@open-everywhere/core 0.1.0

package/agent/contributions.ts

@@ -0,0 +1,197 @@
+// THE CONTRIBUTION MANIFEST for `@open-everywhere/core` (OPE-375) — the curated
+// catalogue of everything this package OFFERS an app's eve slot tree. `oe build` reads it;
+// the app's `roster.config.ts` decides about it, and `roster.lock.json` records the review.
+//
+// 🔴 CURATED, NOT SCANNED, AND THAT IS MEASURED RATHER THAN STYLISTIC. A directory scan cannot
+// enumerate contributions: core ships 47 files under `agent/channels/` of which 9 are channels, and
+// 13 under `agent/connections/` of which 1 is a connection. Shape predicates do not rescue it either
+// — only 8 of the 9 mounted core channels contain `defineChannel(`. A hand-kept list is the only
+// honest catalogue, so keeping it current is a real authoring duty (`npm run lint:contributions`
+// scan-compares the two kinds where a predicate IS sound — tools and hooks — and says plainly that
+// the other four are unguarded).
+//
+// 🔴 THIS FILE IMPORTS NOTHING, DELIBERATELY. A provider bundle may reach core only through the
+// `@open-everywhere/core/agent/adapter-api.js` barrel (the boundary lock, packages/core/scripts/
+// boundary-test.ts), so a manifest that imported its own types would be a boundary red — and
+// widening the barrel to admit a build-time type would be the wrong fix. Every manifest is therefore
+// import-free DATA whose shape `roster-plan.ts` validates at build time, exactly as it must for a
+// third-party package it has never seen. The types are in
+// `@open-everywhere/core/agent/scaffold/roster-config.js` for READERS.
+//
+// ERASABLE SYNTAX ONLY (no `enum`, no `namespace`) — `oe build` loads this with a bare import.
+
+export const CONTRIBUTIONS = {
+  schemaVersion: 1,
+  package: "@open-everywhere/core",
+  contributions: [
+    // ── tools ────────────────────────────────────────────────────────────────────────────────────
+    { kind: "tool", name: "add_label", module: "agent/tools/add_label.js", summary: "Add a label to a ticket — a Linear issue or a GitHub issue/PR." },
+    { kind: "tool", name: "add_routine_rule", module: "agent/tools/add_routine_rule.js", summary: "PROPOSE a standing rule for ONE routine — a short instruction every future run of that routine must follow, e.g." },
+    { kind: "tool", name: "agent_version", module: "agent/tools/agent_version.js", summary: "State which version of this agent is currently running: the OE package version, the deployment's commit sha, the eve framework version, and this deployment's context window with the token count compaction fires at." },
+    { kind: "tool", name: "assign", module: "agent/tools/assign.js", summary: "PROPOSE assigning a ticket — a Linear issue or a GitHub issue/PR — to someone." },
+    { kind: "tool", name: "aws", module: "agent/tools/aws.js", summary: "Run an AWS CLI command under this channel's granted AWS role (e.g." },
+    { kind: "tool", name: "browser_tools", module: "agent/tools/browser_tools.js", summary: "browser_tools — the resolver FILE that mounts the flag-gated agent-browser tool family (OPE-43)." },
+    { kind: "tool", name: "cancel_routine", module: "agent/tools/cancel_routine.js", summary: "PROPOSE cancelling (deleting) a routine on this surface by its id." },
+    { kind: "tool", name: "capture_events", module: "agent/tools/capture_events.js", summary: "Turn on temporary recording of a webhook's incoming deliveries so their shape can be inspected with list_recent_events and a subscription filter written against real traffic." },
+    { kind: "tool", name: "check_pr_status", module: "agent/tools/check_pr_status.js", summary: "Look up the current status of a GitHub pull request — open/closed/merged, draft, title, last updated." },
+    { kind: "tool", name: "checkout_repo", module: "agent/tools/checkout_repo.js", summary: "Clone one of the allowed repositories (see list_repos) into your workspace so you can read and change its code." },
+    { kind: "tool", name: "clear_connector_override", module: "agent/tools/clear_connector_override.js", summary: "PROPOSE reverting an earlier break-glass connector revoke, restoring this surface's config-as-code bundle grants for that connector — this does NOT clear anything itself." },
+    { kind: "tool", name: "clear_spend_limit", module: "agent/tools/clear_spend_limit.js", summary: "PROPOSE clearing a spend-limit override so the scope reverts to the config-as-code cap — this does NOT clear anything itself." },
