@jungjaehoon/mama-os 0.22.1 → 0.24.0

package/dist/agent/gateway-tool-executor.d.ts

@@ -10,7 +10,7 @@
  * - Blocked tools return permission errors instead of executing
  * - Path-based tools (Read, Write) also check path permissions
  */
-import type { GatewayToolName, GatewayToolInput, GatewayToolResult, GatewayToolExecutorOptions, MAMAApiInterface, AgentContext, BotPlatform, GatewayToolExecutionContext, BeginModelRunInput, ModelRunRecord } from './types.js';
+import type { GatewayToolName, GatewayToolInput, GatewayToolResult, GatewayToolExecutorOptions, MAMAApiSetInput, AgentContext, BotPlatform, GatewayToolExecutionContext, BeginModelRunInput, ModelRunRecord } from './types.js';
 import type { AgentProcessManager } from '../multi-agent/agent-process-manager.js';
 import type { DelegationManager } from '../multi-agent/delegation-manager.js';
 import type { AgentEventBus } from '../multi-agent/agent-event-bus.js';
@@ -72,6 +72,9 @@ export declare class GatewayToolExecutor {
     private currentChannelId;
     private disallowedGatewayTools;
     private reportPublisher;
+    private reportRequestHandler;
+    private workOrderRequestHandler;
+    private reportReader;
     private wikiPublisher;
     private wikiPublishAdapter;
     private obsidianVaultPath;
@@ -118,6 +121,21 @@ export declare class GatewayToolExecutor {
     private syncViewerToAgentDetail;
     private resolveManagedAgentId;
     setReportPublisher(fn: (slots: Record<string, string>) => void): void;
+    /** Forwarder hook for on-demand full reports (plan v6 S1-T3). */
+    setReportRequestHandler(fn: () => {
+        accepted: boolean;
+        reason?: string;
+    }): void;
+    /** Forwarder hook for owner-issued workorders (Stage-2 S2-T4; enqueue+ack only). */
+    setWorkOrderRequestHandler(fn: (kind: 'board' | 'wiki' | 'memory-curation') => {
+        accepted: boolean;
+        reason?: string;
+    }): void;
+    /** Read seam for the owner board slots (plan v6 S1-T4 artifact hub). */
+    setReportReader(fn: () => Record<string, {
+        html: string;
+        updatedAt?: string | null;
+    }>): void;
     setWikiPublisher(fn: WikiPagePublisher): void;
     setWikiPublishAdapter(adapter: WikiPublishAdapter | null): void;
     /** Check if a memory agent is available for routing memory writes. */
@@ -148,7 +166,7 @@ export declare class GatewayToolExecutor {
     setContextCompileService(service: GatewayToolExecutorOptions['contextCompileService']): void;
     /** Wire the shared MAMA API built at boot (initMamaCore) so the executor never
      *  lazily constructs a second API/adapter stack against the same DB. */
-    setMamaApi(api: MAMAApiInterface): void;
+    setMamaApi(api: MAMAApiSetInput): void;
     /**
      * Initialize the MAMA API by importing from mcp-server package
      * Called lazily on first tool execution if not provided in constructor
@@ -355,11 +373,6 @@ export declare class GatewayToolExecutor {
      * Execute Obsidian CLI command on the wiki vault.
      */
     private executeObsidian;
-    private resolveCodeActSandboxRole;
-    private normalizeCodeActToolPatterns;
-    private isKnownCodeActToolPattern;
-    private matchesAnyCodeActToolPattern;
-    private matchesCodeActToolPattern;
     private executeCodeAct;
     /**
      * Handle mama_add — auto-extract facts from conversation content with derived memory scopes.

package/dist/agent/gateway-tool-executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gateway-tool-executor.d.ts","sourceRoot":"","sources":["../../src/agent/gateway-tool-executor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAwBH,OAAO,KAAK,EACV,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EASjB,0BAA0B,EAE1B,gBAAgB,EAShB,YAAY,EASZ,WAAW,EAGX,2BAA2B,EAE3B,kBAAkB,EAClB,cAAc,EAEf,MAAM,YAAY,CAAC;AAYpB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AACnF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AA0BnE,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,iBAAiB,EAAwB,MAAM,4BAA4B,CAAC;AAuB1F,KAAK,uBAAuB,GAAG,2BAA2B,CAAC;AAC3D,KAAK,sBAAsB,GAAG;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AA6QF;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClF;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClF;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACzE;AAwCD,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,OAAO,CAAiC;IAChD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAS;IACrC,OAAO,CAAC,YAAY,CAAC,CAAsB;IAC3C,OAAO,CAAC,cAAc,CAAwC;IAC9D,OAAO,CAAC,YAAY,CAAsC;IAC1D,OAAO,CAAC,eAAe,CAAyC;IAChE,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAA0D;IAClG,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA0B;IAC3D,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAiC;IACtE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6C;IAC1E,OAAO,CAAC,qBAAqB,CAAsD;IACnF,OAAO,CAAC,cAAc,CAA6B;IACnD,OAAO,CAAC,yBAAyB,CAAoC;IACrE,OAAO,CAAC,mBAAmB,CAAoC;IAC/D,OAAO,CAAC,oBAAoB,CAAkC;IAC9D,OAAO,CAAC,cAAc,CAAc;IACpC,OAAO,CAAC,aAAa,CAAc;IACnC,OAAO,CAAC,gBAAgB,CAAc;IACtC,OAAO,CAAC,sBAAsB,CAA0B;IACxD,OAAO,CAAC,eAAe,CAA0D;IACjF,OAAO,CAAC,aAAa,CAAkC;IACvD,OAAO,CAAC,kBAAkB,CAAmC;IAC7D,OAAO,CAAC,iBAAiB,CAAuB;IAChD,OAAO,CAAC,iBAAiB,CAAuB;IAChD,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;IAIjE,OAAO,CAAC,UAAU,CAAgE;IAClF,aAAa,CAAC,MAAM,EAAE,OAAO,4BAA4B,EAAE,UAAU,GAAG,IAAI;IAG5E,aAAa,IAAI,OAAO,4BAA4B,EAAE,UAAU,GAAG,IAAI;IAGvE,OAAO,CAAC,aAAa,CAA8B;IACnD,gBAAgB,CAAC,GAAG,EAAE,aAAa,GAAG,IAAI;IAG1C,gBAAgB,IAAI,aAAa,GAAG,IAAI;IAGxC,OAAO,CAAC,UAAU,CAA+B;IACjD,aAAa,CAAC,EAAE,EAAE,cAAc,GAAG,IAAI;IAIvC,OAAO,CAAC,QAAQ,CAAwE;IACxF,WAAW,CAAC,KAAK,EAAE,OAAO,sCAAsC,EAAE,QAAQ,GAAG,IAAI;IAIjF,OAAO,CAAC,kBAAkB,CAAmC;IAC7D,OAAO,CAAC,cAAc,CAA+B;IACrD,iBAAiB,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI;IAG9C,OAAO,CAAC,qBAAqB,CAAqE;IAClG,wBAAwB,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI;IAG/F,OAAO,CAAC,sBAAsB,CAAqD;IACnF,yBAAyB,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI;IAGhF,OAAO,CAAC,iBAAiB,CAET;IAChB,oBAAoB,CAClB,GAAG,EAAE,OAAO,kCAAkC,EAAE,wBAAwB,GACvE,IAAI;IAIP,cAAc,CAAC,cAAc,EAAE,mBAAmB,GAAG,IAAI;IAGzD,sBAAsB,CAAC,EAAE,EAAE,mBAAmB,GAAG,IAAI;IAIrD,oBAAoB,CAAC,EAAE,EAAE,iBAAiB,GAAG,IAAI;IAIjD,wFAAwF;IACxF,sBAAsB,IAAI,mBAAmB,GAAG,IAAI;IAIpD,OAAO,CAAC,yBAAyB;IAyBjC,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,2BAA2B;IASnC,OAAO,CAAC,iCAAiC;IA0BzC,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,gBAAgB;IASxB,OAAO,CAAC,0BAA0B;IAS5B,oBAAoB,CAAC,CAAC,EAC1B,gBAAgB,EAAE,uBAAuB,GAAG,SAAS,EACrD,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,CAAC,CAAC;IAQb,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IAKhF,6BAA6B,IAAI,sBAAsB;IAOvD,iCAAiC,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI;IAKxE,wBAAwB,IAAI,IAAI;IAKhC,yBAAyB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI;IAIhD,OAAO,CAAC,0BAA0B;IAiBlC,OAAO,CAAC,uBAAuB;IAqC/B,OAAO,CAAC,qBAAqB;IAyB7B,kBAAkB,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,IAAI,GAAG,IAAI;IAGrE,gBAAgB,CAAC,EAAE,EAAE,iBAAiB,GAAG,IAAI;IAG7C,qBAAqB,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,GAAG,IAAI;IAI/D,sEAAsE;IACtE,cAAc,IAAI,OAAO;IAIzB,uEAAuE;IACvE,kBAAkB,IAAI,OAAO;IAI7B,qFAAqF;IACrF,OAAO,CAAC,aAAa,CAAgB;IAErC,OAAO,CAAC,wBAAwB;IAahC,OAAO,CAAC,yBAAyB;IAIjC,OAAO,CAAC,qBAAqB;gBAOjB,OAAO,GAAE,0BAA+B;IA4B9C,oBAAoB,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,cAAc,CAAC;IAKxE,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAKpF,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAK5F;;;OAGG;IACH,eAAe,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,GAAG,IAAI;IAInD;;OAEG;IACH,eAAe,IAAI,YAAY,GAAG,IAAI;IAItC,iBAAiB,CAAC,OAAO,EAAE,uBAAuB,GAAG,IAAI;IAIzD,eAAe,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI;IAIrD,kBAAkB,CAAC,OAAO,EAAE,wBAAwB,GAAG,IAAI;IAI3D,wBAAwB,CAAC,OAAO,EAAE,0BAA0B,CAAC,uBAAuB,CAAC,GAAG,IAAI;IAI5F;4EACwE;IACxE,UAAU,CAAC,GAAG,EAAE,gBAAgB,GAAG,IAAI;IAIvC;;;OAGG;YACW,iBAAiB;IA0D/B;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAmB3B;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAmB3B,OAAO,CAAC,0BAA0B;IAmFlC,OAAO,CAAC,mBAAmB;IA2B3B;;;;;;;OAOG;IACG,OAAO,CACX,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,gBAAgB,EACvB,gBAAgB,CAAC,EAAE,uBAAuB,GACzC,OAAO,CAAC,iBAAiB,CAAC;YAoGf,kBAAkB;IAqChC,OAAO,CAAC,eAAe;YA2BT,uBAAuB;IAyBrC,OAAO,CAAC,wBAAwB;YAWlB,8BAA8B;YAgB9B,0BAA0B;IAYxC,OAAO,CAAC,uBAAuB;IAuC/B,OAAO,CAAC,wBAAwB;IAqChC,OAAO,CAAC,mCAAmC;IAe3C,OAAO,CAAC,uBAAuB;IA0D/B,OAAO,CAAC,+BAA+B;YAiCzB,8BAA8B;IAqF5C,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,mBAAmB;IAI3B,OAAO,CAAC,yBAAyB;IAkBjC,OAAO,CAAC,kBAAkB;IAiD1B,OAAO,CAAC,kBAAkB;YA+BZ,iCAAiC;IA4qB/C;;;OAGG;YACW,WAAW;IAiEzB;;;OAGG;YACW,YAAY;IA2C1B;;OAEG;YACW,WAAW;IAiKzB;;;OAGG;YACW,kBAAkB;IAkChC;;OAEG;YACW,gBAAgB;IA8B9B;;OAEG;YACW,mBAAmB;IAwCjC;;OAEG;YACW,sBAAsB;IAWpC;;OAEG;YACW,wBAAwB;IAatC;;OAEG;YACW,mBAAmB;IAWjC;;OAEG;YACW,kBAAkB;IAWhC;;OAEG;YACW,qBAAqB;IAanC;;OAEG;YACW,oBAAoB;IAWlC;;OAEG;YACW,qBAAqB;IAWnC;;OAEG;YACW,sBAAsB;IAWpC;;OAEG;YACW,iBAAiB;IAW/B;;OAEG;YACW,mBAAmB;IAajC;;;OAGG;IACH,OAAO,CAAC,eAAe;IAkBvB;;;OAGG;YACW,aAAa;IA+E3B;;;OAGG;YACW,qBAAqB;IAwEnC;;;OAGG;YACW,gBAAgB;IAkC9B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAmCzB;;;;;;;OAOG;YACW,eAAe;IAkH7B;;;OAGG;IACH,OAAO,CAAC,iBAAiB,CAClB;IAEP;;;OAGG;IACH,OAAO,CAAC,kBAAkB,CAKV;IAEhB;;OAEG;IACH,oBAAoB,CAClB,QAAQ,EAAE,MAAM,GAAG,CAAC,WAAW,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GACrE,IAAI;IAIP;;OAEG;IACH,qBAAqB,CACnB,QAAQ,EAAE,CACR,QAAQ,EAAE,WAAW,EACrB,MAAM,EAAE,OAAO,GAAG,MAAM,KACrB,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GACjD,IAAI;IAIP;;OAEG;YACW,eAAe;IAkD7B;;;OAGG;YACW,iBAAiB;IA4C/B;;;OAGG;YACW,cAAc;IAuC5B,OAAO,CAAC,UAAU;YAMJ,sBAAsB;IA2HpC;;;;;OAKG;YACW,kBAAkB;IA2EhC;;;;;;OAMG;IACH,OAAO,CAAC,UAAU,CAAsD;IACxE,OAAO,CAAC,uBAAuB;IAsE/B;;OAEG;YACW,eAAe;IAqD7B,OAAO,CAAC,yBAAyB;IAyDjC,OAAO,CAAC,4BAA4B;IAgCpC,OAAO,CAAC,yBAAyB;IAOjC,OAAO,CAAC,4BAA4B;IAIpC,OAAO,CAAC,yBAAyB;YAYnB,cAAc;IA2B5B;;OAEG;YACW,aAAa;YA4Bb,gBAAgB;YAuFhB,gBAAgB;IAoC9B,MAAM,CAAC,aAAa,IAAI,eAAe,EAAE;IAIzC;;OAEG;IACH,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,IAAI,eAAe;YAInD,oBAAoB;CAsDnC"}
