@open-everywhere/core 0.1.0

package/agent/hooks/egress.ts

@@ -0,0 +1,694 @@
+// Compiles the resolved access into a sandbox NetworkPolicy and applies it at `session.started` and at every `turn.started`, default-deny, with credentials injected at the firewall rather than in the sandbox.
+// Fail-closed: a resolve or compile failure applies deny-all rather than fall through to eve's allow-all session default; a failed apply aborts at session start unless `egress.allowUnenforced` is set, while a failed turn re-apply leaves the previous policy in force.
+// Never apply a credential-bearing policy from a bootstrap-phase hook: eve's template-bootstrap session wrapper LOGS the policy it is handed, and only the `transform` redaction it gained in eve 0.44.0 keeps the header out of that log. `packages/core/scripts/credential-isolation-test.ts` pins both halves.
+
+import { createHash } from "node:crypto";
+import { defineHook, type HookContext } from "eve/hooks";
+import { defineState } from "eve/context";
+import type { SandboxNetworkPolicy } from "eve/sandbox";
+import { resolveAccessFor } from "../access/request.js";
+import { noteOwnAccountRouteRefusal } from "../connections/own-account-gate.js";
+import { compileNetworkPolicy, openWriteHosts, writeHostsAuditFields } from "../access/egress.js";
+import { noteStandingWriteGrants } from "../channels/standing-authority.js";
+import { browserEgressHosts } from "../access/browser-hosts.js";
+import type { EffectiveAccess, ReachableHost } from "../access/resolver.js";
+import { resolveHeaders } from "../access/credentials.js";
+import { getConfig } from "../access/config.js";
+import { resolveNetworkAccessLevel } from "../access/network-access.js";
+import { resolvePartition } from "../memory/partition.js";
+import { bindFrom, isSubagentChildContext, type BindableContext } from "../identity/binding.js";
+import { narrowByConnectorOverride } from "../access/connector-scope.js";
+import { setConnectorContentOrigin, type ConnectorContentOriginMap } from "../access/connector-content-origin-state.js";
+import { appendAudit, type AuditInput } from "../audit/audit.js";
+import { stampEnforcement } from "../access/enforcement.js";
+import { stampHalted } from "../access/halt-state.js";
+import { haltScopeFor, resolveHalt } from "../access/halt.js";
+import { useSelfHostEgress, pushEgressPolicy } from "../access/self-host-egress.js";
+import {
+  publishEgressStatus,
+  readPublishedEgressFingerprint,
+  type EgressEnforcementState,
+  type EgressStatusInput,
+} from "../access/egress-status.js";
+import { rememberEgressAttribution, type EgressAttribution } from "../access/egress-denial-poller.js";
+import { getSettings } from "../settings/settings.js";
+import { DelegatedTaskBindingUnavailableError, ensureDelegatedTaskBinding } from "../channels/task-wake.js";
+
+function log(msg: string): void {
+  console.log(`[open-everywhere:egress] ${msg}`);
+}
+
+/**
+ * The identical-binding tripwire's own failure — a subagent child whose compiled policy diverged from the one
+ * its parent published into the sandbox they share.
+ *
+ * 🔴 IT IS A TYPE BECAUSE THE MESSAGE VARIES (OPE-1976). The `turn.started` handler must rethrow this one
+ * failure and swallow every other, and it used to tell them apart by matching the invariant sentence inside
+ * the message. Since an own-account withholding now fails the child with the member's REFUSAL as the message,
+ * a substring match would stop recognising exactly the case the ticket is about, and the handler would swallow
+ * the abort and let the child keep running against its parent's firewall. Match on the type, never on words.
+ */
+export class EgressBindingDivergenceError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "EgressBindingDivergenceError";
+  }
+}
+
+export interface ResolvedEgressPolicy {
+  readonly policy: SandboxNetworkPolicy;
+  readonly scopeKey: string;
+  readonly connectors: readonly string[];
+  /**
+   * What each granted connector's grant declared about who authors its bytes, carried out of the SAME resolve that produced `connectors`, so the stamp the model-call seam reads can never describe a different grant set.
+   * `{}` on the fail-closed path, which keeps every connector ingestion on the source-tier table's fail-closed default.
+   */
+  readonly connectorContentOrigin: ConnectorContentOriginMap;
+  /**
+   * Attribution only: the compiled `policy` above, not this list, decides what the firewall allows.
+   * `[]` on the fail-closed path, where the policy is deny-all and nothing is open.
