@open-everywhere/core 0.1.0

package/agent/tools/no_reply.ts

@@ -0,0 +1,272 @@
+// no_reply ends a turn's reply obligation WITHOUT posting anything, with a closed reason and an audit row. Calling it IS the decision, recorded the moment it happens and wired to the same suppression path every channel already uses for the older sentinel, so both routes work on every surface. Not consequential — it is the ABSENCE of an action — so no approval, but still audited, and "why did it go quiet here" always has an answer.
+// 🔴 The vocabulary is universal; the HOST rendering is per-surface. Calling this always means the same thing to the model and its own words are always dropped, but what the host then leaves in the room is the surface's decision — Linear's native @mention route leaves one FIXED host line, because an Agent Session is a UI state with no invisible close. Do not restate that exception in the model-facing description below: a per-surface caveat there is pressure, not information.
+
+import { defineTool } from "eve/tools";
+import { never } from "eve/tools/approval";
+import { z } from "zod";
+// Side-effect import: arms the empty-step terminal guard (OPE-762). The second anchor — a session
+// that mounts the silence verb is exactly a session whose next step can be correctly empty.
+import "../channels/turn-terminal-actions.js";
+import { markNoReplyThisTurn, peekNoReplyThisTurn, type NoReplyReason } from "../channels/no-reply-signal.js";
+import { noteTerminalCallGrain } from "../channels/turn-terminal-actions.js";
+import { END_TURN_WITH_SENTINEL_INSTRUCTION, NO_REPLY_SENTINEL } from "../channels/normalized-wake.js";
+import {
+  markWakeDeclinedThisTurn,
+  standDownAckOwedThisTurn,
+  standDownAckOwedMessage,
+  NO_REPLY_AFTER_STAND_DOWN_ACTION,
+} from "../channels/reply-signal.js";
+import {
+  SETTLEMENT_REPORT_SKIPPED_ACTION,
+  refuseSettlementReport,
+  settlementReportOwedMessage,
+} from "../access/pending-delegation-signal.js";
+import {
+  conversationEnrolledForSilence,
+  NO_REPLY_ADDRESSED_TO_OTHER_REFUSAL,
+  NO_REPLY_ON_ENGAGED_ACTION,
+} from "../channels/engaged-wake.js";
+import { resolvePartition } from "../memory/partition.js";
+import { bindFrom } from "../identity/binding.js";
+import { standDownAckRoute } from "./stand_down.js";
+import { noteTurnCloseoutRefusal } from "../model/turn-closeout.js";
+import { auditToolAction } from "../audit/tool-action.js";
+import { auditSilencesEnabled } from "../audit/audit.js";
+import { currentTurnId, currentWakeId, type BindableContext } from "../identity/binding.js";
+
+/** Closed reason enum — keep in sync with channels/no-reply-signal.ts's NoReplyReason. */
+export const NO_REPLY_REASONS = [
+  "addressed_to_other",
+  "reacted_instead",
+  "nothing_to_add",
+  "not_relevant",
+  "duplicate",
+  "user_requested_silence",
+  "awaiting_context",
+  "other",
+] as const;
+
+/** The turn-closeout reason a SECOND `no_reply` in one turn records (OPE-1520). Its own string, so
+ *  a turn ended by a repeated silence call is countable apart from one ended by a refused reply —
+ *  the two say different things about what the model was trying to do. */
+export const NO_REPLY_REDUNDANT_CLOSEOUT_REASON = "no-reply-redundant";
+
+/**
+ * What a successful `no_reply` hands back to the model. 🔴 The second sentence is a DEFECT FIX, not politeness: eve runs one step per model call, so the step after this one used to come back empty, which eve reads as a failure and reissues with "Answer now from the tool results above" — a note that commands a reply on a turn that correctly chose silence. Naming the terminal output makes that step NON-EMPTY, so the recovery path is never reached.
+ * This is instruction compliance, so it reduces the trigger rather than removing it; the deterministic half is the declined-wake record `tools/reply.ts` refuses against. Exported so the offline probe hands the model the REAL note — a probe answering with anything else would measure a turn the deployment never runs.
+ */
+export const NO_REPLY_NOTE =
+  `Turn reply requirement satisfied — silence recorded as this turn's answer. ` +
+  `${END_TURN_WITH_SENTINEL_INSTRUCTION} Do not call another tool.`;
+
+export default defineTool({
+  description:
+    "End this turn without posting a reply. Call it, then stop — text after it is discarded. " +
+    "`addressed_to_other` — multi-party thread, message is for someone else; " +
+    "`reacted_instead` — an UNADDRESSED message acknowledged with an emoji react; never use it on " +
+    "a message that addressed you, which is owed one short reply as well as the react; " +
+    "`nothing_to_add` — would just be agreeing/restating, no new information; " +
+    "`not_relevant` — auto-respond/firehose message doesn't warrant a response; " +
+    "`duplicate` — the room already has the ANSWER: an earlier reply of yours, or another " +
+    "participant, answered this. A question asked again that nobody answered is not covered; answer it; " +
+    "`user_requested_silence` — user asked you to stop / stay quiet; " +
+    "`awaiting_context` — passively observing the thread, will weigh in once humans add more; " +
+    "`other` — none of the above (say why in `explanation`).",
+  inputSchema: z
+    .object({
+      reason: z.enum(NO_REPLY_REASONS).describe("Why you're not replying — see the tool description for what each value means."),
+      explanation: z
+        .string()
+        .min(10)
+        .max(500)
+        .optional()
+        .describe('Required when reason is "other": why none of the named reasons fit.'),
+    })
+    .superRefine((v, ctx) => {
+      // `other` without a stated reason is the zero-effort escape hatch that let silence go
+      // unjustified (observed: a model hid a confabulated "reply isn't available" belief behind
+      // bare `other` for five straight turns). Naming the reason is the moment a flimsy one
+      // collapses — so the schema demands it, and the audit keeps it.
