@lanes-sh/link 0.8.0 → 0.9.1

package/src/cli/runtime/open.ts

@@ -1,7 +1,7 @@
 import { BearerAuthenticator, ownerPrincipal } from '#auth';
 import type { SecretStore } from '#secrets';
 import type { AuditReader } from '#audit';
-import type { RuntimeState } from '#stores/state';
+import { DISCOVERY_NAMESPACE, type RuntimeState } from '#stores/state';
 import type { BlobStore } from '#stores/blobs';
 import type { AnyConnector, ProviderManifest } from '#connectivity';
 import { RateLimiter, allowedConnections } from '#policy';
@@ -127,7 +127,7 @@ export async function openRuntime(
   // own roots on the target's own storage and are untouched.
   const knowledge = await openKnowledge(adapters, credentials, options.fetch);
   const storage = knowledge ? routeBlobStore(storageFor(), knowledgeRoutes(knowledge)) : storageFor();
-  const state = openState(storageFor);
+  const state = openState(storageFor, config.instance.profile);
 
   // The durable log, plus any copies the target declares. `sink` is what
   // dispatch writes to; `audit` is what `tail` and `verify` read, and those are
@@ -148,10 +148,10 @@ export async function openRuntime(
   // `EMPTY_SKILLS` when none is granted: a profile that denies `skills.*` has
   // no store to open, and handing it the workspace root instead would serve
   // every other profile's procedures.
-  const skillsConnection = soleGrantFor(config, 'skills');
+  const skillsConnection = soleGrantFor(config, 'lanes_skills');
   const skills =
     knowledge?.skills ??
-    (skillsConnection === undefined ? undefined : skillStore(storageFor, skillsConnection));
+    (skillsConnection === undefined ? undefined : skillStore(storageFor, config.instance.profile, skillsConnection));
 
   // The vault's own store, beside the credential store and never it: a separate
   // document, a separate key, and a separate environment variable
@@ -269,7 +269,7 @@ export async function openRuntime(
       }
     }
 
-    const cached = await state.kv.get('discovery', entry.manifest.id);
+    const cached = await state.kv.get(DISCOVERY_NAMESPACE, entry.manifest.id);
     if (cached) {
       try {
         registry.setDiscovered(entry.manifest.id, JSON.parse(cached));

package/src/cli/runtime/select.ts

@@ -126,21 +126,12 @@ export async function resolveProfileOnly(
  * inside Google's network. Opening a full runtime for either would fail on the
  * part that is not needed.
  */
-export async function openSecretStoreFor(
-  config: Config,
-  root: string,
-  target: string,
-): Promise<SecretStore> {
+export async function openSecretStoreFor(root: string, target: string): Promise<SecretStore> {
   // Resolved here rather than taken from the caller, so `secrets push --from
   // local --to cloud` can hold two targets that live in two different workspaces
   // without the caller having to follow either pointer itself.
   const resolved = await openTarget(root, target);
-  return openSecrets({
-    declared: resolved.declared,
-    config,
-    root: resolved.workspaceRoot,
-    target,
-  });
+  return openSecrets({ declared: resolved.declared, root: resolved.workspaceRoot, target });
 }
 
