@intentic/sandbox-contract 1.307.0 → 1.308.2

package/src/contracts/workspace.contract.ts

@@ -1,4 +1,4 @@
-import { oc } from "@orpc/contract";
+import { procedure } from "../protocol/route-meta.js";
 import { WorkspaceHealthQuerySchema, WorkspaceHealthSchema } from "../schemas/codebase-health.js";
 import { WorkspaceModulesSchema } from "../schemas/git/git.js";
 import { OkSchema } from "../schemas/shared.js";
@@ -44,7 +44,7 @@ import {
 // External MCP tools live in the capabilities manifest (mcp kind), not here.
 export const workspaceContract = {
     // `agent` picks whose workspace copy to read (WorkspaceScopeSchema); omitted means the shared /work tree.
-    tree: oc
+    tree: procedure
         .route({
             method: "GET",
             path: "/workspace/tree",
@@ -52,10 +52,11 @@ export const workspaceContract = {
             description:
                 "Every folder and file under the workspace root, as one walk. Name a conversation to read its own private copy of the tree instead of the shared one. Folders the daemon skips, such as installed packages, come back without their contents; ask for those separately.",
         })
+        .meta({ guest: true })
         .input(WorkspaceScopeSchema)
         .output(WorkspaceTreeSchema),
     // Lazy-loads a folder's children the tree walk skipped (node_modules, .git…) to bound its entry budget.
-    children: oc
+    children: procedure
         .route({
             method: "GET",
             path: "/workspace/children",
@@ -63,10 +64,11 @@ export const workspaceContract = {
             description:
                 "The entries inside a folder as one flat list. Direct children are the default, which is how the explorer opens a folder the full tree walk left closed; callers that need a small subtree can ask for up to five levels without a request per directory.",
         })
+        .meta({ guest: true })
         .input(WorkspaceChildrenQuerySchema)
         .output(WorkspaceChildrenSchema),
     // One window of a file's text plus its size, never the whole file: an unbounded read can stall the daemon.
-    file: oc
+    file: procedure
         .route({
             method: "GET",
             path: "/workspace/file",
@@ -74,10 +76,11 @@ export const workspaceContract = {
             description:
                 "A window of one file's text, plus how large the whole file is. Never the entire file: an unbounded read is how a single enormous log stalls the daemon for everyone, so ask for the slice you mean to show and page through if you need more.",
         })
+        .meta({ guest: true })
         .input(WorkspaceFileReadQuerySchema)
         .output(WorkspaceFileSchema),
     // The markdown shadow fileq keeps of a binary file; the read is a plain file read, no derivation triggered.
-    derived: oc
+    derived: procedure
         .route({
             method: "GET",
             path: "/workspace/derived",
@@ -85,10 +88,11 @@ export const workspaceContract = {
             description:
                 "What a document, picture, recording or archive says, as text, from the shadow the sandbox keeps beside it. This is the same rendering an agent reads instead of the bytes, so it is also the way to check what one is working from. Nothing is derived here: a file with no shadow yet answers that it has none, and whether it could have one.",
         })
+        .meta({ guest: true })
         .input(WorkspaceDerivedQuerySchema)
         .output(WorkspaceDerivedSchema),
     // The lazy path, on demand: same convergence the background sweep runs, for one file someone is looking at.
-    derive: oc
+    derive: procedure
         .route({
             method: "POST",
             path: "/workspace/derive",
@@ -96,10 +100,12 @@ export const workspaceContract = {
             description:
                 "Renders one file to text and answers with the result, for when its shadow is missing or you want it rebuilt. The same work the background pass does when that setting is on, so this is how a reader gets the text without turning it on for the whole workspace. Costs a parse of exactly one file; a format nothing can read says so rather than failing.",
         })
+        // Rendering one file as text is reading it: a regenerable cache entry, one parse of a readable file.
+        .meta({ floor: "viewer", guest: true })
         .input(WorkspaceDerivedQuerySchema)
         .output(WorkspaceDerivedSchema),
     // Where the background pass stands, with no file in hand: what the setting's own row reports about itself.
