@open-everywhere/core 0.1.0

package/agent/hooks/native-input-audit.ts

@@ -0,0 +1,41 @@
+// One audit row per non-park `input.requested` batch on a native surface (OPE-1275). This hook never posts: eve's shipped channel defaults and notion.ts already show the prompt.
+// The unified window and a subagent child are excluded by their RAW channel kind, because `bindFrom`'s `oe_platform` hop makes both resolve a real reply target, and the parent audits those requests.
+
+import { defineHook, type HookContext } from "eve/hooks";
+import { appendAudit } from "../audit/audit.js";
+import { isSubagentChildContext, isUnifiedWindowContext, type BindableContext } from "../identity/binding.js";
+import { detectBridgeableInputRequest } from "../channels/question-bridge.js";
+import { resolveReplyTarget } from "../channels/reply-post.js";
+import { resolvePartition } from "../memory/partition.js";
+
+/** A non-park `input.requested` batch reached a native-route surface. Detail carries ids and enums
+ *  only — never the model-authored prompt or option labels (the same redaction rule
+ *  channels/question-bridge.ts states for its own row). */
+export const NATIVE_INPUT_REQUESTED_AUDIT_ACTION = "turn.native_input_requested";
+
+export default defineHook({
+  events: {
+    "input.requested": async (event, ctx: HookContext) => {
+      try {
+        const question = detectBridgeableInputRequest((event.data as { requests?: unknown } | undefined)?.requests);
+        if (!question) return; // eve's session-limit park — hooks/session-park.ts owns that one.
+        const bindable = ctx as unknown as BindableContext;
+        if (isUnifiedWindowContext(bindable)) return; // channels/question-bridge.ts already audits this one.
+        if (isSubagentChildContext(bindable)) return; // the PARENT's adapter carries a worker's request, and audits it there.
+        const target = resolveReplyTarget(bindable);
+        if (target === null) return; // no resolvable native surface at all.
+        const p = resolvePartition(bindable);
+        await appendAudit({
+          action: NATIVE_INPUT_REQUESTED_AUDIT_ACTION,
+          detail: { kind: question.kind, platform: target.platform, requestId: question.requestId, toolName: question.toolName },
+          org: p.org,
+          platform: p.platform,
+          surface: p.surface,
+          workspace: p.workspace,
+        });
+      } catch (err) {
+        console.warn(`[open-everywhere:native-input-audit] audit skipped: ${String(err)}`);
+      }
+    },
+  },
+});

package/agent/hooks/own-account-ask.ts

@@ -0,0 +1,172 @@
+// The one writer of the `oe_own_account_ask` stamp, and the one clearer of its own stale stamp — an auth bag survives into a later delivery (OPE-1597). The fence is `captureEligible` (hooks/requester-messages.ts).
+// It is also the DECISION POINT for an own-account turn, so it writes the `connector.own_account_ask` row (OPE-1900) — see `auditOwnAccountAsk` below for why that row exists and why it cannot wait for the gate.
+// The stamp itself stays synchronous and I/O-free: this runs in a turn preamble, where a store round trip loses eve's divergence-detector timing bet. The row is written WITHOUT being awaited, for exactly that reason.
+
+import { defineHook, type HookContext, type HookEvent } from "eve/hooks";
+import { appendAudit } from "../audit/audit.js";
+import { isWakeEnvelopeShaped, triggerMessageBody } from "../channels/wake-envelope.js";
+import { OE_OWN_ACCOUNT_ASK_ATTR, parseOwnAccountStamp, renderOwnAccountStamp } from "../connections/own-account-carriage.js";
+import {
+  CONNECTOR_OWN_ACCOUNT_ASK_ACTION,
+  namedOwnAccountVendor,
+  ownAccountAskAuditDetail,
+  type OwnAccountAsk,
+  type OwnAccountVendor,
+} from "../connections/own-account-ask.js";
+import { credentialGrantVendors, ownAccountAskVendors } from "../connections/own-account-vendors.js";
+import { currentTurnId, type BindableContext } from "../identity/binding.js";
+import { resolvePartition } from "../memory/partition.js";
+import type { AuditInput } from "../operational/store.js";
+import { captureEligible } from "./requester-messages.js";
+
+/**
+ * Creates the attributes bag when `auth.current` exists without one. `null` means no writable bag, which reads as no ask.
+ * A write here reaches a child eve dispatches later in the same turn — see hooks/spawn-taint.ts's `writableAuthAttrs` measurement note.
