@etiquekit/etq 1.0.14 → 1.0.15

package/packages/control/src/workspace/authority.ts

@@ -1,499 +0,0 @@
-import { readFile } from 'node:fs/promises';
-import { extname } from 'node:path';
-import { parse as parseYaml } from 'yaml';
-import { assertSharedMemoryScopeId, assertSharedMemoryText, detectMemoryRiskFlags } from '../memory/sanitize';
-
-type JsonRecord = Record<string, unknown>;
-
-export const WORKSPACE_AUTHORITY_SCHEMAS = ['workspace-authority.v0'] as const;
-export const WORKSPACE_AUTHORITY_MODES = ['personal_local', 'org_remote', 'runtime_cell'] as const;
-export const WORKSPACE_CANONICAL_LOCATIONS = ['local_workspace', 'org_workspace', 'none'] as const;
-export const WORKSPACE_MEMORY_SCOPES = ['org', 'workspace', 'lane', 'seat', 'session'] as const;
-export const WORKSPACE_MEMORY_ACCESS = ['read_only', 'read_write'] as const;
-export const WORKSPACE_MEMORY_MOUNT_MODES = ['filesystem_like', 'context_pack', 'mcp_resource'] as const;
-export const WORKSPACE_MEMORY_WRITE_POLICIES = ['none', 'candidate_only', 'curator_promoted'] as const;
-export const WORKSPACE_CONSOLIDATION_MODES = ['disabled', 'scheduled_rollup', 'async_rollup'] as const;
-export const WORKSPACE_REPLACEMENT_POLICIES = [
-  'creator_only',
-  'explicit_grant',
-  'org_admin_quorum',
-  'board_policy',
-] as const;
-export const WORKSPACE_INITIATION_LEVELS = ['workspace', 'plane'] as const;
-
-export type WorkspaceAuthorityMode = (typeof WORKSPACE_AUTHORITY_MODES)[number];
-export type WorkspaceCanonicalLocation = (typeof WORKSPACE_CANONICAL_LOCATIONS)[number];
-export type WorkspaceMemoryScope = (typeof WORKSPACE_MEMORY_SCOPES)[number];
-export type WorkspaceMemoryAccess = (typeof WORKSPACE_MEMORY_ACCESS)[number];
-export type WorkspaceMemoryMountMode = (typeof WORKSPACE_MEMORY_MOUNT_MODES)[number];
-export type WorkspaceMemoryWritePolicy = (typeof WORKSPACE_MEMORY_WRITE_POLICIES)[number];
-export type WorkspaceConsolidationMode = (typeof WORKSPACE_CONSOLIDATION_MODES)[number];
-export type WorkspaceReplacementPolicy = (typeof WORKSPACE_REPLACEMENT_POLICIES)[number];
-export type WorkspaceInitiationLevel = (typeof WORKSPACE_INITIATION_LEVELS)[number];
-
-export interface WorkspaceCanonicalRefs {
-  ledger_ref?: string;
-  memory_ref?: string;
-  policy_ref?: string;
-  roster_ref?: string;
-  signing_ref?: string;
-}
-
-export interface WorkspaceOwnerRole {
-  role_id: string;
-  occupant_principal: string;
-  grant_ref: string;
-  replacement_policy: WorkspaceReplacementPolicy;
-}
-
-export interface WorkspaceTenancyPolicy {
-  initiation_level: WorkspaceInitiationLevel;
-  initiator_principal: string;
-  verify_before_initiate: boolean;
-  initiator_becomes_owner_role: boolean;
-  workspace_owner_may_delegate: boolean;
-  plane_authority_granted: boolean;
-  host_can_forge_workflow_truth: boolean;
-}
-
-export interface WorkspaceMemoryStore {
-  store_id: string;
-  scope: WorkspaceMemoryScope;
-  access: WorkspaceMemoryAccess;
-  mount_mode: WorkspaceMemoryMountMode;
-  write_policy: WorkspaceMemoryWritePolicy;
-  evidence_required: boolean;
-}
-
-export interface WorkspaceConsolidationPolicy {
-  mode: WorkspaceConsolidationMode;
-  input_stores: string[];
-  output_store: string;
-  mutates_input_store: boolean;
-  output_policy: 'candidate_only' | 'curator_promoted';
-}
-
-export interface WorkspaceAuthorityBoundary {
-  local_workspace_is_canonical: boolean;
-  org_workspace_is_canonical: boolean;
-  runtime_cell_can_mutate_canonical_truth: boolean;