-    derivedStatus: oc
+    derivedStatus: procedure
         .route({
             method: "GET",
             path: "/workspace/derived-status",
@@ -107,9 +113,10 @@ export const workspaceContract = {
             description:
                 "Whether documents, pictures, recordings and archives are being rendered to text in the background, how many are waiting, which are being read right now, and how many shadows the last whole-tree pass counted. Ask this to tell a file nothing can read from a file whose turn has not come.",
         })
+        .meta({ guest: true })
         .output(SidecarStatusSchema),
     // Mints the ticket GET /workspace/media (a plain Hono byte-range route, no oRPC shape) requires to stream.
-    mediaTicket: oc
+    mediaTicket: procedure
         .route({
             method: "POST",
             path: "/workspace/media-ticket",
@@ -117,10 +124,12 @@ export const workspaceContract = {
             description:
                 "Mints the short-lived ticket a video or audio element hands to the streaming route, which serves byte ranges and so cannot carry an ordinary header. Minting it here means a caller can tell whether this sandbox streams media at all, rather than discovering it mid-playback.",
         })
+        // Opening a media file is a read, and the ticket is strictly narrower than the bearer.
+        .meta({ floor: "viewer", guest: true })
         .input(WorkspaceMediaTicketQuerySchema)
         .output(WorkspaceMediaTicketSchema),
     // Matches a prose-written path, often just a suffix, against the tree rather than trusting it as root-relative.
-    resolve: oc
+    resolve: procedure
         .route({
             method: "GET",
             path: "/workspace/resolve",
@@ -128,10 +137,11 @@ export const workspaceContract = {
             description:
                 "Matches a path somebody wrote in prose against the real tree and says which file it means. A path mentioned in a message is often only the tail of the real one, so this is the lookup behind every clickable file reference rather than a plain existence check.",
         })
+        .meta({ guest: true })
         .input(WorkspaceResolveQuerySchema)
         .output(WorkspaceResolveSchema),
     // `mode` narrows the search to one kind; default fuses text, structure, meaning and history in one pass.
-    search: oc
+    search: procedure
         .route({
             method: "GET",
             path: "/workspace/search",
@@ -139,10 +149,11 @@ export const workspaceContract = {
             description:
                 "Ranked results across the whole workspace, grouped, each carrying why it matched and how fresh it is. Left alone it blends plain text, structure, meaning and history in one pass; narrow it to a single kind of search when you already know which you want. Long result sets resume from the cursor it hands back.",
         })
+        .meta({ guest: true, control: "editor" })
         .input(WorkspaceSearchQuerySchema)
         .output(WorkspaceSearchResultSchema),
     // Per-file churn × complexity, index totals, top modules; scoped to a repo, not the whole /work drop.
-    health: oc
+    health: procedure
         .route({
             method: "GET",
             path: "/workspace/health",
@@ -153,7 +164,7 @@ export const workspaceContract = {
         .input(WorkspaceHealthQuerySchema)
         .output(WorkspaceHealthSchema),
     // Deterministic, no-LLM classification into coarse buckets; read-only, applied only via the move route.
-    classify: oc
+    classify: procedure
         .route({
             method: "GET",
             path: "/workspace/classify",
@@ -163,16 +174,18 @@ export const workspaceContract = {
         })
         .output(WorkspaceClassificationSchema),
     // Delete sends `{path}` in the body, not the query: oRPC's OpenAPI codec reads non-GET input from the body.
-    mkdir: oc
+    mkdir: procedure
         .route({
             method: "POST",
             path: "/workspace/dir",
             summary: "Create a folder",
             description: "Makes a folder, and any missing folders above it.",
         })
+        // Editing the shared tree is the writer grant; each file route resolves its path inside the caller's fence.
