@indexnetwork/protocol 6.14.0-rc.406.1 → 8.0.1-rc.417.1

package/dist/opportunity/discriminator/discriminator.shadow.js

@@ -6,10 +6,8 @@
 import { protocolLogger } from "../../shared/observability/protocol.logger.js";
 import { computeNovelty, scoreDiscriminator } from "./discriminator.scorer.js";
 const logger = protocolLogger("PoolDiscriminatorShadow");
-/** Max text/vector references compared for novelty. */
+/** Max ordinary current-intent/premise text references compared for novelty. */
 const MAX_REFERENCE_TEXTS = 24;
-const MAX_PRIOR_REFERENCE_TEXTS = 24;
-const MAX_REFERENCE_EMBEDDINGS = 24;
 /** Text embedded per discriminator for the novelty comparison. */
 function discriminatorEmbeddingText(d) {
     return `${d.label} — ${d.questionSeed}`;
@@ -31,17 +29,16 @@ export async function runPoolDiscriminatorShadow(input) {
         .slice(0, MAX_REFERENCE_TEXTS);
     const priorReferenceTexts = (input.priorReferenceTexts ?? [])
         .map((text) => text.trim())
-        .filter((text) => text.length > 0)
-        .slice(0, MAX_PRIOR_REFERENCE_TEXTS);
+        .filter((text) => text.length > 0);
     const priorReferenceEmbeddings = (input.priorReferenceEmbeddings ?? [])
-        .filter((embedding) => embedding.length > 0)
-        .slice(0, MAX_REFERENCE_EMBEDDINGS);
+        .filter((embedding) => embedding.length > 0);
+    const hasPriorReferenceHistory = priorReferenceTexts.length > 0 || priorReferenceEmbeddings.length > 0;
     let novelties = mined.map(() => 1);
     let discriminatorEmbeddings = null;
+    let priorReferenceComparisonUnavailable = false;
     const shouldEmbed = input.retainEmbeddings
         || references.length > 0
-        || priorReferenceTexts.length > 0
-        || priorReferenceEmbeddings.length > 0;
+        || hasPriorReferenceHistory;
     if (shouldEmbed) {
         try {
             const texts = [
@@ -53,6 +50,11 @@ export async function runPoolDiscriminatorShadow(input) {
             if (embeddings.length !== texts.length || embeddings.some((embedding) => !Array.isArray(embedding) || embedding.length === 0)) {
                 throw new Error("Embedding provider returned an invalid batch");
             }
+            const comparisonEmbeddings = [...embeddings, ...priorReferenceEmbeddings];
+            const dimension = comparisonEmbeddings[0]?.length;
+            if (dimension !== undefined && comparisonEmbeddings.some((embedding) => embedding.length !== dimension)) {
+                throw new Error("Embedding comparison batch contains incompatible vector dimensions");
+            }
             discriminatorEmbeddings = embeddings.slice(0, mined.length);
             const referenceEmbeddings = [
                 ...priorReferenceEmbeddings,
@@ -64,6 +66,7 @@ export async function runPoolDiscriminatorShadow(input) {
             logger.warn("Novelty embedding failed; defaulting novelty to 1", {
                 error: err instanceof Error ? err.message : String(err),
             });
+            priorReferenceComparisonUnavailable = hasPriorReferenceHistory;
         }
     }
     const discriminators = mined
@@ -79,5 +82,9 @@ export async function runPoolDiscriminatorShadow(input) {
             : scored;
     })
         .sort((a, b) => b.voi - a.voi);
-    return { poolSize: candidates.length, discriminators };
+    return {
+        poolSize: candidates.length,
+        discriminators,
+        ...(priorReferenceComparisonUnavailable ? { priorReferenceComparisonUnavailable: true } : {}),
+    };
 }

package/dist/opportunity/discriminator/discriminator.types.d.ts

@@ -88,4 +88,6 @@ export interface DiscriminatorShadowResult {
     poolSize: number;
     /** Scored discriminators, sorted by VoI descending. */
     discriminators: ScoredDiscriminator[];
+    /** Historical-axis comparison could not be completed due to invalid embeddings. */
+    priorReferenceComparisonUnavailable?: boolean;
 }

package/dist/opportunity/domain/index.d.ts

@@ -25,7 +25,6 @@
  * IND-551: canonical domain layer for the opportunities capability.
  */
 export * from "./opportunity.state.js";
-export * from "./opportunity.discovery.contracts.js";
 export * from "./opportunity.labels.js";
 export * from "./opportunity.utils.js";
 export * from "./opportunity.actor.js";
@@ -34,7 +33,6 @@ export * from "./opportunity.claim-safety.js";
 export * from "./opportunity.presentation.js";
 export * from "./opportunity.safe-presentation.js";
 export * from "./opportunity.presentation-cache.js";
-export * from "./opportunity.discovery-run-coalescing.js";
 export * from "./negotiation-summary.builder.js";
 export * from "./discovery-question.helper.js";
 export type { PoolCandidate, DiscriminatorMiningInput, MinedDiscriminator, ScoredDiscriminator, VerifiedAssignment, DiscriminatorShadowResult, } from "../discriminator/discriminator.types.js";

