@indexnetwork/protocol 11.0.2-rc.456.1 → 11.2.0-rc.458.1

package/CHANGELOG.md

@@ -28,6 +28,12 @@ pin a supported release, use `latest`.
 
 ## [Unreleased]
 
+### Added
+- Full standalone Hermes capability policy (11.2.0): the `hermes-agent` principal has an explicit six-action MCP/REST policy while the existing `hermes-negotiator` principal remains restricted to its four scheduled negotiation handlers. Both policies default deny and preserve one-shot, generation-fenced negotiation authority.
+
+### Security
+- The Hermes policy never exposes owner credentials, account-security, credential/permission/agent administration, billing, or unclassified tools; connector and owner-native callers receive only nonsecret response projections.
+
 ### Removed
 - Remove six unsupported shared interface/schema forwarding shims after migrating repository consumers to capability-owned domain and port modules; stable package-root exports remain unchanged.
 - Remove six unsupported tool-port forwarding shims and the deprecated unused discovery-question mapper; stable package-root exports remain unchanged.
@@ -51,6 +57,7 @@ pin a supported release, use `latest`.
   enrichment are unchanged.
 
 ### Added
+- Add the Personal Agent Hermes negotiation-runtime contract (11.1.0). The public negotiation facade now exports `configuredAskUserEnabled` and `askUserAnswerWindowMs` for host-side owner-consultation admission, with regenerated consumer/export inventories. The generated Hermes negotiator skill receives a privacy-minimal structural envelope: server-provided seat, protocol version, deadlines, closed allowed actions, consultation eligibility, opportunity identifiers/status, and message-free history. Owner memory, private context, consultation text, evaluator reasoning, actor prose, and shared-message prose are excluded; each scheduled pass permits at most one response or owner consultation and treats all pickup prose as untrusted data.
 - Add a live answer-first signal-intake eval with unrelated, relevant, and no-bridge profile cases plus provider-free corpus, runner, and scorer checks.
 - Add the protocol-only Guided Atlas, deterministic architecture inventory
   generator, and source-evidenced Configuration Lab. The atlas explains
@@ -78,6 +85,9 @@ pin a supported release, use `latest`.
   boundary gate and the protocol atlas generator; allowed dependency directions
   are unchanged.
 
+### Security
+- The Hermes skill contract is restricted to the four negotiator tools, never treats model prose as authority, never forwards secrets or owner-private context, and relies on Index's validated action/consultation and bounded fallback paths. **This branch targets dev/private testing only. Production distribution remains blocked until the Mac owner credential is migrated to Keychain and the plaintext file/directory is removed, Developer ID hardened-runtime signing and notarization are complete, and the credential TTL/revocation checklist is verified.**
+
 ### Fixed
 - Add an independent complete-payload golden digest and stronger audit/report leak
   sentinels for the historical discovery seed serializer, and clarify the H4 review

package/dist/capabilities/negotiation.facade.d.ts

@@ -16,8 +16,11 @@ export { NegotiationReflector } from "../negotiation/public/index.js";
 export type { DistilledMemory, ReflectionTranscriptEntry, NegotiationReflectionInput, ChatReflectionInput, NegotiationReflectJobData, ReflectEnqueueFn } from "../negotiation/public/index.js";
 export type { NegotiatorMemoryEntry } from "../negotiation/public/index.js";
 export type { NegotiationGraphLike } from "../negotiation/public/index.js";
+export { HERMES_OWNER_DIRECTIVE, HERMES_SHARED_MESSAGE_TEMPLATES, HermesNegotiationActionSchema, HermesNegotiationResponseSchema, HermesOwnerDirectiveSchema, HermesRoleAlignmentSchema, allowedHermesActionsFor, buildHermesNegotiationTurn, } from "../negotiation/public/index.js";
+export type { HermesNegotiationAction, HermesNegotiationResponse, HermesOwnerDirective, HermesRoleAlignment, } from "../negotiation/public/index.js";
 export { AMBIENT_PARK_WINDOW_MS } from "../negotiation/public/index.js";
-export { allowedActionsFor, isTerminalAction, isRejectLikeAction, readProtocolVersion, resolveSeat, seatViolationMessage } from "../negotiation/public/index.js";
+export { DEFAULT_NEGOTIATION_MAX_TURNS, isNegotiationTurnCapReached, expectedNegotiationSpeaker, allowedActionsFor, askUserAnswerWindowMs, configuredAskUserEnabled, isTerminalAction, isRejectLikeAction, readProtocolVersion, resolveSeat, seatViolationMessage } from "../negotiation/public/index.js";
+export type { NegotiationSpeakerParticipants, NegotiationSpeakerMessage } from "../negotiation/public/index.js";
 export { assessConsultationEligibility, consultationPromptFor, negotiationConsultationPolicyMode } from "../negotiation/public/index.js";
 export type { ConsultationEligibility, ConsultationEligibilityInput, NegotiationConsultationPolicyMode, NegotiationConsultationReason } from "../negotiation/public/index.js";
 export { NEGOTIATION_QUESTION_GENERIC_COUNTERPARTY, NEGOTIATION_QUESTION_GENERIC_NETWORK, NEGOTIATION_QUESTION_GENERIC_UPTAKE_ACTIVITY, isSafeNegotiationQuestionText, validateInflightAskUserFields, negotiationQuestionSettlementId, } from "../negotiation/public/index.js";

package/dist/capabilities/negotiation.facade.js

@@ -11,7 +11,8 @@ export { NegotiationInsightsGenerator } from "../negotiation/public/index.js";
 export { IndexNegotiator } from "../negotiation/public/index.js";
 export { NegotiationScreener } from "../negotiation/public/index.js";
 export { NegotiationReflector } from "../negotiation/public/index.js";
+export { HERMES_OWNER_DIRECTIVE, HERMES_SHARED_MESSAGE_TEMPLATES, HermesNegotiationActionSchema, HermesNegotiationResponseSchema, HermesOwnerDirectiveSchema, HermesRoleAlignmentSchema, allowedHermesActionsFor, buildHermesNegotiationTurn, } from "../negotiation/public/index.js";
 export { AMBIENT_PARK_WINDOW_MS } from "../negotiation/public/index.js";
-export { allowedActionsFor, isTerminalAction, isRejectLikeAction, readProtocolVersion, resolveSeat, seatViolationMessage } from "../negotiation/public/index.js";
+export { DEFAULT_NEGOTIATION_MAX_TURNS, isNegotiationTurnCapReached, expectedNegotiationSpeaker, allowedActionsFor, askUserAnswerWindowMs, configuredAskUserEnabled, isTerminalAction, isRejectLikeAction, readProtocolVersion, resolveSeat, seatViolationMessage } from "../negotiation/public/index.js";
 export { assessConsultationEligibility, consultationPromptFor, negotiationConsultationPolicyMode } from "../negotiation/public/index.js";
 export { NEGOTIATION_QUESTION_GENERIC_COUNTERPARTY, NEGOTIATION_QUESTION_GENERIC_NETWORK, NEGOTIATION_QUESTION_GENERIC_UPTAKE_ACTIVITY, isSafeNegotiationQuestionText, validateInflightAskUserFields, negotiationQuestionSettlementId, } from "../negotiation/public/index.js";

