@open-everywhere/core 0.1.0

package/agent/access/credential-grant-key-shape.ts

@@ -0,0 +1,59 @@
+// WHAT A CREDENTIAL-GRANT SCOPE KEY LOOKS LIKE, and nothing about who may mint one. The two prefixes,
+// the separator that packs the room key's pair, and the two readers that answer from a key's own shape.
+//
+// 🔴 IT IS A LEAF, AND THAT IS THE WHOLE REASON IT EXISTS (OPE-2160). The minting rule lives in
+// `credential-grant-scope.ts`, which reads the binding, the partition and the domain config — so that
+// module pulls in `identity/binding.ts` and `memory/domain.ts`, and `memory/domain.ts` reaches
+// `operational/credential-grant-rows.ts`. A stored ROW has to read its own key's shape too (the
+// disclosure line states a span, and a span is only honest against the key that carries it), and
+// importing the scope module from the rows module would close that loop. These readers need none of
+// it: a key's shape is in the string. So they sit here, with NO imports at all, and both modules take
+// them from one place rather than spelling a prefix twice.
+
+/** Prefix marking a scope key that names a DOMAIN rather than an eve session. A session id is a
+ *  `wrun_…` string, so this form can never collide with one; it is DELIBERATELY not the seat's
+ *  `oe-domain::` registry-key spelling, because these two keys are different things and a shared
+ *  prefix would invite a future reader to join them. */
+export const GRANT_DOMAIN_KEY_PREFIX = "oe-grant-domain::";
+
+/** Prefix marking a scope key that names ONE ROOM of a declared domain (OPE-2012) — the solo
+ *  topology's conversation-stable key. Its own prefix rather than a spelling of the domain one,
+ *  because the two are different reaches and the mount, the card and the audit row all have to tell
+ *  them apart; a shared prefix would make a room-keyed row read as a domain-keyed one. */
+export const GRANT_ROOM_KEY_PREFIX = "oe-grant-room::";
+
+/** The separator between the room key's two segments. Spelled once, and the ONE reason
+ *  `grantDomainScopeVerdict` refuses a domain name that contains it: the key is a pair, and a pair
+ *  packed into a string is only a key while the pair is recoverable from it. */
+export const GRANT_KEY_SEGMENT_SEPARATOR = "::";
+
+/** How wide the scope key on an ask or a row reaches — READ FROM THE KEY'S OWN SHAPE, which is the
+ *  only thing a later reader has. The owner's card branches on it (`credential-grant-card.ts`), so an
+ *  unrecognised shape answers `domain`, the WIDEST keyed reach: the card may under-promise a boundary
+ *  and must never claim one the row does not have. */
+export type GrantScopeReach = "session" | "room" | "domain";
+
+/** The reach {@link GrantScopeReach} names, for the `domainScopeKey` an ask recorded — never for a
+ *  row's `scopeKey`, which carries a session id whenever the ask carried no key. No key at all is the
+ *  exact-session rule; any other unrecognised shape answers `domain`, per the type's note. */
+export function grantScopeReachOf(domainScopeKey: string | undefined): GrantScopeReach {
+  if (domainScopeKey === undefined || domainScopeKey.length === 0) return "session";
+  return domainScopeKey.startsWith(GRANT_ROOM_KEY_PREFIX) ? "room" : "domain";
+}
+
+/**
+ * Does this key name a CONVERSATION that outlives one eve session — a domain or a room — rather than
+ * one session? Read from the key's own shape, which is the only thing a STORED ROW carries.
+ *
+ * 🔴 IT IS THE READER FOR A ROW'S `scopeKey`, AND IT FAILS CLOSED THE OTHER WAY FROM
+ * {@link grantScopeReachOf} (OPE-2160). That function answers about an ASK's `domainScopeKey`, where
+ * an unrecognised shape must read as the WIDEST reach, so the card never claims a boundary the row has
+ * not got. This one answers about a ROW's own key, where the hazard is the opposite: a session id is
+ * exactly the unrecognised shape, and reading it as a conversation would let a surface promise a span
+ * the key cannot carry. So only the two known prefixes answer true, and everything else — a `wrun_…`
+ * session id, an empty string, a key from a future arm — answers false and gets the narrow sentence.
+ */
+export function grantScopeKeyIsConversationStable(scopeKey: string | undefined): boolean {
+  if (scopeKey === undefined) return false;
+  return scopeKey.startsWith(GRANT_DOMAIN_KEY_PREFIX) || scopeKey.startsWith(GRANT_ROOM_KEY_PREFIX);
+}

package/agent/access/credential-grant-notice.ts

@@ -0,0 +1,219 @@
+// The two host-authored notices a granted call sends beside the model's answer: the disclosure line posted into the room by the AGENT, naming the REQUESTER as the actor, and a DM to the owner on the FIRST use of a grant, once per grant forever. Both are fail-soft and independent, and neither is audited as reply.post, which the eval scorers join on.