+   */
+  readonly reachableHosts: readonly ReachableHost[];
+  /** Set iff resolving/compiling threw — the policy is then forced to deny-all. */
+  readonly compileError?: string;
+  /** Set iff a break-glass halt forced the policy to deny-all. Distinct from `compileError` on purpose: a halt is a deliberate operator act that `resume` lifts, not a broken bundle somebody must fix. */
+  readonly halted?: true;
+  /** The vendor hosts this session's own-account ask cost it, carried out of the SAME resolve that produced the policy (OPE-1947). Carried rather than re-resolved: `resolveAccessFor` writes the plane's own best-effort refusal row, and a second call at `session.started` — where there is no turn id to key its memo — would duplicate it. `[]` on the fail-closed path. */
+  readonly ownAccountEgressRefusals: readonly { readonly connector: string; readonly viaConnection: string }[];
+}
+
+/** Compute the egress policy fail-closed: any failure to resolve access or compile yields `deny-all`, never a fall-through to eve's allow-all session default, so a misconfigured bundle cuts the agent off rather than opening it up. */
+export async function computeEgressPolicy(
+  resolve: () => EffectiveAccess,
+  compile: (access: EffectiveAccess) => Promise<SandboxNetworkPolicy>,
+  halted?: () => Promise<boolean>,
+): Promise<ResolvedEgressPolicy> {
+  try {
+    const access = resolve();
+    // The break-glass halt wins over a successful compile. Checked after `resolve` so the deny-all row can still name the scope it applies to, and before the policy is returned so no halted turn reaches `applyEgressPolicy` with hosts open.
+    if (halted !== undefined && (await halted())) {
+      return { policy: "deny-all", scopeKey: access.scopeKey, connectors: [], connectorContentOrigin: {}, reachableHosts: [], halted: true, ownAccountEgressRefusals: access.ownAccountEgressRefusals ?? [] };
+    }
+    const policy = await compile(access);
+    return {
+      policy,
+      scopeKey: access.scopeKey,
+      connectors: access.connectors,
+      connectorContentOrigin: access.connectorContentOrigin,
+      reachableHosts: access.reachableHosts,
+      ownAccountEgressRefusals: access.ownAccountEgressRefusals ?? [],
+    };
+  } catch (err) {
+    return {
+      policy: "deny-all",
+      scopeKey: "(unresolved)",
+      connectors: [],
+      connectorContentOrigin: {},
+      reachableHosts: [],
+      compileError: String(err),
+      ownAccountEgressRefusals: [],
+    };
+  }
+}
+
+export interface AppliedEgressPolicy {
+  readonly enforced: boolean;
+  /** Set iff setNetworkPolicy threw AND the escape hatch allowed degrading. */
+  readonly enforceError?: string;
+}
+
+/**
+ * Apply the compiled policy fail-closed. eve creates the session allow-all and this apply is the only thing that narrows it, so a failed `setNetworkPolicy` throws: hooks are awaited inline, the workflow loop fails, and the agent never runs a turn unenforced.
+ * `egress.allowUnenforced: true` restores warn-and-continue for backends that cannot apply fine-grained policy. This is the session-start contract; a turn-level re-apply catches the throw in {@link enforceEgress}, where the previous policy is still in force.
+ */
+export async function applyEgressPolicy(
+  apply: () => Promise<unknown>,
+  allowUnenforced: boolean,
+): Promise<AppliedEgressPolicy> {
+  try {
+    await apply();
+    return { enforced: true };
+  } catch (err) {
+    if (allowUnenforced) return { enforced: false, enforceError: String(err) };
+    throw new Error(
+      `egress enforcement failed — aborting the session rather than running on Eve's allow-all default ` +
+        `(set egress.allowUnenforced: true to warn-and-continue in dev): ${String(err)}`,
+    );
+  }
+}
+
+/** The apply posture differs between the two edges: a failed apply aborts at session start, absent `egress.allowUnenforced`, while a turn only logs it. */
+export type EgressPhase = "session.started" | "turn.started";
+
+/**
+ * A stable, secret-free identity for a compiled policy: sha-256 over its serialization plus the compile-error marker, so a broken-bundle deny-all never fingerprints the same as a deliberate one.
+ * The serialization contains credential values, so only the digest is ever retained, logged or audited.
+ */
+export function egressPolicyFingerprint(policy: SandboxNetworkPolicy, compileError?: string): string {
+  return createHash("sha256")
+    .update(compileError ? "compile-error " : "ok ")
+    .update(JSON.stringify(policy))
+    .digest("hex");
+}
+
+export type EgressApplyReason = "first-apply" | "policy-changed" | "retry-after-failure" | "unchanged";
+
+/** `session.started` always re-applies, because eve's session default is allow-all until this narrows it. A turn re-applies only when the recompiled policy differs from the last SUCCESSFUL apply, which is what makes the steady-state per-turn cost a compile rather than a sandbox round-trip. */
+export function planEgressApply(input: {
+  readonly phase: EgressPhase;
+  readonly fingerprint: string;
+  readonly lastApplied: string | undefined;
+}): { readonly reapply: boolean; readonly reason: EgressApplyReason } {
+  if (input.phase === "session.started") return { reapply: true, reason: "first-apply" };
+  if (input.lastApplied === undefined) return { reapply: true, reason: "retry-after-failure" };
+  if (input.lastApplied !== input.fingerprint) return { reapply: true, reason: "policy-changed" };
+  return { reapply: false, reason: "unchanged" };
+}
+
+/** Where an audit row lands + who it is attributed to — the ctx-derived half, injected for tests. */
+export interface EgressAuditScope {
+  readonly org: string;
+  readonly platform: string;
+  readonly workspace: string;
+  readonly surface: string;
+  /** Undefined when the binding can't name a principal (an ambient/system wake) — the audit row's
+   *  own `principalId` is optional for exactly that case. */
+  readonly principalId: string | undefined;
+}
+
+/** Every edge {@link enforceEgress} touches. The hook binds the live ones off `ctx`. */
+export interface EgressEnforcementDeps {
+  readonly resolve: () => EffectiveAccess;
+  readonly compile: (access: EffectiveAccess) => Promise<SandboxNetworkPolicy>;
+  readonly apply: (policy: SandboxNetworkPolicy, scopeKey: string) => Promise<void>;
+  readonly lastApplied: () => string | undefined;
+  /** Record the fingerprint of a SUCCESSFUL apply. Never called after a failed one. */
+  readonly rememberApplied: (fingerprint: string) => void;
+  /** The connector set of the last audited grant row, so an unchanged turn writes no row. */
+  readonly lastConnectors: () => string | undefined;
+  readonly rememberConnectors: (key: string) => void;
+  readonly scope: () => EgressAuditScope;
+  /**
+   * Is a break-glass halt in force for this session's address? Its own read fails CLOSED (access/halt.ts), so an unreadable halt store cuts egress rather than opening it.