+        .meta({ floor: "writer" })
         .input(WorkspaceDirSchema)
         .output(OkSchema),
-    delete: oc
+    delete: procedure
         .route({
             method: "DELETE",
             path: "/workspace/entry",
@@ -180,27 +193,30 @@ export const workspaceContract = {
             description:
                 "Removes one entry and everything under it. The path travels in the body rather than the address, the same as every other write in this group.",
         })
+        .meta({ floor: "writer" })
         .input(WorkspaceFileQuerySchema)
         .output(OkSchema),
-    move: oc
+    move: procedure
         .route({
             method: "POST",
             path: "/workspace/move",
             summary: "Move or rename something",
             description: "Moves one entry to a new path, which is also how you rename it.",
         })
+        .meta({ floor: "writer" })
         .input(WorkspaceMoveSchema)
         .output(OkSchema),
-    copy: oc
+    copy: procedure
         .route({
             method: "POST",
             path: "/workspace/copy",
             summary: "Copy a file or folder",
             description: "Duplicates one entry at a new path, recursively for a folder.",
         })
+        .meta({ floor: "writer" })
         .input(WorkspaceMoveSchema)
         .output(OkSchema),
-    extract: oc
+    extract: procedure
         .route({
             method: "POST",
             path: "/workspace/extract",
@@ -208,10 +224,11 @@ export const workspaceContract = {
             description:
                 "Unpacks a zip or tar already in the workspace into a new folder beside it, named after the archive. An archive that is one folder of its own name lands as that folder rather than as it twice, and a .gz, .bz2, .xz or .zst holding a single file lands as that file. Nothing is ever written over: the answer says where it landed. Formats with no tool here, such as .7z and .rar, are refused.",
         })
+        .meta({ floor: "writer" })
         .input(WorkspaceFileQuerySchema)
         .output(WorkspaceExtractSchema),
     // An imported project lacks node_modules/.venv; until this says ready, its type checks and tests can mislead.
-    setup: oc
+    setup: procedure
         .route({
             method: "GET",
             path: "/workspace/setup",
@@ -220,7 +237,7 @@ export const workspaceContract = {
                 "Per project, whether its dependencies are actually present. A project that arrives by import comes without them, so files landing is not the same as the project working: until this says a project is ready, its type checks and tests can only mislead you.",
         })
         .output(WorkspaceSetupSchema),
-    install: oc
+    install: procedure
         .route({
             method: "POST",
             path: "/workspace/setup/install",
@@ -230,15 +247,16 @@ export const workspaceContract = {
         })
         .input(WorkspaceInstallSchema)
         .output(WorkspaceInstallResultSchema),
-    repos: oc
+    repos: procedure
         .route({
             method: "GET",
             path: "/workspace/repos",
             summary: "Repos in the workspace",
             description: "Every git repo the daemon found in the workspace, with where each one sits and what it is called.",
         })
+        .meta({ guest: true })
         .output(ReposListSchema),
-    addRepo: oc
+    addRepo: procedure
         .route({
             method: "POST",
             path: "/workspace/repos",
@@ -247,7 +265,7 @@ export const workspaceContract = {
         })
         .input(CloneRepoSchema)
         .output(CloneResultSchema),
-    createRepo: oc
+    createRepo: procedure
         .route({
             method: "POST",
             path: "/workspace/repos/new",
@@ -258,7 +276,7 @@ export const workspaceContract = {
         .input(CreateRepoSchema)
         .output(CloneResultSchema),
     // Mutates the tree (fetch + fast-forward), which is why this is POST rather than GET.
-    sync: oc
+    sync: procedure
         .route({
             method: "POST",
             path: "/workspace/sync",
@@ -268,7 +286,7 @@ export const workspaceContract = {
         })
         .output(WorkspaceSyncSchema),
     // The source repo's templates.json app types; drives the apps extension's Add-app picker.
-    templates: oc
+    templates: procedure
         .route({
             method: "GET",
             path: "/workspace/templates",
@@ -277,7 +295,7 @@ export const workspaceContract = {
         })
         .output(TemplatesListSchema),
     // Runs as a one-shot tmux job named `panel-<repo>--add_apps`, executing `intentic scaffold add-app`.
-    addApps: oc
+    addApps: procedure
         .route({
             method: "POST",
             path: "/workspace/repos/{repo}/apps",
@@ -287,7 +305,7 @@ export const workspaceContract = {
         })
         .input(AddAppsSchema)
         .output(OkSchema),
-    appsList: oc
+    appsList: procedure
         .route({
             method: "GET",
             path: "/workspace/repos/{repo}/apps",
@@ -297,7 +315,7 @@ export const workspaceContract = {
         .input(RepoAppsParamSchema)
         .output(AppsListSchema),
     // The monorepo's package dependency graph, from pnpm-workspace.yaml globs and each package.json's deps.
-    packageGraph: oc
+    packageGraph: procedure
         .route({
             method: "GET",
             path: "/workspace/repos/{repo}/graph",
@@ -307,7 +325,7 @@ export const workspaceContract = {
         .input(RepoAppsParamSchema)
         .output(WorkspaceGraphSchema),
     // Every repo's package dirs in one call, since a review spans repos and per-repo would fan out per open.