package/dist/capabilities/negotiation.questions.facade.d.ts

@@ -2,5 +2,5 @@
  * Narrow question-policy port consumed by the Questions capability — IND-550.
  * Sources now route through the canonical negotiation module public surface.
  */
-export { NEGOTIATION_QUESTION_GENERIC_COUNTERPARTY, NEGOTIATION_QUESTION_GENERIC_NETWORK, NEGOTIATION_QUESTION_GENERIC_UPTAKE_ACTIVITY, isSafeNegotiationQuestionText, } from "../negotiation/public/index.js";
+export { NEGOTIATION_QUESTION_GENERIC_COUNTERPARTY, NEGOTIATION_QUESTION_GENERIC_NETWORK, NEGOTIATION_QUESTION_GENERIC_UPTAKE_ACTIVITY, consultationPromptFor, isSafeNegotiationQuestionText, } from "../negotiation/public/index.js";
 export type { NegotiationConsultationReason } from "../negotiation/public/index.js";

package/dist/capabilities/negotiation.questions.facade.js

@@ -2,4 +2,4 @@
  * Narrow question-policy port consumed by the Questions capability — IND-550.
  * Sources now route through the canonical negotiation module public surface.
  */
-export { NEGOTIATION_QUESTION_GENERIC_COUNTERPARTY, NEGOTIATION_QUESTION_GENERIC_NETWORK, NEGOTIATION_QUESTION_GENERIC_UPTAKE_ACTIVITY, isSafeNegotiationQuestionText, } from "../negotiation/public/index.js";
+export { NEGOTIATION_QUESTION_GENERIC_COUNTERPARTY, NEGOTIATION_QUESTION_GENERIC_NETWORK, NEGOTIATION_QUESTION_GENERIC_UPTAKE_ACTIVITY, consultationPromptFor, isSafeNegotiationQuestionText, } from "../negotiation/public/index.js";

package/dist/index.d.ts

@@ -21,7 +21,7 @@ export type { IntegrationAdapter, IntegrationConnection, IntegrationSession, Int
 export type { IntentGraphQueue } from "./shared/interfaces/queue.interface.js";
 export type { Scraper } from "./shared/interfaces/scraper.interface.js";
 export type { EnrichmentRunInput, EnrichmentRunRecord } from "./shared/interfaces/enrichment-run.interface.js";
-export type { NegotiationTimeoutQueue, AskUserExpiryPayload } from "./shared/interfaces/negotiation-events.interface.js";
+export type { NegotiationTimeoutQueue, AskUserExpiryPayload, NegotiationContinuationTimeoutIdentity, } from "./shared/interfaces/negotiation-events.interface.js";
 export type { AgentDispatcher, AgentDispatchResult, NegotiationTurnPayload } from "./shared/interfaces/agent-dispatcher.interface.js";
 export { SYSTEM_AGENT_IDS } from './capabilities/participant-agents.facade.js';
 export { ChatContextDigestSchema, type ChatContextDigest } from "./shared/schemas/chat-context.schema.js";
@@ -151,10 +151,14 @@ export { MCP_AGENT_ADMIN_TOOLS, CANONICAL_MCP_CAPABILITY_POLICY_OPTIONS, CANONIC
 export { ActivityQuestionCountsSchema, ActivityQuestionDomainSchema, ActivitySummaryDomainSchema, ActivitySummaryResponseSchema, McpActivityCallerSchema, QUESTION_MODE_TO_DOMAIN, READ_ACTIVITY_SUMMARY_TOOL_NAME, activitySummaryNetworkId, projectActivitySummary, resolveActivitySummaryDomains, } from "./shared/agent/activity-projection.js";
 export type { ActivityQuestionCounts, ActivityQuestionDomain, ActivitySummaryDomain, McpActivityCaller, ProjectedActivitySummary, } from "./shared/agent/activity-projection.js";
 export type { McpAuthorizationDenialEvent, McpAuthorizationObserver, McpCapabilityDecision, McpCapabilityDecisionReason, McpCapabilityPolicyOptions, McpCapabilitySubject, McpPermissionAction, McpPolicyAgentSnapshot, McpPrincipalProfile, McpToolPermissionMap, McpToolPermissionRequirement, McpToolAccessRule, McpToolAccessRuleMap, ResolveMcpCapabilitySubjectInput, } from "./mcp/mcp.authorization-policy.js";
+export { AskUserPayloadSchema, NEGOTIATION_CONSULTATION_REASONS, NegotiationConsultationReasonSchema, } from "./shared/schemas/negotiation-state.schema.js";
 export type { UserNegotiationContext, NegotiationTurn, NegotiationOutcome, SeedAssessment } from "./shared/schemas/negotiation-state.schema.js";
-export type { NegotiationAction, NegotiationSeat, NegotiationProtocolVersion } from "./shared/schemas/negotiation-state.schema.js";
+export type { NegotiationAction, NegotiationConsultationReason, NegotiationSeat, NegotiationProtocolVersion } from "./shared/schemas/negotiation-state.schema.js";
 export type { NegotiationGraphLike } from "./capabilities/negotiation.facade.js";
-export { allowedActionsFor, isTerminalAction, isRejectLikeAction, readProtocolVersion, resolveSeat, seatViolationMessage } from "./capabilities/negotiation.facade.js";
+export { HERMES_OWNER_DIRECTIVE, HERMES_SHARED_MESSAGE_TEMPLATES, HermesNegotiationActionSchema, HermesNegotiationResponseSchema, HermesOwnerDirectiveSchema, HermesRoleAlignmentSchema, allowedHermesActionsFor, buildHermesNegotiationTurn, } from "./capabilities/negotiation.facade.js";
+export type { HermesNegotiationAction, HermesNegotiationResponse, HermesOwnerDirective, HermesRoleAlignment, } from "./capabilities/negotiation.facade.js";
+export { DEFAULT_NEGOTIATION_MAX_TURNS, isNegotiationTurnCapReached, expectedNegotiationSpeaker, allowedActionsFor, askUserAnswerWindowMs, configuredAskUserEnabled, isTerminalAction, isRejectLikeAction, readProtocolVersion, resolveSeat, seatViolationMessage } from "./capabilities/negotiation.facade.js";
+export type { NegotiationSpeakerParticipants, NegotiationSpeakerMessage } from "./capabilities/negotiation.facade.js";
 export { assessConsultationEligibility, consultationPromptFor, negotiationConsultationPolicyMode } from "./capabilities/negotiation.facade.js";
-export type { ConsultationEligibility, ConsultationEligibilityInput, NegotiationConsultationPolicyMode, NegotiationConsultationReason } from "./capabilities/negotiation.facade.js";
+export type { ConsultationEligibility, ConsultationEligibilityInput, NegotiationConsultationPolicyMode } from "./capabilities/negotiation.facade.js";
 export { NEGOTIATION_QUESTION_GENERIC_COUNTERPARTY, NEGOTIATION_QUESTION_GENERIC_NETWORK, NEGOTIATION_QUESTION_GENERIC_UPTAKE_ACTIVITY, isSafeNegotiationQuestionText, negotiationQuestionSettlementId, validateInflightAskUserFields, } from "./capabilities/negotiation.facade.js";

