@open-everywhere/core 0.1.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your Exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Tommy Long
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,21 @@
+Open Everywhere
+Copyright 2026 Tommy Long
+
+This product is licensed under the Apache License, Version 2.0 (see LICENSE).
+
+---
+
+Built on Vercel Eve (https://github.com/vercel/eve), licensed under the
+Apache License, Version 2.0.
+
+@open-everywhere/core also ships a patch that modifies Vercel Eve (the file in
+its patches/ directory), with the oe-eve-patch command that applies it to a
+consumer's own installed copy. The patch is licensed under the Apache License,
+Version 2.0. No modified Vercel Eve files are distributed.
+
+---
+
+Open Everywhere is an independent, open-source project. It is NOT affiliated
+with, endorsed by, or sponsored by Anthropic. "Claude", "Claude Code", and
+"Claude Tag" are referenced only to describe the prior art Open Everywhere is
+inspired by, and are trademarks of their respective owner.

package/README.md

@@ -0,0 +1,67 @@
+# @open-everywhere/core
+
+The portable, host-agnostic agent runtime behind Open Everywhere.
+
+Part of [Open Everywhere](https://github.com/open-everywhere/open-everywhere) — an open, self-hostable autonomous teammate you tag where your
+team works. This package is the runtime every deployment loads.
+
+Core owns the parts that do not depend on a chat platform or a host:
+
+- **access and approvals** — the tool consequence table, window and work-grant planes, approval cards
+- **identity** — principals, seats and the member planes
+- **memory** — per-team stores over git, SQLite, Postgres, GitHub or Notion
+- **spend** — the ingress spend gate and the cost reports
+- **routines and webhooks** — scheduled and event-driven wakes
+- **connectors** — host-side connections whose token is attached outside the sandbox
+- **the audit chain** — one row per decision, and the control-plane read route over it
+- **the `oe` roster build** — `oe build` compiles `roster.config.ts` into the generated tables
+
+Each chat surface ships as a separate `@open-everywhere/provider-*` package, and core's registries
+refuse a provider this deployment has not selected. The boundary is a vendor-coupling one, checked
+per provider by `packages/core/scripts/boundary-test.ts`: it names one or more vendor fingerprint
+strings — a host literal, a credential env key or a signature header — then asserts that **at least
+one** of them appears under that provider's package, and that **every** one of them is absent from
+`packages/core/agent`.
+
+It is **not** a rule that core never mentions a platform, and some vendor surface is core's on
+purpose: the source-control plane calls `api.github.com` from core, and the spend plane renders
+Slack's own shortcodes.
+
+## Install
+
+```sh
+npm i @open-everywhere/core eve@0.54.3
+npx oe-eve-patch
+```
+
+**Both commands are required.** Core refuses to boot on an unpatched `eve`. It reads one runtime
+marker for each patch part before the first wake is served, and it throws when a marker is missing.
+A registry `eve` carries no patch, so `npx oe-eve-patch` applies the copy in this tarball. The
+applier is idempotent: a second run on a patched tree changes nothing and exits 0.
+
+`eve` is a peer dependency, and the version above is the pin this package declares as
+`peerDependencies.eve`. Install that exact version yourself. npm can still nest a second `eve` for a
+package that asks for another version. `oe-eve-patch` patches only the copy at
+`<project root>/node_modules/eve`, and the boot check reads only the copy core itself resolves. A
+nested copy is therefore neither patched nor checked, so one resolved, pinned `eve` is your own
+step — run `npm ls eve` and confirm it prints one version. Node 24 or newer.
+
+## Bins
+
+- `oe` — the roster build and the operator commands
+- `oe-eve-patch` — applies the `eve` patch this version pins, which a registry install of `eve`
+  does not carry. It is a required install step, not an optional tool: see § Install.
+
+## Docs
+
+- [Documentation index](https://github.com/open-everywhere/open-everywhere/blob/main/docs/README.md)
+- [Consuming Open Everywhere as packages](https://github.com/open-everywhere/open-everywhere/blob/main/docs/deploy/consuming-as-packages.md)
+
+## Status
+
+Version 0.1.0 is the planned first public version. It is pre-1.0: the API surface is expected to
+change, and a minor release may break you. Pin an exact version.
+
+## Licence
+
+Apache 2.0. The tarball carries `LICENSE` and `NOTICE`.