-    modules: oc
+    modules: procedure
         .route({
             method: "GET",
             path: "/workspace/modules",
@@ -316,7 +334,7 @@ export const workspaceContract = {
                 "The named packages in the whole workspace, which is what a review list groups changed files under when a reader wants packages rather than paths. Whole-workspace in one answer, because a review spans repos and asking per repo would be a fan-out on every open.",
         })
         .output(WorkspaceModulesSchema),
-    startApp: oc
+    startApp: procedure
         .route({
             method: "POST",
             path: "/workspace/repos/{repo}/apps/{app}/start",
@@ -325,7 +343,7 @@ export const workspaceContract = {
         })
         .input(AppParamSchema)
         .output(OkSchema),
-    stopApp: oc
+    stopApp: procedure
         .route({
             method: "POST",
             path: "/workspace/repos/{repo}/apps/{app}/stop",
@@ -335,7 +353,7 @@ export const workspaceContract = {
         .input(AppParamSchema)
         .output(OkSchema),
     // Runs tests for the named dirs in a one-shot tmux panel; mirrors addApps: an ack, terminal as result surface.
-    runTests: oc
+    runTests: procedure
         .route({
             method: "POST",
             path: "/workspace/repos/{repo}/tests",

package/src/events/land-breakage.ts

@@ -0,0 +1,11 @@
+// The follow-up the daemon sends a conversation whose land turned the main tree's own check red, recognised by its opening.
+
+// Anchored on by the chat, so it must stay unique and stable across releases.
+export const LAND_BREAKAGE_OPENING =
+    "What this conversation landed turned the main tree's own check red after it arrived. Each failure below appeared with that land and was not failing before it. Fix them on this branch and check the fix as you would any change; it lands like any other turn.";
+
+// The prompt a breakage actually sends: its opening, then the failures, each already worded for the model.
+export const landBreakagePrompt = (parts: readonly string[]): string => [LAND_BREAKAGE_OPENING, ...parts].join("\n\n");
+
+// Whether a stored prompt is one.
+export const isLandBreakage = (prompt: string): boolean => prompt.startsWith(LAND_BREAKAGE_OPENING);

package/src/index.ts

@@ -1,5 +1,8 @@
+import { getEventIteratorSchemaDetails, isContractProcedure } from "@orpc/contract";
+import type { z } from "zod";
+import { RAW_ROUTE_LIST } from "./protocol/raw-routes.js";
 import type { ContractRoute } from "./protocol/routes.js";
-import { contractRoutes, requestPathFor, routeForProcedure, routeNameForRequest, routeShapes } from "./protocol/routes.js";
+import { contractRoutes, requestPathFor, routeForProcedure, routeNameForRequest, routeShapes, servedRoute } from "./protocol/routes.js";
 import { accountsContract } from "./contracts/accounts.contract.js";
 import { activityContract } from "./contracts/activity.contract.js";
 import { agentContract } from "./contracts/agent.contract.js";
@@ -108,6 +111,7 @@ export * from "./events/requests.js";
 export * from "./events/resume.js";
 export * from "./events/system-events.js";
 export * from "./events/transcript.js";
+export * from "./events/land-breakage.js";
 export * from "./events/verify-nudge.js";
 export * from "./events/watch-wake.js";
 export * from "./policy/request-status.js";
@@ -115,6 +119,9 @@ export * from "./policy/turned-away.js";
 export * from "./text/mentions.js";
 export * from "./protocol/sse.js";
 export * from "./protocol/routes.js";
+export type { ControlReach, RouteMeta } from "./protocol/route-meta.js";
+export { RAW_ROUTE_LIST, RAW_ROUTES, type RawRouteKey, rawRoutePath } from "./protocol/raw-routes.js";
+export type { SandboxCallInput, SandboxGroup, SandboxHandlerInput, SandboxHandlerOutput, SandboxProcedure } from "./protocol/procedure-types.js";
 export * from "./policy/control-scopes.js";
 // The container's directory layout, re-exported since extensions can't import @intentic/constants directly.
 export { HISTORY_ROOT, HOST_STATE_ROOT, STATE_DIR, WORKSPACE_ROOT } from "@intentic/constants";
@@ -123,6 +130,7 @@ export * from "./state/runtime-state.js";
 export * from "./state/state-portability.js";
 export * from "./state/history-state.js";
 export * from "./state/fix-stance.js";
+export * from "./state/landed-commit.js";
 export * from "./state/fix-attempt-plan.js";
 // Provider vocabulary bottom-up: agent-runtimes, provider-specs, agent-catalog; three modules since the dependency
 // points one way.