 /**

package/src/cli/runtime/stores.ts

@@ -33,21 +33,26 @@ export const EMPTY_SKILL_STORE: BlobStore = {
 /**
  * Where a connection's skills live, in either workspace.
  *
- * `data/skills.d/<connection>/`, and deployed the same key under the bucket
- * prefix. Going through the store rather than a filesystem path is what gives a
+ * `profiles/<profile>/skills.d/<connection>/`, and deployed the same key under
+ * the bucket prefix. Going through the store rather than a filesystem path is what gives a
  * deployment skills at all — a path is baked into a container image at build
  * time and an object key is not, so before ADR-014 a deployed instance could
  * only ever serve the skills that existed when its image was built.
  *
- * **Per connection**, which is the third answer this question has had. Policy
- * gating `skills.<name>` was the whole isolation story while the bytes were
- * shared (ADR-012 §1), and it is a weak one: it decides who may *run* a
- * procedure, not who may read that it exists or what it says. ADR-030 made the
- * bytes per profile; ADR-059 made them per connection, so two profiles granting
- * one skills connection share a set and two granting different ones share
- * nothing.
+ * **Per profile and per connection**, which is the fourth answer this question
+ * has had. Policy gating `skills.<name>` was the whole isolation story while
+ * the bytes were shared (ADR-012 §1), and it is a weak one: it decides who may
+ * *run* a procedure, not who may read that it exists or what it says. ADR-030
+ * made the bytes per profile; ADR-059 made them per connection instead, so two
+ * profiles granting one skills connection shared a set; ADR-066 puts the
+ * profile back in front of it, so they do not. The connection stays because a
+ * profile may still hold more than one set.
  */
-export function skillStore(storage: StorageFactory, connection: string): BlobStore {
-  return storage(layout.skills(connection));
+export function skillStore(
+  storage: StorageFactory,
+  profile: string,
+  connection: string,
+): BlobStore {
+  return storage(layout.skills(profile, connection));
 }
 

package/src/cli/runtime/vault.ts

@@ -40,12 +40,12 @@ export function openVault(
   // The vault connection this profile grants (ADR-059). `main` when it grants
   // none, which keeps a profile that denied the vault opening against the same
   // document every other profile uses rather than inventing a second one.
-  const connection = soleGrantFor(config, 'vault') ?? 'main';
+  const connection = soleGrantFor(config, 'lanes_vault') ?? 'main';
 
   switch (vault.adapter) {
     case 'file':
       return createFileVaultStore({
-        path: workspacePath(root, vault.path ?? layout.vault(connection)),
+        path: workspacePath(root, vault.path ?? layout.vault(config.instance.profile, connection)),
       });
 
     case 'secret':

package/src/cli/usage.ts

@@ -61,7 +61,11 @@ ${style.bold('Profiles')}
                                  rest are copied from a sibling profile
   ${PROGRAM} profile list [--json]
   ${PROGRAM} profile remove <name> [--workspace <name>] [--dry-run] [--yes] [--json]
-                                 the profile, its credentials, and its data
+                                 [--delete-data | --migrate-to <profile>]
+                                 the profile and its own token. Say which of
+                                 --delete-data or --migrate-to for its memory,
+                                 tasks, assets and skills — there is no default.
+                                 Accounts outlive it; disconnect removes those.
 
 ${style.bold('Workspaces')}
   ${PROGRAM} workspace list [--urls]   every workspace this one knows

package/src/cli/workspace-migrate.ts

@@ -1,3 +1,4 @@
+import { migrateToContract4, type Contract4Migration } from './contract4.ts';
 import { migrateToContract3, needsContract3, type Contract3Migration } from './contract3.ts';
 import { readSession } from '#auth/lanes/session.ts';
 import { parseDocument } from 'yaml';
@@ -18,6 +19,7 @@ import {
 } from '#profile';
 import { ConfigDocument } from './config-edit.ts';
 import { hoist, summarise } from './migrate-plan.ts';
+import { C3 } from './contract3-layout.ts';
 
 /**
  * Contract 1 → 2: the target moves out of the profile and into the workspace.
@@ -64,7 +66,7 @@ export interface WorkspaceMigration {
 /** Whether this workspace still holds anything at contract 1. */
 export async function needsMigration(workspaceRoot: string): Promise<boolean> {
   for (const profile of await listProfiles(workspaceRoot)) {
-    const text = await readWorkspaceFile(workspaceFiles(workspaceRoot), `profiles/${profile}.yaml`);
+    const text = await readWorkspaceFile(workspaceFiles(workspaceRoot), C3.profile(profile));
     if (text === null) continue;
     try {
       if (isLegacyProfile(parseDocument(text).toJSON())) return true;
@@ -93,7 +95,10 @@ export async function migrateWorkspace(
     [];
 
