@jungjaehoon/mama-os 0.32.0 → 0.32.1

package/dist/cli/commands/start.js

@@ -73,6 +73,7 @@ const gateway_tool_executor_js_1 = require("../../agent/gateway-tool-executor.js
 const context_compile_service_js_1 = require("../../agent/context-compile-service.js");
 const read_js_1 = require("../../evidence/read.js");
 const tool_registry_js_1 = require("../../agent/tool-registry.js");
+const gateway_tool_catalog_js_1 = require("../../agent/gateway-tool-catalog.js");
 const tool_policy_js_1 = require("../../agent/code-act/tool-policy.js");
 const run_context_registry_js_1 = require("../../agent/code-act/run-context-registry.js");
 const index_js_2 = require("../../gateways/index.js");
@@ -100,6 +101,9 @@ const api_routes_init_js_1 = require("../runtime/api-routes-init.js");
 const server_start_js_1 = require("../runtime/server-start.js");
 const shutdown_js_1 = require("../runtime/shutdown.js");
 const envelope_bootstrap_js_1 = require("../runtime/envelope-bootstrap.js");
+const config_loader_js_1 = require("../../connectors/config-loader.js");
+const connector_bootstrap_js_1 = require("../runtime/connector-bootstrap.js");
+const private_connector_policy_js_1 = require("../../connectors/private-connector-policy.js");
 const message_router_config_js_1 = require("../runtime/message-router-config.js");
 const reactive_config_js_1 = require("../../envelope/reactive-config.js");
 const scope_context_js_1 = require("../../memory/scope-context.js");
@@ -109,6 +113,7 @@ const node_crypto_1 = require("node:crypto");
 const debugLogger = __importStar(require("@jungjaehoon/mama-core/debug-logger"));
 const mama_core_1 = require("@jungjaehoon/mama-core");
 const report_run_js_1 = require("../../operator/report-run.js");
+const report_carry_js_1 = require("../../operator/report-carry.js");
 const console_brief_js_1 = require("../../operator/console-brief.js");
 const task_ledger_js_1 = require("../../operator/task-ledger.js");
 const conductor_inbox_js_1 = require("../../operator/conductor-inbox.js");
@@ -125,6 +130,11 @@ const workorder_consumer_js_1 = require("../../operator/workorder-consumer.js");
 const { DebugLogger } = debugLogger;
 const codeActLogger = new DebugLogger('CodeAct');
 const temporalLogger = new DebugLogger('TemporalReconcile');
+const DISABLED_PRIVATE_CONNECTOR_POLICY = (0, private_connector_policy_js_1.resolvePrivateConnectorPolicy)({
+    ok: true,
+    config: {},
+    enabledNames: [],
+});
 function requireRuntimeBackend(value) {
     if (value === 'claude' || value === 'codex') {
         return value;
@@ -343,15 +353,19 @@ function causeEventIdsFromPayload(payload) {
 }
 function workOrderEnvelopeScope(input) {
     const isTemporal = input.workKind === 'temporal';
+    const surface = (0, private_connector_policy_js_1.resolveWorkOrderPrivateSurface)(input.workKind);
+    const candidateConnectors = isTemporal
+        ? input.temporalBinding
+            ? [input.temporalBinding.connector]
+            : []
+        : input.laneConnectors;
     return {
         project_refs: [{ kind: 'project', id: input.projectId }],
         // A temporal run reads its task's connector or nothing. Every other lane keeps the
         // connectors it was configured with.
