@lanes-sh/link 0.8.0 → 0.9.0

package/src/cli/commands/update-migration.ts

@@ -0,0 +1,54 @@
+import type { Contract3Migration } from '../contract3.ts';
+import type { Contract4Migration } from '../contract4.ts';
+
+/**
+ * What each contract migration did, as `update` reports it.
+ *
+ * Split from `update.ts` so that file stays inside the size budget, and on the
+ * seam it already had: that file decides *whether* to migrate and this says
+ * *what happened*. Kept beside it rather than beside the migrations, because
+ * `doctor --fix` renders the same facts its own way and the two are allowed to
+ * read differently — what they may not do is disagree about which of them is
+ * worth mentioning.
+ */
+
+/**
+ * What contract 4 did, and the one part of it that is the operator's.
+ *
+ * `update` reported nothing, so the shared-store duplication happened in
+ * silence — a decision the migration calls the owner's, and which `doctor --fix`
+ * prints. Two paths disagreeing on that is how one becomes the wrong one to run.
+ */
+export function sayContract4(migration: Contract4Migration, say: (line: string) => void): void {
+  say(
+    `migrated ${migration.profiles.length} profile(s) to contract 4 — a profile owns its data ` +
+      'again, and Lanes\u2019 own surfaces are lanes_memory, lanes_tasks and the rest',
+  );
+  for (const change of migration.changes) say(`  ${change}`);
+
+  if (migration.shared.length > 0) {
+    say('  A store more than one profile granted was copied into each, and the original kept.');
+    say('  Deleting what you do not want is the one step here that is yours.');
+  }
+
+  if (migration.orphaned.length > 0) {
+    say('  What no profile grants was left exactly where it is, and named above.');
+  }
+
+  say('  Every registered client caches its tool list, so re-add them: lanes link mcp add');
+}
+
+export function sayContract3(migration: Contract3Migration, say: (line: string) => void): void {
+  say(
+    `migrated ${migration.profiles.length} profile(s) to contract 3 — connections belong to the ` +
+      'workspace now, and a profile grants them one by one',
+  );
+  for (const change of migration.changes) say(`  ${change}`);
+
+  if (migration.renames.length > 0) {
+    say('  Two profiles named different accounts with the same id, so one was renamed.');
+    say('  Check the grants in each profile before running an agent against them.');
+  }
+
+  say(`  The old per-profile credential stores are left in place; remove them once this works.`);
+}

package/src/cli/commands/update.ts

@@ -1,9 +1,11 @@
 import { homedir } from 'node:os';
 import { join, sep } from 'node:path';
 import { installRoot, resolveWorkspaceRoot } from '#profile';
-import { repairOwnerLayer } from '../config-repair.ts';
-import { migrateToCurrentContract, type ContractMigration } from '../workspace-migrate.ts';
-import type { Contract3Migration } from '../contract3.ts';
+import { repairOwnerLayer } from '../config-repair-sweep.ts';
+import { migrateToCurrentContract, needsMigration, type ContractMigration } from '../workspace-migrate.ts';
+import { needsContract3, type Contract3Migration } from '../contract3.ts';
+import { needsContract4 } from '../contract4.ts';
+import { sayContract3, sayContract4 } from './update-migration.ts';
 import { emit, fail, ok, print, printErr, progress, style, warn } from '../output.ts';
 import { PACKAGE, release, type ReleaseState } from '../release.ts';
 import { version } from '../version.ts';
@@ -184,11 +186,17 @@ export async function update(flags: UpdateFlags): Promise<void> {
     // a contract it does not implement until someone redeploys. `deploy` is what
     // migrates a bucket, because it is the command that ships the image in the
     // same breath.
-    await migrateLocal(root, flags.json === true ? progress : print);
-
-    await repairOwnerLayer(root, undefined, {
-      ...(flags.json === true ? { report: progress } : {}),
-    });
+    const migrated = await migrateLocal(root, flags.json === true ? progress : print);
+
+    // Only on a workspace that is actually at the current contract — see
+    // `migrateLocal`. The repair writes contract-3 shapes, and writing them
+    // after a refusal that said nothing had been written is what left a stray
+    // `connections.yaml` in a contract-2 workspace.
+    if (migrated) {
+      await repairOwnerLayer(root, undefined, {
+        ...(flags.json === true ? { report: progress } : {}),
+      });
+    }
   }
 