@@ -288,9 +296,23 @@ export const SANDBOX_ROUTE_SHAPES: Readonly<Record<string, string>> = routeShape
 export const sandboxRouteName = (method: string, pathWithQuery: string): string | undefined =>
     routeNameForRequest(SANDBOX_ROUTES, method, pathWithQuery);
 
+// The route of either kind that serves a request to the daemon, bound to this build's tables; its meta is the policy the
+// daemon holds the request to, and undefined means nothing serves it.
+export const sandboxRouteFor = (method: string, pathWithQuery: string): ContractRoute | undefined =>
+    servedRoute(RAW_ROUTE_LIST, SANDBOX_ROUTES, method, pathWithQuery);
+
 // The method and path a typed call is about to send, bound to this build's route table. Undefined for an undeclared
 // procedure; the host gate then refuses it rather than assuming it's harmless.
 export const sandboxRequestFor = (procedure: readonly string[], input: unknown): { method: string; path: string } | undefined => {
     const route = routeForProcedure(SANDBOX_ROUTES, procedure);
     return route === undefined ? undefined : { method: route.method, path: requestPathFor(route, input) };
 };
+
+// The schema a procedure's answer is parsed by, bound to this build's contract; undefined for a streamed answer, which
+// passes as it arrives, since a frame kind this build does not know must not end the stream.
+export const sandboxAnswerSchema = (procedure: readonly string[]): z.ZodType | undefined => {
+    const [group = "", name = ""] = procedure;
+    const declared = (sandboxContract as Readonly<Record<string, Readonly<Record<string, unknown>>>>)[group]?.[name];
+    const schema = isContractProcedure(declared) ? declared["~orpc"].outputSchema : undefined;
+    return schema === undefined || getEventIteratorSchemaDetails(schema) !== undefined ? undefined : (schema as z.ZodType);
+};

package/src/models/capability-ledger.test.ts

@@ -8,7 +8,7 @@ import type { AgentCapabilities } from "./agent-runtimes.js";
 type Backing = "enforced" | "descriptive";
 
 const LEDGER: Record<keyof AgentCapabilities, Backing> = {
-    // adapter-registry.ts maps this runtime to its serving adapter; also keys per-runtime health probes.
+    // runtime-table.ts maps this runtime to its serving adapter; also keys per-runtime health probes.
     runtime: "enforced",
     // conversation.ts's `steerable`: the composer offers mid-turn injection only where there is a queue.
     steering: "enforced",

package/src/protocol/procedure-types.ts

@@ -0,0 +1,24 @@
+import type { AnySchema, ContractProcedure, ErrorMap, InferSchemaInput, InferSchemaOutput, Meta } from "@orpc/contract";
+import type { sandboxContract } from "../index.js";
+
+// Every procedure's wire types by group and name, from both ends: what a caller sends, and what a handler is given and
+// may answer. The two ends differ wherever a schema coerces or defaults, so a stand-in daemon types itself by the
+// handler's end and a caller by its own.
+
+type Contract = typeof sandboxContract;
+
+export type SandboxGroup = keyof Contract;
+export type SandboxProcedure<G extends SandboxGroup> = keyof Contract[G] & string;
+
+// What a caller hands the typed client, before the client spreads it over the path, the query and the body.
+export type SandboxCallInput<G extends SandboxGroup, P extends SandboxProcedure<G>> =
+    Contract[G][P] extends ContractProcedure<infer I extends AnySchema, AnySchema, ErrorMap, Meta> ? InferSchemaInput<I> : never;
+
+// What a handler is given: the request's input as the input schema parsed it, a query's "true" already a boolean.
+export type SandboxHandlerInput<G extends SandboxGroup, P extends SandboxProcedure<G>> =
+    Contract[G][P] extends ContractProcedure<infer I extends AnySchema, AnySchema, ErrorMap, Meta> ? InferSchemaOutput<I> : never;
+
+// What a handler may answer: anything the output schema parses, so a defaulted field may be left out. A streamed
+// procedure's is an async iterator of frames in the same sense.