+    { kind: "tool", name: "complete_job", module: "agent/tools/complete_job.js", summary: "Mark this DURABLE JOB done — call it once the WHOLE job you were set to drive is finished (not just this fire's step)." },
+    { kind: "tool", name: "complete_thread", module: "agent/tools/complete_thread.js", summary: "Mark this thread DONE and hand it back to the channel." },
+    { kind: "tool", name: "confirm_link", module: "agent/tools/confirm_link.js", summary: "Confirm (or deny) an account that belongs to this person — the second half of link_identity, and the one-tap confirmation for accounts an identity-directory sync (Okta) suggested for them." },
+    { kind: "tool", name: "connector", module: "agent/tools/connector.js", summary: "Post connect options for a provider so a human can authorize it." },
+    { kind: "tool", name: "create_agent", module: "agent/tools/create_agent.js", summary: "PROPOSE a new AGENT for THIS channel — a self-contained teammate with its OWN memory brain and its own capabilities." },
+    { kind: "tool", name: "create_routine", module: "agent/tools/create_routine.js", summary: "Create a durable ROUTINE so you act without being re-tagged: a scheduled job (cron/everyMinutes, with a required post policy — every run, only when something changed, or never, for work whose product…" },
+    { kind: "tool", name: "create_skill", module: "agent/tools/create_skill.js", summary: "PROPOSE creating or updating a SKILL for this channel's memory domain — a reusable markdown instruction package any future turn in the domain can invoke by its bare name." },
+    { kind: "tool", name: "create_ticket", module: "agent/tools/create_ticket.js", summary: "PROPOSE filing a NEW work item — a GitHub issue or a Linear issue — on a work surface this conversation is bound to." },
+    { kind: "tool", name: "declare_webhook", module: "agent/tools/declare_webhook.js", summary: "Propose an inbound webhook: an endpoint an outside system can POST to." },
+    { kind: "tool", name: "delete_skill", module: "agent/tools/delete_skill.js", summary: "PROPOSE deleting a domain skill created with create_skill, by its bare name (see list_skills)." },
+    { kind: "tool", name: "describe_image", module: "agent/tools/describe_image.js", summary: "describe_image — the host-side, text-out MULTIMODAL affordance." },
+    { kind: "tool", name: "dm_person", module: "agent/tools/dm_person.js", summary: "Send a direct message to a person an operator granted. The FIRST message to someone posts an approval card showing them and your exact text; after that your messages to them send straight away." },
+    { kind: "tool", name: "edit_reply", module: "agent/tools/edit_reply.js", summary: "Correct one of your own recent posts, in place, instead of posting a follow-up." },
+    { kind: "tool", name: "edit_routine", module: "agent/tools/edit_routine.js", summary: "PROPOSE rewriting what an existing routine DOES, keeping its schedule, its id, its history and everything it has learned (a watch's baseline, a durable job's progress and thread)." },
+    { kind: "tool", name: "enable_routine", module: "agent/tools/enable_routine.js", summary: "PROPOSE re-arming a routine that stopped itself after repeated failures, keeping its id, its history and everything it had learned (a watch's baseline, a durable job's progress and thread)." },
+    { kind: "tool", name: "explain_permission", module: "agent/tools/explain_permission.js", summary: "Explain what would happen if a named tool were used HERE: resolves the real approver chain for this scope (config approvers, surface controls, the consequence registry, the domain's approval mode…" },
+    { kind: "tool", name: "grant_tools", module: "agent/tools/grant_tools.js", summary: "grant_tools — the resolver FILE that mounts one tool per live CREDENTIAL GRANT in this conversation (OPE-1060)." },
+    {
+      kind: "tool",
+      name: "request_credential_grant",
+      module: "agent/tools/request_credential_grant.js",
+      summary: "ASK a named person to let this conversation spend their own connector credential — they answer in their own DM; this grants nothing (OPE-1060).",
+    },