+ */
+function writableAuthAttrs(ctx: HookContext): Record<string, unknown> | null {
+  try {
+    const current = (ctx as { session?: { auth?: { current?: { attributes?: unknown } } } }).session?.auth?.current;
+    if (current === undefined || current === null) return null;
+    const attrs = current.attributes;
+    if (typeof attrs === "object" && attrs !== null) return attrs as Record<string, unknown>;
+    const fresh: Record<string, unknown> = {};
+    (current as { attributes?: unknown }).attributes = fresh;
+    return (current as { attributes?: unknown }).attributes === fresh ? fresh : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * A judged wake delivers a RENDERED ENVELOPE carrying the backscroll siblings' bodies, so a raw body passes through and an envelope is reduced to its one trigger element.
+ * An envelope naming no single trigger resolves nothing — the fail-closed answer, and the only one that keeps the ask and the requester in ONE message.
+ */
+export function askBodyOf(text: string | undefined): string | undefined {
+  if (text === undefined) return undefined;
+  if (!isWakeEnvelopeShaped(text)) return text;
+  return triggerMessageBody(text);
+}
+
+/**
+ * Drops a stamp THIS session wrote, when a later graded delivery names no account (OPE-1597).
+ * The session-id guard is load-bearing: clearing a stamp a SEAT wrote would silently un-personalise the delegated read a member asked for.
+ */
+function clearOwnStamp(attrs: Record<string, unknown>, sessionId: string): void {
+  const raw = attrs[OE_OWN_ACCOUNT_ASK_ATTR];
+  const first = Array.isArray(raw) ? raw[0] : raw;
+  if (typeof first !== "string") return;
+  const stamp = parseOwnAccountStamp(first);
+  if (stamp === undefined || stamp.sessionId !== sessionId) return;
+  delete attrs[OE_OWN_ACCOUNT_ASK_ATTR];
+}
+
+/** What ONE delivery's grading came to: the ask the grammar recognised, and whether the stamp reached the auth bag.
+ *  🔴 The two are SEPARATE because an unwritable bag must not hide the ask: the row below is the record that a person
+ *  asked at all, and the bag is only how a delegated worker inherits it. */
+export interface OwnAccountAskRecognition {
+  readonly ask: OwnAccountAsk;
+  /** The `oe_own_account_ask` stamp was written onto this delivery's auth bag. */
+  readonly stamped: boolean;
+}
+
+/**
+ * Grades this delivery, stamps a recognised ask onto its auth bag, or clears this session's own stale stamp when the delivery names no account. Never throws.
+ * 🔴 THE GRAMMAR RUNS BEFORE THE BAG IS READ, and an unwritable bag or an unreadable session id resolves `stamped: false` rather than "no ask".
+ * The CLEAR still needs both, so it can only fire on a delivery whose words were read AND whose stamp this session could own — the OPE-1597 guard is unchanged.
+ */
+export function stampOwnAccountAsk(event: HookEvent<"message.received">, ctx: HookContext): OwnAccountAskRecognition | undefined {
+  try {
+    if (!captureEligible(ctx)) return undefined;
+    const { message } = event.data;
+    if (typeof message !== "string") return undefined;
+    const body = askBodyOf(message);
+    if (body === undefined) return undefined;
+    // The vendors come from the shared registry (connections/own-account-vendors.ts), which THROWS rather than answering that no vendor declares a human-acting family (OPE-1641).
+    // On the degraded path the grammar still runs over the credential-grant connectors, but that half is NARROWER than the truth, so this delivery clears no stamp.
+    let vendors: readonly OwnAccountVendor[];
+    let degraded = false;
+    try {
+      vendors = ownAccountAskVendors();
+    } catch (err) {
+      degraded = true;
+      vendors = credentialGrantVendors();
+      console.error(`[open-everywhere:own-account] grading this delivery with the credential-grant connectors only, and clearing no stamp: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const ask = namedOwnAccountVendor([body], vendors);
+    const raw = (ctx as { session?: { id?: string } }).session?.id;
+    // The session id is what makes a stamp THIS session's own — to write and, above all, to clear.
+    const sessionId = typeof raw === "string" && raw.length > 0 ? raw : undefined;
+    const attrs = sessionId === undefined ? null : writableAuthAttrs(ctx);
+    if (ask === undefined) {
+      if (!degraded && attrs !== null && sessionId !== undefined) clearOwnStamp(attrs, sessionId);
+      return undefined;
+    }
+    if (attrs === null || sessionId === undefined) return { ask, stamped: false };
+    attrs[OE_OWN_ACCOUNT_ASK_ATTR] = renderOwnAccountStamp(sessionId, currentTurnId(ctx as unknown as BindableContext), ask);
+    return { ask, stamped: true };
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * The row ONE recognised ask leaves, built from this delivery's own partition.
