@lanes-sh/link 0.4.1 → 0.5.0

package/src/cli/commands/operate/serve.ts

@@ -1,5 +1,6 @@
 import { startEndpoint } from '#server/endpoint.ts';
 import { streamLogger } from '#server/logging.ts';
+import { repairOwnerLayer } from '../../config-repair.ts';
 import { announce, ok, print, style, warn } from '../../output.ts';
 import { staleNudge } from '../../release.ts';
 import { resolveProfile, type GlobalFlags } from '../../runtime.ts';
@@ -16,6 +17,26 @@ export async function start(
   const { resolution } = await resolveProfile(flags);
   announce(resolution);
 
+  // Before the bootstrap, and only here.
+  //
+  // This is the one command an existing install runs without being told to, so
+  // it is how a profile written before ADR-050 comes to have memory, tasks,
+  // assets, skills and the vault at all — `connect` and `deploy` repair too, but
+  // someone who is already set up may not run either for months. What it writes
+  // is the rows and rules a fresh profile is created with; a `deny` covering a
+  // surface is left alone, which is how one stays off.
+  //
+  // Not inside `startEndpoint`, which the container entrypoint also calls: a
+  // deployed revision holds `objectViewer` on `profiles/` (ADR-023) and must not
+  // be the thing that edits config. The repair belongs to the control plane
+  // (ADR-007), and this is the control plane.
+  //
+  // Scoped as the serving is: `--only` serves one profile, so it repairs one.
+  await repairOwnerLayer(
+    resolution.workspaceRoot,
+    flags.only ? [resolution.profile] : undefined,
+  );
+
   // The bootstrap itself lives in `endpoint.ts`, shared with the container
   // entrypoint. What stays here is what a terminal wants: the plan, printed as
   // it is applied, and the endpoint at the end.

