/` and `docs/plans/` carries a valid `status`, a superseded one names what replaced it, and an accepted record's body is unchanged against `origin/main`.",
+      "when": "Part of `check:consistency`; a failing record is superseded by a new one, never edited."
+    },
+    "hygiene:check": {
+      "does": "The public tree's imprint (company, people, trackers, plan ids, ids, dates) equals the recorded list, which only shrinks.",
+      "when": "Part of `check:consistency`. New hit: rewrite the line or allow it by name in `scripts/public-hygiene.allow`; `-- --list <prefix>` shows the rest."
+    },
+    "hygiene:gen": {
+      "does": "Records the tree's remaining imprint after a scrub; refuses growth unless `-- --force`.",
+      "when": "Part of `fix`; new imprint fails it like `hygiene:check`."
+    },
+    "agents:gen": {
+      "does": "Writes the Commands table in AGENTS.md from `package.json` and this file.",
+      "when": "After adding or changing a script; part of `fix`."
+    },
+    "agents:check": {
+      "does": "AGENTS.md is under its size budget, its Commands table is current, and every root script is described here.",
+      "when": "Part of `check:consistency`."
+    },
+    "clock:gen": {
+      "does": "Regenerates the clock-read allowlist (`src/core/trace/clockAllowlist.json`) from the tree — empty since the ratchet reached zero; a result that is not `{}` names a new direct read.",
+      "when": "Part of `fix`."
+    },
+    "clock:check": {
+      "does": "No production file reads the wall clock directly: the allowlist is empty and the tree agrees.",
+      "when": "Part of `check:consistency`."
+    },
+    "docs:changed": {
+      "does": "Says whether the last push touched the docs or their build (a CI job output).",
+      "when": "CI only — gates the docs deploy."
+    },
+    "deploy:gen": {
+      "does": "Renders each Worker's gitignored `wrangler.jsonc` from its template and the profile in force.",
+      "when": "`test`, each Worker's `verify` and `deploy all` run it; by hand before `wrangler dev`."
+    },
+    "deploy:check": {
+      "does": "The rendered `wrangler.jsonc` files match `deploy:gen`.",
+      "when": "When one looks hand-edited; change the template."
+    },
+    "deploy:targets": {
+      "does": "Which Workers a PR's diff would deploy, as a job summary; on the release PR, a sticky comment.",
+      "when": "CI only — the `deploy targets` job."
+    },
+    "docs:dev": {
+      "does": "Serves the docs site locally with live reload.",
+      "when": "Writing docs; `-- --port <n>` picks the port."
+    },
+    "docs:build": {
+      "does": "Builds the docs site to `docs/.vitepress/dist`.",
+      "when": "Rarely by hand; `verify -w docs` and the docs Worker's deploy run it."
+    },
+    "web:preview": {
+      "does": "Serves the dashboard bundle over fixtures for a visual check.",
+      "when": "After a `web/` change."
+    },
+    "screenshots:gen": {
+      "does": "Renders the dashboard's screenshots from the fixture preview, both themes, and records their inputs' hashes in `docs/public/screenshots/manifest.json`.",
+      "when": "After a `web/` or fixture change, once `screenshots:check` names it; needs `npx playwright-core install chromium`, so it is not part of `fix`."
+    },
+    "screenshots:check": {
+      "does": "The dashboard's source and fixtures still hash to what the screenshots were rendered from — no browser.",
+      "when": "Part of `check:consistency`."
+    },
+    "load": {
+      "does": "Load harness: `-- history|resident|sandbox|e2e|cards|provider`.",
+      "when": "Capacity receipts (docs/reference/specs/load-harness.md)."