+ *
+ * `undefined` when the CONTEXT CANNOT BE READ AT ALL — a row with no scope to key on is not evidence, and
+ * inventing one would put an own-account ask in some other surface's trail. 🔴 That is a narrower case than
+ * it sounds, and the narrowness is measured: `resolvePartition` answers the local defaults for a context
+ * carrying no fields, so only a context whose property access THROWS reaches this fail direction
+ * (own-account-ask-audit-test.ts part 5 drives both).
+ *
+ * Pure, and exported so a suite drives the whole row — action, scope and detail — with no store.
+ */
+export function ownAccountAskAuditEntry(recognition: OwnAccountAskRecognition, ctx: HookContext): AuditInput | undefined {
+  try {
+    const p = resolvePartition(ctx as unknown as BindableContext);
+    return {
+      action: CONNECTOR_OWN_ACCOUNT_ASK_ACTION,
+      detail: ownAccountAskAuditDetail(recognition.ask, recognition.stamped),
+      org: p.org,
+      platform: p.platform,
+      surface: p.surface,
+      workspace: p.workspace,
+    };
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Grade the delivery and, when it asked, leave the DECISION-POINT row (OPE-1900).
+ *
+ * 🔴 WHY THE ROW CANNOT WAIT FOR THE GATE. `connections/own-account-gate.ts` writes one
+ * `connector.acting_identity` row per gated connector READ. A seat that answers "I cannot act as you" WITHOUT
+ * reading — the CORRECT outcome — reaches no gated read, so it wrote nothing at all, and an auditor could not
+ * tell that turn from one that never happened (measured on ship #215: 86 rows on the window, 0 of them
+ * acting-identity). This hook is the one place that fires on the ask itself.
+ *
+ * 🔴 THE REGISTERED HANDLER DOES NOT AWAIT THIS. The stamp runs synchronously, BEFORE the first `await` below,
+ * so the turn preamble is unchanged — a store round trip there loses eve's divergence-detector timing bet. The
+ * row is then best-effort in exactly the way the gate's own write is. The promise is returned rather than
+ * floated inside, so a suite can await the write it just caused instead of racing it.
+ */
+export async function auditOwnAccountAsk(
+  event: HookEvent<"message.received">,
+  ctx: HookContext,
+  write: (entry: AuditInput) => Promise<void> = appendAudit,
+): Promise<OwnAccountAskRecognition | undefined> {
+  const recognition = stampOwnAccountAsk(event, ctx);
+  if (recognition === undefined) return undefined;
+  const entry = ownAccountAskAuditEntry(recognition, ctx);
+  if (entry !== undefined) await write(entry).catch(() => undefined);
+  return recognition;
+}
+
+export default defineHook({
+  events: {
+    // `.catch` on the floated promise, not decoration: this handler is `void`ed, so a rejection — an
+    // injected writer that threw, a partition read that failed past the guards — would surface as an
+    // unhandled rejection in a turn preamble instead of a dropped best-effort row.
+    "message.received": (event, ctx) => void auditOwnAccountAsk(event, ctx).catch(() => undefined),
+  },
+});

package/agent/hooks/requester-identity.ts

@@ -0,0 +1,30 @@
+// Captures WHO asked from `message.received`, the only seam that sees the whole coalesced delivery; a tool context on the unified single-window path carries no auth attributes at all.
+// Separate from hooks/requester-messages.ts on purpose: that hook captures nothing inside a delegation child, while this one must run inside a child, because that is where the inherited stamp is read.
+
+import { defineHook, type HookContext, type HookEvent } from "eve/hooks";
+import { recordRequesterIdentity } from "../access/requester-identity.js";
+import type { BindableContext } from "../identity/binding.js";
+import { recordDeliveredWakes } from "../access/dispatch-origin-signal.js";
+
+function captureRequesterIdentity(event: HookEvent<"message.received">, ctx: HookContext): void {
+  try {
+    const { message, turnId } = event.data;
+    recordDeliveredWakes(typeof turnId === "string" ? turnId : undefined, typeof message === "string" ? message : undefined);
+    recordRequesterIdentity(
+      ctx as unknown as BindableContext,
+      typeof turnId === "string" ? turnId : undefined,
+      typeof message === "string" ? message : undefined,
+    );
+  } catch {
+    // Best-effort observation — a capture failure must never disturb the turn. The consumer
+    // (access/admin-standing.ts) fails CLOSED on the absence this leaves behind, on every seat it
+    // can see more than one person can wake (`seatServesManyAskers`); a per-surface session, a
+    // script or the control plane serves one asker, so there it still reads the acting principal.