package/agent/access/access-referenced-link-sets.ts

@@ -0,0 +1,23 @@
+// Collects the link-set ids that ACCESS config names, so a directory auto-confirm into one is suppressed and downgraded to a suggestion the person must still complete. It answers only that question: a link-set-vault-armed deployment reaches a live token through membership alone, which is planDirectorySync's separate blanket input.
+
+import type { Binding } from "./bundle.js";
+import { groupLinkSets, type Group } from "../identity/groups.js";
+import { parseLinkSetRef } from "../identity/link-set-ref.js";
+
+/** Every link-set id referenced by access config — `linkSet:` principal bindings and person-group link-set members. Exact principal-key and `platform/<id>` entries are excluded: a directory sync can change only which accounts a link-set holds. */
+export function accessReferencedLinkSets(input: {
+  readonly bindings?: readonly Binding[];
+  readonly groups?: readonly Group[];
+}): Set<string> {
+  const out = new Set<string>();
+  for (const b of input.bindings ?? []) {
+    if (b.scope.level === "principal" && b.scope.principal !== undefined) {
+      const id = parseLinkSetRef(b.scope.principal);
+      if (id !== undefined) out.add(id);
+    }
+  }
+  for (const g of input.groups ?? []) {
+    for (const id of groupLinkSets(g)) out.add(id);
+  }
+  return out;
+}

package/agent/access/admin-read-venue.ts

@@ -0,0 +1,159 @@
+// The venue fence for org-wide admin memory reads: an ARMED governance channel or the asker's own DM gets the org-wide view, any other room is narrowed to its own domain, and otherwise the answer is redirected with no substance rendered. It only ever REMOVES reach, and membership is never standing.
+
+import { appendAudit } from "../audit/audit.js";
+import { bindFrom, type BindableContext } from "../identity/binding.js";
+import { domainKeyOf, resolvePartition } from "../memory/partition.js";
+import { getConfig } from "./config.js";
+import { domainForChannel, isGovernanceChannel } from "../memory/domain.js";
+import { attestGovernanceChannel, type FloorAttestation } from "./audience-floor.js";
+import { governanceRedirectTarget, PaneRedirectError } from "./pane-venue.js";
+
+/** The `adminControlRoles` role meaning "org admin" (control/auth.ts's ROLE CONVENTION). */
+const ORG_ROLE = "admin";
+const DOMAIN_ROLE_PREFIX = "domain:";
+
+/** Where an admin memory read may answer, and with WHICH roles. */
+export type AdminReadVenue =
+  /** The full org-wide view, rendered in place. */
+  | { readonly placement: "org-wide"; readonly via: "governance-channel" | "requester-dm"; readonly roles: readonly string[] }
+  /** Narrowed to this room's own domain — the answer no longer exceeds the room's scope. */
+  | { readonly placement: "domain-scoped"; readonly domain: string; readonly roles: readonly string[] }
+  /** Nothing this asker holds is sayable here. `channel` is the governance channel, when one exists. */
+  | { readonly placement: "redirect"; readonly target: "governance-channel" | "requester-dm"; readonly channel?: string };
+
+/** The classification inputs — all resolved by the caller, so the core stays pure. */
+export interface AdminReadVenueInput {
+  /** The asker's roles, from the caller's OWN role gate (adminControlRoles). Never re-derived here. */
+  readonly roles: readonly string[];
+  readonly isRequesterDm: boolean;
+  readonly isGovernanceChannel: boolean;
+  /** The governance floor attestation for the asking room (present iff isGovernanceChannel). */
+  readonly attestation?: FloorAttestation;
+  /** The explicit domain this room resolves to (domainForChannel), if any. */
+  readonly roomDomain?: string;
+  /** The configured governance-channel target (governanceChannelFor); undefined ⇒ none configured. */
+  readonly governanceChannel?: string;
+}
+
+/** The pure venue decision: an armed governance channel, then the asker's DM, then this room's explicit domain when the asker administers it, else a redirect. A breached floor is an ordinary room, and step 3 narrows an org admin to exactly `domain:<room>`. */
+export function classifyAdminReadVenue(input: AdminReadVenueInput): AdminReadVenue {
+  if (input.isGovernanceChannel && input.attestation?.armed) {
