@open-everywhere/core 0.1.0

package/agent/access/capabilities.ts

@@ -0,0 +1,11 @@
+// Deployment-pinned security switches: a wide blast-radius capability is never something the running agent can turn on for itself. The switches are NOT uniform — read each one's own doc block for where its authority lives, and each precedence is pinned by a test.
+
+import { SETTINGS, getSettings } from "../settings/settings.js";
+
+/** Is the standing-WINDOW apparatus armed for this deployment? The shipped default is OFF and must stay OFF — it is the default for everyone who clones the repo, and a unified window is a wider data blast radius. A deployment arms it by declaring `window: { topology: true }` in its own `agent/settings.ts`; there is no env route, and the agent has none. */
+export const WINDOW_TOPOLOGY_ENABLED: boolean = SETTINGS.window.topology.shipped;
+
+/** The runtime resolver every window gate calls. Precedence is the deployment's registered settings, then the shipped default, read PER CALL so a settings change takes effect on the next call rather than the next cold start. */
+export function windowTopologyEnabled(): boolean {
+  return getSettings().window.topology;
+}

package/agent/access/chat-dm-grant.ts

@@ -0,0 +1,241 @@
+// Three checks answer three parties: the operator's grant, the domain fence (which proves only that the domain works on that surface, never that a person is in a domain), and the recipient's own stop, which OUTRANKS a live grant. It is a routing and honesty control, not a reach control, and only the FIRST delivery to a person is carded.
+
+import { appendAudit } from "../audit/audit.js";
+import { allowedSurfaceIdsFrom } from "../channels/channel-read.js";
+import { DM_REFUSED_ACTION, dmStoppedRefusalMessage, dmUnreadableRefusalMessage, PERSON_RESOURCE_TYPE, personAddress, readDmAudience } from "../channels/dm-audience.js";
+import { bindFrom, type BindableContext } from "../identity/binding.js";
+import type { Domain } from "../memory/domain.js";
+import { domainKeyOf, resolvePartition } from "../memory/partition.js";
+import { resolveAccessFor } from "./request.js";
+import type { ResourceCapability } from "./resource-capabilities.js";
+import { parseResourceAddress, resourceTypesFor } from "./resource-grant.js";
+
+export { PERSON_RESOURCE_TYPE };
+
+/** One person this session may DM — the parsed form of a granted, in-domain address. */
+export interface ChatDmTarget {
+  readonly platform: string;
+  /** The recipient's bare platform member id — exactly what `deliverDirectMessage` takes. */
+  readonly principalId: string;
+  /** The address exactly as config wrote it — what the card renders and the audit row names. */
+  readonly address: string;
+}
+
+/** Thrown by {@link assertChatDmAllowed}. A distinct class so a call site can tell this refusal apart
+ *  from the transport failures it also has to report. */
+export class ChatDmGrantError extends Error {
+  constructor(
+    readonly platform: string,
+    readonly principalId: string,
+    /** Which check refused: malformed (the model wrote nonsense, so no boundary was crossed), ungranted (no bundle names this person), cross-domain (the domain does not work on that surface), stopped (the RECIPIENT refused, and no operator remedy exists), unreadable (the stop could not be read). unreadable is never folded into stopped: reporting an outage as a person's decision states a fact about them that nobody established. */
+    readonly boundary: "malformed" | "ungranted" | "cross-domain" | "stopped" | "unreadable",
+    message: string,
+  ) {
+    super(message);
+  }
+}
+
+/** Fail closed to no capabilities: an unreadable identity or an unregistered config cannot show a grant, so it holds none. */
+function grantedAddresses(ctx: BindableContext): Readonly<Record<string, readonly ResourceCapability[]>> {
+  try {
+    return resolveAccessFor(ctx).resourceCapabilities;
+  } catch {
+    return {};
+  }
+}
+
+/** The caller's DOMAIN-GRAIN key, not the finer conversation unit surfaceKey names — a roster lists containers, so a raw surface key resolves no domain and hides the platforms the domain really works on. undefined when the ctx carries no identity, which makes every check below fail closed. */
+function callerDomainKey(ctx: BindableContext): string | undefined {
+  try {
+    return domainKeyOf(resolvePartition(ctx));
+  } catch {
+    return undefined;
+  }
+}
+
+/** Reads the SAME roster every chat read is fenced against, so a gate and a fence cannot resolve the domain differently. The caller's own container is seeded into that roster, so a Slack session can DM a granted Slack person; what it cannot do is DM a person on a surface this domain never touches. */
+export function domainWorksOnPlatform(domainKey: string, platform: string, domains: readonly Domain[]): boolean {
+  return allowedSurfaceIdsFrom(domainKey, platform, domains).ids.size > 0;
+}
+
+/** Pure: the caller injects the domain key, the grants and the domains, so the mount, the refusal copy and the test read ONE answer. The stop is deliberately not applied here — folding in a durable read would make the MOUNT depend on it, and the stop is instead read once at execute, closest to the send. */
+export function chatDmTargetsFrom(
+  domainKey: string,
+  granted: Readonly<Record<string, readonly ResourceCapability[]>>,
+  domains: readonly Domain[],
+): readonly ChatDmTarget[] {
+  const worksOn = new Map<string, boolean>();
+  const out: ChatDmTarget[] = [];
+  for (const [address, capabilities] of Object.entries(granted)) {
+    if (!capabilities.includes("dm")) continue;
+    const parsed = parseResourceAddress(address);
+    if (!parsed || parsed.type !== PERSON_RESOURCE_TYPE) continue;
+    // An address naming an unimplemented connector or type is SKIPPED, not thrown on: the loud refusal for that config belongs at load, and by here the only honest answer is that it grants nothing.