+{"version":3,"file":"gateway-tool-executor.d.ts","sourceRoot":"","sources":["../../src/agent/gateway-tool-executor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAyBH,OAAO,KAAK,EACV,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EASjB,0BAA0B,EAG1B,eAAe,EASf,YAAY,EASZ,WAAW,EAGX,2BAA2B,EAE3B,kBAAkB,EAClB,cAAc,EAEf,MAAM,YAAY,CAAC;AAYpB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AACnF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AA0BnE,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,iBAAiB,EAAwB,MAAM,4BAA4B,CAAC;AAuB1F,KAAK,uBAAuB,GAAG,2BAA2B,CAAC;AAC3D,KAAK,sBAAsB,GAAG;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAsQF;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClF;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClF;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACzE;AAwCD,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,OAAO,CAAiC;IAChD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAS;IACrC,OAAO,CAAC,YAAY,CAAC,CAAsB;IAC3C,OAAO,CAAC,cAAc,CAAwC;IAC9D,OAAO,CAAC,YAAY,CAAsC;IAC1D,OAAO,CAAC,eAAe,CAAyC;IAChE,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAA0D;IAClG,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA0B;IAC3D,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAiC;IACtE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6C;IAC1E,OAAO,CAAC,qBAAqB,CAAsD;IACnF,OAAO,CAAC,cAAc,CAA6B;IACnD,OAAO,CAAC,yBAAyB,CAAoC;IACrE,OAAO,CAAC,mBAAmB,CAAoC;IAC/D,OAAO,CAAC,oBAAoB,CAAkC;IAC9D,OAAO,CAAC,cAAc,CAAc;IACpC,OAAO,CAAC,aAAa,CAAc;IACnC,OAAO,CAAC,gBAAgB,CAAc;IACtC,OAAO,CAAC,sBAAsB,CAA0B;IACxD,OAAO,CAAC,eAAe,CAA0D;IACjF,OAAO,CAAC,oBAAoB,CAA+D;IAC3F,OAAO,CAAC,uBAAuB,CAEf;IAChB,OAAO,CAAC,YAAY,CACb;IACP,OAAO,CAAC,aAAa,CAAkC;IACvD,OAAO,CAAC,kBAAkB,CAAmC;IAC7D,OAAO,CAAC,iBAAiB,CAAuB;IAChD,OAAO,CAAC,iBAAiB,CAAuB;IAChD,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;IAIjE,OAAO,CAAC,UAAU,CAAgE;IAClF,aAAa,CAAC,MAAM,EAAE,OAAO,4BAA4B,EAAE,UAAU,GAAG,IAAI;IAG5E,aAAa,IAAI,OAAO,4BAA4B,EAAE,UAAU,GAAG,IAAI;IAGvE,OAAO,CAAC,aAAa,CAA8B;IACnD,gBAAgB,CAAC,GAAG,EAAE,aAAa,GAAG,IAAI;IAG1C,gBAAgB,IAAI,aAAa,GAAG,IAAI;IAGxC,OAAO,CAAC,UAAU,CAA+B;IACjD,aAAa,CAAC,EAAE,EAAE,cAAc,GAAG,IAAI;IAIvC,OAAO,CAAC,QAAQ,CAAwE;IACxF,WAAW,CAAC,KAAK,EAAE,OAAO,sCAAsC,EAAE,QAAQ,GAAG,IAAI;IAIjF,OAAO,CAAC,kBAAkB,CAAmC;IAC7D,OAAO,CAAC,cAAc,CAA+B;IACrD,iBAAiB,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI;IAG9C,OAAO,CAAC,qBAAqB,CAAqE;IAClG,wBAAwB,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI;IAG/F,OAAO,CAAC,sBAAsB,CAAqD;IACnF,yBAAyB,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI;IAGhF,OAAO,CAAC,iBAAiB,CAET;IAChB,oBAAoB,CAClB,GAAG,EAAE,OAAO,kCAAkC,EAAE,wBAAwB,GACvE,IAAI;IAIP,cAAc,CAAC,cAAc,EAAE,mBAAmB,GAAG,IAAI;IAGzD,sBAAsB,CAAC,EAAE,EAAE,mBAAmB,GAAG,IAAI;IAIrD,oBAAoB,CAAC,EAAE,EAAE,iBAAiB,GAAG,IAAI;IAIjD,wFAAwF;IACxF,sBAAsB,IAAI,mBAAmB,GAAG,IAAI;IAIpD,OAAO,CAAC,yBAAyB;IA4BjC,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,2BAA2B;IASnC,OAAO,CAAC,iCAAiC;IA8BzC,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,gBAAgB;IASxB,OAAO,CAAC,0BAA0B;IAS5B,oBAAoB,CAAC,CAAC,EAC1B,gBAAgB,EAAE,uBAAuB,GAAG,SAAS,EACrD,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,CAAC,CAAC;IAQb,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IAKhF,6BAA6B,IAAI,sBAAsB;IAOvD,iCAAiC,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI;IAKxE,wBAAwB,IAAI,IAAI;IAKhC,yBAAyB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI;IAIhD,OAAO,CAAC,0BAA0B;IAiBlC,OAAO,CAAC,uBAAuB;IAqC/B,OAAO,CAAC,qBAAqB;IAyB7B,kBAAkB,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,IAAI,GAAG,IAAI;IAGrE,iEAAiE;IACjE,uBAAuB,CAAC,EAAE,EAAE,MAAM;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAG/E,oFAAoF;IACpF,0BAA0B,CACxB,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,iBAAiB,KAAK;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GACzF,IAAI;IAGP,wEAAwE;IACxE,eAAe,CAAC,EAAE,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,GAAG,IAAI;IAG5F,gBAAgB,CAAC,EAAE,EAAE,iBAAiB,GAAG,IAAI;IAG7C,qBAAqB,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,GAAG,IAAI;IAI/D,sEAAsE;IACtE,cAAc,IAAI,OAAO;IAIzB,uEAAuE;IACvE,kBAAkB,IAAI,OAAO;IAI7B,qFAAqF;IACrF,OAAO,CAAC,aAAa,CAAgB;IAErC,OAAO,CAAC,wBAAwB;IAahC,OAAO,CAAC,yBAAyB;IAIjC,OAAO,CAAC,qBAAqB;gBAOjB,OAAO,GAAE,0BAA+B;IA4B9C,oBAAoB,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,cAAc,CAAC;IAKxE,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAKpF,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAK5F;;;OAGG;IACH,eAAe,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,GAAG,IAAI;IAInD;;OAEG;IACH,eAAe,IAAI,YAAY,GAAG,IAAI;IAItC,iBAAiB,CAAC,OAAO,EAAE,uBAAuB,GAAG,IAAI;IAIzD,eAAe,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI;IAIrD,kBAAkB,CAAC,OAAO,EAAE,wBAAwB,GAAG,IAAI;IAI3D,wBAAwB,CAAC,OAAO,EAAE,0BAA0B,CAAC,uBAAuB,CAAC,GAAG,IAAI;IAI5F;4EACwE;IACxE,UAAU,CAAC,GAAG,EAAE,eAAe,GAAG,IAAI;IAoCtC;;;OAGG;YACW,iBAAiB;IA0D/B;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IA0B3B;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAmB3B,OAAO,CAAC,0BAA0B;IAmFlC,OAAO,CAAC,mBAAmB;IA2B3B;;;;;;;OAOG;IACG,OAAO,CACX,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,gBAAgB,EACvB,gBAAgB,CAAC,EAAE,uBAAuB,GACzC,OAAO,CAAC,iBAAiB,CAAC;YAsGf,kBAAkB;IAqChC,OAAO,CAAC,eAAe;YA2BT,uBAAuB;IAyBrC,OAAO,CAAC,wBAAwB;YAWlB,8BAA8B;YAgB9B,0BAA0B;IAYxC,OAAO,CAAC,uBAAuB;IAuC/B,OAAO,CAAC,wBAAwB;IAqChC,OAAO,CAAC,mCAAmC;IAe3C,OAAO,CAAC,uBAAuB;IA0D/B,OAAO,CAAC,+BAA+B;YAiCzB,8BAA8B;IAqF5C,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,mBAAmB;IAI3B,OAAO,CAAC,yBAAyB;IAkBjC,OAAO,CAAC,kBAAkB;IAiD1B,OAAO,CAAC,kBAAkB;YA+BZ,iCAAiC;IAg2B/C;;;OAGG;YACW,WAAW;IAiEzB;;;OAGG;YACW,YAAY;IA2C1B;;OAEG;YACW,WAAW;IAiKzB;;;OAGG;YACW,kBAAkB;IAkChC;;OAEG;YACW,gBAAgB;IA8B9B;;OAEG;YACW,mBAAmB;IAwCjC;;OAEG;YACW,sBAAsB;IAWpC;;OAEG;YACW,wBAAwB;IAatC;;OAEG;YACW,mBAAmB;IAWjC;;OAEG;YACW,kBAAkB;IAWhC;;OAEG;YACW,qBAAqB;IAanC;;OAEG;YACW,oBAAoB;IAWlC;;OAEG;YACW,qBAAqB;IAWnC;;OAEG;YACW,sBAAsB;IAWpC;;OAEG;YACW,iBAAiB;IAW/B;;OAEG;YACW,mBAAmB;IAajC;;;OAGG;IACH,OAAO,CAAC,eAAe;IAkBvB;;;OAGG;YACW,aAAa;IA+E3B;;;OAGG;YACW,qBAAqB;IA0EnC;;;OAGG;YACW,gBAAgB;IAkC9B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAmCzB;;;;;;;OAOG;YACW,eAAe;IAmH7B;;;OAGG;IACH,OAAO,CAAC,iBAAiB,CAClB;IAEP;;;OAGG;IACH,OAAO,CAAC,kBAAkB,CAKV;IAEhB;;OAEG;IACH,oBAAoB,CAClB,QAAQ,EAAE,MAAM,GAAG,CAAC,WAAW,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GACrE,IAAI;IAIP;;OAEG;IACH,qBAAqB,CACnB,QAAQ,EAAE,CACR,QAAQ,EAAE,WAAW,EACrB,MAAM,EAAE,OAAO,GAAG,MAAM,KACrB,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GACjD,IAAI;IAIP;;OAEG;YACW,eAAe;IAkD7B;;;OAGG;YACW,iBAAiB;IA4C/B;;;OAGG;YACW,cAAc;IAuC5B,OAAO,CAAC,UAAU;YAMJ,sBAAsB;IA2HpC;;;;;OAKG;YACW,kBAAkB;IA2EhC;;;;;;OAMG;IACH,OAAO,CAAC,UAAU,CAAsD;IACxE,OAAO,CAAC,uBAAuB;IAsE/B;;OAEG;YACW,eAAe;YAqDf,cAAc;IAiD5B;;OAEG;YACW,aAAa;YA4Bb,gBAAgB;YAuFhB,gBAAgB;IAoC9B,MAAM,CAAC,aAAa,IAAI,eAAe,EAAE;IAIzC;;OAEG;IACH,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,IAAI,eAAe;YAInD,oBAAoB;CAuDnC"}

package/dist/agent/gateway-tool-executor.js

@@ -59,6 +59,7 @@ const util_1 = require("util");
 const debugLogger = __importStar(require("@jungjaehoon/mama-core/debug-logger"));
 const mama_core_1 = require("@jungjaehoon/mama-core");
 const security_monitor_js_1 = require("../security/security-monitor.js");
+const secret_filter_js_1 = require("../memory/secret-filter.js");
 const scope_context_js_1 = require("../memory/scope-context.js");
 const types_js_1 = require("./types.js");
 const sqlite_js_1 = __importDefault(require("../sqlite.js"));
@@ -292,6 +293,9 @@ class GatewayToolExecutor {
     currentChannelId = '';
     disallowedGatewayTools = new Set();
     reportPublisher = null;
+    reportRequestHandler = null;
+    workOrderRequestHandler = null;
+    reportReader = null;
     wikiPublisher = null;
     wikiPublishAdapter = null;
     obsidianVaultPath = null;
@@ -374,8 +378,11 @@ class GatewayToolExecutor {
             sourceMessageRef: executionContext?.sourceMessageRef,
             modelRunId: executionContext?.modelRunId ?? null,
             gatewayCallId: executionContext?.gatewayCallId,
+            signal: executionContext?.signal,
+            parentToolName: executionContext?.parentToolName,
             backgroundTasks: executionContext?.backgroundTasks,
             disallowedGatewayTools: executionContext?.disallowedGatewayTools,
+            reportPublisherOverride: executionContext?.reportPublisherOverride,
         };
     }
     getExecutionState() {
@@ -405,10 +412,14 @@ class GatewayToolExecutor {
             sourceMessageRef: active.sourceMessageRef ?? fallback.sourceMessageRef,
             modelRunId: active.modelRunId ?? fallback.modelRunId,
             gatewayCallId: active.gatewayCallId ?? fallback.gatewayCallId,
+            signal: active.signal,
             parentToolName: active.parentToolName ?? fallback.parentToolName,