+export type SandboxHandlerOutput<G extends SandboxGroup, P extends SandboxProcedure<G>> =
+    Contract[G][P] extends ContractProcedure<AnySchema, infer O extends AnySchema, ErrorMap, Meta> ? InferSchemaInput<O> : never;

package/src/protocol/raw-routes.ts

@@ -0,0 +1,191 @@
+import type { RouteMeta } from "./route-meta.js";
+import type { ContractRoute } from "./routes.js";
+import { runnerTranslatorPath } from "./runner-protocol.js";
+
+// Every route the daemon serves outside oRPC (streamed bytes, WebSocket upgrades, doors checking their own credential),
+// keyed `METHOD /path` in the order the daemon registers them: among overlapping ones the first registered answers.
+// `{param}` is one path segment, a trailing `/*` any further ones, `ALL` every method; the daemon serves no other.
+export const RAW_ROUTES = {
+    // The "is a daemon there" probe every flow uses; it names the sandbox and says whether it is still converging.
+    "GET /health": { auth: "door", beforeBoot: true },
+    "GET /diff/raw": {},
+    // Arming the dictation model is a read any tier makes; dictating is writing a message, the collaborator's grant.
+    "GET /speech/status": { guest: true },
+    "POST /speech/transcribe": { floor: "collaborator", guest: true },
+    // The bytes behind the workspace reads; each applies the caller's fence itself.
+    "GET /workspace/raw": { guest: true },
+    // No door, unlike media: the page fetches a thumbnail itself, so the request carries the header.
+    "GET /workspace/thumb": { guest: true },
+    // Fetched by a <video>/<audio> tag, which sends no header: its scoped ticket is checked in the handler.
+    "GET /workspace/media": { auth: "door", guest: true },
+    // An attachment is part of the message it rides with; any other target edits the shared tree.
+    "POST /workspace/upload": { floor: "writer", attachmentFloor: "collaborator" },
+    "POST /workspace/upload-diff": {},
+    "POST /workspace/upload-archive": {},
+    // Minting is cheap: each WebSocket upgrade floors its own redemption.
+    "POST /system/ws-ticket": { beforeBoot: true, floor: "collaborator", control: "never" },
+    // A WebSocket upgrade carries no Authorization header; the terminal and both browser wires check a query ticket.
+    "GET /system/terminal": { auth: "door", beforeBoot: true, control: "never" },
+    // Desktop sync's byte pipe, guarded again by sshd's own key check against the same enrollment.
+    "GET /system/sync/ssh": { sync: "pipe", control: "never" },
+    "GET /system/browser-profile": { auth: "door", beforeBoot: true, control: "never" },
+    "GET /system/browser-view": { auth: "door", beforeBoot: true, control: "never" },
+    // Deploy-target enrollment, gated by the connect token.
+    "POST /enroll": { auth: "door", control: "never" },
+    // An event automation's webhook, gated by the automation's own token.
+    "POST /automations/{id}/fire": { auth: "door" },
+    // The release gate a pipeline runner waits on, gated by the workflow's minted gate token.
+    "POST /workflows/{id}/gate": { auth: "door" },
+    // The Visitor chat, embedded on the owner's sites: gated by its origin allowlist, rate limit and bot check.
+    "GET /webchat/widget.js": { auth: "door", embedded: true },
+    "GET /webchat/{id}/config": { auth: "door", embedded: true },
+    "GET /webchat/{id}/challenge": { auth: "door", embedded: true },
+    "POST /webchat/{id}/message": { auth: "door", embedded: true },
+    "GET /webchat/{id}/messages": { auth: "door", embedded: true },
+    // Which sites loaded the widget is the owner's diagnostic, not the visitor's.
+    "GET /webchat/{id}/installs": {},
+    // The bug intake, the other anonymous door: gated by origin allowlist or ingest key, rate window and daily ceiling.
+    "GET /intake/sdk.js": { auth: "door", embedded: true },
+    "GET /intake/{id}/config": { auth: "door", embedded: true },
+    "GET /intake/{id}/challenge": { auth: "door", embedded: true },
+    "POST /intake/{id}/report": { auth: "door", embedded: true },
+    // The roster is ownership's to change; giving up one's own grant is every tier's.
