@huynle/hub 0.8.1 → 0.8.3

package/src/central/agent/acting-routes.ts

@@ -1,6 +1,6 @@
 // The act verbs on /api/agent (design §5, §8; decision wvqeuis0): thin HTTP over the acting engine (acting.ts).
 //
-//   POST /api/agent/sessions/:addr/approve {requestID, always?, why?}
+//   POST /api/agent/sessions/:addr/approve {requestID, always?, why?, recommend?}   recommend: a Concierge advises it (R-03)
 //   POST /api/agent/sessions/:addr/deny    {requestID, why?}               why → the harness, with who denied it
 //   POST /api/agent/sessions/:addr/answer  {formID, answer | cancel: true, why?}
 //   POST /api/agent/sessions/:addr/prompt  {text, images? (users), delivery? "queue"|"steer", wake?, why?}
@@ -65,7 +65,8 @@ export function actingRoutes(acting: Acting): AgentRoute[] {
       async handle({ request, params, actor, user }) {
         const body = await bodyOf(request)
         const always = flag(body, "always")
-        return ok(await acting.approve({ actor, userID: user.id }, params.addr!, { requestID: id(body, "requestID"), ...(always ? { always } : {}), ...why(body) }))
+        const recommend = flag(body, "recommend")
+        return ok(await acting.approve({ actor, userID: user.id }, params.addr!, { requestID: id(body, "requestID"), ...(always ? { always } : {}), ...(recommend ? { recommend } : {}), ...why(body) }))
       },
     },
     {

package/src/central/agent/acting.ts

@@ -16,6 +16,9 @@
 //     {verdict, reason, tier, grants}. The `escalate` hook (P3-T8 turns it into a Decision) gets the escalation
 //     first; a request without parsed details, or truncated, is always needs_user (tap).
 //   · deny, answer, prompt and stop need only the grant's verb (a reject is always safe).
+//   · (R-03) the CURRENT Concierge session's approve without any usable grant is needs_user too (a Decision at the hub's tier;
+//     the hub's never rules still forbid; self-tree still applies), never a bare refusal; other agents stay forbidden.
+//     A Concierge escalation recommends approve only when it passed `recommend: true`.
 // - Every outcome after the address resolves is in the agent audit: decision (allow, needs_user, forbidden,
 //   paused, rate_limited) and outcome (ok, gone, offline, unsupported, escalated, refused, failed).
 // - Races: the request answered elsewhere first is gone (410).
@@ -83,8 +86,12 @@ export interface Escalation {
   readonly request?: PermissionRequest
   readonly always: boolean
   readonly evaluation: Evaluation
-  /** The agent's reason (`--why`): its recommendation to approve. */
+  /** The agent's reason (`--why`): its recommendation to approve (a Concierge's: only with `recommend`). */
   readonly why?: string
+  /** (R-03) The actor is a Concierge session: its escalation recommends approve only with `recommend`. */
+  readonly concierge?: true
+  /** (R-03) The Concierge itself advises approving (absent: the user only asked it to try). */
+  readonly recommend?: true
 }
 
 /** The escalation hook: answers the Decision it opened (or nothing); a throw only loses the Decision. */
@@ -111,11 +118,18 @@ export interface ActingDeps {
    * "always", even inside its grant: needs_user, a tap Decision. A failed read counts as yes (fail closed).
    */
   readonly conciergeActor?: (userID: string, sessionID: string) => Promise<boolean>
+  /**
+   * (R-03 verify) Whether the acting session is the user's CURRENT Concierge session (never a retired one). Only it
+   * may escalate an approve without a grant; a failed read counts as no (fail closed: refused).
+   */
+  readonly currentConcierge?: (userID: string, sessionID: string) => Promise<boolean>
 }
 
 /** (CON-13 decision) Why the Concierge escalates a covered request. */
 export const CONCIERGE_TAP_REASON = "Shell, outside folders and tools always need the user's tap"
 export const CONCIERGE_ALWAYS_REASON = "The Concierge never answers “always”: the user decides"
+/** (R-03) Why the Concierge escalates an approval it holds no grant for. */
+export const CONCIERGE_NO_GRANT_REASON = "No grant lets it approve here: the user decides"
 
 /** Who acts, for which user. */
 export interface Caller {
@@ -127,6 +141,8 @@ export interface ApproveInput {
   readonly requestID: string
   readonly always?: boolean
   readonly why?: string
+  /** (R-03) The Concierge advises approving: its escalation recommends approve (other agents' why always does). */
+  readonly recommend?: boolean
 }
 
 export interface Approved {
@@ -282,6 +298,17 @@ function neverForms(request: PermissionRequest): PermissionRequest[] {
 
 const patterns = (texts: readonly string[]): Pattern[] => texts.flatMap((t) => parsePattern(t) ?? [])
 
