@desplega.ai/agent-swarm 1.112.0 → 1.113.0

package/src/http/schedules.ts

@@ -22,6 +22,27 @@ import { json, jsonError } from "./utils";
 
 // ─── Route Definitions ───────────────────────────────────────────────────────
 
+const scheduleUpdateBodySchema = z.object({
+  name: z.string().optional(),
+  description: z.string().optional(),
+  cronExpression: z.string().nullable().optional(),
+  intervalMs: z.number().int().positive().nullable().optional(),
+  taskTemplate: z.string().optional(),
+  taskType: z.string().optional(),
+  tags: z.array(z.string()).optional(),
+  priority: z.number().int().optional(),
+  targetAgentId: z.string().uuid().nullable().optional(),
+  enabled: z.boolean().optional(),
+  timezone: z.string().optional(),
+  model: z.string().nullable().optional(),
+  modelTier: ModelTierSchema.nullable().optional(),
+  nextRunAt: z.string().nullable().optional(),
+  targetType: ScheduledTaskTargetTypeSchema.optional(),
+  workflowId: z.string().uuid().nullable().optional(),
+  scriptName: z.string().nullable().optional(),
+  scriptArgs: z.record(z.string(), z.unknown()).nullable().optional(),
+});
+
 const createSchedule = route({
   method: "post",
   path: "/api/schedules",
@@ -93,6 +114,8 @@ const listSchedules = route({
       .enum(["true", "false"])
       .optional()
       .transform((v) => (v === undefined ? undefined : v === "true")),
+    consecutiveErrorsMin: z.coerce.number().int().min(0).optional(),
+    lastRunStatus: z.enum(["failed", "succeeded"]).optional(),
     /** `full` restores the legacy shape (includes `taskTemplate`); default is slim. */
     fields: z.enum(["full", "slim"]).optional(),
   }),
@@ -121,26 +144,7 @@ const updateSchedule = route({
   summary: "Update a schedule",
   tags: ["Schedules"],
   params: z.object({ id: z.string() }),
-  body: z.object({
-    name: z.string().optional(),
-    description: z.string().optional(),
-    cronExpression: z.string().nullable().optional(),
-    intervalMs: z.number().int().positive().nullable().optional(),
-    taskTemplate: z.string().optional(),
-    taskType: z.string().optional(),
-    tags: z.array(z.string()).optional(),
-    priority: z.number().int().optional(),
-    targetAgentId: z.string().uuid().optional(),
-    enabled: z.boolean().optional(),
-    timezone: z.string().optional(),
-    model: z.string().optional(),
-    modelTier: ModelTierSchema.nullable().optional(),
-    nextRunAt: z.string().nullable().optional(),
-    targetType: ScheduledTaskTargetTypeSchema.optional(),
-    workflowId: z.string().uuid().nullable().optional(),
-    scriptName: z.string().nullable().optional(),
-    scriptArgs: z.record(z.string(), z.unknown()).nullable().optional(),
-  }),
+  body: scheduleUpdateBodySchema,
   responses: {
     200: { description: "Schedule updated" },
     400: { description: "Validation error" },
@@ -149,6 +153,28 @@ const updateSchedule = route({
   },
 });
 
+const patchSchedule = route({
+  method: "patch",
+  path: "/api/schedules/{id}",
+  pattern: ["api", "schedules", null],
+  summary: "Patch a schedule",
+  description:
+    "Partially updates a schedule by shallow-merging provided fields over the existing row.",
+  tags: ["Schedules"],
+  params: z.object({ id: z.string() }),
+  body: scheduleUpdateBodySchema,
+  responses: {
+    200: { description: "Schedule patched" },
+    400: { description: "Validation error" },
+    404: { description: "Schedule not found" },
+    409: { description: "Duplicate name" },
+  },
+  rbac: {
+    ungated:
+      "matches existing schedule update/delete posture: bearer-authenticated agents may manage schedules",
+  },
+});
+
 const deleteSchedule = route({
   method: "delete",
   path: "/api/schedules/{id}",
@@ -182,6 +208,8 @@ export async function handleSchedules(
       workflowId: parsed.query.workflowId,
       scriptName: parsed.query.scriptName,
       hideCompleted: parsed.query.hideCompleted,
+      consecutiveErrorsMin: parsed.query.consecutiveErrorsMin,
+      lastRunStatus: parsed.query.lastRunStatus,
     };
     // List responses default to slim (no full `taskTemplate`); `?fields=full` restores it.
     const schedules =
@@ -387,8 +415,14 @@ export async function handleSchedules(
     return true;
   }
 