+    if (!resourceTypesFor(parsed.connector).includes(parsed.type)) continue;
+    let works = worksOn.get(parsed.connector);
+    if (works === undefined) {
+      works = domainWorksOnPlatform(domainKey, parsed.connector, domains);
+      worksOn.set(parsed.connector, works);
+    }
+    if (!works) continue;
+    out.push({ platform: parsed.connector, principalId: parsed.id, address });
+  }
+  return out.sort((a, b) => a.address.localeCompare(b.address));
+}
+
+/** {@link chatDmTargetsFrom} bound to a live session. Both resolutions fail closed to nothing. */
+export function chatDmTargets(ctx: BindableContext, domains: readonly Domain[]): readonly ChatDmTarget[] {
+  const domainKey = callerDomainKey(ctx);
+  if (!domainKey) return [];
+  return chatDmTargetsFrom(domainKey, grantedAddresses(ctx), domains);
+}
+
+/** ABSENCE OVER REFUSAL: a session with no grant must never see the verb, because a mounted-but-impossible tool produces a false capability claim in a reply. The domains thunk is lazy because a session.started resolver can run before the app config is registered, and any throw inside is a refusal. */
+export function chatDmMount(ctx: BindableContext, domains: () => readonly Domain[]): boolean {
+  try {
+    return chatDmTargets(ctx, domains()).length > 0;
+  } catch {
+    return false;
+  }
+}
+
+/** Returns the resolved target so the caller freezes exactly what the fence admitted, never a second parse of the model's string. The two refusals carry different messages because the remedies are different files: an ungranted person needs a bundle row, a cross-domain one needs the domain's own roster. */
+export function resolveChatDmTargetFrom(
+  domainKey: string | undefined,
+  granted: Readonly<Record<string, readonly ResourceCapability[]>>,
+  domains: readonly Domain[],
+  requested: string,
+): ChatDmTarget {
+  const parsed = parseResourceAddress(requested);
+  if (!parsed) {
+    throw new ChatDmGrantError(
+      // No platform can be named: the string did not parse, so there is nothing to name. The audit
+      // row stamps the CALLER's own platform instead of this placeholder — see auditChatDmRefusal.
+      "",
+      requested,
+      "malformed",
+      `"${requested}" is not a person address — write \`<connector>:${PERSON_RESOURCE_TYPE}/<id>\`, e.g. ` +
+        `${personAddress("slack", "U0123ABC")}.`,
+    );
+  }
+  const target =
+    domainKey === undefined ? undefined : chatDmTargetsFrom(domainKey, granted, domains).find((t) => t.address === requested);
+  if (target) return target;
+
+  const worksOnPlatform = domainKey !== undefined && domainWorksOnPlatform(domainKey, parsed.connector, domains);
+  if (worksOnPlatform) {
+    throw new ChatDmGrantError(
+      parsed.connector,
+      parsed.id,
+      "ungranted",
+      `direct-messaging ${parsed.connector} person "${parsed.id}" is not granted to this scope. This session works on ` +
+        `${parsed.connector}, so the remedy is one config line: add ${JSON.stringify(requested)} to a bound bundle's ` +
+        `\`resourceGrants\` (access/resource-grant.ts). Nobody is DMed by presence alone.`,
+    );
+  }
+  throw new ChatDmGrantError(
+    parsed.connector,
+    parsed.id,
+    "cross-domain",
+    `direct-messaging ${parsed.connector} person "${parsed.id}" is refused: this session's memory domain declares no ` +
+      `${parsed.connector} container, so it does not work on that surface at all. A grant cannot reach a surface the ` +
+      `domain does not hold. The remedy is to give that domain a ${parsed.connector} container in its \`reach\` ` +
+      `(memory/config/domains/<domain>.ts), which is a reviewed config change, and then grant the person.`,
+  );
+}
+
+function resolveChatDmTarget(ctx: BindableContext, domains: readonly Domain[], requested: string): ChatDmTarget {
+  return resolveChatDmTargetFrom(callerDomainKey(ctx), grantedAddresses(ctx), domains, requested);
+}
+
+/** What {@link assertChatDmAllowed} admitted — the target plus the fact that decides whether this
+ *  delivery cards or flows. */
+export interface AdmittedChatDm {
+  readonly target: ChatDmTarget;
+  /** A proactive DM has ALREADY landed on this person under this grant, so this one flows. False on the first delivery, which is consequential and takes the approval card. */
+  readonly delivered: boolean;
+}
+
+/**
+ * Runs the pure grant and domain checks first, then the recipient's stop. The stop is checked LAST and always, which is what keeps it from leaking the existence of a grant: a caller with no grant is refused ungranted whether or not that person ever stopped anything.