+  }
+}
+
+export default defineHook({
+  events: {
+    "message.received": (event, ctx) => captureRequesterIdentity(event, ctx),
+  },
+});

package/agent/hooks/requester-messages.ts

@@ -0,0 +1,55 @@
+// Fills access/requester-messages.ts's per-turn slot from message.received. Its one consumer is the approval judge's reasoning-blind requesterMessages consent signal.
+// The capture fence is provenance, not parsing: model-authored, outside-party or tool-derived bytes with no requester behind them must never reach an enforcing judge.
+
+import { defineHook, type HookContext, type HookEvent } from "eve/hooks";
+import { recordRequesterMessage } from "../access/requester-messages.js";
+import { FIRE_UNATTENDED_ATTR, isSubagentChildContext, type BindableContext } from "../identity/binding.js";
+import { adoptedParentTurnTaintThisTurn, TAINT_SEED_ATTRS } from "./spawn-taint.js";
+
+/** Read the DELIVERY's attributes (`current`, never `initiator`) — the same channel and the same
+ *  reasoning as spawn-taint's currentAttrs: a stamp belongs to the delivery that carries it. */
+function currentAttrs(ctx: HookContext): Record<string, unknown> | undefined {
+  return (ctx as { session?: { auth?: { current?: { attributes?: Record<string, unknown> } | null } } }).session?.auth?.current?.attributes;
+}
+
+/** Array-tolerant truthy read (eve can hand attributes back as `string[]`). */
+function stampedTrue(v: unknown): boolean {
+  const first = Array.isArray(v) ? v[0] : v;
+  return first === "true" || first === true;
+}
+
+/** Is this delivery capture-eligible requester material? False inside a native delegation child,
+ *  false on ANY unattended/taint-seed stamp, and false when the attributes are unreadable in a way
+ *  that hides a stamp — absence of capture is the safe direction (the judge just decides on action
+ *  facts alone). */
+export function captureEligible(ctx: HookContext): boolean {
+  // A native child's opening message is written by the PARENT MODEL — eve wraps the parent's agent tool argument in its own subagent preamble — so a delegation child is never a requester.
+  // The test keys on host-set, model-unforgeable delegation identity, and no human path reaches a session carrying any of those arms.
+  if (isSubagentChildContext(ctx as unknown as BindableContext)) return false;
+  const attrs = currentAttrs(ctx);
+  if (stampedTrue(attrs?.[FIRE_UNATTENDED_ATTR])) return false;
+  for (const name of TAINT_SEED_ATTRS) {
+    if (stampedTrue(attrs?.[name])) return false;
+  }
+  // Read the slot, never the attribute. The forward stamp is a carriage, and the child's own adoption overwrites it during turn.started.
+  // eve awaits that adoption before it emits message.received, so re-deriving the answer from the attributes here is always false.
+  if (adoptedParentTurnTaintThisTurn(ctx)) return false;
+  return true;
+}
+
+function captureReceivedMessage(event: HookEvent<"message.received">, ctx: HookContext): void {
+  try {
+    if (!captureEligible(ctx)) return;
+    const { message, turnId } = event.data;
+    if (typeof message !== "string") return;
+    recordRequesterMessage(typeof turnId === "string" ? turnId : undefined, message);
+  } catch {
+    // Best-effort observation — a capture failure must never disturb the turn.
+  }
+}
+
+export default defineHook({
+  events: {
+    "message.received": (event, ctx) => captureReceivedMessage(event, ctx),
+  },
+});

package/agent/hooks/routine-outcome.ts

@@ -0,0 +1,252 @@
+// Folds a routine fire's real outcome back onto the routine at the fire's OWN turn, and writes the routine.fire join that only this seam can (it holds both the marker and the session id).
+// ONE FOLD PER FIRE: a subagent child never folds and a latched fire never folds twice, because a spurious fold advances the schedule and ERASES the failure streak that disables a broken routine. A fire that settled non-failed reopens for exactly one late declared failure.