+      if (v.reason === "other" && (v.explanation === undefined || v.explanation.trim().length < 10)) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          path: ["explanation"],
+          message: 'reason "other" requires an explanation — one sentence on why none of the named reasons fit.',
+        });
+      }
+    }),
+  outputSchema: z.object({ acknowledged: z.boolean(), reason: z.string(), note: z.string() }),
+  approval: never(),
+  async execute(input, ctx) {
+    // Confabulation fence: the one belief that must NEVER justify silence is "I can't reply". This catches it at the exact moment it becomes text and answers with the corrective instead of recording the silence.
+    // The corrective is INSTRUCTIVE only — this code cannot see the session's tools map, so it must not assert a presence it cannot check.
+    const confabulated =
+      /\breply\b[^.]{0,60}?\b(unavailable|not available|isn'?t available|can'?t|cannot)\b/i;
+    const confabulatedInverted = /\b(can'?t|cannot|unable to|no way to)\b[^.]{0,30}?\breply\b/i;
+    if (input.explanation && (confabulated.test(input.explanation) || confabulatedInverted.test(input.explanation))) {
+      throw new Error(
+        "Don't conclude from silence that `reply` is gone — if you believe it can't deliver, " +
+          "call it and read the error; otherwise pick a named reason for silence.",
+      );
+    }
+    // 🔴 THE STAND-DOWN ACKNOWLEDGEMENT THIS TURN STILL OWES (OPE-1580). A `stand_down` asks the
+    // model for one short line back, and this call used to CLOSE that obligation: it recorded
+    // silence as the turn's answer and replied "Turn reply requirement satisfied", so the
+    // acknowledgement never left the turn. Measured three drives of three on ship #180 — the
+    // engagement row was flagged every time and the room heard nothing.
+    // ONE ACKNOWLEDGEMENT IS WHAT THIS ASKS FOR — it is NOT a post cap and carries no ceiling. It
+    // therefore has NO refuse-once valve either, unlike the duplicate-post gates on the reply path,
+    // and that is a deliberate choice with a cost. A valve would accept the SECOND `no_reply`, which
+    // records silence and loses the acknowledgement again — and the measured models called
+    // `no_reply` twice on every drive, so the second call is the likely one, not the rare one. What
+    // bounds a model that keeps calling it is the step boundary (model/step-boundary.ts); ending the
+    // turn with text and no tool call is available at every step. The audit row below is ungated and
+    // written per refusal on purpose: a turn that draws several is how we would MEASURE that habit.
+    // also does NOT end the turn: no `noteTurnCloseoutRefusal`, and no
+    // `END_TURN_WITH_SENTINEL_INSTRUCTION` in the copy, because the turn has to stay open long
+    // enough for the acknowledgement to leave it. That is the one way this arm differs from the
+    // redundant arm below.
+    // Placed ABOVE `noteTerminalCallGrain`: a refused call is not a terminal call, and above the
+    // silence mark so nothing is recorded. Below the confabulation fence, which always applies.
+    const turnIdForGuards = currentTurnId(ctx as BindableContext);
+    if (standDownAckOwedThisTurn(turnIdForGuards)) {
+      // Ungated, unlike the silence rows below: this is a REFUSAL, not a record of a silence the
+      // model chose, and a lost acknowledgement has to be countable in the actions-only posture prod
+      // runs in.
+      await auditToolAction(ctx, NO_REPLY_AFTER_STAND_DOWN_ACTION, {
+        reason: input.reason,
+        ...(input.explanation !== undefined ? { explanation: input.explanation } : {}),
+      });
+      throw new Error(standDownAckOwedMessage(standDownAckRoute()));
+    }
+    // 🔴 THE DELEGATED REPORT THIS TURN STILL OWES (OPE-1655). The seat told a conversation it had
+    // started the work — the hand-off note the pending-delegation guard asked it for — and this turn
+    // was woken by that work settling, holding the task's own reply address. Silence here is the
+    // promise broken, and it is what ship #188 measured on five scenarios: "I've started …", then
+    // nothing.
+    // A VALVE, NOT A WALL, unlike the stand-down arm above: `refuseSettlementReport` stands the guard
+    // aside on the SECOND call, because a report can still be refused by a gate below the reply
+    // plane's own and a turn with no move left must be able to end. The audit row is ungated, so a
+    // seat that talks its way past this is as countable as one that never tried.
+    // Placed BELOW the stand-down arm — a stop asked for by a person outranks a report — and ABOVE
+    // `noteTerminalCallGrain`, because a refused call is not a terminal call.