+
+import { AsyncLocalStorage } from "node:async_hooks";
+import { canDeliverDirectMessage } from "../channels/post-arms.js";
+import { assertProactiveDmAllowed, deliverProactiveDm, dmDeliveryFooter, ProactiveDmRefusedError } from "../channels/dm-audience.js";
+import { postReply, resolveReplyTarget } from "../channels/reply-post.js";
+import type { BindableContext } from "../identity/binding.js";
+import { accountProfileFor, composedAccountName } from "../identity/account-display-name.js";
+import { parsePrincipalKey } from "../identity/principal-key.js";
+import { getOperationalStore } from "../operational/provider.js";
+import type { CredentialGrantRow } from "../operational/credential-grant-rows.js";
+import {
+  foreignGrantRoomNoticeRegistrant,
+  GrantRoomNoticeAlreadyRegisteredError,
+  registerCoreGrantRoomNotice,
+} from "./grant-room-notice-registry.internal.js";
+import { GRANT_MODE_WORDS, grantBorrowPhrase, grantOwnerDmAddress } from "./credential-grant-card.js";
+import { connectorDisplayName, grantClockPhrase, grantDisplayLabel, grantOwnerPhrase, grantSpanPhrase } from "./credential-grant-copy.js";
+import { grantScopeKeyIsConversationStable } from "./credential-grant-key-shape.js";
+import { auditGrant, type GrantAuditStamps } from "./credential-grant-flow.js";
+
+function log(line: string): void {
+  console.log(`[open-everywhere:grant] ${line}`);
+}
+
+/** What a granted call's notices need and only the MOUNT holds: the live tool context, the org, and the audit stamps. It rides AsyncLocalStorage rather than a wider broker port, which keeps eve types out of the broker's signature and keeps two concurrent granted calls from reading each other's room. */
+export interface GrantRoomContext extends GrantAuditStamps {
+  /** The live tool context of the turn that made the granted call. */
+  readonly ctx: BindableContext;
+}
+
+const roomContext = new AsyncLocalStorage<GrantRoomContext>();
+
+/** Called ONCE, by the mount, around the whole runGrantedCall. Do not wrap anything else: "the room this granted call ran in" stops being true. */
+export function withGrantRoomContext<T>(context: GrantRoomContext, fn: () => Promise<T>): Promise<T> {
+  return roomContext.run(context, fn);
+}
+
+/** The granted call running right now, or `undefined` outside one. */
+function grantRoomContext(): GrantRoomContext | undefined {
+  return roomContext.getStore();
+}
+
+/** Never invents a name: no arm for the platform, an unparsable principal key, or an arm that answers nothing all resolve undefined, and every caller falls back to the principal key alone. The label is additional to the key, never a replacement for it. */
+export async function resolveRequesterLabel(principalId: string): Promise<string | undefined> {
+  const parsed = parsePrincipalKey(principalId);
+  if (parsed === undefined) return undefined;
+  const profile = await accountProfileFor(parsed.platform, parsed.id, parsed.tenant);
+  return composedAccountName(profile);
+}
+
+/** The key is host-composed and deliberately shown, because it is the string the grant.used audit row names and a reader joins the two by eye. The LABEL comes off another plane, so it is guarded: a label that merely repeats the platform id is dropped and the phrase falls back to the key alone. */
+function requesterActorPhrase(principalId: string, requesterLabel: string | undefined): string {
+  const label = grantDisplayLabel(requesterLabel);
+  return label === undefined ? `\`${principalId}\`` : `${label} (\`${principalId}\`)`;
+}
+
+/** Host-authored throughout: it names the REQUESTER as the actor and the owner as the credential holder, keeps the requester's principal key so a reader joins it to the grant.used row, and prints a clock time rather than the raw instant. It must keep passing postReply NO ReplyAudit — an org would reach postOnce, whose dedupe keys on the posted text, and two granted calls in one minute would collapse into one line. */
+export function grantRoomNoticeText(
+  line: string,
+  grant: Pick<CredentialGrantRow, "requesterPrincipalId" | "ownerSlug">,
+  atIso: string,
+  requesterLabel?: string,
+): string {
+  const actor = requesterActorPhrase(grant.requesterPrincipalId, requesterLabel);
+  const clock = grantClockPhrase(atIso);
+  const when = clock === undefined ? "Granted-credential use." : `Granted-credential use at ${clock}.`;
+  return [`${when} This is ${actor}'s act, run with ${grantOwnerPhrase(grant.ownerSlug)}'s credential.`, line].join("\n");
+}
+
+/** Short, and every field but the requester label comes from the grant ROW. It is honest about how many more notices to expect, names the DM route that ends the grant, and prints no grant id: the revoke offer is true only while tools/revoke_credential_grant.ts ships. */
+export function grantOwnerNoticeText(grant: CredentialGrantRow, requesterLabel: string | undefined, nowMs: number): string {
+  return [
+    `Your ${connectorDisplayName(grant.connector)} credential was just used in the conversation you approved.`,
+    "",
+    `• What it did: ${grantBorrowPhrase(grant)}`,
+    `• Who ran it: ${requesterActorPhrase(grant.requesterPrincipalId, requesterLabel)}`,
+    `• The grant: ${GRANT_MODE_WORDS[grant.mode]}`,
+    "",
+    grant.mode === "once"
+      ? "That was a one-shot grant, so it is now spent. Nothing else can be run with it."
+      // Both clauses are load-bearing: the span renders a duration and a clock time rather than the raw ISO column, and the revoke clause is honest only while the revoke verb ships. The copy test pins both.