package/dist/opportunity/domain/index.js

@@ -26,7 +26,6 @@
  */
 // ── Flat domain files ─────────────────────────────────────────────────────────
 export * from "./opportunity.state.js";
-export * from "./opportunity.discovery.contracts.js";
 export * from "./opportunity.labels.js";
 export * from "./opportunity.utils.js";
 export * from "./opportunity.actor.js";
@@ -35,7 +34,6 @@ export * from "./opportunity.claim-safety.js";
 export * from "./opportunity.presentation.js";
 export * from "./opportunity.safe-presentation.js";
 export * from "./opportunity.presentation-cache.js";
-export * from "./opportunity.discovery-run-coalescing.js";
 export * from "./negotiation-summary.builder.js";
 export * from "./discovery-question.helper.js";
 export { poolQuestionsMiningMode, poolQuestionsMode, poolQuestionsPushMode, poolQuestionsStampNewborn, POOL_DISCRIMINATOR_MIN_POOL_SIZE, POOL_DISCRIMINATOR_MAX_CANDIDATES, POOL_DISCRIMINATOR_MAX_PUBLIC_CONTEXT_CHARS, POOL_QUESTION_MIN_VOI, POOL_QUESTION_MAX_PENDING_PER_INTENT, poolQuestionsRanking, POOL_RERUN_DEBOUNCE_MS, poolQuestionsVisitTrigger, POOL_VISIT_MINING_DEBOUNCE_MS, } from "../discriminator/discriminator.env.js";

package/dist/opportunity/domain/opportunity.state.d.ts

@@ -108,40 +108,6 @@ export interface OpportunityPersistenceOutcome {
     crossTriggerAllowedCount: number;
     finalAtomicConflictCount: number;
 }
-/**
- * Which flow triggered this graph invocation. Determines initial persist status,
- * park-window timeout, streaming behavior, and whether AbortSignal is honored.
- *
- * - 'ambient' (default): queue-driven. Persists at the trigger default of
- *   `pending` unless `options.initialStatus` overrides (the queue worker
- *   passes `'latent'`, chat-bound ambient discovery passes `'draft'`). 5-min
- *   park window, no streaming, ignores abort.
- * - 'orchestrator': chat-driven. Persists at the trigger default of
- *   `negotiating` unless `options.initialStatus` overrides. 60s park window,
- *   streams `opportunity_draft_ready` events, honors abort.
- *
- * See {@link resolveInitialStatus} for the exact fallback used when
- * `options.initialStatus` is undefined.
- */
-export type OpportunityTrigger = 'ambient' | 'orchestrator';
-/**
- * Resolves the initial status for opportunities created in the persist node.
- *
- * Explicit `options.initialStatus` always wins (callers like the chat tool or
- * maintenance scripts override per-call). When the caller leaves it
- * undefined, the trigger drives the default:
- * - 'orchestrator' → 'negotiating' (chat-driven; negotiations run before the
- *   user sees a draft card).
- * - 'ambient' (or any other trigger) → 'pending' (long-standing default for
- *   queue- and intent-driven discovery).
- *
- * Lives here rather than in opportunity.graph.ts so unit tests can exercise
- * it without pulling in the full graph (and the evaluator's LLM requirements).
- *
- * @param trigger - The graph invocation's trigger
- * @param explicit - Caller-supplied initial status from options.initialStatus
- */
-export declare function resolveInitialStatus(trigger: OpportunityTrigger, explicit: OpportunityStatus | undefined): OpportunityStatus;
 /**
  * Options passed to the graph
  */
@@ -194,37 +160,6 @@ export declare const OpportunityGraphState: import("@langchain/langgraph").Annot
     /** Optional: discover on behalf of this user (introducer flow). When set, prep/eval use this user's profile/intents; userId becomes the introducer. */
     onBehalfOfUserId: import("@langchain/langgraph").BaseChannel<Id<"users"> | undefined, Id<"users"> | import("@langchain/langgraph").OverwriteValue<Id<"users"> | undefined> | undefined, unknown>;
     options: import("@langchain/langgraph").BaseChannel<OpportunityGraphOptions, OpportunityGraphOptions | import("@langchain/langgraph").OverwriteValue<OpportunityGraphOptions>, unknown>;
-    /**
-     * Which flow triggered this graph invocation. See {@link OpportunityTrigger}
-     * for the exact branch behavior and {@link resolveInitialStatus} for the
-     * persist default when `options.initialStatus` is unset.
-     *
-     * - 'ambient' (default): queue-driven, persist default `pending`, 5-min
-     *   park window, no streaming, ignores abort.
-     * - 'orchestrator': chat-driven, persist default `negotiating`, 60s park
-     *   window, streams `opportunity_draft_ready` events, honors abort.
-     */
-    trigger: import("@langchain/langgraph").BaseChannel<OpportunityTrigger, OpportunityTrigger | import("@langchain/langgraph").OverwriteValue<OpportunityTrigger>, unknown>;
-    /**
-     * Accepted opportunities the persist node discovered between the discoverer
-     * and a candidate actor (same pair, status='accepted'). The orchestrator
-     * branch populates this so the discover_opportunities tool (Task 7) can tell
-     * the LLM "these pairs are already connected, surface the existing chat
-     * rather than creating a new draft". Always empty for the ambient trigger.
-     *
-     * Left intentionally minimal — conversationId/URL resolution happens at
-     * Start Chat time (Task 8), not here.
-     */
-    dedupAlreadyAccepted: import("@langchain/langgraph").BaseChannel<{
-        opportunityId: string;
-        counterpartyUserId: string;
-    }[], {
-        opportunityId: string;
-        counterpartyUserId: string;
-    }[] | import("@langchain/langgraph").OverwriteValue<{
-        opportunityId: string;
-        counterpartyUserId: string;
-    }[]>, unknown>;
     /**
      * Operation mode controls graph flow:
      * - 'create': Existing discover pipeline (Prep → Scope → Discovery → Evaluation → Ranking → Persist)
@@ -441,11 +376,8 @@ export declare const OpportunityGraphState: import("@langchain/langgraph").Annot
     /**
      * Per-candidate negotiation records captured by `negotiateNode`. Populated
      * regardless of accept/reject so the question generator sees a complete
-     * picture. Populated for ALL triggers (ambient + orchestrator) since the
-     * negotiate node's `onCandidateResolved` hook is unconditional; only the
-     * orchestrator streaming side-effects (opportunity_draft_ready emission)
-     * are trigger-gated. Empty when the negotiate node was skipped (no
-     * opportunities to negotiate).
+     * picture. Empty when the negotiate node was skipped (no opportunities to
+     * negotiate).
      */
     discoveryNegotiations: import("@langchain/langgraph").BaseChannel<{
         counterpartyHint: string;