package/src/cli/commands/owner/assets.ts

@@ -0,0 +1,132 @@
+import { readFile } from 'node:fs/promises';
+import { basename } from 'node:path';
+import { ConfigError } from '#profile';
+import { scopeNamespace } from '#dispatch';
+import { scopeBlobStore, type BlobStore } from '#stores/blobs';
+import { assetStorage } from '#providers/owner.ts';
+import { heading, ok, print, style, table } from '../../output.ts';
+import type { Runtime } from '../../runtime.ts';
+import {
+  agreed,
+  ownerConnection,
+  required,
+  withRuntime,
+  type OwnerFlags,
+} from './shared.ts';
+
+/** `lanes link assets` — files the owner wants kept. */
+
+export async function assetsList(flags: OwnerFlags): Promise<void> {
+  await withRuntime(flags, async (runtime) => {
+    const assets = await assetStorage.all(assetsStore(runtime, flags));
+
+    heading(`Assets (${assets.length})`);
+    if (assets.length === 0) {
+      print(style.dim('  none — keep one with: lanes link assets add <file>'));
+      return;
+    }
+
+    table(
+      assets.map((asset) => [
+        `  ${asset.name}`,
+        style.dim(asset.contentType),
+        style.dim(assetStorage.humanBytes(asset.bytes)),
+        style.dim(asset.modifiedAt.slice(0, 10)),
+      ]),
+    );
+  });
+}
+
+/**
+ * `lanes link assets add <file>` — a path on this machine.
+ *
+ * Only a path, where the capability takes five sources. The other four exist
+ * because the endpoint may not be on the caller's machine; a CLI is, by
+ * definition, already there, so a URL or a staged handle here would be
+ * ceremony over `curl -O`.
+ */
+export async function assetsAdd(path: string | undefined, flags: OwnerFlags): Promise<void> {
+  const from = required(path, 'lanes link assets add <file>');
+
+  let bytes: Uint8Array;
+  try {
+    bytes = new Uint8Array(await readFile(from));
+  } catch (failure) {
+    const code = (failure as { code?: string }).code;
+    if (code === 'ENOENT') throw new ConfigError(`No file at ${from}.`);
+    if (code === 'EISDIR') throw new ConfigError(`${from} is a directory, not a file.`);
+    throw new ConfigError(`Could not read ${from} — ${(failure as Error).message}`);
+  }
+
+  const name = flags.name ?? basename(from);
+  assetStorage.assertName(name);
+
+  await withRuntime(flags, async (runtime) => {
+    const store = assetsStore(runtime, flags);
+    const replaced = await store.has(name);
+
+    // Only when told. Left off, the store infers from the extension and writes no
+    // sidecar; `--content-type` is for the file whose name does not say what it
+    // is, which is the only case worth a `<name>.meta` beside it.
+    await store.put(name, bytes, flags.contentType ? { contentType: flags.contentType } : {});
+
+    print(
+      ok(
+        `${replaced ? 'replaced' : 'kept'} ${style.bold(name)} — ` +
+          `${assetStorage.humanBytes(bytes.byteLength)}, sha256 ${assetStorage.digest(bytes).slice(0, 12)}…`,
+      ),
+    );
+  });
+}
+
+/**
+ * `lanes link assets get <name>` — write the bytes to stdout.
+ *
+ * Bytes rather than a description, unlike the capability: this end of the pipe is
+ * a shell, so `lanes link assets get invoice.pdf > invoice.pdf` is the useful
+ * thing and there is no context window to protect. Refuses a terminal for the
+ * same reason `curl` warns about it — binary into a tty is a mess nobody wanted.
+ */
+export async function assetsGet(name: string | undefined, flags: OwnerFlags): Promise<void> {
+  const wanted = required(name, 'lanes link assets get <name> > <file>');
+
+  await withRuntime({ ...flags, raw: true }, async (runtime) => {
+    const store = assetsStore(runtime, flags);
+    const bytes = await store.get(wanted);
+    if (bytes === null) throw new ConfigError(`No asset "${wanted}" in this profile.`);
+
+    if (process.stdout.isTTY) {
+      throw new ConfigError(
+        `"${wanted}" would be written to your terminal. Redirect it:\n` +
+          `  lanes link assets get ${wanted} > ${wanted}`,
+      );
+    }
+
+    await Bun.write(Bun.stdout, bytes);
+  });
+}
+
+export async function assetsRemove(name: string | undefined, flags: OwnerFlags): Promise<void> {
+  const wanted = required(name, 'lanes link assets remove <name>');
+
+  await withRuntime(flags, async (runtime) => {
+    const store = assetsStore(runtime, flags);
+    const asset = await assetStorage.find(store, wanted);
+    if (!asset) throw new ConfigError(`No asset "${wanted}" in this profile.`);
+
+    print(`  ${style.bold(asset.name)}  ${assetStorage.describe(asset)}`);
+    if (!(await agreed(flags, 'Delete this file?'))) return;
+
+    await store.delete(wanted);
+    print(ok(`deleted ${style.bold(wanted)}`));
+  });
+}
+
+/**
+ * The blob namespace core would scope this provider to — see `tasks.ts` for why
+ * it is built from the same two functions rather than spelled as a path.
+ */
+export function assetsStore(runtime: Runtime, flags: OwnerFlags): BlobStore {
+  const connection = ownerConnection(runtime.config, 'assets', flags);
+  return scopeBlobStore(runtime.storage, scopeNamespace('assets', connection));
+}

package/src/cli/commands/owner/shared.ts

@@ -4,11 +4,11 @@ import { confirm } from '../../prompt.ts';
 import { openRuntime, type GlobalFlags, type Runtime } from '../../runtime.ts';
 
 /**
- * What `lanes link memory`, `lanes link skills` and `lanes link vault` all need: the flag shape, the
- * runtime wrapper, connection resolution, and the two prompts.
+ * What every `lanes link` command over the owner's own data needs: the flag
+ * shape, the runtime wrapper, connection resolution, and the two prompts.
  *
- * All four commands are the same shape — open a runtime, announce, act, close —
- * so the wrapper lives here rather than three times over.
+ * All of them are the same shape — open a runtime, announce, act, close — so the
+ * wrapper lives here rather than once per noun.
  */
 