+      // 🔴 THE SPAN IS READ FROM THE ROW'S OWN KEY (OPE-2160), never from its expiry column alone: a
+      // `standing` row bound to one eve session dies at that seat's next rotation while the column
+      // still says 30 days, and this DM is the owner's own record of what they lent. The mode word on
+      // the bullet above is the WIRE mode and stays as it is — what it names is the button they
+      // tapped, which is a fact about their own decision; this sentence is the one that states a span,
+      // so this sentence is the one that has to be able to keep it.
+      : `This is the FIRST use of that grant, and the only notice you get for it. It stays live ${grantSpanPhrase({ conversationStable: grantScopeKeyIsConversationStable(grant.scopeKey), expiresAt: grant.expiresAt, mode: grant.mode, nowMs })}. Tell me here to end it and I will end it now.`,
+  ].join("\n");
+}
+
+/** The lifetime claim key behind "notify the owner on the FIRST use". One row per grant, forever. */
+export function grantUseNoticeKey(grantId: string): string {
+  return `grant-use:${grantId}`;
+}
+
+/** Posts the disclosure line into the conversation the granted call ran in; TRUE when it landed. A surface with no mid-turn post arm resolves no target, which is an honest cannot-post-here and never a post somewhere else. */
+export async function postGrantRoomNotice(
+  context: GrantRoomContext | undefined,
+  line: string,
+  grant: CredentialGrantRow,
+  atIso: string,
+  requesterLabel?: string,
+): Promise<boolean> {
+  if (context === undefined) return false;
+  const target = resolveReplyTarget(context.ctx);
+  if (target === null) return false;
+  // NO `ReplierLabel` ARGUMENT, DELIBERATELY (§8.2 bullet 2). A replier label re-renders the post
+  // under another display name; the requester's act must not appear as the owner speaking.
+  await postReply(target, grantRoomNoticeText(line, grant, atIso, requesterLabel));
+  return true;
+}
+
+/**
+ * ORDER: resolve the address, CHECK THE RECIPIENT'S STOP, THEN claim, THEN send. A claim is permanent, so claiming first would burn the grant's one notice on a delivery that could never be made; every step before the claim is a side-effect-free read, so two racing calls both reach it and exactly one wins. A send that fails after the claim does not give it back.
+ * 🔴 THE STOP CHECK IS WHY THE EARLY CALL EXISTS (OPE-1855). The road reads the stop again at the send, and THAT read is the control; this one runs before the claim so an owner who has asked the agent to stop does not silently lose their grant's one notice as well. A stopped owner gets a `dm.refused` row naming the plane, and the grant itself is untouched — a stop refuses the message, it never revokes or answers a grant.
+ * THE WINDOW IS STATED RATHER THAN CLOSED: a stop that lands BETWEEN this check and the send still spends the claim, because the store has no release for one. It is the same bound the failed-send path has always carried — "a send that fails after the claim does not give it back" — and it is bounded by the milliseconds between two reads.
+ */
+export async function deliverGrantOwnerNotice(
+  context: GrantRoomContext | undefined,
+  grant: CredentialGrantRow,
+  atIso: string,
+  requesterLabel?: string,
+): Promise<boolean> {
+  if (context === undefined) return false;
+  const store = getOperationalStore();
+  // The GRANT row carries no platform address — the ASK row does, pinned when the owner was first
+  // DMed. Reading it back is what puts this notice in the SAME 1:1 conversation the card lives in.
+  const ask = await store.getCredentialGrantAsk(context.org, grant.askId);
+  if (ask === null) return false;
+  if (!canDeliverDirectMessage(ask.ownerPlatform)) return false;
+  const where = { org: context.org, platform: context.platform, workspace: context.workspace, ...(context.surface === undefined ? {} : { surface: context.surface }) };
+  const address = grantOwnerDmAddress(ask);
+  const road = {
+    where,
+    plane: "credential.grant.notice" as const,
+    platform: ask.ownerPlatform,
+    recipientId: ask.ownerNativeId,
+    address,
+    attributedTo: grant.requesterPrincipalId,
+  };
+  try {
+    await assertProactiveDmAllowed(road);
+  } catch (err) {
+    if (err instanceof ProactiveDmRefusedError) {
+      log(`owner notice for grant ${grant.id} was refused before the claim: ${err.boundary} — the grant is unchanged and the claim is unspent.`);
+      return false;
+    }
+    throw err;
+  }
+  const won = await store.claimNotice(context.org, grantUseNoticeKey(grant.id), atIso);
+  if (!won) return false;
+  try {
+    // The expiry is measured from the instant of the granted CALL this notice discloses, not from whenever the DM arm got round to sending.
+    await deliverProactiveDm({
+      ...road,
+      text: grantOwnerNoticeText(grant, requesterLabel, Date.parse(atIso)),
+      footer: dmDeliveryFooter({ requestedBy: grant.requesterPrincipalId, fromContainer: grant.scopeKey }),
+      requestedBy: grant.requesterPrincipalId,
+      attributedTo: grant.requesterPrincipalId,
+    });
+  } catch (err) {
+    // The row is written and then the throw is re-raised: swallowing it would silence the caller's log line and turn a failed DM into a successful-looking call.