+   * Absent in a unit context: the halt question is then not asked at all and nothing is stamped.
+   */
+  readonly halted?: () => Promise<boolean>;
+  /** Stamp the halt answer into the per-session slot the toolset projection reads. The live default is access/halt-state.ts's own stamper. */
+  readonly stampHalted?: (halted: boolean) => void;
+  readonly audit?: (entry: AuditInput) => Promise<void>;
+  readonly stamp?: (enforced: boolean) => void;
+  /**
+   * Publish the in-sandbox self-diagnosis surface (access/egress-status.ts). Optional: a unit context has no sandbox, and a failed sandbox write must cost the diagnostics, never the firewall.
+   * Called only when this pass established what is in force, inside the same skip-unchanged gate as the apply.
+   */
+  readonly publish?: (input: EgressStatusInput) => Promise<void>;
+  /**
+   * Record the scope and policy generation a later EGRESS DENIAL should be attributed to (OPE-314).
+   * Called only on a pass that ESTABLISHED what is in force — never on a skipped-unchanged turn, and never after an apply that threw, because a generation that was never applied cannot have denied anything.
+   */
+  readonly rememberScope?: (input: EgressAttribution) => void;
+  /**
+   * Set only inside an eve subagent CHILD, which shares the parent's sandbox and firewall: it returns the `policyFingerprint` the parent last published, so a child whose compile diverges is failed rather than allowed to replace the parent's live policy.
+   * `undefined` is not a violation — an unpublished parent, or an unreadable or malformed file. What closes the gap is the identical binding; this only reports on it, and a child with `bash` in the shared sandbox can delete the file.
+   */
+  readonly parentPublishedFingerprint?: () => Promise<string | undefined>;
+  /**
+   * Stamp the DECLARED connector content origin for this wake (OPE-339) so the model-call projection seam can feed `grantContentOrigin` to the source-tier table.
+   * Called on every pass, before the skip-unchanged gate: a turn whose recompiled policy is byte-identical skips the apply but still makes model calls that ingest connector results.
+   */
+  readonly stampConnectorContentOrigin?: (declared: ConnectorContentOriginMap) => void;
+}
+
+export interface EgressEnforcementResult {
+  readonly phase: EgressPhase;
+  /** Did this call actually reach the firewall (false = skipped as unchanged, or dry-run)? */
+  readonly applied: boolean;
+  readonly reason: EgressApplyReason;
+  /** Whether THIS call's apply actually enforced. Absent when nothing was applied: a turn skipped as unchanged did not test enforcement, so the standing policy is whatever the last apply left — in a dry-run deployment, nothing at all. */
+  readonly enforced?: boolean;
+  readonly fingerprint: string;
+  readonly compileError?: string;
+  readonly enforceError?: string;
+  /** Set when the caller must rethrow: a `session.started` apply that failed without the escape hatch, or a subagent child whose policy diverged from its parent's, on either phase. */
+  readonly abortError?: Error;
+  /** What this session's own-account ask cost its reach, from this pass's own resolve. Present on EVERY return, the aborting child included: that child is exactly the case the row exists for. */
+  readonly ownAccountEgressRefusals: readonly { readonly connector: string; readonly viaConnection: string }[];
+}
+
+/**
+ * One enforcement pass, for either lifecycle edge. Deps are injected so the phase contract is unit-testable without an eve context.
+ * It never throws for `turn.started`, and for `session.started` it returns `abortError` rather than throwing, so the caller can finish auditing before failing the workflow loop.
+ */
+export async function enforceEgress(phase: EgressPhase, deps: EgressEnforcementDeps): Promise<EgressEnforcementResult> {
+  const audit = deps.audit ?? appendAudit;
+
+  // Phase-independent on purpose: a bundle that stops compiling mid-session must cut egress off, not coast on the policy it compiled an hour ago.
+  const { policy, scopeKey, connectors, connectorContentOrigin, reachableHosts, compileError, halted, ownAccountEgressRefusals } = await computeEgressPolicy(
+    deps.resolve,
+    deps.compile,
+    deps.halted,
+  );
+
+  // Stamp the halt answer for the synchronous seam: `projectToolSet` subtracts `web_search` and the framework `web_fetch` while halted and has no context to page a store from.