-  if (updateSchedule.match(req.method, pathSegments)) {
-    const parsed = await updateSchedule.parse(req, res, pathSegments, queryParams);
+  if (
+    updateSchedule.match(req.method, pathSegments) ||
+    patchSchedule.match(req.method, pathSegments)
+  ) {
+    const routeHandle = updateSchedule.match(req.method, pathSegments)
+      ? updateSchedule
+      : patchSchedule;
+    const parsed = await routeHandle.parse(req, res, pathSegments, queryParams);
     if (!parsed) return true;
     const body = parsed.body as Record<string, unknown>;
     if (parsed.body.model !== undefined || parsed.body.modelTier !== undefined) {

package/src/http/scripts.ts

@@ -27,6 +27,7 @@ import {
   scriptSdkTypesWithGeneratedApis,
   typecheckScript,
 } from "../be/scripts/typecheck";
+import { can } from "../rbac";
 import { extractScriptSignature } from "../scripts-runtime/extract-signature";
 import { runScript } from "../scripts-runtime/loader";
 import {
@@ -96,6 +97,7 @@ const upsertRoute = route({
     400: { description: "Validation or typecheck failure" },
     403: { description: "Global write requires lead agent" },
   },
+  rbac: { permission: "script.global.write" },
 });
 
 const runRoute = route({
@@ -145,6 +147,7 @@ const deleteRoute = route({
     400: { description: "Validation error" },
     403: { description: "Global delete requires lead agent" },
   },
+  rbac: { permission: "script.global.delete" },
 });
 
 const typesRoute = route({
@@ -410,6 +413,21 @@ export async function handleScripts(
     const agent = requireAgent(res, agentId);
     if (!agent) return true;
 
+    // Global-scope writes require lead — the 403 this route has always
+    // documented, enforced since DES-445 slice 1. Agent-scope ops unchanged.
+    if (parsed.body.scope === "global") {
+      const decision = can({
+        principal: { kind: "agent", agentId: agent.id, isLead: agent.isLead },
+        verb: "script.global.write",
+        resource: { kind: "owned", scope: "global" },
+        source: "http",
+      });
+      if (!decision.allow) {
+        jsonError(res, "Global write requires lead agent", 403);
+        return true;
+      }
+    }
+
     const typecheck = typecheckScript(parsed.body.source, { agentId: agent.id });
     if (!typecheck.ok) {
       json(
@@ -712,6 +730,21 @@ export async function handleScripts(
     const agent = requireAgent(res, agentId);
     if (!agent) return true;
 
+    // Global-scope deletes require lead — the 403 this route has always
+    // documented, enforced since DES-445 slice 1. Agent-scope ops unchanged.
+    if (parsed.query.scope === "global") {
+      const decision = can({
+        principal: { kind: "agent", agentId: agent.id, isLead: agent.isLead },
+        verb: "script.global.delete",
+        resource: { kind: "owned", scope: "global" },
+        source: "http",
+      });
+      if (!decision.allow) {
+        jsonError(res, "Global delete requires lead agent", 403);
+        return true;
+      }
+    }
+
     const deleted = deleteScript({
       name: parsed.params.name,
       scope: parsed.query.scope,