+
+import { defineHook, type HookContext } from "eve/hooks";
+import { defineState } from "eve/context";
+import { oneAttrValue, routineFireIdStamped, routineManualStamped, routineMarker } from "../routines/routine.js";
+import { foldRoutineOutcome, type RoutineOutcomeMarker } from "../routines/outcome-fold.js";
+import { isScheduleOriginatedAuth, isSubagentChildContext, type BindableContext } from "../identity/binding.js";
+import { OE_WAKE_ID_ATTR } from "../channels/unified-window.js";
+
+/** The auth slot this hook reads, structurally - the shape a hook's HookContext and a tool's execute ctx both satisfy, so noteDeclaredRunFailure can take it too. */
+export interface FireBagContext {
+  readonly session?: {
+    readonly id?: unknown;
+    readonly auth?: { readonly current?: unknown; readonly initiator?: unknown } | null;
+  };
+}
+
+/**
+ * Everything the fold needs, CAPTURED at `turn.started`. The values are captured rather than re-read at the turn end, so the fold does not depend on the auth slot still holding the fire's bag after the turn's last step.
+ * A slot that is null is a turn that will not fold, whatever the auth says later.
+ */
+interface ArmedFire {
+  readonly marker: RoutineOutcomeMarker;
+  readonly manual: boolean;
+  readonly sessionId?: string;
+  /**
+   * The fire's own id - the per-FIRE latch key: the dispatcher's ROUTINE_MARKER.fire stamp first, then the window divert's `oe_wake_id`, then NO_WAKE_KEY.
+   * Both stamps hold the same host-minted uuid on a windowed fire, so the key does not depend on which one is read.
+   */
+  readonly wakeKey: string;
+}
+
+/** The per-session fold state. `folded` is keyed by fire id, which is what makes the fold per-FIRE rather than per-turn: a job seat's next fire arrives with a fresh id and is unaffected by it. */
+interface FoldState {
+  readonly armed: ArmedFire | null;
+  readonly folded: Record<string, true>;
+  /** The fires whose fold settled NON-failed and may still take ONE late declared failure. The late fold deletes the key, so one fire reopens once. */
+  readonly lateOpen: Record<string, true>;
+  /** The fire a declaration on THIS turn will fold at the turn end, or `null`. Written by
+   *  {@link noteDeclaredRunFailure}, cleared unconditionally at every `turn.started`. */
+  readonly lateFold: ArmedFire | null;
+}
+
+/**
+ * Every read of `lateOpen` and `lateFold` must tolerate their absence: a session resumed across the deploy that adds them hands back a container built by the old factory.
+ * Read as "no fire is late-open, nothing is pending", which is the fail-closed direction.
+ */
+const foldState = defineState<FoldState>("open-everywhere.routines.foldState", () => ({
+  armed: null,
+  folded: {},
+  lateOpen: {},
+  lateFold: null,
+}));
+
+/**
+ * The latch key for a fire that carries NEITHER per-fire stamp. Every such fire in one session shares it, so the session folds AT MOST ONCE.
+ * Fail-closed on purpose: losing a fold under-reports, while a wrong fold RESETS a failure streak that was about to disable a broken routine.
+ */
+const NO_WAKE_KEY = "no-wake";
+
+function log(msg: string): void {
+  console.log(`[open-everywhere:routines] ${msg}`);
+}
+
+/**
+ * Arms the fold only when this turn belongs to a routine FIRE that has not folded yet. Each part of the predicate closes a distinct wrong fold: a subagent child inherits the parent's whole bag and its fold would file the CHILD's session id;
+ * eve's schedule auth stops a job seat's `auth.initiator` (which holds the FIRST fire's bag forever) folding on a human's turn; and without the routine marker there is nothing to fold onto.
+ */
+function armFireFold(ctx: HookContext, alreadyFolded: Readonly<Record<string, true>>): ArmedFire | null {
+  const fire = readFireBag(ctx as unknown as FireBagContext);
+  if (fire === null) return null;
+  if (alreadyFolded[fire.wakeKey] === true) return null; // this FIRE is already settled — a later turn of it
+  return fire;
+}
+
+/** Reads the fire this context belongs to, with no reference to what has already folded - the same predicate and key derivation the declaration path needs on a fire that HAS folded. */
+function readFireBag(ctx: FireBagContext): ArmedFire | null {
+  if (isSubagentChildContext(ctx as unknown as BindableContext)) return null;
+  const c = ctx;
+  // `current` first, `initiator` only when there is no current slot at all — the same precedence
+  // identity/binding.ts's `authOf` uses, so this reads the slot the turn's own tools will read.