package/dist/opportunity/domain/opportunity.state.js

@@ -1,26 +1,4 @@
 import { Annotation } from "@langchain/langgraph";
-/**
- * Resolves the initial status for opportunities created in the persist node.
- *
- * Explicit `options.initialStatus` always wins (callers like the chat tool or
- * maintenance scripts override per-call). When the caller leaves it
- * undefined, the trigger drives the default:
- * - 'orchestrator' → 'negotiating' (chat-driven; negotiations run before the
- *   user sees a draft card).
- * - 'ambient' (or any other trigger) → 'pending' (long-standing default for
- *   queue- and intent-driven discovery).
- *
- * Lives here rather than in opportunity.graph.ts so unit tests can exercise
- * it without pulling in the full graph (and the evaluator's LLM requirements).
- *
- * @param trigger - The graph invocation's trigger
- * @param explicit - Caller-supplied initial status from options.initialStatus
- */
-export function resolveInitialStatus(trigger, explicit) {
-    if (explicit !== undefined)
-        return explicit;
-    return trigger === 'orchestrator' ? 'negotiating' : 'pending';
-}
 /**
  * Opportunity Graph State Annotation
  */
@@ -68,34 +46,6 @@ export const OpportunityGraphState = Annotation.Root({
         reducer: (curr, next) => next ?? curr,
         default: () => ({}),
     }),
-    /**
-     * Which flow triggered this graph invocation. See {@link OpportunityTrigger}
-     * for the exact branch behavior and {@link resolveInitialStatus} for the
-     * persist default when `options.initialStatus` is unset.
-     *
-     * - 'ambient' (default): queue-driven, persist default `pending`, 5-min
-     *   park window, no streaming, ignores abort.
-     * - 'orchestrator': chat-driven, persist default `negotiating`, 60s park
-     *   window, streams `opportunity_draft_ready` events, honors abort.
-     */
-    trigger: Annotation({
-        reducer: (curr, next) => next ?? curr,
-        default: () => 'ambient',
-    }),
-    /**
-     * Accepted opportunities the persist node discovered between the discoverer
-     * and a candidate actor (same pair, status='accepted'). The orchestrator
-     * branch populates this so the discover_opportunities tool (Task 7) can tell
-     * the LLM "these pairs are already connected, surface the existing chat
-     * rather than creating a new draft". Always empty for the ambient trigger.
-     *
-     * Left intentionally minimal — conversationId/URL resolution happens at
-     * Start Chat time (Task 8), not here.
-     */
-    dedupAlreadyAccepted: Annotation({
-        reducer: (curr, next) => next ?? curr,
-        default: () => [],
-    }),
     /**
      * Operation mode controls graph flow:
      * - 'create': Existing discover pipeline (Prep → Scope → Discovery → Evaluation → Ranking → Persist)
@@ -291,11 +241,8 @@ export const OpportunityGraphState = Annotation.Root({
     /**
      * Per-candidate negotiation records captured by `negotiateNode`. Populated
      * regardless of accept/reject so the question generator sees a complete
-     * picture. Populated for ALL triggers (ambient + orchestrator) since the
-     * negotiate node's `onCandidateResolved` hook is unconditional; only the
-     * orchestrator streaming side-effects (opportunity_draft_ready emission)
-     * are trigger-gated. Empty when the negotiate node was skipped (no
-     * opportunities to negotiate).
+     * picture. Empty when the negotiate node was skipped (no opportunities to
+     * negotiate).
      */
     discoveryNegotiations: Annotation({
         reducer: (curr, next) => [...curr, ...(next || [])],