+ * 🔴 THIS READ IS NOT THE CONTROL, AND MUST NEVER BE TREATED AS ONE (OPE-1855). It runs at the tool call, which on the carded arm is minutes or hours before the send; `deliverProactiveDm` reads the stop again at the send, on every plane, and THAT read is what a person's stop actually rests on. What this one buys is a refusal the seat can explain in the room, and the carded/flowing answer the caller needs before it proposes anything.
+ */
+export async function assertChatDmAllowed(
+  ctx: BindableContext,
+  domains: readonly Domain[],
+  requested: string,
+): Promise<AdmittedChatDm> {
+  let target: ChatDmTarget;
+  try {
+    target = resolveChatDmTarget(ctx, domains, requested);
+  } catch (err) {
+    if (err instanceof ChatDmGrantError) await auditChatDmRefusal(ctx, err);
+    throw err;
+  }
+  const org = orgOf(ctx);
+  const audience = await readDmAudience(org, target.address);
+  if (!audience.readable) {
+    // The store did not answer. Suppress — but NEVER as the person's decision: see the `unreadable`
+    // arm of ChatDmGrantError's `boundary` doc.
+    const refusal = new ChatDmGrantError(
+      target.platform,
+      target.principalId,
+      "unreadable",
+      dmUnreadableRefusalMessage(target.platform, target.principalId),
+    );
+    await auditChatDmRefusal(ctx, refusal);
+    throw refusal;
+  }
+  if (audience.stopped) {
+    const refusal = new ChatDmGrantError(
+      target.platform,
+      target.principalId,
+      "stopped",
+      dmStoppedRefusalMessage(target.platform, target.principalId),
+    );
+    await auditChatDmRefusal(ctx, refusal);
+    throw refusal;
+  }
+  return { target, delivered: audience.delivered };
+}
+
+/** The caller's org, or the empty string when the ctx carries no identity — which makes the audience
+ *  read fail closed (an org nobody wrote a row under has no delivery record, so the DM cards). */
+function orgOf(ctx: BindableContext): string {
+  try {
+    return resolvePartition(ctx).org;
+  } catch {
+    return "";
+  }
+}
+
+/** The refusal row. NEVER throws — an audit failure must not turn one refusal into a different error,
+ *  nor unwind before the throw the caller owes (auditChannelReadRefusal's own contract). */
+async function auditChatDmRefusal(ctx: BindableContext, refusal: ChatDmGrantError): Promise<void> {
+  try {
+    const partition = resolvePartition(ctx);
+    const principalId = bindFrom(ctx).principalId;
+    // workspace and surface name the ROW'S SUBJECT, never a foreign caller; platform is the REFUSED person's platform, which on a unified window need not be the caller's. A malformed refusal names no platform, so that row is filed under the caller's own platform, the only true fact available.
+    const platform = refusal.boundary === "malformed" ? partition.platform : refusal.platform;
+    const foreignCaller = partition.platform !== platform;
+    await appendAudit({
+      org: partition.org,
+      platform,
+      workspace: foreignCaller ? "unknown" : partition.workspace,
+      surface: foreignCaller ? "unknown" : partition.surface,
+      ...(principalId ? { principalId } : {}),
+      action: DM_REFUSED_ACTION,
+      // Measured facts only, and no message body: the fence runs before anything is sent.
+      detail: {
+        target: refusal.principalId,
+        boundary: refusal.boundary,
+        callerSurfaceKey: partition.surfaceKey,
+        // The key the FENCE read (OPE-1106) — carried only when it differs, the same positive-only
+        // rule access/chat-write-grant.ts's row follows, and for the same reason.
+        ...(domainKeyOf(partition) === partition.surfaceKey ? {} : { callerDomainKey: domainKeyOf(partition) }),
+      },
+    });
+  } catch (err) {
+    console.warn(`[open-everywhere:audit] dm.refused row was not written: ${String(err)}`);
+  }
+}

package/agent/access/chat-write-grant.ts

@@ -0,0 +1,194 @@
+// May this session post into a container other than the one its turn arrived in? Both checks bind — the address must carry the `post` capability and the target must be in the caller's own memory domain, read at the DOMAIN-GRAIN key — and this is a routing control, not a reach control: the bot tokens are static.
