@open-everywhere/core 0.1.0

package/agent/tools/add_routine_rule.ts

@@ -0,0 +1,215 @@
+// add_routine_rule PROPOSES a standing rule for ONE routine: a dated, sourced, one-line imperative every future fire of that routine is handed as TRUSTED text. Not `edit_routine`, which rewrites the whole instruction and therefore REVOKES every declared permission the routine accumulated and rotates a durable job's seat; and not a memory write, which records org knowledge and is recurrence-gated, while a rule must bind after ONE incident and be present in a fire doing no memory read. (There is no `remember` TOOL — OPE-389 deleted the verb; a memory write is a file edit the host persists at the turn's end.)
+// 🔴 A rule is the only text in this system injected as a trusted instruction into unattended fires forever, so authorship is fenced four ways: NOT FROM A FIRE (a host-set, model-unforgeable marker refuses one, which is what stops a routine amending its own doctrine), NOT AUTO-APPROVED ON A TAINTED TURN (the approver chain floors the verdict at a human decision and denies it unattended), NOT on a restricted job wake, and finally the card. A shared grammar guard keeps a rule from impersonating one of the fire message's own host-authored blocks. Residual, stated rather than hidden: a human can still be talked into typing a bad rule and clicking it.
+
+import { defineTool } from "eve/tools";
+import { never } from "eve/tools/approval";
+import { z } from "zod";
+import { bindFrom } from "../identity/binding.js";
+import { principalIdOf, unattendedOf } from "../access/request.js";
+import { resolvePartition } from "../memory/partition.js";
+import { proposalScopeKey } from "../channels/propose-scope.js";
+import { getRoutine, newPolicyRuleId } from "../routines/store.js";
+import { describeTrigger, routineMarker } from "../routines/routine.js";
+import {
+  POLICY_MAX_RULES,
+  POLICY_RULE_MAX_CHARS,
+  POLICY_WHY_MAX_CHARS,
+  policyAuthorRefusal,
+  policyRules,
+  policyTextProblem,
+} from "../routines/policy.js";
+import { requestApproval, autoApprovedNote } from "../approvals/flow.js";
+import { approvalPostDeps } from "./set_spend_limit.js";
+import { checkApprovalVenue, describeVenueRefusal, cardPostedPrefix, cardPostedTail } from "../approvals/card-venue.js";
+import { getConfig } from "../access/config.js";
+import { requireSessionContinuation } from "../spend/checkpoint.js";
+
+export default defineTool({
+  description:
+    "PROPOSE a standing rule for ONE routine — a short instruction every future run of that routine must follow, e.g. 'never post before 09:00 UTC' or 'ignore pull requests opened by bots'. Use when someone corrects a routine after a bad run ('don't do that again', 'it should have skipped that one'), or wants to tune how one behaves, WITHOUT rewriting its whole instruction. Get the id from list_routines. Every rule needs a `why` — the incident or reasoning behind it — because the rule is re-read on every run for as long as it exists and nobody can retire it safely without knowing what it was for. This does NOT arm on the spot: a card posts showing the rule and its reason, and it takes effect only when a human confirms. If the thing to record is a FACT ABOUT THE ORG rather than an instruction for this one routine, save it to the channel's memory instead — that is a file edit in the silo the memory index names, not a tool call; to replace the routine's whole instruction, use `edit_routine`. The posted card IS the reply — do not add narration after this call. EXCEPT when this surface can't host a card: it then goes to a card-capable channel in the same domain, the `message` field names it, and you MUST relay that.",
+  inputSchema: z.object({
+    routineId: z.string().min(1).describe("The routine id, e.g. 'r-1a2b3c4d' (from list_routines)."),
+    rule: z
+      .string()
+      .min(1)
+      .max(POLICY_RULE_MAX_CHARS)
+      .describe(
+        `The rule, as ONE line of plain imperative English the routine must follow (max ${POLICY_RULE_MAX_CHARS} chars). ` +
+          "Write it as a standing instruction ('never …', 'always …', 'skip … when …'), not as a description of what went wrong.",
+      ),
+    why: z
+      .string()
+      .min(1)
+      .max(POLICY_WHY_MAX_CHARS)
+      .describe(
+        `REQUIRED: why this rule exists — the incident or the reasoning (max ${POLICY_WHY_MAX_CHARS} chars), one line. ` +
+          "Name the concrete thing that happened where you can ('the 2026-07-19 run woke the channel at 03:12'), not a restatement of the rule.",
+      ),
+    source: z
+      .enum(["human", "learned"])
+      .default("human")
+      .describe(
+        "'human' when a person in this conversation asked for this rule; 'learned' when YOU are proposing it yourself after noticing a problem nobody raised. Say 'learned' honestly — it is shown on the card so the person confirming knows nobody asked for it.",
+      ),
+    incidentRunAt: z
+      .string()
+      .optional()
+      .describe("Optional ISO timestamp of the run that prompted this rule (a routine's lastRunAt, from list_routines)."),
+  }),
+  outputSchema: z.object({
+    pending: z.boolean(),
+    pendingId: z.string().optional(),
+    routineId: z.string(),
+    ruleId: z.string(),
+    message: z.string(),
+    autoApproved: z.boolean().optional().describe("The approver chain lowered this verb: no card was posted and it has ALREADY run."),
+  }),
+  approval: never(),
+  async execute(input, ctx) {
+    await requireSessionContinuation(ctx, "add_routine_rule");
+
+    // Gate 1, from the ONE shared definition so the two rule tools cannot drift. Checked FIRST, before anything is read or resolved, so an autonomous turn cannot even learn whether a rule would have been accepted. The marker is stamped by the dispatcher onto the fired session's auth and is not model-writable.