+  // A pass that never asked the question stamps `true`. A compile failure returns with `halted` unset, and stamping `false` there would leave those two names mounted under an active halt — the two the deny-all sandbox cannot cover — so unknown fails closed.
+  if (deps.halted !== undefined) (deps.stampHalted ?? stampHalted)(halted === true || compileError !== undefined);
+
+  // Before the skip-unchanged gate below: a turn whose recompiled policy is byte-identical returns early, and it still makes model calls that ingest connector results. A compile failure stamps `{}`, fail-closed.
+  (deps.stampConnectorContentOrigin ?? setConnectorContentOrigin)(connectorContentOrigin);
+
+  if (compileError) {
+    log(`compile FAILED — applying deny-all (fail-closed): ${compileError}`);
+  }
+  if (halted) {
+    log(`break-glass HALT in force — applying deny-all (lift it with resume)`);
+  }
+
+  const hostCount = typeof policy === "string" ? 0 : Object.keys(policy.allow ?? {}).length;
+  // Derived from the COMPILED policy, so it describes the firewall this pass set rather than the config it came from; secret-free by construction (see `openWriteHosts`). Computed here so the divergence-abort row below can carry it too.
+  // The declared browser hosts ride beside `reachableHosts` because a browser host's credential is named by its own declaration and by no bundle.
+  const writeHosts = openWriteHosts(policy, reachableHosts, browserEgressHosts());
+  const summary = compileError
+    ? `deny-all (compile error)`
+    : halted
+      ? `deny-all (break-glass halt)`
+      : typeof policy === "string"
+        ? policy
+        : `allow ${hostCount} host(s), default-deny`;
+
+  const fingerprint = egressPolicyFingerprint(policy, compileError);
+
+  // The identical-binding tripwire, checked BEFORE any apply, publish or stamp, so a violating child touches nothing in the shared sandbox.
+  if (deps.parentPublishedFingerprint) {
+    let parentFingerprint: string | undefined;
+    try {
+      parentFingerprint = await deps.parentPublishedFingerprint();
+    } catch (err) {
+      // Unreadable ⇒ nothing to compare ⇒ proceed, exactly as if the parent had not published.
+      log(`subagent child: parent egress fingerprint unreadable, invariant not asserted this pass: ${String(err)}`);
+    }
+    if (parentFingerprint !== undefined && parentFingerprint !== fingerprint) {
+      const failure = new EgressBindingDivergenceError(
+        `egress identical-binding invariant VIOLATED: this subagent child compiled policy ${fingerprint} ` +
+          `(${summary}, bound to ${scopeKey}) while its parent published ${parentFingerprint} into the sandbox ` +
+          `they share. A native child binds to its parent's identity (identity/binding.ts channelPlatform's ` +
+          `subagent origin-hop), so the two policies must be byte-identical; a divergence means the child would ` +
+          `REPLACE its parent's live firewall. Failing the child rather than applying.`,
+      );
+      log(failure.message);
+      try {
+        const s = deps.scope();
+        await audit({
+          org: s.org,
+          platform: s.platform,
+          workspace: s.workspace,
+          surface: s.surface,
+          principalId: s.principalId,
+          action: "egress.policy",
+          // Never a byte of the policy — it holds credential values. The child's own `scopeKey` and host count are what separate a mis-bound child from a binding that compiled different bytes.
+          detail: {
+            phase,
+            reason: "subagent-binding-divergence",
+            policyFingerprint: fingerprint,
+            parentPolicyFingerprint: parentFingerprint,
+            scopeKey,
+            hosts: hostCount,
+            summary,
+            // What the REFUSED child policy would have left open to a write: a divergence whose two sides differ in write reach is a different incident from one that differs in a read-only host.
+            ...writeHostsAuditFields(writeHosts),
+            // THAT THIS PASS ALSO WITHHELD THE VENDOR'S HOSTS (OPE-1976) — the first thing to check before chasing a
+            // binding bug, because a worker whose seat carries an own-account stamp compiles WITHOUT those hosts and
+            // so diverges by design. 🔴 It is a fact about the PASS, not a cause of the mismatch: a stamped worker
+            // that is ALSO genuinely mis-bound carries it too, so it narrows the search and never closes it.
+            ...(ownAccountEgressRefusals.length > 0
+              ? { ownAccountConnector: ownAccountEgressRefusals[0]!.connector, ownAccountWithheld: true }
+              : {}),
+            aborted: true,
+          },
+        });
+      } catch (err) {
+        log(`subagent divergence audit skipped (the child is still being failed): ${String(err)}`);
+      }
+      // Returned, not thrown, so the caller rethrows on both phases. A child's diverging turn-level re-apply gets no "the old policy is still fine" consolation, because the old policy is the PARENT's.
+      return { phase, applied: false, reason: "policy-changed", fingerprint, abortError: failure, ownAccountEgressRefusals };
+    }
+  }
+
+  // BEFORE the skip-unchanged gate below, and for the same reason `stampConnectorContentOrigin` is:
+  // a turn whose recompiled policy is byte-identical returns early, and its reply still needs to know
+  // which standing grants stand in a card's place (OPE-1876, channels/standing-authority.ts). After
+  // the divergence tripwire, because a child that never applies its policy must name none.
