@huynle/hub 0.9.2 → 0.10.0

package/src/central/agent-data.ts

@@ -63,11 +63,51 @@ export interface AppToken {
   [field: string]: unknown
 }
 
+/**
+ * (AF1) A registered app client of this user (hub-wide when an admin registered it with audience "hub", else
+ * personal). Only the sha256 of its secret is stored. Unique per user by id (hcl_…); IDs are hub-unique.
+ */
+export interface AppClientRecord {
+  id: string
+  secretHash: string
+  name?: string
+  redirectURIs?: string[]
+  scopes?: string[]
+  audience?: "hub" | "user"
+  created?: number
+  updated?: number
+  disabled?: true
+  [field: string]: unknown
+}
+
+/**
+ * (AF1) This user's connection to an app client: its scopes and its token family (sha256 hashes only). `previous`
+ * is the 30 s refresh grace: the just-rotated refresh token's hash, its access token's hash and the new pair sealed
+ * with a key derived from that refresh token. Unique per user by id (16 hex, the app's tokenID).
+ */
+export interface ConnectionRecord {
+  id: string
+  clientID: string
+  scopes?: string[]
+  created?: number
+  lastUsed?: number
+  accessHash?: string
+  accessExpiresAt?: number
+  refreshHash?: string
+  refreshExpiresAt?: number
+  previous?: { readonly refreshHash: string; readonly accessHash: string; readonly until: number; readonly accessUntil: number; readonly sealed: string }
+  [field: string]: unknown
+}
+
 export interface AgentData {
   names?: AgentName[]
   roles?: AgentRole[]
   sessions?: AgentSession[]
   appTokens?: AppToken[]
+  /** (AF1) Registered app clients (connect-app). */
+  appClients?: AppClientRecord[]
+  /** (AF1) Connections of this user to app clients. */
+  connections?: ConnectionRecord[]
   /** Last holder generation handed out per roleKey(role, project). */
   generations?: Record<string, number>
   /** The user's agent kill switch (agent/acting-switch.ts): every agent action answers paused. */
@@ -89,11 +129,13 @@ const LEGACY_ROLE_KEY = "\u0000"
 type Entry = Record<string, unknown>
 
 /** Each list: the string fields an entry needs, and its identity (entries with the same one are duplicates). */
-const LISTS: Record<"names" | "roles" | "sessions" | "appTokens", { required: readonly string[]; identity: (e: Entry) => string }> = {
+const LISTS: Record<"names" | "roles" | "sessions" | "appTokens" | "appClients" | "connections", { required: readonly string[]; identity: (e: Entry) => string }> = {
   names: { required: ["name", "sessionID"], identity: (e) => e.name as string },
   roles: { required: ["role", "sessionID"], identity: (e) => `${roleKey(e.role as string, typeof e.project === "string" ? e.project : undefined)}\u0000${e.sessionID}` },
   sessions: { required: ["sessionID"], identity: (e) => e.sessionID as string },
   appTokens: { required: ["id", "tokenHash"], identity: (e) => e.id as string },
+  appClients: { required: ["id", "secretHash"], identity: (e) => e.id as string },
+  connections: { required: ["id", "clientID"], identity: (e) => e.id as string },
 }
 
 const isPlain = (v: unknown): v is Entry => typeof v === "object" && v !== null && !Array.isArray(v)

package/src/central/backend/memory-counters.ts

@@ -46,9 +46,9 @@ export class MemoryCounters implements Counters {
     this.counts = new ExpiringMap(this.now)
   }
 
-  async incr(key: string, ttlMs: number): Promise<number> {
+  async incr(key: string, ttlMs: number, by = 1): Promise<number> {
     const current = this.counts.get(key)
-    const count = (current?.count ?? 0) + 1
+    const count = (current?.count ?? 0) + by
     this.counts.set(key, { count, expiresAt: current?.expiresAt ?? this.now() + ttlMs })
     return count
   }