package/src/http/workflows.ts

@@ -45,6 +45,12 @@ const listWorkflowsRoute = route({
     "Returns workflows WITHOUT the heavy `definition` (the full DAG) by default — the list view only needs a `nodeCount`, which is included. Pass `fields=full` to restore `definition` + trigger config. Fetch the full workflow via `GET /api/workflows/{id}`.",
   tags: ["Workflows"],
   query: z.object({
+    enabled: z
+      .enum(["true", "false"])
+      .optional()
+      .transform((v) => (v === undefined ? undefined : v === "true")),
+    consecutiveErrorsMin: z.coerce.number().int().min(0).optional(),
+    lastRunStatus: WorkflowRunStatusSchema.optional(),
     /** `full` restores the legacy shape (includes `definition`); default is slim. */
     fields: z.enum(["full", "slim"]).optional(),
   }),
@@ -403,13 +409,18 @@ export async function handleWorkflows(
     const parsed = await listWorkflowsRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed) return true;
     const userId = resolveHttpAuditUserId(req, myAgentId);
+    const filters = {
+      enabled: parsed.query.enabled,
+      consecutiveErrorsMin: parsed.query.consecutiveErrorsMin,
+      lastRunStatus: parsed.query.lastRunStatus,
+    };
     // List responses default to slim (no `definition`); `?fields=full` restores it.
     if (parsed.query.fields === "full") {
-      json(res, withFavoriteFlags(listWorkflows(), { userId, itemType: "workflow" }));
+      json(res, withFavoriteFlags(listWorkflows(filters), { userId, itemType: "workflow" }));
     } else {
       json(
         res,
-        withFavoriteFlags(listWorkflows(undefined, { slim: true }), {
+        withFavoriteFlags(listWorkflows(filters, { slim: true }), {
           userId,
           itemType: "workflow",
         }),

package/src/prompts/base-prompt.ts

@@ -58,8 +58,8 @@ export type BasePromptArgs = {
   traits?: ProviderTraits;
   /**
    * Harness provider for this session. Gates provider-specific prompt blocks
-   * (e.g. the context-mode block is excluded for `pi`, which has no
-   * context-mode MCP wiring yet — deferred to DES-514).
+   * (e.g. the context-mode MCP tool list is excluded for `pi`, which has no
+   * context-mode MCP wiring yet).
    */
   provider?: ProviderName;
   name?: string;
@@ -102,10 +102,11 @@ export const getBasePrompt = async (args: BasePromptArgs): Promise<string> => {
   } else if (role === "lead") {
     compositeEventType = "system.session.lead";
   } else if (args.provider === "pi") {
-    // Pi has no context-mode MCP wiring yet (deferred to DES-514), so it uses a
-    // worker composite that omits the context_mode block to avoid advertising
-    // phantom `ctx_*` tools. All other local providers (claude, codex, opencode)
-    // keep the block via the standard worker composite.
+    // Pi has no context-mode MCP wiring yet, so it uses a worker composite that
+    // omits the context-mode tool list while still including the shared script
+    // rubric and seed-script guidance. All other local providers (claude,
+    // codex, opencode) keep the full context block via the standard worker
+    // composite.
     compositeEventType = "system.session.worker.pi";
   } else {
     compositeEventType = "system.session.worker";

package/src/prompts/session-templates.ts

@@ -392,13 +392,9 @@ Use this to debug issues and propose improvements to your own infrastructure.
 });
 
 registerTemplate({
-  eventType: "system.agent.context_mode",
+  eventType: "system.agent.script_rubric",
   header: "",
   defaultBody: `
-### Context Window Management
-
-You have access to the \`context-mode\` MCP tools (\`batch_execute\`, \`execute\`, \`execute_file\`, \`search\`, \`fetch_and_index\`, \`index\`) which compress tool output to save context window space. For data-heavy operations (web fetches, large file reads, CLI output processing), prefer these over raw Bash/WebFetch to avoid flooding your context window with raw output.
-
 ### Agent Scripts — for bulk, repetitive, or data-heavy work
 