+    return { placement: "org-wide", via: "governance-channel", roles: input.roles };
+  }
+  if (input.isRequesterDm) {
+    return { placement: "org-wide", via: "requester-dm", roles: input.roles };
+  }
+  const room = input.roomDomain;
+  if (room !== undefined && room.length > 0) {
+    const covers = input.roles.includes(ORG_ROLE) || input.roles.includes(`${DOMAIN_ROLE_PREFIX}${room}`);
+    if (covers) return { placement: "domain-scoped", domain: room, roles: [`${DOMAIN_ROLE_PREFIX}${room}`] };
+  }
+  if (input.governanceChannel) return { placement: "redirect", target: "governance-channel", channel: input.governanceChannel };
+  return { placement: "redirect", target: "requester-dm" };
+}
+
+/** The model-facing copy for a room that may hear nothing this asker holds. Never carries substance. */
+function adminReadRedirectDirective(target: "governance-channel" | "requester-dm", channel: string | undefined, kind: string): string {
+  const where =
+    target === "governance-channel"
+      ? `Ask again in the governance channel ${channel}, or in a DM with me`
+      : "Ask again in a DM with me (or configure a governance domain to give the whole admin team a shared venue)";
+  return (
+    `that's org-wide admin memory output (${kind}) — a map of memory beyond this room's own domain — so it can't be answered here, ` +
+    `whatever standing you hold. ${where}. Reply here only with that pointer, and render NONE of the substance in this channel ` +
+    `(partial disclosure is still disclosure).`
+  );
+}
+
+/** The note a NARROWED answer carries, so the model never presents a partial map as the whole one. */
+function adminReadNarrowedNote(domain: string, target: "governance-channel" | "requester-dm", channel: string | undefined): string {
+  const where = target === "governance-channel" ? `the governance channel ${channel}` : "a DM with me";
+  return (
+    `Narrowed to this room's own domain ("${domain}") — this is NOT the org-wide view, and other domains' silos are omitted. ` +
+    `Say so when you answer, and point at ${where} for the org-wide map.`
+  );
+}
+
+/** Everything the runtime resolution found, so the caller can audit and phrase without re-deriving. */
+interface AdminReadVenueResolution {
+  readonly decision: AdminReadVenue;
+  readonly channelKey: string;
+  readonly principalId?: string;
+  readonly coords: { org: string; platform: string; workspace: string; surface: string };
+  /** The redirect target this room would get, whatever the decision — for the narrowed note's copy. */
+  readonly governanceChannel?: string;
+}
+
+/** Classify this turn's venue for an admin memory read; it never throws and never audits. `principalId` is passed in rather than re-derived, because re-reading the binding could pick a DIFFERENT person from the one whose roles were checked. */
+async function resolveAdminReadVenue(
+  ctx: BindableContext,
+  input: { readonly roles: readonly string[]; readonly principalId?: string },
+): Promise<AdminReadVenueResolution> {
+  const domains = getConfig().loadDomains();
+  const b = bindFrom(ctx);
+  const part = resolvePartition(ctx);
+  const coords = { org: part.org, platform: part.platform, workspace: part.workspace, surface: part.surface };
+
+  // The GOVERNANCE check reads `surfaceKey` — the same grain access/pane-venue.ts uses, and the
+  // fail-CLOSED one: a Discord thread under a governance channel does not itself resolve as the
+  // governance room, so it narrows rather than widening.
+  const isGov = isGovernanceChannel(part.surfaceKey, domains);
+  const attestation = isGov ? await attestGovernanceChannel(part.surfaceKey, domains, { ...coords, principalId: b.principalId }) : undefined;
+  // The ROOM'S DOMAIN reads the DOMAIN grain (`domainKeyOf` — a Discord thread resolves via its
+  // parent channel), matching access/roles.ts's own channelKey. This one may only NARROW, so the
+  // wider grain costs nothing: it decides which single domain the answer is cut down to.
+  const roomDomain = domainForChannel(domainKeyOf(part), domains)?.name;
+  // ONE resolution of the redirect target, shared with access/pane-venue.ts — including its
+  // `OE_ACCESS_ADMIN_CHANNEL` fallback — so both planes always point at the same room.