package/src/central/backend/types.ts

@@ -143,8 +143,11 @@ export interface EventLog {
 
 /** Fixed-window counters (rate limits, budgets): INCR + PEXPIRE NX in a cluster. */
 export interface Counters {
-  /** Adds one and returns the count; the first increment of a window starts its `ttlMs`. */
-  incr(key: string, ttlMs: number): Promise<number>
+  /**
+   * Adds `by` (default one; a non-zero whole number, negative to undo an increment) and returns the count; the first
+   * increment of a window starts its `ttlMs`, later ones never extend it.
+   */
+  incr(key: string, ttlMs: number, by?: number): Promise<number>
   /** The current count (0 when unset or expired). */
   get(key: string): Promise<number>
 }

package/src/central/backend/valkey-counters.ts

@@ -1,10 +1,10 @@
-// Counters in Valkey: fixed windows as INCR + PEXPIRE NX in one Lua script, so the first increment of a window
+// Counters in Valkey: fixed windows as INCRBY + PEXPIRE NX in one Lua script, so the first increment of a window
 // starts its expiry and later ones never extend it, atomically. Keys go under a prefix (default "ctr:").
 // Expiry is server-side, so it follows the server's clock, not an injected one.
 import type { Counters } from "./types"
 import { ValkeyConnection, type ValkeySource } from "./valkey-client"
 
-const INCR_WINDOW = `local n = redis.call('INCR', KEYS[1])
+const INCR_WINDOW = `local n = redis.call('INCRBY', KEYS[1], ARGV[2])
 redis.call('PEXPIRE', KEYS[1], ARGV[1], 'NX')
 return n`
 
@@ -22,9 +22,10 @@ export class ValkeyCounters implements Counters {
     this.prefix = options.prefix ?? "ctr:"
   }
 
-  async incr(key: string, ttlMs: number): Promise<number> {
+  async incr(key: string, ttlMs: number, by = 1): Promise<number> {
     if (!(Number.isInteger(ttlMs) && ttlMs > 0)) throw new Error("Counters.incr: ttl must be a positive whole number of milliseconds")
-    return Number(await this.valkey.send("EVAL", [INCR_WINDOW, "1", this.prefix + key, String(ttlMs)]))
+    if (!(Number.isInteger(by) && by !== 0)) throw new Error("Counters.incr: by must be a non-zero whole number")
+    return Number(await this.valkey.send("EVAL", [INCR_WINDOW, "1", this.prefix + key, String(ttlMs), String(by)]))
   }
 
   async get(key: string): Promise<number> {

package/src/central/client-address.ts

@@ -0,0 +1,16 @@
+// The client address of a request, for per-address rate limits (connect-app, AF1). The TCP peer, unless the peer is
+// a trusted reverse proxy (HUB_TRUSTED_PROXIES): then the right-most X-Forwarded-For entry that is not itself a
+// trusted proxy (the address the outermost trusted proxy saw). Without trusted proxies the header is never read, so
+// a client cannot pick its own address. Only for limits: never for authentication or authorization.
+import { type Cidr, inCidrs } from "./fetcher"
+
+export function clientAddress(request: Request, peer: string | undefined, trusted: readonly Cidr[]): string {
+  const direct = (peer ?? "").trim() || "unknown"
+  if (!trusted.length || !inCidrs(direct, trusted)) return direct
+  const hops = (request.headers.get("x-forwarded-for") ?? "")
+    .split(",")
+    .map((hop) => hop.trim())
+    .filter(Boolean)
+  for (let i = hops.length - 1; i >= 0; i--) if (!inCidrs(hops[i]!, trusted)) return hops[i]!.slice(0, 64)
+  return hops[0]?.slice(0, 64) ?? direct
+}

package/src/central/concierge/board-render.ts

@@ -24,8 +24,12 @@
 // surrogates are removed from all of the text.
 import { CONCIERGE_BOARD_LIMITS, INTENT_MAX, type ConciergeBoard, type ConciergeBoardDecision, type ConciergeBoardSection, type ConciergeBoardSession } from "../../../packages/protocol/src/concierge"
 import { isHubSessionID } from "../../../packages/protocol/src/harness-events"
+import { CONTEXT_CARD_LIMITS } from "../../../packages/protocol/src/context-cards"
 import { sanitizeLabel } from "../agent/envelope"
 