+    // The TAINT gate that used to sit beside it is gone: this row declares `taint: "gate"`, so the approver chain floors a tainted turn at a human decision and denies it unattended. One control, one enforcement point.
+    const auth = ctx.session?.auth;
+    const refusal = policyAuthorRefusal(
+      { inRoutineFire: routineMarker(auth?.current?.attributes ?? auth?.initiator?.attributes) !== null },
+      "add",
+    );
+    if (refusal) throw new Error(refusal);
+
+    const p = resolvePartition(ctx);
+    // 🔴 THE ROOM THAT ASKED, NOT THE ROOM THAT ARRIVED LAST (OPE-1756). `p` above is the TURN's
+    // partition, and a turn that merged queued deliveries carries only the LAST delivery's auth —
+    // so on a turn answering two rooms it names the wrong one. The GOVERNED scope follows the
+    // ADDRESSED wake instead, through the same road the reply path uses; it falls back to `p` on
+    // every unknown, so a single-wake turn is unchanged.
+    // 🔴 THE MERGE ROAD IS UNREACHABLE ON eve 0.54.3; THIS READ IS STILL LIVE (OPE-2042). eve batches
+    // adjacent queued deliveries only when their full auth contexts match, and OE stamps a fresh
+    // per-delivery `oe_delivery_id` into `auth.attributes`, so two auth-carrying deliveries on one
+    // unified window never compare equal; only the caller-less task COMPLETION COHORT still folds,
+    // and it carries no `auth` at all. But the TURN's ctx names the wrong room WITHOUT any merge
+    // too: a turn woken by an INTERNAL wake — an approval decision, a completion — answers a
+    // conversation whose envelope is in the seat's shared context, through the reply fence's
+    // same-conversation and pending arms (`channels/unified-window.ts` `resolveAnswerableReplyTarget`,
+    // arms 3 and 4). Measured in production on 2026-08-15 (`docs/glossary.md`). So this read is
+    // LOAD-BEARING, not defensive. `scripts/coalesced-delivery-merge-assumption-test.ts` pins only
+    // the merge road's impossibility.
+    // 🔴 WHAT MOVES IS THE GOVERNANCE KEY ONLY. Anything else this tool derives from `p` — the memory
+    // tier, the card's venue walk, and any surface key frozen into the proposal's own `args` — keeps
+    // reading the TURN's partition, deliberately: those name what the act DOES and where this seat
+    // lives, while the scope key names who may approve it and which halt covers it. Moving the act's
+    // own target is a design choice this task does not hold.
+    const proposeScopeKey = await proposalScopeKey(ctx, p);
+    const routineId = input.routineId.trim();
+    const rule = input.rule.trim();
+    const why = input.why.trim();
+
+    // GRAMMAR — the same check the write runs (routines/policy.ts), run here so the refusal reaches
+    // the person while they are still in the conversation, rather than as a dead card.
+    for (const [text, field, cap] of [
+      [rule, "rule", POLICY_RULE_MAX_CHARS],
+      [why, "why", POLICY_WHY_MAX_CHARS],
+    ] as const) {
+      const problem = policyTextProblem(text, field, cap);
+      if (problem) throw new Error(`That rule can't be armed as written — ${problem}`);
+    }
+
+    const routine = await getRoutine(p.org, p.surfaceKey, routineId);
+    if (!routine) {
+      throw new Error(`No routine '${routineId}' on this surface — check the id with list_routines.`);
+    }
+    if (routine.status === "done") {
+      throw new Error(
+        `Routine '${routineId}' is a finished job (${routine.completedReason ?? "completed"}) — it will never fire again, so a rule for it would never be read. Create a fresh routine if the work has come back.`,
+      );
+    }
+    const existing = policyRules(routine);
+    // Cap + duplicate are re-checked at the write against the LIVE row (two cards can be pending at
+    // once); this early copy exists so the common refusal is a sentence in the conversation rather
+    // than a card that dies on click.
+    if (existing.length >= POLICY_MAX_RULES) {
+      throw new Error(
+        `Routine '${routineId}' already has the maximum ${POLICY_MAX_RULES} standing rules, and I never drop one automatically to make room — that would silently remove a guardrail. Ask me to list them and remove one first.`,
+      );
+    }
+    const norm = (s: string): string => s.trim().replace(/\s+/g, " ").toLowerCase();
+    const dupe = existing.find((x) => norm(x.rule) === norm(rule));
+    if (dupe) {
+      throw new Error(`Routine '${routineId}' already has that rule (${dupe.id}, added ${dupe.addedAt}) — nothing to add.`);
+    }
+
+    const description = describeTrigger(routine.trigger, routine.report);
+    const binding = bindFrom(ctx);
+    // principal-gate: accountability — the card's "asked by" line, which a member reads before arming a
+    // standing rule. The PRESENCE question is answered a few lines up and much harder: routines/policy.ts
+    // refuses this tool outright inside any routine fire (`inRoutineFire`), so a fire never reaches here.