+    await auditOwnerNotice(context, grant, ask.ownerPlatform, "failed", err);
+    throw err;
+  }
+  await auditOwnerNotice(context, grant, ask.ownerPlatform, "sent");
+  return true;
+}
+
+/** One grant.notified row per grant, written by the claim winner only. IDS, NAMES AND AN ERROR CLASS ONLY: the DM's text is never recorded, and a failure records Error.name rather than the message, which can quote the address it failed to reach. */
+async function auditOwnerNotice(
+  stamps: GrantAuditStamps,
+  grant: CredentialGrantRow,
+  ownerPlatform: string,
+  outcome: "sent" | "failed",
+  err?: unknown,
+): Promise<void> {
+  try {
+    await auditGrant(stamps, "grant.notified", grant.ownerPrincipalId, {
+      connector: grant.connector,
+      grantId: grant.id,
+      mode: grant.mode,
+      outcome,
+      owner: grant.ownerPrincipalId,
+      ownerPlatform,
+      requester: grant.requesterPrincipalId,
+      verb: grant.verb,
+      ...(err === undefined ? {} : { error: err instanceof Error ? err.name : "unknown" }),
+    });
+  } catch (auditErr) {
+    log(`grant.notified row was not written for grant ${grant.id}: ${String(auditErr)}`);
+  }
+}
+
+/** Registers the shipped arm on the broker's room-notice port, once. A repeat core call is SKIPPED and the first arm stays; a port a FOREIGN arm holds throws, so the deployment fails to boot rather than running granted calls the room never sees. */
+export function installGrantUseNotices(): void {
+  const foreign = foreignGrantRoomNoticeRegistrant();
+  if (foreign !== undefined) throw new GrantRoomNoticeAlreadyRegisteredError(foreign);
+  registerCoreGrantRoomNotice(async (line, grant) => {
+    const context = grantRoomContext();
+    const atIso = new Date().toISOString();
+    // Resolved ONCE, before either half sends, so both notices name the same requester. The catch is belt-and-braces: a label lookup can never cost either half its notice.
+    const requesterLabel = await resolveRequesterLabel(grant.requesterPrincipalId).catch(() => undefined);
+    // The two halves are independent. A room with no post arm must not cost the owner their notice,
+    // and an undeliverable DM must not cost the room its line.
+    const [room, owner] = await Promise.allSettled([
+      postGrantRoomNotice(context, line, grant, atIso, requesterLabel),
+      deliverGrantOwnerNotice(context, grant, atIso, requesterLabel),
+    ]);
+    if (room.status === "rejected") log(`room notice could not be posted for grant ${grant.id}: ${String(room.reason)}`);
+    if (owner.status === "rejected") log(`owner notice could not be delivered for grant ${grant.id}: ${String(owner.reason)}`);
+    // This arm never rejects: it reports the room half's outcome so the broker can write the grant.undisclosed row naming the reason, which rejecting would lose. A false answer means either no context (the call ran outside the mount's wrap) or a surface that takes no mid-turn post.
+    if (room.status === "rejected") return { posted: false, reason: "post_failed" };
+    if (!room.value) return { posted: false, reason: context === undefined ? "no_room_context" : "no_post_arm" };
+    return { posted: true };
+  });
+}

package/agent/access/credential-grant-owner.ts

@@ -0,0 +1,23 @@
+// Turns a grant row's `ownerPrincipalId` into the OAuth vault subject the owner's credential is keyed by, through connections/connector-auth.ts's own composer — never a second spelling. The owner's platform and tenant come off the grant row's principal key, never off the calling surface, and every gate that makes a granted call safe has already run at the broker.
+
+import { effectiveUserVaultSubject } from "../connections/connector-auth.js";
+import { parsePrincipalKey } from "../identity/principal-key.js";
+
+/** Everything a registered borrow transport needs to resolve the OWNER's credential, and deliberately nothing else. It carries NO token and no secret — only the vault subject that credential is keyed by. */
+export interface GrantOwnerSubject {
+  /** The partition the granted call runs in — the org half of every vault subject. */
+  readonly org: string;
+  /** The OAuth vault subject the owner's personal credential for this connector is keyed by. */
+  readonly vaultSubject: string;
+}
+
+/** The owner's vault subject for one grant, or `undefined` when the row's `ownerPrincipalId` is not a well-formed principal key. `undefined` is a REFUSAL, not a fallback — there is no weaker subject to try — and this function never throws, because the broker's contract is a named refusal on every arm. */
+export async function grantOwnerSubject(org: string, connector: string, ownerPrincipalId: string): Promise<GrantOwnerSubject | undefined> {
+  const parsed = parsePrincipalKey(ownerPrincipalId);
+  if (parsed === undefined) return undefined;
+  try {
+    return { org, vaultSubject: await effectiveUserVaultSubject(connector, org, parsed.platform, parsed.tenant, parsed.id) };
+  } catch {
+    return undefined;
+  }
+}

package/agent/access/credential-grant-reach.ts

@@ -0,0 +1,81 @@
+// THE USE-TIME GRANT LOOKUP (OPE-1950) — the one read the granted-tool mount and the own-account gate share.
+// 🔴 IT LIVES APART FROM `credential-grant-scope.ts` ON PURPOSE. That file is PURE and is imported by the mint, which the operational store's own module graph reaches; a store import there closes a cycle and the process dies at boot with "Cannot access 'sqliteOperationalStore' before initialization" (measured 2026-09-19 on `test:halt`). The scope RULES are pure; only this reader touches a store.