+    const owedReport = refuseSettlementReport(turnIdForGuards);
+    if (owedReport !== undefined) {
+      await auditToolAction(ctx, SETTLEMENT_REPORT_SKIPPED_ACTION, {
+        task: owedReport,
+        reason: input.reason,
+        ...(input.explanation !== undefined ? { explanation: input.explanation } : {}),
+      });
+      throw new Error(settlementReportOwedMessage());
+    }
+    // 🔴 `addressed_to_other` IS NOT AVAILABLE IN A CONVERSATION THIS SEAT IS ENGAGED ON (OPE-1740).
+    // A follow-up in an enrolled conversation is addressed to the seat BY CONSTRUCTION — that is what
+    // the enrolment means and it is why the wake happened at all — so this reason contradicts the
+    // registry rather than reporting a judgement. Measured on deploy #200: the `J-ENGAGED-github`
+    // follow-up drew `no_reply reason:"addressed_to_other"` and the gate that asserts a reply red.
+    // channels/engaged-wake.ts carries the whole ruling, the narrow predicate and this copy.
+    //
+    // ONLY THIS ONE REASON. Every other closed reason is untouched, so a seat that is enrolled and
+    // genuinely has nothing to say still ends the turn in silence through `nothing_to_add` — the
+    // refusal removes a false claim, never the option of being quiet.
+    //
+    // A VALVE IS NEITHER NEEDED NOR WANTED, unlike the settlement arm above: the corrective names a
+    // reason the schema always accepts, so the model's next call cannot be blocked by this guard, and
+    // there is no move it can leave the turn without.
+    //
+    // Placed with the other refusal arms — ABOVE `noteTerminalCallGrain`, because a refused call is
+    // not a terminal call, and BELOW the stand-down and settlement arms, whose obligations outrank a
+    // wrong reason. FAIL-SOFT throughout: a binding or partition this turn cannot resolve, and an
+    // unreadable engagement store, all read as NOT enrolled and let the call through.
+    //
+    // 🔴 AND IT STANDS ASIDE ON A TURN THAT HAS ALREADY RECORDED SILENCE. The two arms above hold an
+    // UNMET obligation, so they fire whatever else the turn did; this one does not — a turn whose
+    // reply obligation was already closed by an earlier `no_reply` has nothing left to owe, and the
+    // OPE-1520 redundant arm below is what must handle the repeat (it latches the turn-ending stub).
+    // Throwing here instead would REOPEN a correctly closed turn and leave it stepping. The peek does
+    // not consume: `message.completed` still owns the read-reset.
+    if (input.reason === "addressed_to_other" && peekNoReplyThisTurn() === null) {
+      let enrolled = false;
+      let anchor: string | undefined;
+      try {
+        const binding = bindFrom(ctx as BindableContext);
+        // The ENGAGEMENT-REGISTRY key, resolved exactly as `stand_down` resolves it — the platform's
+        // own registry key first (Discord/Teams publish one and carry no `threadTs`), the thread
+        // anchor second (Slack, whose `threadTs` IS its registry key).
+        anchor = binding.engagementKey ?? binding.threadTs;
+        enrolled = await conversationEnrolledForSilence(resolvePartition(ctx as BindableContext), anchor);
+      } catch {
+        enrolled = false;
+      }
+      if (enrolled) {
+        // Ungated, like the other two refusal rows and for the same reason: this is a REFUSAL, not a
+        // silence the model chose, and it must be countable in the actions-only posture prod runs in.
+        await auditToolAction(ctx, NO_REPLY_ON_ENGAGED_ACTION, {
+          reason: input.reason,
+          ...(anchor ? { anchor } : {}),
+          ...(input.explanation !== undefined ? { explanation: input.explanation } : {}),
+        });
+        throw new Error(NO_REPLY_ADDRESSED_TO_OTHER_REFUSAL);
+      }
+    }
+    // Redundant-call guard: at most one silence row per turn, whatever repeats. The invariant is "one silence row per turn", which any repeated model call would break. Placed AFTER the confabulation fence so that always applies, and the peek does NOT consume — the completion handler still owns the read-reset.
+    // The calling grain is recorded BEFORE either branch returns: a worker's empty final step is a failure its caller is waiting on, so the empty-step guard must never suppress the recovery on a worker.
+    noteTerminalCallGrain(ctx as BindableContext);
+    const already = peekNoReplyThisTurn();
+    if (already !== null) {
+      // …AND THE SECOND CALL ENDS THE TURN (OPE-1520). Recording silence twice is a turn that has
+      // closed its reply obligation and is still stepping, which is the same failure the refused
+      // `reply` arm catches — and it is the ONLY arm that catches it on a per-surface seat, where
+      // there is no wake id for the declined-wake record to key on. The latch makes the next model
+      // round-trip resolve the turn-ending stub (model/turn-closeout.ts).
+      // Above the returns, so it is recorded whether or not the silence audit row is enabled.
+      await noteTurnCloseoutRefusal(ctx as BindableContext, NO_REPLY_REDUNDANT_CLOSEOUT_REASON);
+      // ACTIONS-ONLY (audit-wedge build plan §1c): the no_reply silence row is GATED behind
+      // audit.silences (default OFF ⇒ prod actions-only; the eval targets set it and score
+      // abstention from it). The turn-termination machinery (peek/return) is untouched.