 export interface OwnerFlags extends GlobalFlags {
@@ -18,6 +18,14 @@ export interface OwnerFlags extends GlobalFlags {
   readonly tag?: string | undefined;
   readonly description?: string | undefined;
   readonly file?: string | undefined;
+  /** `tasks`: which status to set, or to filter a listing by. */
+  readonly status?: string | undefined;
+  /** `tasks`: when it is due, as the owner would write it. Empty clears it. */
+  readonly due?: string | undefined;
+  /** `assets`: what to call the stored file, where the path's basename is wrong. */
+  readonly name?: string | undefined;
+  /** `assets`: for the file whose extension does not say what it is. */
+  readonly contentType?: string | undefined;
   /** Reveal a vault value on a terminal. */
   readonly show?: boolean | undefined;
   /** Print only the value, for `$(…)`. */
@@ -102,6 +110,22 @@ export async function readStdin(usage: string, what: string): Promise<string> {
   return text;
 }
 
+/**
+ * Read stdin where there may legitimately be nothing on it.
+ *
+ * `readStdin` refuses both a terminal and an empty pipe, which is right for
+ * `memory write` and `vault set` — a command whose whole subject arrived empty
+ * has been mis-invoked. It is wrong for `tasks add`, whose subject is the title
+ * on argv and whose notes are optional: refusing there made
+ * `lanes link tasks add "x"` fail in every non-interactive context — a script, a
+ * cron, a `< /dev/null` — while working by hand, which is the worst shape for a
+ * bug to have.
+ */
+export async function optionalStdin(): Promise<string> {
+  if (process.stdin.isTTY) return '';
+  return (await Bun.stdin.text()).replace(/\n$/, '');
+}
+
 /** Confirm a destructive action, unless `--yes` already answered. */
 export async function agreed(flags: OwnerFlags, question: string): Promise<boolean> {
   if (flags.yes) return true;