+
+import { appendAudit } from "../audit/audit.js";
+import { allowedSurfaceIdsFrom } from "../channels/channel-read.js";
+import { bindFrom, type BindableContext } from "../identity/binding.js";
+import type { Domain } from "../memory/domain.js";
+import { domainKeyOf, resolvePartition } from "../memory/partition.js";
+import { resolveAccessFor } from "./request.js";
+import type { ResourceCapability } from "./resource-capabilities.js";
+import { parseResourceAddress, resourceAddress, resourceTypesFor } from "./resource-grant.js";
+
+export const CONTAINER_RESOURCE_TYPE = "channel";
+
+/** One target this session may post into — the parsed form of a granted, in-domain address. */
+export interface ChatWriteTarget {
+  readonly platform: string;
+  readonly container: string;
+  /** The address exactly as config wrote it — what the card renders and the audit row names. */
+  readonly address: string;
+}
+
+/** Thrown by {@link assertChatWriteAllowed}. A distinct class so a call site can tell this refusal
+ *  apart from the transport failures it also has to report. */
+export class ChatWriteGrantError extends Error {
+  constructor(
+    readonly platform: string,
+    readonly container: string,
+    /** Which check refused. `malformed` is kept apart from `ungranted` because a malformed address crossed no boundary at all; folding them would file a model typo in the audit log as a refused grant attempt. */
+    readonly boundary: "malformed" | "ungranted" | "cross-domain",
+    message: string,
+  ) {
+    super(message);
+  }
+}
+
+/** This scope's resolved per-address capabilities. FAIL CLOSED to none: `resolveAccessFor` throws
+ *  when no app config is registered or the ctx carries no identity, and on this plane both mean the
+ *  same thing — we cannot show the caller holds a grant, so it holds none. */
+function grantedAddresses(ctx: BindableContext): Readonly<Record<string, readonly ResourceCapability[]>> {
+  try {
+    return resolveAccessFor(ctx).resourceCapabilities;
+  } catch {
+    return {};
+  }
+}
+
+/** The caller's own fully-qualified DOMAIN-GRAIN key — the CONTAINER a domain roster can list, not
+ *  the finer conversation/thread unit `surfaceKey` names (see this file's header, OPE-1106).
+ *  `undefined` when the ctx carries no identity, which makes every check below fail closed. */
+function callerDomainKey(ctx: BindableContext): string | undefined {
+  try {
+    return domainKeyOf(resolvePartition(ctx));
+  } catch {
+    return undefined;
+  }
+}
+
+/** The pure decision: the grant set intersected with the caller's own domain roster, sorted by address. It EXCLUDES the arrival container unless a grant names it, and an address naming an unimplemented connector or type is skipped rather than thrown on. */
+export function chatWriteTargetsFrom(
+  domainKey: string,
+  granted: Readonly<Record<string, readonly ResourceCapability[]>>,
+  domains: readonly Domain[],
+): readonly ChatWriteTarget[] {
+  const rosterByPlatform = new Map<string, Set<string>>();
+  const out: ChatWriteTarget[] = [];
+  for (const [address, capabilities] of Object.entries(granted)) {
+    if (!capabilities.includes("post")) continue;
+    const parsed = parseResourceAddress(address);
+    if (!parsed || parsed.type !== CONTAINER_RESOURCE_TYPE) continue;
+    if (!resourceTypesFor(parsed.connector).includes(parsed.type)) continue;
+    let roster = rosterByPlatform.get(parsed.connector);
+    if (!roster) {
+      roster = allowedSurfaceIdsFrom(domainKey, parsed.connector, domains).ids;
+      rosterByPlatform.set(parsed.connector, roster);
+    }
+    if (!roster.has(parsed.id)) continue;
+    out.push({ platform: parsed.connector, container: parsed.id, address });
+  }
+  return out.sort((a, b) => a.address.localeCompare(b.address));
+}
+
+/** {@link chatWriteTargetsFrom} bound to a live session. Both resolutions fail closed to nothing —
+ *  an unreadable identity or an unregistered config cannot show a grant, so there is none. */
+export function chatWriteTargets(ctx: BindableContext, domains: readonly Domain[]): readonly ChatWriteTarget[] {
+  const domainKey = callerDomainKey(ctx);
+  if (!domainKey) return [];
+  return chatWriteTargetsFrom(domainKey, grantedAddresses(ctx), domains);
+}
+
+/** The mount predicate, ABSENCE OVER REFUSAL: a session with no grant must never see the verb, because a mounted-but-impossible tool is a false capability claim. The `domains` thunk is lazy because a `session.started` resolver can run before config is registered, and any throw inside is a refusal. */
+export function chatWriteMount(ctx: BindableContext, domains: () => readonly Domain[]): boolean {
+  try {
+    return chatWriteTargets(ctx, domains()).length > 0;
+  } catch {
+    return false;
+  }
+}
+
+/** The per-call fence: it returns the resolved target so the caller freezes exactly what the fence admitted, never a second parse of the model's string. The two refusals are deliberately different messages, because the remedies are different files. */
+export function resolveChatWriteTargetFrom(
+  domainKey: string | undefined,
+  granted: Readonly<Record<string, readonly ResourceCapability[]>>,
+  domains: readonly Domain[],
+  requested: string,
+): ChatWriteTarget {
+  const parsed = parseResourceAddress(requested);
+  if (!parsed) {
+    throw new ChatWriteGrantError(
+      // No platform can be named: the string did not parse, so there is nothing to name. The audit
+      // row stamps the CALLER's own platform instead of this placeholder — see auditChatWriteRefusal.