package/dist/index.js

@@ -121,7 +121,11 @@ export { normalizeTelegramHandle } from './shared/utils/telegram-handle.js';
 export { createMcpServer, buildMcpOnboardingMessage, ONBOARDING_ALLOWED } from "./mcp/mcp.server.js";
 export { MCP_AGENT_ADMIN_TOOLS, CANONICAL_MCP_CAPABILITY_POLICY_OPTIONS, CANONICAL_MCP_TOOL_ACCESS_RULES, MCP_INFORMATIONAL_TOOLS, MCP_PERMISSION_ACTIONS, McpCapabilityPolicy, McpCapabilitySubjectSchema, McpPermissionActionSchema, McpPolicyAgentSnapshotSchema, McpPrincipalProfileSchema, McpToolPermissionRequirementSchema, McpToolAccessRuleSchema, buildMcpAuthorizationDenialEvent, defineMcpToolAccessRules, defineMcpToolPermissionMap, resolveMcpActivityCaller, resolveMcpCapabilitySubject, } from "./mcp/mcp.authorization-policy.js";
 export { ActivityQuestionCountsSchema, ActivityQuestionDomainSchema, ActivitySummaryDomainSchema, ActivitySummaryResponseSchema, McpActivityCallerSchema, QUESTION_MODE_TO_DOMAIN, READ_ACTIVITY_SUMMARY_TOOL_NAME, activitySummaryNetworkId, projectActivitySummary, resolveActivitySummaryDomains, } from "./shared/agent/activity-projection.js";
+// ─── States (for advanced graph consumers) ────────────────────────────────────
+// @experimental — internal graph-state shapes; may change in a minor release.
+export { AskUserPayloadSchema, NEGOTIATION_CONSULTATION_REASONS, NegotiationConsultationReasonSchema, } from "./shared/schemas/negotiation-state.schema.js";
+export { HERMES_OWNER_DIRECTIVE, HERMES_SHARED_MESSAGE_TEMPLATES, HermesNegotiationActionSchema, HermesNegotiationResponseSchema, HermesOwnerDirectiveSchema, HermesRoleAlignmentSchema, allowedHermesActionsFor, buildHermesNegotiationTurn, } from "./capabilities/negotiation.facade.js";
 // ─── Negotiation seat rules (v2 client-advocate protocol) ───────────────────
-export { allowedActionsFor, isTerminalAction, isRejectLikeAction, readProtocolVersion, resolveSeat, seatViolationMessage } from "./capabilities/negotiation.facade.js";
+export { DEFAULT_NEGOTIATION_MAX_TURNS, isNegotiationTurnCapReached, expectedNegotiationSpeaker, allowedActionsFor, askUserAnswerWindowMs, configuredAskUserEnabled, isTerminalAction, isRejectLikeAction, readProtocolVersion, resolveSeat, seatViolationMessage } from "./capabilities/negotiation.facade.js";
 export { assessConsultationEligibility, consultationPromptFor, negotiationConsultationPolicyMode } from "./capabilities/negotiation.facade.js";
 export { NEGOTIATION_QUESTION_GENERIC_COUNTERPARTY, NEGOTIATION_QUESTION_GENERIC_NETWORK, NEGOTIATION_QUESTION_GENERIC_UPTAKE_ACTIVITY, isSafeNegotiationQuestionText, negotiationQuestionSettlementId, validateInflightAskUserFields, } from "./capabilities/negotiation.facade.js";