+/** (Concierge grant requests) The verbs a board may name for a project's grant (anything else is dropped). */
+export const PROJECT_GRANT_VERBS: readonly string[] = ["approve", "deny", "answer", "prompt", "stop"]
+
 const MIN = 60_000
 /** An age line when the board is at least this old. */
 const AGE_AFTER_MS = MIN
@@ -129,7 +133,11 @@ const cutLine = (line: string) => cutUnits(line, LINE_MAX)
 
 function sessionLine(s: ConciergeBoardSession, at: number): string {
   const parts: string[] = [s.name ? `${s.sessionID} ${frame(s.name, LABEL_CHARS)}` : s.sessionID]
-  if (s.project) parts.push(`project ${frame(s.project, LABEL_CHARS)}`)
+  // (Concierge grant requests) Whether a @@concierge grant covers the project (the hub's lookup), with its verbs.
+  const verbs = s.projectGrant?.filter((v) => PROJECT_GRANT_VERBS.includes(v))
+  const covered = verbs === undefined ? "" : verbs.length ? ` inGrant=yes (${verbs.join(", ")})` : " inGrant=no"
+  if (s.project) parts.push(`project ${frame(s.project, LABEL_CHARS)}${covered}`)
+  else if (covered) parts.push(`project${covered}`)
   if (s.machine) parts.push(`on ${frame(s.machine, LABEL_CHARS)}`)
   parts.push(s.since !== undefined ? `${s.state} ${span(at - s.since)}` : s.state)
   if (!s.blockers.reported) parts.push("blockers not reported")
@@ -144,6 +152,7 @@ function sessionLine(s: ConciergeBoardSession, at: number): string {
   if (s.intent) parts.push(`intent (${s.intent.source}) ${frame(s.intent.text, INTENT_MAX)}`)
   // (CON-11) "no intent": the title shows only because no intent is set (one the user cleared reads the same).
   else if (s.title) parts.push(`no intent · title ${frame(s.title, CONCIERGE_BOARD_LIMITS.titleChars)}`)
+  if (s.pickup) parts.push(`pick up ${frame(s.pickup, CONTEXT_CARD_LIMITS.headline)}`)
   parts.push(`watching: ${s.reasons.join(", ")}`)
   return cutLine(`- ${parts.join(" · ")}`)
 }
@@ -211,3 +220,45 @@ export function renderBoard(board: ConciergeBoard, options: RenderOptions = {}):
   }
   return cutUnits(text, max).replace(LONE_SURROGATE, "")
 }
+
+/** (P2) The compact board for the Concierge's voice front, at most this many characters. */
+export const FRONT_BOARD_MAX = 6_000
+/** Intent shown on the compact board (characters). */
+const FRONT_INTENT_CHARS = 100
+
+/**
+ * (P2 Concierge front, contract "P2: Concierge mode") The compact board for the front's note: the watched sessions
+ * with ID, @name, title (or intent), project, machine, state and what they wait for, then the machines. Enough to pick
+ * a relay target and answer simple status questions; no Decision IDs, watch reasons, grant facts or results (those
+ * are the Concierge's). Untrusted text is framed as on the full board. Lines past FRONT_BOARD_MAX are dropped from the
+ * end (the lowest priority) and counted.
+ */
+export function renderFrontBoard(board: ConciergeBoard): string {
+  const machines =
+    board.machines.status !== "ok"
+      ? "Machines: unavailable"
+      : cutLine(`Machines: ${board.machines.items.length ? board.machines.items.map((m) => `${frame(m.name, 40)} ${m.online ? "online" : "offline"}`).join(", ") : "none"}`)
+  if (board.sessions.status !== "ok") return [`The user's watched sessions: ${unavailable(board.sessions)}`, machines].join("\n")
+  const items = board.sessions.items.filter((s) => isHubSessionID(s.sessionID))
+  if (!items.length) return ["The user's watched sessions: none", machines].join("\n")
+  const total = Math.max(board.counts.watched, items.length)
+  const head = `The user's watched sessions (${total}${total > items.length ? `, ${items.length} shown` : ""}):`
+  const lines = items.map((s) => {
+    const parts = [s.name ? `${s.sessionID} ${frame(s.name, LABEL_CHARS)}` : s.sessionID]
+    if (s.title) parts.push(frame(s.title, CONCIERGE_BOARD_LIMITS.titleChars))
+    else if (s.intent) parts.push(`intent ${frame(s.intent.text, FRONT_INTENT_CHARS)}`)
+    if (s.project) parts.push(`project ${frame(s.project, LABEL_CHARS)}`)
+    if (s.machine) parts.push(`on ${frame(s.machine, LABEL_CHARS)}`)
+    parts.push(s.since !== undefined ? `${s.state} ${span(board.at - s.since)}` : s.state)
+    if (s.blockers.reported && s.blockers.count > 0) parts.push(`waits for the user: ${s.blockers.kinds.length ? s.blockers.kinds.map((k) => sanitizeLabel(k, 40)).join(", ") : String(s.blockers.count)}`)
+    return cutLine(`- ${parts.join(" · ")}`)
+  })
+  const compose = (shown: string[]) => [head, ...shown, ...(shown.length < lines.length ? [`(${lines.length - shown.length} more not shown)`] : []), machines].join("\n")
+  let shown = lines
+  let text = compose(shown)
+  while (text.length > FRONT_BOARD_MAX && shown.length > 0) {
+    shown = shown.slice(0, -1)
+    text = compose(shown)
+  }
+  return cutUnits(text, FRONT_BOARD_MAX).replace(LONE_SURROGATE, "")
+}