+    }
+  }
+}

package/dist/assets/source.json

@@ -0,0 +1,5 @@
+{
+  "version": "1.18.0",
+  "commit": "30eddf412e567d1989a3d01e7f926536dc54d932",
+  "builtAt": "2026-09-10T20:01:13.759Z"
+}

package/dist/assets/src/core/authz/actor.ts

@@ -0,0 +1,100 @@
+import { ALL_GRANTS } from "./grants.js";
+import type { Actor, Grants } from "./types.js";
+
+// Actor resolution — adapters resolve identity, never authority: each adapter
+// proves WHO is asking (a Slack user id, an ingress token's subject, an Access
+// `sub` or service token `common_name`, the local CLI, a schedule registry
+// entry) and hands it here; this module gives it a kind, its
+// platform-namespaced id (invariant 4) and its grants — looked up by id through
+// the one `GrantsLookup` config owns. No decision lives here: nothing below
+// says what an actor MAY do.
+
+/** What an adapter can prove about a caller's surface. */
+export type ActorSurface = "slack" | "http" | "mcp" | "access-browser" | "access-service" | "cli" | "schedule";
+
+export interface ActorInput {
+  surface: ActorSurface;
+  /** The bare subject the surface authenticated: `U…` for Slack, the token's
+   *  `subject`, the Access `sub` / `common_name`, the schedule's `name`. */
+  subjectId: string;
+  /** Where a chat actor is speaking from; both or neither (context, never authority). */
+  channelId?: string;
+  threadKey?: string;
+}
+
+/** `ConfigStore.grantsFor` — or `grantsFor(id, source)` for callers without a store. */
+export type GrantsLookup = (actorId: string) => Grants;
+
+/** The local CLI: one operator at a keyboard, every grant, no config consulted. */
+export const CLI_ACTOR: Actor = Object.freeze({ kind: "user", id: "cli:local", grants: ALL_GRANTS });
+
+/** The one id form per surface. */
+export function actorIdFor(surface: ActorSurface, subjectId: string): string {
+  switch (surface) {
+    case "slack":
+      return `slack:${subjectId}`;
+    case "http":
+      return `http:${subjectId}`;
+    case "mcp":
+      return `mcp:${subjectId}`;
+    case "access-browser":
+      return `access:${subjectId}`;
+    case "access-service":
+      return `access:svc:${subjectId}`;
+    case "cli":
+      return CLI_ACTOR.id;
+    case "schedule":
+      return `schedule:${subjectId}`;
+  }
+}
+
+function kindFor(surface: ActorSurface): Actor["kind"] {
+  switch (surface) {
+    case "slack":
+    case "access-browser":
+    case "cli":
+      return "user";
+    case "http":
+    case "mcp":
+    case "access-service":
+      return "service";
+    case "schedule":
+      return "schedule";
+  }
+}
+
+/** The `Actor` for what an adapter proved: kind from the surface, namespaced
+ *  id, grants from config by that id (the CLI always holds everything), and
+ *  `origin` when the input names both a channel and a thread. */
+export function resolveActor(input: ActorInput, grantsFor: GrantsLookup): Actor {
+  if (input.surface === "cli") return CLI_ACTOR;
+  const id = actorIdFor(input.surface, input.subjectId);
+  const origin =
+    input.channelId !== undefined && input.threadKey !== undefined
+      ? { channelId: input.channelId, threadKey: input.threadKey }
+      : undefined;
+  return { kind: kindFor(input.surface), id, grants: grantsFor(id), ...(origin ? { origin } : {}) };
+}
+
+const CHAT_SURFACES: Readonly<Record<string, ActorSurface>> = {
+  slack: "slack",
+  http: "http",
+  mcp: "mcp",
+  cli: "cli",
+  schedule: "schedule",
+};
+
+/** A chat message's `userId` is already namespaced by its adapter (`slack:U…`,
+ *  `http:<subject>`, `mcp:<subject>`, `cli:local`, `schedule:<name>`): the prefix picks the surface.
+ *  A namespace this module does not know stays a `user` with the id as given —
+ *  its grants are whatever config names for that id, never a guess. */
+export function resolveChatActor(
+  msg: { userId: string; channelId: string; threadKey: string },
+  grantsFor: GrantsLookup,
+): Actor {
+  const colon = msg.userId.indexOf(":");
+  const surface = colon > 0 ? CHAT_SURFACES[msg.userId.slice(0, colon)] : undefined;
+  const origin = { channelId: msg.channelId, threadKey: msg.threadKey };
+  if (surface === undefined) return { kind: "user", id: msg.userId, grants: grantsFor(msg.userId), origin };
+  return resolveActor({ surface, subjectId: msg.userId.slice(colon + 1), ...origin }, grantsFor);
+}

package/dist/assets/src/core/authz/authorize.ts

@@ -0,0 +1,169 @@
+// The ONE decision (docs/decisions/0007-authorization-policy-table.md):
+// `authorize(actor, action, resource)`.