-  creator_is_root_authority: boolean;
-  portal_rbac_is_workflow_authority: boolean;
-  memory_can_authorize_work: boolean;
-}
-
-export interface WorkspaceAuthorityProfile {
-  schema: 'workspace-authority.v0';
-  workspace_id: string;
-  org_id?: string;
-  authority_mode: WorkspaceAuthorityMode;
-  canonical_location: WorkspaceCanonicalLocation;
-  creator_principal: string;
-  owner_role: WorkspaceOwnerRole;
-  tenancy?: WorkspaceTenancyPolicy;
-  canonical_refs: WorkspaceCanonicalRefs;
-  memory_stores: WorkspaceMemoryStore[];
-  consolidation?: WorkspaceConsolidationPolicy;
-  authority_boundary: WorkspaceAuthorityBoundary;
-}
-
-export interface WorkspaceAuthorityValidation {
-  schema: 'workspace-authority-validation.v0';
-  workspace_id: string;
-  org_id?: string;
-  verdict: 'valid';
-  authority_mode: WorkspaceAuthorityMode;
-  canonical_location: WorkspaceCanonicalLocation;
-  creator_is_root_authority: boolean;
-  local_workspace_is_canonical: boolean;
-  org_workspace_is_canonical: boolean;
-  runtime_cell_can_mutate_canonical_truth: boolean;
-  owner_role: {
-    role_id: string;
-    occupant_principal: string;
-    replacement_policy: WorkspaceReplacementPolicy;
-  };
-  tenancy_summary: {
-    initiation_level: WorkspaceInitiationLevel | 'none';
-    initiator_principal: string | null;
-    verify_before_initiate: boolean;
-    plane_authority_granted: boolean;
-    host_can_forge_workflow_truth: boolean;
-    workspace_owner_may_delegate: boolean;
-  };
-  memory_summary: {
-    stores: number;
-    filesystem_like_stores: number;
-    shared_read_write_stores: number;
-    consolidation_mode: WorkspaceConsolidationMode;
-    runner_memory_boundary: 'external_runner_recall_not_etiquette_authority';
-    consolidation_mutates_input_store: boolean;
-  };
-  authority_boundary: WorkspaceAuthorityBoundary;
-}
-
-function isRecord(value: unknown): value is JsonRecord {
-  return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-
-function asRecord(value: unknown, name: string): JsonRecord {
-  if (!isRecord(value)) throw new Error(`${name} must be an object`);
-  return value;
-}
-
-function asString(record: JsonRecord, key: string): string {
-  const value = record[key];
-  if (typeof value !== 'string' || value.trim().length === 0) {
-    throw new Error(`${key} must be a non-empty string`);
-  }
-  return value.trim();
-}
-
-function optionalString(record: JsonRecord, key: string): string | undefined {
-  const value = record[key];
-  if (value === undefined) return undefined;
-  if (typeof value !== 'string' || value.trim().length === 0) {
-    throw new Error(`${key} must be a non-empty string when present`);
-  }
-  return value.trim();
-}
-
-function asBoolean(record: JsonRecord, key: string): boolean {
-  const value = record[key];
-  if (typeof value !== 'boolean') throw new Error(`${key} must be a boolean`);
-  return value;
-}
-
-function asEnum<T extends readonly string[]>(values: T, raw: unknown, key: string): T[number] {
-  if (typeof raw !== 'string' || !(values as readonly string[]).includes(raw)) {
-    throw new Error(`${key} must be one of: ${values.join(', ')}`);
-  }
-  return raw as T[number];
-}
-
-function asStringArray(record: JsonRecord, key: string): string[] {
-  const value = record[key];
-  if (!Array.isArray(value) || value.some((item) => typeof item !== 'string' || item.trim().length === 0)) {
-    throw new Error(`${key} must be a string array`);
-  }
-  return value.map((item) => item.trim());