 Use **scripts** (\`script-upsert\` + \`script-run\`) when a task involves repetitive SDK calls, large data processing, or deterministic multi-step pipelines. Scripts run out-of-process and return only their final result.
@@ -407,19 +403,49 @@ Use **scripts** (\`script-upsert\` + \`script-run\`) when a task involves repeti
 
 | Situation | Preferred approach |
 |---|---|
-| 1–10 SDK calls, result fits in context | Direct tool call |
+| 1–10 SDK calls, result fits in context | Direct tool call. Do not script below the ~10-call threshold. |
 | 10+ items, bulk/fan-out SDK ops | **Script** (\`script-run\` with inline source or named) |
 | Heavy data (fetch + parse + transform) | **Script** or \`ctx_*\` (context-mode) |
 | Single expensive web fetch | \`ctx_fetch_and_index\` (context-mode) |
 | Multi-agent fan-out, parallel work, deterministic pipeline | **Workflow** |
 | One-off bash/TS with no reuse needed | \`code-mode run\` (Bash) |
 
+**Script persistence guardrail:** use a named script only when the logic will be invoked ≥2 times by you, another agent, or a workflow. For genuine one-offs, use inline \`script-run\` so the catalog does not accumulate scratch-* auto-saves.
+
+**Worked example:** workflow triage that previously cost ~26 underlying calls can return one ~4.3k-token result in ~13s, a ~90-95% context reduction.
+
 The 5 script tools (\`script-search\`, \`script-run\`, \`script-upsert\`, \`script-delete\`, \`script-query-types\`) are deferred tools. Call ToolSearch to load \`script-upsert\`, \`script-run\`, and \`script-query-types\` before using them.
 
 **Key gotchas:**
 - \`agentId\` IS propagated to scripts via the \`X-Agent-ID\` header.
 - \`taskId\` is NOT propagated to scripts — there is no ambient task context. Pass \`taskId\` explicitly via \`args\` if the script needs to call \`ctx.swarm.task_storeProgress\`.
 - Use \`script-query-types\` to inspect the live \`swarm-sdk.d.ts\` before authoring a complex script.
+- Typed API connections: a lead-registered \`script_connections\` entry exposes a typed \`ctx.api.<slug>.<method>(...)\` client in scripts.
+- \`ctx.api\` clients auto-inject the configured credential at egress, so scripts calling an allow-listed external API should prefer \`ctx.api\` over hand-written \`[REDACTED:<KEY>]\` Authorization headers.
+- Registration is lead-only; workers should document the connection spec and hand it to the lead to register.
+`,
+  variables: [],
+  category: "system",
+});
+
+registerTemplate({
+  eventType: "system.agent.context_mode",
+  header: "",
+  defaultBody: `
+### Context Window Management
+
+You have access to the \`context-mode\` MCP tools (\`batch_execute\`, \`execute\`, \`execute_file\`, \`search\`, \`fetch_and_index\`, \`index\`) which compress tool output to save context window space. For data-heavy operations (web fetches, large file reads, CLI output processing), prefer these over raw Bash/WebFetch to avoid flooding your context window with raw output.
+
+{{@template[system.agent.script_rubric]}}
+
+### Scheduling — Pick the Right targetType
+
+When creating a schedule, match \`targetType\` to the work being fired:
+- Use \`targetType: "workflow"\` with \`workflowId\` when the schedule's only job is to start a workflow.
+- Use \`targetType: "script"\` with \`scriptName\` and optional \`scriptArgs\` when it only needs to run a catalog script.
+- Use \`targetType: "agent-task"\` only when a reasoning agent genuinely needs to be in the loop for judgment, open-ended work, or tool orchestration that is not already captured by a workflow or script.
+
+Do not create an \`agent-task\` schedule whose \`taskTemplate\` just says to trigger a workflow or script. Workflow/script targets dispatch directly; agent-task fields such as \`targetAgentId\`, \`model\`, \`taskTemplate\`, \`priority\`, and \`tags\` do not drive those direct runs, and workflow cooldowns still gate workflow targets.
 `,
   variables: [],
   category: "system",
@@ -680,11 +706,10 @@ registerTemplate({
 });
 