   const report = {
@@ -315,22 +323,8 @@ async function runInstall(argv: readonly string[], json: boolean): Promise<boole
  * fifteen accounts were merged into one store should see that happen rather than
  * discover it from a directory listing.
  */
-function sayContract3(migration: Contract3Migration, say: (line: string) => void): void {
-  say(
-    `migrated ${migration.profiles.length} profile(s) to contract 3 — connections belong to the ` +
-      'workspace now, and a profile grants them one by one',
-  );
-  for (const change of migration.changes) say(`  ${change}`);
-
-  if (migration.renames.length > 0) {
-    say('  Two profiles named different accounts with the same id, so one was renamed.');
-    say('  Check the grants in each profile before running an agent against them.');
-  }
-
-  say(`  The old per-profile credential stores are left in place; remove them once this works.`);
-}
 
-async function migrateLocal(root: string, say: (line: string) => void): Promise<void> {
+async function migrateLocal(root: string, say: (line: string) => void): Promise<boolean> {
   try {
     // One call, both steps, in order — a workspace that predates both walks
     // through them rather than jumping, so each step's reasoning applies to the
@@ -347,11 +341,30 @@ async function migrateLocal(root: string, say: (line: string) => void): Promise<
 
     if (migration.legacy) sayLegacyTargets(migration.legacy, say);
     if (migration.contract3) sayContract3(migration.contract3, say);
+    if (migration.contract4) sayContract4(migration.contract4, say);
+    return true;
   } catch (error) {
     say(`could not migrate this workspace: ${error instanceof Error ? error.message : String(error)}`);
+
+    // **Still behind, not "something threw".** Keying the repair on the throw
+    // suppressed it for the whole workspace when one profile failed to
+    // migrate — so the others, already current, never received a newly shipped
+    // surface, which is the case `update` runs the repair for at all. One
+    // unreadable profile is a per-profile warning, which the repair already
+    // gives it.
+    const behind = await stillBehind(root);
+    if (behind) say('  the owner-layer repair is skipped until it does');
+    return !behind;
   }
 }
 
+/** Anything still below the current contract. Unreadable counts as behind. */
+function stillBehind(root: string): Promise<boolean> {
+  return needsMigration(root)
+    .then(async (one) => one || (await needsContract3(root)) || (await needsContract4(root)))
+    .catch(() => true);
+}
+
 /** Contract 1 to contract 2: targets move from the profile to the workspace. */
 function sayLegacyTargets(
   migration: NonNullable<ContractMigration['legacy']>,

package/src/cli/config-edit.ts

@@ -1,9 +1,10 @@
 import { rename, writeFile } from 'node:fs/promises';
-import { Document, parseDocument, type Node } from 'yaml';
+import { Document, parseDocument, YAMLSeq, type Node } from 'yaml';
 import {
   CONNECTIONS_FILE,
   ConfigError,
   WORKSPACE_FILE,
+  LEGACY_WORKSPACE_FILE,
   workspaceSchema,
   assertConnectionsUnique,
   connectionsFileSchema,
@@ -15,6 +16,7 @@ import {
   validateConfigShape,
   workspaceFiles,
   writeWorkspaceFile,
+  layout,
 } from '#profile';
 
 /**
@@ -42,9 +44,13 @@ function validateDocument(
   raw: unknown,
   path: string,
   key: string | undefined,
-  options: { shapeOnly?: boolean },
+  options: { shapeOnly?: boolean; contract?: number },
 ): void {
-  if (key === WORKSPACE_FILE) {
+  // Either name. The contract-3 migration rewrites the registry under the name
+  // it still has, and a document checked against the wrong schema fails with
+  // "instance: expected object" — which reads as a corrupt profile rather than
+  // as a registry being validated as one.
+  if (key === WORKSPACE_FILE || key === LEGACY_WORKSPACE_FILE) {
     const parsed = workspaceSchema.safeParse(raw);
     if (!parsed.success) {
       throw new ConfigError(
@@ -74,8 +80,10 @@ function validateDocument(
     return;
   }
 