+/** Forbidden when a never rule (the hub's, or a usable grant's) matches the request as asked or normalised (saves too, for always). */
+function checkNever(request: PermissionRequest, rules: ReadonlyArray<{ grant: Grant; never: Pattern[] }>, hubNever: readonly Pattern[], always: boolean): void {
+  const sets = rules.length ? rules.map((r) => ({ id: r.grant.id, never: r.never })) : [{ id: undefined, never: [] as Pattern[] }]
+  for (const form of neverForms(request)) {
+    for (const { id, never } of sets) {
+      const verdict = evaluatePermission(form, { grant: { allow: [], never }, hubNever, always, allowAlways: true })
+      if (verdict.verdict === "never") throw forbidden(`never: ${verdict.by === "hub" ? "the hub's" : `grant ${id}'s`} rule ${formatPattern(verdict.pattern)} matches ${verdict.subject}`)
+    }
+  }
+}
+
 const invalid = (message: string) => new AgentError("invalid", message)
 const forbidden = (message: string) => new AgentError("forbidden", message)
 const offline = () => new AgentError("offline", "No spoke reports this session now")
@@ -303,6 +330,8 @@ export class Acting {
     const concierge = await this.isConcierge(caller)
     return this.act(caller, "approve", target, { requestID: input.requestID }, input.why, {
       selfTree: true,
+      // (R-03) The Concierge without a grant escalates (needs_user, a Decision) instead of being refused.
+      ...(concierge ? { withoutGrant: () => this.isCurrentConcierge(caller) } : {}),
       choose: (usable) => this.choosePermission(usable, origin.request, always, concierge),
       escalation: (evaluation) => ({
         verb: "approve",
@@ -314,6 +343,8 @@ export class Acting {
         always,
         evaluation,
         ...(input.why ? { why: input.why } : {}),
+        ...(concierge ? { concierge: true as const } : {}),
+        ...(concierge && input.recommend === true ? { recommend: true as const } : {}),
       }),
       run: async (grant) => {
         const answered = await this.deps.actions.answerPermission({ rootID: target.rootID, requestID: input.requestID, decision })
@@ -519,9 +550,20 @@ export class Acting {
       if (target.parentID) throw invalid("Prompts go to root sessions, not subagent sessions")
       if (actor.kind === "session" && actor.sessionID === target.sessionID) throw invalid("A session never prompts itself")
     }
+    // A prompt commits a staged revert (OpenCode, quirk 9budy9na): only the console's Send (or Restore) ends one.
+    // Checked after the grant (an agent without one learns nothing about the session) and audited like any refusal.
+    const notStaged = () => {
+      if ((this.deps.registry.session(target.sessionID) as { revert?: unknown } | undefined)?.revert) {
+        throw new AgentError("conflict", "A revert is staged in this session: a prompt would make it permanent", { hint: "Restore it or send from the session's console first" })
+      }
+    }
     return this.act(caller, "prompt", target, {}, input.why, {
+      check: notStaged,
       run: async (grant) => {
-        if (!grant) return this.userPrompt(target.sessionID, text, images, input.intent)
+        if (!grant) {
+          notStaged()
+          return this.userPrompt(target.sessionID, text, images, input.intent)
+        }
         return this.agentPrompt(caller, addr, target.sessionID, text, grant, input.delivery)
       },
     })
@@ -584,6 +626,8 @@ export class Acting {
     plan: {
       /** A session never acts in its own tree (permissions and forms). */
       readonly selfTree?: boolean
+      /** (R-03) No usable grant is not forbidden: `choose` gets none and throws NeedsUser (or forbidden). */
+      readonly withoutGrant?: () => Promise<boolean>
       /** The grant to act under (default: the newest usable); throws NeedsUser or forbidden. */
       readonly choose?: (usable: Grant[]) => Grant
       readonly escalation?: (evaluation: Evaluation) => Omit<Escalation, "userID" | "actor">
@@ -610,7 +654,7 @@ export class Acting {
         acting.ensureActing(userID)
         await this.guard(userID, target)
         const usable = await grants.usable(actor, verb, { directory: target.directory })
-        if (!usable.length) throw forbidden(`No grant lets this ${actor.kind} ${verb} in this session`)
+        if (!usable.length && !(plan.choose && plan.withoutGrant && (await plan.withoutGrant()))) throw forbidden(`No grant lets this ${actor.kind} ${verb} in this session`)
         if (plan.selfTree && actor.kind === "session" && (this.deps.registry.rootOf(actor.sessionID) ?? actor.sessionID) === target.rootID) {
           throw forbidden("A session never answers requests in its own session tree")
         }
@@ -670,24 +714,32 @@ export class Acting {
     }
   }
 