             backgroundTasks: active.backgroundTasks ?? fallback.backgroundTasks,
             // Never merged from fallback - blocks are strictly per-call.
             disallowedGatewayTools: active.disallowedGatewayTools,
+            // Never merged from fallback - a lingering global capture override
+            // would swallow LIVE publishes (Stage-2 shadow seam).
+            reportPublisherOverride: active.reportPublisherOverride,
         };
     }
     getActiveContext() {
@@ -533,6 +544,18 @@ class GatewayToolExecutor {
     setReportPublisher(fn) {
         this.reportPublisher = fn;
     }
+    /** Forwarder hook for on-demand full reports (plan v6 S1-T3). */
+    setReportRequestHandler(fn) {
+        this.reportRequestHandler = fn;
+    }
+    /** Forwarder hook for owner-issued workorders (Stage-2 S2-T4; enqueue+ack only). */
+    setWorkOrderRequestHandler(fn) {
+        this.workOrderRequestHandler = fn;
+    }
+    /** Read seam for the owner board slots (plan v6 S1-T4 artifact hub). */
+    setReportReader(fn) {
+        this.reportReader = fn;
+    }
     setWikiPublisher(fn) {
         this.wikiPublisher = fn;
     }
@@ -634,7 +657,35 @@ class GatewayToolExecutor {
     /** Wire the shared MAMA API built at boot (initMamaCore) so the executor never
      *  lazily constructs a second API/adapter stack against the same DB. */
     setMamaApi(api) {
-        this.mamaApi = api;
+        const listDecisions = 'listDecisions' in api ? api.listDecisions : undefined;
+        if (typeof listDecisions === 'function') {
+            this.mamaApi = api;
+            return;
+        }
+        const list = 'list' in api ? api.list : undefined;
+        if (typeof list !== 'function') {
+            throw new Error('MAMA API must provide listDecisions() or list()');
+        }
+        const normalizedListDecisions = list.bind(api);
+        const boundMethods = new WeakMap();
+        this.mamaApi = new Proxy({}, {
+            get(_target, property) {
+                if (property === 'listDecisions') {
+                    return normalizedListDecisions;
+                }
+                const value = Reflect.get(api, property, api);
+                if (typeof value !== 'function') {
+                    return value;
+                }
+                const cached = boundMethods.get(value);
+                if (cached) {
+                    return cached;
+                }
+                const bound = value.bind(api);
+                boundMethods.set(value, bound);
+                return bound;
+            },
+        });
     }
     /**
      * Initialize the MAMA API by importing from mcp-server package
@@ -696,6 +747,12 @@ class GatewayToolExecutor {
         // If no context set, allow all tools (backward compatibility)
         const context = this.getActiveContext();
         if (!context) {
+            if (toolName === 'code_act') {
+                return {
+                    allowed: false,
+                    error: 'Permission denied: code_act requires an active agent role',
+                };
+            }
             return { allowed: true };
         }
         const role = context.role;
@@ -832,6 +889,7 @@ class GatewayToolExecutor {
         }
         const startedAt = Date.now();
         const baseCtx = this.mergeWithFallbackExecutionContext(this.executionContextStorage.getStore());
+        baseCtx.signal?.throwIfAborted();
         const gatewayCallId = baseCtx.gatewayCallId ?? `gw_${(0, crypto_1.randomUUID)().replace(/-/g, '')}`;
         const ctx = { ...baseCtx, gatewayCallId };
         const effectiveInput = this.applyEnvelopeScopedReadDefaults(toolName, input, ctx);
@@ -841,6 +899,7 @@ class GatewayToolExecutor {
         let result;
         try {
             result = await this.executionContextStorage.run(activeCtx, () => this.executeWithEnvelopeAndPermissions(toolName, effectiveInput, gatewayCallId));
+            activeCtx.signal?.throwIfAborted();
         }
         catch (error) {
             await this.appendToolTraceIfNeeded(traceState, activeCtx, toolName, undefined, Date.now() - startedAt, gatewayCallId, error).catch((appendError) => {
@@ -1254,6 +1313,7 @@ class GatewayToolExecutor {
         }
     }
     async executeWithEnvelopeAndPermissions(toolName, input, gatewayCallId) {
+        this.getExecutionState().signal?.throwIfAborted();
         if (!VALID_TOOLS.includes(toolName)) {
             throw new types_js_1.AgentError(`Unknown tool: ${toolName}. Valid tools: ${VALID_TOOLS.join(', ')}`, 'UNKNOWN_TOOL', undefined, false);
         }
@@ -1564,6 +1624,18 @@ class GatewayToolExecutor {
             switch (toolName) {
                 case 'mama_save': {
                     const saveInput = input;