+  noteStandingWriteGrants(writeHosts);
+
+  const { reapply, reason } = planEgressApply({ phase, fingerprint, lastApplied: deps.lastApplied() });
+
+  // Enforced by default; egress.enforce: false opts out to dry-run. Even in dry-run we
+  // still apply a deny-all produced by a COMPILE ERROR — dry-run relaxes the *intended*
+  // policy for bundle-coverage gaps, not a failure to compute one at all.
+  const { enforce: wantEnforce, allowUnenforced } = getSettings().egress;
+  let applied = false;
+  let enforced = false;
+  let enforceError: string | undefined;
+  let abortError: Error | undefined;
+  // What the in-sandbox status file may honestly claim about this pass. `null` means this pass established nothing — the apply-threw case, where the policy still in force is the PREVIOUS one.
+  // Left null there, so the older file, which is still accurate, stands.
+  let publishState: EgressEnforcementState | null = null;
+
+  if (!reapply) {
+    // The recompiled policy is byte-identical to the one already in force. Deliberately nothing to audit either: a row per turn saying "still the same" would bury the rows that mean something.
+    return { phase, applied: false, reason, fingerprint, ownAccountEgressRefusals, ...(compileError ? { compileError } : {}) };
+  }
+
+  if (wantEnforce || compileError) {
+    applied = true;
+    try {
+      const result = await applyEgressPolicy(() => deps.apply(policy, scopeKey), allowUnenforced);
+      enforced = result.enforced;
+      enforceError = result.enforceError;
+      if (enforced) {
+        deps.rememberApplied(fingerprint);
+        publishState = "enforced";
+        log(
+          `${wantEnforce ? "enforced" : "enforced (compile-error deny-all)"} [${phase} · ${reason}]: ${summary} for ${scopeKey}`,
+        );
+      } else {
+        // The backend cannot apply fine-grained policy (Docker coarse, just-bash) and the operator accepted that with `egress.allowUnenforced`.
+        // The audit row and the in-sandbox status file both record `enforced: false`; softening it would be a security-relevant field stating something this pass disproved.
+        publishState = "unenforced";
+        log(`enforce FAILED (backend rejected setNetworkPolicy) — running UNENFORCED (egress.allowUnenforced: true): ${enforceError}`);
+      }
+    } catch (err) {
+      const failure = err instanceof Error ? err : new Error(String(err));
+      enforceError = failure.message;
+      if (phase === "session.started") {
+        // FAIL CLOSED: without the escape hatch a failed apply ABORTS the session — Eve's default
+        // is allow-all, so continuing here would run the agent with NO firewall. Returned (not
+        // thrown) so the caller audits the abort first.
+        abortError = failure;
+        log(`enforce FAILED — aborting session (fail-closed): ${failure.message}`);
+      } else {
+        // On a turn the last policy the sandbox ACCEPTED is still in force, so this is a staleness failure, not an unfirewalled one.
+        // No fingerprint is recorded, so the next turn retries.
+        log(`turn re-apply FAILED — the previously-applied policy stays in force: ${failure.message}`);
+      }
+    }
+  } else {
+    // Dry-run records the fingerprint too, or the skip-unchanged gate could never engage on this path and an `egress.enforce: false` deployment would get an `egress.policy` row on every turn.
+    // The recorded value still means "the policy this session is on", which in dry-run is the intended policy rather than an enforced one.
+    deps.rememberApplied(fingerprint);
+    publishState = "dry-run";
+    log(`dry-run (egress.enforce: false) [${phase} · ${reason}]: ${summary} for ${scopeKey}`);
+  }
+
+  // Best-effort by construction: diagnostics must never be able to undo the firewall that was just applied, so a failure is logged and the pass continues.
+  if (publishState !== null && deps.publish) {
+    try {
+      await deps.publish({ policy, state: publishState, fingerprint, compileError: compileError !== undefined });
+    } catch (err) {
+      log(`egress status file skipped (the policy itself is unaffected): ${String(err)}`);
+    }
+  }
+
+  // A proxy access-log line names a host and a client address; it names no org and no workspace, which the audit schema requires. This is the only moment those are known alongside the fingerprint of the generation now in force.
+  // Gated on `publishState !== null` for the same reason the status file is: a pass that established nothing must not re-stamp. Best-effort and silent.
+  if (publishState !== null && deps.rememberScope) {
+    try {
+      const s = deps.scope();
+      deps.rememberScope({
+        org: s.org,
+        platform: s.platform,
+        workspace: s.workspace,
+        surface: s.surface,
+        policyFingerprint: fingerprint,
+      });
+    } catch (err) {
+      log(`egress denial attribution not updated (the policy itself is unaffected): ${String(err)}`);
+    }
+  }
+
+  // Best-effort: an audit failure must not undo the policy just applied.
+  try {
+    const scope = deps.scope();
+    await audit({
+      org: scope.org,
+      platform: scope.platform,
+      workspace: scope.workspace,
+      surface: scope.surface,
+      principalId: scope.principalId,
+      action: "egress.policy",
+      detail: {
+        hosts: hostCount,
+        enforced,
+        scopeKey,
+        summary,
+        phase,
+        reason,
+        // The join key for an `egress.denied` row, which names the policy generation that refused it. Same spelling as `egress/STATUS.json` and the in-sandbox README, on purpose.