-        raw_connectors: isTemporal
-            ? input.temporalBinding
-                ? [input.temporalBinding.connector]
-                : []
-            : input.laneConnectors,
+        raw_connectors: [
+            ...input.privateConnectorPolicy.projectRawConnectors(surface, candidateConnectors),
+        ],
         memory_scopes: [
             ...(0, scope_context_js_1.deriveMemoryScopes)({
                 source: 'operator',
@@ -410,13 +424,11 @@ exports.WORKORDER_TOOL_POLICIES = {
             'changes_read',
             'context_compile',
             'contract_no_update',
-            'kagemusha_entities',
-            'kagemusha_messages',
-            'kagemusha_overview',
-            'kagemusha_tasks',
             'mama_search',
             'report_publish',
             'task_create',
+            'task_external_bind',
+            'task_lifecycle_reconcile',
             'task_list',
             'task_update',
             'trello_card',
@@ -430,23 +442,13 @@ exports.WORKORDER_TOOL_POLICIES = {
     },
     'memory-curation': {
         roleName: 'workorder-memory-curation',
-        allowedTools: [
-            'agent_notices',
-            'kagemusha_entities',
-            'kagemusha_messages',
-            'mama_save',
-            'mama_search',
-        ],
+        allowedTools: ['agent_notices', 'mama_save', 'mama_search'],
     },
     temporal: {
         roleName: 'workorder-temporal',
         allowedTools: [
             'agent_notices',
             'context_compile',
-            'kagemusha_entities',
-            'kagemusha_messages',
-            'kagemusha_overview',
-            'kagemusha_tasks',
             'schedule_upcoming',
             'task_list',
             'task_temporal_reconcile',
@@ -484,10 +486,6 @@ exports.OPERATOR_REPORT_TOOL_POLICY = {
         // answer that was to re-read current state and infer the delta, which is how a
         // report ends up restating the board instead of naming the change.
         'changes_read',
-        'kagemusha_entities',
-        'kagemusha_messages',
-        'kagemusha_overview',
-        'kagemusha_tasks',
         'mama_provenance',
         'mama_recall',
         'mama_save',
@@ -499,6 +497,28 @@ exports.OPERATOR_REPORT_TOOL_POLICY = {
         'trello_kanban',
     ],
 };
+function requirePrivateConnectorPolicy(privateConnectorPolicy) {
+    if (!privateConnectorPolicy) {
+        throw new Error('privateConnectorPolicy is required');
+    }
+    return privateConnectorPolicy;
+}
+function buildProjectedLaneRole(surface, allowedTools, privateConnectorPolicy) {
+    return privateConnectorPolicy.projectRole(surface, {
+        allowedTools: [...allowedTools],
+        blockedTools: [],
+        allowedPaths: [],
+        systemControl: false,
+        sensitiveAccess: false,
+    });
+}
+function buildProjectedLanePrompt(innerTools, surface, privateConnectorPolicy) {
+    return (0, gateway_tool_catalog_js_1.buildGatewayToolCatalog)({
+        surface,
+        allowedTools: innerTools,
+        privateConnectorPolicy,
+    }).prompt;
+}
 /**
  * The conductor's grant (S1). Reads and judgment surfaces plus the ONE write
  * family the spec's center names: committing work orders and board cards. No
@@ -520,7 +540,7 @@ exports.CONDUCTOR_TOOL_POLICY = {
     ],
 };
 /** Mirrors buildOperatorReportAgentPolicy - same shape, conductor grant. */
-function buildConductorAgentPolicy(model, backend) {
+function buildConductorAgentPolicy(model, backend, privateConnectorPolicy) {
     const blockedTools = [];
     const innerTools = uniqueToolList(exports.CONDUCTOR_TOOL_POLICY.allowedTools);
     const allowedTools = uniqueToolList([...innerTools]);
@@ -547,7 +567,15 @@ function buildConductorAgentPolicy(model, backend) {
         tier: 2,
         backend,
     };
-    return { agentContext, gatewayToolsPrompt: tool_registry_js_1.ToolRegistry.generatePrompt(innerTools) };
+    return {
+        agentContext,
+        gatewayToolsPrompt: (0, gateway_tool_catalog_js_1.buildGatewayToolCatalog)({
+            surface: 'multi-agent-generic',
+            allowedTools: innerTools,
+            privateConnectorPolicy,
+        }).prompt,
+        briefProjectionPolicy: DISABLED_PRIVATE_CONNECTOR_POLICY,
+    };
 }
 /**
  * Merge + validate the conductor config at boot. No-fallback: a malformed
@@ -581,22 +609,18 @@ function resolveConductorConfig(config) {
  * logs "executed NO gateway gather tools" while still being delivered. Mirrors
  * buildWorkOrderAgentPolicy so both operator job families get their permissions the same way.