+    const requestedBy = principalIdOf(ctx);
+    if (!requestedBy) {
+      throw new Error(
+        "add_routine_rule needs a verified sender to gate the rule — no principal id resolved, so there's no requester to show on the approval card.",
+      );
+    }
+
+    // Where the card goes: this room when it can host one, otherwise a card-capable channel in the SAME domain. This also subsumes the old "couldn't resolve this channel's id" throw.
+    const venueResult = await checkApprovalVenue(binding, p, () => getConfig().loadDomains());
+    if ("refusal" in venueResult) {
+      throw new Error(describeVenueRefusal(venueResult.refusal, binding.platform, "add that rule"));
+    }
+    const venue = venueResult.venue;
+
+    // Minted here so the id a human reads on the card is the id in the rendered block and the audit
+    // row. `updateRoutine` never sees a model-supplied id.
+    const ruleId = newPolicyRuleId();
+    const posted = await requestApproval(
+      {
+        org: p.org,
+        kind: "routine.policy.add",
+        args: {
+          org: p.org,
+          partition: p,
+          surfaceKey: p.surfaceKey,
+          routineId,
+          description,
+          ruleId,
+          rule,
+          why,
+          source: input.source,
+          ...(input.incidentRunAt ? { incidentRunAt: input.incidentRunAt } : {}),
+          countBefore: existing.length,
+          requestedBy,
+        },
+        scopeKey: proposeScopeKey,
+        domain: null,
+        requestedBy,
+        channelId: venue.channelId,
+        threadTs: venue.sameRoom ? binding.threadTs ?? null : null,
+        postedTo: venue.surfaceKey,
+        // OPE-296 P3: the chain's unattended signal — a fire (no ACTING sender) must deny fast on an
+        // undeclared gate rather than post a card into an empty room (ask-unattended; feeds OPE-297).
+        chain: { unattended: unattendedOf(ctx) },
+      },
+      approvalPostDeps(venue.platform, ctx),
+    );
+
+    // Chain-lowered (OPE-296) ⇒ no card and no click, so the rule is already attached — the
+    // "takes effect on the next fire after someone clicks" tail is replaced, not just softened.
+    const subject = `standing rule ${ruleId} for routine ${routineId} (${description})`;
+    if (posted.autoApproved) {
+      return {
+        pending: false,
+        autoApproved: true,
+        pendingId: posted.id,
+        routineId,
+        ruleId,
+        message: `${autoApprovedNote(subject, posted.autoApproved)} It applies from the next fire on.`,
+      };
+    }
+    return {
+      pending: true,
+      pendingId: posted.id,
+      routineId,
+      ruleId,
+      message: `${cardPostedPrefix(venue)} — ${subject} awaiting a human to confirm (pending ${posted.id}). It takes effect on the next fire after someone clicks, and shows up in every fire after that.${cardPostedTail(venue, "confirm the rule", posted)}`,
+    };
+  },
+});

package/agent/tools/agent_version.ts

@@ -0,0 +1,46 @@
+// agent_version answers "what version are you running?" from the SAME registered fact bag the status command already renders, so the model's own answer and the human-typed command can never disagree. A TOOL rather than an injected instruction fact: an operator needs a LEVER over disclosing a build sha, and declining to mount a tool is exactly that lever, where an always-on prompt fact has no off switch short of hand-editing core and costs prompt budget on every turn for a fact that is asked rarely.
+// Structurally it never guesses and never reads the checkout — it returns exactly what the fact bag carries, so "unknown" (for the three string fields) and ABSENT (for the two optional token counts) are the only other values possible. `version` answers "unversioned" rather than a number on a build that never bumps its own package.json; the commit sha is this repo's build identity. Ungated at every grain and reachable from a JOB WAKE, because an unattended routine asking "am I behind?" is precisely the case with nobody in the room to route the question to.
+// 🔴 EVERY FIELD THE FACT BAG CARRIES IS RETURNED (OPE-1634). The bag also holds the primary model's context window and the absolute token count compaction fires at, and this tool used to drop both — so `/oe status` answered "compaction fires at 525,000" while the model's own answer to the same question could not say it. That is exactly the disagreement the header above claims this tool prevents. Adding a field to `registerAppInfo` therefore means adding it HERE too, or the claim goes stale again. The two model ids are the deliberate exception: the running model is already the model's own turn context, so reporting it back to itself buys nothing.