-}
-
-function assertOpaqueRef(value: string, field: string): void {
-  if (value.length > 160) throw new Error(`${field} must be <= 160 chars`);
-  if (value.startsWith('/') || value.startsWith('\\') || /^[A-Za-z]:[\\/]/.test(value)) {
-    throw new Error(`${field} must be opaque or repo-relative, not a local absolute path`);
-  }
-  if (/[a-z][a-z0-9+.-]*:\/\//i.test(value)) {
-    throw new Error(`${field} must be an opaque ref, not a URL`);
-  }
-  const flags = detectMemoryRiskFlags(value);
-  if (flags.length > 0) {
-    throw new Error(`${field} contains restricted shared content: ${flags.join(', ')}`);
-  }
-}
-
-function assertIdentity(value: string, field: string): void {
-  assertSharedMemoryScopeId(value, field);
-}
-
-function assertTextRef(value: string, field: string): void {
-  assertSharedMemoryText(value, field);
-  assertOpaqueRef(value, field);
-}
-
-async function readStructured(path: string): Promise<unknown> {
-  const raw = await readFile(path, 'utf-8');
-  if (extname(path).toLowerCase() === '.json') return JSON.parse(raw) as unknown;
-  return parseYaml(raw) as unknown;
-}
-
-function parseCanonicalRefs(raw: unknown): WorkspaceCanonicalRefs {
-  const record = asRecord(raw, 'canonical_refs');
-  const refs: WorkspaceCanonicalRefs = {
-    ledger_ref: optionalString(record, 'ledger_ref'),
-    memory_ref: optionalString(record, 'memory_ref'),
-    policy_ref: optionalString(record, 'policy_ref'),
-    roster_ref: optionalString(record, 'roster_ref'),
-    signing_ref: optionalString(record, 'signing_ref'),
-  };
-  for (const [key, value] of Object.entries(refs)) {
-    if (value) assertTextRef(value, `canonical_refs.${key}`);
-  }
-  return refs;
-}
-
-function parseOwnerRole(raw: unknown): WorkspaceOwnerRole {
-  const record = asRecord(raw, 'owner_role');
-  const owner: WorkspaceOwnerRole = {
-    role_id: asString(record, 'role_id'),
-    occupant_principal: asString(record, 'occupant_principal'),
-    grant_ref: asString(record, 'grant_ref'),
-    replacement_policy: asEnum(WORKSPACE_REPLACEMENT_POLICIES, record.replacement_policy, 'owner_role.replacement_policy'),
-  };
-  assertIdentity(owner.role_id, 'owner_role.role_id');
-  assertIdentity(owner.occupant_principal, 'owner_role.occupant_principal');
-  assertTextRef(owner.grant_ref, 'owner_role.grant_ref');
-  return owner;
-}
-
-function parseTenancy(raw: unknown): WorkspaceTenancyPolicy | undefined {
-  if (raw === undefined) return undefined;
-  const record = asRecord(raw, 'tenancy');
-  const tenancy: WorkspaceTenancyPolicy = {
-    initiation_level: asEnum(WORKSPACE_INITIATION_LEVELS, record.initiation_level, 'tenancy.initiation_level') as WorkspaceInitiationLevel,
-    initiator_principal: asString(record, 'initiator_principal'),
-    verify_before_initiate: asBoolean(record, 'verify_before_initiate'),
-    initiator_becomes_owner_role: asBoolean(record, 'initiator_becomes_owner_role'),
-    workspace_owner_may_delegate: asBoolean(record, 'workspace_owner_may_delegate'),
-    plane_authority_granted: asBoolean(record, 'plane_authority_granted'),
-    host_can_forge_workflow_truth: asBoolean(record, 'host_can_forge_workflow_truth'),
-  };
-  assertIdentity(tenancy.initiator_principal, 'tenancy.initiator_principal');
-  return tenancy;
-}
-
-function parseMemoryStores(raw: unknown): WorkspaceMemoryStore[] {
-  if (!Array.isArray(raw) || raw.length === 0) throw new Error('memory_stores must be a non-empty array');
-  return raw.map((item, index) => {