+  /** (R-03 verify) The actor is the user's current Concierge session; a failed read (or no reader) is no. */
+  private async isCurrentConcierge(caller: Caller): Promise<boolean> {
+    const { actor } = caller
+    if (actor.kind !== "session" || !this.deps.currentConcierge) return false
+    try {
+      return await this.deps.currentConcierge(caller.userID, actor.sessionID)
+    } catch {
+      return false
+    }
+  }
+
   /**
    * The grant that covers the request, after every never rule; NeedsUser when none does. (CON-13 decision)
    * `concierge`: a Concierge actor's "always", or a covered request of the tap risk tier, is NeedsUser at tap tier.
+   * (R-03 verify) Every never rule (the hub's and each usable grant's, also with no grant) is checked first, before
+   * any NeedsUser: a forbidden request never becomes a Decision, "always" or not.
    */
   private choosePermission(usable: Grant[], request: PermissionRequest | undefined, always: boolean, concierge = false): Grant {
     const hubNever = this.deps.acting.hubNever()
     const ids = usable.map((g) => g.id)
+    const rules = usable.map((g) => ({ grant: g, allow: patterns(g.permissions.allow), never: patterns(g.permissions.never) }))
+    if (request) checkNever(request, rules, hubNever, always)
     if (concierge && always) throw new NeedsUser({ verdict: "outside", reason: CONCIERGE_ALWAYS_REASON, tier: "tap", grants: ids })
     if (!request) throw new NeedsUser({ verdict: "outside", reason: "The request's details are unknown", tier: "tap", grants: ids })
-    const rules = usable.map((g) => ({ grant: g, allow: patterns(g.permissions.allow), never: patterns(g.permissions.never) }))
-    for (const form of neverForms(request)) {
-      for (const { grant, allow, never } of rules) {
-        const verdict = evaluatePermission(form, { grant: { allow, never }, hubNever, always, allowAlways: grant.allowAlways })
-        if (verdict.verdict === "never") {
-          throw forbidden(`never: ${verdict.by === "hub" ? "the hub's" : `grant ${grant.id}'s`} rule ${formatPattern(verdict.pattern)} matches ${verdict.subject}`)
-        }
-      }
-    }
+    // (R-03) The current Concierge holds no grant: anything the never rules let through is the user's, at the hub's tier.
+    if (!usable.length) throw new NeedsUser({ verdict: "outside", reason: CONCIERGE_NO_GRANT_REASON, tier: request.truncated ? "tap" : riskTier(request, hubNever), grants: [] })
     const allNever = [...hubNever, ...rules.flatMap((r) => r.never)]
     if (request.truncated) throw new NeedsUser({ verdict: "outside", reason: "The request was too large to check in full", tier: "tap", grants: ids })
     let reason: string | undefined
@@ -790,6 +842,9 @@ export function auditOf(cause: unknown): [AuditDecision, AuditOutcome] {
       return ["forbidden", "refused"]
     case "rate_limited":
       return ["rate_limited", "refused"]
+    // Allowed, but the session's state refuses it now (a staged revert).
+    case "conflict":
+      return ["allow", "refused"]
     // (FX-07) The hub's state did not answer in time: refused, and Activity says the hub was busy.
     case "busy":
       return ["busy", "refused"]

package/src/central/agent/delivery.ts

@@ -68,6 +68,8 @@ export interface DeliveryRegistry {
   idle(sessionID: string): boolean
   /** Higher: more recent activity. */
   recency(sessionID: string): number
+  /** A revert is staged in the session (Registry.revertStaged): nothing is sent to it (absent: never). */
+  revertStaged?(sessionID: string): boolean
 }
 
 /** Address resolution (Directory.resolve) and the primer flag (without primed/markPrimed: no primer). */
@@ -673,8 +675,13 @@ export class Delivery {
     return { message: updated, delivery: result.delivered }
   }
 