+
+import { defineTool } from "eve/tools";
+import { never } from "eve/tools/approval";
+import { z } from "zod";
+import { getAppInfo } from "../commands/core.js";
+
+export default defineTool({
+  description:
+    "State which version of this agent is currently running: the deployment's commit sha, the eve framework version this deployment was built against, the Open Everywhere package version where the build carries one, and this deployment's context window with the token count at which compaction fires. The commit sha is the identity that separates two builds — report it first. Use this to answer \"what version are you on?\", \"how big is your context window?\" or \"when do you compact?\", or to compare against an upstream release before proposing a self-upgrade. Never guesses — \"unknown\" means this deployment does not expose the fact (e.g. running locally, off Vercel), \"unversioned\" means the build carries no package version, so the sha is the only answer, and an ABSENT token count means this deployment registered none.",
+  inputSchema: z.object({}),
+  outputSchema: z.object({
+    version: z
+      .string()
+      .describe(
+        "The Open Everywhere package version, or \"unversioned\" when this build carries none (OPE-1057). A deployment that does not bump its own package.json is identified by deploymentSha, not by this field — do not report \"unversioned\" as a version number.",
+      ),
+    deploymentSha: z.string().describe("The commit sha this deployment was built from, or \"unknown\" if the platform doesn't expose it."),
+    evePin: z.string().describe("The installed eve framework version, or \"unknown\" if it could not be resolved."),
+    contextWindowTokens: z
+      .number()
+      .optional()
+      .describe(
+        "The primary model's context window, in tokens. ABSENT when this deployment registered no window — never a default, and never derived from the model id.",
+      ),
+    compactionThresholdTokens: z
+      .number()
+      .optional()
+      .describe(
+        "The absolute token count at which compaction fires: the context window times the configured threshold percent. ABSENT when this deployment registered no window. This is the same number `/oe status` prints.",
+      ),
+  }),
+  approval: never(),
+  async execute() {
+    const info = getAppInfo();
+    return {
+      version: info.version,
+      deploymentSha: info.deploymentSha,
+      evePin: info.evePin,
+      contextWindowTokens: info.contextWindowTokens,
+      compactionThresholdTokens: info.compactionThresholdTokens,
+    };
+  },
+});

package/agent/tools/assign.ts

@@ -0,0 +1,182 @@
+// assign PROPOSES assigning a ticket to someone. Neutral and entity-gated, with no surface identity in its params. GATED, because assignment is audience-expanding: it makes the entity someone's explicit responsibility, visible to the whole team or repo rather than just the asking room. This is the PROPOSE half — it validates and resolves the ref, freezes the fields and posts a card, and the mutation happens only on a human's click.
+// Same two-join split as set_state: the ENTITY SOURCE stays resolved from the ASKING window, while the CARD may be redirected to a card-capable channel in the SAME domain when this room cannot host one. The entity acted on may be on a different platform from the card, in either direction. There is no `approval:` property; the consequential gate is the OE approvals plane, not eve HITL.
+
+import { defineDynamic, defineTool } from "eve/tools";
+import { z } from "zod";
+import { bindFrom } from "../identity/binding.js";
+import type { BindableContext } from "../identity/binding.js";
+import { principalIdOf, unattendedOf } from "../access/request.js";
+import { resolvePartition } from "../memory/partition.js";
+import { proposalScopeKey } from "../channels/propose-scope.js";
+import { untrustedIngestedThisTurn } from "../access/taint-signal.js";
+import { getConfig } from "../access/config.js";
+import { resolveEntityAction, currentTurnEntityRef, supportedEntityActionPlatforms } from "../channels/entity-actions.js";
+import { workDestinationPlatforms } from "../channels/work-destinations.js";
+import { requestApproval, autoApprovedNote } from "../approvals/flow.js";
+import { requireSessionContinuation } from "../spend/checkpoint.js";
+import { approvalPostDeps } from "./set_spend_limit.js";
+import { checkApprovalVenue, describeVenueRefusal, cardPostedPrefix, cardPostedTail } from "../approvals/card-venue.js";
+import type { TicketAssignArgs } from "../approvals/ticket-actions.js";
+import { preRegisterDynamicEntry } from "../access/window-gated.js";
+import type { Domain } from "../memory/domain.js";
+
+function safeDomains(): readonly Domain[] {
+  try {
+    return getConfig().loadDomains();
+  } catch {
+    return [];
+  }
+}
+
+const refSchema = z
+  .object({
+    platform: z.string().min(1).describe('Ticketing surface — "linear" or "github".'),
+    id: z.string().min(1).describe('Entity id — a Linear issue UUID/identifier (e.g. "ENG-42"), or GitHub "owner/repo#123".'),
+  })
+  .optional()
+  .describe("The ticket to act on. Defaults to the current turn's entity (the Linear issue or GitHub issue/PR this turn is on).");
+
+// Exported for the unit test (calls .execute directly, mirroring read_linear_issue.ts's pattern).