-  if (options.shapeOnly === true) validateConfigShape(raw, path);
-  else validateConfig(raw, path);
+  // `contract` is the one a migration is *producing*, and it is only ever
+  // passed by one: every other caller writes the newest.
+  if (options.shapeOnly === true) validateConfigShape(raw, path, options.contract);
+  else validateConfig(raw, path, options.contract);
 }
 
 export class ConfigDocument {
@@ -101,7 +109,7 @@ export class ConfigDocument {
    * `gs://` URL produces something that addresses nothing.
    */
   static async open(workspaceRoot: string, profile: string): Promise<ConfigDocument> {
-    return ConfigDocument.openKey(workspaceRoot, `profiles/${profile}.yaml`);
+    return ConfigDocument.openKey(workspaceRoot, layout.profileConfig(profile));
   }
 
   /**
@@ -199,7 +207,20 @@ export class ConfigDocument {
     // difference decided whether a command explained itself or crashed.
     const existing = this.#document.getIn(path as (string | number)[]);
     if (existing === undefined || existing === null) {
-      this.#document.setIn(path as (string | number)[], [node]);
+      // A `YAMLSeq` rather than the plain `[node]` this used to set. The array
+      // is not a collection the document API will traverse — the same hazard
+      // `setIn` above documents — so the *first* append landed and the second
+      // found a value with no `.add` and threw `existing.add is not a
+      // function`. `#expand` below reads `.items` and was silently a no-op for
+      // the same reason, leaving the sequence in flow style.
+      //
+      // Latent until contract 3: every path this was called with
+      // (`connections`, `policy.allow`) already existed, so the branch ran at
+      // most once per document. `grants:` is genuinely absent on a profile
+      // being repaired, which is what made the second append reachable.
+      const created = new YAMLSeq();
+      created.add(node);
+      this.#document.setIn(path as (string | number)[], created);
     } else {
       (existing as { add(item: unknown): void }).add(node);
     }
@@ -262,7 +283,7 @@ export class ConfigDocument {
    * The half it keeps is the half that matters for a write: the schema, and the
    * scan that stops a credential value being written into config.
    */
-  async save(options: { shapeOnly?: boolean } = {}): Promise<void> {
+  async save(options: { shapeOnly?: boolean; contract?: number } = {}): Promise<void> {
     const rendered = this.toString();
 