   for (const profile of names) {
-    const document = await ConfigDocument.open(workspaceRoot, profile);
+    // The contract-1 path, frozen. `open` resolves the live layout, which is
+    // contract 4's — so this read a profile that does not exist yet and the
+    // migration refused a workspace it was supposed to move.
+    const document = await ConfigDocument.openKey(workspaceRoot, C3.profile(profile));
     const raw = document.toJSON();
     if (!isLegacyProfile(raw)) continue;
 
@@ -126,10 +131,10 @@ export async function migrateWorkspace(
     changes.push(
       entry.at !== undefined
         ? `workspaces.${name}: pointer to ${entry.at}`
-        : `targets.${name}: declared in ${WORKSPACE_FILE}`,
+        : `targets.${name}: declared in ${C3.workspace}`,
     );
   }
-  for (const { profile } of legacy) changes.push(`profiles/${profile}.yaml: targets: removed, contract: 2`);
+  for (const { profile } of legacy) changes.push(`${C3.profile(profile)}: targets: removed, contract: 2`);
 
   if (!options.apply) {
     return {
@@ -170,7 +175,7 @@ export async function migrateWorkspace(
     // wrote, and `check` refuses anything either step leaves broken.
     await writeWorkspaceFile(
       workspaceFiles(workspaceRoot),
-      `profiles/${profile}.yaml`,
+      C3.profile(profile),
       document.toString(),
     );
   }
@@ -190,6 +195,7 @@ export interface ContractMigration {
   readonly legacy: WorkspaceMigration | null;
   /** The contract 2 → 3 half, when this workspace needed one. */
   readonly contract3: Contract3Migration | null;
+  readonly contract4: Contract4Migration | null;
   /** Every profile either half rewrote, deduplicated. */
   readonly profiles: readonly string[];
   /** Targets written into the registry by the contract 1 → 2 half. */
@@ -236,7 +242,7 @@ export interface ContractMigration {
  */
 export async function migrateToCurrentContract(
   workspaceRoot: string,
-  options: { apply: boolean; subject?: string } = { apply: true },
+  options: { apply: boolean; subject?: string; target?: string } = { apply: true },
 ): Promise<ContractMigration> {
   const legacy = (await needsMigration(workspaceRoot))
     ? await migrateWorkspace(workspaceRoot, { apply: options.apply })
@@ -249,14 +255,29 @@ export async function migrateToCurrentContract(
     ...(subject === undefined ? {} : { subject }),
   });
 
+  // In sequence, not in parallel: contract 4 moves what contract 3 produced, so
+  // it has to run against the tree the previous step left. With `apply: false`
+  // it sees the unmigrated shape and reports only what it can see from here —
+  // which is the honest preview, and why the count is not promised.
+  const contract4 = await migrateToContract4(workspaceRoot, {
+    apply: options.apply,
+    ...(options.target === undefined ? {} : { target: options.target }),
+  });
+
   return {
     workspaceRoot,
     legacy: legacy !== null && !legacy.alreadyCurrent ? legacy : null,
     contract3: contract3.alreadyCurrent ? null : contract3,
-    profiles: [...new Set([...(legacy?.profiles ?? []), ...contract3.profiles])],
+    contract4: contract4.alreadyCurrent ? null : contract4,
+    profiles: [
+      ...new Set([...(legacy?.profiles ?? []), ...contract3.profiles, ...contract4.profiles]),
+    ],
     targets: legacy?.targets ?? [],
-    changes: [...(legacy?.changes ?? []), ...contract3.changes],
-    alreadyCurrent: (legacy === null || legacy.alreadyCurrent) && contract3.alreadyCurrent,
+    changes: [...(legacy?.changes ?? []), ...contract3.changes, ...contract4.changes],
+    alreadyCurrent:
+      (legacy === null || legacy.alreadyCurrent) &&
+      contract3.alreadyCurrent &&
+      contract4.alreadyCurrent,
   };
 }
 