package/src/central/concierge/board-routes.ts

@@ -52,6 +52,8 @@ export interface BoardRouteDeps {
   /** Launched sessions' labels (the latest launch wins), for label filters. */
   readonly labels?: (userID: string) => Promise<ReadonlyMap<string, Readonly<Record<string, string>>>>
   readonly intents?: Pick<SessionIntents, "many">
+  /** Context cards: the shown roots' primary card headlines (docs/context-cards.md). */
+  readonly cards?: { primaries(userID: string, sessionIDs: Iterable<string>): Promise<ReadonlyMap<string, { readonly headline: string }>> }
   readonly results?: Pick<ResultTracker, "many">
   readonly identity?: ConciergeIdentity
   /** (CON-06) The Decision armed now by the current Concierge; a failure shows none armed. */
@@ -64,6 +66,12 @@ export interface BoardRouteDeps {
    * tier, Acting.coverage). Absent, or no current Concierge: every permission reads inGrant=no, auto=no.
    */
   readonly coverage?: (userID: string, conciergeSessionID: string, sessionID: string, requestID: string) => Promise<{ readonly inGrant: boolean; readonly auto: boolean }>
+  /**
+   * (Concierge grant requests) The verbs an active grant the current Concierge holds allows in a folder (Grants.usable
+   * per verb): the board's project-level inGrant, so the Concierge knows where it may offer to request one. Absent,
+   * no current Concierge or a failure: not shown.
+   */
+  readonly projectGrant?: (userID: string, conciergeSessionID: string, directory: string) => Promise<readonly string[]>
   readonly now?: Clock
 }
 