+                    // Secret inviolability (plan v6 S1-T7): a secret saved as a
+                    // "decision" would resurface later via mama_search/recall - the one
+                    // leak path a chat-reachable tool has. Refuse loudly at the choke.
+                    const saveSecretScan = (0, secret_filter_js_1.scanMemoryWriteInput)(saveInput);
+                    if (!saveSecretScan.clean) {
+                        console.warn(`[Security] mama_save refused: secret-shaped content (${saveSecretScan.matches.join(', ')})`);
+                        return {
+                            success: false,
+                            code: 'secret_material_refused',
+                            error: `Refusing to save: content matches secret pattern(s): ${saveSecretScan.matches.join(', ')}. Secrets must never enter memory.`,
+                        };
+                    }
                     const api = await getApi();
                     let trustedOptions;
                     let effectiveSaveInput = saveInput;
@@ -1631,17 +1703,45 @@ class GatewayToolExecutor {
                     return await this.handleMamaRecall(input);
                 case 'context_compile':
                     return await this.handleContextCompile(input);
-                case 'mama_update':
+                case 'mama_update': {
+                    const updateSecretScan = (0, secret_filter_js_1.scanMemoryWriteInput)(input);
+                    if (!updateSecretScan.clean) {
+                        console.warn(`[Security] mama_update refused: secret-shaped content (${updateSecretScan.matches.join(', ')})`);
+                        return {
+                            success: false,
+                            code: 'secret_material_refused',
+                            error: `Refusing to update: content matches secret pattern(s): ${updateSecretScan.matches.join(', ')}. Secrets must never enter memory.`,
+                        };
+                    }
                     return await (0, mama_tool_handlers_js_1.handleUpdate)(await getApi(), input);
+                }
                 case 'mama_load_checkpoint':
                     return await (0, mama_tool_handlers_js_1.handleLoadCheckpoint)(await getApi(), input);
                 case 'mama_add': {
+                    const addSecretScan = (0, secret_filter_js_1.scanMemoryWriteInput)(input);
+                    if (!addSecretScan.clean) {
+                        console.warn(`[Security] mama_add refused: secret-shaped content (${addSecretScan.matches.join(', ')})`);
+                        return {
+                            success: false,
+                            code: 'secret_material_refused',
+                            error: `Refusing to add: content matches secret pattern(s): ${addSecretScan.matches.join(', ')}. Secrets must never enter memory.`,
+                        };
+                    }
                     const api = await getApi();
                     return await this.handleMamaAdd(input, this.supportsTrustedIngest(api)
                         ? (await this.buildTrustedMemoryWriteOptions('mama_add', gatewayCallId)).options
                         : undefined);
                 }
                 case 'mama_ingest': {
+                    const ingestSecretScan = (0, secret_filter_js_1.scanMemoryWriteInput)(input);
+                    if (!ingestSecretScan.clean) {
+                        console.warn(`[Security] mama_ingest refused: secret-shaped content (${ingestSecretScan.matches.join(', ')})`);
+                        return {
+                            success: false,
+                            code: 'secret_material_refused',
+                            error: `Refusing to ingest: content matches secret pattern(s): ${ingestSecretScan.matches.join(', ')}. Secrets must never enter memory.`,
+                        };
+                    }
                     const api = await getApi();
                     return await this.handleMamaIngest(input, this.supportsTrustedIngest(api)
                         ? (await this.buildTrustedMemoryWriteOptions('mama_ingest', gatewayCallId)).options
@@ -1652,8 +1752,11 @@ class GatewayToolExecutor {
                     if (!slotsInput || typeof slotsInput !== 'object') {
                         throw new types_js_1.AgentError('report_publish requires slots object', 'TOOL_ERROR', undefined, false);
                     }
-                    if (this.reportPublisher) {
-                        this.reportPublisher(slotsInput);
+                    // Stage-2 shadow seam: a per-run capture override takes precedence
+                    // over the global singleton (capture runs never touch the live store).