+
+import { getOperationalStore } from "../operational/provider.js";
+import type { CredentialGrantRow } from "../operational/credential-grant-rows.js";
+import { classifySessionId } from "../channels/window-key.js";
+import { currentSessionId, delegationRootSessionId, isSubagentChildContext, type BindableContext } from "../identity/binding.js";
+import { grantDomainScopeKey } from "./credential-grant-scope.js";
+
+/**
+ * THE CONVERSATION THIS SESSION SPENDS ON BEHALF OF, as a session-shaped scope key — the ROOT SEAT's session id inside a delegated worker, the session's own id on a conversational seat, and `undefined` where neither can be named.
+ *
+ * TWO READERS FOR THE WORKER ARM, AND THE SECOND IS NOT REDUNDANT. eve's typed `session.parent` reaches TOOL and HOOK contexts; a DYNAMIC-RESOLVER context carries only the session id, the auth bag and the channel (eve's `buildResolveContext`), and the granted-tool MOUNT is a resolver. The continuation token is the linkage every child has, and `connections/own-account-carriage.ts` reads it for exactly this reason.
+ *
+ * 🔴 BOTH SOURCES ARE HOST-SET AND MODEL-UNREACHABLE, which is what makes this a scope key rather than a claim. eve mints the child's continuation token as `subagent:<parent session id>:<call id>` and its parent linkage at spawn; the model authors only the task text. So a worker of one conversation cannot name another conversation, and a lent tool cannot travel to it.
+ * 🔴 A CHILD FAILS CLOSED TO `undefined`, never to its own session id — that would be a scope key naming a run that ends minutes after it starts, which is the dead-scope row OPE-1343 closed on the ask side.
+ */
+export function sessionScopeKeyInReach(ctx: BindableContext): string | undefined {
+  try {
+    if (isSubagentChildContext(ctx)) {
+      const root = delegationRootSessionId(ctx);
+      if (root !== undefined && root.length > 0) return root;
+      const classified = classifySessionId(ctx.channel?.continuationToken);
+      return classified.kind === "subagent" && classified.parentSessionId.length > 0 ? classified.parentSessionId : undefined;
+    }
+    const own = currentSessionId(ctx);
+    return own !== undefined && own.length > 0 ? own : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * THE CONVERSATION-STABLE SCOPE KEY THIS SESSION MAY REACH — a straight re-export of
+ * `grantDomainScopeKey`, kept here so the mount and the own-account gate read their two keys from one
+ * module rather than two.
+ *
+ * 🔴 IT NEEDS NO WORKER ARM, AND THAT IS THE POINT (OPE-2023). An earlier revision re-read the
+ * `non_standing_grain` gate here for a delegated worker. That was a SECOND SPELLING of a rule
+ * `credential-grant-scope.ts` states is spelled once, and OPE-2012 proved why that is not a style
+ * preference: it added a ROOM-shaped key for an unseated deployment — the shipped default — and a
+ * re-read written against the domain arm would have admitted the WIDER domain key for a worker whose
+ * conversation binds to a room. The rule takes the CONVERSATION's grain at its own root now
+ * (`conversationGrainOf`), so a worker inherits the room arm, the domain arm and every refusal
+ * unchanged.
+ */
+export function domainScopeKeyInReach(ctx: BindableContext): string | undefined {
+  return grantDomainScopeKey(ctx);
+}
+
+/**
+ * THE ONE USE-TIME LOOKUP: every grant row this seat may reach — its own session-keyed rows, whatever
+ * their status, UNION the live standing rows bound to the room's CONVERSATION-STABLE key (OPE-1950).
+ * The granted-tool mount and the own-account gate both read it, so the two can never answer
+ * differently about one seat.
+ *
+ * 🔴 `domainScopeKey` IS OPAQUE HERE, AND IT HAS TWO SHAPES. `access/credential-grant-scope.ts`
+ * decides whether this seat gets the domain-shaped key or the room-shaped one and hands the answer
+ * down; nothing below reads which. So do not take the parameter's name for a promise that a row on
+ * this half is domain-keyed.
+ *
+ * The two halves filter differently on purpose, and {@link import("../operational/store.js").OperationalStore.liveStandingCredentialGrantsForScope}
+ * carries the argument: the session half mounts on EXISTENCE so a cold-healed transcript keeps meeting
+ * its own tools, and the conversation half mounts only what is still live, because it is read by
+ * sessions that never saw the row.
+ *
+ * Rows are keyed by id, so a conversation key that happens to equal the session key cannot double-count.
+ */
+export async function credentialGrantsInReach(
+  org: string,
+  sessionScopeKey: string,
+  domainScopeKey: string | undefined,
+  nowIso: string,
+): Promise<readonly CredentialGrantRow[]> {
+  const store = getOperationalStore();
+  const rows = sessionScopeKey.length > 0 ? [...(await store.credentialGrantsForScope(org, sessionScopeKey))] : [];
+  if (domainScopeKey === undefined || domainScopeKey.length === 0 || domainScopeKey === sessionScopeKey) return rows;
+  const seen = new Set(rows.map((r) => r.id));
+  for (const row of await store.liveStandingCredentialGrantsForScope(org, domainScopeKey, nowIso)) if (!seen.has(row.id)) rows.push(row);
+  return rows;
+}

package/agent/access/credential-grant-resolution.ts

@@ -0,0 +1,119 @@
+// Reports the owner's answer back into the requester's conversation, because that turn must not block on the owner. The address is PINNED on the ask and never re-resolved here, so no model input can redirect it; the notice is host-authored, carries no `ReplyAudit`, and every arm fails soft.