@@ -274,7 +295,7 @@ async function writeRegistry(
   registry: Record<string, WorkspaceTarget>,
 ): Promise<void> {
   const files = workspaceFiles(workspaceRoot);
-  const text = (await readWorkspaceFile(files, WORKSPACE_FILE)) ?? `contract: ${SUPPORTED_CONTRACT}\n`;
+  const text = (await readWorkspaceFile(files, C3.workspace)) ?? `contract: ${SUPPORTED_CONTRACT}\n`;
   const document = parseDocument(text);
   const current = (document.toJSON() ?? {}) as {
     workspaces?: Record<string, WorkspaceTarget>;
@@ -318,7 +339,7 @@ async function writeRegistry(
   document.deleteIn(['deployments']);
   document.deleteIn(['default_target']);
 
-  await writeWorkspaceFile(files, WORKSPACE_FILE, String(document));
+  await writeWorkspaceFile(files, C3.workspace, String(document));
 }
 
 function describe(

package/src/connectivity/manifest/provider.ts

@@ -76,25 +76,44 @@ export const providerManifestSchema = z.object({
 export type ProviderManifest = z.infer<typeof providerManifestSchema>;
 
 /**
- * Provider ids reserved for the owner layer.
+ * The owner layer's provider ids — Lanes' own surfaces.
+ *
+ * **`lanes_` on each, which is what stops them needing to be reserved.** They
+ * were `memory`, `tasks`, `assets`, `skills`, `vault`, `entities` — six of the
+ * most obvious words a vendor manifest might want, held back from every
+ * operator so the built-ins could have them. `buildRegistry` registers these
+ * before `PROVIDERS`, so a manifest claiming one threw at startup rather than
+ * being shadowed (ADR-051); the reservation is what made that a refusal instead
+ * of a collision. Prefixed, there is nothing to reserve: an operator's own
+ * `memory` connector is now a legal thing to declare.
+ *
+ * It is also the shape the vendor-qualified providers already use —
+ * `google_tasks`, `gmail_imap`, `icloud_mail` — and it reads the same way: the
+ * half before the underscore says whose surface this is.
  *
  * The order is read: `#server/mcp`'s instructions emit one paragraph per
  * reachable id in this sequence, so it is the order an agent meets them in.
- * `entities` is appended rather than inserted alphabetically so that it lands
- * beside `identity`: the two answer the same question about different people,
- * and the instructions collapse them into one paragraph when both are reachable.
+ * `lanes_entities` is appended rather than inserted alphabetically so that it
+ * lands beside `lanes_identity`: the two answer the same question about
+ * different people, and the instructions collapse them into one paragraph when
+ * both are reachable.
  */
 export const RESERVED_PROVIDER_IDS: readonly string[] = [
-  'memory',
-  'tasks',
-  'assets',
-  'skills',
-  'vault',
-  'setup',
-  'identity',
-  'entities',
+  'lanes_memory',
+  'lanes_tasks',
+  'lanes_assets',
+  'lanes_skills',
+  'lanes_vault',
+  'lanes_setup',
+  'lanes_identity',
+  'lanes_entities',
 ];
 
+/** Old id to new, for the contract-4 migration and for a refusal that names it. */
+export const RENAMED_OWNER_PROVIDERS: ReadonlyMap<string, string> = new Map(
+  RESERVED_PROVIDER_IDS.map((id) => [id.slice('lanes_'.length), id]),
+);
+
 /**
  * Validate a manifest, with the cross-field rules the schema alone cannot
  * express.

package/src/connectivity/transports/imap/parser.ts

@@ -16,6 +16,30 @@
 const CR = 0x0d;
 const LF = 0x0a;
 