package/dist/opportunity/opportunity.owner-approval.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Thin backward-compat shim — IND-551.
+ * Canonical location: opportunity/application/opportunity.owner-approval.ts
+ */
+export * from "./application/opportunity.owner-approval.js";

package/dist/opportunity/opportunity.owner-approval.js

@@ -0,0 +1,5 @@
+/**
+ * Thin backward-compat shim — IND-551.
+ * Canonical location: opportunity/application/opportunity.owner-approval.ts
+ */
+export * from "./application/opportunity.owner-approval.js";

package/dist/opportunity/ports/opportunity.tools.port.d.ts

@@ -1,5 +1,16 @@
 import type { ToolRegistryCompositionDeps } from "../../shared/agent/tool.helpers.js";
+import type { OpportunityOwnerApprovalAuthority } from "../application/opportunity.owner-approval.js";
+/**
+ * IND-593 host authority consumed only by the opportunity mutation boundary.
+ *
+ * This stays capability-local rather than extending the shared registry shape:
+ * the shared helper participates in the negotiation/question architecture
+ * cycle, while owner approval belongs to the opportunity composition seam.
+ */
+export interface OpportunityOwnerApprovalDeps {
+    opportunityOwnerApproval?: OpportunityOwnerApprovalAuthority;
+}
 /** Host capabilities consumed by opportunity discovery, delivery, and presentation tools. */
-export type OpportunityToolDeps = Pick<ToolRegistryCompositionDeps, "database" | "userDb" | "systemDb" | "cache" | "chatSummary" | "opportunityDiscovery" | "opportunityPresentation" | "questionGenerator" | "questionerEnqueue" | "findPendingQuestions" | "negotiationSummary" | "negotiationDatabase" | "deliveryLedger" | "discoveryRuns" | "discoveryRunQueue" | "mintConnectLink" | "frontendUrl" | "stampNewbornOpportunities" | "reportToolError"> & {
+export type OpportunityToolDeps = Pick<ToolRegistryCompositionDeps, "database" | "userDb" | "systemDb" | "cache" | "chatSummary" | "opportunityPresentation" | "questionGenerator" | "questionerEnqueue" | "findPendingQuestions" | "negotiationSummary" | "negotiationDatabase" | "deliveryLedger" | "mintConnectLink" | "frontendUrl" | "stampNewbornOpportunities" | "reportToolError"> & OpportunityOwnerApprovalDeps & {
     graphs: Pick<ToolRegistryCompositionDeps["graphs"], "index" | "networkMembership" | "opportunity">;
 };

package/dist/opportunity/public/index.d.ts

@@ -7,9 +7,8 @@
  *
  * IND-551: canonical public surface for the opportunities capability.
  */
-export { OpportunityGraphState, resolveInitialStatus, } from "../domain/opportunity.state.js";
-export type { SourceProfileData, IndexedIntent, TargetNetwork, CandidateMatch, EvaluatedCandidate, EvaluatedOpportunityActor, EvaluatedOpportunity, OpportunityPersistenceOutcome, OpportunityTrigger, OpportunityGraphOptions, } from "../domain/opportunity.state.js";
-export type { DiscoverDebugStep, DiscoveryResultContract, } from "../domain/opportunity.discovery.contracts.js";
+export { OpportunityGraphState, } from "../domain/opportunity.state.js";
+export type { SourceProfileData, IndexedIntent, TargetNetwork, CandidateMatch, EvaluatedCandidate, EvaluatedOpportunityActor, EvaluatedOpportunity, OpportunityPersistenceOutcome, OpportunityGraphOptions, } from "../domain/opportunity.state.js";
 export { MINIMAL_MAIN_TEXT_MAX_CHARS, PRIMARY_ACTION_LABEL_INTRODUCER, PRIMARY_ACTION_LABEL_DEFAULT, SECONDARY_ACTION_LABEL, getPrimaryActionLabel, } from "../domain/opportunity.labels.js";
 export { deriveRolesFromCorpus, validateOpportunityActors, canUserSeeOpportunity, isActionableForViewer, classifyOpportunity, selectByComposition, deduplicateByPerson, selectDigestCandidates, FEED_SOFT_TARGETS, DIGEST_REDELIVERY_COOLDOWN_DAYS, } from "../domain/opportunity.utils.js";
 export type { OpportunityActorRole, DerivedRoles, FeedCategory, DigestDeliveredRow, } from "../domain/opportunity.utils.js";
@@ -35,6 +34,7 @@ export type { OutcomeLabel, OutcomeExample, OutcomeShadowResult, } from "../outc
 export { isOutcomeQuestionsActivated, OUTCOME_MIN_INDEPENDENT_EXAMPLES, OUTCOME_MAX_CANDIDATES, OUTCOME_MAX_PUBLIC_CONTEXT_CHARS, } from "../outcome/outcome.env.js";
 export { computeFeedHealth } from "../feed/feed.health.js";
 export type { FeedHealthInput } from "../feed/feed.health.js";
+export { isIntroducerDiscoveryEnabled } from "../application/opportunity.introducer-feature.js";
 export { OpportunityGraphFactory } from "../application/opportunity.graph.js";
 export type { StampNewbornOpportunitiesFn, StampNewbornOpportunitiesInput, } from "../application/opportunity.newborn-stamping.js";
 export { OpportunityEvaluator } from "../application/opportunity.evaluator.js";