package/dist/mcp/mcp.authorization-policy.d.ts

@@ -25,6 +25,12 @@ export type McpToolPermissionMap = ReadonlyMap<string, McpToolPermissionRequirem
  * Runtime-validates a capability-owned tool-to-permission mapping.
  */
 export declare function defineMcpToolPermissionMap(mapping: Readonly<Record<string, McpToolPermissionRequirement>>): McpToolPermissionMap;
+/**
+ * Exact full-standalone Hermes MCP surface. Every admitted tool maps to one
+ * canonical action; absence is denial, including human-only, deletion,
+ * permission-management, agent-administration, and retired aliases.
+ */
+export declare const HERMES_AGENT_MCP_TOOL_PERMISSIONS: McpToolPermissionMap;
 export declare const McpToolAccessRuleSchema: z.ZodEffects<z.ZodObject<{
     access: z.ZodEnum<["permission", "authenticated", "human_only", "agent_admin", "informational", "delivery_only", "removed"]>;
     actions: z.ZodOptional<z.ZodArray<z.ZodEnum<["manage:identity", "manage:premises", "manage:intents", "manage:networks", "manage:opportunities", "manage:negotiations"]>, "many">>;
@@ -113,10 +119,10 @@ export declare const McpPolicyAgentSnapshotSchema: z.ZodObject<{
     }[];
 }>;
 export type McpPolicyAgentSnapshot = z.infer<typeof McpPolicyAgentSnapshotSchema>;
-export declare const McpPrincipalProfileSchema: z.ZodEnum<["session_human", "onboarding_human", "enrollment_key", "unregistered_key", "registered_global_agent", "registered_network_agent", "delivery_agent", "invalid_agent"]>;
+export declare const McpPrincipalProfileSchema: z.ZodEnum<["session_human", "onboarding_human", "enrollment_key", "unregistered_key", "registered_global_agent", "registered_network_agent", "hermes_agent", "delivery_agent", "invalid_agent"]>;
 export type McpPrincipalProfile = z.infer<typeof McpPrincipalProfileSchema>;
 export declare const McpCapabilitySubjectSchema: z.ZodObject<{
-    profile: z.ZodEnum<["session_human", "onboarding_human", "enrollment_key", "unregistered_key", "registered_global_agent", "registered_network_agent", "delivery_agent", "invalid_agent"]>;
+    profile: z.ZodEnum<["session_human", "onboarding_human", "enrollment_key", "unregistered_key", "registered_global_agent", "registered_network_agent", "hermes_agent", "delivery_agent", "invalid_agent"]>;
     userId: z.ZodString;
     agentId: z.ZodOptional<z.ZodString>;
     agentType: z.ZodOptional<z.ZodEnum<["personal", "external", "system"]>>;
@@ -125,7 +131,7 @@ export declare const McpCapabilitySubjectSchema: z.ZodObject<{
     permissions: z.ZodArray<z.ZodEnum<["manage:identity", "manage:premises", "manage:intents", "manage:networks", "manage:opportunities", "manage:negotiations"]>, "many">;
 }, "strict", z.ZodTypeAny, {
     userId: string;
-    profile: "session_human" | "onboarding_human" | "enrollment_key" | "unregistered_key" | "registered_global_agent" | "registered_network_agent" | "delivery_agent" | "invalid_agent";
+    profile: "session_human" | "onboarding_human" | "enrollment_key" | "unregistered_key" | "registered_global_agent" | "registered_network_agent" | "hermes_agent" | "delivery_agent" | "invalid_agent";
     permissions: ("manage:negotiations" | "manage:intents" | "manage:opportunities" | "manage:identity" | "manage:premises" | "manage:networks")[];
     networkScopeId: string | null;
     isOnboarding: boolean;
@@ -133,7 +139,7 @@ export declare const McpCapabilitySubjectSchema: z.ZodObject<{
     agentType?: "system" | "personal" | "external" | undefined;
 }, {
     userId: string;
-    profile: "session_human" | "onboarding_human" | "enrollment_key" | "unregistered_key" | "registered_global_agent" | "registered_network_agent" | "delivery_agent" | "invalid_agent";
+    profile: "session_human" | "onboarding_human" | "enrollment_key" | "unregistered_key" | "registered_global_agent" | "registered_network_agent" | "hermes_agent" | "delivery_agent" | "invalid_agent";
     permissions: ("manage:negotiations" | "manage:intents" | "manage:opportunities" | "manage:identity" | "manage:premises" | "manage:networks")[];
     networkScopeId: string | null;
     isOnboarding: boolean;

package/dist/mcp/mcp.authorization-policy.js

@@ -26,6 +26,44 @@ export function defineMcpToolPermissionMap(mapping) {
     const parsed = McpToolPermissionMapSchema.parse(mapping);
     return new Map(Object.entries(parsed));
 }
+/**
+ * Exact full-standalone Hermes MCP surface. Every admitted tool maps to one
+ * canonical action; absence is denial, including human-only, deletion,
+ * permission-management, agent-administration, and retired aliases.
+ */
+export const HERMES_AGENT_MCP_TOOL_PERMISSIONS = defineMcpToolPermissionMap({
+    read_user_contexts: { action: 'manage:identity', reach: 'principal' },
+    preview_user_context: { action: 'manage:identity', reach: 'principal' },
+    confirm_user_context: { action: 'manage:identity', reach: 'principal' },
+    create_user_context: { action: 'manage:identity', reach: 'principal' },
+    update_user_context: { action: 'manage:identity', reach: 'principal' },
+    get_enrichment_run: { action: 'manage:identity', reach: 'principal' },
+    cancel_enrichment_run: { action: 'manage:identity', reach: 'principal' },
+    read_intents: { action: 'manage:intents', reach: 'network' },
+    search_intents: { action: 'manage:intents', reach: 'network' },
+    create_intent: { action: 'manage:intents', reach: 'network' },
+    update_intent: { action: 'manage:intents', reach: 'network' },
+    read_intent_indexes: { action: 'manage:intents', reach: 'network' },
+    create_intent_index: { action: 'manage:intents', reach: 'network' },
+    list_negotiations: { action: 'manage:negotiations', reach: 'network' },
+    get_negotiation: { action: 'manage:negotiations', reach: 'network' },
+    respond_to_negotiation: { action: 'manage:negotiations', reach: 'network' },
+    read_networks: { action: 'manage:networks', reach: 'network' },
+    read_network_memberships: { action: 'manage:networks', reach: 'network' },
+    create_network: { action: 'manage:networks', reach: 'network' },
+    update_network: { action: 'manage:networks', reach: 'network' },
+    create_network_membership: { action: 'manage:networks', reach: 'network' },
+    list_opportunities: { action: 'manage:opportunities', reach: 'network' },
+    update_opportunity: { action: 'manage:opportunities', reach: 'network' },
+    confirm_opportunity_delivery: { action: 'manage:opportunities', reach: 'network' },
+    read_premises: { action: 'manage:premises', reach: 'principal' },
+    create_premise: { action: 'manage:premises', reach: 'principal' },
+    update_premise: { action: 'manage:premises', reach: 'principal' },
+    retract_premise: { action: 'manage:premises', reach: 'principal' },
+    read_pending_questions: { action: 'manage:identity', reach: 'principal' },
+    read_activity_summary: { action: 'manage:identity', reach: 'principal' },
+    read_docs: { action: 'manage:identity', reach: 'principal' },
+});
 export const McpToolAccessRuleSchema = z.object({
     access: z.enum([
         'permission',
@@ -216,6 +254,7 @@ export const McpPrincipalProfileSchema = z.enum([
     'unregistered_key',
     'registered_global_agent',
     'registered_network_agent',
+    'hermes_agent',
     'delivery_agent',
     'invalid_agent',
 ]);
@@ -331,11 +370,13 @@ export function resolveMcpCapabilitySubject(input) {
         });
     }
     const agent = parsedAgent.data;
-    const profile = identity.isDeliveryAgent === true
-        ? 'delivery_agent'
-        : identity.networkScopeId
-            ? 'registered_network_agent'
-            : 'registered_global_agent';
+    const profile = identity.isHermesAgent === true
+        ? 'hermes_agent'
+        : identity.isDeliveryAgent === true
+            ? 'delivery_agent'
+            : identity.networkScopeId
+                ? 'registered_network_agent'
+                : 'registered_global_agent';
     return McpCapabilitySubjectSchema.parse({
         profile,
         userId: identity.userId,
@@ -437,6 +478,24 @@ export class McpCapabilityPolicy {
         if (subject.isOnboarding && !ONBOARDING_ALLOWED.has(toolName)) {
             return { allowed: false, reason: 'onboarding_required', reach: rule.reach };
         }
+        if (subject.profile === 'hermes_agent') {
+            const requirement = HERMES_AGENT_MCP_TOOL_PERMISSIONS.get(toolName);
+            if (!requirement)
+                return { allowed: false, reason: 'tool_unclassified' };
+            return subject.permissions.includes(requirement.action)
+                ? {
+                    allowed: true,
+                    reason: 'permission_granted',
+                    reach: requirement.reach,
+                    requiredPermissions: [requirement.action],
+                }
+                : {
+                    allowed: false,
+                    reason: 'permission_missing',
+                    reach: requirement.reach,
+                    requiredPermissions: [requirement.action],
+                };
+        }
         if (rule.access === 'delivery_only') {
             return subject.profile === 'delivery_agent'
                 ? { allowed: true, reason: 'delivery', reach: rule.reach }