+    { kind: "tool", name: "get_pr_feedback", module: "agent/tools/get_pr_feedback.js", summary: "Read the feedback on a GitHub pull request: review verdicts (approved / changes-requested), inline review comments (with file + line), issue-thread comments, and check runs (with a failure excerpt…" },
+    { kind: "tool", name: "halt", module: "agent/tools/halt.js", summary: "STOP EVERYTHING CONSEQUENTIAL, NOW — the break-glass halt. Use it the moment someone in the conversation asks you to stop, halt, freeze, or pull the plug." },
+    { kind: "tool", name: "link_identity", module: "agent/tools/link_identity.js", summary: "Start linking another account (GitHub, Linear, Slack, …) to the person you are talking to, so their work is attributed to ONE human across surfaces." },
+    { kind: "tool", name: "list_recent_events", module: "agent/tools/list_recent_events.js", summary: "Read the deliveries a webhook has actually sent, numbered, so a subscription filter can be written against real traffic instead of guesswork." },
+    { kind: "tool", name: "list_repos", module: "agent/tools/list_repos.js", summary: "List the GitHub repositories this channel is allowed to work with." },
+    { kind: "tool", name: "list_routines", module: "agent/tools/list_routines.js", summary: "List the routines (scheduled jobs, watches, event subscriptions) set up on this surface, with their status, next run time, recent run history (last session id, last time it posted, fires and tokens…" },
+    { kind: "tool", name: "list_skills", module: "agent/tools/list_skills.js", summary: "List the skills available to you right now in this session, with their provenance (bundle-granted, this channel's domain, or repo-discovered)." },
+    { kind: "tool", name: "list_webhooks", module: "agent/tools/list_webhooks.js", summary: "List the inbound webhooks declared for this deployment — which external systems can trigger work here, whether each one runs a fixed instruction or just emits events for routines to subscribe to, and…" },
+    { kind: "tool", name: "memory_admin_list", module: "agent/tools/memory_admin_list.js", summary: "ADMIN ONLY: enumerate every memory silo you are allowed to inspect — org -> domains -> silos -> files, with sizes — from ANY channel or DM, not just the one you\\'re speaking in right now (unlike the…" },
+    { kind: "tool", name: "memory_admin_read", module: "agent/tools/memory_admin_read.js", summary: "ADMIN ONLY: read one file's raw content out of one memory silo (memory_admin_list for silo names + file lists), from ANY channel or DM — the gate is YOUR role, not which channel you're speaking in." },
+    { kind: "tool", name: "message_thread_seat", module: "agent/tools/message_thread_seat.js", summary: "Send a message to a thread seat you opened — a steer, a correction, a fact it cannot see, or a question; `mirror` decides whether the people in the thread see it too." },
+    { kind: "tool", name: "no_reply", module: "agent/tools/no_reply.js", summary: "End this turn without posting a reply." },
+    { kind: "tool", name: "open_pull_request", module: "agent/tools/open_pull_request.js", summary: "PROPOSE pushing your committed branch and opening a GitHub pull request for it (this is the ONLY way changes leave the workspace — plain `git push` is not authorized)." },
+    { kind: "tool", name: "permission_fit_report", module: "agent/tools/permission_fit_report.js", summary: "Report whether this domain's PERMISSION GRANTS still fit the work — in both directions, from the audit log." },
+    { kind: "tool", name: "post_file", module: "agent/tools/post_file.js", summary: "Post one or more FILES/artifacts (screenshots, images, docs, data) to the current conversation on this surface — the delivery channel for things a text reply can't carry." },
+    { kind: "tool", name: "post_message", module: "agent/tools/post_message.js", summary: "Post a message into ANOTHER container your domain owns — not the one you are talking in (use reply for that). Consequential: an approval card renders the destination and the exact message before anything posts." },
+    { kind: "tool", name: "post_pr_walkthrough", module: "agent/tools/post_pr_walkthrough.js", summary: "Render the PR walkthrough and post it to the governance admin channel." },
+    { kind: "tool", name: "purge_memory", module: "agent/tools/purge_memory.js", summary: "PROPOSE ERASING remembered fact(s) from durable memory — the RARE, destructive path (corrections are plain file edits; every matching bullet across every writable silo is swept behind a confirmation card)." },