@@ -126,11 +134,13 @@ export async function conciergeBoard(deps: BoardRouteDeps, revisions: BoardRevis
   const machineName = new Map(ownMachines.map((m) => [m.id, m.name]))
   const slugs = new Map(facts.sessions.filter((f) => f.projectSlug !== undefined).map((f) => [f.sessionID, f.projectSlug!]))
   const coverage = await coverageOf(deps, userID, live)
-  const [intents, results, decisions, armed] = await Promise.all([
+  const projectGrants = await projectGrantsOf(deps, userID, live)
+  const [intents, results, decisions, armed, primaries] = await Promise.all([
     deps.intents ? deps.intents.many(userID, shown) : new Map(),
     deps.results ? deps.results.many(userID, shown) : new Map(),
     open,
     deps.armed ? deps.armed(userID).catch((cause: unknown) => (console.error(`[hub] concierge board: armed failed: ${(cause as Error).message}`), undefined)) : undefined,
+    deps.cards ? deps.cards.primaries(userID, shown).catch((cause: unknown) => (console.error(`[hub] concierge board: context cards failed: ${(cause as Error).message}`), undefined)) : undefined,
   ])
   const rootFacts = new Map<string, BoardRoot>()
   for (const id of shown) {
@@ -144,7 +154,8 @@ export async function conciergeBoard(deps: BoardRouteDeps, revisions: BoardRevis
     if (reported) {
       const s = reported.session
       const blockers = s.blockers.map((b) => ({ kind: b.kind, id: b.id, ...(b.action !== undefined ? { action: b.action } : {}), ...(b.kind === "permission" ? { inGrant: coverage.get(b.id)?.inGrant === true, auto: coverage.get(b.id)?.auto === true } : {}) }))
-      rootFacts.set(id, { ...common, machine: reported.machine, state: STATES.has(s.state) ? (s.state as ConciergeBoardState) : "idle", online: true, title: s.title, blockers })
+      const projectGrant = projectGrants.get(s.project ?? s.directory)
+      rootFacts.set(id, { ...common, machine: reported.machine, state: STATES.has(s.state) ? (s.state as ConciergeBoardState) : "idle", online: true, title: s.title, blockers, ...(projectGrant !== undefined ? { projectGrant } : {}) })
       continue
     }
     const machine = record?.machineID !== undefined ? machineName.get(record.machineID) : undefined
@@ -168,6 +179,7 @@ export async function conciergeBoard(deps: BoardRouteDeps, revisions: BoardRevis
     rootOf,
     intents,
     results,
+    ...(primaries?.size ? { cards: new Map([...primaries].map(([id, card]) => [id, card.headline])) } : {}),
     decisions: !deps.decisions ? { status: "unsupported", feature: "decisions" } : decisions.ok ? (decisions.list as BoardDecisionInput[]) : { status: "failed" },
     hidden,
     machines,
@@ -203,6 +215,17 @@ async function coverageOf(deps: BoardRouteDeps, userID: string, live: ReadonlyMa
   return out
 }
 
+/** (Concierge grant requests) The verbs the current Concierge's grants allow in each shown live session's project folder. */
+async function projectGrantsOf(deps: BoardRouteDeps, userID: string, live: ReadonlyMap<string, { session: CatalogSession }>): Promise<Map<string, readonly string[]>> {
+  const out = new Map<string, readonly string[]>()
+  if (!deps.projectGrant || !deps.identity) return out
+  const conciergeID = await deps.identity.current(userID).then((c) => c.sessionID, () => undefined)
+  if (conciergeID === undefined) return out
+  const folders = new Set([...live.values()].map(({ session }) => session.project ?? session.directory).filter((d): d is string => typeof d === "string" && d.length > 0))
+  await Promise.all([...folders].map((dir) => deps.projectGrant!(userID, conciergeID, dir).then((verbs) => void out.set(dir, verbs), () => undefined)))
+  return out
+}
+
 /** Muted sessions named on the line (the rest counted). */
 const MUTED_SHOWN = 20
 

package/src/central/concierge/board.ts

@@ -19,6 +19,7 @@
 // digest} (a SHA-256 of the content without `at`), version-checked, so it changes only when the content changes and
 // concurrent renders of one change bump it once. Nothing else is written.
 import { createHash } from "node:crypto"
+import { CONTEXT_CARD_LIMITS } from "../../../packages/protocol/src/context-cards"
 import {
   CONCIERGE_BOARD_LIMITS,
   CONCIERGE_BOARD_PENDING_MAX,
@@ -39,7 +40,7 @@ import { partyLabel } from "../agent/envelope"
 import { isPlaceholderTitle } from "../agent/names"
 import { updateVersioned } from "../agent/versioned"
 import type { StateStore } from "../backend/types"
-import { boardText } from "./board-render"
+import { boardText, PROJECT_GRANT_VERBS } from "./board-render"
 
 export const BOARD_COLLECTION = "concierge-board"
 const REVISION_KEY = "revision"
@@ -63,8 +64,12 @@ export interface BoardRoot {
   readonly title?: string
   /** Open blockers in the tree when this hub's catalog reports it; absent: not reported. Summaries are never read. */
   readonly blockers?: readonly { readonly kind: string; readonly id?: string; readonly action?: string; readonly inGrant?: boolean; readonly auto?: boolean }[]
+  /** (Concierge grant requests) The verbs a @@concierge grant allows in its project folder; absent: unknown. */
+  readonly projectGrant?: readonly string[]
 }
 