     // Throws on any validation failure, including a credential value that has

package/src/cli/config-repair-sweep.ts

@@ -0,0 +1,119 @@
+import { CONNECTIONS_FILE, listProfiles, workspaceFiles, writeWorkspaceFile } from '#profile';
+import { newConnectionsTemplate } from './config-templates.ts';
+import { ConfigDocument } from './config-edit.ts';
+import { ok, print, style, warn } from './output.ts';
+import { DEFAULT_SURFACES, ensureOwnerLayer, repairLines, repaired } from './config-repair.ts';
+
+/**
+ * Applying the owner-layer repair across a whole workspace.
+ *
+ * Split from `config-repair.ts` when that file outgrew the budget, on the seam
+ * it already had: that file decides what one profile is missing, and this one
+ * walks the workspace applying it. The decision is a pure function of two
+ * documents and is tested as one; the sweep is all filesystem, ordering and
+ * what to say when a profile will not open.
+ */
+
+/** `memory, tasks, assets, skills, vault, setup and entities`, in repair order. */
+function listSurfaces(): string {
+  const names = [...DEFAULT_SURFACES];
+  const last = names.pop();
+  return names.length === 0 ? String(last) : `${names.join(', ')} and ${last}`;
+}
+
+/** The workspace's connections document, written from the template if missing. */
+async function openOrCreateConnections(workspaceRoot: string): Promise<ConfigDocument> {
+  try {
+    return await ConfigDocument.openKey(workspaceRoot, CONNECTIONS_FILE);
+  } catch {
+    await writeWorkspaceFile(
+      workspaceFiles(workspaceRoot),
+      CONNECTIONS_FILE,
+      newConnectionsTemplate(),
+    );
+    return ConfigDocument.openKey(workspaceRoot, CONNECTIONS_FILE);
+  }
+}
+
+/**
+ * Apply that repair across a workspace, saving and reporting what changed.
+ *
+ * Here rather than in `#deployments`, where it was, because `start` needs it as
+ * much as `deploy` does — more, in fact: `start` is the one command an existing
+ * install runs without being asked to, so it is the path by which a profile
+ * written before ADR-050 gets the layer at all. Two copies of a function that
+ * widens a policy is not a thing to have.
+ *
+ * **The caller scopes it**, and for `deploy` that is exactly the set being
+ * uploaded: a profile it sends is a profile the endpoint will serve, so
+ * repairing a narrower set would leave a served profile without the surfaces.
+ * Note what a `--profile` flag does not mean — it is the flag alone, so a
+ * profile resolved from the environment leaves it undefined and that reads as
+ * the whole workspace.
+ *
+ * *Which files are profiles* comes from `listProfiles`, never from an allowlist
+ * of what is safe to copy: that would happily hand over a committed
+ * `personal.example.yaml` or a nested `profiles/archive/old.yaml`, and this
+ * opens and validates what it is given — which once turned a template into a
+ * `ConfigError` aborting a deploy after provisioning had made cloud resources.
+ *
+ * A profile that cannot be read is warned about rather than fatal: the repair is
+ * a courtesy on the way past, and the caller's real work should still happen.
+ * Not silent, though — nothing else widens a policy without being asked.
+ *
+ * CLI-side by construction, like everything else in this file: a deployed
+ * revision holds `objectViewer` on `profiles/` (ADR-023) and could not write
+ * this even if the code let it.
+ */
+export async function repairOwnerLayer(
+  workspaceRoot: string,
+  profiles: readonly string[] | undefined,
+  options: { report?: (line: string) => void } = {},
+): Promise<void> {
+  // stdout by default, because every caller but one is printing a report a
+  // person reads. `update --json` passes `progress` instead: what it produces is
+  // a document, and a line of prose in front of it corrupts whatever is parsing.
+  // Routed rather than silenced — nothing else here widens a policy without
+  // saying so, and this must not be the exception.
+  const say = options.report ?? print;
+  const wanted = profiles === undefined ? undefined : new Set(profiles);
+
+  // One connections document for the whole sweep. The owner layer is the
+  // workspace's now (ADR-059), so repairing three profiles must not add three
+  // `memory.main` rows — opening it once and saving it once is what makes the
+  // second profile see what the first one created.
+  // Created if absent rather than refused. A contract-3 workspace always has
+  // one, but a hand-made or half-migrated one may not — and this is the repair,
+  // so the file it needs is a thing to write rather than a reason to stop.
+  const connections = await openOrCreateConnections(workspaceRoot);
+  let connectionsChanged = false;
+
+  for (const name of await listProfiles(workspaceRoot)) {
+    if (wanted !== undefined && !wanted.has(name)) continue;
+
+    try {
+      const document = await ConfigDocument.open(workspaceRoot, name);
+      const repair = ensureOwnerLayer(connections, document);
+      if (!repaired(repair)) continue;
+
+      connectionsChanged = true;
+      await document.save();
+
+      say(ok(`gave ${style.bold(name)} its own owner layer`));
+      for (const change of repairLines(repair)) say(`      ${style.dim(change)}`);
+      // Built from `DEFAULT_SURFACES` rather than typed out. The typed-out
+      // version still named six after a seventh had been added, so a person
+      // watching a deploy was told entities had arrived on the line above and
+      // that the layer was six things on the line below.
+      say(`      ${style.dim(`${listSurfaces()} — your own material, no account behind any of them`)}`);
+    } catch (error) {
+      say(
+        warn(
+          `could not give ${name} its owner layer: ${error instanceof Error ? error.message.split('\n')[0] : String(error)}`,
+        ),
+      );
+    }
+  }
+
+  if (connectionsChanged) await connections.save();
+}

package/src/cli/config-repair.ts

@@ -1,7 +1,5 @@
-import { newConnectionsTemplate } from './config-templates.ts';
-import { CONNECTIONS_FILE, listProfiles, workspaceFiles, writeWorkspaceFile } from '#profile';
 import { ConfigDocument } from './config-edit.ts';
-import { ok, print, style, warn } from './output.ts';
+import { nextConnectionId } from './identity.ts';
 
 /**
  * Giving a profile a reserved provider it is missing, without undoing a choice.
@@ -19,16 +17,16 @@ import { ok, print, style, warn } from './output.ts';
  * than several that look alike.
  */
 