+/**
+ * The most this will accumulate before refusing a response.
+ *
+ * A literal's length is a number the *server* writes — `{1234}` — and the
+ * reader's job is to wait until that many bytes have arrived. With no ceiling
+ * that is an allocation an upstream decides the size of, and the upstream is
+ * not always one this endpoint chose: a connector names its own host, so a
+ * connection pointed at a hostile or compromised server could announce a
+ * literal of any size and be believed.
+ *
+ * Sixty-four mebibytes because that is already the ceiling on the other side of
+ * the same journey — `MAX_UPLOAD_BYTES` in `server/attachments.ts` — and a
+ * message larger than the largest attachment this endpoint will accept is not
+ * one it can do anything useful with. Every mail host's own limit is well below
+ * it, so this is never what refuses a legitimate read.
+ *
+ * Applied twice, and both are needed. The announced length is refused up front,
+ * so an absurd number costs nothing rather than being discovered after the
+ * bytes arrive. The accumulated buffer is refused too, because one response may
+ * announce several literals and a server that never completes a response would
+ * otherwise grow this without ever announcing anything unreasonable.
+ */
+export const MAX_RESPONSE_BYTES = 64 * 1024 * 1024;
+
 /** A parsed element of a response. */
 export type ImapToken =
   | { readonly kind: 'atom'; readonly value: string }
@@ -32,27 +56,56 @@ export type ImapToken =
  */
 export class ResponseAssembler {
   #buffer = new Uint8Array(0);
-
+  /** Bytes in use. The buffer is grown ahead of this and is not a length. */
+  #length = 0;
+
+  /**
+   * Take a chunk off the socket.
+   *
+   * Capacity doubles rather than growing to fit. It used to allocate exactly
+   * `held + chunk` and copy everything across on every chunk, which is
+   * quadratic in the size of a response — a thirty-megabyte message arriving in
+   * sixty-four-kilobyte pieces copied several gigabytes to assemble, and that
+   * was the *legitimate* case. Doubling makes each byte move a constant number
+   * of times.
+   */
   push(chunk: Uint8Array): void {
-    const merged = new Uint8Array(this.#buffer.length + chunk.length);
-    merged.set(this.#buffer);
-    merged.set(chunk, this.#buffer.length);
-    this.#buffer = merged;
+    const needed = this.#length + chunk.length;
+    if (needed > MAX_RESPONSE_BYTES) {
+      throw new Error(
+        `The server sent more than ${MAX_RESPONSE_BYTES} bytes without completing a response.`,
+      );
+    }
+
+    if (needed > this.#buffer.length) {
+      let capacity = Math.max(this.#buffer.length, 8192);
+      while (capacity < needed) capacity *= 2;
+
+      const grown = new Uint8Array(Math.min(capacity, MAX_RESPONSE_BYTES));
+      grown.set(this.#buffer.subarray(0, this.#length));
+      this.#buffer = grown;
+    }
+
+    this.#buffer.set(chunk, this.#length);
+    this.#length = needed;
   }
 
   /** The next complete response, or undefined while more bytes are needed. */
   next(): Uint8Array | undefined {
-    const end = completeResponseEnd(this.#buffer);
+    const end = completeResponseEnd(this.#buffer.subarray(0, this.#length));
     if (end === undefined) return undefined;
 
-    const response = this.#buffer.subarray(0, end);
-    this.#buffer = this.#buffer.slice(end);
+    // A copy, not a view: the remainder is shifted down in place below, which
+    // would otherwise rewrite the bytes underneath the response just returned.
+    const response = this.#buffer.slice(0, end);
+    this.#buffer.copyWithin(0, end, this.#length);
+    this.#length -= end;
     return response;
   }
 
   /** Whatever has arrived but does not yet form a response. For diagnostics. */
   get pending(): number {
-    return this.#buffer.length;
+    return this.#length;
   }
 }
 