+const grantVerbs = (verbs: readonly string[]) => PROJECT_GRANT_VERBS.filter((v) => verbs.includes(v))
+
 /** The Decision fields the board reads (never question, options, recommendation or answer). */
 export type BoardDecisionInput = Pick<Decision, "id" | "from" | "about" | "urgency" | "tier" | "at" | "deadline" | "state">
 
@@ -88,6 +93,8 @@ export interface BoardInput {
   readonly intents: ReadonlyMap<string, SessionIntent>
   /** Last results of the shown roots. */
   readonly results: ReadonlyMap<string, LastResult>
+  /** Primary context card headlines of the shown roots (docs/context-cards.md). */
+  readonly cards?: ReadonlyMap<string, string>
   /** The user's open Decisions, or why there are none to show. */
   readonly decisions: readonly BoardDecisionInput[] | { readonly status: "unsupported"; readonly feature: string } | { readonly status: "failed" }
   /** The Concierge's own sessions (current and previous). */
@@ -136,6 +143,7 @@ function sessionItem(entry: WatchlistEntry, input: BoardInput, decisions: readon
   const intentText = stored ? label(stored.text, INTENT_MAX) : undefined
   const title = intentText === undefined && r && !isPlaceholderTitle(r.title) ? label(r.title, CONCIERGE_BOARD_LIMITS.titleChars) : undefined
   const blockers = r?.blockers
+  const pickup = label(input.cards?.get(entry.sessionID), CONTEXT_CARD_LIMITS.headline)
   const name = label(r?.name, LABEL_CHARS)
   const project = label(r?.project, LABEL_CHARS)
   const machine = label(r?.machine, LABEL_CHARS)
@@ -144,12 +152,14 @@ function sessionItem(entry: WatchlistEntry, input: BoardInput, decisions: readon
     ...(name ? { name } : {}),
     ...(project ? { project } : {}),
     ...(machine ? { machine } : {}),
+    ...(r?.projectGrant !== undefined ? { projectGrant: grantVerbs(r.projectGrant) } : {}),
     state,
     ...(since !== undefined ? { since } : {}),
     blockers: blockers ? { reported: true, count: blockers.length, kinds: [...new Set(blockers.map((b) => (BLOCKER_KIND.test(b.kind) ? b.kind : "other")))].sort(), ...pendingField(blockers) } : { reported: false },
     decisions,
     ...(intentText !== undefined && stored ? { intent: { text: intentText, source: stored.source } } : {}),
     ...(title !== undefined ? { title } : {}),
+    ...(pickup !== undefined ? { pickup } : {}),
     ...(result ? { lastResult: { at: result.at, outcome: result.outcome } } : {}),
     reasons: [...entry.reasons],
   }

package/src/central/concierge/context.ts

@@ -21,7 +21,7 @@
 import { CONCIERGE_TOOLS, SESSION_CONTEXT_FEATURE, SESSION_CONTEXT_LIMITS, type SessionContextRequest, type SessionContextResult } from "../../../packages/protocol/src/concierge"
 import type { Clock, Timers } from "../backend/types"
 import type { NotesStore } from "./notes"
-import { conciergeInstructions, grantLine, type GrantLineInput, NOTES_HEADER, RETIRED_INSTRUCTIONS } from "./prompt"
+import { conciergeInstructions, grantLines, type GrantLineInput, NOTES_HEADER, type RequestedGrantInput, RETIRED_INSTRUCTIONS } from "./prompt"
 import type { SettingsStore } from "./settings"
 
 export { CONCIERGE_TOOLS } from "../../../packages/protocol/src/concierge"
@@ -46,14 +46,22 @@ export interface ContextGrant {
   readonly permissions?: { readonly allow: readonly string[]; readonly never: readonly string[] }
 }
 