package/src/cli/commands/owner/tasks.ts

@@ -0,0 +1,194 @@
+import { ConfigError } from '#profile';
+import { scopeNamespace } from '#dispatch';
+import { scopeBlobStore, type BlobStore } from '#stores/blobs';
+import { ACTIVE_STATUSES, TASK_STATUSES, taskStorage, type TaskStatus } from '#providers/owner.ts';
+import { heading, ok, print, style, table } from '../../output.ts';
+import type { Runtime } from '../../runtime.ts';
+import {
+  agreed,
+  optionalStdin,
+  ownerConnection,
+  required,
+  withRuntime,
+  type OwnerFlags,
+} from './shared.ts';
+
+/** `lanes link tasks` — what the owner has to do. */
+
+export async function tasksList(flags: OwnerFlags): Promise<void> {
+  await withRuntime(flags, async (runtime) => {
+    const store = tasksStore(runtime, flags);
+
+    // The same default the `tasks.list` capability applies, and for the same
+    // reason: the question is what is outstanding, and a list that grows forever
+    // is one nobody reads. `--status all` is the escape hatch.
+    const wanted = statusFilter(flags.status);
+    const tasks = (await taskStorage.all(store)).filter(
+      (task) =>
+        (wanted === null || wanted.has(task.status)) && (!flags.tag || task.tags.includes(flags.tag)),
+    );
+
+    heading(`Tasks (${tasks.length}${wanted === null ? '' : ' outstanding'})`);
+    if (tasks.length === 0) {
+      print(style.dim('  none — add one with: lanes link tasks add <title>'));
+      return;
+    }
+
+    table(
+      tasks.map((task) => [
+        `  ${task.id}`,
+        task.status,
+        task.title,
+        task.due ? style.dim(`due ${task.due}`) : '',
+        task.tags.length > 0 ? style.dim(task.tags.join(', ')) : '',
+      ]),
+    );
+  });
+}
+
+export async function tasksGet(id: string | undefined, flags: OwnerFlags): Promise<void> {
+  const taskId = required(id, 'lanes link tasks get <id>');
+
+  await withRuntime(flags, async (runtime) => {
+    const task = await taskStorage.read(tasksStore(runtime, flags), taskId);
+    if (!task) throw new ConfigError(`No task "${taskId}" in this profile.`);
+
+    print('');
+    print(`  ${style.bold(task.title)}`);
+    print(style.dim(`  ${task.status}${task.due ? `  due ${task.due}` : ''}`));
+    if (task.tags.length > 0) print(style.dim(`  ${task.tags.join(', ')}`));
+    if (task.body.length > 0) {
+      print('');
+      print(task.body);
+    }
+  });
+}
+
+/**
+ * `lanes link tasks add <title>` — the title on argv, notes optional on stdin.
+ *
+ * Unlike `memory write`, the title is the argument and the body is optional: a
+ * task is usually one line, and demanding a heredoc to write "chase the invoice"
+ * would make the common case the awkward one. So `optionalStdin` rather than
+ * `readStdin` — see its docstring for what refusing an empty pipe here broke.
+ */
+export async function tasksAdd(title: string | undefined, flags: OwnerFlags): Promise<void> {
+  const given = required(title, 'lanes link tasks add <title>   (notes on stdin, optional)');
+  const notes = await optionalStdin();
+
+  await withRuntime(flags, async (runtime) => {
+    const store = tasksStore(runtime, flags);
+    const id = taskStorage.slugify(given);
+    const existing = await taskStorage.read(store, id);
+    const now = new Date().toISOString();
+
+    await taskStorage.write(store, {
+      id,
+      title: given,
+      status: assertStatus(flags.status) ?? 'open',
+      tags: flags.tag ? [flags.tag] : (existing?.tags ?? []),
+      ...(flags.due ? { due: flags.due } : {}),
+      createdAt: existing?.createdAt ?? now,
+      updatedAt: now,
+      body: notes,
+    });
+
+    print(ok(`${existing ? 'replaced' : 'added'} task ${style.bold(id)}`));
+  });
+}
+
+/**
+ * `lanes link tasks update <id> --status done`.
+ *
+ * Omitted flags leave their fields alone, which is what makes this the way to
+ * close a task rather than delete it: the record of having done it is the useful
+ * part, and `--status done` keeps everything else.
+ */
+export async function tasksUpdate(id: string | undefined, flags: OwnerFlags): Promise<void> {
+  const taskId = required(id, 'lanes link tasks update <id> --status <status>');
+
+  await withRuntime(flags, async (runtime) => {
+    const store = tasksStore(runtime, flags);
+    const existing = await taskStorage.read(store, taskId);
+    if (!existing) throw new ConfigError(`No task "${taskId}" in this profile.`);
+
+    const status = assertStatus(flags.status);
+    if (!status && !flags.title && !flags.due && !flags.tag) {
+      throw new ConfigError(
+        `Nothing to change. Pass --status, --title, --due or --tag.\n` +
+          `  statuses: ${TASK_STATUSES.join(', ')}`,
+      );
+    }
+
+    // `due` is taken off the existing record rather than spread and overwritten,
+    // because spreading cannot remove a key — the same trap the provider's
+    // `update` documents.
+    const { due: previous, ...rest } = existing;
+    const due = flags.due === '' ? undefined : (flags.due ?? previous);
+
+    await taskStorage.write(store, {
+      ...rest,
+      title: flags.title ?? existing.title,
+      status: status ?? existing.status,
+      tags: flags.tag ? [flags.tag] : existing.tags,
+      ...(due ? { due } : {}),
+      updatedAt: new Date().toISOString(),
+    });
+
+    print(ok(`updated task ${style.bold(taskId)} — now ${status ?? existing.status}`));
+  });
+}
+
+export async function tasksRemove(id: string | undefined, flags: OwnerFlags): Promise<void> {
+  const taskId = required(id, 'lanes link tasks remove <id>');
+
+  await withRuntime(flags, async (runtime) => {
+    const store = tasksStore(runtime, flags);
+    const task = await taskStorage.read(store, taskId);
+    if (!task) throw new ConfigError(`No task "${taskId}" in this profile.`);
+
+    print(`  ${style.bold(task.id)}  ${task.status}  ${task.title}`);
+    print(
+      style.dim('  deleting loses the record that it happened — "update --status done" keeps it'),
+    );
+    if (!(await agreed(flags, 'Delete this task?'))) return;
+
+    await store.delete(taskStorage.key(taskId));
+    print(ok(`deleted task ${style.bold(taskId)}`));
+  });
+}
+
+/**
+ * `--status` as a filter: a named one, `all`, or the outstanding set by default.
+ *
+ * `null` means every status. Returning a set rather than a predicate so the
+ * heading can say whether it narrowed.
+ */
+function statusFilter(raw: string | undefined): Set<TaskStatus> | null {
+  if (raw === 'all') return null;
+  if (raw === undefined) return new Set(ACTIVE_STATUSES);
+  return new Set([assertStatus(raw)!]);
+}
+
+function assertStatus(raw: string | undefined): TaskStatus | undefined {
+  if (raw === undefined) return undefined;
+  if (!(TASK_STATUSES as readonly string[]).includes(raw)) {
+    throw new ConfigError(
+      `Unknown status "${raw}". One of: ${TASK_STATUSES.join(', ')}` +
+        '\n  (or "all", when filtering a listing)',
+    );
+  }
+  return raw as TaskStatus;
+}
+
+/**
+ * The blob namespace core would scope this provider to.
+ *
+ * Built from `scopeNamespace` and `scopeBlobStore` — the same two functions
+ * `buildProviderContext` uses — rather than from a path spelled out again, so the
+ * CLI cannot address a different directory from the provider.
+ */
+export function tasksStore(runtime: Runtime, flags: OwnerFlags): BlobStore {
+  const connection = ownerConnection(runtime.config, 'tasks', flags);
+  return scopeBlobStore(runtime.storage, scopeNamespace('tasks', connection));
+}