 // Pi-specific worker composite. Identical to `system.session.worker` except it
-// OMITS the `system.agent.context_mode` block — pi has no context-mode MCP
-// wiring yet (deferred to DES-514), so advertising the `ctx_*` tools to pi
-// workers would point at phantom tools. `getBasePrompt` selects this composite
-// when `provider === 'pi'`; all other local providers (claude, codex, opencode)
-// keep the context_mode block via `system.session.worker`.
+// omits only the `system.agent.context_mode` MCP-tool block — pi has no
+// context-mode MCP wiring yet, so advertising the `ctx_*` tools would point at
+// phantom tools. It still includes the shared script rubric and seed-script
+// guidance so pi sessions get the same bulk-work decision policy (DES-514).
 registerTemplate({
   eventType: "system.session.worker.pi",
   header: "",
@@ -694,6 +719,8 @@ registerTemplate({
 {{@template[system.agent.worker]}}
 {{@template[system.agent.filesystem]}}
 {{@template[system.agent.self_awareness]}}
+{{@template[system.agent.script_rubric]}}
+{{@template[system.agent.seed_scripts]}}
 
 {{@template[system.agent.system]}}
 {{@template[system.agent.share_urls]}}

package/src/rbac/can.ts

@@ -0,0 +1,44 @@
+/**
+ * Central authorization engine (DES-445, slice 1).
+ *
+ * `can()` is pure and synchronous: no DB imports, no caching (correctness >
+ * performance — every call evaluates directly). It centralizes the DECISION;
+ * call sites keep their existing denial presentation (MCP soft failures,
+ * HTTP 403 bodies).
+ *
+ * Audit seam: `setAuditSink()` installs a fire-and-forget observer invoked
+ * (sync, exceptions swallowed) on every `can()` call — allow AND deny. The
+ * real batched writer is wired at server boot in increment 2 (Phase 6);
+ * until then the sink stays unset and `can()` still decides correctly.
+ */
+import { LEGACY_POLICY } from "./legacy-policy";
+import type { RbacCheck, RbacDecision } from "./types";
+
+export type AuditSink = (check: RbacCheck, decision: RbacDecision) => void;
+
+let auditSink: AuditSink | null = null;
+
+export function setAuditSink(fn: AuditSink): void {
+  auditSink = fn;
+}
+
+export function clearAuditSink(): void {
+  auditSink = null;
+}
+
+export function can(check: RbacCheck): RbacDecision {
+  const rule = LEGACY_POLICY[check.verb];
+  const decision: RbacDecision = rule.evaluate(check.principal, check.resource)
+    ? { allow: true }
+    : { allow: false, reason: rule.denyReason, missing: check.verb };
+
+  if (auditSink) {
+    try {
+      auditSink(check, decision);
+    } catch {
+      // The audit sink must never break or slow the request path.
+    }
+  }
+
+  return decision;
+}

package/src/rbac/index.ts

@@ -0,0 +1,13 @@
+/**
+ * Public surface of the RBAC module (DES-445).
+ *
+ * Import from here at call sites: `import { can } from "@/rbac"`.
+ */
+
+export type { AuditSink } from "./can";
+export { can, clearAuditSink, setAuditSink } from "./can";
+export type { LegacyRule } from "./legacy-policy";
+export { LEGACY_POLICY, LEGACY_RULES } from "./legacy-policy";
+export type { PermissionVerb } from "./permissions";
+export { PERMISSION_VERBS, PERMISSIONS, PermissionVerbSchema } from "./permissions";
+export type { RbacCheck, RbacDecision, RbacPrincipal, RbacResource } from "./types";