  */
-function buildOperatorReportAgentPolicy(model, backend) {
-    const blockedTools = [];
-    const innerTools = uniqueToolList(exports.OPERATOR_REPORT_TOOL_POLICY.allowedTools);
+function buildOperatorReportAgentPolicy(model, backend, privateConnectorPolicy) {
+    const requiredPrivatePolicy = requirePrivateConnectorPolicy(privateConnectorPolicy);
+    const surface = 'operator-report';
+    const projectedRole = buildProjectedLaneRole(surface, exports.OPERATOR_REPORT_TOOL_POLICY.allowedTools, requiredPrivatePolicy);
+    const blockedTools = [...(projectedRole.blockedTools ?? [])];
+    const innerTools = uniqueToolList(projectedRole.allowedTools);
     const allowedTools = uniqueToolList(['code_act', ...innerTools]);
     const agentContext = {
         source: 'operator',
         platform: 'cli',
         roleName: exports.OPERATOR_REPORT_TOOL_POLICY.roleName,
-        role: {
-            allowedTools,
-            blockedTools,
-            allowedPaths: [],
-            systemControl: false,
-            sensitiveAccess: false,
-            model,
-        },
+        role: { ...projectedRole, allowedTools, blockedTools, model },
         session: {
             sessionId: report_run_js_1.OPERATOR_REPORT_SESSION_KEY,
             channelId: 'report',
@@ -609,28 +633,34 @@ function buildOperatorReportAgentPolicy(model, backend) {
         tier: 2,
         backend,
     };
-    return { agentContext, gatewayToolsPrompt: tool_registry_js_1.ToolRegistry.generatePrompt(innerTools) };
+    return {
+        agentContext,
+        gatewayToolsPrompt: buildProjectedLanePrompt(innerTools, surface, requiredPrivatePolicy),
+        briefProjectionPolicy: requiredPrivatePolicy,
+    };
 }
-function buildWorkOrderAgentPolicy(kind, model, backend) {
+function buildWorkOrderAgentPolicy(kind, model, backend, privateConnectorPolicy, rawConnectorScope) {
+    const requiredPrivatePolicy = requirePrivateConnectorPolicy(privateConnectorPolicy);
+    if (!rawConnectorScope) {
+        throw new Error('rawConnectorScope is required');
+    }
     const policy = exports.WORKORDER_TOOL_POLICIES[kind];
     if (!policy) {
         throw new Error(`Missing built-in workorder tool policy for '${kind}'`);
     }
-    const blockedTools = [];
-    const innerTools = uniqueToolList(policy.allowedTools);
+    const surface = (0, private_connector_policy_js_1.resolveWorkOrderPrivateSurface)(kind);
+    const scopedSurface = requiredPrivatePolicy.enabledPrivateConnectors.some((name) => rawConnectorScope.includes(name))
+        ? surface
+        : 'multi-agent-generic';
+    const projectedRole = buildProjectedLaneRole(scopedSurface, policy.allowedTools, requiredPrivatePolicy);
+    const blockedTools = [...(projectedRole.blockedTools ?? [])];
+    const innerTools = uniqueToolList(projectedRole.allowedTools);
     const allowedTools = uniqueToolList(['code_act', ...innerTools]);
     const agentContext = {
         source: 'operator',
         platform: 'cli',
         roleName: policy.roleName,
-        role: {
-            allowedTools,
-            blockedTools,
-            allowedPaths: [],
-            systemControl: false,
-            sensitiveAccess: false,
-            model,
-        },
+        role: { ...projectedRole, allowedTools, blockedTools, model },
         session: {
             sessionId: `operator:worker:${kind}`,
             channelId: `worker:${kind}`,
@@ -643,7 +673,10 @@ function buildWorkOrderAgentPolicy(kind, model, backend) {
     };
     return {
         agentContext,
-        gatewayToolsPrompt: tool_registry_js_1.ToolRegistry.generatePrompt(innerTools),
+        gatewayToolsPrompt: buildProjectedLanePrompt(innerTools, scopedSurface, requiredPrivatePolicy),
+        briefProjectionPolicy: scopedSurface === 'multi-agent-generic'
+            ? DISABLED_PRIVATE_CONNECTOR_POLICY
+            : requiredPrivatePolicy,
     };
 }
 function bindCodeActParentModelRun(adapter, executionContext, options) {
@@ -821,8 +854,9 @@ async function runAgentLoop(config, options = {}) {
     // (workorders are the only run path since v0.28.0).