@@ -67,6 +120,14 @@ function completeResponseEnd(buffer: Uint8Array): number | undefined {
     const announced = literalLength(buffer, cursor, crlf);
     if (announced === undefined) return crlf + 2;
 
+    // Refused on the announcement rather than after the bytes turn up: the
+    // number is the server's, and believing an absurd one means waiting for it.
+    if (announced > MAX_RESPONSE_BYTES) {
+      throw new Error(
+        `The server announced a ${announced}-byte literal, over the ${MAX_RESPONSE_BYTES}-byte limit.`,
+      );
+    }
+
     const afterLiteral = crlf + 2 + announced;
     if (buffer.length < afterLiteral) return undefined;
 

package/src/deployments/adapters/filesystem.ts

@@ -1,7 +1,7 @@
 import { mkdir, readdir, readFile, rename, rm, rmdir, stat, writeFile } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
 import { dirname, join, relative, resolve, sep } from 'node:path';
-import type { BlobKey, BlobMetadata, BlobStore } from '#stores/blobs';
+import { containedKey, type BlobKey, type BlobMetadata, type BlobStore } from '#stores/blobs';
 
 /**
  * Filesystem blob store — the `local` target's adapter.
@@ -54,12 +54,27 @@ export function createFilesystemBlobStore(options: FilesystemBlobStoreOptions):
    * this adapter is also usable directly, and a containment check belongs at
    * the point where a path actually becomes a filesystem operation. Defence in
    * depth is cheap; a provider escaping its directory is not.
+   *
+   * **The rule is `containedKey`'s, not this file's.** It used to be a copy,
+   * and the copy did not agree: it tested `rel.startsWith('..')` where it meant
+   * "the first segment is `..`", so a key beginning with two dots and
+   * continuing — an ordinary name — was refused here and accepted by every
+   * other adapter. That is the divergence `conformance.ts` exists to prevent,
+   * and it was reachable from an ordinary argument, because a provider passes
+   * a caller's name straight through as a key.
+   *
+   * Kept as a resolve-then-join rather than deferring the whole path: the
+   * shared rule answers "does this land inside", and this adapter still has to
+   * turn the answer into a filesystem path.
    */
   const pathFor = (key: BlobKey): string => {
-    const resolved = resolve(root, key);
+    const resolved = resolve(root, containedKey(key));
     const rel = relative(root, resolved);
 
-    if (rel === '' || rel.startsWith('..') || rel.startsWith(`..${sep}`)) {
+    // Unreachable once `containedKey` has answered, and kept because this is
+    // the line where a path becomes a filesystem operation: a future change to
+    // either side should fail here rather than escape.
+    if (rel === '' || rel === '..' || rel.startsWith(`..${sep}`)) {
       throw new Error(`Blob key resolves outside the store root: ${key}`);
     }
     return resolved;

package/src/deployments/deploy.ts

@@ -14,7 +14,7 @@ import { recordDeployment, type DeploymentRecord } from './record.ts';
 import { printSteps, runSteps } from './steps.ts';
 import { driverFor } from './drivers.ts';
 import { prepareSecrets, readableRefs, rotatableRefs } from './prepare.ts';
-import { repairOwnerLayer } from '#cli/config-repair.ts';
+import { repairOwnerLayer } from '#cli/config-repair-sweep.ts';
 import { migrateToCurrentContract } from '#cli/workspace-migrate.ts';
 import { deployedWorkspace, uploadWorkspace } from './upload.ts';
 import { servingProfiles } from './serving.ts';
@@ -229,7 +229,7 @@ export async function deploy(flags: DeployFlags): Promise<void> {
     await runSteps(driver, provision);
   }
 