package/src/cli/commands/owner.ts

@@ -1,5 +1,6 @@
 /**
- * `lanes link memory`, `lanes link skills`, `lanes link vault` — the owner layer's control plane.
+ * `lanes link memory`, `tasks`, `assets`, `skills`, `vault` — the owner layer's
+ * control plane.
  *
  * The layer shipped in M4 with no CLI at all, so the two stores holding the
  * owner's *own* data were reachable only by an agent, and the one thing that
@@ -20,9 +21,9 @@
  * both sides now: from here because this is the owner's control plane, and over
  * MCP because ADR-014 §1 decided a policy-gated grant beats a missing path.
  *
- * One noun per file — `memory.ts`, `skills.ts`, `vault.ts` — over the shape all
- * three share in `shared.ts`: the flag type, the open-announce-act-close
- * wrapper, connection resolution, and the two prompts.
+ * One noun per file — `memory.ts`, `tasks.ts`, `assets.ts`, `skills.ts`,
+ * `vault.ts` — over the shape they all share in `shared.ts`: the flag type, the
+ * open-announce-act-close wrapper, connection resolution, and the two prompts.
  */
 
 export {
@@ -33,6 +34,10 @@ export {
   memoryWrite,
 } from './owner/memory.ts';
 
+export { tasksAdd, tasksGet, tasksList, tasksRemove, tasksUpdate } from './owner/tasks.ts';
+
+export { assetsAdd, assetsGet, assetsList, assetsRemove } from './owner/assets.ts';
+
 export { skillsAdd, skillsList, skillsRemove, skillsShow } from './owner/skills.ts';
 
 export {

package/src/cli/config-edit.ts

@@ -264,13 +264,27 @@ oauth_apps: {}
 # reports — an address, a workspace — so this list says whose data is reachable
 # without having to look anything up.
 #
-# "setup" holds no account. It lets an agent see what is connected here and what
-# connecting something else would take, so it can tell you the command to run
-# rather than guess at one. It is read-only: nothing it offers writes config,
-# stores a credential, signs in, or changes what is permitted — those stay in
-# this CLI (ADR-007, ADR-019). Delete this entry and the allow line below to
-# remove it entirely.
+# The six below hold no account, and that is why they are here already: they
+# reach your own material rather than anybody's API, so there was never anything
+# for a connect step to authorise (ADR-050). What each one is:
+#
+#   memory   what you want remembered between sessions
+#   tasks    what you have to do, each with a status
+#   assets   files you want kept, by name
+#   skills   procedures you have written, handed to an agent as instructions
+#   vault    passwords and API keys, released one at a time
+#   setup    what is connected here, and what connecting more would take
+#
+# Nothing is stored in any of them until you or an agent puts something there,
+# and none of them can read an account. To switch one off, deny it below —
+# deleting the entry no longer works, because the next connect or deploy puts it
+# back.
 connections:
+  - { id: main, provider: memory, account: Memory }
+  - { id: main, provider: tasks, account: Tasks }
+  - { id: main, provider: assets, account: Assets }
+  - { id: main, provider: skills, account: Skills }
+  - { id: main, provider: vault, account: Vault }
   - { id: main, provider: setup, account: Setup }
 