+    "GET /members": { control: "never" },
+    "POST /members": { control: "never" },
+    "DELETE /members": { control: "never" },
+    "DELETE /members/self": { floor: "viewer", guest: true, control: "never" },
+    "GET /environment": {},
+    "GET /environment/contents": {},
+    "POST /environment/approve": {},
+    "POST /environment/reject": {},
+    "POST /environment/runtime-install": {},
+    "GET /engines": {},
+    "POST /engines/channel": {},
+    "POST /engines/update": {},
+    "POST /engines/revert": {},
+    "GET /bundles": { control: "never" },
+    "POST /bundles": { control: "never" },
+    "DELETE /bundles": { control: "never" },
+    "POST /bundles/ticket": { control: "never" },
+    // Navigated to by the browser, so no header: its ticket is checked in the handler.
+    "GET /bundles/download": { auth: "door", control: "never" },
+    "GET /definition": {},
+    "POST /definition/diff": {},
+    "GET /definition/workspace": {},
+    "POST /definition/workspace/publish": {},
+    "POST /arrivals/plan": {},
+    "GET /arrivals/hosts": {},
+    "POST /arrivals/scan": {},
+    "POST /arrivals/apply": {},
+    "DELETE /arrivals": {},
+    "GET /extensions/{id}/bundle": {},
+    // An extension backend's own namespace, proxied verbatim.
+    "ALL /x/*": {},
+    // The `capabilities` CLI: discovery by name, and the ask that parks on an owner-decided card.
+    "GET /capabilities/connectable": { floor: "maintainer", agent: true, control: "never" },
+    "POST /capabilities/ask": { floor: "maintainer", agent: true, control: "never" },
+    // The `sandboxes` CLI; every create parks on a card in the owner's chat first.
+    "GET /sandboxes": { agent: true },
+    "POST /sandboxes": { agent: true },
+    // The `wallet` CLI; spend is bounded by the owner's policy and the key never enters the container.
+    "GET /wallet/status": { agent: true, control: "never" },
+    "POST /wallet/fetch": { agent: true, control: "never" },
+    "GET /wallet/history": { agent: true, control: "never" },
+    // The `agents` CLI's children: start, follow up, answer (never a consent card), list.
+    "POST /children/spawn": { agent: true, control: "never" },
+    "GET /children/providers": { agent: true, control: "never" },
+    "POST /children/wait": { agent: true, control: "never" },
+    "POST /children/send": { agent: true, control: "never" },
+    "POST /children/answer": { agent: true, control: "never" },
+    "GET /children": { agent: true, control: "never" },
+    // The fleet reads, and the one write: words in front of another conversation, which a person can do by typing.
+    "GET /fleet": { agent: true },
+    "POST /fleet/message": { agent: true },
+    "GET /fleet/{handle}": { agent: true },
+    // An extension gateway's realtime-listener control, reached with the panel token.
+    "GET /listeners/{provider}/state": {},
+    "POST /listeners/{provider}/dispatch": {},
+    "POST /listeners/{provider}/failure": {},
+    "POST /listeners/{provider}/status": {},
+    // The CI webhook receiver, gated by the per-sandbox webhook secret.
+    "POST /ci/webhook/{host}": { auth: "door" },
+    // Below maintainer a pairing is capped to port-mirror, so a collaborator may mint a preview tunnel.
+    "POST /system/sync/pair": { floor: "collaborator", control: "never" },
+    // The peer doors: a device, browser or runner redeems its pairing at `enroll` and dials `connect` with the token.
+    "POST /system/hosts/pair": { control: "never" },
+    "POST /system/hosts/enroll": { auth: "door", control: "never" },
+    "GET /system/hosts": { control: "never" },
+    "DELETE /system/hosts/{id}": { control: "never" },
+    // A peer's socket reconnects on its own backoff, so it answers before boot.
+    "GET /system/hosts/connect": { auth: "door", beforeBoot: true, control: "never" },
+    // The MCP bridge onto a peer, carrying the per-boot bridge token its handler checks.
+    "POST /mcp/hosts/{id}": { auth: "door" },
+    "GET /mcp/hosts/{id}": { auth: "door" },
+    "DELETE /mcp/hosts/{id}": { auth: "door" },
+    "POST /system/webext/pair": { control: "never" },
+    "POST /system/webext/enroll": { auth: "door", control: "never" },
+    "GET /system/webext": { control: "never" },
+    "DELETE /system/webext/{id}": { control: "never" },
+    "GET /system/webext/connect": { auth: "door", beforeBoot: true, control: "never" },
+    "POST /mcp/webext/{id}": { auth: "door" },
+    "GET /mcp/webext/{id}": { auth: "door" },
+    "DELETE /mcp/webext/{id}": { auth: "door" },
+    "POST /system/runners/pair": { control: "never" },
+    "POST /system/runners/enroll": { auth: "door", control: "never" },
+    "GET /system/runners": { control: "never" },
+    "DELETE /system/runners/{id}": { control: "never" },
+    "GET /system/runners/connect": { auth: "door", beforeBoot: true, control: "never" },
+    // A turn's own browser router, carrying the per-boot browser bridge token.