     const temporalStartup = (0, temporal_runtime_js_1.preflightTemporalStartup)(process.env);
     const runtimeBackend = requireRuntimeBackend(config.agent.backend);
+    const { connectorConfigLoadResult, privateConnectorPolicy } = (0, connector_bootstrap_js_1.resolveRuntimeConnectorBootstrap)((0, config_loader_js_1.loadConnectorConfig)());
     const temporalPolicy = temporalStartup.temporalFlag === 'on'
-        ? buildWorkOrderAgentPolicy('temporal', config.agent.model, runtimeBackend)
+        ? buildWorkOrderAgentPolicy('temporal', config.agent.model, runtimeBackend, privateConnectorPolicy, [])
         : null;
     const temporalEffectiveTools = temporalPolicy
         ? (0, tool_policy_js_1.projectCodeActToolPolicy)({
@@ -867,7 +901,7 @@ async function runAgentLoop(config, options = {}) {
     process.env.MAMA_WORKSPACE = workspaceRoot;
     // Initialize channel history with SQLite persistence (Sprint 3 F5)
     (0, index_js_2.initChannelHistory)(db);
-    const envelopeBootstrap = (0, envelope_bootstrap_js_1.buildRuntimeEnvelopeBootstrap)(db, config, process.env);
+    const envelopeBootstrap = (0, envelope_bootstrap_js_1.buildRuntimeEnvelopeBootstrap)(db, config, process.env, connectorConfigLoadResult);
     const mamaDbPath = (0, config_manager_js_1.expandPath)(config.database.path);
     const toolExecutor = new gateway_tool_executor_js_1.GatewayToolExecutor({
         mamaDbPath: mamaDbPath,
@@ -875,6 +909,7 @@ async function runAgentLoop(config, options = {}) {
         rolesConfig: config.roles, // Pass roles from config.yaml
         envelopeIssuanceMode: envelopeBootstrap.metadata.issuance,
         metricsStore,
+        privateConnectorPolicy,
     });
     process.env.MAMA_BACKEND = runtimeBackend;
     const agentLoopBackend = runtimeBackend;
@@ -903,7 +938,7 @@ async function runAgentLoop(config, options = {}) {
     toolExecutor.setContextCompileService(contextCompileService);
     agentLoop.setContextCompileService(contextCompileService);
     // ── Phase 4: Memory Agent + MessageRouter ─────────────────────────────────
-    const messageRouter = new index_js_2.MessageRouter(sessionStore, agentLoopClient, mamaApiClient, (0, message_router_config_js_1.resolveMessageRouterConfig)(config, runtimeBackend), envelopeBootstrap.envelopeConfig, envelopeBootstrap.envelopeAuthority);
+    const messageRouter = new index_js_2.MessageRouter(sessionStore, agentLoopClient, mamaApiClient, (0, message_router_config_js_1.resolveMessageRouterConfig)(config, runtimeBackend), envelopeBootstrap.envelopeConfig, envelopeBootstrap.envelopeAuthority, { privateConnectorPolicy, reportCarry: new report_carry_js_1.FileReportCarryStore() });
     messageRouter.setSessionsDb(db);
     // validationService wired after creation (Phase 5 below)
     const { memoryAgentLoop } = await (0, memory_agent_init_js_1.initMemoryAgent)(oauthManager, config, mamaApi, mamaApiClient, messageRouter, agentLoopBackend, toolExecutor);
@@ -918,7 +953,7 @@ async function runAgentLoop(config, options = {}) {
         sessionsDb: db,
         uiCommandQueue,
     };
-    let codeActRawConnectors = [];