-/** The reserved provider ids that hold no account, and the label each row carries. */
+/** Lanes' own provider ids, and the label each row carries. */
 const RESERVED_SURFACES = {
-  memory: 'Memory',
-  tasks: 'Tasks',
-  assets: 'Assets',
-  skills: 'Skills',
-  vault: 'Vault',
-  setup: 'Setup',
-  identity: 'Identity',
-  entities: 'Entities',
+  lanes_memory: 'Memory',
+  lanes_tasks: 'Tasks',
+  lanes_assets: 'Assets',
+  lanes_skills: 'Skills',
+  lanes_vault: 'Vault',
+  lanes_setup: 'Setup',
+  lanes_identity: 'Identity',
+  lanes_entities: 'Entities',
 } as const;
 
 type ReservedSurface = keyof typeof RESERVED_SURFACES;
@@ -56,13 +54,13 @@ type ReservedSurface = keyof typeof RESERVED_SURFACES;
  * template writes and a diff between the two reads as a diff.
  */
 export const DEFAULT_SURFACES: readonly ReservedSurface[] = [
-  'memory',
-  'tasks',
-  'assets',
-  'skills',
-  'vault',
-  'setup',
-  'entities',
+  'lanes_memory',
+  'lanes_tasks',
+  'lanes_assets',
+  'lanes_skills',
+  'lanes_vault',
+  'lanes_setup',
+  'lanes_entities',
 ];
 
 /**
@@ -121,18 +119,37 @@ export function ensureReservedConnection(
   const rows = Array.isArray(workspace?.connections) ? workspace.connections : [];
   const held_grants = Array.isArray(config?.grants) ? config.grants : [];
 
-  // The row this profile would use. Any instance of the provider will do, and
-  // the *first* one is taken rather than `main` specifically: an operator who
-  // renamed theirs should not get a second one bolted on beside it.
-  const existing = rows.find(
-    (row) => (row as { provider?: unknown } | null)?.provider === provider,
-  ) as { id?: unknown } | undefined;
-  const id = typeof existing?.id === 'string' ? existing.id : 'main';
-  const key = `${provider}.${id}`;
-
-  const held = held_grants.find(
-    (row) => (row as { connection?: unknown } | null)?.connection === key,
-  ) as { allow?: unknown; deny?: unknown } | undefined;
+  // **This profile's own grant comes first.** Any instance of the provider will
+  // do, and the *first* one is taken rather than `main` specifically: an
+  // operator who renamed theirs should not get a second one bolted on beside
+  // it. That reasoning was right and the lookup implementing it was not — it
+  // read the workspace's first row, which under contract 2 was this profile's
+  // because a profile carried its own connections, and under contract 3 is
+  // whichever profile sorts first.
+  //
+  // So the repair asked whether `personal` granted `memory.main` — demo's — saw
+  // that it did not, and set about adding it. For `vault` and `skills` the
+  // schema refuses a second grant and the save failed loudly, which is how this
+  // was found. For `memory`, `tasks`, `assets`, `setup` and `entities` nothing
+  // refuses it, and the profile would quietly have been granted another
+  // profile's notes and another profile's task list — the outcome ADR-059
+  // exists to prevent, arriving from the repair rather than the migration.
+  //
+  // **Every** instance, not the first one matched. A profile may grant two —
+  // `memory.team` and `memory.personal` — and reading only the first let a deny
+  // on the other be stepped around: the repair widened the undenied row and
+  // reported the surface granted, which is the one thing the paragraph below
+  // says it must never do.
+  //
+  // `startsWith` rather than slicing at the dot, because these rows are raw
+  // unvalidated YAML: `indexOf` answers -1 for a value with no dot at all, and
+  // `'vaults'.slice(0, -1)` is `'vault'` — so a typo'd `connection: vaults`
+  // matched the vault surface and was widened while the real one stayed
+  // unreachable.
+  const mine = held_grants.filter((row) => {
+    const connection = (row as { connection?: unknown } | null)?.connection;
+    return typeof connection === 'string' && connection.startsWith(`${provider}.`);
+  }) as { connection?: string; allow?: unknown; deny?: unknown }[];
 