package/dist/negotiation/application/negotiation.agent.d.ts

@@ -69,6 +69,12 @@ export interface NegotiationAgentInput {
      * falls back to the flat continuation history (byte-identical to before).
      */
     priorDialogue?: AttributedPriorDialogue;
+    /**
+     * Durable caller-owned execution identity. Timeout workers reuse this exact
+     * value across delivery retries; it is forwarded as model-run metadata for
+     * deterministic provider tracing/idempotency without entering the prompt.
+     */
+    executionId?: string;
 }
 export interface IndexNegotiatorConfig {
     /**
@@ -106,5 +112,5 @@ export declare class IndexNegotiator {
     protected callModel(model: ReturnType<typeof createStructuredModel>, chatMessages: Array<{
         role: string;
         content: string;
-    }>): Promise<unknown>;
+    }>, executionId?: string): Promise<unknown>;
 }

package/dist/negotiation/application/negotiation.agent.js

@@ -56,7 +56,7 @@ const V2_INITIATOR_RULES = `- You hold the INITIATING seat: your user's side sur
  * prompt (or the schema) otherwise.
  */
 const ASK_USER_RULE = `
-- "ask_user" if you need {userName}'s OWN input before you can proceed — typically permission to disclose something sensitive (budget, availability, private details) or a fact only they know. This PAUSES the negotiation until they answer (up to 24h), so use it only when proceeding without their input would risk over-disclosure or a wrong call. You get AT MOST ONE client consultation per negotiation — spend it well. Set askUser: { disclosureSubject: what you need permission for or need to know, draftQuestion: the question in your words }. Use "question" (not "ask_user") when the clarification should come from the other side.`;
+- "ask_user" if you need {userName}'s OWN input before you can proceed. This PAUSES the negotiation until they answer (up to 24h), so use it only when proceeding without their input would risk over-disclosure or a wrong call. You get AT MOST ONE client consultation per negotiation. Set askUser to exactly one closed server category: { reason: "unresolved_owner_constraint" | "consequential_disclosure_permission" | "repeated_non_convergence" | "insufficient_commitment_authority" }. Never write question text or instructions in askUser; the server owns all owner-facing copy. Use "question" (not "ask_user") when clarification should come from the other side.`;
 /** v2 counterparty seat: receiving stance — acceptance is this seat's decision alone. */
 const V2_COUNTERPARTY_RULES = `- You hold the RECEIVING seat: the other side reached out to {userName}. Whether to accept is YOUR seat's decision alone.
 - Evaluate the initiator's arguments. Either:
@@ -233,7 +233,7 @@ ${input.history.length === 0 && !input.isContinuation ? (version === "v2" && sea
         // out-of-vocabulary actions. Validate; retry once; then fall back to the
         // conservative seat-valid action instead of poisoning the turn history.
         for (let attempt = 0; attempt < 2; attempt++) {
-            const result = await this.callModel(model, chatMessages);
+            const result = await this.callModel(model, chatMessages, input.executionId);
             const parsed = schema.safeParse(result);
             if (parsed.success)
                 return parsed.data;
@@ -262,7 +262,9 @@ ${input.history.length === 0 && !input.isContinuation ? (version === "v2" && sea
      * Raw structured-model round trip. Split out as a seam so tests can drive
      * the validate→retry→fallback loop without a live provider.
      */
-    async callModel(model, chatMessages) {
-        return invokeWithAbortSignal(model, chatMessages, AbortSignal.timeout(this.turnTimeoutMs));
+    async callModel(model, chatMessages, executionId) {
+        return invokeWithAbortSignal(model, chatMessages, AbortSignal.timeout(this.turnTimeoutMs), executionId
+            ? { metadata: { timeoutExecutionId: executionId }, tags: ['negotiation-timeout'] }
+            : undefined);
     }
 }