+    const codeActRawConnectors = resolveCodeActRawConnectors(connectorConfigLoadResult.enabledNames);
     // Wire uiCommandQueue into messageRouter for page context awareness
     messageRouter.setUICommandQueue(uiCommandQueue);
     // Wire sessionsDb into gateway tool executor
@@ -929,13 +964,16 @@ async function runAgentLoop(config, options = {}) {
     const executeLegacyCodeAct = async (code, codeActContext) => {
         const { CodeActSandbox, HostBridge } = await import('../../agent/code-act/index.js');
         const sandbox = new CodeActSandbox();
-        const resolvedCodeActPolicy = resolveCodeActAgentPolicy(codeActContext, config.multi_agent?.agents, config.multi_agent?.default_agent || 'conductor');
+        const legacyRequestContext = codeActContext
+            ? { ...codeActContext, agentId: undefined }
+            : undefined;
+        const resolvedCodeActPolicy = resolveCodeActAgentPolicy(legacyRequestContext, config.multi_agent?.agents, config.multi_agent?.default_agent || 'conductor');
         if (resolvedCodeActPolicy.error) {
             return { success: false, error: resolvedCodeActPolicy.error };
         }
         const codeActAgentId = resolvedCodeActPolicy.agentId;
         const codeActPolicy = resolvedCodeActPolicy.policy ?? {};
-        const codeActRole = buildCodeActRole(codeActPolicy);
+        const codeActRole = privateConnectorPolicy.projectRole('legacy-unbound', buildCodeActRole(codeActPolicy));
         const codeActReadOnly = isTruthyEnvValue(process.env.MAMA_CODE_ACT_READ_ONLY);
         const codeActTier = codeActReadOnly ? 3 : 2;
         const instanceId = (0, node_crypto_1.randomUUID)();
@@ -958,7 +996,9 @@ async function runAgentLoop(config, options = {}) {
                 trigger_context: { user_text: '<api-code-act invocation>' },
                 scope: {
                     project_refs: [projectRef],
-                    raw_connectors: codeActRawConnectors,
+                    raw_connectors: [
+                        ...privateConnectorPolicy.projectRawConnectors('legacy-unbound', codeActRawConnectors),
+                    ],
                     memory_scopes: memoryScopes,
                     allowed_destinations: [],
                 },
@@ -1172,6 +1212,7 @@ async function runAgentLoop(config, options = {}) {
         const pm = new AgentProcessManager(fallbackMultiAgentConfig, buildSystemAgentProcessDefaults(config), {
             backend: runtimeBackend,
             model: config.agent.model,
+            privateConnectorPolicy,
         });
         toolExecutor.setAgentProcessManager(pm);
         agentLoop.setAgentProcessManager(pm);
@@ -1332,15 +1373,35 @@ async function runAgentLoop(config, options = {}) {
             noticeOwner: (summary) => messageRouter.enqueueOperatorNotice(summary),
             opsAlarm,
             runOptionsFor: async (wo) => {
+                // Resolve the run's raw binding before constructing either backend's
+                // role/catalog. The catalog and execution envelope must use the same
+                // projection so an unbound or non-private run never advertises private
+                // connector tools it cannot execute.