+        policyFingerprint: fingerprint,
+        // Allowed egress requests are audited on no tier — only the self-host proxy lifts DENIALS — so this row is the only place that can name which connection opened a write-capable host.
+        // `writeHostCount: 0` is a positive statement, so it rides every row, while the list itself rides only the rows that have one.
+        ...writeHostsAuditFields(writeHosts),
+        ...(compileError ? { error: compileError } : {}),
+        ...(enforceError ? { enforceError } : {}),
+        ...(abortError ? { aborted: true } : {}),
+        // A turn-level apply that failed is the row an incident reader is looking for: the session
+        // is running on a policy OLDER than its config says it should be.
+        ...(enforceError && phase === "turn.started" ? { reapplyFailed: true } : {}),
+      },
+    });
+
+    // eve has no per-surface connection filter, so this row is the authoritative "who was allowed which connector" trail; the connection's own `approval()` is the live hard gate.
+    // Recorded even when the set is empty, but only when the SET CHANGED, so the per-turn re-apply does not rewrite an identical row on every wake.
+    const connectorKey = connectors.join(",");
+    if (phase === "session.started" || deps.lastConnectors() !== connectorKey) {
+      deps.rememberConnectors(connectorKey);
+      // Connectors granted through a PLUGIN or a PROVIDER have no `contentOrigin` field to declare, so `assertBundlesValid` structurally cannot reach them and they stay on the table's fail-closed default.
+      // Naming them here is the only place a reader sees why a session's connector reads keep marking. Names only, like every other field on this row.
+      const undeclared = connectors.filter((c) => connectorContentOrigin[c] === undefined);
+      await audit({
+        org: scope.org,
+        platform: scope.platform,
+        workspace: scope.workspace,
+        surface: scope.surface,
+        principalId: scope.principalId,
+        action: "connector.grant",
+        detail: { connectors, scopeKey, phase, ...(undeclared.length > 0 ? { undeclaredContentOrigin: undeclared } : {}) },
+      });
+    }
+  } catch (err) {
+    log(`audit skipped (policy still applied): ${String(err)}`);
+  }
+
+  // `enforced` is true only where `setNetworkPolicy` actually applied — never in dry-run, never on a backend that rejected it — which is exactly the condition under which the git read-broker is safe to rely on instead of an in-sandbox token.
+  // A failed TURN-level re-apply must not downgrade the stamp: the previously-applied policy still enforces, and flipping it to false would put a credential inside the sandbox because a `sandbox.update` call blipped.
+  if (phase === "session.started" || enforced) (deps.stamp ?? stampEnforcement)(enforced);
+
+  return {
+    phase,
+    applied,
+    reason,
+    enforced,
+    fingerprint,
+    ownAccountEgressRefusals,
+    ...(compileError ? { compileError } : {}),
+    ...(enforceError ? { enforceError } : {}),
+    ...(abortError ? { abortError } : {}),
+  };
+}
+
+/** Per-session enforcement memo: the last SUCCESSFULLY-applied policy fingerprint (never the policy
+ *  itself — it holds credential values) and the last audited connector set. */
+const egressApplied = defineState<{ fingerprint?: string; connectors?: string }>(
+  "open-everywhere.egress.applied",
+  () => ({}),
+);
+
+function liveDeps(ctx: HookContext): EgressEnforcementDeps {
+  return {
+    resolve: () => resolveAccessFor(ctx),
+    // The narrowing dep applies the same live connector_override overlay the credential gate consults, keyed by connection id, so a break-glass revoke reaches this allow-list on the next re-apply rather than waiting for a deploy.
+    // The network-access LEVEL is resolved from the same `access` this pass just computed — no second resolve, no second ctx read — and fed to the compiler as an additive top-up; absent registration, every scope resolves to none.
+    compile: (access) =>
+      compileNetworkPolicy(
+        access,
+        resolveHeaders,
+        (ids) => narrowByConnectorOverride(ctx, ids),
+        resolveNetworkAccessLevel(access, getConfig().loadNetworkAccess?.() ?? []),
+      ),
+    apply: async (policy, scopeKey) => {
+      // Off Vercel with a proxy wired, the compiled policy is PUSHED to the egress-proxy control service instead of the Vercel firewall, under the same fail-closed contract: `pushEgressPolicy` throws on failure and the session aborts unless the escape hatch is set.
+      // The proxy accepts the policy natively, so `egress.allowUnenforced` is unnecessary in this mode.
+      if (useSelfHostEgress()) {
+        await pushEgressPolicy(policy, { sessionId: scopeKey });
+      } else {
+        const sandbox = await ctx.getSandbox();
+        await sandbox.setNetworkPolicy(policy);
+      }
+    },
+    // Deliberately NOT behind `useSelfHostEgress()`: the apply above skips the sandbox in proxy mode, but the reader of these files is a shell inside the sandbox either way.
+    // On Vercel the apply has already booted the sandbox, so this is free.
+    publish: async (input) => publishEgressStatus(await ctx.getSandbox(), input),
+    // Bound only inside an eve subagent child, so a root session's deps object costs not even a slot read. The sandbox is the PARENT's — eve reattaches the same instance for a child — which is what makes the parent's file readable at all.