-  const credentials = await openSecretStoreFor(config, resolution.workspaceRoot, target);
+  const credentials = await openSecretStoreFor(resolution.workspaceRoot, target);
   const prepared = await prepareSecrets({
     config,
     declared,
@@ -288,7 +288,7 @@ export async function deploy(flags: DeployFlags): Promise<void> {
     // bucket at contract 2 — and running it after the upload is the same as not
     // running it, because the upload writes contract-3 profiles and
     // `needsContract3` reads the profiles.
-    await migrateToCurrentContract(workspace, { apply: true });
+    await migrateToCurrentContract(workspace, { apply: true, target });
 
     // Before the rollout, so the revision that comes up finds a config to read.
     // Uploading after would leave a window where the service is serving and the
@@ -308,7 +308,7 @@ export async function deploy(flags: DeployFlags): Promise<void> {
 
     // Again for what the upload put there: a newly created bucket gets its
     // profiles written here for the first time. Idempotent — one listing.
-    await migrateToCurrentContract(workspace, { apply: true });
+    await migrateToCurrentContract(workspace, { apply: true, target });
 
     // Where this deployment lives, in both registries — see `record.ts`. The
     // declaration has to land before the revision boots, so it goes here rather
@@ -374,7 +374,7 @@ async function migrateTargetWorkspace(target: string, apply: boolean): Promise<b
   const workspace = await resolveTargetWorkspace(root, target).catch(() => null);
   if (workspace === null || workspace === root) return true;
 
-  const migrated = await migrateToCurrentContract(workspace, { apply });
+  const migrated = await migrateToCurrentContract(workspace, { apply, target });
   if (migrated.alreadyCurrent) return true;
 
   heading(apply ? 'Migrated' : 'Would migrate');

package/src/deployments/gcp/bucket.ts

@@ -51,6 +51,11 @@ export function bucketGrants(bucket: string, profiles: readonly string[]): Condi
     `resource.name.startsWith("projects/_/buckets/${bucket}/objects/${path}")`;
   const objectIs = (path: string): string =>
     `resource.name == "projects/_/buckets/${bucket}/objects/${path}"`;
+  // Parenthesised, because `!` binds tighter than `==` in CEL: `!resource.name
+  // == "…"` negates the *name* and compares that, which is not a type error and
+  // not what it reads as. Bracketing is the whole difference between excluding
+  // one object and excluding nothing.
+  const objectIsNot = (path: string): string => `!(${objectIs(path)})`;
   /**
    * The bucket itself, which is a different resource from anything in it.
    *
@@ -80,10 +85,41 @@ export function bucketGrants(bucket: string, profiles: readonly string[]): Condi
   // One prefix, not one per profile. Manifests are the workspace's since
   // ADR-057 — a manifest defines a connection, and connections do not live in a
   // profile — so the carve-out no longer varies with the profile set.
-  const manifestPrefixes = [objectsUnder(`${layout.providers()}/`)];
-  // No profiles leaves the carve-out off rather than guessing at one: the
-  // revision keeps write on its own data, as it did before this existed.
-  const manifests = manifestPrefixes.length > 0 ? `(${manifestPrefixes.join(' || ')})` : null;
+  const manifests = `(${objectsUnder(`${layout.providers()}/`)})`;
+
+  /**
+   * What a running revision writes, named rather than carved out of `data/`.
+   *
+   * It used to be `objectsUnder('data/') && !manifests` — everything under one
+   * prefix, minus the exception. There is no `data/` any more (ADR-067), and
+   * naming the writable prefixes is the better shape regardless: an allowlist
+   * says what a compromised revision can reach, where a denylist says only what
+   * it cannot and grows silently every time something new lands under the
+   * prefix.
+   *
+   * `credentials.enc` is in it because `connect --from-endpoint` and a token
+   * refresh both write there (ADR-025), and its `.key` sits beside it.
+   */
+  // **Per profile, not `profiles/` wholesale.** Granting the whole tree and
+  // carving the served declarations back out left the revision `create` and
+  // `delete` on every *other* profile's `profile.yaml` — the configuration of a
+  // profile the same endpoint serves — and on any name it invented, which
+  // `listProfiles` would then pick up on the next boot. Before ADR-067 no
+  // declaration was writable at all, because `profiles/` sat outside `data/`;
+  // this restores that, one prefix per profile.
+  //
+  // `!==` on a whole object rather than a pattern, because Cloud Storage IAM
+  // conditions have no `matches` — see the note on the read binding below.
+  const writable = [
+    objectsUnder(`${layout.audit()}/`),
+    objectsUnder(`${layout.state()}/`),
+    objectsUnder(layout.credentials()),
+    ...profiles.map(
+      (profile) =>
+        `(${objectsUnder(`${layout.profileDir(profile)}/`)} && ` +
+        `${objectIsNot(layout.profileConfig(profile))})`,
+    ),
+  ].join(' || ');
 