+//
+// Rows for the (action, target) OR; a row's conditions AND; no row → deny.
+// Deny reasons are short machine-readable tokens carrying no resource id or
+// attribute — an audit line may log them, a reply never renders them.
+//
+// Grant arithmetic lives here too. Action grants may be wildcards: `<prefix>:*`
+// covers every action under the prefix (`agent:run:*` ⊇ `agent:run:coding`).
+// Channel and repo sets are literal ids — never wildcarded — so a
+// `channels-in` predicate is always a plain `IN (...)` a store can run.
+
+import { ACTOR_KINDS, POLICY, resolveGrant, ruleTarget } from "./policy.js";
+import { attributesOf, targetOfResource, type ResourceAttributes } from "./resource.js";
+import type { Action, Actor, Condition, Decision, Grants, GrantSet, Resource, Rule } from "./types.js";
+
+// ── grants ───────────────────────────────────────────────────────────────────
+
+/** Does an action grant set hold `action`, literally or through a `<prefix>:*` wildcard? */
+export function hasAction(actions: GrantSet, action: string): boolean {
+  if (actions === "all") return true;
+  if (actions.has(action)) return true;
+  for (let i = action.lastIndexOf(":"); i > 0; i = action.lastIndexOf(":", i - 1)) {
+    if (actions.has(`${action.slice(0, i)}:*`)) return true;
+  }
+  return false;
+}
+
+/** Does a literal id set (channels, repos) hold `id`? */
+export function holds(set: GrantSet, id: string): boolean {
+  return set === "all" || set.has(id);
+}
+
+function intersectSets(a: GrantSet, b: GrantSet, covers: (set: GrantSet, member: string) => boolean): GrantSet {
+  if (a === "all") return b;
+  if (b === "all") return a;
+  const out = new Set<string>();
+  for (const member of a) if (covers(b, member)) out.add(member);
+  for (const member of b) if (covers(a, member)) out.add(member);
+  return out;
+}
+
+/** `a ∩ b`, never a superset of either side. Wildcards intersect by coverage:
+ *  `{agent:run:*} ∩ {agent:run:coding}` is `{agent:run:coding}`. */
+export function intersectGrants(a: Grants, b: Grants): Grants {
+  return {
+    actions: intersectSets(a.actions, b.actions, hasAction),
+    channels: intersectSets(a.channels, b.channels, holds),
+    repos: intersectSets(a.repos, b.repos, holds),
+  };
+}
+
+/** The grants a decision is made against: an actor acting on behalf of a
+ *  principal gets the intersection with that principal's effective grants. */
+export function effectiveGrants(actor: Actor): Grants {
+  return actor.onBehalfOf ? intersectGrants(actor.grants, effectiveGrants(actor.onBehalfOf)) : actor.grants;
+}
+
+/** The identity `is-self` compares against: the root principal of an on-behalf-of chain. */
+export function principalOf(actor: Actor): Actor {
+  let current = actor;
+  while (current.onBehalfOf) current = current.onBehalfOf;
+  return current;
+}
+
+// ── decision ─────────────────────────────────────────────────────────────────
+
+const ALLOW: Decision = Object.freeze({ allow: true });
+
+/** Every deny reason `authorize` can return. */
+export type DenyReason =
+  | "unknown-actor-kind" // actor.kind is outside the vocabulary
+  | "no-rule" // nothing in the table names this action on this resource
+  | "actor-kind" // rows exist, none admits this actor kind
+  | "origin-visibility" // rows exist, none admits the resource's origin visibility
+  | "missing-grant"
+  | "not-member"
+  | "not-self"
+  | "not-owner"
+  | "not-all-channels";
+
+const FAILURE_REASON: Readonly<Record<Condition["kind"], DenyReason>> = {
+  "has-grant": "missing-grant",
+  "member-of": "not-member",
+  "is-self": "not-self",
+  "owner-of": "not-owner",
+  "all-channels": "not-all-channels",
+};
+
+function deny(reason: DenyReason): Decision {
+  return { allow: false, reason };
+}
+
+export function isKnownActorKind(kind: string): boolean {
+  return (ACTOR_KINDS as readonly string[]).includes(kind);
+}
+
+export function evaluateCondition(
+  condition: Condition,
+  grants: Grants,
+  selfId: string,
+  attributes: ResourceAttributes,
+): boolean {
+  switch (condition.kind) {
+    case "has-grant": {
+      const grant = resolveGrant(condition.grant, attributes);
+      return grant !== undefined && hasAction(grants.actions, grant);
+    }
+    case "member-of":
+      // Granted the channel, or the channel is public (a run's stamped
+      // visibility). `unknown` — no stamp, a directory failure — is never
+      // public: fail-closed.