package/dist/opportunity/public/index.js

@@ -10,7 +10,7 @@
 // ── Domain exports ────────────────────────────────────────────────────────────
 export { 
 // state
-OpportunityGraphState, resolveInitialStatus, } from "../domain/opportunity.state.js";
+OpportunityGraphState, } from "../domain/opportunity.state.js";
 export { MINIMAL_MAIN_TEXT_MAX_CHARS, PRIMARY_ACTION_LABEL_INTRODUCER, PRIMARY_ACTION_LABEL_DEFAULT, SECONDARY_ACTION_LABEL, getPrimaryActionLabel, } from "../domain/opportunity.labels.js";
 export { deriveRolesFromCorpus, validateOpportunityActors, canUserSeeOpportunity, isActionableForViewer, classifyOpportunity, selectByComposition, deduplicateByPerson, selectDigestCandidates, FEED_SOFT_TARGETS, DIGEST_REDELIVERY_COOLDOWN_DAYS, } from "../domain/opportunity.utils.js";
 export { normalizeOpportunityActorIntent, resolveOpportunityActorIntent, normalizeOpportunityActors, normalizeCreateOpportunityActorIntents, } from "../domain/opportunity.actor.js";
@@ -29,6 +29,7 @@ export { isOutcomeQuestionsActivated, OUTCOME_MIN_INDEPENDENT_EXAMPLES, OUTCOME_
 // feed domain
 export { computeFeedHealth } from "../feed/feed.health.js";
 // ── Application exports ───────────────────────────────────────────────────────
+export { isIntroducerDiscoveryEnabled } from "../application/opportunity.introducer-feature.js";
 export { OpportunityGraphFactory } from "../application/opportunity.graph.js";
 export { OpportunityEvaluator } from "../application/opportunity.evaluator.js";
 export { OpportunityPresenter, gatherPresenterContext, } from "../application/opportunity.presenter.js";

package/dist/participant-agents/application/agent.tools.d.ts

@@ -13,4 +13,4 @@
  */
 import type { DefineTool } from '../../shared/agent/tool.helpers.js';
 import type { AgentToolDeps } from '../ports/index.js';
-export declare function createAgentTools(defineTool: DefineTool, deps: AgentToolDeps): never[] | readonly [any, any, any, any, any, any];
+export declare function createAgentTools(defineTool: DefineTool, deps: AgentToolDeps): never[] | readonly [any, any, any, any, any, any, any];