+      if (auditSilencesEnabled()) {
+        await auditToolAction(ctx, "reply.no_reply_redundant", {
+          reason: input.reason,
+          already,
+          ...(input.explanation !== undefined ? { explanation: input.explanation } : {}),
+        });
+      }
+      return {
+        acknowledged: true,
+        reason: input.reason,
+        // Same terminal instruction as {@link NO_REPLY_NOTE}, and for the same reason: this branch
+        // also ends the turn, so the step after it must not come back empty (OPE-748).
+        note: `Silence already recorded this turn; no second no_reply logged. ${END_TURN_WITH_SENTINEL_INSTRUCTION}`,
+      };
+    }
+    markNoReplyThisTurn(input.reason as NoReplyReason);
+    // Stamp the turn's wake id where it is reachable, so a silence row can be PROVABLY joined back to the probe that woke the turn, rather than to any completion row that lands inside its poll window.
+    // Conditional-spread, so every non-unified surface stays byte-identical.
+    const wakeId = currentWakeId(ctx as BindableContext);
+    // Record the DECLINE so `reply` can refuse its own contradiction: eve's empty-response reissue lands an "Answer now" nudge on a turn that just chose silence, and this mark is what lets `reply` refuse that one call.
+    // It never throws; off the unified path `wakeId` is undefined and the guard simply stays off.
+    markWakeDeclinedThisTurn(currentTurnId(ctx as BindableContext), wakeId);
+    // Always on, and minimal. Without this row a genuinely dead no_reply route and a healthy one that judged silence correctly were byte-identical from outside, so the end-to-end scenario could assert only its negative control.
+    // Deliberately NOT the old audit plane reopened: it carries only the closed `reason` enum — never free text — plus the wakeId join key, and it fires only when the TOOL is actually called, which is a judgment rather than every silent ambient turn.
+    await auditToolAction(ctx, "reply.no_reply_observed", {
+      reason: input.reason,
+      ...(wakeId ? { wakeId } : {}),
+    });
+    // ACTIONS-ONLY (audit-wedge build plan §1c): this FULL-DETAIL row is GATED behind audit.silences
+    // (default OFF ⇒ prod actions-only). markNoReplyThisTurn above already ran — turn termination
+    // is untouched; only the audit write is gated. The eval targets set the flag and score
+    // abstention from this exact row (wakeId-joined).
+    if (auditSilencesEnabled()) {
+      await auditToolAction(ctx, "reply.no_reply", {
+        reason: input.reason,
+        ...(wakeId ? { wakeId } : {}),
+        ...(input.explanation !== undefined ? { explanation: input.explanation } : {}),
+      });
+    }
+    return {
+      acknowledged: true,
+      reason: input.reason,
+      note: NO_REPLY_NOTE,
+    };
+  },
+});

package/agent/tools/open_pull_request.ts

@@ -0,0 +1,348 @@
+import { defineTool } from "eve/tools";
+import { windowGated } from "../access/window-gated.js";
+import { z } from "zod";
+import { bindFrom } from "../identity/binding.js";
+import { resolvePartition } from "../memory/partition.js";
+import { proposalScopeKey } from "../channels/propose-scope.js";
+import { principalIdOf, resolveAccessFor, unattendedOf } from "../access/request.js";
+import { untrustedIngestedThisTurn } from "../access/taint-signal.js";
+import { getGitHubApp, repoAllowed } from "../scm/provider.js";
+import { githubWorkMount } from "../scm/github-work.js";
+import { resolvePrWriteToken } from "../scm/write-token.js";
+import { isSafeBranchName, isSafeCheckoutDir, parseStagedSha, redactSecret, stagePushCommand } from "../scm/git.js";
+import type { SandboxNetworkPolicy } from "eve/sandbox";
+import { compileNetworkPolicy } from "../access/egress.js";
+import { resolveHeaders } from "../access/credentials.js";
+import { isEnforced } from "../access/enforcement.js";
+import { narrowByConnectorOverride } from "../access/connector-scope.js";
+import { mintGitReadBroker, mergeGitReadBroker, withBareAllowHost } from "../scm/broker.js";
+import { auditBrokeredEgressPolicy, type BrokerApplyReason } from "../scm/broker-audit.js";
+import type { BindableContext } from "../identity/binding.js";
+import { useSelfHostEgress, pushEgressPolicy } from "../access/self-host-egress.js";
+import { requestApproval, autoApprovedNote } from "../approvals/flow.js";
+import { requireSessionContinuation } from "../spend/checkpoint.js";
+import { approvalPostDeps } from "./set_spend_limit.js";
+import { checkApprovalVenue, describeVenueRefusal, cardPostedPrefix, cardPostedTail } from "../approvals/card-venue.js";
+import { getConfig } from "../access/config.js";
+import { resolveNetworkAccessLevel } from "../access/network-access.js";
+import { executePrOpen, type PrOpenArgs } from "../approvals/pr-open.js";
+import { getOperationalStore } from "../operational/provider.js";
+import { haltScopeFor, resolveHalt } from "../access/halt.js";
+import { proposingSessionId } from "../identity/binding.js";
+import { markCardPostedThisTurn } from "../approvals/card-signal.js";
+import { bridgeSlackForm } from "../channels/slack-bridge.js";
+import { surfaceMessageOps } from "../channels/surface-message-ops.js";
+
+// The one consequential SCM write, gated on the OE approvals plane rather than eve-native HITL: a PR is audience-expanding, so it pauses for a human with STANDING on a durable card, which session-scoped eve HITL cannot check.