+    { kind: "tool", name: "query_analytics", module: "agent/tools/query_analytics.js", summary: "Query your org's own operational analytics in natural language — you form a STRUCTURED query object (never SQL) over a fixed schema, the host compiles + scopes it, and returns the answer." },
+    { kind: "tool", name: "react", module: "agent/tools/react.js", summary: "React to a message with an emoji, instead of (or as) your reply." },
+    { kind: "tool", name: "read_channel", module: "agent/tools/read_channel.js", summary: "Read recent messages from THIS conversation's channel — the room this turn arrived in. Takes no target." },
+    { kind: "tool", name: "read_docs", module: "agent/tools/read_docs.js", summary: "Read Open Everywhere's own shipped documentation — how this agent works, what it can do, how a capability is set up and governed." },
+    { kind: "tool", name: "read_file_upload", module: "agent/tools/read_file_upload.js", summary: "READ an uploaded TEXT file (CSV/TSV/JSON/markdown/log/plain text, up to 5 MB) that isn't visible as text." },
+    { kind: "tool", name: "read_routine_transcript", module: "agent/tools/read_routine_transcript.js", summary: "Read the transcript of a past routine run in THIS channel — what it was woken with, what it did, which tools it called and what they returned." },
+    { kind: "tool", name: "read_thread", module: "agent/tools/read_thread.js", summary: "Read all replies in THIS thread — the thread this turn arrived in. Takes no target." },
+    { kind: "tool", name: "read_thread_seat", module: "agent/tools/read_thread_seat.js", summary: "Read what you recorded about a thread you handed to a thread seat: which seat holds it, whether it is still open, and its closing report once it has handed back." },
+    { kind: "tool", name: "read_webhook_history", module: "agent/tools/read_webhook_history.js", summary: "Diagnose an inbound webhook: whether the sender is actually reaching us, and what each delivery did or didn't trigger." },
+    {
+      kind: "tool",
+      name: "read_work_channel",
+      module: "agent/tools/read_work_channel.js",
+      summary: "Read recent messages from the channel this task was delegated from — the work-surface read, under the domain's work grant. Takes no target.",
+    },
+    {
+      kind: "tool",
+      name: "read_work_thread",
+      module: "agent/tools/read_work_thread.js",
+      summary: "Read every reply in the thread this task was delegated from — the work-surface read, under the domain's work grant. Takes no target.",
+    },
+    { kind: "tool", name: "record_job_state", module: "agent/tools/record_job_state.js", summary: "Record your progress on this DURABLE JOB — a short, canonical note (goal, what's done, what's next) that survives even if this session is later replaced, so it's your reliable hand-off to the next…" },
+    { kind: "tool", name: "record_follow_up", module: "agent/tools/record_follow_up.js", summary: "Leave a named follow-up for the NEXT run of this same routine, or resolve one that is finished." },
+    { kind: "tool", name: "record_watch_state", module: "agent/tools/record_watch_state.js", summary: "Record the state a WATCH routine just observed, and learn whether it changed since the last check." },
+    { kind: "tool", name: "remove_routine_rule", module: "agent/tools/remove_routine_rule.js", summary: "PROPOSE removing ONE standing rule from a routine — the rule stops being applied to every future run." },
+    { kind: "tool", name: "reply", module: "agent/tools/reply.js", summary: "Post a reply into the conversation a specific wake came from, without ending your turn." },
+    { kind: "tool", name: "report_run_failed", module: "agent/tools/report_run_failed.js", summary: "Declare that THIS routine fire did not do its work — the thing you needed was down, a credential was rejected, the page never loaded." },
+    { kind: "tool", name: "request_access", module: "agent/tools/request_access.js", summary: "PROPOSE widening access — this grants nothing itself." },
+    { kind: "tool", name: "resume", module: "agent/tools/resume.js", summary: "PROPOSE lifting the break-glass halt — this does NOT lift it. Posts a confirmation card; an org admin must click Approve, because resuming WIDENS what the deployment may do." },