-    const record = asRecord(item, `memory_stores[${index}]`);
-    const store: WorkspaceMemoryStore = {
-      store_id: asString(record, 'store_id'),
-      scope: asEnum(WORKSPACE_MEMORY_SCOPES, record.scope, `memory_stores[${index}].scope`) as WorkspaceMemoryScope,
-      access: asEnum(WORKSPACE_MEMORY_ACCESS, record.access, `memory_stores[${index}].access`) as WorkspaceMemoryAccess,
-      mount_mode: asEnum(WORKSPACE_MEMORY_MOUNT_MODES, record.mount_mode, `memory_stores[${index}].mount_mode`) as WorkspaceMemoryMountMode,
-      write_policy: asEnum(WORKSPACE_MEMORY_WRITE_POLICIES, record.write_policy, `memory_stores[${index}].write_policy`) as WorkspaceMemoryWritePolicy,
-      evidence_required: asBoolean(record, 'evidence_required'),
-    };
-    assertIdentity(store.store_id, `memory_stores[${index}].store_id`);
-    if (store.access === 'read_only' && store.write_policy !== 'none') {
-      throw new Error(`memory_stores[${index}] read_only stores must use write_policy: none`);
-    }
-    if (store.access === 'read_write' && store.write_policy === 'none') {
-      throw new Error(`memory_stores[${index}] read_write stores require candidate_only or curator_promoted write_policy`);
-    }
-    if (store.scope === 'org' && store.access === 'read_write' && store.write_policy !== 'curator_promoted') {
-      throw new Error(`memory_stores[${index}] org shared read_write stores require write_policy: curator_promoted`);
-    }
-    if (store.scope === 'workspace' && store.access === 'read_write' && store.write_policy === 'candidate_only') {
-      throw new Error(`memory_stores[${index}] workspace shared read_write stores require curator_promoted writes`);
-    }
-    if (store.access === 'read_write' && store.evidence_required !== true) {
-      throw new Error(`memory_stores[${index}] read_write stores must require evidence`);
-    }
-    return store;
-  });
-}
-
-function parseConsolidation(raw: unknown, memoryStores: WorkspaceMemoryStore[]): WorkspaceConsolidationPolicy | undefined {
-  if (raw === undefined) return undefined;
-  const record = asRecord(raw, 'consolidation');
-  const policy: WorkspaceConsolidationPolicy = {
-    mode: asEnum(WORKSPACE_CONSOLIDATION_MODES, record.mode, 'consolidation.mode') as WorkspaceConsolidationMode,
-    input_stores: asStringArray(record, 'input_stores'),
-    output_store: asString(record, 'output_store'),
-    mutates_input_store: asBoolean(record, 'mutates_input_store'),
-    output_policy: asEnum(['candidate_only', 'curator_promoted'] as const, record.output_policy, 'consolidation.output_policy'),
-  };
-  const storeIds = new Set(memoryStores.map((store) => store.store_id));
-  for (const storeId of policy.input_stores) {
-    assertIdentity(storeId, 'consolidation.input_stores[]');
-    if (!storeIds.has(storeId)) throw new Error(`consolidation input store is not declared: ${storeId}`);
-  }
-  assertIdentity(policy.output_store, 'consolidation.output_store');
-  if (!storeIds.has(policy.output_store)) throw new Error(`consolidation output store is not declared: ${policy.output_store}`);
-  if (policy.mode !== 'disabled' && policy.input_stores.length === 0) {
-    throw new Error('consolidation input_stores must not be empty unless mode is disabled');
-  }
-  if (policy.mode !== 'disabled' && policy.mutates_input_store !== false) {
-    throw new Error('evidence consolidation must not mutate input memory stores');
-  }
-  const outputStore = memoryStores.find((store) => store.store_id === policy.output_store);