+                const workOrderBatch = causeEventIdsFromPayload(wo.payload);
+                let temporalContext;
+                let temporalBinding = null;
+                if (wo.workKind === 'temporal') {
+                    temporalContext = (0, temporal_worker_js_1.buildTemporalWorkerContext)(taskLedger, wo);
+                    temporalBinding = temporalTaskBinding(taskLedger, temporalContext.taskId);
+                }
+                const projectId = (0, reactive_config_js_1.resolveReactiveProjectRoot)(config, process.env);
+                const workOrderScope = workOrderEnvelopeScope({
+                    workKind: wo.workKind,
+                    projectId,
+                    laneConnectors: codeActRawConnectors,
+                    temporalBinding,
+                    privateConnectorPolicy,
+                });
                 // Worker prompt selects the provider's supported tool path: Claude's
                 // text gateway or Codex's injected native host tools. Both avoid the
                 // spawn-default code-act path, where per-run envelope/capture overrides
                 // cannot reach (shadow-gate §8.2).
                 const { buildWorkerSystemPrompt } = await import('../../operator/worker-run.js');
-                const workOrderPolicy = buildWorkOrderAgentPolicy(wo.workKind, config.agent.model, runtimeBackend);
+                const workOrderPolicy = buildWorkOrderAgentPolicy(wo.workKind, config.agent.model, runtimeBackend, privateConnectorPolicy, workOrderScope.raw_connectors);
                 const runOptions = attachWorkOrderAttemptContext({
                     systemPrompt: buildWorkerSystemPrompt(workOrderPolicy.gatewayToolsPrompt, runtimeBackend, wo.workKind),
                     agentContext: workOrderPolicy.agentContext,
+                    workOrderBriefProjectionPolicy: workOrderPolicy.briefProjectionPolicy,
                 }, wo.id);
                 // A temporal run is bound to ONE task on ONE channel, and the packet check
                 // (temporalPacketRawSourcesWithinBoundSource) enforces exactly that: every raw ref
@@ -1359,15 +1420,11 @@ async function runAgentLoop(config, options = {}) {
                 // durable change the run produces rest on it WITHOUT the agent restating anything -
                 // the system knew the batch before the run began. This is the whole difference
                 // between a bounded run and an unbounded one.
-                const workOrderBatch = causeEventIdsFromPayload(wo.payload);
                 if (workOrderBatch.length > 0) {
                     runOptions.causeEventIds = workOrderBatch;
                 }
-                let temporalBinding = null;
-                if (wo.workKind === 'temporal') {
-                    const temporalContext = (0, temporal_worker_js_1.buildTemporalWorkerContext)(taskLedger, wo);
+                if (temporalContext) {
                     runOptions.temporalWorkContext = temporalContext;
-                    temporalBinding = temporalTaskBinding(taskLedger, temporalContext.taskId);
                 }
                 // Per-run scoped envelope (live-gate finding, 2026-07-18): gateway
                 // 'model_tool' executions are envelope-gated, and workerRun is a new
@@ -1376,7 +1433,6 @@ async function runAgentLoop(config, options = {}) {
                 // lane's issuance (createPersonaReportAsk wiring below); issuance
                 // failure rejects -> failWorkOrder (no envelope-less fallback run).
                 if (envelopeBootstrap.envelopeAuthority && envelopeBootstrap.metadata.issuance !== 'off') {
-                    const projectId = (0, reactive_config_js_1.resolveReactiveProjectRoot)(config, process.env);
                     const wallSeconds = Math.min(Math.max(Number(process.env.MAMA_REPORT_WALL_SECONDS) || 900, 60), 1800);
                     runOptions.envelope = await envelopeBootstrap.envelopeAuthority.buildAndPersist({
                         agent_id: `workorder-${wo.workKind}`,
@@ -1386,16 +1442,8 @@ async function runAgentLoop(config, options = {}) {
                         source: 'watch',
                         channel_id: `worker:${wo.workKind}`,
                         trigger_context: { user_text: `<stage2 workorder ${wo.workKind}#${wo.id}>` },
-                        scope: (() => {
-                            const scope = workOrderEnvelopeScope({
-                                workKind: wo.workKind,
-                                projectId,
-                                laneConnectors: codeActRawConnectors,
-                                temporalBinding,
-                            });
-                            // Identity scopes only - the read mirror is enforcement-layer.
-                            return scope;
-                        })(),
+                        // Identity scopes only - the read mirror is enforcement-layer.