+// This is the PROPOSE half. It stage-pushes the head branch's exact sha to a hidden staging ref — no branch in the UI, no watcher notification, no branch CI — and freezes the proposal onto a card. Publication happens host-side on a member's click, pinned to the frozen sha, so the click can never publish commits the card did not show. A follow-up push to an existing PR branch flows through the same gate.
+
+/**
+ * MAY THE SESSION MEMO BE READ AT ALL? — the ONE decision that keeps this tool's pre-chain dispatch
+ * honest, named so it can be tested for what it is (its four inputs are hard to reach through a live
+ * `execute`, and this is the finding a reviewer is most likely to lose).
+ *
+ * All three conjuncts are refusals to take the shortcut, and each has its own reason:
+ *  • no session ⇒ there is no memo to read;
+ *  • TAINTED ⇒ a turn that read external content must earn a fresh human card, so a poisoned turn
+ *    cannot ride an earlier session grant;
+ *  • HALTED (OPE-1602) ⇒ this is the ONE path in `agent/tools/**` that dispatches a gated act before
+ *    `requestApproval`, so the approver chain's halt arrow cannot see it. Falling through to the
+ *    chain — rather than refusing here — is what keeps ONE refusal path and one audit shape.
+ *
+ * FALSE means "fall through to `requestApproval`", never "refuse": the chain decides.
+ */
+export function sessionMemoAdmissible(input: { readonly sessionId?: string; readonly tainted: boolean; readonly halted: boolean }): boolean {
+  return Boolean(input.sessionId) && !input.tainted && !input.halted;
+}
+
+/** Post a short, non-blocking note onto the proposing surface (the session-skip has no card). Slack
+ *  uses the bot chat.postMessage; Discord a channel create-message. Best-effort — never throws. */
+async function postSessionNote(platform: string, channelId: string, threadTs: string | null, text: string): Promise<void> {
+  const ops = surfaceMessageOps(platform);
+  if (ops) {
+    await ops.postText(channelId, text).catch(() => {});
+    return;
+  }
+  const body = new URLSearchParams();
+  body.set("channel", channelId);
+  if (threadTs) body.set("thread_ts", threadTs);
+  body.set("text", text);
+  await bridgeSlackForm("chat.postMessage", body.toString()).catch(() => {});
+}
+
+export default windowGated("open_pull_request", defineTool({
+  description:
+    "PROPOSE pushing your committed branch and opening a GitHub pull request for it (this is the ONLY way changes leave the workspace — plain `git push` is not authorized). Commit on the head branch in the checkout first. This does NOT open the PR: your commits are parked on a hidden staging ref and an approval card posts with the exact repo, branches, commit and description — the branch and PR publish only when a human approves. Write a clear body: what changed, why, how you verified it, and link the request that prompted it. If a PR is already open for that branch, approval updates it with your new commits instead. The posted card IS the reply — do not add narration after this call. EXCEPT when this surface can't host a card: it then goes to a card-capable channel in the same domain, the `message` field names it, and you MUST relay that.",
+  inputSchema: z.object({
+    repo: z.string().describe("Target repository as 'owner/repo'."),
+    head: z.string().describe("The branch containing the changes (must exist in the checkout)."),
+    base: z.string().default("main").describe("The branch to merge into."),
+    title: z.string().describe("PR title."),
+    body: z.string().describe("PR description (markdown)."),
+    dir: z.string().optional().describe("Workspace-relative checkout directory to push from (default: the repo name)."),
+  }),
+  outputSchema: z.object({
+    ok: z.boolean(),
+    repo: z.string(),
+    head: z.string(),
+    // Gated: nothing is published yet — an approval card was posted for a human to confirm.
+    pending: z.boolean(),
+    pendingId: z.string().optional(),
+    message: z.string(),
+    autoApproved: z.boolean().optional().describe("The approver chain lowered this verb: no card was posted and it has ALREADY run."),
+  }),
+  async execute(input, ctx) {
+    // SOFT session cost checkpoint (OPE-62): if this session has crossed a configured cost
+    // threshold and holds no continue grant, pause here (post a "keep going?" card once + throw a
+    // recoverable error) BEFORE any staging push touches the remote. No-op when unconfigured.
+    await requireSessionContinuation(ctx, "open_pull_request");
+    // Fail-closed repo gate — the SAME boundary checkout_repo enforces. Human approval is a second gate, not the only one.
+    // Without this, a PAT fallback could target ANY repo the token reaches, so "the bundle is the boundary" must hold on the consequential write too, not just on checkout.