-  if (policy.mode !== 'disabled') {
-    if (!outputStore || outputStore.access !== 'read_write') {
-      throw new Error('consolidation output_store must be read_write');
-    }
-    if (outputStore.write_policy !== policy.output_policy) {
-      throw new Error('consolidation output_policy must match the output store write_policy');
-    }
-  }
-  return policy;
-}
-
-function parseBoundary(raw: unknown): WorkspaceAuthorityBoundary {
-  const record = asRecord(raw, 'authority_boundary');
-  return {
-    local_workspace_is_canonical: asBoolean(record, 'local_workspace_is_canonical'),
-    org_workspace_is_canonical: asBoolean(record, 'org_workspace_is_canonical'),
-    runtime_cell_can_mutate_canonical_truth: asBoolean(record, 'runtime_cell_can_mutate_canonical_truth'),
-    creator_is_root_authority: asBoolean(record, 'creator_is_root_authority'),
-    portal_rbac_is_workflow_authority: asBoolean(record, 'portal_rbac_is_workflow_authority'),
-    memory_can_authorize_work: asBoolean(record, 'memory_can_authorize_work'),
-  };
-}
-
-export function parseWorkspaceAuthorityProfile(value: unknown): WorkspaceAuthorityProfile {
-  const record = asRecord(value, 'workspace_authority');
-  const memoryStores = parseMemoryStores(record.memory_stores);
-  const profile: WorkspaceAuthorityProfile = {
-    schema: asEnum(WORKSPACE_AUTHORITY_SCHEMAS, record.schema, 'schema'),
-    workspace_id: asString(record, 'workspace_id'),
-    org_id: optionalString(record, 'org_id'),
-    authority_mode: asEnum(WORKSPACE_AUTHORITY_MODES, record.authority_mode, 'authority_mode') as WorkspaceAuthorityMode,
-    canonical_location: asEnum(WORKSPACE_CANONICAL_LOCATIONS, record.canonical_location, 'canonical_location') as WorkspaceCanonicalLocation,
-    creator_principal: asString(record, 'creator_principal'),
-    owner_role: parseOwnerRole(record.owner_role),
-    tenancy: parseTenancy(record.tenancy),
-    canonical_refs: parseCanonicalRefs(record.canonical_refs),
-    memory_stores: memoryStores,
-    consolidation: parseConsolidation(record.consolidation, memoryStores),
-    authority_boundary: parseBoundary(record.authority_boundary),
-  };
-  validateWorkspaceAuthorityProfile(profile);
-  return profile;
-}
-
-export async function loadWorkspaceAuthorityProfile(path: string): Promise<WorkspaceAuthorityProfile> {
-  return parseWorkspaceAuthorityProfile(await readStructured(path));
-}
-
-function assertRequiredRefs(profile: WorkspaceAuthorityProfile, required: Array<keyof WorkspaceCanonicalRefs>): void {
-  for (const key of required) {
-    if (!profile.canonical_refs[key]) throw new Error(`canonical_refs.${key} is required for ${profile.authority_mode}`);
-  }
-}
-
-export function validateWorkspaceAuthorityProfile(profile: WorkspaceAuthorityProfile): void {
-  assertIdentity(profile.workspace_id, 'workspace_id');
-  if (profile.org_id) assertIdentity(profile.org_id, 'org_id');
-  assertIdentity(profile.creator_principal, 'creator_principal');
-
-  if (profile.authority_boundary.portal_rbac_is_workflow_authority !== false) {
-    throw new Error('portal RBAC cannot be workflow authority');
-  }
-  if (profile.authority_boundary.memory_can_authorize_work !== false) {
-    throw new Error('memory cannot authorize workflow actions');
-  }
-  if (profile.tenancy) {
-    if (profile.tenancy.initiation_level !== 'workspace') {
-      throw new Error('workspace-authority cannot grant plane provisioning authority');