+      "",
+      requested,
+      "malformed",
+      `"${requested}" is not a container address — write \`<connector>:${CONTAINER_RESOURCE_TYPE}/<id>\`, e.g. ` +
+        `${resourceAddress("slack", CONTAINER_RESOURCE_TYPE, "C0123ABC")}.`,
+    );
+  }
+  const target =
+    domainKey === undefined ? undefined : chatWriteTargetsFrom(domainKey, granted, domains).find((t) => t.address === requested);
+  if (target) return target;
+
+  const inDomain =
+    domainKey !== undefined && allowedSurfaceIdsFrom(domainKey, parsed.connector, domains).ids.has(parsed.id);
+  if (inDomain) {
+    throw new ChatWriteGrantError(
+      parsed.connector,
+      parsed.id,
+      "ungranted",
+      `posting to ${parsed.connector} container "${parsed.id}" is not granted to this scope. The container is in this ` +
+        `session's memory domain, so the remedy is one config line: add ${JSON.stringify(requested)} to a bound ` +
+        `bundle's \`resourceGrants\` (access/resource-grant.ts).`,
+    );
+  }
+  throw new ChatWriteGrantError(
+    parsed.connector,
+    parsed.id,
+    "cross-domain",
+    `posting to ${parsed.connector} container "${parsed.id}" is refused: it is not in this session's memory domain. ` +
+      `The agent may only post in containers its own domain declares — a grant cannot reach across domains. ` +
+      `The remedy is to add the container to that domain's \`reach\` in memory/config/domains/<domain>.ts, which is a reviewed ` +
+      `config change, and then grant it.`,
+  );
+}
+
+export function resolveChatWriteTarget(
+  ctx: BindableContext,
+  domains: readonly Domain[],
+  requested: string,
+): ChatWriteTarget {
+  return resolveChatWriteTargetFrom(callerDomainKey(ctx), grantedAddresses(ctx), domains, requested);
+}
+
+/** Assert the requested target is postable, else audit the refusal and throw. The row states measured facts only — which boundary refused, the target, and the caller's own surface — and never a message body. */
+export async function assertChatWriteAllowed(
+  ctx: BindableContext,
+  domains: readonly Domain[],
+  requested: string,
+): Promise<ChatWriteTarget> {
+  try {
+    return resolveChatWriteTarget(ctx, domains, requested);
+  } catch (err) {
+    if (err instanceof ChatWriteGrantError) await auditChatWriteRefusal(ctx, err);
+    throw err;
+  }
+}
+
+/** The refusal row. NEVER throws — an audit failure must not turn one refusal into a different
+ *  error, nor unwind before the throw the caller owes (auditChannelReadRefusal's own contract). */
+async function auditChatWriteRefusal(ctx: BindableContext, refusal: ChatWriteGrantError): Promise<void> {
+  try {
+    const partition = resolvePartition(ctx);
+    const principalId = bindFrom(ctx).principalId;
+    // `workspace` and `surface` name the row's own subject, never a foreign caller: a caller on another platform is stamped "unknown" rather than under a platform it does not belong to. A `malformed` refusal names no platform, so the row is filed under the caller's own.
+    const platform = refusal.boundary === "malformed" ? partition.platform : refusal.platform;
+    const foreignCaller = partition.platform !== platform;
+    await appendAudit({
+      org: partition.org,
+      platform,
+      workspace: foreignCaller ? "unknown" : partition.workspace,
+      surface: foreignCaller ? "unknown" : partition.surface,
+      ...(principalId ? { principalId } : {}),
+      action: "chat.post_refused",
+      detail: {
+        target: refusal.container,
+        boundary: refusal.boundary,
+        callerSurfaceKey: partition.surfaceKey,
+        // The key the FENCE actually read, carried only when it differs from the surface key. On Teams and on a Discord thread the two are different strings, and a cross-domain row is unreadable without it.
+        ...(domainKeyOf(partition) === partition.surfaceKey ? {} : { callerDomainKey: domainKeyOf(partition) }),
+      },
+    });
+  } catch (err) {
+    console.warn(`[open-everywhere:audit] chat.post_refused row was not written: ${String(err)}`);
+  }
+}

package/agent/access/config.ts

@@ -0,0 +1,132 @@
+// The registry that lets core read deployer-owned config without importing it: the app calls registerConfig() at startup and core reads it through getConfig(). See docs/core-app-separation.md.