package/dist/participant-agents/application/agent.tools.js

@@ -16,13 +16,19 @@ import { error, success } from '../../shared/agent/tool.helpers.js';
 import { protocolLogger } from '../../shared/observability/protocol.logger.js';
 const logger = protocolLogger('ChatTools:Agent');
 const AGENT_ACTIONS = [
-    'manage:profile',
+    'manage:identity',
+    'manage:premises',
     'manage:intents',
     'manage:networks',
-    'manage:contacts',
     'manage:opportunities',
     'manage:negotiations',
 ];
+/**
+ * Canonical permission-action enum for the public tool INPUT schemas. Retired
+ * `manage:profile` / `manage:contacts` strings are rejected at the schema seam
+ * (defense-in-depth: the handler still re-validates via {@link isValidAction}).
+ */
+const AgentPermissionActionSchema = z.enum(AGENT_ACTIONS);
 function invalidActionMessage(action) {
     return `Invalid action: ${action}. Valid actions: ${AGENT_ACTIONS.join(', ')}`;
 }
@@ -44,7 +50,11 @@ function ensureAgentScopedAccess(context, requestedAgentId) {
 function sanitizeAgentForOutput(agent) {
     return {
         ...agent,
-        transports: agent.transports,
+        // Transport config carries private connection material (endpoint secrets,
+        // auth headers/tokens). It is never projected to ANY MCP caller — including
+        // the agent reading its own record via read_own_agent (IND-599). Channel,
+        // priority, and health metadata remain visible; config is fully redacted.
+        transports: agent.transports?.map((transport) => ({ ...transport, config: {} })),
     };
 }
 function sanitizeAgentName(name) {
@@ -66,7 +76,7 @@ export function createAgentTools(defineTool, deps) {
         querySchema: z.object({
             name: z.string().min(1).describe('Display name for the agent.'),
             description: z.string().optional().describe('What the agent does.'),
-            permissions: z.array(z.string()).optional().describe('Optional initial permission actions to grant.'),
+            permissions: z.array(AgentPermissionActionSchema).optional().describe('Optional initial permission actions to grant. Valid values: manage:identity, manage:premises, manage:intents, manage:networks, manage:opportunities, manage:negotiations.'),
         }),
         handler: async ({ context, query }) => {
             if (context.agentId) {
@@ -121,6 +131,33 @@ export function createAgentTools(defineTool, deps) {
             }
         },
     });
+    const readOwnAgent = defineTool({
+        name: 'read_own_agent',
+        description: "Read the calling agent's own registration record \u2014 its identity, " +
+            'transports, and granted permissions. Returns only the authenticated ' +
+            'agent\u2019s own record; no other agent can be named or targeted. Use this ' +
+            'when an agent needs to inspect its own configuration.',
+        querySchema: z.object({}),
+        handler: async ({ context }) => {
+            // Defense-in-depth: the capability policy only admits registered active
+            // agent principals here, but never trust the caller — require an agent
+            // context and resolve strictly the caller's OWN record (no target input).
+            if (!context.agentId) {
+                return error('read_own_agent is only available to a registered agent principal.');
+            }
+            try {
+                const agent = await agentDb.getAgentWithRelations(context.agentId);
+                if (!agent || agent.ownerId !== context.userId) {
+                    return error('Agent not found');
+                }
+                return success({ agent: sanitizeAgentForOutput(agent) });
+            }
+            catch (err) {
+                logger.error('Failed to read own agent', { err });
+                return error('Failed to read agent. Please try again.');
+            }
+        },
+    });
     const listAgents = defineTool({
         name: 'list_agents',
         description: 'List all agents the current user owns or has authorized.',
@@ -228,10 +265,10 @@ export function createAgentTools(defineTool, deps) {
     const grantAgentPermission = defineTool({
         name: 'grant_agent_permission',
         description: 'Grant one or more permissions to an agent for the current user. ' +
-            'Valid actions: manage:profile, manage:intents, manage:networks, manage:contacts, manage:opportunities, manage:negotiations.',
+            'Valid actions: manage:identity, manage:premises, manage:intents, manage:networks, manage:opportunities, manage:negotiations.',
         querySchema: z.object({
             agent_id: z.string().min(1).describe('The agent ID to grant permissions to.'),
-            actions: z.array(z.string()).min(1).describe('Permission actions to grant. Valid values: manage:profile, manage:intents, manage:networks, manage:contacts, manage:opportunities, manage:negotiations.'),
+            actions: z.array(AgentPermissionActionSchema).min(1).describe('Permission actions to grant. Valid values: manage:identity, manage:premises, manage:intents, manage:networks, manage:opportunities, manage:negotiations.'),
             scope: z.enum(['global', 'node', 'network']).optional().describe('Optional permission scope.'),
             scope_id: z.string().optional().describe('Scope target ID for node/network scopes.'),
         }),
@@ -303,6 +340,7 @@ export function createAgentTools(defineTool, deps) {
         },
     });
     return [
+        readOwnAgent,
         registerAgent,
         listAgents,
         updateAgent,

package/dist/participant-agents/application/index.d.ts

@@ -6,9 +6,11 @@
  *
  * ## Foreground adapters (participant-directed, authenticated)
  *
- * - {@link createAgentTools} — `register_agent`, `list_agents`, `update_agent`,
- *   `delete_agent`, `grant_agent_permission`, `revoke_agent_permission` MCP
- *   tools for the authenticated registration and permission management path.
+ * - {@link createAgentTools} — `read_own_agent`, `register_agent`,
+ *   `list_agents`, `update_agent`, `delete_agent`, `grant_agent_permission`,
+ *   `revoke_agent_permission` MCP tools for the authenticated registration
+ *   and permission management path (IND-599: `read_own_agent` is the
+ *   agent-principal self-read; the rest are human owner/admin actions).
  *
  * ## Boundary
  *