+  const governanceChannel = governanceRedirectTarget(domains);
+
+  const decision = classifyAdminReadVenue({
+    roles: input.roles,
+    isRequesterDm: b.mode === "dm",
+    isGovernanceChannel: isGov,
+    attestation,
+    roomDomain,
+    governanceChannel,
+  });
+  return { decision, channelKey: part.surfaceKey, principalId: input.principalId, coords, governanceChannel };
+}
+
+/** The venue half of the gate — call it right AFTER the role gate; that composition IS the dual gate. It returns the EFFECTIVE roles the read may spend, always a subset of what was passed in, and throws {@link PaneRedirectError} when the room may hear nothing. */
+export async function requireAdminReadVenue(
+  ctx: BindableContext,
+  input: { readonly roles: readonly string[]; readonly principalId?: string; readonly kind: string },
+): Promise<{ readonly roles: readonly string[]; readonly decision: AdminReadVenue; readonly note?: string }> {
+  const r = await resolveAdminReadVenue(ctx, input);
+  const decision = r.decision;
+  if (decision.placement === "redirect") {
+    await auditAdminReadVenue(r, input.kind);
+    throw new PaneRedirectError(adminReadRedirectDirective(decision.target, decision.channel, input.kind), decision.target, decision.channel);
+  }
+  if (decision.placement === "domain-scoped") {
+    await auditAdminReadVenue(r, input.kind);
+    const target: "governance-channel" | "requester-dm" = r.governanceChannel ? "governance-channel" : "requester-dm";
+    return { roles: decision.roles, decision, note: adminReadNarrowedNote(decision.domain, target, r.governanceChannel) };
+  }
+  return { roles: decision.roles, decision };
+}
+
+/** Stamp the audit row for a fenced admin read. TWO actions, because they are two different events: a redirect renders nothing and reuses pane-venue's `governance.redirected`, while a narrowed read renders real content at a smaller grain and gets its own `governance.narrowed`. */
+async function auditAdminReadVenue(r: AdminReadVenueResolution, kind: string): Promise<void> {
+  const decision = r.decision;
+  if (decision.placement === "domain-scoped") {
+    await appendAudit({
+      ...r.coords,
+      principalId: r.principalId,
+      action: "governance.narrowed",
+      detail: { kind, from: r.channelKey, domain: decision.domain, roles: decision.roles },
+    });
+    return;
+  }
+  if (decision.placement !== "redirect") return; // an org-wide venue fences nothing — nothing to stamp
+  await appendAudit({
+    ...r.coords,
+    principalId: r.principalId,
+    action: "governance.redirected",
+    detail: { kind, from: r.channelKey, to: decision.target, ...(decision.channel ? { channel: decision.channel } : {}) },
+  });
+}

package/agent/access/admin-standing.ts

@@ -0,0 +1,98 @@
+// An admin gate checks the standing of the VERIFIED REQUESTER, not the acting principal, and refuses when it cannot name them; the refusal says the caller could not be verified, never "you are not an admin". One exception: when EVERY candidate asker of a coalesced turn is on the `org` admins roster the answer is identical whichever asked, so the turn is served under a deterministic pick of them.
+// The ACTING principal is the subject on ONE seat only — the `open` seat, which is a per-surface session, a script, or the control plane, and any context the classifier cannot place. Every other seat can be woken by more than one person, so an absent record there refuses rather than falling back to whichever delivery's auth the turn carries.
+
+import { actingPrincipalId, currentTurnId, type BindableContext, type SurfaceBinding } from "../identity/binding.js";
+import { requesterThisTurn, seatServesManyAskers } from "./requester-identity.js";
+import { rosterHasPrincipal } from "../identity/principal-key.js";
+import { criteriaDomain } from "../memory/domain.js";
+import { getConfig } from "./config.js";
+
+export type AdminSubject = { readonly ok: true; readonly principalId: string } | { readonly ok: false; readonly message: string };
+
+/** The refusal when nobody is acting. One string, so an operator meets the same sentence at every
+ *  admin gate (identity/link-tenant.ts's convention). */
+const ADMIN_NO_ACTING_MESSAGE =
+  "No verified sender id on this turn — no acting principal resolved, so there is no caller to check admin standing for.";
+
+/** The reason a turn that left NO requester record at all carries. The capture is best-effort
+ *  (hooks/requester-identity.ts swallows its own failures) and TURN-KEYED (requesterThisTurn drops a
+ *  record another turn wrote), so "no record" is reachable on a live seat and means exactly one
+ *  thing: nothing on this turn says whose ask it is. */
+const ADMIN_NO_RECORD_REASON =
+  "nothing on this turn recorded who asked, and this seat can be woken by more than one person, so the only id left is whichever delivery's auth the turn happens to carry";
+
+/** The remedy for a COALESCED turn: the room settling is what un-coalesces it. */
+const COALESCED_TAIL = "Ask again on its own — in a thread, or once the other work in this room has settled.";
+
+/** The remedy for a MISSING record. Deliberately NOT the coalesced tail: a record that was never
+ *  written does not appear when the room goes quiet, so sending the caller to wait it out is a loop.