   return [
     {
@@ -91,7 +127,7 @@ export function bucketGrants(bucket: string, profiles: readonly string[]): Condi
       // skills are all written by the running endpoint.
       role: 'roles/storage.objectAdmin',
       title: 'owns-its-data',
-      expression: `${objectsUnder('data/')}${manifests ? ` && !${manifests}` : ''}`,
+      expression: `(${writable})`,
     },
     {
       // `expression=true` was here, which is every object in the bucket — the
@@ -110,7 +146,7 @@ export function bucketGrants(bucket: string, profiles: readonly string[]): Condi
       // saw a passing build and Cloud Run saw a container that never started.
       role: 'roles/storage.objectViewer',
       title: 'reads-its-config',
-      expression: `${theBucket} || ${objectsUnder('profiles/')} || ${objectIs(WORKSPACE_FILE)} || ${objectIs(CONNECTIONS_FILE)}${manifests ? ` || ${manifests}` : ''}`,
+      expression: `${theBucket} || ${objectsUnder(`${layout.profilesRoot()}/`)} || ${objectIs(WORKSPACE_FILE)} || ${objectIs(CONNECTIONS_FILE)} || ${manifests}`,
     },
   ];
 }

package/src/deployments/knowledge.ts

@@ -1,7 +1,7 @@
 import type { SecretStore } from '#secrets';
 import type { BlobStore } from '#stores/blobs';
 import type { BlobRoute } from '#stores/blobs/route.ts';
-import { KNOWLEDGE_LAYOUT, knowledgeRoot, type KnowledgeArea, type KnowledgeConfig } from '#profile';
+import { KNOWLEDGE_LAYOUT, KNOWLEDGE_PREFIX, knowledgeRoot, type KnowledgeArea, type KnowledgeConfig } from '#profile';
 import { requireSecret, type TargetInput } from './target.ts';
 import type { FetchLike } from './adapters/github-api.ts';
 // Type-only, so a target with no `knowledge` block never loads the adapter.
@@ -134,10 +134,15 @@ export async function knowledgeStores(
  * how they would come to disagree. `skills` is absent because it is not a
  * prefix of that root — it is a store of its own, handed over whole.
  */
-export function knowledgeRoutes(stores: KnowledgeStores): BlobRoute[] {
+export function knowledgeRoutes(
+  stores: Pick<KnowledgeStores, 'memory' | 'entities'>,
+): BlobRoute[] {
   return [
-    { prefix: `${KNOWLEDGE_LAYOUT.memory}/`, store: stores.memory },
-    { prefix: `${KNOWLEDGE_LAYOUT.entities}/`, store: stores.entities },
+    // The *provider's* prefix, which is what core scopes a store into. The
+    // repository directory it lands in is `KNOWLEDGE_LAYOUT`, and the two are
+    // different strings since contract 4 prefixed the owner layer.
+    { prefix: `${KNOWLEDGE_PREFIX.memory}/`, store: stores.memory },
+    { prefix: `${KNOWLEDGE_PREFIX.entities}/`, store: stores.entities },
   ];
 }