package/dist/participant-agents/application/index.js

@@ -6,9 +6,11 @@
  *
  * ## Foreground adapters (participant-directed, authenticated)
  *
- * - {@link createAgentTools} — `register_agent`, `list_agents`, `update_agent`,
- *   `delete_agent`, `grant_agent_permission`, `revoke_agent_permission` MCP
- *   tools for the authenticated registration and permission management path.
+ * - {@link createAgentTools} — `read_own_agent`, `register_agent`,
+ *   `list_agents`, `update_agent`, `delete_agent`, `grant_agent_permission`,
+ *   `revoke_agent_permission` MCP tools for the authenticated registration
+ *   and permission management path (IND-599: `read_own_agent` is the
+ *   agent-principal self-read; the rest are human owner/admin actions).
  *
  * ## Boundary
  *

package/dist/questions/application/question.tools.js

@@ -16,6 +16,7 @@
 import { z } from "zod";
 import { error, success } from "../../shared/agent/tool.helpers.js";
 import { focusedIntentId, focusedNetworkId, focusedNetworkLabel } from "../../shared/agent/tool.scope.js";
+import { callerMayAccessQuestionMode } from "../../shared/agent/activity-projection.js";
 /**
  * Detection modes whose questions derive solely from the caller's own data
  * (profile gaps, own intents, own discovery sessions). Negotiation-mode
@@ -27,6 +28,23 @@ const SELF_OWNED_MODES = ["enrichment", "intent", "discovery"];
 function isVisibleInScopedNetwork(question, userId, networkId) {
     return question.actors?.some((actor) => actor.userId === userId && actor.networkId === networkId) === true;
 }
+/**
+ * Exact affected-domain permission gate for a single question mode.
+ *
+ * The canonical MCP matrix admits both question tools with a UNION of domain
+ * actions (so any question-holding agent can reach the handler), but exact
+ * inheritance must be enforced here: a global `manage:intents` agent must not
+ * read or answer a `negotiation` question. Reuses the shared
+ * `callerMayAccessQuestionMode` mapping so this matches the read_activity_summary
+ * projection. A caller context without an `mcpCaller` (REST/chat surfaces) is
+ * owner-trusted and passes; MCP humans own their data and also pass.
+ */
+function callerMayAccessQuestion(context, mode) {
+    const caller = context.mcpCaller;
+    if (!caller)
+        return true;
+    return callerMayAccessQuestionMode(caller, mode);
+}
 function stripInternalQuestionFields(question) {
     const { actors: _actors, purpose: _purpose, ...publicQuestion } = question;
     return publicQuestion;
@@ -80,10 +98,14 @@ export function createQuestionerTools(defineTool, deps) {
                     ...(isIntentScoped ? { scopeType: 'intent', scopeId: scopedIntentId } : {}),
                     limit,
                 });
+                // Exact affected-domain permission projection: an agent sees only the
+                // question modes backed by one of its permissions (a global intents-only
+                // agent never sees negotiation questions). The owning human passes.
+                const permitted = fetched.filter((q) => callerMayAccessQuestion(context, q.mode));
                 const visible = isNetworkScoped
-                    ? fetched.filter((q) => SELF_OWNED_MODES.includes(q.mode) &&
+                    ? permitted.filter((q) => SELF_OWNED_MODES.includes(q.mode) &&
                         isVisibleInScopedNetwork(q, context.userId, scopedNetworkId))
-                    : fetched;
+                    : permitted;
                 const limited = visible.slice(0, limit).map(stripInternalQuestionFields);
                 if (isIntentScoped) {
                     return success({
@@ -163,6 +185,13 @@ export function createQuestionerTools(defineTool, deps) {
                 if (!target) {
                     return error("Question not found among the client's pending questions — it may already be answered or dismissed. Re-check with read_pending_questions.");
                 }
+                // Enforce exact affected-domain inheritance on the resolved target BEFORE
+                // any write: the union admission that let this tool run does not grant
+                // cross-domain answering (e.g. a manage:intents agent cannot answer a
+                // negotiation question). Fail closed with nothing persisted.
+                if (!callerMayAccessQuestion(context, target.mode)) {
+                    return error("You are not authorized to answer this question — it belongs to a domain your agent key does not manage.");
+                }
                 const answered = await deps.answerPendingQuestion(context.userId, query.questionId, {
                     selectedOptions,
                     ...(freeText ? { freeText } : {}),

package/dist/runtime/foreground/composition/tool.factory.d.ts

@@ -1,4 +1,5 @@
 import { type ToolContext, type ResolvedToolContext } from "../../../shared/agent/tool.helpers.js";
+import type { OpportunityOwnerApprovalDeps } from "../../../opportunity/ports/opportunity.tools.port.js";
 export type { ToolContext, ResolvedToolContext, ProtocolDeps } from "../../../shared/agent/tool.helpers.js";
 export type { ToolDeps } from "../../../shared/agent/tool.helpers.js";
 /**
@@ -9,7 +10,7 @@ export type { ToolDeps } from "../../../shared/agent/tool.helpers.js";
  * All external dependencies (cache, integration, queue, etc.) are provided
  * via the `deps` parameter — the protocol lib never imports concrete adapters.
  */
-export declare function createChatTools(deps: ToolContext, preResolvedContext?: ResolvedToolContext): Promise<any[]>;
+export declare function createChatTools(deps: ToolContext & OpportunityOwnerApprovalDeps, preResolvedContext?: ResolvedToolContext): Promise<any[]>;
 /**
  * Type for the tools array returned by createChatTools.
  */