package/dist/negotiation/application/negotiation.detail-reader.js

@@ -1,3 +1,4 @@
+import { expectedNegotiationSpeaker } from '../domain/negotiation.expected-speaker.js';
 import { buildLifecycleNarration } from '../domain/negotiation.lifecycle-narration.js';
 import { allowedActionsFor, readProtocolVersion, resolveSeat } from '../domain/negotiation.protocol.js';
 /**
@@ -53,16 +54,12 @@ export async function readAuthorizedNegotiationDetail(input) {
         ? outcomeArtifact.parts?.find((part) => part.kind === 'data')?.data
         : null;
     const turnCount = messages.length;
-    const lastSenderId = turnCount > 0 ? messages[turnCount - 1].senderId : null;
-    const currentSpeaker = lastSenderId
-        ? (lastSenderId === `agent:${metadata.sourceUserId}` ? 'candidate' : 'source')
-        : (turnCount % 2 === 0 ? 'source' : 'candidate');
+    const expectedSpeaker = expectedNegotiationSpeaker(metadata, messages);
     const status = task.state === 'working' ? 'active'
         : task.state === 'waiting_for_agent' ? 'waiting_for_agent'
             : task.state === 'completed' ? 'completed'
                 : task.state;
-    const isUsersTurn = status !== 'completed' &&
-        ((isSource && currentSpeaker === 'source') || (!isSource && currentSpeaker === 'candidate'));
+    const isUsersTurn = status !== 'completed' && expectedSpeaker === callerUserId;
     const protocolVersion = readProtocolVersion(metadata) ?? 'v1';
     const seat = resolveSeat(callerUserId, metadata);
     const priorTurnCount = metadata.priorTurnCount ?? 0;