+    { kind: "tool", name: "revoke_connector", module: "agent/tools/revoke_connector.js", summary: "Break-glass PROPOSE: cut an Eve connector (by name, e.g." },
+    {
+      kind: "tool",
+      name: "revoke_credential_grant",
+      module: "agent/tools/revoke_credential_grant.js",
+      summary: "List, or END, the credential grants the person you are talking to is lending — DM only, and only ever their own (OPE-1637).",
+    },
+    { kind: "tool", name: "revoke_routine_permissions", module: "agent/tools/revoke_routine_permissions.js", summary: "Withdraw a routine's STANDING permissions — the things it was allowed to do unattended without asking — while leaving the routine itself running on its schedule." },
+    { kind: "tool", name: "rotate_webhook", module: "agent/tools/rotate_webhook.js", summary: "Issue a signing secret for a webhook that exists here, and send it privately as a one-time link." },
+    { kind: "tool", name: "run_routine_now", module: "agent/tools/run_routine_now.js", summary: "Run an existing routine ONCE right now, off its schedule, without changing the schedule." },
+    { kind: "tool", name: "sandbox_tools", module: "agent/tools/sandbox_tools.js", summary: "sandbox_tools — the per-GRAIN provider of the six framework sandbox/egress tools: `bash`, `glob`, `grep`, `read_file`, `write_file`, `web_fetch` (window-tool-gating Stage C)." },
+    {
+      kind: "tool",
+      name: "search",
+      module: "agent/tools/search.js",
+      summary: "Search this domain's connected work surfaces (GitHub, Notion, Linear, ...) by keyword, and get back ids + titles — a pointer, not an answer.",
+    },
+    { kind: "tool", name: "session_cost", module: "agent/tools/session_cost.js", summary: "What did THIS conversation cost so far — tokens (input/output/cache), an estimated $ (if a model can be assumed), and sandbox runtime seconds + an estimated $ for any sandbox time this session used." },
+    { kind: "tool", name: "set_dm_delivery", module: "agent/tools/set_dm_delivery.js", summary: "Turn the direct messages THIS agent starts with the person you are talking to on or off, at their request. No configuration overrides their choice." },
+    { kind: "tool", name: "set_spend_limit", module: "agent/tools/set_spend_limit.js", summary: "PROPOSE a monthly spend limit — token count and/or USD — for this surface (or, with level:\"workspace\", the whole workspace: the Slack workspace / Discord server; with level:\"domain\", every surface in…" },
+    { kind: "tool", name: "set_state", module: "agent/tools/set_state.js", summary: "PROPOSE changing a ticket's status — a Linear issue's workflow state (e.g." },
+    { kind: "tool", name: "spawn_thread_session", module: "agent/tools/spawn_thread_session.js", summary: "Open a lasting presence in a thread: spawn a conversational seat that owns the thread and stays live across messages (unlike a one-off worker)." },
+    { kind: "tool", name: "spend_report", module: "agent/tools/spend_report.js", summary: "Token spend rollup for your memory domain, or (org admins only) the whole org: tokens + estimated $ by surface and turn-origin kind, the existing monthly ledger totals (tokens AND $) against…" },
+    { kind: "tool", name: "stand_down", module: "agent/tools/stand_down.js", summary: "Stop following this conversation — call it when the people here have asked you to stop, to go quiet, or to leave them to it, however they phrased it." },
+    { kind: "tool", name: "subscribe_pr", module: "agent/tools/subscribe_pr.js", summary: "Subscribe this channel to a GitHub pull request: re-checks it on an interval (default 15 min) and posts here when something changes — reviews, comments, new commits, CI going red or green, merged or…" },
+    { kind: "tool", name: "unlink_identity", module: "agent/tools/unlink_identity.js", summary: "Remove a linked account from the caller's own identity link-set — their current account by default, or another account already on their set (platform + nativeId)." },
+    { kind: "tool", name: "update_status", module: "agent/tools/update_status.js", summary: "Record your current work status so the team can see it at a glance (it's mirrored to a pinned status message in the channel, shared across all threads)." },
+    { kind: "tool", name: "usage_report", module: "agent/tools/usage_report.js", summary: "Activity analytics for your memory domain, or (org admins only) the whole org: conversation count (an estimate — see note), turns, a per-user activity breakdown, and the busiest surfaces, over a time…" },