+
+import type { Bundle, Binding } from "./bundle.js";
+import { defaultConnectorOpTierArm, type ConnectorOpTierArm } from "./consequence.js";
+import type { ResultReduceSeam } from "./result-reduce.js";
+import type { WakeArmAnswer, WakeArmInput } from "../channels/wake-arm.js";
+import type { ConnectorCredentials } from "./connector-credentials.js";
+import type { NetworkAccessBinding } from "./network-access.js";
+import type { AgentsFile } from "../memory/agents-codemod.js";
+import type { PluginRegistry } from "../plugins/types.js";
+import type { SkillPackageDefinition } from "eve/skills";
+import type { Domain } from "../memory/domain.js";
+import type { MemorySilo } from "../memory/silo.js";
+import type { Role } from "../roles/role.js";
+import type { WebhookHook } from "../webhooks/config.js";
+import type { SpendBudgets } from "../spend/spend.js";
+import type { SpendCheckpoints } from "../spend/checkpoint.js";
+import type { ModelPolicy } from "../model/policy.js";
+import type { BlobHostingConfig } from "../blob/hosting.js";
+import type { Principal } from "../identity/principals.js";
+import type { Group } from "../identity/groups.js";
+
+/** The access-request flow's knobs. FAIL-CLOSED: `request_access` refuses unless BOTH `adminChannel` and `configRepo` are set; `baseBundles`/`baseBindings` are the code-only baseline for pre-PR re-validation. */
+export interface AccessRequestsConfig {
+  readonly adminChannel?: string;
+  /** The config repo the bot-PR targets ("owner/repo") — normally this deployment's own. */
+  readonly configRepo?: string;
+  /** Base branch the request branch cuts from / the PR merges into. Default "main". */
+  readonly configBase?: string;
+  /** Repo-relative path of the grants overlay. Default "agent/access/grants.generated.ts". */
+  readonly grantsPath?: string;
+  /** Repo-relative path of the webhook-hooks overlay. Default "agent/webhooks/hooks.generated.ts". */
+  readonly hooksPath?: string;
+  /** Repo-relative path of the agents overlay. Default "agent/memory/config/agents.generated.ts". */
+  readonly agentsPath?: string;
+  /** Repo-relative path of the person-group overlay. Default "agent/identity/groups.generated.ts"; it arms on `configRepo` alone, since the group delivery posts no admin-channel notice. */
+  readonly groupsPath?: string;
+  /** The code-declared webhook baseline (hooks overlay excluded) that the hook-declaration PR path merges a candidate overlay into for pre-PR re-validation. Absent: this deployment cannot declare hooks from chat (fail-closed). */
+  baseWebhooks?(): readonly WebhookHook[];
+  /** The code-declared agents baseline (agents overlay excluded) for the create_agent path's pre-PR re-validation. Absent: this deployment cannot create agents from chat (fail-closed). */
+  baseAgents?(): AgentsFile;
+  /** The code-declared domain and silo baseline for the create_agent path's pre-PR re-validation of the memory half. Optional and fail-soft: absent validates the candidate overlay against an empty baseline alone. */
+  baseDomains?(): readonly Domain[];
+  baseSilos?(): readonly MemorySilo[];
+  /** Test/e2e mode: execute() validates + reports what WOULD happen, zero network. */
+  readonly dryRun?: boolean;
+  baseBundles(): readonly Bundle[];
+  baseBindings(): readonly Binding[];
+  /** The MERGED memory-domain registry, including generated agents: a domain binding is checked against what the deployment currently resolves. Absent makes a domain-scoped access request fail closed before opening a PR. */
+  domainRegistry?(): readonly Domain[];
+  /** The MERGED person-group registry, not a code-only baseline: a group binding is checked against what the deployment resolves. Absent SKIPS the existence check rather than faking one. */
+  groupRegistry?(): readonly Group[];
+  /** The code-only credential-catalogue baseline (bindings overlay excluded) for the binding-PR path's pre-PR re-validation. Absent: binding PRs fail-safe skip. */
+  baseConnectorCredentials?(): readonly ConnectorCredentials[];
+}
+
+export interface AppConfig {
+  loadBundles(): readonly Bundle[];
+  loadBindings(): readonly Binding[];
+  /** The CONNECTOR CREDENTIAL CATALOGUES (one per connector: its credentials + the type allowlist).