-  /** Sends the request to each of the user's deliver-capable connections for the session until one takes it. */
+  /**
+   * Sends the request to each of the user's deliver-capable connections for the session until one takes it. Not at
+   * all while a revert is staged there: admitting anything commits it (decision in docs/session-view.md), so the
+   * message stays pending and goes in on the sessions frame that shows the revert restored or committed.
+   */
   private async request(userID: string, sessionID: string, req: DeliverRequest): Promise<DeliverResult | undefined> {
+    if (this.deps.registry.revertStaged?.(sessionID)) return undefined
     for (const connID of this.targets(userID, sessionID)) {
       let result: unknown
       try {
@@ -748,6 +755,8 @@ export class Delivery {
     if (!current || (current.kind === "ask" && current.state !== "open" && current.state !== "expired")) return
     const message = (await this.messages.setDelivery(userID, current.id, "expired")) ?? current
     const what = `${message.kind} ${message.id} to ${message.to}`
+    // Why it waited: a staged revert holds every delivery (request()), else the session was offline or busy.
+    const why = this.deps.registry.revertStaged?.(value.sessionID) ? "a revert stayed staged in its session for 24 h" : "its session stayed offline or busy for 24 h"
     try {
       this.deps.expired?.(userID, message)
     } catch (cause) {
@@ -755,14 +764,14 @@ export class Delivery {
     }
     const { from } = message
     if (from.kind === "user") {
-      this.deps.alert?.(userID, { kind: "expired", sessionID: value.sessionID, messageID: message.id, text: `Your ${message.kind} to ${message.to} was not delivered: its session stayed offline or busy for 24 h` })
+      this.deps.alert?.(userID, { kind: "expired", sessionID: value.sessionID, messageID: message.id, text: `Your ${message.kind} to ${message.to} was not delivered: ${why}` })
     } else if (from.kind === "session") {
       const id = this.newID()
       await this.request(userID, from.sessionID, {
         op: "deliver",
         sessionID: from.sessionID,
         messageID: id,
-        text: `[hub] notice · ${what} was not delivered: its session stayed offline or busy for 24 h · ${id}`,
+        text: `[hub] notice · ${what} was not delivered: ${why} · ${id}`,
         wake: false,
         meta: { kind: "msg", from: "hub", to: wireAddress(from), delivery: "queue" },
       })

package/src/central/agent/escalation.ts

@@ -5,6 +5,8 @@
 //   agent's recommendation, the tier the hub set on the evaluation, about the asking session); escalating the same
 //   request again updates the open Decision's reason instead (no new push). Concurrent escalations race on a
 //   version-checked reservation: one opens the Decision, the other is rate_limited (retry).
+// - (R-03) A Concierge's escalation recommends nothing unless it passed `recommend: true`: its why is then a note
+//   after the question ("The Concierge's note: …"), and the blocker only links the Decision (no "recommends").
 // - The recommendation also shows on the request's blocker (registry.recommend: catalog, status, the push's
 //   service worker reads it there).
 // - Answering (decisions.ts runs `act` after the answer wins) replies to the permission AS THE USER through the
@@ -150,19 +152,24 @@ export class Escalations {
     const opened = await counters.incr(`escalations:${userID}:${partyKey(holder)}`, HOUR_MS)
     if (opened > ESCALATIONS_PER_HOLDER_HOUR) throw rateLimited(`At most ${ESCALATIONS_PER_HOLDER_HOUR} escalations an hour`, 3600)
     const pushes = await counters.incr(`escalation-push:${userID}`, ESCALATION_PUSH_COALESCE_MS)
-    const recommend = escalation.always ? "always" : "approve"
+    // (R-03 verify) The Concierge never gets "always": its Decision offers Approve once or Deny only (the user can
+    // still approve always on the session's card).
+    const always = offersAlways(escalation)
+    const recommend = always ? "always" : "approve"
     const why = boundedWhy(escalation.why)
+    const advises = recommends(escalation)
     const { message, decision } = await decisions.ask(
       userID,
       escalation.actor,
       {
-        question: question(escalation, partyLabel(holder)),
+        // (R-03) A Concierge that only tries recommends nothing: its why is a note after the question.
+        question: question(escalation, partyLabel(holder)) + (!advises && why ? `\nThe Concierge's note: ${why}` : ""),
         options: [
-          ...(escalation.always ? [{ id: "always", label: "Approve always" }] : []),
+          ...(always ? [{ id: "always", label: "Approve always" }] : []),
           { id: "approve", label: "Approve once" },
           { id: "deny", label: "Deny", safe: true },
         ],
-        recommendation: { option: recommend, ...(why ? { why } : {}) },
+        ...(advises ? { recommendation: { option: recommend, ...(why ? { why } : {}) } } : {}),
         urgency: "high",
         tier: escalation.evaluation.tier,
         about: [escalation.sessionID],
@@ -173,7 +180,7 @@ export class Escalations {
           requestID: escalation.requestID,
           rootID: escalation.rootID,
           sessionID: escalation.sessionID,
-          always: escalation.always,
+          always,
           ...(escalation.request ? { request: decisionRequest(escalation.request) } : {}),
           ...(escalation.evaluation.reason ? { reason: escalation.evaluation.reason.slice(0, WHY_MAX) } : {}),
         },
@@ -189,8 +196,8 @@ export class Escalations {
   private async update(escalation: Escalation, holder: Party, decision: Decision): Promise<{ decisionID: string }> {
     const why = boundedWhy(escalation.why)
     let current = decision
-    if (why && why !== decision.recommendation?.why) {
-      const option = decision.recommendation?.option ?? (escalation.always ? "always" : "approve")
+    if (recommends(escalation) && why && why !== decision.recommendation?.why) {
+      const option = decision.recommendation?.option ?? (offersAlways(escalation) ? "always" : "approve")
       current = (await this.deps.decisions.revise(escalation.userID, decision.id, { recommendation: { option, why } })) ?? decision
     }
     this.showOnBlocker(escalation.requestID, holder, current)
@@ -198,8 +205,11 @@ export class Escalations {
   }
 