+ *  The capture is host-side, so a repeat is an operator's problem, not the asker's. */
+const NO_RECORD_TAIL = "Ask again in a fresh message. If it keeps happening, tell an operator — this one is the host's to fix, not yours.";
+
+/** The refusal when somebody IS acting but the gate cannot tie this turn to their ask. */
+function adminUnverifiedMessage(reason: string, tail: string = COALESCED_TAIL): string {
+  return (
+    `this action needs to know who asked, and this turn cannot say: ${reason}. ` +
+    "Admin standing is checked against the person who asked, never against whoever else this session was serving, so it is refused rather than guessed. " +
+    tail
+  );
+}
+
+/**
+ * WHOSE standing this turn may spend on an admin-only action. Call this instead of
+ * `actingPrincipalId(binding)` anywhere an id is about to be matched against an admin roster.
+ */
+export function adminStandingSubject(binding: SurfaceBinding, ctx?: BindableContext): AdminSubject {
+  // principal-gate: presence — a HUMAN must be here, acting. A fire must NOT satisfy this, whatever
+  // its rendered envelope names, so the ACTING principal is read first and its absence refuses
+  // outright (OPE-269).
+  const acting = actingPrincipalId(binding);
+  if (!acting) return { ok: false, message: ADMIN_NO_ACTING_MESSAGE };
+  // The ctx is passed so the verdict can be TURN-KEYED — see requesterThisTurn. A caller that has
+  // no ctx (the matrix tests) simply gets the unkeyed read, which is what it had before.
+  const requester = requesterThisTurn(ctx === undefined ? undefined : currentTurnId(ctx));
+  if (requester.kind === "requester") return { ok: true, principalId: requester.principalId };
+  if (requester.kind === "unverified") {
+    const shared = sharedOrgAdminSubject(binding, acting, requester.candidates);
+    if (shared !== undefined) return { ok: true, principalId: shared };
+    return { ok: false, message: adminUnverifiedMessage(requester.reason) };
+  }
+  // 🔴 `none` — NO record for this turn, which is NOT the same as "one asker, so the acting
+  // principal is them". requesterVerdictFor already refuses on a `child`, `worker` or `room` seat,
+  // so a `none` HERE means the record is missing or belongs to another turn: the capture threw, or
+  // the tool ran on a turn no `message.received` opened. Serving that under the acting principal is
+  // the OPE-673 escalation itself — a standing seat's auth is one delivery's, and an admin who spoke
+  // on the window earlier is exactly whose id it carries. Only an `open` seat serves ONE asker, so
+  // only there is the acting principal an honest answer. A caller with no ctx (the matrix tests)
+  // keeps the unkeyed read it had before.
+  // 🔴 `seatServesManyAskers`, NOT `requesterSeatOf`: this runs inside a tool's execute, where
+  // `ctx.channel` is absent, so the plain classifier would read every window seat as `open` and this
+  // fence would never fire on the road it exists for.
+  if (ctx !== undefined && seatServesManyAskers(ctx)) return { ok: false, message: adminUnverifiedMessage(ADMIN_NO_RECORD_REASON, NO_RECORD_TAIL) };
+  return { ok: true, principalId: acting };
+}
+
+/** The subject to serve a several-askers turn under when EVERY candidate holds org-admin standing, or `undefined`, which refuses. Fail-closed at every step: fewer than two candidates, no `org` pseudo-domain, an empty roster, one candidate the roster does not admit, or an unreadable config all answer `undefined`. */
+export function sharedOrgAdminSubject(
+  binding: SurfaceBinding,
+  acting: string | undefined,
+  candidates: readonly string[] | undefined,
+): string | undefined {
+  if (candidates === undefined || candidates.length < 2) return undefined;
+  let admins: readonly string[] | undefined;
+  try {
+    admins = criteriaDomain("org", getConfig().loadDomains())?.admins;
+  } catch {
+    return undefined; // no registered config (a unit caller) — decline, never guess
+  }
+  if (admins === undefined || admins.length === 0) return undefined;
+  // 🔴 EXACT-ID, EXACT-WORKSPACE — the same roster primitive access/roles.ts uses, so this rule can
+  // never admit an id shape the ordinary admin gate would reject.
+  for (const id of candidates) {
+    if (!rosterHasPrincipal(admins, binding.platform, binding.workspace, id)) return undefined;
+  }
+  // Deterministic pick. The acting principal is the candidate whose delivery the turn's auth
+  // carries, so it is the most truthful of the equals; the sorted first id is the stable fallback.
+  const sorted = [...candidates].sort();
+  return acting !== undefined && candidates.includes(acting) ? acting : (sorted[0] as string);
+}