+                    const activePublisher = this.getExecutionState().reportPublisherOverride ?? this.reportPublisher;
+                    if (activePublisher) {
+                        activePublisher(slotsInput);
                         const slotNames = Object.keys(slotsInput);
                         return {
                             success: true,
@@ -1662,6 +1765,111 @@ class GatewayToolExecutor {
                     }
                     throw new types_js_1.AgentError('Report publisher not configured', 'TOOL_ERROR', undefined, false);
                 }
+                case 'report_request': {
+                    // Owner intent -> the REAL report machinery. Fire-and-forget: the
+                    // report runs on the operator lane and is delivered by the owner
+                    // leg; awaiting ~260s here would block the chat turn (and the plan
+                    // bans nested awaited lane runs).
+                    if (!this.reportRequestHandler) {
+                        return {
+                            success: false,
+                            code: 'report_leg_disabled',
+                            error: 'Full-report machinery is not enabled (trigger loop off or report channel unset). ' +
+                                'The scheduled report legs are inactive on this deployment.',
+                        };
+                    }
+                    const started = this.reportRequestHandler();
+                    if (!started.accepted) {
+                        return {
+                            success: false,
+                            code: `report_${started.reason ?? 'unavailable'}`,
+                            error: started.reason === 'busy'
+                                ? 'The operator lane is busy (a report or tick is in progress). Retry shortly.'
+                                : 'Report machinery unavailable (no output sink).',
+                        };
+                    }
+                    return {
+                        success: true,
+                        message: 'Full report started. It will be generated fresh (delta-anchored) and delivered to the owner channel - tell the owner it is on its way; do not fabricate its contents.',
+                    };
+                }
+                case 'workorder_request': {
+                    // Owner intent -> a priority workorder. Enqueue + ack ONLY - the
+                    // run happens on the operator lane later; awaiting it here would
+                    // block the chat turn (plan B6: issue tools are enqueue+ack only).
+                    const requestedKind = input.kind;
+                    if (requestedKind !== 'board' &&
+                        requestedKind !== 'wiki' &&
+                        requestedKind !== 'memory-curation') {
+                        return {
+                            success: false,
+                            code: 'invalid_workorder_kind',
+                            error: `kind must be one of board|wiki|memory-curation, got: ${String(requestedKind)}`,
+                        };
+                    }
+                    if (!this.workOrderRequestHandler) {
+                        return {
+                            success: false,
+                            code: 'workorder_machinery_disabled',
+                            error: 'Stage-2 workorders are not enabled on this deployment (MAMA_STAGE2_WORKORDERS=off).',
+                        };
+                    }
+                    const enqueued = this.workOrderRequestHandler(requestedKind);
+                    if (!enqueued.accepted) {
+                        return {
+                            success: false,
+                            code: `workorder_${enqueued.reason ?? 'unavailable'}`,
+                            error: `Workorder enqueue failed: ${enqueued.reason ?? 'unknown'}`,
+                        };
+                    }
+                    return {
+                        success: true,
+                        message: 'Workorder enqueued at priority high. It will run on the operator lane shortly - tell the owner it is queued; do not wait for it or fabricate its result.',
+                    };
+                }
+                case 'workorder_status': {
+                    if (!this.taskLedger) {
+                        return {
+                            success: false,
+                            code: 'ledger_unavailable',
+                            error: 'Task ledger is not wired on this deployment.',
+                        };
+                    }
+                    return { success: true, data: { kinds: this.taskLedger.workOrderStats() } };
+                }
+                case 'board_read': {
+                    if (!this.reportReader) {
+                        return {
+                            success: false,
+                            code: 'board_unavailable',
+                            error: 'Report store not wired (board_read requires the API server report store).',
+                        };
+                    }
+                    const slots = this.reportReader();
+                    return { success: true, slots };
+                }
+                case 'audit_findings_read': {
+                    const auditStatePath = (0, path_1.join)(process.env.HOME || (0, os_1.homedir)(), '.mama', 'state', 'audit-findings.json');
+                    try {
+                        const raw = (0, fs_1.readFileSync)(auditStatePath, 'utf8');
+                        return { success: true, findings: JSON.parse(raw) };
+                    }
+                    catch (error) {
+                        const code = error.code;
+                        if (code === 'ENOENT') {
+                            return {
+                                success: true,
+                                findings: null,
+                                message: 'No audit findings recorded yet (first audit has not run).',
+                            };
+                        }
+                        return {
+                            success: false,
+                            code: 'audit_state_unreadable',
+                            error: `Failed to read audit findings: ${error instanceof Error ? error.message : String(error)}`,
+                        };
+                    }
+                }
                 case 'wiki_publish': {
                     const pagesInput = input.pages;
                     if (!pagesInput || !Array.isArray(pagesInput)) {
@@ -1696,7 +1904,15 @@ class GatewayToolExecutor {
                 case 'kagemusha_tasks': {
                     const { queryTasks } = await import('../connectors/kagemusha/query-tools.js');
                     const taskInput = input;
-                    return { success: true, tasks: queryTasks(taskInput) };
+                    // Vocabulary annotation (Stage-2 S2-T7): this source's status set
+                    // differs from the native ledger's - an empty result for an
+                    // out-of-vocabulary status (e.g. 'blocked') is a vocabulary miss,
+                    // not evidence the work disappeared. Observe-only.