+  const auth = (c.session?.auth?.current ?? c.session?.auth?.initiator ?? null) as
+    | { authenticator?: unknown; principalId?: unknown; principalType?: unknown; attributes?: Record<string, string | readonly string[]> }
+    | null;
+  if (!isScheduleOriginatedAuth(auth)) return null; // cheapest exit on every ordinary turn
+  const marker = routineMarker(auth?.attributes);
+  if (!marker) return null;
+  const wakeKey =
+    routineFireIdStamped(auth?.attributes) ?? oneAttrValue(auth?.attributes?.[OE_WAKE_ID_ATTR]) ?? NO_WAKE_KEY;
+  const sessionId = typeof c.session?.id === "string" && c.session.id.length > 0 ? c.session.id : undefined;
+  return {
+    marker,
+    // The host-set manual stamp rides the same attribute bag as the marker, and it is the only surviving witness that a human asked for this run off-schedule: the dispatcher clears `manualRunAt` from the row at fire time.
+    manual: routineManualStamped(auth?.attributes),
+    wakeKey,
+    ...(sessionId !== undefined ? { sessionId } : {}),
+  };
+}
+
+/**
+ * Takes the armed fire, clears the arm and LATCHES its fire id, all in one act before the fold runs.
+ * The latch lands BEFORE the store write: foldRoutineOutcome is asynchronous and the settlement-wake turn of the same fire can begin while it is in flight, so latching afterwards would leave both turns believing they are the first.
+ */
+function consumeArmedFire(): ArmedFire | null {
+  try {
+    const armed = foldState.get().armed;
+    if (armed === null) return null;
+    foldState.update((s) => ({ ...s, armed: null, folded: { ...s.folded, [armed.wakeKey]: true } }));
+    return armed;
+  } catch {
+    return null; // an unreadable container folds nothing, which is the safe direction
+  }
+}
+
+/**
+ * Marks this fire LATE-OPEN: it settled without a failure, so one declared failure from a later turn of the same fire may still fold. Fail-soft - an unreadable container leaves the fire closed.
+ * It runs AFTER the fold, so a declaration made while the first fold is still in flight answers `uncounted`: that costs ONE strike and never invents one, while opening the fire before the fold could let an `ok` overwrite a late `failed`.
+ */
+function openLateFold(wakeKey: string): void {
+  try {
+    foldState.update((s) => ({ ...s, lateOpen: { ...(s.lateOpen ?? {}), [wakeKey]: true } }));
+  } catch {
+    /* no late fold for this fire — a lost strike, never a wrong one */
+  }
+}
+
+/** Takes the pending late fold and CLOSES the fire to any further one: one fire owes at most one late strike, however many turns declare one. */
+function consumeLateFold(): ArmedFire | null {
+  try {
+    const late = foldState.get().lateFold ?? null;
+    if (late === null) return null;
+    foldState.update((s) => {
+      const lateOpen = { ...(s.lateOpen ?? {}) };
+      delete lateOpen[late.wakeKey];
+      return { ...s, lateFold: null, lateOpen };
+    });
+    return late;
+  } catch {
+    return null; // an unreadable container folds nothing, which is the safe direction
+  }
+}
+
+async function record(outcome: "ok" | "failed"): Promise<void> {
+  const armed = consumeArmedFire();
+  if (armed !== null) {
+    await fold(armed, outcome, false);
+    return;
+  }
+  const late = consumeLateFold();
+  if (late !== null) await fold(late, "failed", true);
+}
+
+/** Fold one settlement of one fire. `late` marks the SECOND settlement of a fire that already folded non-failed and then declared a failure. */
+async function fold(fire: ArmedFire, outcome: "ok" | "failed", late: boolean): Promise<void> {
+  try {
+    const folded = await foldRoutineOutcome({
+      marker: fire.marker,
+      sessionOutcome: outcome,
+      at: new Date(),
+      ...(fire.sessionId !== undefined ? { sessionId: fire.sessionId } : {}),
+      ...(fire.manual ? { manual: true } : {}),
+      ...(late ? { late: true } : {}),
+    });
+    if (!folded.folded) return; // cancelled meanwhile
+    // Only a fold that settled non-failed reopens the fire: one that settled `failed` has spent its strike, and reopening it would let one fire count twice. This line is the only thing that ever opens the late path.