   private showOnBlocker(requestID: string, holder: Party, decision: Decision): void {
+    // (R-03) Without a recommendation the blocker only links the Decision (its tier still gates quick answers).
     const why = decision.recommendation?.why
-    const recommendation: BlockerRecommendation = { by: partyLabel(holder), recommends: "approve", ...(why ? { why } : {}), decisionID: decision.id }
+    const recommendation: BlockerRecommendation = decision.recommendation
+      ? { by: partyLabel(holder), recommends: "approve", ...(why ? { why } : {}), decisionID: decision.id }
+      : { by: partyLabel(holder), decisionID: decision.id }
     this.deps.registry.recommend(requestID, recommendation)
   }
 
@@ -211,6 +221,16 @@ export class Escalations {
   }
 }
 
+/** (R-03 verify) Whether the Decision offers Approve always: never for the Concierge. */
+function offersAlways(escalation: Escalation): boolean {
+  return escalation.always && !escalation.concierge
+}
+
+/** (R-03) Whether the escalation recommends approving: always for agents, for the Concierge only with `recommend`. */
+function recommends(escalation: Escalation): boolean {
+  return !escalation.concierge || escalation.recommend === true
+}
+
 /** The agent's reason, cut to what a Decision keeps. */
 function boundedWhy(why: string | undefined): string | undefined {
   const trimmed = why?.trim()
@@ -221,7 +241,8 @@ function boundedWhy(why: string | undefined): string | undefined {
 function question(escalation: Escalation, by: string): string {
   const { request, evaluation } = escalation
   const what = request ? `${request.action}${request.resources.length ? `: ${request.resources.join(", ")}` : ""}` : "a permission request (details unknown)"
-  const always = escalation.always && request?.save?.length ? ` always (saves ${request.save.join(", ")})` : escalation.always ? " always" : ""
+  const asksAlways = offersAlways(escalation)
+  const always = asksAlways && request?.save?.length ? ` always (saves ${request.save.join(", ")})` : asksAlways ? " always" : ""
   const text = `${by} asks to approve${always} ${what}. Outside its grant: ${evaluation.reason}`
   return text.length > QUESTION_MAX ? `${text.slice(0, QUESTION_MAX - 1)}…` : text
 }

package/src/central/agent/launch-spec.ts

@@ -105,6 +105,24 @@ const TOP_FIELDS = FIELDS.filter((field) => !SECTIONS.some(([section]) => sectio
 /** (FX-03) The hint every unknown-field answer carries: callers often send a flat spec. */
 export const LAUNCH_SPEC_SHAPE = `A launch spec is nested: ${SECTIONS.map(([section, fields]) => `${section}{${fields.join(", ")}}`).join(", ")}; top level: ${TOP_FIELDS.join(", ")}`
 
+/** How validateLaunchSpec words its hints for one caller. */
+export interface LaunchSpecOptions {
+  /**
+   * (R-04) Team staffing builds the spec: it sets launch.key itself and refuses the caller's, so a misplaced `key`
+   * points at idempotencyKey (the Idempotency-Key header), not "key (top level)".
+   */
+  readonly staffing?: boolean
+}
+
+/** Where a misplaced `key` belongs and the shape hint, for one caller. */
+interface Wording {
+  readonly keyPlace: string
+  readonly shape: string
+}
+
+const PLAIN: Wording = { keyPlace: "key (top level)", shape: LAUNCH_SPEC_SHAPE }
+const STAFFING: Wording = { keyPlace: "idempotencyKey (the Idempotency-Key header)", shape: `${LAUNCH_SPEC_SHAPE}; key is set by staffing: send idempotencyKey (the Idempotency-Key header) instead` }
+
 const KEY = /^[!-~]{1,200}$/
 const SLUG = /^[a-z0-9][a-z0-9-]{0,39}$/
 const AGENT = /^[A-Za-z0-9_.-]{1,80}$/
@@ -120,21 +138,21 @@ const invalid = (message: string, hint?: string) => new AgentError("invalid", me
 const isObject = (value: unknown): value is Record<string, unknown> => typeof value === "object" && value !== null && !Array.isArray(value)
 