-    }
-    if (profile.tenancy.initiator_principal !== profile.creator_principal) {
-      throw new Error('tenancy initiator_principal must match creator_principal');
-    }
-    if (profile.tenancy.plane_authority_granted !== false) {
-      throw new Error('workspace provisioning must not grant plane authority');
-    }
-    if (profile.tenancy.host_can_forge_workflow_truth !== false) {
-      throw new Error('workspace host must not be able to forge workflow truth');
-    }
-  }
-
-  if (profile.authority_mode === 'personal_local') {
-    if (profile.canonical_location !== 'local_workspace') {
-      throw new Error('personal_local workspaces require canonical_location: local_workspace');
-    }
-    if (profile.authority_boundary.local_workspace_is_canonical !== true) {
-      throw new Error('personal_local workspaces must mark local_workspace_is_canonical true');
-    }
-    if (profile.authority_boundary.org_workspace_is_canonical !== false) {
-      throw new Error('personal_local workspaces must mark org_workspace_is_canonical false');
-    }
-    if (profile.authority_boundary.runtime_cell_can_mutate_canonical_truth !== false) {
-      throw new Error('runtime cells must not mutate canonical truth');
-    }
-    assertRequiredRefs(profile, ['ledger_ref', 'memory_ref', 'policy_ref', 'roster_ref']);
-  }
-
-  if (profile.authority_mode === 'org_remote') {
-    if (!profile.org_id) throw new Error('org_remote workspaces require org_id');
-    if (!profile.tenancy) throw new Error('org_remote workspaces require tenancy policy');
-    if (profile.tenancy.verify_before_initiate !== true) {
-      throw new Error('org_remote workspace initiation requires verified principal');
-    }
-    if (profile.tenancy.initiator_becomes_owner_role !== true) {
-      throw new Error('org_remote workspace initiator must create the owner role');
-    }
-    if (profile.tenancy.workspace_owner_may_delegate !== true) {
-      throw new Error('org_remote workspace owner role must be delegatable');
-    }
-    if (profile.canonical_location !== 'org_workspace') {
-      throw new Error('org_remote workspaces require canonical_location: org_workspace');
-    }
-    if (profile.authority_boundary.local_workspace_is_canonical !== false) {
-      throw new Error('org_remote local working copies must not be canonical truth');
-    }
-    if (profile.authority_boundary.org_workspace_is_canonical !== true) {
-      throw new Error('org_remote workspaces must mark org_workspace_is_canonical true');
-    }
-    if (profile.authority_boundary.creator_is_root_authority !== false) {
-      throw new Error('org_remote creator is provenance only, not root authority');
-    }
-    if (profile.owner_role.replacement_policy === 'creator_only') {
-      throw new Error('org_remote owner role must be replaceable by org policy');
-    }
-    if (profile.authority_boundary.runtime_cell_can_mutate_canonical_truth !== false) {
-      throw new Error('runtime cells must not mutate canonical truth');
-    }
-    assertRequiredRefs(profile, ['ledger_ref', 'memory_ref', 'policy_ref', 'roster_ref', 'signing_ref']);
-  }
-
-  if (profile.authority_mode === 'runtime_cell') {
-    if (profile.tenancy) throw new Error('runtime_cell profiles must not carry tenancy authority');
-    if (profile.canonical_location !== 'none') {
-      throw new Error('runtime_cell profiles require canonical_location: none');
-    }
-    if (profile.authority_boundary.local_workspace_is_canonical !== false