   // Denied on purpose, and a deny beats an allow — so writing the rule would
   // widen nothing while announcing that an agent can now read the surface,
@@ -143,18 +160,53 @@ export function ensureReservedConnection(
   // Only a rule covering the whole surface counts. `deny: [setup.provider]` is
   // an operator narrowing it, not switching it off, and that narrowing survives
   // the repair untouched — which is the point of denying one capability.
-  if (patternsIn(held?.deny).some(covers)) return { changes: [], granted: [] };
+  if (mine.some((row) => patternsIn(row.deny).some(covers))) return { changes: [], granted: [] };
+
+  // The instance already carrying the rule, if any. Not an early return: the
+  // workspace row can be missing while the grant is present — a profile written
+  // before the surface existed, repaired once against a `connections.yaml` that
+  // has since been hand-edited — and repairing one half only is what this
+  // function exists to prevent.
+  const allowed = mine.find((row) => patternsIn(row.allow).some(covers));
+
+  // Otherwise the first row that exists and grants nothing is the one to widen.
+  const owned = allowed ?? mine[0];
+
+  // Only when this profile grants no instance of the provider at all is the
+  // workspace consulted, which is the case this was written for: a surface that
+  // did not exist when the profile was written.
+  const declared = rows.find(
+    (row) => (row as { provider?: unknown } | null)?.provider === provider,
+  ) as { id?: unknown } | undefined;
+
+  // The id an existing row already has, else the next free one. Opaque and
+  // allocated across the whole workspace, so `lan3` names exactly one row
+  // however many surfaces a repair adds in one pass.
+  const taken = rows.flatMap((row) => {
+    const id = (row as { id?: unknown } | null)?.id;
+    return typeof id === 'string' ? [id] : [];
+  });
+  const id = typeof declared?.id === 'string' ? declared.id : nextConnectionId(taken, true);
+
+  const key = owned?.connection ?? `${provider}.${id}`;
+
+  // Whether the *workspace* needs a row, which is a separate question from
+  // which one this profile grants: a profile cannot grant a connection that is
+  // not declared, so `owned` implies `declared`.
+  const existing = declared;
+  const held = owned;
 
   const changes: string[] = [];
   const granted: string[] = [];
 
   if (existing === undefined) {
-    // Inline, and `main` for the id, so a repaired workspace is spelled exactly
-    // like `newConnectionsTemplate` writes a fresh one. Two spellings of one row
-    // is how a template and its repair drift apart.
+    // Inline, and the allocated id, so a repaired workspace is spelled exactly
+    // like `newConnectionsTemplate` writes a fresh one — which is what
+    // `config-edit.test.ts` asserts by checking a fresh profile needs no repair.
+    // Two spellings of one row is how a template and its repair drift apart.
     connections.addTo(
       ['connections'],
-      { id: 'main', provider, account: RESERVED_SURFACES[provider] },
+      { id, provider, account: RESERVED_SURFACES[provider] },
       { inline: true },
     );
     changes.push(`connections.yaml += ${key}`);
@@ -166,7 +218,7 @@ export function ensureReservedConnection(
     profile.addTo(['grants'], { connection: key, allow: [rule], deny: [] }, { inline: true });
     changes.push(`grants += ${key}`);
     granted.push(rule);
-  } else if (!patternsIn(held.allow).some(covers)) {
+  } else if (allowed === undefined) {
     // A row that exists and grants nothing is a surface that is present and
     // silent. Widening it back is the repair; the deny check above is what stops
     // this undoing a deliberate narrowing.
@@ -178,28 +230,7 @@ export function ensureReservedConnection(
   return { changes, granted };
 }
 
-/** The workspace's connections document, written from the template if missing. */
-async function openOrCreateConnections(workspaceRoot: string): Promise<ConfigDocument> {
-  try {
-    return await ConfigDocument.openKey(workspaceRoot, CONNECTIONS_FILE);
-  } catch {
-    await writeWorkspaceFile(
-      workspaceFiles(workspaceRoot),
-      CONNECTIONS_FILE,
-      newConnectionsTemplate(),
-    );
-    return ConfigDocument.openKey(workspaceRoot, CONNECTIONS_FILE);
-  }
-}
-
 /** Whether a repair did anything, without a caller adding up two lists. */
-/** `memory, tasks, assets, skills, vault, setup and entities`, in repair order. */
-function listSurfaces(): string {
-  const names = [...DEFAULT_SURFACES];
-  const last = names.pop();
-  return names.length === 0 ? String(last) : `${names.join(', ')} and ${last}`;
-}
-
 export function repaired(repair: SurfaceRepair): boolean {
   return repair.changes.length > 0 || repair.granted.length > 0;
 }
@@ -286,88 +317,6 @@ export function ensureIdentityConnection(
   connections: ConfigDocument,
   profile: ConfigDocument,
 ): SurfaceRepair {
-  return ensureReservedConnection(connections, profile, 'identity');
+  return ensureReservedConnection(connections, profile, 'lanes_identity');
 }
 