 /** Where an unknown `key` at level `what` (launch, or a section) belongs instead: `section.key`s, or the top level. */
-function placesOf(key: string, what: string): string[] {
+function placesOf(key: string, what: string, wording: Wording): string[] {
   const places = SECTIONS.filter(([section, fields]) => section !== what && fields.includes(key)).map(([section]) => `${section}.${key}`)
-  if (what !== "launch" && TOP_FIELDS.includes(key)) places.push(`${key} (top level)`)
+  if (what !== "launch" && TOP_FIELDS.includes(key)) places.push(key === "key" ? wording.keyPlace : `${key} (top level)`)
   return places
 }
 
 /** Refuses every field outside `allowed` at once, naming where a misplaced one belongs (FX-03). */
-function onlyFields(value: Record<string, unknown>, allowed: readonly string[], what: string): void {
+function onlyFields(value: Record<string, unknown>, allowed: readonly string[], what: string, wording: Wording = PLAIN): void {
   const unknown = Object.keys(value).filter((key) => !allowed.includes(key))
   if (unknown.length === 0) return
-  const suggestions = unknown.slice(0, 10).map((key) => placesOf(key, what)).filter((places) => places.length > 0).map((places) => places.join(" or "))
+  const suggestions = unknown.slice(0, 10).map((key) => placesOf(key, what, wording)).filter((places) => places.length > 0).map((places) => places.join(" or "))
   // Keys are the caller's: bounded in number and length.
   const shown = [...unknown.slice(0, 10).map((key) => key.slice(0, 40)), ...(unknown.length > 10 ? ["…"] : [])]
   const message = `Unknown ${what} field${unknown.length > 1 ? "s" : ""} ${shown.join(", ")}${suggestions.length ? `: did you mean ${suggestions.join(", ")}?` : ""}`
-  throw invalid(message, LAUNCH_SPEC_SHAPE)
+  throw invalid(message, wording.shape)
 }
 
 function oneOf<T extends string>(value: unknown, options: readonly T[], fallback: T, what: string): T {
@@ -202,9 +220,9 @@ function validRoles(value: unknown): string[] {
   return roles
 }
 
-function validWorkspace(value: unknown): LaunchWorkspace {
+function validWorkspace(value: unknown, wording: Wording): LaunchWorkspace {
   if (!isObject(value)) throw invalid("workspace is {repo, mode?, branch?, base?, remote?}")
-  onlyFields(value, WORKSPACE_FIELDS, "workspace")
+  onlyFields(value, WORKSPACE_FIELDS, "workspace", wording)
   // canonicalProject rejects relative, `~` and root paths.
   const repo = typeof value.repo === "string" ? canonicalProject(value.repo) : undefined
   if (repo === undefined) throw invalid("workspace.repo is an absolute repository path")
@@ -224,10 +242,10 @@ function validWorkspace(value: unknown): LaunchWorkspace {
   }
 }
 
-function validRuntime(value: unknown, workspace: LaunchWorkspace): LaunchRuntime {
+function validRuntime(value: unknown, workspace: LaunchWorkspace, wording: Wording): LaunchRuntime {
   if (value === undefined) return { kind: "host" }
   if (!isObject(value)) throw invalid("runtime is {kind, profile?}")
-  onlyFields(value, RUNTIME_FIELDS, "runtime")
+  onlyFields(value, RUNTIME_FIELDS, "runtime", wording)
   const kind = oneOf<RuntimeKind>(value.kind, ["host", "openshell"], "host", "runtime.kind")
   const profile = matching(value.profile, SLUG, "runtime.profile")
   if (kind === "host" && profile !== undefined) throw invalid("runtime.profile applies to the openshell runtime only")
@@ -235,20 +253,20 @@ function validRuntime(value: unknown, workspace: LaunchWorkspace): LaunchRuntime
   return { kind, ...(profile !== undefined ? { profile } : {}) }
 }
 
-function validPlacement(value: unknown): LaunchPlacement {
+function validPlacement(value: unknown, wording: Wording): LaunchPlacement {
   if (value === undefined) return { labels: {}, mode: "require" }
   if (!isObject(value)) throw invalid("placement is {labels?, machine?, mode?}")
-  onlyFields(value, PLACEMENT_FIELDS, "placement")
+  onlyFields(value, PLACEMENT_FIELDS, "placement", wording)
   const labels = validLabels(value.labels, "placement.labels")
   const machine = matching(value.machine, MACHINE, "placement.machine")
   const mode = oneOf<PlacementMode>(value.mode, ["require", "prefer"], "require", "placement.mode")
   return { labels, ...(machine !== undefined ? { machine } : {}), mode }
 }
 