package/src/rbac/legacy-policy.ts

@@ -0,0 +1,185 @@
+/**
+ * Built-in legacy policy (DES-445, slice 1).
+ *
+ * Data-driven rule table reproducing TODAY'S exact inline authorization rules
+ * (research doc §3 / plan Appendix A, verified against HEAD 2026-07-07).
+ * This IS `can()`'s disabled-mode policy — not allow-all. The role engine
+ * (increment 3) replaces the lookup behind the same `can()` signature.
+ *
+ * Every rule is a small pure predicate `(principal, resource) => boolean`.
+ * Compile-time exhaustiveness: `LEGACY_POLICY` must cover every
+ * `PermissionVerb` (enforced via `satisfies`).
+ */
+import type { PermissionVerb } from "./permissions";
+import type { RbacPrincipal, RbacResource } from "./types";
+
+export type LegacyRule = {
+  /** Stable rule identifier — surfaces in audit rows and debug output. */
+  name: string;
+  /** Human-readable reason attached to deny decisions. */
+  denyReason: string;
+  /** Pure predicate — true = allow. Never touches the DB. */
+  evaluate: (principal: RbacPrincipal, resource: RbacResource | undefined) => boolean;
+};
+
+// ── Named rules (research §3 Rule column) ────────────────────────────────────
+
+const leadOnly: LegacyRule = {
+  name: "lead-only",
+  denyReason: "requires lead agent",
+  evaluate: (principal) => principal.kind === "agent" && principal.isLead,
+};
+
+const leadOrTaskCreator: LegacyRule = {
+  name: "lead-or-task-creator",
+  denyReason: "requires lead agent or task creator",
+  evaluate: (principal, resource) => {
+    if (principal.kind !== "agent") return false;
+    if (principal.isLead) return true;
+    return (
+      resource?.kind === "task" &&
+      resource.creatorAgentId != null &&
+      resource.creatorAgentId === principal.agentId
+    );
+  },
+};
+
+const leadOrResourceOwner: LegacyRule = {
+  name: "lead-or-resource-owner",
+  denyReason: "requires lead agent or resource owner",
+  evaluate: (principal, resource) => {
+    if (principal.kind !== "agent") return false;
+    if (principal.isLead) return true;
+    return (
+      resource?.kind === "owned" &&
+      resource.ownerAgentId != null &&
+      resource.ownerAgentId === principal.agentId
+    );
+  },
+};
+
+const leadOrOwnNamespace: LegacyRule = {
+  name: "lead-or-own-namespace",
+  denyReason: "requires lead agent or your own task:agent: namespace",
+  evaluate: (principal, resource) => {
+    if (principal.kind !== "agent") return false;
+    if (principal.isLead) return true;
+    // A blank agent id can never own a namespace — the pre-migration guards
+    // used truthiness (`if (info.agentId && ...)`), so `X-Agent-ID: ""` plus
+    // the literal namespace `task:agent:` must stay denied.
+    return (
+      principal.agentId !== "" &&
+      resource?.kind === "kv-namespace" &&
+      resource.namespace === `task:agent:${principal.agentId}`
+    );
+  },
+};
+
+const anyAuthenticated: LegacyRule = {
+  name: "any-authenticated",
+  denyReason: "requires an authenticated principal",
+  // Reaching can() at all implies the request passed handleCore auth — every
+  // constructed principal counts as authenticated. Unused by any slice-1 verb;
+  // kept because Phase-1 additions and increment 3 need the rule kind.
+  evaluate: () => true,
+};
+
+const requesterOwnsTask: LegacyRule = {
+  name: "requester-owns-task",
+  denyReason: "not the task requester",
+  // Mirrors assertOwnsTask (src/tools/task-tool-ctx.ts): owner contexts
+  // (agent-side and operator calls) always pass; user principals must match
+  // the task's requestedByUserId.
+  evaluate: (principal, resource) => {
+    if (principal.kind !== "user") return true;
+    return resource?.kind === "task" && resource.requestedByUserId === principal.userId;