-/**
- * Apply that repair across a workspace, saving and reporting what changed.
- *
- * Here rather than in `#deployments`, where it was, because `start` needs it as
- * much as `deploy` does — more, in fact: `start` is the one command an existing
- * install runs without being asked to, so it is the path by which a profile
- * written before ADR-050 gets the layer at all. Two copies of a function that
- * widens a policy is not a thing to have.
- *
- * **The caller scopes it**, and for `deploy` that is exactly the set being
- * uploaded: a profile it sends is a profile the endpoint will serve, so
- * repairing a narrower set would leave a served profile without the surfaces.
- * Note what a `--profile` flag does not mean — it is the flag alone, so a
- * profile resolved from the environment leaves it undefined and that reads as
- * the whole workspace.
- *
- * *Which files are profiles* comes from `listProfiles`, never from an allowlist
- * of what is safe to copy: that would happily hand over a committed
- * `personal.example.yaml` or a nested `profiles/archive/old.yaml`, and this
- * opens and validates what it is given — which once turned a template into a
- * `ConfigError` aborting a deploy after provisioning had made cloud resources.
- *
- * A profile that cannot be read is warned about rather than fatal: the repair is
- * a courtesy on the way past, and the caller's real work should still happen.
- * Not silent, though — nothing else widens a policy without being asked.
- *
- * CLI-side by construction, like everything else in this file: a deployed
- * revision holds `objectViewer` on `profiles/` (ADR-023) and could not write
- * this even if the code let it.
- */
-export async function repairOwnerLayer(
-  workspaceRoot: string,
-  profiles: readonly string[] | undefined,
-  options: { report?: (line: string) => void } = {},
-): Promise<void> {
-  // stdout by default, because every caller but one is printing a report a
-  // person reads. `update --json` passes `progress` instead: what it produces is
-  // a document, and a line of prose in front of it corrupts whatever is parsing.
-  // Routed rather than silenced — nothing else here widens a policy without
-  // saying so, and this must not be the exception.
-  const say = options.report ?? print;
-  const wanted = profiles === undefined ? undefined : new Set(profiles);
-
-  // One connections document for the whole sweep. The owner layer is the
-  // workspace's now (ADR-059), so repairing three profiles must not add three
-  // `memory.main` rows — opening it once and saving it once is what makes the
-  // second profile see what the first one created.
-  // Created if absent rather than refused. A contract-3 workspace always has
-  // one, but a hand-made or half-migrated one may not — and this is the repair,
-  // so the file it needs is a thing to write rather than a reason to stop.
-  const connections = await openOrCreateConnections(workspaceRoot);
-  let connectionsChanged = false;
-
-  for (const name of await listProfiles(workspaceRoot)) {
-    if (wanted !== undefined && !wanted.has(name)) continue;
-
-    try {
-      const document = await ConfigDocument.open(workspaceRoot, name);
-      const repair = ensureOwnerLayer(connections, document);
-      if (!repaired(repair)) continue;
-
-      connectionsChanged = true;
-      await document.save();
-
-      say(ok(`gave ${style.bold(name)} its own owner layer`));
-      for (const change of repairLines(repair)) say(`      ${style.dim(change)}`);
-      // Built from `DEFAULT_SURFACES` rather than typed out. The typed-out
-      // version still named six after a seventh had been added, so a person
-      // watching a deploy was told entities had arrived on the line above and
-      // that the layer was six things on the line below.
-      say(`      ${style.dim(`${listSurfaces()} — your own material, no account behind any of them`)}`);
-    } catch (error) {
-      say(
-        warn(
-          `could not give ${name} its owner layer: ${error instanceof Error ? error.message.split('\n')[0] : String(error)}`,
-        ),
-      );
-    }
-  }
-
-  if (connectionsChanged) await connections.save();
-}