+   *  Optional — absent/empty means NO connector grant resolves, because since OPE-591 every grant
+   *  names a credential and a credential with no catalogue cannot be found. Fail-closed. */
+  loadConnectorCredentials?(): readonly ConnectorCredentials[];
+  /** Per-scope network-access LEVEL bindings, resolved narrowest-wins like every other scoped grant. Absent or empty means every scope resolves DEFAULT_NETWORK_ACCESS_LEVEL ("none"). */
+  loadNetworkAccess?(): readonly NetworkAccessBinding[];
+  readonly pluginRegistry: PluginRegistry;
+  readonly skillContent: Record<string, SkillPackageDefinition>;
+  /** Per-session files for a granted skill, keyed by skill name. The skills resolver (skills/scoped.ts)
+   *  calls the function with the session's own surface on every resolve and writes the result beside
+   *  that skill's package, so a script can learn where the conversation is without the wake envelope
+   *  naming it. The function must return the same file names on every call: the sandbox overwrites a
+   *  file but never deletes one, so a file that appears only on some surfaces goes stale. */
+  readonly skillSessionFiles?: Readonly<Record<string, (where: { readonly platform: string; readonly surface: string }) => Record<string, string>>>;
+  /** Memory domains — the anchors of the opt-in memory model, including the optional org / public / dm criteria pseudo-domains. */
+  loadDomains(): readonly Domain[];
+  loadSilos(): readonly MemorySilo[];
+  /** Role presets referenced by domains via `role:`. Absent or empty means no role rungs or prompt blocks resolve; register the whole role library even while no domain references one. */
+  loadRoles?(): readonly Role[];
+  /** Domain names a surface belongs to (≤1 under exclusivity) — for domain-scoped access bindings. */
+  domainsForSurface(arg: { workspaceKey: string; surface: string }): readonly string[];
+  /** The webhook-trigger registry. Absent or empty means every `POST /webhooks/<id>` 404s. */
+  loadWebhooks?(): readonly WebhookHook[];
+  /** The operator's optional NARROWING over which webhook source classes a hook may name; absent admits every source with a verifier and a normalizer. It narrows BOTH the declarable and the mintable set, never widens. */
+  loadWebhookSources?(): readonly string[] | undefined;
+  /** Token and/or USD caps per scope, enforced at every new-spend origin. Absent or empty means UNCAPPED. */
+  loadSpendBudgets?(): SpendBudgets;
+  /** Per-session SOFT spend thresholds that pause consequential actions and ask a human. Absent or empty means no checkpoints; reads and replies are never paused, only gate:member tools. */
+  loadSpendCheckpoints?(): SpendCheckpoints;
+  /** Access-request flow config. Absent or incomplete means the `request_access` tool refuses politely (fail-closed) and the flow is not enabled. */
+  loadAccessRequests?(): AccessRequestsConfig | null;
+  /** The org's model allow-list, reasoning-effort ceiling and provider deny-list. Absent means fully permissive. */
+  loadModelPolicy?(): ModelPolicy | undefined;
+  /** The org opt-in for publishing an HTML artifact to a world-readable Blob URL. Absent means OFF and post_file attaches the raw bytes instead; the public write stays approval-gated. */
+  loadBlobHosting?(): BlobHostingConfig | undefined;
+  /** The cross-surface principals map. Absent or empty means every account stays a distinct per-surface identity; accounts are never merged on name similarity, and the map is validated fail-closed at load. */
+  loadPrincipals?(): readonly Principal[];
+  /** The person-group registry. Absent or empty means no group membership resolves, so a `group` binding grants nothing, and a binding naming an undeclared group is refused. */
+  loadGroups?(): readonly Group[];
+  /** The audit-scrub arm; its absence is the shipped built-in. The seam runs the built-in before and after it, so no SECRET_SHAPES span survives, but nothing else is enforced and a throwing arm keeps the built-in result. */
+  auditScrub?(text: string): string;
+
+  /** The connector-op tiering arm; registerConfig fills the slot with defaultConnectorOpTierArm, so it is never empty. An arm may raise freely and lower only to `write` — floored in connectorOpTierParts — and must be pure, synchronous and memoised. */
+  connectorOpTier?: ConnectorOpTierArm;
+
+  /** The result-reducing arm; its absence is the built-in truncation. It is consulted only when `body.length > limit`, its answer is re-capped by capResult, and every abstention, throw or timeout keeps the built-in result. */
+  reduceResult?(
+    body: string,
+    limit: number,
+    ctx: { readonly source: ResultReduceSeam; readonly toolName?: string },
+  ): string | undefined | Promise<string | undefined>;
+
+  /** The wake arm; its absence wakes on a name-drop alone. An arm can only ADD a wake, runs only where the built-in abstained on an offering surface, and is consulted BEFORE the spend gate and the external-participant policy. */
+  decideWake?(input: WakeArmInput): WakeArmAnswer | undefined | Promise<WakeArmAnswer | undefined>;
+}
+
+let registered: AppConfig | null = null;
+
+/** Register the app's config; called once at startup (instrumentation.ts) and in test setup. A config that supplies no `connectorOpTier` is registered carrying defaultConnectorOpTierArm; every other member passes through untouched. */
+export function registerConfig(config: AppConfig): void {
+  registered = config.connectorOpTier === undefined ? { ...config, connectorOpTier: defaultConnectorOpTierArm } : config;
+}
+
+/** The registered app config. Throws when nothing has registered — fail-loud, rather than a silent empty config that would quietly deny everything. */
+export function getConfig(): AppConfig {
+  if (!registered) {
+    throw new Error(
+      "open-everywhere: app config not registered. The app must call registerConfig() at " +
+        "startup (agent/instrumentation.ts); tests must import the shared config bootstrap.",
+    );
+  }
+  return registered;
+}

package/agent/access/connector-content-origin-state.ts

@@ -0,0 +1,72 @@
+// Carries each connection's DECLARED content origin from the access resolve to the model-call seam, which has no ctx of its own. Keyed per CONNECTION and then per tool, so one bundle's vouch can never decide another bundle's connector. Fail-closed everywhere: an unstamped session, a context-less caller or an undeclared connector all answer `undefined`, which can never produce a `trusted` verdict config did not write.