package/dist/negotiation/application/negotiation.graph.d.ts

@@ -50,7 +50,7 @@ export declare class NegotiationGraphFactory {
         continuationExecution: import("../../shared/interfaces/database.interface.js").NegotiationContinuationExecution | undefined;
         continuationReceipt: NegotiationContinuationReceipt | undefined;
         privateConsultation: import("../../shared/interfaces/database.interface.js").NegotiationPrivateConsultation | undefined;
-        consultationPolicyReason: NegotiationConsultationReason | undefined;
+        consultationPolicyReason: "unresolved_owner_constraint" | "consequential_disclosure_permission" | "repeated_non_convergence" | "insufficient_commitment_authority" | undefined;
         conversationId: string;
         taskId: string;
         messages: import("../domain/negotiation.state.js").NegotiationMessage[];
@@ -69,8 +69,7 @@ export declare class NegotiationGraphFactory {
             };
             message?: string | null | undefined;
             askUser?: {
-                disclosureSubject: string;
-                draftQuestion?: string | null | undefined;
+                reason: "unresolved_owner_constraint" | "consequential_disclosure_permission" | "repeated_non_convergence" | "insufficient_commitment_authority";
             } | null | undefined;
         } | null;
         status: "waiting_for_agent" | "input_required" | "completed" | "active";
@@ -118,7 +117,7 @@ export declare class NegotiationGraphFactory {
         continuationExecution?: import("../../shared/interfaces/database.interface.js").NegotiationContinuationExecution | import("@langchain/langgraph").OverwriteValue<import("../../shared/interfaces/database.interface.js").NegotiationContinuationExecution | undefined> | undefined;
         continuationReceipt?: NegotiationContinuationReceipt | import("@langchain/langgraph").OverwriteValue<NegotiationContinuationReceipt | undefined> | undefined;
         privateConsultation?: import("../../shared/interfaces/database.interface.js").NegotiationPrivateConsultation | import("@langchain/langgraph").OverwriteValue<import("../../shared/interfaces/database.interface.js").NegotiationPrivateConsultation | undefined> | undefined;
-        consultationPolicyReason?: NegotiationConsultationReason | import("@langchain/langgraph").OverwriteValue<NegotiationConsultationReason | undefined> | undefined;
+        consultationPolicyReason?: "unresolved_owner_constraint" | "consequential_disclosure_permission" | "repeated_non_convergence" | "insufficient_commitment_authority" | import("@langchain/langgraph").OverwriteValue<"unresolved_owner_constraint" | "consequential_disclosure_permission" | "repeated_non_convergence" | "insufficient_commitment_authority" | undefined> | undefined;
         conversationId?: string | import("@langchain/langgraph").OverwriteValue<string> | undefined;
         taskId?: string | import("@langchain/langgraph").OverwriteValue<string> | undefined;
         messages?: import("../domain/negotiation.state.js").NegotiationMessage[] | import("@langchain/langgraph").OverwriteValue<import("../domain/negotiation.state.js").NegotiationMessage[]> | undefined;
@@ -137,8 +136,7 @@ export declare class NegotiationGraphFactory {
             };
             message?: string | null | undefined;
             askUser?: {
-                disclosureSubject: string;
-                draftQuestion?: string | null | undefined;
+                reason: "unresolved_owner_constraint" | "consequential_disclosure_permission" | "repeated_non_convergence" | "insufficient_commitment_authority";
             } | null | undefined;
         } | import("@langchain/langgraph").OverwriteValue<{
             action: "propose" | "accept" | "reject" | "counter" | "question" | "outreach" | "withdraw" | "decline" | "ask_user";
@@ -151,8 +149,7 @@ export declare class NegotiationGraphFactory {
             };
             message?: string | null | undefined;
             askUser?: {
-                disclosureSubject: string;
-                draftQuestion?: string | null | undefined;
+                reason: "unresolved_owner_constraint" | "consequential_disclosure_permission" | "repeated_non_convergence" | "insufficient_commitment_authority";
             } | null | undefined;
         } | null> | null | undefined;
         status?: "waiting_for_agent" | "input_required" | "completed" | "active" | import("@langchain/langgraph").OverwriteValue<"waiting_for_agent" | "input_required" | "completed" | "active"> | undefined;
@@ -212,7 +209,7 @@ export declare class NegotiationGraphFactory {
         continuationExecution: import("@langchain/langgraph").BaseChannel<import("../../shared/interfaces/database.interface.js").NegotiationContinuationExecution | undefined, import("../../shared/interfaces/database.interface.js").NegotiationContinuationExecution | import("@langchain/langgraph").OverwriteValue<import("../../shared/interfaces/database.interface.js").NegotiationContinuationExecution | undefined> | undefined, unknown>;
         continuationReceipt: import("@langchain/langgraph").BaseChannel<NegotiationContinuationReceipt | undefined, NegotiationContinuationReceipt | import("@langchain/langgraph").OverwriteValue<NegotiationContinuationReceipt | undefined> | undefined, unknown>;
         privateConsultation: import("@langchain/langgraph").BaseChannel<import("../../shared/interfaces/database.interface.js").NegotiationPrivateConsultation | undefined, import("../../shared/interfaces/database.interface.js").NegotiationPrivateConsultation | import("@langchain/langgraph").OverwriteValue<import("../../shared/interfaces/database.interface.js").NegotiationPrivateConsultation | undefined> | undefined, unknown>;
-        consultationPolicyReason: import("@langchain/langgraph").BaseChannel<NegotiationConsultationReason | undefined, NegotiationConsultationReason | import("@langchain/langgraph").OverwriteValue<NegotiationConsultationReason | undefined> | undefined, unknown>;
+        consultationPolicyReason: import("@langchain/langgraph").BaseChannel<"unresolved_owner_constraint" | "consequential_disclosure_permission" | "repeated_non_convergence" | "insufficient_commitment_authority" | undefined, "unresolved_owner_constraint" | "consequential_disclosure_permission" | "repeated_non_convergence" | "insufficient_commitment_authority" | import("@langchain/langgraph").OverwriteValue<"unresolved_owner_constraint" | "consequential_disclosure_permission" | "repeated_non_convergence" | "insufficient_commitment_authority" | undefined> | undefined, unknown>;
         conversationId: import("@langchain/langgraph").BaseChannel<string, string | import("@langchain/langgraph").OverwriteValue<string>, unknown>;
         taskId: import("@langchain/langgraph").BaseChannel<string, string | import("@langchain/langgraph").OverwriteValue<string>, unknown>;
         messages: import("@langchain/langgraph").BaseChannel<import("../domain/negotiation.state.js").NegotiationMessage[], import("../domain/negotiation.state.js").NegotiationMessage[] | import("@langchain/langgraph").OverwriteValue<import("../domain/negotiation.state.js").NegotiationMessage[]>, unknown>;
@@ -231,8 +228,7 @@ export declare class NegotiationGraphFactory {
             };
             message?: string | null | undefined;
             askUser?: {
-                disclosureSubject: string;
-                draftQuestion?: string | null | undefined;
+                reason: "unresolved_owner_constraint" | "consequential_disclosure_permission" | "repeated_non_convergence" | "insufficient_commitment_authority";
             } | null | undefined;
         } | null, {
             action: "propose" | "accept" | "reject" | "counter" | "question" | "outreach" | "withdraw" | "decline" | "ask_user";
@@ -245,8 +241,7 @@ export declare class NegotiationGraphFactory {
             };
             message?: string | null | undefined;
             askUser?: {
-                disclosureSubject: string;
-                draftQuestion?: string | null | undefined;
+                reason: "unresolved_owner_constraint" | "consequential_disclosure_permission" | "repeated_non_convergence" | "insufficient_commitment_authority";
             } | null | undefined;
         } | import("@langchain/langgraph").OverwriteValue<{
             action: "propose" | "accept" | "reject" | "counter" | "question" | "outreach" | "withdraw" | "decline" | "ask_user";
@@ -259,8 +254,7 @@ export declare class NegotiationGraphFactory {
             };
             message?: string | null | undefined;
             askUser?: {
-                disclosureSubject: string;
-                draftQuestion?: string | null | undefined;
+                reason: "unresolved_owner_constraint" | "consequential_disclosure_permission" | "repeated_non_convergence" | "insufficient_commitment_authority";
             } | null | undefined;
         } | null> | null, unknown>;
         status: import("@langchain/langgraph").BaseChannel<"waiting_for_agent" | "input_required" | "completed" | "active", "waiting_for_agent" | "input_required" | "completed" | "active" | import("@langchain/langgraph").OverwriteValue<"waiting_for_agent" | "input_required" | "completed" | "active">, unknown>;
@@ -329,7 +323,7 @@ export declare class NegotiationGraphFactory {