+      return (
+        (attributes.channelId !== undefined && holds(grants.channels, attributes.channelId)) ||
+        attributes.channelVisibility === "public"
+      );
+    case "is-self":
+      return attributes.userId !== undefined && attributes.userId === selfId;
+    case "owner-of":
+      return attributes.repo !== undefined && holds(grants.repos, attributes.repo);
+    case "all-channels":
+      return grants.channels === "all";
+  }
+  return false;
+}
+
+/** Does ONE row allow this actor on this resource? Selectors (`actorKinds`,
+ *  `originVisibility`) are checked as well as the conditions, so a row is
+ *  evaluated exactly as `authorize` would. Exported for the per-row table tests. */
+export function evaluateRule(rule: Rule, actor: Actor, resource: Resource): boolean {
+  if (!isKnownActorKind(actor.kind)) return false;
+  if (ruleTarget(rule) !== targetOfResource(resource)) return false;
+  if (rule.actorKinds && !rule.actorKinds.includes(actor.kind)) return false;
+  const attributes = attributesOf(resource);
+  if (rule.originVisibility && !rule.originVisibility.includes(attributes.visibility)) return false;
+  const grants = effectiveGrants(actor);
+  const selfId = principalOf(actor).id;
+  return rule.when.every((condition) => evaluateCondition(condition, grants, selfId, attributes));
+}
+
+/** `authorize` over an explicit (validated) table. Tests use it to drive
+ *  alternative tables; production code calls `authorize`. */
+export function authorizeWith(rules: readonly Rule[], actor: Actor, action: Action, resource: Resource): Decision {
+  if (!isKnownActorKind(actor.kind)) return deny("unknown-actor-kind");
+  const target = targetOfResource(resource);
+  const named = rules.filter((rule) => rule.action === action && ruleTarget(rule) === target);
+  if (named.length === 0) return deny("no-rule");
+  const forKind = named.filter((rule) => !rule.actorKinds || rule.actorKinds.includes(actor.kind));
+  if (forKind.length === 0) return deny("actor-kind");
+  const attributes = attributesOf(resource);
+  const forOrigin = forKind.filter(
+    (rule) => !rule.originVisibility || rule.originVisibility.includes(attributes.visibility),
+  );
+  if (forOrigin.length === 0) return deny("origin-visibility");
+  const grants = effectiveGrants(actor);
+  const selfId = principalOf(actor).id;
+  let reason: DenyReason | undefined;
+  for (const rule of forOrigin) {
+    const failed = rule.when.find((condition) => !evaluateCondition(condition, grants, selfId, attributes));
+    if (!failed) return ALLOW;
+    reason ??= FAILURE_REASON[failed.kind];
+  }
+  // Unreachable: a row with no failing condition returned above, and every row here has conditions.
+  return deny(reason ?? "no-rule");
+}
+
+export function authorize(actor: Actor, action: Action, resource: Resource): Decision {
+  return authorizeWith(POLICY, actor, action, resource);
+}