+    ...(isSubagentChildContext(ctx as unknown as BindableContext)
+      ? { parentPublishedFingerprint: async () => readPublishedEgressFingerprint(await ctx.getSandbox()) }
+      : {}),
+    // Bound unconditionally rather than behind `useSelfHostEgress()`: only a poller that does not run on Vercel ever reads it, and a tier gate here would be one more place for the two tiers to drift.
+    rememberScope: rememberEgressAttribution,
+    lastApplied: () => egressApplied.get().fingerprint,
+    rememberApplied: (fingerprint) => egressApplied.update((s) => ({ ...s, fingerprint })),
+    lastConnectors: () => egressApplied.get().connectors,
+    rememberConnectors: (connectors) => egressApplied.update((s) => ({ ...s, connectors })),
+    scope: () => {
+      const p = resolvePartition(ctx);
+      return {
+        org: p.org,
+        platform: p.platform,
+        workspace: p.workspace,
+        surface: p.surface,
+        principalId: bindFrom(ctx).principalId,
+      };
+    },
+    // The live halt read, bound to this session's address: its surface, the tenant above it, and the bound person. The domain is deliberately absent, because the egress policy is compiled per SURFACE.
+    // A resolve failure answers `true`, which cuts egress rather than opening it.
+    halted: async () => {
+      try {
+        const p = resolvePartition(ctx);
+        return (await resolveHalt(haltScopeFor({ org: p.org, scopeKey: p.surfaceKey, ...(bindFrom(ctx).principalId ? { principalId: bindFrom(ctx).principalId } : {}) }))).halted;
+      } catch {
+        return true;
+      }
+    },
+  };
+}
+
+/**
+ * THE ROW the connector-tool road writes, for the road that has no tool call (OPE-1947).
+ *
+ * This edge is where the withholding REACHES THE WIRE: the compiled policy decides whether the firewall
+ * stamps the team key on the vendor's host, and a delegated worker running the sandbox REST skill meets no
+ * connector tool at all. So the refusal is recorded here, on the `connector.acting_identity` trail, rather
+ * than being visible only as an egress-plane row.
+ *
+ * 🔴 THE ROW RIDES THE ABORT PATH TOO, AND THAT IS THE POINT — through one of TWO callers. This function is
+ * the floated one, on every pass that did not abort and on an abort the own-account withholding does not
+ * explain; {@link ownAccountAbortError} awaits the same writer on the divergence arm, because it also needs
+ * the verdict. Between them every arm that wrote the row before still writes it. A worker dispatched by a seat whose own
+ * firewall still holds the vendor host is FAILED by the identical-binding tripwire above; that worker is
+ * exactly the case this row exists for, so a write conditioned on a successful apply would record nothing in
+ * the one state the ticket is about. The row records the DECISION — which identity the request required, and
+ * that it was refused — never a transport outcome; `egress.policy` is where enforcement is recorded. No
+ * reachable state makes the row false: where the apply fails and `egress.allowUnenforced` lets the session
+ * continue, eve's default session carries no credentials at all, so the team key still answers nothing.
+ *
+ * The refusals are CARRIED from the pass's own resolve rather than re-resolved: `resolveAccessFor` writes the
+ * plane's own best-effort `egress.own_account_refusal` row, and a second call at `session.started` — where
+ * there is no turn id to key that writer's memo — would duplicate it.
+ *
+ * Floated and swallowed on every arm. The policy apply is the security control; this is its record, and a
+ * store outage must never be able to fail an enforcement pass.
+ */
+function noteOwnAccountWithheld(ctx: HookContext, result: EgressEnforcementResult): void {
+  try {
+    void noteOwnAccountRouteRefusal(ctx as unknown as BindableContext, result.ownAccountEgressRefusals).catch(() => undefined);
+  } catch (err) {
+    log(`own-account acting-identity row skipped (the withholding itself is unaffected): ${String(err)}`);
+  }
+}
+
+/**
+ * The clause that turns the refusal into an account of THIS delegation, appended after it (OPE-1976). One
+ * line, never a blank one: eve renders a failed task's payload into the seat's settlement notification, and
+ * `access/background-tasks.ts` reads that payload only as far as the first BLANK line.
+ */
+function workerStoppedClause(connector: string): string {
+  return (
+    `(The delegated worker was stopped before it read anything: its seat's firewall still carries the shared ` +
+    `${connector} integration, and one session holds one credential per host, so the worker may not narrow it. ` +
+    // "The worker read nothing", never "nothing reached the vendor": the SEAT's own firewall carries the
+    // vendor host for the whole turn, so a claim about the session would be wider than this pass can know.
+    `The worker read nothing. Say the refusal above in the room — do not retry the delegation.)`
+  );
+}
+
+/**
+ * THE SENTENCE A DELEGATING SEAT'S WORKER IS FAILED WITH (OPE-1976).
+ *
+ * A worker whose seat carries an own-account stamp compiles its policy WITHOUT the vendor's hosts, so the
+ * identical-binding tripwire above fails it. That outcome is correct and stays: under the
+ * one-credential-per-host-per-session invariant (OPE-1549, ruled 2026-09-09) the ask cannot be answered on
+ * this road at all, and a child may not replace the firewall it shares with its seat. What was missing is the
+ * SENTENCE — the member got a dead delegation instead of the honest refusal a direct seat returns.