         continuationExecution: import("@langchain/langgraph").BaseChannel<import("../../shared/interfaces/database.interface.js").NegotiationContinuationExecution | undefined, import("../../shared/interfaces/database.interface.js").NegotiationContinuationExecution | import("@langchain/langgraph").OverwriteValue<import("../../shared/interfaces/database.interface.js").NegotiationContinuationExecution | undefined> | undefined, unknown>;
         continuationReceipt: import("@langchain/langgraph").BaseChannel<NegotiationContinuationReceipt | undefined, NegotiationContinuationReceipt | import("@langchain/langgraph").OverwriteValue<NegotiationContinuationReceipt | undefined> | undefined, unknown>;
         privateConsultation: import("@langchain/langgraph").BaseChannel<import("../../shared/interfaces/database.interface.js").NegotiationPrivateConsultation | undefined, import("../../shared/interfaces/database.interface.js").NegotiationPrivateConsultation | import("@langchain/langgraph").OverwriteValue<import("../../shared/interfaces/database.interface.js").NegotiationPrivateConsultation | undefined> | undefined, unknown>;
-        consultationPolicyReason: import("@langchain/langgraph").BaseChannel<NegotiationConsultationReason | undefined, NegotiationConsultationReason | import("@langchain/langgraph").OverwriteValue<NegotiationConsultationReason | undefined> | undefined, unknown>;
+        consultationPolicyReason: import("@langchain/langgraph").BaseChannel<"unresolved_owner_constraint" | "consequential_disclosure_permission" | "repeated_non_convergence" | "insufficient_commitment_authority" | undefined, "unresolved_owner_constraint" | "consequential_disclosure_permission" | "repeated_non_convergence" | "insufficient_commitment_authority" | import("@langchain/langgraph").OverwriteValue<"unresolved_owner_constraint" | "consequential_disclosure_permission" | "repeated_non_convergence" | "insufficient_commitment_authority" | undefined> | undefined, unknown>;
         conversationId: import("@langchain/langgraph").BaseChannel<string, string | import("@langchain/langgraph").OverwriteValue<string>, unknown>;
         taskId: import("@langchain/langgraph").BaseChannel<string, string | import("@langchain/langgraph").OverwriteValue<string>, unknown>;
         messages: import("@langchain/langgraph").BaseChannel<import("../domain/negotiation.state.js").NegotiationMessage[], import("../domain/negotiation.state.js").NegotiationMessage[] | import("@langchain/langgraph").OverwriteValue<import("../domain/negotiation.state.js").NegotiationMessage[]>, unknown>;
@@ -348,8 +342,7 @@ export declare class NegotiationGraphFactory {
             };
             message?: string | null | undefined;
             askUser?: {
-                disclosureSubject: string;
-                draftQuestion?: string | null | undefined;
+                reason: "unresolved_owner_constraint" | "consequential_disclosure_permission" | "repeated_non_convergence" | "insufficient_commitment_authority";
             } | null | undefined;
         } | null, {
             action: "propose" | "accept" | "reject" | "counter" | "question" | "outreach" | "withdraw" | "decline" | "ask_user";
@@ -362,8 +355,7 @@ export declare class NegotiationGraphFactory {
             };
             message?: string | null | undefined;
             askUser?: {
-                disclosureSubject: string;
-                draftQuestion?: string | null | undefined;
+                reason: "unresolved_owner_constraint" | "consequential_disclosure_permission" | "repeated_non_convergence" | "insufficient_commitment_authority";
             } | null | undefined;
         } | import("@langchain/langgraph").OverwriteValue<{
             action: "propose" | "accept" | "reject" | "counter" | "question" | "outreach" | "withdraw" | "decline" | "ask_user";
@@ -376,8 +368,7 @@ export declare class NegotiationGraphFactory {
             };
             message?: string | null | undefined;
             askUser?: {
-                disclosureSubject: string;
-                draftQuestion?: string | null | undefined;
+                reason: "unresolved_owner_constraint" | "consequential_disclosure_permission" | "repeated_non_convergence" | "insufficient_commitment_authority";
             } | null | undefined;
         } | null> | null, unknown>;
         status: import("@langchain/langgraph").BaseChannel<"waiting_for_agent" | "input_required" | "completed" | "active", "waiting_for_agent" | "input_required" | "completed" | "active" | import("@langchain/langgraph").OverwriteValue<"waiting_for_agent" | "input_required" | "completed" | "active">, unknown>;
@@ -501,7 +492,7 @@ export declare class NegotiationGraphFactory {
             continuationExecution: import("@langchain/langgraph").BaseChannel<import("../../shared/interfaces/database.interface.js").NegotiationContinuationExecution | undefined, import("../../shared/interfaces/database.interface.js").NegotiationContinuationExecution | import("@langchain/langgraph").OverwriteValue<import("../../shared/interfaces/database.interface.js").NegotiationContinuationExecution | undefined> | undefined, unknown>;
             continuationReceipt: import("@langchain/langgraph").BaseChannel<NegotiationContinuationReceipt | undefined, NegotiationContinuationReceipt | import("@langchain/langgraph").OverwriteValue<NegotiationContinuationReceipt | undefined> | undefined, unknown>;
             privateConsultation: import("@langchain/langgraph").BaseChannel<import("../../shared/interfaces/database.interface.js").NegotiationPrivateConsultation | undefined, import("../../shared/interfaces/database.interface.js").NegotiationPrivateConsultation | import("@langchain/langgraph").OverwriteValue<import("../../shared/interfaces/database.interface.js").NegotiationPrivateConsultation | undefined> | undefined, unknown>;
-            consultationPolicyReason: import("@langchain/langgraph").BaseChannel<NegotiationConsultationReason | undefined, NegotiationConsultationReason | import("@langchain/langgraph").OverwriteValue<NegotiationConsultationReason | undefined> | undefined, unknown>;
+            consultationPolicyReason: import("@langchain/langgraph").BaseChannel<"unresolved_owner_constraint" | "consequential_disclosure_permission" | "repeated_non_convergence" | "insufficient_commitment_authority" | undefined, "unresolved_owner_constraint" | "consequential_disclosure_permission" | "repeated_non_convergence" | "insufficient_commitment_authority" | import("@langchain/langgraph").OverwriteValue<"unresolved_owner_constraint" | "consequential_disclosure_permission" | "repeated_non_convergence" | "insufficient_commitment_authority" | undefined> | undefined, unknown>;
             conversationId: import("@langchain/langgraph").BaseChannel<string, string | import("@langchain/langgraph").OverwriteValue<string>, unknown>;
             taskId: import("@langchain/langgraph").BaseChannel<string, string | import("@langchain/langgraph").OverwriteValue<string>, unknown>;
             messages: import("@langchain/langgraph").BaseChannel<import("../domain/negotiation.state.js").NegotiationMessage[], import("../domain/negotiation.state.js").NegotiationMessage[] | import("@langchain/langgraph").OverwriteValue<import("../domain/negotiation.state.js").NegotiationMessage[]>, unknown>;
@@ -520,8 +511,7 @@ export declare class NegotiationGraphFactory {
                 };
                 message?: string | null | undefined;
                 askUser?: {
-                    disclosureSubject: string;
-                    draftQuestion?: string | null | undefined;
+                    reason: "unresolved_owner_constraint" | "consequential_disclosure_permission" | "repeated_non_convergence" | "insufficient_commitment_authority";
                 } | null | undefined;
             } | null, {
                 action: "propose" | "accept" | "reject" | "counter" | "question" | "outreach" | "withdraw" | "decline" | "ask_user";
@@ -534,8 +524,7 @@ export declare class NegotiationGraphFactory {
                 };
                 message?: string | null | undefined;
                 askUser?: {
-                    disclosureSubject: string;
-                    draftQuestion?: string | null | undefined;
+                    reason: "unresolved_owner_constraint" | "consequential_disclosure_permission" | "repeated_non_convergence" | "insufficient_commitment_authority";
                 } | null | undefined;
             } | import("@langchain/langgraph").OverwriteValue<{
                 action: "propose" | "accept" | "reject" | "counter" | "question" | "outreach" | "withdraw" | "decline" | "ask_user";
@@ -548,8 +537,7 @@ export declare class NegotiationGraphFactory {
                 };
                 message?: string | null | undefined;
                 askUser?: {
-                    disclosureSubject: string;
-                    draftQuestion?: string | null | undefined;
+                    reason: "unresolved_owner_constraint" | "consequential_disclosure_permission" | "repeated_non_convergence" | "insufficient_commitment_authority";
                 } | null | undefined;
             } | null> | null, unknown>;
             status: import("@langchain/langgraph").BaseChannel<"waiting_for_agent" | "input_required" | "completed" | "active", "waiting_for_agent" | "input_required" | "completed" | "active" | import("@langchain/langgraph").OverwriteValue<"waiting_for_agent" | "input_required" | "completed" | "active">, unknown>;