+    if (!late && folded.outcome !== "failed") openLateFold(fire.wakeKey);
+    log(
+      `outcome ${folded.outcome}${late ? " (LATE declaration)" : ""} for ${fire.marker.id} [${fire.marker.surfaceKey}] ` +
+        `(fails=${folded.consecutiveFailures}${folded.disabled ? ", AUTO-DISABLED" : ""})`,
+    );
+  } catch (err) {
+    log(`outcome record skipped for ${fire.marker.id}: ${String(err)}`);
+  }
+}
+
+/** What will become of a `report_run_failed` declaration made right now — the answer
+ *  `tools/report_run_failed.ts` reports to the model instead of guessing. */
+export type DeclaredFailureFate =
+  /** This fire's own fold is still ahead of the declaration - the turn end reads the row and settles `failed`. */
+  | "counted"
+  /** The fire already folded, and this declaration reopened it for ONE late fold at this turn's end. */
+  | "counted-late"
+  /** The fire already folded and is NOT reopenable - it settled `failed`, a human cancelled it, or it has taken its one late fold. Nothing will count this declaration. */
+  | "uncounted"
+  /** Not decidable from here: no readable fire bag on this context. The caller must not claim either way. */
+  | "unknown";
+
+/**
+ * Called from tools/report_run_failed.ts and nowhere else: says what will become of a declaration just written to the row, and arms the late fold when one is owed. It lives here because the fold state is this hook's.
+ * Unknown is NOT uncounted: a declaration from a delegated child reaches no fire bag here, yet the PARENT's fold can still read the row it wrote.
+ */
+export function noteDeclaredRunFailure(ctx: FireBagContext): DeclaredFailureFate {
+  try {
+    const fire = readFireBag(ctx);
+    if (fire === null) return "unknown";
+    const s = foldState.get();
+    if (s.armed !== null && s.armed.wakeKey === fire.wakeKey) return "counted";
+    // Positive evidence only: this exact fire is recorded as folded. Anything else — a fire this
+    // container never saw, a resumed session with an empty map — is `unknown`, not `uncounted`.
+    if (s.folded?.[fire.wakeKey] !== true) return "unknown";
+    if (s.lateOpen?.[fire.wakeKey] !== true) return "uncounted";
+    foldState.update((st) => ({ ...st, lateFold: fire }));
+    return "counted-late";
+  } catch {
+    return "unknown";
+  }
+}
+
+export default defineHook({
+  events: {
+    "turn.started": (_event, ctx) => {
+      // Fail-soft in both directions: an unreadable auth slot arms nothing (the fire goes unfolded,
+      // which is the behaviour this deployment already had), and a state-container blip must never
+      // fail the fire's turn.
+      try {
+        // UNCONDITIONAL. A cancelled fire turn emits neither `turn.completed` nor `turn.failed`, so its arm is never consumed; a conditional write would leave that stale arm for the NEXT turn to fold as `ok`, advancing nextRunAt and resetting the failure streak.
+        // `lateFold` is cleared here by the same act, so a declaration made on a turn that then cancelled cannot fold onto a later one.
+        foldState.update((s) => ({ ...s, armed: armFireFold(ctx, s.folded), lateFold: null }));
+      } catch {
+        /* unarmed — never break the fire for the sake of observing it */
+      }
+    },
+    "turn.completed": async () => {
+      await record("ok");
+    },
+    // A CANCELLED fire records NO outcome and LATCHES its fire id. Dropping the arm alone is not enough: a later turn of the SAME fire - the task-settlement wake - would arm again and fold `ok`, reporting a run a human stopped as a clean success.
+    // The routine is not stranded, because the dispatcher advances the schedule at FIRE time, not at fold time.
+    "turn.cancelled": () => {
+      try {
+        const armed = foldState.get().armed;
+        // OPE-625: a declaration made on THIS turn dies with it, armed fire or not. A cancelled turn
+        // settles nothing, and that has to hold for the late path as well as the ordinary one.
+        foldState.update((s) => ({ ...s, lateFold: null }));
+        if (armed === null) return;
+        foldState.update((s) => ({ ...s, armed: null, folded: { ...s.folded, [armed.wakeKey]: true } }));
+        log(`fire cancelled for ${armed.marker.id} [${armed.marker.surfaceKey}] — no outcome recorded`);
+      } catch {
+        /* an unreadable container drops nothing; the unconditional arm at the next turn.started
+           still clears the stale slot, which is the half that prevents a wrong fold */
+      }
+    },
+    "turn.failed": async () => {
+      await record("failed");
+    },
+    // BELT ONLY. eve emits `session.failed` inside the turn loop after `turn.failed`, where the arm is already consumed, and its terminal site never dispatches to hooks - so a session that dies outside a turn reaches no hook at all.
+    // The line stays because it costs one state read and would carry a future eve that does dispatch it.
+    "session.failed": async () => {
+      await record("failed");
+    },
+  },
+});

package/agent/hooks/routine-silence.ts

@@ -0,0 +1,38 @@
+// Writes the silence slot on EVERY turn, not only on a positive stamp: a durable JOB routine resumes one eve session across fires and can also be woken by a human, so a stale true would silence an answer owed to a person.