package/dist/runtime/foreground/composition/tool.factory.js

@@ -24,6 +24,7 @@ import { createAgentTools } from "../../../capabilities/participant-agents.tools
 import { createNegotiationTools } from "../../../capabilities/negotiation.facade.js";
 import { createPremiseTools } from "../../../premise/premise.tools.js";
 import { createQuestionerTools, createAskUserQuestionTools } from "../../../capabilities/questions.facade.js";
+import { bindOwnerApprovalProvenance } from "../../../opportunity/application/opportunity.owner-provenance.js";
 const logger = protocolLogger("ChatTools");
 // ═══════════════════════════════════════════════════════════════════════════════
 // TOOL FACTORY
@@ -57,6 +58,13 @@ export async function createChatTools(deps, preResolvedContext) {
         resolvedContext.scopeType = explicitScope.scopeType;
         resolvedContext.scopeId = explicitScope.scopeId;
     }
+    // This factory is an orchestrated chat surface, never a direct owner request.
+    // Bind that fact at composition time rather than inferring it from a session
+    // id or a caller-controlled tool argument inside the opportunity handler.
+    bindOwnerApprovalProvenance(resolvedContext, {
+        surface: 'chat',
+        sessionAuthenticated: false,
+    });
     const allowedNetworkIds = deriveAllowedNetworkIds({
         memberships: resolvedContext.userNetworks,
         ...(resolvedContext.scopeType && resolvedContext.scopeId
@@ -155,8 +163,7 @@ export async function createChatTools(deps, preResolvedContext) {
         agentDispatcher: deps.agentDispatcher,
         stampNewbornOpportunities: deps.stampNewbornOpportunities,
         deliveryLedger: deps.deliveryLedger,
-        discoveryRuns: deps.discoveryRuns,
-        discoveryRunQueue: deps.discoveryRunQueue,
+        ...(deps.opportunityOwnerApproval && { opportunityOwnerApproval: deps.opportunityOwnerApproval }),
         enrichmentRuns: deps.enrichmentRuns,
         enrichmentRunQueue: deps.enrichmentRunQueue,
         mintConnectToken: deps.mintConnectToken,
@@ -172,6 +179,7 @@ export async function createChatTools(deps, preResolvedContext) {
         ...(deps.chatQuestions && { chatQuestions: deps.chatQuestions }),
         ...(deps.chatSession && { chatSession: deps.chatSession }),
         ...(deps.getUserContextText && { getUserContextText: deps.getUserContextText }),
+        ...(deps.intentProposalStore && { intentProposalStore: deps.intentProposalStore }),
         graphs: {
             profile: profileGraph,
             intent: intentGraph,

package/dist/runtime/foreground/composition/tool.registry.d.ts

@@ -1,11 +1,25 @@
 import type { ToolDeps, ToolRegistry } from '../../../shared/agent/tool.helpers.js';
+import type { ToolSurface } from '../../../shared/agent/utility.tools.js';
+import type { OpportunityOwnerApprovalDeps } from '../../../opportunity/ports/opportunity.tools.port.js';
+export interface CreateToolRegistryOptions {
+    /**
+     * Tool-surface profile. The default `'rest'` profile (direct HTTP Tool API)
+     * exposes the full tool set — contact/Gmail tools, `scrape_url`, and the
+     * deprecated profile/profile-run compatibility aliases. The restricted
+     * `'mcp'` profile omits exactly those surfaces (IND-596/597/598); their
+     * non-MCP implementations remain intact for REST and chat.
+     */
+    surface?: ToolSurface;
+}
 /**
  * Creates a tool registry containing all tool handlers indexed by name.
  * Handlers are raw async functions (not LangChain tool() wrappers) that
  * accept { context, query } and return a JSON string.
  *
  * @param deps - Shared tool dependencies (graphs, database, embedder, etc.)
- * @param context - Resolved user context for this request.
+ * @param options - Surface profile selecting the MCP-restricted or full REST set.
  * @returns Map of tool name to raw tool definition.
  */
-export declare function createToolRegistry(deps: ToolDeps): ToolRegistry;
+/** Complete registry composition with the opportunity-local owner-proof port. */
+export type ToolRegistryDeps = ToolDeps & OpportunityOwnerApprovalDeps;
+export declare function createToolRegistry(deps: ToolRegistryDeps, options?: CreateToolRegistryOptions): ToolRegistry;