+    { kind: "tool", name: "walk_pr", module: "agent/tools/walk_pr.js", summary: "Gather everything needed to walk a human through a pull request before they merge it: the PR's state, its diff, and the resolved-config FACTS computed by CI (effective access per scope, domain…" },
+
+    // ── channels ─────────────────────────────────────────────────────────────────────────────────
+    { kind: "channel", name: "aws-sso-callback", module: "agent/channels/aws-sso-callback.js", summary: "Deployment mount for the OE-owned AWS IAM Identity Center link callback — `GET /oauth/v1/aws-sso/callback` (the Identity Center OIDC authorization-server redirect landing, Phase 1)." },
+    { kind: "channel", name: "control-mcp", module: "agent/channels/control-mcp.js", summary: "Deployment mount for the control plane's MCP WRITE transport — `POST /control/v1/mcp` — and the small OAuth 2.1 authorization server that guards it: `/control/v1/oauth/authorize`, `/control/v1/oauth/token`, and the RFC 8414 and RFC 9728 discovery documents (OPE-72). Fail-closed: every route 404s until `OE_CONTROL_OAUTH_SIGNING_SECRET` is set AND `CONTROL_OAUTH_ISSUER` is declared in tracked config; a registered client is then a further condition on issuing a token." },
+    { kind: "channel", name: "control-read", module: "agent/channels/control-read.js", summary: "Deployment mount for the control plane's READ side — `GET /control/v1/usage` (priced usage window), `GET /control/v1/audit` (the audit window: dispatched/replied/no_reply/rejected rows — the uniform…" },
+    { kind: "channel", name: "credential-intake-page", module: "agent/channels/credential-intake-page.js", summary: "Deployment mount for the one-shot credential-intake PAGE (task #113, stage 6) — GET renders the entry form, POST stores the value." },
+    { kind: "channel", name: "oe-oauth-callback", module: "agent/channels/oe-oauth-callback.js", summary: "Deployment mount for the OE-owned own-rolled OAuth callback — `GET /oauth/v1/callback` (the hosted-MCP authorization-server redirect landing, OPE-88)." },
+    { kind: "channel", name: "policy-pages", module: "agent/channels/policy-pages.js", summary: "Deployment mount for the two PUBLIC policy pages — `GET /privacy` and `GET /terms` (pages/policy-pages.ts). The text is the operator's, declared as `policyPages.privacy` / `policyPages.terms`; unset renders a placeholder and both routes always answer 200, because `teams-app/manifest.json` points `privacyUrl`/`termsOfUseUrl` here." },
+    { kind: "channel", name: "test-wake", module: "agent/channels/test-wake.js", summary: "Deployment mount for the TEST-WAKE INJECTION control route — `POST /control/v1/test/wake` (control/test-route.ts)." },
+    { kind: "channel", name: "transcript-relay", module: "agent/channels/transcript-relay.js", summary: "Deployment mount for the INTERNAL transcript relay — `POST /eve/v1/internal/transcript` (OPE-153)." },
+    { kind: "channel", name: "unified", module: "agent/channels/unified.js", summary: "The synthetic UNIFIED channel — the single-context cross-surface window's delivery spine." },
+    { kind: "channel", name: "webhook-reveal-page", module: "agent/channels/webhook-reveal-page.js", summary: "Deployment mount for the ONE-SHOT webhook-secret REVEAL page (OPE-150) — GET renders a confirm page with no secret on it, POST consumes the grant and shows the secret once." },
+    { kind: "channel", name: "webhooks", module: "agent/channels/webhooks.js", summary: "Generic inbound-webhook surface — the third leg of the trigger triad (manual mention, cron routines, webhooks)." },
+
+    // ── hooks ────────────────────────────────────────────────────────────────────────────────────
+    { kind: "hook", name: "approval-raised", module: "agent/hooks/approval-raised.js", summary: "APPROVAL-RAISED record hook (OPE-436) — marks a duplicate-approval fingerprint only once eve has DURABLY recorded that it actually raised a \"tool-approval\" input request." },
+    { kind: "hook", name: "approval-settlement", module: "agent/hooks/approval-settlement.js", summary: "EVE APPROVAL SETTLEMENT AUDIT (OPE-575, adopt-part C of the OPE-560 STAY verdict)." },