+// The stamp is host-set off the stored routine row (routines/fire-auth.ts) and is not model-writable.
+
+import { defineHook, type HookContext } from "eve/hooks";
+import { routineSilentStamped } from "../routines/routine.js";
+import { clearSilentRoutineTurn, markSilentRoutineTurn } from "../routines/report.js";
+
+function attrsOf(ctx: HookContext): Readonly<Record<string, string | readonly string[]>> | undefined {
+  const c = ctx as unknown as {
+    session?: {
+      auth?: {
+        current?: { attributes?: Readonly<Record<string, string | readonly string[]>> } | null;
+        initiator?: { attributes?: Readonly<Record<string, string | readonly string[]>> } | null;
+      };
+    };
+  };
+  return c.session?.auth?.current?.attributes ?? c.session?.auth?.initiator?.attributes;
+}
+
+function classifyTurn(ctx: HookContext): void {
+  // (1) CLEAR FIRST — everything below can throw; "posts" is the safe verdict.
+  clearSilentRoutineTurn();
+  try {
+    if (routineSilentStamped(attrsOf(ctx))) markSilentRoutineTurn();
+  } catch {
+    /* an unreadable auth bag means "not a silent fire" — never disturb the turn */
+  }
+}
+
+export default defineHook({
+  events: {
+    "turn.started": (_event, ctx) => classifyTurn(ctx),
+    // Belt on the clear-first brace: a finished turn drops the signal, so a turn that never reaches
+    // the hook (or reaches it and throws) can never inherit the previous turn's silence.
+    "turn.completed": () => clearSilentRoutineTurn(),
+    "turn.failed": () => clearSilentRoutineTurn(),
+  },
+});

package/agent/hooks/session-park.ts

@@ -0,0 +1,48 @@
+// At its session-token bound eve parks a conversation-mode session on a HITL prompt that nothing answers, so `input.requested` is the only visible trace that the seat stopped answering.
+// Discriminating on the `session_limit_continuation` tool name is load-bearing: an `ask_question` prompt reaches this same event, and channels/question-bridge.ts posts every non-park request.
+
+import { defineHook, type HookContext } from "eve/hooks";
+import { domainKeyOf, resolvePartition } from "../memory/partition.js";
+import { bareTokenFromEveContext } from "../channels/window-key.js";
+import { detectSessionLimitPark, handleSessionLimitPark } from "../channels/session-park.js";
+
+export default defineHook({
+  events: {
+    "input.requested": async (event, ctx: HookContext) => {
+      try {
+        const park = detectSessionLimitPark((event.data as { requests?: unknown } | undefined)?.requests);
+        if (!park) return;
+        const p = resolvePartition(ctx);
+        // eve reports the context token namespaced with the channel-definition name, while every registry row stores the bare token OE minted (OPE-92).
+        // Fall back to the raw value so a native or foreign session still gets its audit row.
+        const token = bareTokenFromEveContext(ctx.channel?.continuationToken) ?? ctx.channel?.continuationToken;
+        const sessionId = typeof ctx.session?.id === "string" && ctx.session.id.length > 0 ? ctx.session.id : undefined;
+        const outcome = await handleSessionLimitPark(
+          {
+            org: p.org,
+            platform: p.platform,
+            workspace: p.workspace,
+            surface: p.surface,
+            domainKey: domainKeyOf(p),
+            token,
+            ...(sessionId !== undefined ? { sessionId } : {}),
+          },
+          park,
+        );
+        // Loud by design — a parked seat is a liveness event, and the console line is the fastest signal in `vercel logs`.
+        console.warn(
+          // The noun is derived, not interpolated (OPE-1557): eve's third bound has kind `token-cost`, so a bare kind-plus-token printed a token-cost-token bound and sent an operator looking for a token limit when the cap is in dollars.
+          `[open-everywhere:session-park] session hit eve's ${
+            park.kind === "token-cost"
+              ? `model token-COST bound${park.limitUsd !== undefined ? ` ($${park.limitUsd})` : ""}`
+              : `${park.kind}-token bound${park.limit !== undefined ? ` (${park.limit})` : ""}`
+          } and PARKED ` +
+            `(org=${p.org} surface=${p.surfaceKey} token=${JSON.stringify(token)} remedy=${outcome.remedy}` +
+            `${outcome.registryKey ? ` key=${outcome.registryKey}` : ""}${outcome.audited ? "" : " audit=throttled"})`,
+        );
+      } catch (err) {
+        console.warn(`[open-everywhere:session-park] park handling skipped: ${String(err)}`);
+      }
+    },
+  },
+});