+    const access = resolveAccessFor(ctx);
+    if (!repoAllowed(input.repo, access.repos)) {
+      throw new Error(
+        `repo "${input.repo}" is not granted to this channel. Allowed: ${access.repos.length ? access.repos.join(", ") : "(none)"}. ` +
+          `Grant it via a bundle's repos (see agent/access/bundles.ts).`,
+      );
+    }
+
+    // Both go into the push shell command — same hard validation as checkout_repo.
+    if (!isSafeBranchName(input.head)) {
+      throw new Error(`invalid head branch "${input.head}" — use a simple branch name (e.g. fix/issue-123).`);
+    }
+    const dir = input.dir ?? input.repo.split("/")[1];
+    if (!isSafeCheckoutDir(dir)) {
+      throw new Error(`invalid checkout dir "${dir}" — use a simple workspace-relative path.`);
+    }
+
+    // GATE plumbing, fail-closed BEFORE anything touches the remote — same posture as
+    // create_skill: no verified sender, or no venue to host the approval, and nothing may be
+    // staged for it either.
+    const binding = bindFrom(ctx);
+    const p = resolvePartition(ctx);
+    // 🔴 THE ROOM THAT ASKED, NOT THE ROOM THAT ARRIVED LAST (OPE-1756). `p` above is the TURN's
+    // partition, and a turn that merged queued deliveries carries only the LAST delivery's auth —
+    // so on a turn answering two rooms it names the wrong one. The GOVERNED scope follows the
+    // ADDRESSED wake instead, through the same road the reply path uses; it falls back to `p` on
+    // every unknown, so a single-wake turn is unchanged.
+    // 🔴 THE MERGE ROAD IS UNREACHABLE ON eve 0.54.3; THIS READ IS STILL LIVE (OPE-2042). eve batches
+    // adjacent queued deliveries only when their full auth contexts match, and OE stamps a fresh
+    // per-delivery `oe_delivery_id` into `auth.attributes`, so two auth-carrying deliveries on one
+    // unified window never compare equal; only the caller-less task COMPLETION COHORT still folds,
+    // and it carries no `auth` at all. But the TURN's ctx names the wrong room WITHOUT any merge
+    // too: a turn woken by an INTERNAL wake — an approval decision, a completion — answers a
+    // conversation whose envelope is in the seat's shared context, through the reply fence's
+    // same-conversation and pending arms (`channels/unified-window.ts` `resolveAnswerableReplyTarget`,
+    // arms 3 and 4). Measured in production on 2026-08-15 (`docs/glossary.md`). So this read is
+    // LOAD-BEARING, not defensive. `scripts/coalesced-delivery-merge-assumption-test.ts` pins only
+    // the merge road's impossibility.
+    // 🔴 WHAT MOVES IS THE GOVERNANCE KEY ONLY. Anything else this tool derives from `p` — the memory
+    // tier, the card's venue walk, and any surface key frozen into the proposal's own `args` — keeps
+    // reading the TURN's partition, deliberately: those name what the act DOES and where this seat
+    // lives, while the scope key names who may approve it and which halt covers it. Moving the act's
+    // own target is a design choice this task does not hold.
+    const proposeScopeKey = await proposalScopeKey(ctx, p);
+    // principal-gate: accountability — the card's PROPOSER line. A routine that opens a PR is a shipped
+    // capability, so refusing an unattended turn here would delete it; the unattended bound is grain
+    // (a wide-hands row) plus a review surface no other carded verb has.
+    //
+    // 🔴 THE INCONSISTENCY WITH create_skill/delete_skill IS DELIBERATE (OPE-278) — do not "fix" it. Those
+    // two became `presence` gates because an approved skill ARMS ON THE CLICK ALONE: one person reading a
+    // body on a card is the entire review, and what they arm is trusted text every later turn follows. A PR
+    // arms on nothing. It is a proposal into a pipeline with THREE further independent checks after the card
+    // — a merge decision by someone who is not the clicker, CI, and the config-diff gate on anything that
+    // changes what the agent may do (OPE-255) — so the fire's proposal cannot become an effect without
+    // people who never saw this session agreeing to it. The distinction is REVIEW SURFACE, not consequence
+    // size, and it is what makes an unattended PR the one carded write worth keeping.
+    const requestedBy = principalIdOf(ctx);
+    if (!requestedBy) {
+      throw new Error("open_pull_request needs a verified sender to gate the publish — no principal id resolved, so there's no proposer to show on the approval card.");
+    }
+
+    // Where the card goes: this room when it can host one, otherwise a card-capable channel in the SAME domain.
+    // Resolved BEFORE the staging push, the same fail-closed-first posture the old card-path check had: nothing is staged for a request that has nowhere to land its card.
+    const venueResult = await checkApprovalVenue(binding, p, () => getConfig().loadDomains());
+    if ("refusal" in venueResult) {
+      throw new Error(describeVenueRefusal(venueResult.refusal, binding.platform, "publish that PR"));
+    }
+    const venue = venueResult.venue;
+    // The ORIGIN room's channel id, best-effort and non-throwing, used only for the session-skip note below — a short "already approved" line posted back into the room that asked.
+    // It is independent of where the CARD lands. Absent on a channel-less origin, the note is skipped rather than thrown on.