+    { kind: "hook", name: "binding-bridge", module: "agent/hooks/binding-bridge.js", summary: "Binding-bridge hook: stamp the session's platform identity into the per-session state slot so TOOL contexts that arrive identity-less (send()-created sessions — name-drop wake, engaged-thread…" },
+    { kind: "hook", name: "connector-audit", module: "agent/hooks/connector-audit.js", summary: "Per-OP connector audit (task #93 A3) — makes \"every action lands in an append-only audit log\" TRUE for the connector plane." },
+    { kind: "hook", name: "egress", module: "agent/hooks/egress.js", summary: "Egress enforcement: compile the resolved access into a sandbox NetworkPolicy and apply it, so the channel can only reach what its bundle grants (two-surface, default-deny) and credentials are…" },
+    { kind: "hook", name: "eve-patch-gate", module: "agent/hooks/eve-patch-gate.js", summary: "UNPATCHED-EVE REFUSAL, turn edge (OPE-2182) — reads every live eve patch part's runtime marker at `turn.started` and throws when one is absent, so a build that inlines eve (where no package root resolves and the boot probe cannot decide) fails its first turn instead of serving it unfenced." },
+    { kind: "hook", name: "fire-carriage", module: "agent/hooks/fire-carriage.js", summary: "FIRE-CARRIAGE probe, SESSION SIDE (OPE-483) — records the auth-attribute KEY NAMES a schedule-originated session's turn actually received, so the pair with the dispatcher's own row says which side of the session hop lost a fire's stamps." },
+    { kind: "hook", name: "fire-toolset", module: "agent/hooks/fire-toolset.js", summary: "FIRE-TIME DECLARED-OP MOUNT (OPE-2135) — seeds eve's own discovered-result slot with the connector operation a routine's declared permission names, so the fire starts holding the tool it exists to call instead of having to rediscover it." },
+    { kind: "hook", name: "job-posture", module: "agent/hooks/job-posture.js", summary: "JOB-WAKE classification hook (OPE-111) — the one site that holds BOTH the delivery auth and the eve context, so it is where a wake's shape is turned into the session slots the restriction reads…" },
+    { kind: "hook", name: "lean-seat", module: "agent/hooks/lean-seat.js", summary: "LEAN-SEAT classification hook (OPE-301) — the one site that holds BOTH the delivery auth and the session identity, so it is where a wake's seat shape is turned into the session slot the lean filter…" },
+    { kind: "hook", name: "learn", module: "agent/hooks/learn.js", summary: "Mode 1 — \"learn\": the GENERATIVE, per-request consolidation, as a SIBLING to the memory lifecycle hook (hooks/memory.ts)." },
+    { kind: "hook", name: "link-claim", module: "agent/hooks/link-claim.js", summary: "LINK-CLAIM HOOK — recognises an inbound `link <code>` and stamps the challenge with the WAKE'S OWN captured author." },
+    { kind: "hook", name: "log-flush", module: "agent/hooks/log-flush.js", summary: "Log-ship flush hook — give the batched log shipper (observability/ship.ts) a deterministic flush point at the end of every turn/session, so records queued during the turn leave the instance BEFORE…" },
+    { kind: "hook", name: "loop-breaker", module: "agent/hooks/loop-breaker.js", summary: "PER-TURN RESET hook for the two #101 resilience memos — the in-turn loop breaker (access/loop-breaker.ts) and the connector needsAuthorization short-circuit (connections/auth-retry-memo.ts)." },
+    { kind: "hook", name: "memory", module: "agent/hooks/memory.js", summary: "Lifecycle memory sync — turns the ephemeral sandbox into an agent that learns." },
+    { kind: "hook", name: "native-input-audit", module: "agent/hooks/native-input-audit.js", summary: "NATIVE-ROUTE input-request AUDIT (OPE-1275) — the observability half of a non-park `input.requested` batch on every surface OTHER than the unified window." },
+    { kind: "hook", name: "own-account-ask", module: "agent/hooks/own-account-ask.js", summary: "THE OWN-ACCOUNT PRODUCER (OPE-1525) — the one writer of the `oe_own_account_ask` stamp, so a member's \"use my own account\" reaches the workers the seat delegates to." },
+    { kind: "hook", name: "requester-identity", module: "agent/hooks/requester-identity.js", summary: "REQUESTER-IDENTITY CAPTURE (OPE-673) — fills access/requester-identity.ts's per-turn slot from `message.received`, and stamps the answer onto the delivery's auth so a delegated worker inherits…" },