+/** (P2) The spoke feature that takes the frontBoard part (the Concierge's voice front). */
+export const CONCIERGE_FRONT_FEATURE = "conciergeFront"
+
 export interface ContextDeps {
-  readonly registry: { sessionTargets(sessionID: string): string[]; supports(connID: string, feature: typeof SESSION_CONTEXT_FEATURE): boolean; connTenant(connID: string): string | undefined }
+  readonly registry: { sessionTargets(sessionID: string): string[]; supports(connID: string, feature: typeof SESSION_CONTEXT_FEATURE | typeof CONCIERGE_FRONT_FEATURE): boolean; connTenant(connID: string): string | undefined }
   readonly send: (connID: string, req: SessionContextRequest) => Promise<SessionContextResult>
-  /** The rendered board of the user (renderBoard). */
-  readonly board: (userID: string) => Promise<string>
+  /**
+   * The rendered board of the user (renderBoard); (P2) with `front`, also the compact board for the voice front
+   * (renderFrontBoard), sent as the frontBoard part to spokes that take it.
+   */
+  readonly board: (userID: string) => Promise<string | { readonly rendered: string; readonly front?: string }>
   readonly notes: Pick<NotesStore, "get">
   readonly settings: Pick<SettingsStore, "get">
   readonly grant: (userID: string, grantID: string) => Promise<ContextGrant | undefined>
+  /** (Concierge grant requests) The user's @@concierge grants: the active ones besides the Settings grant are named. */
+  readonly requested?: (userID: string) => Promise<readonly ContextGrant[]>
   /** (CON-09a) Speech is set up for the user (the instructions mention voice and voice confirm). Absent: false. */
   readonly voice?: (userID: string) => boolean
   readonly now?: Clock
@@ -105,13 +113,26 @@ export class ContextPusher {
     return { state: "ended", id: grant.id, at: grant.revokedAt ?? grant.expiresAt }
   }
 
-  private async build(userID: string, sessionID: string): Promise<Body> {
-    const [settings, notes, board] = await Promise.all([this.deps.settings.get(userID), this.deps.notes.get(userID), this.deps.board(userID)])
+  /** (Concierge grant requests) The active requested grants (not the Settings grant); a failed read names none. */
+  private async requestedGrants(userID: string, settingsGrantID: string | undefined): Promise<RequestedGrantInput[]> {
+    if (!this.deps.requested) return []
+    const grants = await this.deps.requested(userID).catch(() => [] as readonly ContextGrant[])
+    const active = grants.filter((g) => g.state === "active" && g.id !== settingsGrantID)
+    return active.map((g) => ({ id: g.id, allow: g.allow, projects: g.scope.projects, expiresAt: g.expiresAt }))
+  }
+
+  private async build(userID: string, sessionID: string, connID: string): Promise<Body> {
+    const [settings, notes, boards] = await Promise.all([this.deps.settings.get(userID), this.deps.notes.get(userID), this.deps.board(userID)])
+    const board = typeof boards === "string" ? boards : boards.rendered
+    const front = typeof boards === "string" ? undefined : boards.front
     const grant = await this.grantInput(userID, settings.grantID)
+    const requested = await this.requestedGrants(userID, settings.grantID)
     const parts: SessionContextRequest["parts"][number][] = [
       { key: "instructions", text: cut(conciergeInstructions({ voice: this.deps.voice?.(userID) === true, timeZone: settings.timeZone })) },
-      { key: "board", text: cut(`${grantLine(grant, settings.timeZone)}\n${board}`) },
+      { key: "board", text: cut(`${grantLines(grant, requested, settings.timeZone)}\n${board}`) },
       ...(notes.text ? [{ key: "notes" as const, text: cut(`${NOTES_HEADER}\n${notes.text}`) }] : []),
+      // (P2) Only a spoke that takes it: an older one refuses an unknown part key.
+      ...(front !== undefined && this.deps.registry.supports(connID, CONCIERGE_FRONT_FEATURE) ? [{ key: "frontBoard" as const, text: cut(front) }] : []),
     ]
     return { op: "sessionContext", sessionID, parts, tools: { allow: [...CONCIERGE_TOOLS] }, lockAgent: true }
   }
@@ -137,7 +158,7 @@ export class ContextPusher {
     try {
       const connID = this.target(userID, sessionID)
       if (connID === undefined) return false
-      const body = await this.build(userID, sessionID)
+      const body = await this.build(userID, sessionID, connID)
       const digest = JSON.stringify(body)
       const key = `${userID}\n${sessionID}`
       const known = this.sent.get(key)