 # Only what is listed here is reachable, and an empty policy grants nothing.
@@ -284,8 +298,20 @@ connections:
 #   allow: ['*']                  everything, which is what connect writes
 #   allow: [notion.*, gmail.*]    two providers
 #   deny:  [gmail.send_message]   a deny always beats an allow
+#
+# The rules below grant each of the six its whole namespace, writes included —
+# the same thing "connect memory" wrote when it was a command you had to run.
+# Narrowing is one line, and these are the three worth knowing:
+#
+#   deny: [memory.write]          memory becomes read-only
+#   deny: [skills.manage.*]       skills can be invoked but not authored
+#   deny: [vault.put, vault.remove]   nothing new can be stored
+#
+# A vault read is not granted by "vault.*" alone: each stored item is its own
+# "vault.get.<id>" capability and only appears after a restart, so a write can
+# never hand itself a read (ADR-012).
 policy:
-  allow: [setup.*]
+  allow: [memory.*, tasks.*, assets.*, skills.*, vault.*, setup.*]
   deny: []
 `;
 }

package/src/cli/config-repair.ts

@@ -1,4 +1,6 @@
-import type { ConfigDocument } from './config-edit.ts';
+import { listProfiles } from '#profile';
+import { ConfigDocument } from './config-edit.ts';
+import { ok, print, style, warn } from './output.ts';
 
 /**
  * Giving a profile a reserved provider it is missing, without undoing a choice.
@@ -9,22 +11,49 @@ import type { ConfigDocument } from './config-edit.ts';
  * was already there: that file knows how to *edit* YAML safely, and this one
  * knows what a reserved provider needs to be reachable at all.
  *
- * Two providers hold no account and are therefore invisible without a
- * connection row nobody would think to write: `setup`, which describes what is
- * connected, and `identity`, which says who the owner is. Both are repaired the
+ * The owner layer holds no account and is therefore invisible without a
+ * connection row nobody would think to write. Every one of them is repaired the
  * same way and the rules below are subtle enough that a second copy would drift
  * — which is the whole reason this is one function taking a provider id rather
- * than two that look alike.
+ * than several that look alike.
  */
 
 /** The reserved provider ids that hold no account, and the label each row carries. */
 const RESERVED_SURFACES = {
+  memory: 'Memory',
+  tasks: 'Tasks',
+  assets: 'Assets',
+  skills: 'Skills',
+  vault: 'Vault',
   setup: 'Setup',
   identity: 'Identity',
 } as const;
 
 type ReservedSurface = keyof typeof RESERVED_SURFACES;
 
+/**
+ * The ones a profile gets whether it asked or not.
+ *
+ * `identity` is the exception and stays off this list, for the reason
+ * `ensureIdentityConnection` gives: a profile with no identity block has nothing
+ * for the surface to report, so registering a tool that answers "nothing
+ * declared" would spend instructions budget to say so. Everything else here
+ * reaches the owner's own material and is empty until they put something in it,
+ * which is ADR-050's whole argument — so a profile written before those existed
+ * gets them on the next command rather than needing five of its own.
+ *
+ * Ordered as `RESERVED_PROVIDER_IDS` is, so a repair reports in the order the
+ * template writes and a diff between the two reads as a diff.
+ */
+export const DEFAULT_SURFACES: readonly ReservedSurface[] = [
+  'memory',
+  'tasks',
+  'assets',
+  'skills',
+  'vault',
+  'setup',
+];
+
 /**
  * What a repair did, split by what a caller does with each half.
  *
@@ -162,14 +191,28 @@ function patternsIn(rules: unknown, now = Date.now()): string[] {
 }
 