-      || profile.authority_boundary.org_workspace_is_canonical !== false
-      || profile.authority_boundary.runtime_cell_can_mutate_canonical_truth !== false
-      || profile.authority_boundary.creator_is_root_authority !== false) {
-      throw new Error('runtime_cell profiles must be authority-false');
-    }
-  }
-}
-
-export function validateWorkspaceAuthorityFile(profilePath: string): Promise<WorkspaceAuthorityValidation> {
-  return loadWorkspaceAuthorityProfile(profilePath).then(createWorkspaceAuthorityValidation);
-}
-
-export function createWorkspaceAuthorityValidation(profile: WorkspaceAuthorityProfile): WorkspaceAuthorityValidation {
-  validateWorkspaceAuthorityProfile(profile);
-  const consolidationMode = profile.consolidation?.mode ?? 'disabled';
-  const tenancy = profile.tenancy;
-  return {
-    schema: 'workspace-authority-validation.v0',
-    workspace_id: profile.workspace_id,
-    ...(profile.org_id ? { org_id: profile.org_id } : {}),
-    verdict: 'valid',
-    authority_mode: profile.authority_mode,
-    canonical_location: profile.canonical_location,
-    creator_is_root_authority: profile.authority_boundary.creator_is_root_authority,
-    local_workspace_is_canonical: profile.authority_boundary.local_workspace_is_canonical,
-    org_workspace_is_canonical: profile.authority_boundary.org_workspace_is_canonical,
-    runtime_cell_can_mutate_canonical_truth: profile.authority_boundary.runtime_cell_can_mutate_canonical_truth,
-    owner_role: {
-      role_id: profile.owner_role.role_id,
-      occupant_principal: profile.owner_role.occupant_principal,
-      replacement_policy: profile.owner_role.replacement_policy,
-    },
-    tenancy_summary: {
-      initiation_level: tenancy?.initiation_level ?? (profile.authority_mode === 'runtime_cell' ? 'none' : 'workspace'),
-      initiator_principal: tenancy?.initiator_principal ?? (profile.authority_mode === 'runtime_cell' ? null : profile.creator_principal),
-      verify_before_initiate: tenancy?.verify_before_initiate ?? (profile.authority_mode === 'org_remote'),
-      plane_authority_granted: tenancy?.plane_authority_granted ?? false,
-      host_can_forge_workflow_truth: tenancy?.host_can_forge_workflow_truth ?? false,
-      workspace_owner_may_delegate: tenancy?.workspace_owner_may_delegate ?? (profile.owner_role.replacement_policy !== 'creator_only'),
-    },
-    memory_summary: {
-      stores: profile.memory_stores.length,
-      filesystem_like_stores: profile.memory_stores.filter((store) => store.mount_mode === 'filesystem_like').length,
-      shared_read_write_stores: profile.memory_stores.filter((store) => (
-        store.access === 'read_write' && (store.scope === 'org' || store.scope === 'workspace')
-      )).length,
-      consolidation_mode: consolidationMode,
-      runner_memory_boundary: 'external_runner_recall_not_etiquette_authority',
-      consolidation_mutates_input_store: profile.consolidation?.mutates_input_store ?? false,
-    },
-    authority_boundary: profile.authority_boundary,
-  };
-}

package/packages/protocol/src/guards.ts

@@ -1,119 +0,0 @@
-import {
-  ACTOR_KINDS,
-  PACKET_STATES,
-  SCRUTINY_STATES,
-  SLICE_STATES,
-  TASK_STATES,
-  type ProjectManifest,
-  type Slice,
-  type SliceState,
-  type SliceTask,
-  type SliceTaskBlueprint,
-  type Surface,
-  type TaskState,
-} from './types';
-
-function assertMember<T extends string>(name: string, value: string, allowed: readonly T[]): T {