+    const originChannelId = typeof binding.target?.channelId === "string" ? binding.target.channelId : undefined;
+
+    // OPE-1794: the staging push carries the repo's DECLARED capabilities, exactly as the publish
+    // half does. This mint used to send the bare default set, so a domain that named the `workflows`
+    // capability could not propose a branch touching `.github/workflows/**`: GitHub refused this
+    // push and no card ever posted. Read ONCE here and reused for the frozen card args below, so the
+    // two can no longer disagree about what this repo was opted into.
+    const repoCapabilities = access.repoCapabilities[input.repo] ?? [];
+    const token = await resolvePrWriteToken(input.repo, repoCapabilities);
+
+    // Stages the head branch's exact sha on the hidden staging ref in one shot: the write token rides inline in this single command and is never persisted to git config, so the checkout's stored credential stays read-only.
+    // Nothing is published — no branch, no PR, no CI, no watcher notification — and re-proposing simply re-stages within our own staging namespace, so a revised proposal is harmless.
+    let sandbox: Awaited<ReturnType<typeof ctx.getSandbox>>;
+    try {
+      sandbox = await ctx.getSandbox();
+    } catch (err) {
+      throw new Error(
+        `no workspace to push from (${err instanceof Error ? err.message : String(err)}). ` +
+          `checkout_repo the repo, commit on "${input.head}", then retry.`,
+      );
+    }
+    // checkout_repo installs the READ installation token as a firewall header TRANSFORM over all github.com traffic, which OVERRIDES this push's inline write token and makes the push arrive read-authenticated. So for this ONE command the stamp is lifted off github.com, and restored in a finally.
+    // The window is safe because the write token never becomes a firewall header — it stays in the git process's argv, so no standing write credential exists for concurrent sandbox code to reach. Lifting the read stamp only leaves ordinary unauthenticated github.com requests, which sandbox code can always make.
+    const brokerApp = getGitHubApp();
+    let brokered: SandboxNetworkPolicy | null = null;
+    if (isEnforced() && brokerApp) {
+      // OPE-311: same override-narrowing dep the egress hook passes, so a mid-session
+      // break-glass connector revoke reaches this recompile too. OPE-509: also thread the
+      // resolved network-access level, for the same reason checkout_repo.ts does.
+      const basePolicy = await compileNetworkPolicy(
+        access,
+        resolveHeaders,
+        (ids) => narrowByConnectorOverride(ctx, ids),
+        resolveNetworkAccessLevel(access, getConfig().loadNetworkAccess?.() ?? []),
+      );
+      const { rulesByOwner } = await mintGitReadBroker(brokerApp, access.repos);
+      brokered = mergeGitReadBroker(basePolicy, rulesByOwner);
+    }
+    // OPE-1448: every apply on this path gets its own `egress.policy` row, appended AFTER the apply
+    // returns (both arms throw on failure, so reaching the audit is what makes the row's
+    // `enforced: true` honest). Both states are real and BOTH are rowed: the swap that lifts the
+    // read stamp off github.com for the staging push, and the re-arm that restores the brokered
+    // policy. See scm/broker-audit.ts for why this path never deduplicates by fingerprint.
+    const applyPolicy = async (policy: SandboxNetworkPolicy, reason: BrokerApplyReason): Promise<void> => {
+      if (useSelfHostEgress()) await pushEgressPolicy(policy);
+      else await sandbox.setNetworkPolicy(policy);
+      await auditBrokeredEgressPolicy(ctx as BindableContext, access, policy, reason);
+    };
+
+    let push: Awaited<ReturnType<typeof sandbox.run>>;
+    try {
+      if (brokered) await applyPolicy(withBareAllowHost(brokered, "github.com"), "open_pull_request.push");
+      push = await sandbox.run({ command: stagePushCommand(dir, token, input.head) });
+    } finally {
+      if (brokered) {
+        try {
+          // Re-arm the read broker (re-applying the WHOLE brokered policy — the swap only
+          // changed github.com). Runs on every exit path, including a failed swap above.
+          await applyPolicy(brokered, "open_pull_request.restore");
+        } catch (restoreErr) {
+          // FAIL CLOSED: the read-broker stamp was lifted off github.com and could not be re-armed, so this must not be swallowed.
+          // No standing write credential ever existed as a firewall header, so nothing privileged leaks — but github.com is left on a bare allow until the next SCM call re-arms it, which is a degraded firewall state the operator must see rather than have pass silently.
+          throw new Error(
+            `open_pull_request: could not restore the git read-broker egress policy after the staging push — ` +
+              `github.com is left on a bare allow (no firewall-injected credential) until the next SCM call re-arms it. ` +
+              `This is a degraded firewall state that must be investigated: ${restoreErr instanceof Error ? restoreErr.message : String(restoreErr)}`,
+          );
+        }
+      }
+    }
+    const headSha = push.exitCode === 0 ? parseStagedSha(push.stdout ?? "") : null;
+    if (push.exitCode !== 0 || !headSha) {
+      throw new Error(
+        `staging push of "${input.head}" from ${dir}/ failed — is the repo checked out there (checkout_repo) with that branch committed? ` +
+          redactSecret(push.stderr || push.stdout || "unknown error", token).slice(0, 500),
+      );
+    }
+
+    // Freeze the proposal and post the card. The frozen headSha is the content pin —
+    // the click publishes exactly these commits or fails.