 /**
- * The `setup` surface, which every profile is expected to have.
+ * The owner layer, which every profile is expected to have.
+ *
+ * Was `ensureSetupConnection`, and grew rather than gained siblings: the callers
+ * are the same three, and what changed is how many surfaces "a profile should be
+ * able to reach its own material" covers. Repairs are accumulated so a caller
+ * reports one list — five separate calls would print five near-identical blocks
+ * on the one upgrade where any of them fire.
  *
- * A named wrapper rather than a call site passing `'setup'`, because three
- * callers say it and reading `ensureReservedConnection(document, 'setup')` at
- * each of them says less than the name did.
+ * Each surface is still decided independently, so a profile that denied exactly
+ * one of them keeps that decision while the rest are repaired.
  */
-export function ensureSetupConnection(document: ConfigDocument): SurfaceRepair {
-  return ensureReservedConnection(document, 'setup');
+export function ensureOwnerLayer(document: ConfigDocument): SurfaceRepair {
+  const changes: string[] = [];
+  const granted: string[] = [];
+
+  for (const provider of DEFAULT_SURFACES) {
+    const repair = ensureReservedConnection(document, provider);
+    changes.push(...repair.changes);
+    granted.push(...repair.granted);
+  }
+
+  return { changes, granted };
 }
 
 /**
@@ -184,3 +227,64 @@ export function ensureSetupConnection(document: ConfigDocument): SurfaceRepair {
 export function ensureIdentityConnection(document: ConfigDocument): SurfaceRepair {
   return ensureReservedConnection(document, 'identity');
 }
+
+/**
+ * Apply that repair across a workspace, saving and reporting what changed.
+ *
+ * Here rather than in `#deployments`, where it was, because `start` needs it as
+ * much as `deploy` does — more, in fact: `start` is the one command an existing
+ * install runs without being asked to, so it is the path by which a profile
+ * written before ADR-050 gets the layer at all. Two copies of a function that
+ * widens a policy is not a thing to have.
+ *
+ * **The caller scopes it**, and for `deploy` that is exactly the set being
+ * uploaded: a profile it sends is a profile the endpoint will serve, so
+ * repairing a narrower set would leave a served profile without the surfaces.
+ * Note what a `--profile` flag does not mean — it is the flag alone, so a
+ * profile resolved from the environment leaves it undefined and that reads as
+ * the whole workspace.
+ *
+ * *Which files are profiles* comes from `listProfiles`, never from an allowlist
+ * of what is safe to copy: that would happily hand over a committed
+ * `personal.example.yaml` or a nested `profiles/archive/old.yaml`, and this
+ * opens and validates what it is given — which once turned a template into a
+ * `ConfigError` aborting a deploy after provisioning had made cloud resources.
+ *
+ * A profile that cannot be read is warned about rather than fatal: the repair is
+ * a courtesy on the way past, and the caller's real work should still happen.
+ * Not silent, though — nothing else widens a policy without being asked.
+ *
+ * CLI-side by construction, like everything else in this file: a deployed
+ * revision holds `objectViewer` on `profiles/` (ADR-023) and could not write
+ * this even if the code let it.
+ */
+export async function repairOwnerLayer(
+  workspaceRoot: string,
+  profiles: readonly string[] | undefined,
+): Promise<void> {
+  const wanted = profiles === undefined ? undefined : new Set(profiles);
+
+  for (const name of await listProfiles(workspaceRoot)) {
+    if (wanted !== undefined && !wanted.has(name)) continue;
+
+    try {
+      const document = await ConfigDocument.open(workspaceRoot, name);
+      const repair = ensureOwnerLayer(document);
+      if (!repaired(repair)) continue;
+
+      await document.save();
+
+      print(ok(`gave ${style.bold(name)} its own owner layer`));
+      for (const change of repairLines(repair)) print(`      ${style.dim(change)}`);
+      print(
+        `      ${style.dim('memory, tasks, assets, skills, vault and setup — your own material, no account behind any of them')}`,
+      );
+    } catch (error) {
+      print(
+        warn(
+          `could not give ${name} its owner layer: ${error instanceof Error ? error.message.split('\n')[0] : String(error)}`,
+        ),
+      );
+    }
+  }
+}