+                        scope: workOrderScope,
                         tier: 2,
                         budget: { wall_seconds: wallSeconds },
                         expires_at: new Date(Date.now() + wallSeconds * 1000 + 30_000).toISOString(),
@@ -1490,8 +1538,10 @@ async function runAgentLoop(config, options = {}) {
         log: (line) => temporalLogger.info(line),
     });
     temporalRuntime = temporalAssembly.runtime;
-    const { rawStoreForApi, enabledConnectorNames, connectorSchedulerStop } = await (0, connector_init_js_1.initConnectors)(connectorExtractionFn, { nudge: () => triggerLoopNudge.current?.() });
-    codeActRawConnectors = resolveCodeActRawConnectors(enabledConnectorNames);
+    const { rawStoreForApi, enabledConnectorNames, connectorSchedulerStop } = await (0, connector_init_js_1.initConnectors)(connectorExtractionFn, {
+        connectorConfigLoadResult,
+        nudge: () => triggerLoopNudge.current?.(),
+    });
     // Inject rawStore into tool executor for agent_test connector data access
     if (rawStoreForApi) {
         toolExecutor.setRawStore(rawStoreForApi);
@@ -1525,7 +1575,7 @@ async function runAgentLoop(config, options = {}) {
             const { createTriggerAgentRuntime } = await import('../../operator/trigger-author.js');
             const { reviewTriggerCLI } = await import('../../operator/trigger-review.js');
             const { ReportScheduler, FileReportScheduleStore, parseReportHours } = await import('../../operator/report-scheduler.js');
-            const { persistLastFullReport } = await import('../../operator/report-carry.js');
+            const { createTelegramReportCarryDelivery, createTelegramReportOutput } = await import('../../operator/report-carry-delivery.js');
             // Set when a report is composed, read when that same report is delivered. Safe
             // because ALL operator work serializes on the operator lane (SOURCE_GLOBAL_LANES),
             // so compose and deliver cannot interleave with another report - stated here
@@ -1542,10 +1592,14 @@ async function runAgentLoop(config, options = {}) {
             // Owner-report leg (M1.5): destination chat comes from env (~/.mama/start.sh),
             // never source. No chat configured or no telegram gateway -> loop stays read-only.
             const reportChatId = resolveOperatorReportChatId(process.env, config.telegram?.allowed_chats);
+            const persistReportCarry = reportChatId
+                ? createTelegramReportCarryDelivery({
+                    reportChatId,
+                    carryStore: new report_carry_js_1.FileReportCarryStore(),
+                })
+                : undefined;
             const reportOutput = reportChatId && telegramGateway
-                ? {
-                    send: (text, deliveryId) => telegramGateway.sendMessage(reportChatId, text, deliveryId ?? `operator-report:legacy:${(0, node_crypto_1.randomUUID)()}`),
-                }
+                ? createTelegramReportOutput({ reportChatId, telegramSender: telegramGateway })
                 : undefined;
             // Scheduled full-report leg (M2): local hours from env (~/.mama/start.sh), never source.
             // Empty/absent -> [] -> leg off. Requires the same telegram sink as the digest leg.
@@ -1610,7 +1664,9 @@ async function runAgentLoop(config, options = {}) {
                                     // read authority is bounded per tool by envelope/tool-connector-scope.ts
                                     // against the connectors granted here.