-function validEnd(value: unknown): LaunchEnd {
+function validEnd(value: unknown, wording: Wording): LaunchEnd {
   if (value === undefined) return { when: "idle", cleanup: "keep" }
   if (!isObject(value)) throw invalid("end is {when?, timeout?, cleanup?}")
-  onlyFields(value, END_FIELDS, "end")
+  onlyFields(value, END_FIELDS, "end", wording)
   const when = oneOf<EndWhen>(value.when, ["idle", "asked", "never"], "idle", "end.when")
   let timeoutMs: number | undefined
   if (value.timeout !== undefined) {
@@ -262,10 +280,11 @@ function validEnd(value: unknown): LaunchEnd {
 // ---------- spec ----------
 
 /** Validates a launch body into a LaunchSpec (a fresh copy, defaults filled in); throws AgentError invalid. */
-export function validateLaunchSpec(input: unknown): LaunchSpec {
+export function validateLaunchSpec(input: unknown, options: LaunchSpecOptions = {}): LaunchSpec {
+  const wording = options.staffing ? STAFFING : PLAIN
   if (!isObject(input)) throw invalid("A launch is an object")
   if ("grant" in input) throw invalid("grant is not supported yet: a launched session has its launcher's powers only")
-  onlyFields(input, FIELDS, "launch")
+  onlyFields(input, FIELDS, "launch", wording)
   const key = matching(input.key, KEY, `key (1–${KEY_MAX} visible characters)`)
   let name: string | undefined
   if (input.name !== undefined) {
@@ -276,9 +295,9 @@ export function validateLaunchSpec(input: unknown): LaunchSpec {
   const harness = matching(input.harness, SLUG, "harness") ?? "opencode"
   const agent = matching(input.agent, AGENT, "agent")
   const model = matching(input.model, MODEL, "model (provider/model)", MODEL_MAX)
-  const workspace = validWorkspace(input.workspace)
-  const runtime = validRuntime(input.runtime, workspace)
-  const placement = validPlacement(input.placement)
+  const workspace = validWorkspace(input.workspace, wording)
+  const runtime = validRuntime(input.runtime, workspace, wording)
+  const placement = validPlacement(input.placement, wording)
   let prompt: string | undefined
   if (input.prompt !== undefined) {
     if (typeof input.prompt !== "string" || input.prompt.length > PROMPT_MAX || PROMPT_CONTROL.test(input.prompt)) throw invalid(`prompt is text of up to ${PROMPT_MAX} characters`)
@@ -287,7 +306,7 @@ export function validateLaunchSpec(input: unknown): LaunchSpec {
   // (CON-02) What the session is for: untrusted, sanitised to one line, at most INTENT_MAX characters.
   const intent = input.intent === undefined ? undefined : intentText(input.intent)
   const labels = validLabels(input.labels, "labels")
-  const end = validEnd(input.end)
+  const end = validEnd(input.end, wording)
   const profileProblem = input.agentProfile === undefined ? undefined : launchAgentProfileProblem(input.agentProfile)
   if (profileProblem) throw invalid(profileProblem)
   const agentProfile = input.agentProfile === undefined ? undefined : { profileID: (input.agentProfile as LaunchAgentProfile).profileID, version: (input.agentProfile as LaunchAgentProfile).version }

package/src/central/agent/routes.ts

@@ -6,6 +6,7 @@
 // requests skip it) → 403 forbidden; credential → 401 unauthorized / token_expired; route → 404 not_found;
 // route class (agentAllows) → 403 forbidden; then the handler, whose throws become the envelope (agentFailure).
 // Path parameters address sessions as `:addr` (resolved per caller), never `:session`.
+import { type ConciergeCallRecorder, recordConciergeCalls } from "../recording/concierge-taps"
 import type { AgentEvents } from "./events"
 import type { CursorKeys } from "./event-cursor"
 import { eventsRoutes, type EventsRouteDeps } from "./events-routes"
@@ -88,6 +89,8 @@ export interface AgentRoute {
 /** What the agent API needs from the hub. */
 export interface AgentDeps {
   readonly store: Store
+  /** (REC-01) Voice recordings: the Concierge's agent calls (recordConciergeCalls). */
+  readonly recording?: ConciergeCallRecorder
   /** Hub-minted session tokens (P1-T5). */
   readonly sessionTokens?: SessionTokens
   /** Names, roles and address resolution (P1-T8); its routes are added when given. */
@@ -272,7 +275,7 @@ export function agentRoutes(deps: AgentDeps): AgentRoute[] {
   const identity = deps.concierge?.identity
   const directory = deps.directory
   const launches = deps.launches
-  return identity && directory
+  const guarded = identity && directory
     ? guardConciergeRoutes(all, {
         identity,
         resolve: (userID, addr) => directory.resolve(userID, addr).sessions.map((s) => s.sessionID),
@@ -286,6 +289,9 @@ export function agentRoutes(deps: AgentDeps): AgentRoute[] {
           : {}),
       })
     : all
+  // (REC-01) concierge.tool: a session actor's calls (method, route, target, status, ms; never a body or response)
+  // reach the recording service, which keeps them only for a recorded Concierge session.
+  return deps.recording ? recordConciergeCalls(guarded, deps.recording) : guarded
 }
 