+
+import { postArm } from "../channels/post-arms.js";
+import { GRANT_MODE_WORDS, grantBorrowPhrase, grantModeIsBroader, grantModePhrase, type GrantApproveGate } from "./credential-grant-card.js";
+import { connectorDisplayName, grantExpiryPhrase, grantOwnerPhrase, grantRevokedRoomText } from "./credential-grant-copy.js";
+import { postReply, type ReplyTarget } from "../channels/reply-post.js";
+import { credentialGrantDisclosureLine, type CredentialGrantAskRow, type CredentialGrantMode, type CredentialGrantRow } from "../operational/credential-grant-rows.js";
+
+function log(line: string): void {
+  console.log(`[open-everywhere:grant] ${line}`);
+}
+
+/** What happened to the ask, as the notice needs to say it. `expired` is the one arm with NO CLICK behind it: the scheduled sweep decides it, because the owner never answered. */
+export type GrantResolution =
+  /** `askedMode` is CARRIED, never read back off the ask row: the approve CAS overwrites `requested_mode` with the mode the owner tapped. Capture it before the CAS; it is required rather than optional so a caller cannot silently leave the room comparing a mode against itself. */
+  | { readonly kind: "approved"; readonly grant: CredentialGrantRow; readonly askedMode: CredentialGrantMode }
+  | { readonly kind: "declined" }
+  | { readonly kind: "expired" }
+  /** The owner said YES and the grant still could not be minted — the approve-time catalogue read found no such tool, or one that does not take the arguments the ask froze. It is neither a decline nor a lapse: the owner answered, and what failed is a fact about the vendor. */
+  | { readonly kind: "refused"; readonly gate: GrantApproveGate }
+  /** The owner took the grant back after it was minted and spent. It is reported through this door because only the ask row's pinned `requesterTarget` is postable — the grant names its chat by session key. */
+  | { readonly kind: "revoked" };
+
+/** Read one ask's pinned reply target back, or `undefined` when it holds nothing postable. The platform must name a REGISTERED post arm: a row from an older build would otherwise reach `postReply` with a platform nothing serves, and the honest answer is "cannot post", not a throw inside an approval. */
+function parseGrantRequesterTarget(raw: string | undefined): ReplyTarget | undefined {
+  if (typeof raw !== "string" || raw.length === 0) return undefined;
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return undefined;
+  }
+  if (typeof parsed !== "object" || parsed === null) return undefined;
+  const platform = (parsed as Record<string, unknown>).platform;
+  if (typeof platform !== "string" || platform.length === 0) return undefined;
+  if (postArm(platform)?.dispatchReply === undefined) return undefined;
+  return parsed as ReplyTarget;
+}
+
+/** The text the requester's conversation reads, HOST-AUTHORED throughout: it never prints the minted tool name, because the seat reads what it holds from its own tool list, and it never names the requester. `nowMs` is the caller's clock, required so this renderer stays pure. */
+export function grantResolutionText(ask: CredentialGrantAskRow, resolution: GrantResolution, nowMs: number): string {
+  const owner = grantOwnerPhrase(ask.ownerSlug);
+  const ownerLead = sentenceLead(owner);
+  const what = grantBorrowPhrase(ask);
+  switch (resolution.kind) {
+    case "approved": {
+      // 🔴 THE PINNED NAME IS STILL READ, NEVER COMPOSED (OPE-1136) — it is no longer PRINTED, but it
+      // is still what decides this arm. A row that pinned NO name mounts nothing (OPE-1334), so the
+      // "it arrives next turn" sentence would be a promise the mount cannot keep.
+      const mounts = resolution.grant.toolName !== undefined;
+      return [
+        `${ownerLead} approved the credential grant — ${what}.`,
+        // The mode is spelled for a reader, never rendered as the raw column value, and the expiry is a duration plus a clock time for the same reason.
+        `The grant is ${grantModePhrase(resolution.grant.mode)}, ${grantExpiryPhrase(resolution.grant.expiresAt, nowMs)}.`,
+        ...(mounts ? ["The tool is in this conversation's tool list from the next turn."] : []),
+        ...breadthLines(resolution.grant, resolution.askedMode, owner),
+        credentialGrantDisclosureLine(resolution.grant, nowMs),
+      ].join("\n");
+    }
+    case "declined":
+      return `${ownerLead} declined the credential grant — ${what}. Nothing was granted and no tool is mounted. Do not ask again for the same thing — find another way, or ask the room.`;
+    case "expired":
+      // It says "no answer", never "no": a lapse is not a refusal. That distinction drives the advice too — a decline tells the room to stop asking, a lapse leaves asking again open.