+  },
+};
+
+// ── Composites (verified against HEAD) ───────────────────────────────────────
+
+/** memory.delete.any — owner OR (lead AND scope=swarm) (src/tools/memory-delete.ts:54-56). */
+const memoryOwnerOrLeadSwarm: LegacyRule = {
+  name: "memory-owner-or-lead-swarm",
+  denyReason: "requires memory owner, or lead agent for swarm-scoped memories",
+  evaluate: (principal, resource) => {
+    if (principal.kind !== "agent" || resource?.kind !== "owned") return false;
+    if (resource.ownerAgentId != null && resource.ownerAgentId === principal.agentId) return true;
+    return principal.isLead && resource.scope === "swarm";
+  },
+};
+
+/**
+ * task.fs.mutate — operator OR user OR lead OR task-assignee OR task-creator
+ * (src/http/fs.ts canMutateTask). Order-independent OR: today's early
+ * operator/user returns short-circuit before agent identity, but no input
+ * satisfies one branch while failing another, so a flat OR is equivalent
+ * (plan Appendix A row 36 note).
+ */
+const taskFsMutate: LegacyRule = {
+  name: "operator-or-user-or-lead-or-task-owner",
+  denyReason: "requires operator, user, lead agent, task assignee, or task creator",
+  evaluate: (principal, resource) => {
+    if (principal.kind === "operator" || principal.kind === "user") return true;
+    if (principal.isLead) return true;
+    if (resource?.kind !== "task") return false;
+    return (
+      (resource.agentId != null && resource.agentId === principal.agentId) ||
+      (resource.creatorAgentId != null && resource.creatorAgentId === principal.agentId)
+    );
+  },
+};
+
+/** All named (non-composite) rule kinds, keyed by identifier. */
+export const LEGACY_RULES = {
+  "lead-only": leadOnly,
+  "lead-or-task-creator": leadOrTaskCreator,
+  "lead-or-resource-owner": leadOrResourceOwner,
+  "lead-or-own-namespace": leadOrOwnNamespace,
+  "any-authenticated": anyAuthenticated,
+  "requester-owns-task": requesterOwnsTask,
+} as const;
+
+// ── Verb → rule table ────────────────────────────────────────────────────────
+
+export const LEGACY_POLICY = {
+  "user.manage": leadOnly,
+  "agent.profile.update.any": leadOnly,
+  "agent.context.read.any": leadOnly,
+  "task.cancel.any": leadOrTaskCreator,
+  "task.read.own": requesterOwnsTask,
+  "task.cancel.own": requesterOwnsTask,
+  "task.action.own": requesterOwnsTask,
+  "task.fs.mutate": taskFsMutate,
+  "memory.learning.inject": leadOnly,
+  "memory.delete.any": memoryOwnerOrLeadSwarm,
+  "channel.delete": leadOnly,
+  "integration.kapso.manage": leadOnly,
+  "integration.slack.post": leadOnly,
+  "integration.slack.read": leadOnly,
+  "integration.slack.thread.start": leadOnly,
+  "integration.slack.upload": leadOnly,
+  "integration.slack.delete": leadOnly,
+  "integration.slack.update": leadOnly,
+  "credential-binding.manage": leadOnly,
+  "script-connection.manage": leadOnly,
+  "config.credential-bindings.write": leadOnly,
+  "config.write.any": leadOnly,
+  "config.delete.any": leadOnly,
+  "config.read.secrets": leadOnly,
+  "skill.create.swarm": leadOnly,
+  "skill.install.any": leadOnly,
+  "skill.install.global": leadOnly,
+  "skill.uninstall.any": leadOnly,
+  "skill.update.any": leadOrResourceOwner,
+  "skill.promote.swarm": leadOnly,
+  "skill.delete.any": leadOrResourceOwner,
+  "mcp-server.create.swarm": leadOnly,
+  "mcp-server.install.any": leadOnly,
+  "mcp-server.uninstall.any": leadOnly,
+  "mcp-server.delete.any": leadOrResourceOwner,
+  "mcp-server.update.any": leadOrResourceOwner,
+  "kv.write.any": leadOrOwnNamespace,
+  "script.global.write": leadOnly,
+  "script.global.delete": leadOnly,
+} as const satisfies Record<PermissionVerb, LegacyRule>;