+
+import { defineState } from "eve/context";
+import { contentOriginForTool, type ConnectorContentOrigin, type ConnectorContentOriginSpec } from "./bundle.js";
+
+/** connection name → the content origin its grant DECLARED (a scalar, or per-tool grain). Sparse: a
+ *  connector that declared nothing is ABSENT, never present-as-external (see access/resolver.ts's
+ *  `connectorContentOrigin` doc). */
+export type ConnectorContentOriginMap = Readonly<Record<string, ConnectorContentOriginSpec>>;
+
+const connectorContentOriginSlot = defineState<ConnectorContentOriginMap>("open-everywhere.connector-content-origin", () => ({}));
+
+/** Record the declared connector content origins for the wake in flight, stamped from the same resolve that audits the grant set so the two cannot disagree. CLEAR-FIRST: pass `{}` before anything can throw, so a failed resolve inherits no declaration. Fail-soft outside an eve context. */
+export function setConnectorContentOrigin(declared: ConnectorContentOriginMap): void {
+  try {
+    connectorContentOriginSlot.update(() => declared);
+  } catch {
+    /* no eve context — nothing to stamp; every read below then answers `undefined` (fail-closed) */
+  }
+}
+
+/** The whole stamped map for the wake in flight; `{}` for every context-less caller. */
+function currentConnectorContentOrigin(): ConnectorContentOriginMap {
+  try {
+    return connectorContentOriginSlot.get();
+  } catch {
+    return {};
+  }
+}
+
+/** What THIS connection's grant declared, as written (scalar or per-tool), or `undefined`. `undefined` means the operator has not declared, never that they declared external. */
+export function declaredContentOriginForConnection(connection: string): ConnectorContentOriginSpec | undefined {
+  return currentConnectorContentOrigin()[connection];
+}
+
+/** The declared content origin for a qualified connector tool name (`<connection>__<tool>`). Match the LONGEST declared connection prefix, never the first `__` — a slug may itself contain one — then consult only that connection's own `except` map; `connection_search` never matches by NAME, because its result aggregates several connections — `declaredContentOriginForConnectionSearch` reads the result instead. */
+export function declaredContentOriginForToolName(toolName: string): ConnectorContentOrigin | undefined {
+  const declared = currentConnectorContentOrigin();
+  let best: string | undefined;
+  for (const name of Object.keys(declared)) {
+    if (!toolName.startsWith(`${name}__`)) continue;
+    if (best === undefined || name.length > best.length) best = name;
+  }
+  if (best === undefined) return undefined;
+  return contentOriginForTool(declared[best]!, toolName.slice(best.length + 2));
+}
+
+/**
+ * The declared content origin for one `connection_search` RESULT. The name cannot answer, because one result aggregates several connections, so each row answers with its OWN connection's declaration for the tool it describes, and the result is only as trusted as its least-trusted row: `internal` when every discovered-tool row resolves `internal`, `external` when a row resolves `external`, otherwise `undefined`.
+ * Fail-closed: a result this cannot decompose, a row that names no connection, a connection that declared nothing and a result with no discovered tool all answer `undefined`, which the table reads as the ruled default. An eve-authored status row (`error` / `needsAuthorization`, no tool) adds nothing, as it does not taint on its own.
+ */
+export function declaredContentOriginForConnectionSearch(output: unknown): ConnectorContentOrigin | undefined {
+  if (!Array.isArray(output) || output.length === 0) return undefined;
+  let sawTool = false;
+  let sawExternal = false;
+  for (const el of output) {
+    if (el === null || typeof el !== "object") return undefined;
+    const row = el as Record<string, unknown>;
+    const isToolRow = "tool" in row || "qualifiedName" in row;
+    if (!isToolRow) {
+      if (typeof row.error === "string" || row.needsAuthorization === true) continue;
+      return undefined;
+    }
+    if (typeof row.connection !== "string" || typeof row.tool !== "string") return undefined;
+    const spec = declaredContentOriginForConnection(row.connection);
+    if (spec === undefined) return undefined;
+    sawTool = true;
+    if (contentOriginForTool(spec, row.tool) === "external") sawExternal = true;
+  }
+  if (!sawTool) return undefined;
+  return sawExternal ? "external" : "internal";
+}