+      return [
+        `The credential grant request — ${what} — expired with no answer from ${owner}.`,
+        `Nothing was granted and no tool is mounted. ${ownerLead} did not decline — the request simply timed out.`,
+        "You can ask again if it is still needed.",
+      ].join("\n");
+    case "revoked":
+      // 🔴 IT GOES THROUGH THE COPY MODULE, so it carries no mounted tool name, no uuid and no ISO
+      // instant — the rule this module's three older arms are the standing exception to (OPE-1592).
+      // It also names no reason: see `grantRevokedRoomText`.
+      return grantRevokedRoomText(ask.connector, ask.mcpTool);
+    case "refused":
+      // 🔴 IT NAMES THE OWNER'S YES. The room must not read this as a refusal by a person: the owner
+      // approved, and the connection could not honour it. That distinction is what stops a seat
+      // treating a fixable vendor fact as a social answer it should never re-litigate.
+      return [
+        `${ownerLead} approved the credential grant — ${what} — but it could not be minted.`,
+        resolution.gate === "tool_absent"
+          ? `Their ${connectorDisplayName(ask.connector)} connection publishes no tool by that name, so there was nothing to lend.`
+          : `The ${connectorDisplayName(ask.connector)} tool does not take the arguments the request fixed, so the grant could never have been spent.`,
+        "Nothing was granted and no tool is mounted. Check the tool name and the arguments against the connection, then ask again.",
+      ].join("\n");
+  }
+}
+
+/** One owner phrase at the head of a sentence. {@link grantOwnerPhrase} is lower case because most
+ *  of its callers spend it mid-sentence; only the first letter changes here, so a real handle that
+ *  starts lower case (`ada`) is left exactly as the owner spells it. */
+function sentenceLead(owner: string): string {
+  return owner === "the owner" ? "The owner" : owner;
+}
+
+/** The room is told when the OWNER granted MORE breadth than was asked, because it watched the ask go up naming one breadth. It fires only on a widening: a grant equal to or narrower than the ask is already described by the mode word on the line above. */
+function breadthLines(grant: CredentialGrantRow, askedMode: CredentialGrantMode, owner: string): readonly string[] {
+  if (!grantModeIsBroader(grant.mode, askedMode)) return [];
+  return [
+    `${sentenceLead(owner)} granted MORE than was asked: the request was for ${GRANT_MODE_WORDS[askedMode]}, and the grant is for ${GRANT_MODE_WORDS[grant.mode]}.`,
+  ];
+}
+
+/** Three outcomes rather than a boolean: `sent`, `no_target` (the ask pinned nothing postable, so nothing was attempted — not an error), and `failed` (a target was pinned and the post threw). Only `failed` is a transport problem somebody may want to chase. */
+export type GrantNoticeOutcome = "sent" | "no_target" | "failed";
+
+/** Post one resolution back into the conversation the ask came from; `nowMs` is the DECIDING caller's own clock. FAIL-SOFT and never throws — a notice that cannot post must not fail the approval that already minted a grant, nor the sweep that already closed a row. */
+export async function postGrantResolution(ask: CredentialGrantAskRow, resolution: GrantResolution, nowMs: number): Promise<GrantNoticeOutcome> {
+  const target = parseGrantRequesterTarget(ask.requesterTarget);
+  if (target === undefined) return "no_target";
+  try {
+    // NO `ReplyAudit` and NO `ReplierLabel`: this is a host notice, not a model reply, and it is
+    // spoken by the agent rather than under anybody's display name.
+    await postReply(target, grantResolutionText(ask, resolution, nowMs));
+    return "sent";
+  } catch (err) {
+    log(`resolution notice for ask ${ask.id} could not be posted: ${String(err)}`);
+    return "failed";
+  }
+}

package/agent/access/credential-grant-revoke.ts

@@ -0,0 +1,95 @@
+// The caller's own principal key IS the query key, so a person can only ever read and end grants their own account pays for; nothing here takes an owner argument. Revoking is the DE-ESCALATING direction, so it takes no approval card, and the borrowing room's notice is best-effort — a post that fails never undoes the revoke.