+export const assignEntry = defineTool({
+  description:
+    "PROPOSE assigning a ticket — a Linear issue or a GitHub issue/PR — to someone. Entity-gated: only " +
+    "works on a ticketing surface; refuses cleanly on chat or Notion. Consequential: posts an approval " +
+    "card — nothing changes until a human confirms. The posted card IS the reply — do not add narration " +
+    "after this call. EXCEPT when this surface can't host a card: it then goes to a card-capable channel " +
+    "in the same domain, the `message` field names it, and you MUST relay that.",
+  inputSchema: z.object({
+    ref: refSchema,
+    assignee: z
+      .string()
+      .min(1)
+      .describe(
+        "Who to assign — Linear: an email, display name, or Linear user id. GitHub: a login (username). " +
+          "Ambiguous or unmatched names are refused rather than guessed.",
+      ),
+  }),
+  outputSchema: z.object({
+    pending: z.boolean(),
+    pendingId: z.string().optional(),
+    platform: z.string(),
+    id: z.string(),
+    message: z.string(),
+    autoApproved: z.boolean().optional().describe("The approver chain lowered this verb: no card was posted and it has ALREADY run."),
+  }),
+  // NO `approval:` on a dynamic tool: eve registers the approval fn in-process at session.started resolve time only, so a RESUMED session's replay lookup fails and eve forces an ungrantable user-approval that kills the turn.
+  // The consequential gate is requestApproval below, not eve HITL.
+  async execute(input, ctx) {
+    const bctx = ctx as BindableContext;
+    await requireSessionContinuation(bctx, "assign");
+    // ONE config read, threaded to BOTH joins below — see set_state.ts.
+    const domains = safeDomains();
+    // 🔴 Resolved from `bctx`, the ASKING surface — never from the venue below.
+    const { ref, capabilities } = await resolveEntityAction(bctx, "assign", input.ref, domains);
+
+    const binding = bindFrom(ctx);
+    const p = resolvePartition(ctx);
+    // 🔴 THE ROOM THAT ASKED, NOT THE ROOM THAT ARRIVED LAST (OPE-1756). `p` above is the TURN's
+    // partition, and a turn that merged queued deliveries carries only the LAST delivery's auth —
+    // so on a turn answering two rooms it names the wrong one. The GOVERNED scope follows the
+    // ADDRESSED wake instead, through the same road the reply path uses; it falls back to `p` on
+    // every unknown, so a single-wake turn is unchanged.
+    // 🔴 THE MERGE ROAD IS UNREACHABLE ON eve 0.54.3; THIS READ IS STILL LIVE (OPE-2042). eve batches
+    // adjacent queued deliveries only when their full auth contexts match, and OE stamps a fresh
+    // per-delivery `oe_delivery_id` into `auth.attributes`, so two auth-carrying deliveries on one
+    // unified window never compare equal; only the caller-less task COMPLETION COHORT still folds,
+    // and it carries no `auth` at all. But the TURN's ctx names the wrong room WITHOUT any merge
+    // too: a turn woken by an INTERNAL wake — an approval decision, a completion — answers a
+    // conversation whose envelope is in the seat's shared context, through the reply fence's
+    // same-conversation and pending arms (`channels/unified-window.ts` `resolveAnswerableReplyTarget`,
+    // arms 3 and 4). Measured in production on 2026-08-15 (`docs/glossary.md`). So this read is
+    // LOAD-BEARING, not defensive. `scripts/coalesced-delivery-merge-assumption-test.ts` pins only
+    // the merge road's impossibility.
+    // 🔴 WHAT MOVES IS THE GOVERNANCE KEY ONLY. Anything else this tool derives from `p` — the memory
+    // tier, the card's venue walk, and any surface key frozen into the proposal's own `args` — keeps
+    // reading the TURN's partition, deliberately: those name what the act DOES and where this seat
+    // lives, while the scope key names who may approve it and which halt covers it. Moving the act's
+    // own target is a design choice this task does not hold.
+    const proposeScopeKey = await proposalScopeKey(ctx, p);
+    // Where the card goes: this room when it can host one, otherwise a card-capable channel in the SAME domain. Placed exactly where the old card-path refusal was, and it subsumes the "couldn't resolve this channel's id" throw that followed.
+    // The ASSIGNEE is not a room-scoped value: it is resolved against the ENTITY's workspace by the frozen platform's adapter at click time, so the venue cannot touch it.
+    const venueResult = await checkApprovalVenue(binding, p, () => domains);
+    if ("refusal" in venueResult) {
+      throw new Error(describeVenueRefusal(venueResult.refusal, binding.platform, "assign that ticket"));
+    }
+    const venue = venueResult.venue;
+    // principal-gate: accountability — a routine that triages and re-assigns work is the PRODUCT, not an
+    // abuse, so refusing an unattended turn would delete a capability people want. What the gate protects
+    // is the card: an assignment lands in someone's queue, and the queue owner is owed a name for it. A
+    // fire's attested creator is the honest answer to that, and the member card is still the control.
+    const requestedBy = principalIdOf(ctx);
+    if (!requestedBy) {
+      throw new Error("assign needs a verified sender to gate the change — no principal id resolved, so there's no requester to show on the approval card.");
+    }
+
+    const args: TicketAssignArgs = {
+      org: p.org,
+      scopeKey: proposeScopeKey,
+      platform: ref.platform,
+      entityId: ref.id,
+      ...(ref.organizationId ? { organizationId: ref.organizationId } : {}),
+      assignee: input.assignee,
+      requestedBy,
+      tainted: untrustedIngestedThisTurn(),
+      // OPE-1024: freeze the work source's capability expansions — there is no ctx at decide time.