+                    return {
+                        success: true,
+                        tasks: queryTasks(taskInput),
+                        vocabularyNote: "Statuses in this source: pending|in_progress|review|done|completed|cancelled|dismissed|active. 'blocked' does NOT exist here - if memory mentions blocked work, compare vocabularies instead of reporting a contradiction.",
+                    };
                 }
                 case 'kagemusha_messages': {
                     const { queryMessages } = await import('../connectors/kagemusha/query-tools.js');
@@ -2386,8 +2602,10 @@ class GatewayToolExecutor {
                 config.roles.sourceMapping[mapSource] = role;
             }
             await (0, config_manager_js_1.saveConfig)(config);
-            // Update RoleManager with new config
+            // Update RoleManager with new config (trust anchor included: telegram
+            // allowed_chats may have changed alongside roles in the saved config)
             this.roleManager.updateRolesConfig(config.roles);
+            this.roleManager.setTelegramTrust(config.telegram?.allowed_chats);
             return {
                 success: true,
                 message: `Role "${role}" updated successfully.${mapSource ? ` Source "${mapSource}" now maps to this role.` : ''}`,
@@ -2511,8 +2729,9 @@ class GatewayToolExecutor {
                     config.roles.definitions[role].maxTurns = maxTurns;
                 }
                 await (0, config_manager_js_1.saveConfig)(config);
-                // Update RoleManager with new config
+                // Update RoleManager with new config (trust anchor included)
                 this.roleManager.updateRolesConfig(config.roles);
+                this.roleManager.setTelegramTrust(config.telegram?.allowed_chats);
                 const changes = [`model: ${model}`];
                 if (maxTurns !== undefined)
                     changes.push(`maxTurns: ${maxTurns}`);
@@ -3000,95 +3219,39 @@ class GatewayToolExecutor {
             };
         }
     }
-    resolveCodeActSandboxRole(input, activeRole, registryNames) {
-        const allowedResolution = this.normalizeCodeActToolPatterns(input.allowedTools, 'allowedTools', registryNames);
-        if (allowedResolution.error) {
-            return { error: allowedResolution.error };
-        }
-        const blockedResolution = this.normalizeCodeActToolPatterns(input.blockedTools, 'blockedTools', registryNames);
-        if (blockedResolution.error) {
-            return { error: blockedResolution.error };
-        }
-        if (!activeRole && !allowedResolution.patterns && !blockedResolution.patterns) {
-            return {};
-        }
-        let effectiveToolNames = activeRole
-            ? registryNames.filter((toolName) => this.roleManager.isToolAllowed(activeRole, toolName))
-            : [...registryNames];
-        const allowedPatterns = allowedResolution.patterns;
-        if (allowedPatterns) {
-            effectiveToolNames = effectiveToolNames.filter((toolName) => this.matchesAnyCodeActToolPattern(toolName, allowedPatterns));
-        }
-        const blockedPatterns = blockedResolution.patterns;
-        if (blockedPatterns) {
-            effectiveToolNames = effectiveToolNames.filter((toolName) => !this.matchesAnyCodeActToolPattern(toolName, blockedPatterns));
-        }
-        return {
-            role: {
-                ...activeRole,
-                allowedTools: effectiveToolNames,
-                blockedTools: undefined,
-                allowedPaths: activeRole?.allowedPaths ?? [],
-                systemControl: activeRole?.systemControl ?? false,
-                sensitiveAccess: activeRole?.sensitiveAccess ?? false,
-            },
-        };
-    }
-    normalizeCodeActToolPatterns(value, fieldName, registryNames) {
-        if (value === undefined) {
-            return {};
-        }
-        if (!Array.isArray(value)) {
-            return { error: `${fieldName} must be an array of gateway tool names.` };
-        }
-        const patterns = [];
-        const seen = new Set();
-        for (const item of value) {
-            if (typeof item !== 'string' || item.trim().length === 0) {
-                return { error: `${fieldName} must contain non-empty gateway tool names.` };
-            }
-            const pattern = item.trim();
-            if (seen.has(pattern)) {
-                continue;
-            }
-            if (!this.isKnownCodeActToolPattern(pattern, registryNames)) {
-                return { error: `Unknown Code-Act tool pattern in ${fieldName}: ${pattern}` };
-            }
-            seen.add(pattern);
-            patterns.push(pattern);
-        }
-        return { patterns };
-    }
-    isKnownCodeActToolPattern(pattern, registryNames) {
-        return (pattern === '*' ||
-            registryNames.some((toolName) => this.matchesCodeActToolPattern(toolName, pattern)));
-    }
-    matchesAnyCodeActToolPattern(toolName, patterns) {
-        return patterns.some((pattern) => this.matchesCodeActToolPattern(toolName, pattern));
-    }
-    matchesCodeActToolPattern(toolName, pattern) {
-        return this.roleManager.isToolAllowed({
-            allowedTools: [pattern],
-            allowedPaths: [],
-            systemControl: false,
-            sensitiveAccess: false,
-        }, toolName);
-    }
     async executeCodeAct(input) {
-        const { CodeActSandbox, HostBridge } = await import('./code-act/index.js');
+        const { CodeActSandbox, CodeActToolPolicyValidationError, HostBridge, projectCodeActToolPolicy, } = await import('./code-act/index.js');
         const sandbox = new CodeActSandbox();
-        const context = this.getActiveContext();
-        const tier = (context?.tier ?? 1);
-        const registryNames = HostBridge.getToolRegistry().map((meta) => meta.name);
-        const sandboxRole = this.resolveCodeActSandboxRole(input, context?.role, registryNames);
-        if (sandboxRole.error) {
+        const state = this.getExecutionState();
+        const contextTier = state.agentContext?.tier;
+        const tier = contextTier === undefined ? 1 : contextTier;
+        let policy;
+        try {
+            policy = projectCodeActToolPolicy({
+                tier,
+                role: state.agentContext?.role,
+                disallowedTools: state.disallowedGatewayTools,
+                requestedAllowedTools: input.allowedTools,
+                requestedBlockedTools: input.blockedTools,
+            });
+        }
+        catch (error) {
+            if (!(error instanceof CodeActToolPolicyValidationError)) {
+                throw error;
+            }
             return {
                 success: false,
-                error: sandboxRole.error,
+                error: error.message,
             };
         }
-        const bridge = new HostBridge(this, this.roleManager);
-        bridge.injectInto(sandbox, tier, sandboxRole.role);
+        const nestedExecutionContext = {
+            ...state,
+            agentContext: state.agentContext ?? undefined,
+            executionSurface: 'code_act',
+            parentToolName: 'code_act',
+        };
+        const bridge = new HostBridge(this, this.roleManager, nestedExecutionContext);
+        bridge.injectInto(sandbox, policy.names);
         const result = await sandbox.execute(input.code);
         return {
             success: result.success,
@@ -3265,6 +3428,7 @@ class GatewayToolExecutor {
                 envelope: ctx.envelope,
                 modelRunId: ctx.modelRunId ?? null,
                 input,
+                signal: ctx.signal,
             });
             return {
                 success: true,