+
+import { GRANT_NONE_LIVE_TEXT, grantHoldingPhrase, grantRevokedOwnerText, type GrantHoldingFacts, type GrantRevokedHolding } from "./credential-grant-copy.js";
+import { revokeCredentialGrant, type GrantAuditStamps } from "./credential-grant-flow.js";
+import { postGrantResolution, type GrantNoticeOutcome } from "./credential-grant-resolution.js";
+import { quotedPurpose, type CredentialGrantRow } from "../operational/credential-grant-rows.js";
+import { getOperationalStore } from "../operational/provider.js";
+
+/** The ORDINAL is a VIEW, never an identifier: it means something only against the list the same call rendered. */
+export interface OwnerGrantHolding {
+  readonly grant: CredentialGrantRow;
+  /** 1-based position in the live list, oldest first. */
+  readonly ordinal: number;
+  /** The one clause that describes this grant to its owner. Id-free by construction. */
+  readonly phrase: string;
+}
+
+/** The grant ids the next `end` call must carry, kept OUT of the owner-facing message because a POSITION re-resolved later names whichever grant has moved into it. A grant id is not a capability: the lookup filters the owner's OWN live list, so an id belonging to somebody else matches no row. */
+export interface OwnerGrantHandle {
+  /** The grant's own id — what `end` takes. Stable across a re-read; a position is not. */
+  readonly id: string;
+  readonly number: number;
+}
+
+export function ownerGrantHandles(holdings: readonly OwnerGrantHolding[]): readonly OwnerGrantHandle[] {
+  return holdings.map((h) => ({ id: h.grant.id, number: h.ordinal }));
+}
+
+/** The facts one row hands the copy module. The purpose is sanitised HERE, by its one owner, because
+ *  `credential-grant-copy.ts` imports nothing and must not carry a second quoting rule. */
+function holdingFacts(grant: CredentialGrantRow, nowMs: number): GrantHoldingFacts {
+  return { connector: grant.connector, expiresAt: grant.expiresAt, mcpTool: grant.mcpTool, nowMs, quotedPurpose: quotedPurpose(grant.purpose) };
+}
+
+/** Every grant this owner still lends, numbered OLDEST FIRST. That order is load-bearing: a grant approved while the owner is reading the list appends, so the numbers do not move under them. */
+export async function ownerLiveGrants(org: string, ownerPrincipalId: string, nowMs: number): Promise<readonly OwnerGrantHolding[]> {
+  const rows = await getOperationalStore().liveCredentialGrantsForOwner(org, ownerPrincipalId, new Date(nowMs).toISOString());
+  return rows.map((grant, i) => ({ grant, ordinal: i + 1, phrase: grantHoldingPhrase(holdingFacts(grant, nowMs)) }));
+}
+
+/** The owner's live list as one message. The lines are the holdings' own `phrase`, never a second rendering, so the confirmation after a revoke names the same words. */
+export function ownerGrantListText(holdings: readonly OwnerGrantHolding[]): string {
+  if (holdings.length === 0) return GRANT_NONE_LIVE_TEXT;
+  return [
+    `You are lending your account to ${holdings.length === 1 ? "one conversation" : `${String(holdings.length)} conversations`}:`,
+    ...holdings.map((h) => `${String(h.ordinal)}. ${h.phrase}`),
+    "",
+    "Say which number to end, and I will end it now. Ending one is immediate and it cannot be undone — a fresh ask would have to be approved again.",
+  ].join("\n");
+}
+
+/** What one revoke call did. Every field is what ACTUALLY happened, never what was asked for. */
+export interface GrantRevokeOutcome {
+  readonly ended: readonly CredentialGrantRow[];
+  readonly remaining: readonly OwnerGrantHolding[];
+  readonly text: string;
+  /** What became of each borrowing room's notice, in `ended` order. See {@link GrantNoticeOutcome}. */
+  readonly notices: readonly GrantNoticeOutcome[];
+}
+
+/** `ownerPrincipalId` is read as given, so proving it is the caller's obligation; `grantIds` names ROWS, never positions, so a redelivered call matches an already-revoked row and ends nothing. `undefined` means EVERY live grant and keeps the redelivery hazard in a narrower form — it re-reads the live list and can end a grant approved between the two deliveries. */
+export async function revokeOwnerGrants(
+  stamps: GrantAuditStamps,
+  ownerPrincipalId: string,
+  grantIds: readonly string[] | undefined,
+  nowMs: number,
+): Promise<GrantRevokeOutcome> {
+  const holdings = await ownerLiveGrants(stamps.org, ownerPrincipalId, nowMs);
+  const wanted = grantIds === undefined ? holdings : holdings.filter((h) => grantIds.includes(h.grant.id));
+  const ended: CredentialGrantRow[] = [];
+  const endedHoldings: GrantRevokedHolding[] = [];
+  const notices: GrantNoticeOutcome[] = [];
+  for (const holding of wanted) {
+    if (!(await revokeCredentialGrant(stamps, holding.grant.id, ownerPrincipalId, "thread", nowMs))) continue;
+    ended.push(holding.grant);
+    const notice = await tellBorrowingRoom(stamps.org, holding.grant, nowMs);
+    notices.push(notice);
+    // 🔴 `sent` IS THE ONLY OUTCOME THAT COUNTS AS TOLD. `no_target` never attempted a post and
+    // `failed` threw, so both leave the borrowing room ignorant — and the owner's confirmation must
+    // not say otherwise (cold review, 2026-09-09).
+    endedHoldings.push({ phrase: holding.phrase, told: notice === "sent" });
+  }
+  // RE-READ RATHER THAN SUBTRACTED. The owner is being shown what they still lend, and a list
+  // computed by removing the ended rows from a snapshot would silently keep a grant a racing sweep
+  // had already expired.
+  const remaining = await ownerLiveGrants(stamps.org, ownerPrincipalId, nowMs);
+  return { ended, notices, remaining, text: grantRevokedOwnerText(endedHoldings, remaining.map((h) => h.phrase)) };
+}
+
+/** Tells the conversation that held the grant; `no_target` when the ask row is gone or pinned nothing postable. The address comes off the ASK row, because a grant names its chat by session key, which nothing can post to, and `nowMs` is the revoke's own tick. */
+async function tellBorrowingRoom(org: string, grant: CredentialGrantRow, nowMs: number): Promise<GrantNoticeOutcome> {
+  const ask = await getOperationalStore().getCredentialGrantAsk(org, grant.askId);
+  if (ask === null) return "no_target";
+  return await postGrantResolution(ask, { kind: "revoked" }, nowMs);
+}