+      ...(capabilities.length ? { capabilities } : {}),
+    };
+
+    const posted = await requestApproval(
+      {
+        org: p.org,
+        kind: "ticket.assign",
+        args,
+        scopeKey: proposeScopeKey,
+        domain: null,
+        requestedBy,
+        channelId: venue.channelId,
+        threadTs: venue.sameRoom ? binding.threadTs ?? null : null,
+        // The VENUE's key, because that is where the card actually is — the TTL sweep and the
+        // decision wake both go looking there.
+        postedTo: venue.surfaceKey,
+        // OPE-296 P3: the chain's unattended signal — a fire (no ACTING sender) must deny fast on an
+        // undeclared gate rather than post a card into an empty room (ask-unattended; feeds OPE-297).
+        chain: { unattended: unattendedOf(ctx) },
+      },
+      approvalPostDeps(venue.platform, ctx),
+    );
+
+    // Chain-lowered (OPE-296) ⇒ no card, the assignment already landed on the tracker.
+    const subject = `assign ${ref.platform} ${ref.id} to ${input.assignee}`;
+    if (posted.autoApproved) {
+      return {
+        pending: false,
+        autoApproved: true,
+        pendingId: posted.id,
+        platform: ref.platform,
+        id: ref.id,
+        message: autoApprovedNote(subject, posted.autoApproved),
+      };
+    }
+    return {
+      pending: true,
+      pendingId: posted.id,
+      platform: ref.platform,
+      id: ref.id,
+      message: `${cardPostedPrefix(venue)} — ${subject} awaiting a human to confirm (pending ${posted.id}).${cardPostedTail(venue, "confirm the assignment", posted)}`,
+    };
+  },
+});
+preRegisterDynamicEntry("assign", "_single", assignEntry);
+
+export default defineDynamic({
+  events: {
+    "session.started": (_event, ctx) => {
+      const bctx = ctx as BindableContext;
+      // Mount on the SAME set the resolver gates on: the window's sources PLUS the connectors this domain holds a work grant on.
+      const destinations = workDestinationPlatforms(bctx, safeDomains());
+      const adapterPlatforms = supportedEntityActionPlatforms();
+      if (!destinations.some((s) => adapterPlatforms.includes(s)) && !currentTurnEntityRef(bctx)) return null;
+      return assignEntry;
+    },
+  },
+});

package/agent/tools/aws.ts

@@ -0,0 +1,175 @@
+// aws runs an `aws` CLI command host-side under a bundle-granted, identity-bound role. The credentials are minted in the framework process and injected into a SINGLE invocation, so the sandbox never holds them — and the CLI is FENCED so that claim is a property rather than a wish: it cannot echo its own credentials, and the WHOLE argv is screened for the options that would ship a SigV4-signed request to an attacker host. The screen runs as the approver chain's L2 element BEFORE any credential is minted, so a refused command never mints one.
+// `open` and ungated because the control here is not a card and not the seat grain: it is the reviewed per-scope grant (default-deny, with a REQUIRED allow list), plus the role's IAM policy, plus the adapter being wired — the tool is inert until an operator arms all three. 🔴 Audit is therefore the ONLY observability this tool has, which is why it is unconditional: a grant bounds what CAN happen, and only the log says what DID. The output is untrusted DATA, and it is REDACTED before it is returned, not merely before it is rendered.
+
+import { defineTool } from "eve/tools";
+import { never } from "eve/tools/approval";
+import { z } from "zod";
+import { actingPrincipalIdOf, unattendedOf } from "../access/request.js";
+import { approvalModeForDomain, resolveApproverChain } from "../access/approver-chain.js";
+import { haltScopeForCtx, resolveHalt } from "../access/halt.js";
+import { awsCommandVerdict } from "../access/aws-screen.js";
+import { redactAwsOutput, redactionCount, renderAwsResultForModel } from "../access/aws-output.js";
+import { auditToolAction } from "../audit/tool-action.js";
+import type { BindableContext } from "../identity/binding.js";
+import { requireAwsExecutor } from "../connections/aws-exec.js";
+import { mintPlannedAwsIdentity, planAwsIdentityFor } from "../connections/aws-identity.js";
+
+/** `service:operation` for the audit row — the AWS verb grammar's own grain, which is the grain the
+ *  allow-list narrows on, so a log line and a grant entry read as the same kind of thing.