+ *
+ * So the refusal becomes the failure's own message. eve writes a failed task's error payload into the seat's
+ * settlement notification, and the seat answers the room off that report (OPE-1988), which is how the words
+ * reach the person who asked. The verdict comes from the SAME gate a direct seat's connector tool consults,
+ * so the two roads refuse in identical words rather than in two drifting copies.
+ *
+ * Fail-soft on every arm: an unreadable gate, a store outage or a verdict with no refusal all fall back to
+ * the tripwire's own message. A worse sentence is the cost; the withholding itself is already done.
+ */
+async function ownAccountAbortError(ctx: HookContext, result: EgressEnforcementResult): Promise<Error> {
+  // A plain Error, never the divergence class: `turn.started` rethrows that one class, so promoting a shape
+  // this function did not predict into it would rethrow an abort that edge is meant to swallow.
+  const fallback = result.abortError ?? new Error("egress enforcement aborted");
+  // `?? []` though the field is required: this runs on the path that is already failing, and a shape this
+  // function did not predict must cost the better sentence, never replace the abort with a TypeError.
+  const refusals = result.ownAccountEgressRefusals ?? [];
+  const connector = refusals[0]?.connector;
+  // 🔴 GATED ON THE ABORT'S CAUSE, NOT ON THE REFUSALS. `session.started` has TWO abort producers: this
+  // tripwire, and the fail-closed enforce failure when `setNetworkPolicy` throws without
+  // `egress.allowUnenforced`. A worker carrying an own-account stamp always has a non-empty refusals list, so
+  // keying on that alone told a member their ask was refused when the firewall apply had merely blipped —
+  // and told them not to retry the one delegation a retry would fix. The withholding is a fact about the
+  // pass; only the divergence is the abort this sentence explains.
+  if (connector === undefined || !(result.abortError instanceof EgressBindingDivergenceError)) {
+    // A real binding fault, or an abort of another kind. The row still rides the ordinary floated path.
+    noteOwnAccountWithheld(ctx, result);
+    return fallback;
+  }
+  try {
+    // Awaited, unlike the floated writer above: this pass needs the verdict it returns. It adds one grants
+    // read (`credentialGrantsInReach`) to a path that already awaits the divergence row's own write.
+    const verdict = await noteOwnAccountRouteRefusal(ctx as unknown as BindableContext, refusals);
+    if (verdict?.refusal === undefined) return fallback;
+    return new EgressBindingDivergenceError(`${verdict.refusal}\n${workerStoppedClause(connector)}`);
+  } catch (err) {
+    log(`own-account refusal sentence unavailable, failing the worker with the invariant message instead: ${String(err)}`);
+    return fallback;
+  }
+}
+
+export default defineHook({
+  events: {
+    "session.started": async (_event, ctx) => {
+      // Hook files have no ordering guarantee. Establish a delayed child's dispatch binding here
+      // too, before compiling the sandbox policy, rather than assuming binding-bridge ran first.
+      await ensureDelegatedTaskBinding(ctx as unknown as BindableContext);
+      const result = await enforceEgress("session.started", liveDeps(ctx));
+      // Rethrow AFTER auditing: hooks are awaited inline, so this fails the workflow
+      // loop and Eve emits a terminal session.failed — the turn never runs unenforced.
+      // An own-account abort is failed with the member's own refusal; `ownAccountAbortError` writes the
+      // acting-identity row on that path, so the row rides both arms exactly as OPE-1947 requires.
+      if (result.abortError) throw await ownAccountAbortError(ctx, result);
+      noteOwnAccountWithheld(ctx, result);
+    },
+
+    // The per-turn re-apply is the revocation reach for the egress plane: it recompiles from live config and live credentials and re-applies only when the result differs from what is in force.
+    // Wrapped so a failure in the surrounding plumbing degrades to a logged warning — the session-start policy is already enforcing, so an exception here could only kill a live session.
+    "turn.started": async (_event, ctx) => {
+      try {
+        await ensureDelegatedTaskBinding(ctx as unknown as BindableContext);
+        const result = await enforceEgress("turn.started", liveDeps(ctx));
+        // The one turn-level abort. Every other failure at this edge is a STALENESS failure, the last accepted policy still enforces, and that is why this edge otherwise never throws.
+        // A subagent child whose binding diverged is the opposite case: the thing still enforcing is the PARENT's policy, and the child must stop before it replaces it.
+        if (result.abortError) throw await ownAccountAbortError(ctx, result);
+        noteOwnAccountWithheld(ctx, result);
+      } catch (err) {
+        // 🔴 ON THE TYPE, NEVER ON THE WORDS. An own-account abort's message IS the member's refusal, so the
+        // invariant sentence this used to match is no longer in it — and a missed match here swallows the one
+        // abort this edge must rethrow, leaving the child running against its parent's firewall.
+        if (err instanceof DelegatedTaskBindingUnavailableError || err instanceof EgressBindingDivergenceError) throw err;
+        log(`turn.started re-apply skipped (session-start policy still in force): ${String(err)}`);
+      }
+    },
+  },
+});