+    "POST /system/browser/prepare": { auth: "door", control: "never" },
+    // A connected browser's credential doors, on its durable token: a sign-in moves in (`session`) or out (`lend`).
+    "POST /system/webext/session": { auth: "door", control: "never" },
+    "POST /system/webext/lend": { auth: "door", control: "never" },
+    "POST /system/runners/{id}/definition/sync": { control: "never" },
+    // A runner's git door and credential doors, each on the runner's own bearer.
+    "GET /system/runners/git/{repo}/info/refs": { auth: "door", control: "never" },
+    "POST /system/runners/git/{repo}/git-upload-pack": { auth: "door", control: "never" },
+    "POST /system/runners/git/{repo}/git-receive-pack": { auth: "door", control: "never" },
+    "POST /system/runners/credentials": { auth: "door", control: "never" },
+    "POST /system/runners/credentials/refresh": { auth: "door", control: "never" },
+    [`ALL ${runnerTranslatorPath}/*` as const]: { auth: "door", control: "never" },
+    "POST /system/control/tokens": { control: "never" },
+    "GET /system/control/tokens": { control: "never" },
+    "DELETE /system/control/tokens/{id}": { control: "never" },
+    // One's own passkeys are identity, like staying signed in; the policy and recovery codes are ownership's.
+    "GET /system/passkeys": { guest: true, control: "never" },
+    "POST /system/passkeys/register/options": { floor: "viewer", guest: true, enrolment: true, control: "never" },
+    "POST /system/passkeys/register": { floor: "viewer", guest: true, enrolment: true, control: "never" },
+    // The assertion has no bearer yet, since it is how one is minted.
+    "POST /system/passkeys/assert/options": { auth: "door", beforeBoot: true, control: "never" },
+    "POST /system/passkeys/assert": { auth: "door", beforeBoot: true, control: "never" },
+    "POST /system/passkeys/policy": { control: "never" },
+    "POST /system/passkeys/recovery": { control: "never" },
+    // One's own passkey; the handler holds another member's to the owner.
+    "DELETE /system/passkeys/{id}": { floor: "viewer", guest: true, control: "never" },
+    // Checks its own bearer, since the require-passkey policy would otherwise hold out the owner it exists for.
+    "POST /system/session/recover": { auth: "door", beforeBoot: true, control: "never" },
+    "POST /system/sessions/revoke": { control: "never" },
+    // Stays repeatable after a partial attempt; the handler does its own owner check.
+    "POST /system/access/disable": { auth: "door", control: "never" },
+    // The desktop-sync agent: redeems a one-time pairing, and later revokes with its own token.
+    "POST /system/authorized-key": { auth: "door", control: "never" },
+    "GET /system/sync": { control: "never" },
+    // The sync agent's own machine report, the daemon's only view of SYNC_DIR.
+    "POST /system/sync/report": { sync: "poll", control: "never" },
+    "DELETE /system/authorized-key": { auth: "door", control: "never" },
+    // The owner revoking one machine is no door: it goes through the session middleware.
+    "DELETE /system/authorized-key/{machine}": { control: "never" },
+} as const satisfies Readonly<Record<`${"GET" | "POST" | "PUT" | "DELETE" | "ALL"} /${string}`, RouteMeta>>;
+
+export type RawRouteKey = keyof typeof RAW_ROUTES;
+
+// A raw route's path, for a caller that builds a URL to it rather than registering it.
+export const rawRoutePath = (key: RawRouteKey): string => key.slice(key.indexOf(" ") + 1);
+
+// The table as routes of their own, each named by its key, in registration order.
+export const RAW_ROUTE_LIST: readonly (ContractRoute & { readonly name: RawRouteKey })[] = (Object.keys(RAW_ROUTES) as RawRouteKey[]).map((name) => ({
+    name,
+    method: name.slice(0, name.indexOf(" ")),
+    path: rawRoutePath(name),
+    meta: RAW_ROUTES[name],
+}));