+ *  Only the first two argv positions: everything after them is flags and VALUES, and a value can be
+ *  an object key, a query string or a log-group name nobody decided to put in an audit row. */
+function awsCommandLabel(args: readonly string[]): string {
+  const service = args[0] ?? "(none)";
+  const operation = args[1];
+  return operation ? `${service}:${operation}` : service;
+}
+
+/** The eve session id, for the design's `{sessionId, …}` row (aws-access-plan.md §9). It is what
+ *  joins a call to the TRANSCRIPT — the audit log says what was run, the transcript says why — and
+ *  it is not an AuditEntry column, so it rides in `detail` like every other tool that carries one
+ *  (tools/complete_thread.ts, hooks/routine-outcome.ts). */
+function sessionIdOf(ctx: unknown): string | null {
+  const id = (ctx as { session?: { id?: unknown } }).session?.id;
+  return typeof id === "string" && id.length > 0 ? id : null;
+}
+
+export default defineTool({
+  description:
+    "Run an AWS CLI command under this channel's granted AWS role (e.g. read CloudWatch logs, query DynamoDB). Credentials are resolved host-side from the verified identity and never enter the sandbox. `args` are the arguments after `aws` (e.g. [\"logs\",\"start-query\",\"--log-group-name\",\"/x\",...]). Fails closed if this channel has no AWS role granted, and refuses commands outside the grant's allow list (plus, always: credential-echo subcommands and request-redirect options). Reach is bounded by the role's IAM policy.",
+  inputSchema: z.object({
+    args: z
+      .array(z.string())
+      .min(1)
+      .describe('The `aws` CLI arguments AFTER the word `aws`, e.g. ["sts","get-caller-identity"] or ["logs","start-query","--log-group-name","/prod","--start-time","...","--query-string","..."].'),
+    roleArn: z
+      .string()
+      .optional()
+      .describe("If this channel is granted more than one AWS role, name which to use. Must be one of the granted roles."),
+    identity: z
+      .enum(["domain", "me"])
+      .optional()
+      .describe('Whose identity to act as: "domain" (default) uses the channel domain\'s service role; "me" uses your own AWS SSO identity (DM only, attended — not available to a routine fire or in a shared channel).'),
+  }),
+  outputSchema: z.object({
+    exitCode: z.number().int().describe("The aws CLI exit code (0 = success). Non-zero returns the CLI's own error in stderr rather than throwing."),
+    stdout: z.string(),
+    stderr: z.string(),
+    roleArn: z.string().describe("The role actually assumed for this call."),
+    identity: z.enum(["domain-role", "user-sso"]).describe("Which identity mode the call ran under."),
+    redactions: z
+      .array(z.object({ rule: z.string(), count: z.number().int() }))
+      .describe("Credential-shaped values Open Everywhere removed from stdout/stderr before returning them — rule names and counts, never the removed values. Empty on an ordinary call."),
+  }),
+  approval: never(),
+  async execute(input, ctx) {
+    // The unattended-origin flag, read ONCE and stamped on whichever row this call produces. A PROVENANCE read, not a gate: `aws` is deliberately reachable from a routine fire under the domain role, and only the `me` mode is refused there.
+    // It is also the chain request's unattended signal, which cannot refuse this tool's ALLOW, so the read stays a provenance read — "which of these calls had no human behind them" is otherwise unanswerable after the fact.
+    const unattended = unattendedOf(ctx);
+    const command = awsCommandLabel(input.args);
+
+    // 1. PLAN — fail-closed identity selection (no grant / ambiguous / user-sso fences throw here).
+    //    No credential exists yet: the screen must run before any mint.
+    const plan = planAwsIdentityFor(ctx as BindableContext, {
+      roleArn: input.roleArn,
+      as: input.identity === "me" ? "user-sso" : "domain-role",
+    });
+
+    // 2. THE APPROVER CHAIN (OPE-296 §8.2) — the aws surface element (the three-fence screen) at
+    //    L2, the registry's open verdict at L4, and the domain's approvalMode transforms on top.
+    const resolution = await resolveApproverChain({
+      tool: "aws",
+      args: input.args,
+      principalId: actingPrincipalIdOf(ctx),
+      unattended,
+      ...(plan.domain !== undefined ? { domain: plan.domain, mode: approvalModeForDomain(plan.domain) } : {}),
+      // 🔴 THE BREAK-GLASS HALT (OPE-1602). This tool is `open` tier and runs a consequential
+      // host-side command through its own executor — not `oeFetch`, not a connector, not a
+      // credential grant — so NO other halt arrow sees it. It builds its own chain request rather
+      // than going through `requestApproval`, so it must resolve the halt itself; without this line
+      // a worker could `aws s3 rm` inside a halted deployment. Fail-CLOSED with the rest of the
+      // plane, and it lands as a non-allow verdict, which this tool already reports as a refusal
+      // naming the mode that stopped it.
+      halted: (await resolveHalt(haltScopeForCtx(ctx as BindableContext))).halted,
+      aws: { argv: input.args, allow: plan.grant.allow },
+    });
+
+    if (resolution.verdict !== "allow") {
+      // Name WHICH fence refused: re-derive the screen verdict (pure, cheap) for its closed code;
+      // a clean screen + non-allow chain verdict means a MODE stopped it (DENY_ALL, or APPROVE_ALL
+      // flooring to ask — this tool has no card path, so an ask is honestly a refusal here).
+      const screen = awsCommandVerdict({ argv: input.args, allow: plan.grant.allow });
+      const reason = screen.ok ? "mode" : screen.code;
+      await auditToolAction(ctx as BindableContext, "aws.refused", {
+        roleArn: plan.grant.roleArn,
+        identity: plan.kind,
+        domain: plan.domain ?? null,
+        sessionId: sessionIdOf(ctx),
+        command,
+        unattended,
+        reason,
+        // The grant's own list, not the model's args — what an auditor needs to tell a probe from a
+        // grant that is simply too narrow for the work people keep asking for.