 /** HWA-28/40: unfiltered events and watch read by a team-scoped session leave out what discovery hides from it. */
@@ -328,6 +334,12 @@ function conciergeCurrent(deps: AgentDeps): { conciergeCurrent?: (userID: string
   return identity ? { conciergeCurrent: async (userID: string) => (await identity.current(userID)).sessionID } : {}
 }
 
+/** (R-03 verify) Whether a session is the user's CURRENT Concierge session (the no-grant escalation; never a retired one). */
+function currentConciergeActor(deps: AgentDeps): { currentConcierge?: (userID: string, sessionID: string) => Promise<boolean> } {
+  const identity = deps.concierge?.identity
+  return identity ? { currentConcierge: async (userID: string, sessionID: string) => (await identity.current(userID)).sessionID === sessionID } : {}
+}
+
 /** (CON-02) What reads show of intents: the stored ones of the listed sessions, by session. */
 function intentReads(deps: AgentDeps): { intents?: (userID: string, sessionIDs: readonly string[]) => Promise<Map<string, SessionIntent>> } {
   const { intents } = deps
@@ -350,6 +362,7 @@ function actVerbRoutes(deps: AgentDeps): AgentRoute[] {
       ...(deps.escalate ? { escalate: deps.escalate } : {}),
       ...(deps.maxPromptChars !== undefined ? { maxPromptChars: deps.maxPromptChars } : {}),
       ...(deps.concierge?.protects ? { protect: deps.concierge.protects, conciergeActor: deps.concierge.protects } : {}),
+      ...currentConciergeActor(deps),
     }),
   )
 }

package/src/central/artifacts/blob-store.ts

@@ -9,7 +9,7 @@
 //   usage is per user. The same bytes stored by two users are two blobs.
 // - put streams the body: it hashes as it reads, stops reading (and cancels the source) as soon as the body passes
 //   `maxBytes` (default and ceiling ARTIFACT_LIMITS.blobBytes), and stores nothing when the body is too large, its
-//   hash is not `expectedHash`, the media type is not in ARTIFACT_MEDIA_TYPES (never sniffed), or a new blob would
+//   hash is not `expectedHash`, the media type is not in ARTIFACT_MEDIA_TYPES (or the put's `mediaTypes`; never sniffed), or a new blob would
 //   take the user past `quotaBytes` (default ARTIFACT_LIMITS.userBlobBytes). Storing bytes that are already there
 //   stores nothing new, is never refused for quota, and refreshes `touchedAt`.
 // - A blob becomes visible to get/has/stat/list only once all its bytes are durably stored and verified
@@ -30,6 +30,11 @@ export interface BlobPutOptions {
   readonly maxBytes?: number
   /** The user's total stored bytes a new blob may not exceed (default ARTIFACT_LIMITS.userBlobBytes). */
   readonly quotaBytes?: number
+  /**
+   * The media types this put accepts instead of ARTIFACT_MEDIA_TYPES (REC-01: RECORDING_MEDIA_TYPES under the
+   * `rec~<userID>` tenant). Artifact routes never pass it, so audio stays refused there.
+   */
+  readonly mediaTypes?: readonly string[]
 }
 
 /** A stored blob's facts (no media type: that belongs to the revision's BlobRef). */

package/src/central/artifacts/blob-support.ts

@@ -11,7 +11,9 @@ export interface PutLimits {
 
 /** Checks put's media type and options (BlobInputError) and answers the limits in force. */
 export function putLimits(mediaType: string, options: BlobPutOptions = {}): PutLimits {
-  if (!(ARTIFACT_MEDIA_TYPES as readonly string[]).includes(mediaType)) throw new BlobInputError("mediaType is not allowed")
+  // The allowlist is ARTIFACT_MEDIA_TYPES unless the caller names its own (REC-01 recordings: RECORDING_MEDIA_TYPES).
+  const allowed: readonly string[] = options.mediaTypes ?? ARTIFACT_MEDIA_TYPES
+  if (!allowed.includes(mediaType)) throw new BlobInputError("mediaType is not allowed")
   const maxBytes = options.maxBytes ?? ARTIFACT_LIMITS.blobBytes
   if (!Number.isSafeInteger(maxBytes) || maxBytes < 0 || maxBytes > ARTIFACT_LIMITS.blobBytes) {
     throw new BlobInputError(`maxBytes must be 0–${ARTIFACT_LIMITS.blobBytes}`)