-  if (!allowed.includes(value as T)) {
-    throw new Error(`invalid ${name}: ${value}`);
-  }
-  return value as T;
-}
-
-export function assertSliceState(value: string): SliceState {
-  return assertMember('slice_state', value, SLICE_STATES);
-}
-
-export function assertTaskState(value: string): TaskState {
-  return assertMember('task_state', value, TASK_STATES);
-}
-
-export function assertPacketState(value: string) {
-  return assertMember('packet_state', value, PACKET_STATES);
-}
-
-export function assertScrutinyState(value: string) {
-  return assertMember('scrutiny_state', value, SCRUTINY_STATES);
-}
-
-export function assertSurface(value: string): Surface {
-  if (!value.trim()) {
-    throw new Error('invalid surface: empty');
-  }
-  return value;
-}
-
-export function assertActorKind(value: string) {
-  return assertMember('actor_kind', value, ACTOR_KINDS);
-}
-
-export function validateTask(task: SliceTask): void {
-  assertTaskState(task.state);
-  assertSurface(task.surface);
-  if (task.bounds.repoRoots.length === 0) {
-    throw new Error(`task ${task.taskId} must declare at least one repo root`);
-  }
-  if (task.bounds.ownedPaths.length === 0) {
-    throw new Error(`task ${task.taskId} must declare owned paths`);
-  }
-}
-
-export function validateSlice(slice: Slice): void {
-  assertSliceState(slice.state);
-  if (!slice.scrutinyId) {
-    throw new Error(`slice ${slice.sliceId} missing scrutinyId`);
-  }
-  const seen = new Set<string>();
-  for (const task of slice.tasks) {
-    validateTask(task);
-    if (seen.has(task.taskId)) {
-      throw new Error(`duplicate taskId: ${task.taskId}`);
-    }
-    seen.add(task.taskId);
-  }
-}
-
-function validateSurfaceDefaults(manifest: ProjectManifest): void {
-  const entries = Object.entries(manifest.surfaces);
-  if (entries.length === 0) {
-    throw new Error('project manifest must declare at least one surface');
-  }
-  for (const [surface, value] of entries) {
-    assertSurface(surface);
-    if (!value.owner || !value.workerRole || !value.worktreeTemplate) {
-      throw new Error(`surface ${surface} missing owner/workerRole/worktreeTemplate`);
-    }
-    if (!manifest.workerScripts[surface]) {
-      throw new Error(`surface ${surface} missing worker script`);
-    }
-  }
-}
-
-function validateSliceBlueprint(task: SliceTaskBlueprint, surface: Surface): void {
-  if (!task.title || !task.summary) {
-    throw new Error(`slice task ${surface} must define title and summary`);
-  }
-}
-
-export function validateProjectManifest(manifest: ProjectManifest): void {
-  if (manifest.schemaVersion !== 'discipline-project.v1') {
-    throw new Error(`unsupported project manifest schema: ${manifest.schemaVersion}`);
-  }
-  if (!manifest.projectRoot || !manifest.handshakeStorePath) {
-    throw new Error('project manifest missing projectRoot or handshakeStorePath');
-  }
-  validateSurfaceDefaults(manifest);
-  for (const [sliceId, slice] of Object.entries(manifest.slices)) {
-    if (!slice.scrutinyId || !slice.title || !slice.objective) {
-      throw new Error(`slice ${sliceId} missing title/objective/scrutinyId`);
-    }
-    for (const [surface, task] of Object.entries(slice.tasks)) {
-      if (!task) continue;
-      const resolvedSurface = assertSurface(surface);
-      if (!manifest.surfaces[resolvedSurface]) {
-        throw new Error(`slice ${sliceId} references unknown surface ${resolvedSurface}`);
-      }
-      validateSliceBlueprint(task, resolvedSurface);
-    }
-  }
-}