+    const tainted = untrustedIngestedThisTurn();
+    const sessionId = proposingSessionId(ctx);
+    const args: PrOpenArgs = {
+      org: p.org,
+      scopeKey: proposeScopeKey,
+      repo: input.repo,
+      head: input.head,
+      base: input.base,
+      title: input.title,
+      body: input.body,
+      headSha,
+      requestedBy,
+      tainted,
+      // OPE-1024: freeze the capability sets THIS scope's binding opted this repo into. Absent from
+      // the map ⇒ no expansion ⇒ the default write job set, which is every bare-string repo grant.
+      // The SAME read the staging mint above used.
+      ...(repoCapabilities.length ? { capabilities: repoCapabilities } : {}),
+      ...(sessionId ? { sessionId } : {}),
+    };
+
+    // Session skip: when this session already carries a live "Approve for session" grant for `pr.open`, publishing goes through the same execute path an approve click takes, attributed to the original granting member, with a short non-blocking channel note instead of a card.
+    // A TAINTED proposal is NEVER auto-skipped — reading external content this turn forces a fresh human card, as a defence against a poisoned turn riding an earlier session grant. Scoping by session rather than by repo is safe because the repo gate above already bound what this can target.
+    // 🔴 A HALT CLOSES THIS BYPASS (OPE-1602). This is the ONE path in `agent/tools/**` that
+    // dispatches a gated act BEFORE `requestApproval` and therefore around the approver chain — so
+    // the chain's halt arrow, which covers the other 22 gated verbs, cannot see it. Without this
+    // line a live session memo would publish a pull request during a halt. The fix is to fall
+    // THROUGH to the chain rather than to refuse here: the chain then denies it with the halt
+    // arrow's own reason and writes the same `approval.chain` row every other refused verb writes,
+    // so there is one refusal path and one audit shape, not a second one that has to agree.
+    // Fail-closed with the rest of the plane — an unreadable halt store falls through too.
+    const halt = await resolveHalt(haltScopeFor({ org: p.org, scopeKey: proposeScopeKey, principalId: requestedBy }));
+    const store = getOperationalStore();
+    const memo = sessionMemoAdmissible({ sessionId, tainted, halted: halt.halted })
+      ? await store.getSessionApproval(p.org, sessionId!, "pr.open", new Date().toISOString()).catch(() => null)
+      : null;
+    if (memo) {
+      const outcome = await executePrOpen(args, memo.grantedBy, {}, { sessionApproved: true });
+      // Best-effort, and ONLY into the origin room (this note is unrelated to the card venue — it
+      // is a short "already approved" confirmation for whoever is here): skipped, never thrown on,
+      // when the origin has no channel id at all.
+      if (originChannelId) {
+        await postSessionNote(binding.platform, originChannelId, binding.threadTs ?? null, `${outcome}\n-# session-approved by <@${memo.grantedBy}>`);
+      }
+      markCardPostedThisTurn(); // the note is the reply — suppress the model's redundant narration, like the card path
+      return {
+        ok: true,
+        repo: input.repo,
+        head: input.head,
+        pending: false,
+        message: `session-approved (by ${memo.grantedBy}) — published without a card: ${outcome}`,
+      };
+    }
+
+    const posted = await requestApproval(
+      {
+        org: p.org,
+        kind: "pr.open",
+        args,
+        scopeKey: proposeScopeKey,
+        domain: null,
+        requestedBy,
+        channelId: venue.channelId,
+        threadTs: venue.sameRoom ? binding.threadTs ?? null : null,
+        // Mint-frozen proposing-surface identity (task #105) — the TTL sweep's feedback target,
+        // and the VENUE's key because that is where the card actually is.
+        postedTo: venue.surfaceKey,
+        // OPE-296 P3: the chain's unattended signal — a fire (no ACTING sender) must deny fast on an
+        // undeclared gate rather than post a card into an empty room (ask-unattended; feeds OPE-297).
+        chain: { unattended: unattendedOf(ctx) },
+      },
+      approvalPostDeps(venue.platform, ctx),
+    );
+
+    const subject = `PR "${input.title}" (${input.repo}: ${input.head} → ${input.base}, commit ${headSha.slice(0, 12)})${tainted ? " ⚠ tainted" : ""}`;
+    // Chain-lowered (OPE-296) ⇒ no card, the PR is already open (its number/url is in the outcome).
+    if (posted.autoApproved) {
+      return {
+        ok: true,
+        repo: input.repo,
+        head: input.head,
+        pending: false,
+        autoApproved: true,
+        pendingId: posted.id,
+        message: autoApprovedNote(subject, posted.autoApproved),
+      };
+    }
+    return {
+      ok: true,
+      repo: input.repo,
+      head: input.head,
+      pending: true,
+      pendingId: posted.id,
+      message: `${cardPostedPrefix(venue)} — ${subject} awaiting a human to approve the publish (pending ${posted.id}).${cardPostedTail(venue, "approve the publish", posted)}`,
+    };
+  },
+// MOUNT ON THE GRANT (OPE-940), not on the grain alone: a seat whose scope grants no repo can open
+// no PR, so it does not see this tool. scm/github-work.ts carries the fail-open reasoning.
+}), githubWorkMount);