+        allow: plan.grant.allow ?? null,
+        resolvedBy: resolution.resolvedBy,
+        transforms: resolution.transforms.map((t) => t.name),
+      });
+      const detail = screen.ok
+        ? `this domain's approval mode (${resolution.transforms.map((t) => t.name).join(", ") || resolution.resolvedBy}) stops it — a config decision, lifted only by a config diff`
+        : screen.reason;
+      throw new Error(
+        screen.ok || screen.code !== "allow-list"
+          ? `aws command "${command}" was refused before anything ran: ${detail}. Fail-closed: the command was NOT run and no credential was minted.`
+          : `aws command "${command}" is not permitted by this channel's AWS grant: the role "${plan.grant.roleArn}" ` +
+            `carries a host-side allow-list (${(plan.grant.allow ?? []).join(", ")}) and it does not cover this command. ` +
+            `This is a reviewed narrowing on top of the IAM role — an admin must widen the grant's \`allow\` list ` +
+            `(access/bundle.ts awsRoles) to run it. Fail-closed: the command was NOT run and no credential was minted.`,
+      );
+    }
+
+    // 3. MINT — only an allowed command reaches here. Domain-role mints carry the grant's allow
+    //    compiled as an STS session policy (AWS-enforced); the credentials go straight into ONE
+    //    executor invocation and nowhere else.
+    const resolved = await mintPlannedAwsIdentity(plan);
+    const result = await requireAwsExecutor().run({
+      credentials: resolved.credentials,
+      region: resolved.region,
+      args: input.args,
+    });
+    // Redact BEFORE anything else sees the bytes, and deliberately here in execute rather than in `toModelOutput`: the structured result is what eve PERSISTS in the session, so striking a credential only on the way to the model would leave it in the transcript.
+    // The minted strings are passed for exact-match striking and are neither logged nor returned — they go in, and only a rule name and a count come back out.
+    const redacted = redactAwsOutput({
+      stdout: result.stdout,
+      stderr: result.stderr,
+      secrets: [resolved.credentials.accessKeyId, resolved.credentials.secretAccessKey, resolved.credentials.sessionToken],
+    });
+    // AFTER the call, so the row is evidence that it happened rather than that it was attempted, and it carries the CLI's own verdict.
+    // Deliberately NOT stdout or stderr: those are the account's own data, and an AWS error string can quote the arguments back — while this log is append-only and outside the erasure path, the one place bytes must not be parked casually.
+    await auditToolAction(ctx as BindableContext, "aws.exec", {
+      roleArn: resolved.roleArn,
+      identity: resolved.boundAs,
+      domain: resolved.domain ?? null,
+      sessionId: sessionIdOf(ctx),
+      region: resolved.region ?? null,
+      command,
+      exitCode: result.exitCode,
+      unattended,
+      // A COUNT, never a value (same rule as stdout/stderr above). Worth a column: a call whose
+      // output carried credential shapes is a fact an auditor wants — either OE's own credential
+      // came back in an error body, or the account is storing keys somewhere the agent can read.
+      redactions: redactionCount(redacted.hits),
+    });
+    return {
+      exitCode: result.exitCode,
+      stdout: redacted.stdout,
+      stderr: redacted.stderr,
+      roleArn: resolved.roleArn,
+      identity: resolved.boundAs,
+      redactions: redacted.hits.map((h) => ({ rule: h.rule, count: h.count })),
+    };
+  },
+  // THE FENCE (OPE-305). Host-derived structure as trusted text; each CLI stream individually
+  // wrapped as untrusted DATA — see access/aws-output.ts for the tier reasoning and the renderer.
+  toModelOutput(output) {
+    return { type: "text" as const, value: renderAwsResultForModel(output) };
+  },
+});

package/agent/tools/browser_tools.ts

@@ -0,0 +1,22 @@
+// The resolver FILE that mounts the flag-gated agent-browser tool family. It mounts NOTHING under its own name: at session start it resolves whatever the adapter registered through the browser-toolkit seam for this seat's grain, and every negative outcome is structural ABSENCE rather than a mounted-then-refusing tool — an unarmed capability and a conversational-root seat both yield null, because browsing is wide-hands work that belongs to workers.
+// Entries mount under their bare `browser_*` keys, with a single underscore ON PURPOSE, because a double underscore is the connector-op separator. The grain read is FAIL-CLOSED: an unreadable seat narrows to the conversational posture and therefore gets no kit.
+
+import { defineDynamic } from "eve/tools";
+import { windowGrainOf, type BindableContext, type WindowGrain } from "../identity/binding.js";
+import { resolveBrowserKit } from "../access/browser-toolkit.js";
+
+function grainOf(ctx: BindableContext): WindowGrain {
+  try {
+    return windowGrainOf(ctx);
+  } catch {
+    return "standing"; // fail-closed: an unreadable seat gets the conversational posture (⇒ no kit)
+  }
+}
+
+export default defineDynamic({
+  events: {
+    "session.started": async (_event, ctx) => {
+      return resolveBrowserKit(grainOf(ctx as BindableContext));
+    },
+  },
+});