                                     project_refs: [{ kind: 'project', id: projectId }],
-                                    raw_connectors: codeActRawConnectors,
+                                    raw_connectors: [
+                                        ...privateConnectorPolicy.projectRawConnectors('operator-report', codeActRawConnectors),
+                                    ],
                                     memory_scopes: uniqueMemoryScopes((0, scope_context_js_1.deriveMemoryScopes)({ source: 'operator', channelId: 'report', projectId })),
                                     allowed_destinations: [],
                                 },
@@ -1621,6 +1677,7 @@ async function runAgentLoop(config, options = {}) {
                         }
                         : undefined,
                     run: async (prompt, envelope) => {
+                        const reportAgentPolicy = buildOperatorReportAgentPolicy(config.agent.model, runtimeBackend, privateConnectorPolicy);
                         const result = await agentLoop.runWithContent([{ type: 'text', text: prompt }], {
                             sessionKey: report_run_js_1.OPERATOR_REPORT_SESSION_KEY,
                             source: 'operator',
@@ -1630,8 +1687,8 @@ async function runAgentLoop(config, options = {}) {
                             // gather no matter what the prompt instructs (roleAllowsOuterCodeAct
                             // fails closed on an absent role - agent-loop.ts). Same built-in
                             // least-privilege treatment the Stage-2 workers get.
-                            agentContext: buildOperatorReportAgentPolicy(config.agent.model, runtimeBackend)
-                                .agentContext,
+                            agentContext: reportAgentPolicy.agentContext,
+                            gatewayToolsPrompt: reportAgentPolicy.gatewayToolsPrompt,
                             // Stateless report lane: each run starts on a fresh session so the
                             // continuous session no longer accumulates every run's gather dumps
                             // (measured 146s -> 521s growth over 3 days). Continuity comes from
@@ -1667,11 +1724,15 @@ async function runAgentLoop(config, options = {}) {
                 // Kagemusha dual output: the same scheduled run updates the /ui operator board
                 // slots via report_publish, then writes the plain-text owner report.
                 fullReportBoardLines: buildBoardPublishLines(),
-                // S1-T4 context carry: the delivered FULL report persists so the owner
-                // console references it per turn instead of fabricating status.
-                persistLastFullReport: (iso, text) => {
+                // TG-06: composition supplies provenance immediately to the prepared
+                // delivery; this callback receives that durable artifact only after send success.
+                fullReportProvenance: () => lastReportProvenance,
+                persistLastFullReport: (report) => {
                     (0, leg_cadence_js_1.getLegCadence)()?.beat('full-report');
-                    return persistLastFullReport(iso, text, lastReportProvenance);
+                    if (!persistReportCarry) {
+                        throw new Error('Cannot persist full report carry without a Telegram report chat');
+                    }
+                    persistReportCarry(report);
                 },
                 pendingReportStore: new FilePendingReportStore((0, config_manager_js_1.expandPath)('~/.mama/operator/pending-owner-reports.json'), (line) => console.error(line)),
                 config: {
@@ -1725,7 +1786,7 @@ async function runAgentLoop(config, options = {}) {
                     maxTurns: conductorConfig.maxTurns,
                     maxTokens: conductorConfig.maxTokens,
                 });
-                const conductorPolicy = buildConductorAgentPolicy(config.agent.model, runtimeBackend);
+                const conductorPolicy = buildConductorAgentPolicy(config.agent.model, runtimeBackend, privateConnectorPolicy);
                 // Per-run envelope, mirroring the report lane: without it every
                 // model_tool call dies 'envelope_missing' while the run resolves and
                 // acks the batch - zero work, green ledger (review F2).
@@ -1819,6 +1880,8 @@ async function runAgentLoop(config, options = {}) {
         envelopeMetadata: envelopeBootstrap.metadata,
         envelopeAuthority: envelopeBootstrap.envelopeAuthority,
         contextCompileService,
+        connectorConfigLoadResult,
+        privateConnectorPolicy,
     });
     channelDeltaSink.current = (channelKey, lines, eventIds) => eventBus.emit({ type: 'operator:channel-delta', channelKey, lines, eventIds });
     await (0, api_routes_init_js_1.registerApiRoutes)({
@@ -1834,6 +1897,10 @@ async function runAgentLoop(config, options = {}) {
         slackGateway,
         graphHandler,
         getAdapter,
+        privateConnectorPolicy,
+        rawConnectorScope: [
+            ...privateConnectorPolicy.projectRawConnectors('workorder-board', codeActRawConnectors),
+        ],
         sessionsDb: db,
         workOrderConsumer: workOrderConsumer ?? undefined,
     });