+    { kind: "hook", name: "requester-messages", module: "agent/hooks/requester-messages.js", summary: "REQUESTER-MESSAGE CAPTURE (OPE-318 phase 2) — fills access/requester-messages.ts's per-turn slot from `message.received`, the one hook event that carries the host-normalised text of what the seat was…" },
+    { kind: "hook", name: "routine-outcome", module: "agent/hooks/routine-outcome.js", summary: "Routine outcome feedback — closes the loop on proactivity." },
+    { kind: "hook", name: "routine-silence", module: "agent/hooks/routine-silence.js", summary: "SILENT-FIRE classification hook (OPE-149) — the one site holding BOTH the delivery auth and the eve context, so it is where a fire's stored `report: {kind:\"silent\"}` becomes the per-turn signal the…" },
+    { kind: "hook", name: "session-park", module: "agent/hooks/session-park.js", summary: "SESSION-LIMIT PARK detection (OPE-171) — the observe-and-remedy seam for eve's HITL park." },
+    { kind: "hook", name: "spawn-taint", module: "agent/hooks/spawn-taint.js", summary: "THE TURN BOUNDARY for the taint signal — it does TWO things, in this order, and both belong here:" },
+    { kind: "hook", name: "spend", module: "agent/hooks/spend.js", summary: "Spend recording — accumulates usage per scope so caps can be enforced and usage observed." },
+    { kind: "hook", name: "stall-guard", module: "agent/hooks/stall-guard.js", summary: "Stall-guard DETECTION hook — the observe-only seam that feeds the within-loop stall guard (agent/stall/guard.ts)." },
+    { kind: "hook", name: "telemetry", module: "agent/hooks/telemetry.js", summary: "Turn-level telemetry — accumulates one turn's step count + token total + start time, then emits `oe.turn.completed`/`oe.turn.failed` (surface TYPE only, never a surfaceKey/session/principal id — see…" },
+    { kind: "hook", name: "turn-anchor", module: "agent/hooks/turn-anchor.js", summary: "THE TURN-ANCHOR HOOK (OPE-418) — the writer for the stop registry, and the whole ✋ lifecycle." },
+    { kind: "hook", name: "wake-accounting-turn", module: "agent/hooks/wake-accounting-turn.js", summary: "THE TURN EDGE FOR PER-WAKE ACCOUNTING (OPE-1013) — the second call site for channels/unified.ts's `auditUnaccountedWakesForTurn`, wired to turn.completed/turn.cancelled/session.failed so a turn whose…" },
+    { kind: "hook", name: "wake-turn-start", module: "agent/hooks/wake-turn-start.js", summary: "THE TURN-START ANCHOR (OPE-1716) — one audit row at the instant a wake's turn begins, so the stretch BEFORE the turn can be told apart from the turn itself." },
+    { kind: "hook", name: "window-routing", module: "agent/hooks/window-routing.js", summary: "Routing-invariant hook (OPE-121) — audit a wake that landed on a NATIVE seat even though its own domain windows." },
+
+    // ── schedules ────────────────────────────────────────────────────────────────────────────────
+    { kind: "schedule", name: "directory-sync", module: "agent/schedules/directory-sync.js", summary: "The DIRECTORY-SYNC SCHEDULE — the clock half of IdP pre-population (P2.3)." },
+    { kind: "schedule", name: "dispatch", module: "agent/schedules/dispatch.js", summary: "The routine DISPATCHER — the one bridge from Eve's static cron to OpenEverywhere's dynamic, NL-created, per-surface routines (Phase 3)." },
+    { kind: "schedule", name: "dream-mode3", module: "agent/schedules/dream-mode3.js", summary: "The Mode-3 (\"failure digest\") SCHEDULE — the weekly, harness-level learning pass (sibling to schedules/tidy.ts's daily Mode-2 pass; see memory/dream/mode3.ts for the pure logic this wires up)." },
+    { kind: "schedule", name: "tidy", module: "agent/schedules/tidy.js", summary: "The Mode-2 \"tidy\" SCHEDULE — the periodic, corrective maintenance pass over the memory silos." },
+
+    // ── connections ──────────────────────────────────────────────────────────────────────────────
+    { kind: "connection", name: "notion", module: "agent/connections/notion.js", summary: "An Eve *connection* — the host-side connector plane (NEW; see connector-auth decision)." },
+
+    // ── skills ───────────────────────────────────────────────────────────────────────────────────
+    { kind: "skill", name: "scoped", module: "agent/skills/scoped.js", summary: "Scoped skills: expose to the model the skills this session may see, merged from THREE sources (precedence, narrowest-wins-on-name-collision): bundle-GRANTED skills (plugin grants → resolver →…" },
+  ],
+} as const;