@open-everywhere/core 0.1.0

package/agent/tools/read_webhook_history.ts

@@ -0,0 +1,46 @@
+// read_webhook_history answers "my webhook is wired up, so why did nothing happen?" in the room where the question is asked. Neither the ingress listing nor the routine listing says whether the SENDER ever reached us, or joins a delivery to the routines it did and did not fire. It SHOWS MISSES, which is the entire point: refused at the door, accepted but matched nothing, and matched then refused with its own closed reason — the interesting rows are exactly the ones a hits-only history would discard.
+// 🔴 The gate is the hook's OWN `readableBy`, and it IS the fire gate: the same resolve-and-check pair the fire path calls, so the rule is "if a routine here could have been fired by this hook, this room may read its history", and a refusal renders the grant in words as a diagnosis rather than a wall. No hook id, no URL and no secret ref ever join the output — the result is projected field by field, so a new audit-detail key cannot silently widen the disclosure — and no payload body is stored on the path this reads, so there is no branch that could reach one.
+
+// The read is audited on both verdicts, and the acting principal is passed from here because the tool is what holds the ctx.
+
+import { defineTool } from "eve/tools";
+import { z } from "zod";
+import { ingestUntrustedModelOutput } from "../access/untrusted.js";
+import { principalIdOf } from "../access/request.js";
+import { resolvePartition } from "../memory/partition.js";
+import { readDeliveryHistory, renderDeliveryHistory } from "../control/delivery-history.js";
+
+export default defineTool({
+  description:
+    "Diagnose an inbound webhook: whether the sender is actually reaching us, and what each delivery did or didn't trigger. Use when someone says a webhook 'isn't working', when a routine that should be firing on events is quiet, or before rewriting a filter. Shows deliveries that were rejected at the door, deliveries that arrived but matched no routine, and routines that matched but were refused (with the reason). Name the hook by its source handle from list_webhooks.",
+  inputSchema: z.object({
+    source: z.string().min(1).describe("The webhook's source handle, e.g. 'deploy-status' (from list_webhooks)."),
+  }),
+  outputSchema: z.object({
+    ok: z.boolean(),
+    /** Host-composed rendering — the whole answer. Empty when `ok` is false. */
+    history: z.string(),
+    /** The refusal sentence when `ok` is false (unknown hook, or not readable from here). */
+    message: z.string(),
+  }),
+  async execute(input, ctx) {
+    const partition = resolvePartition(ctx);
+    const principalId = principalIdOf(ctx);
+    const result = await readDeliveryHistory({ partition, source: input.source, ...(principalId !== undefined ? { principalId } : {}) });
+    if (!result.ok) return { ok: false, history: "", message: result.message };
+    return { ok: true, history: renderDeliveryHistory(result.history), message: "" };
+  },
+  toModelOutput(output) {
+    // A REFUSAL IS HOST-COMPOSED AND STAYS OUTSIDE THE FENCE. It contains no off-host string (the
+    // hook handle it echoes came from our own config or store, and the grant rendering is
+    // describeReadableBy's), and wrapping OE's own diagnosis as untrusted data would teach the model
+    // to discount the one sentence it must act on.
+    if (!output.ok) return { type: "text" as const, value: output.message };
+    // Declare the source: stored deliveries are still `webhook` bytes, the same kind the live dispatch path declares, and that row is untrusted — so this read taints exactly as it always did.
+    // What the declaration buys is that the site is GOVERNED by the table rather than by this line: if the row is ever revised, this seam moves with it.
+    return ingestUntrustedModelOutput(output.history, {
+      source: "webhook delivery history",
+      ingestion: { kind: "webhook", label: "read_webhook_history" },
+    });
+  },
+});

package/agent/tools/read_work_channel.ts

@@ -0,0 +1,109 @@
+// read_work_channel is the DELEGATED WORKER's channel read on a chat work surface. The chat surface's vocabulary is the SEAT's, and a worker reads its WORK surface under the domain's work grant — without this, a worker delegated from a chat surface held no way to read the conversation it was delegated about, and reported on a brief instead of on what was said.
+// 🔴 It is not `read_channel` under a new name, and the three differences are the point: the GRANT is the mount, so an ungranted domain never sees the verb; it is OFF the seat's roster, so the chat plane stays the seat's and the work plane the worker's; and it carries NO read budget, because digestion is exactly what the seat delegates and a budget here would re-impose the limit delegation exists to escape. It takes NO TARGET — a worker inherits its delegating seat's binding, so the container it reads IS the room it was delegated from. The work role today names the same vendor credential the chat route uses; what is really enforced is the mount grant plus the per-surface domain allowlist inside the adapter.
+
+import { defineDynamic, defineTool } from "eve/tools";
+import { z } from "zod";
+import { ingestUntrustedModelOutput } from "../access/untrusted.js";
+import { type BindableContext, TurnOriginFenceError } from "../identity/binding.js";
+import { getConfig } from "../access/config.js";
+import { readChannelResult, chatReadIngestion, renderChannelBody, channelReadSource, keyedReadResult, WindowSourcesRefusalError } from "../channels/channel-read.js";
+import { resolveWakeChannel } from "../channels/wake-container.js";
+import { auditSourcesGateRefusal, auditOriginFenceRefusal } from "../channels/read-scope-audit.js";
+import { preRegisterDynamicEntry } from "../access/window-gated.js";
+import { capReadForInline } from "../channels/read-spool.js";
+import { assertSurfaceWorkGrant, surfaceWorkReadMount } from "../access/surface-work-grant.js";
+import type { Domain } from "../memory/domain.js";
+
+// 🔴 The same ceiling `read_channel` uses, and raising it would be a LIE: "unbounded" here means no per-turn READ BUDGET, never a bigger page.
+// The adapters do not all paginate, and `possiblyIncomplete` is set only when the fetch returns EXACTLY the size it asked for — so a ceiling above the real page would come back short, miss the flag, and tell the worker the read was complete when it was not, which is the fabrication class this read tier exists to close. Raise it only in the diff that gives every adapter real pagination.
+const MAX_LIMIT = 100;
+
+/** Domains, fail-soft — see read_channel.ts. An empty list makes every gate below fail closed. */
+function safeDomains(): readonly Domain[] {
+  try {
+    return getConfig().loadDomains();
+  } catch {
+    return [];
+  }
+}
+
+// FACTORED + PRE-REGISTERED (the REPLAY DOCTRINE — see read_channel.ts): a top-level defineTool const
+// registered at module load, never an inline literal.
+const readWorkChannelEntry = defineTool({
+  description:
+    "Read recent messages from the channel this task was delegated from — the work-surface read. It " +
+    "takes no target: it always reads the container you were delegated in. Use it before you report " +
+    "on a conversation, so your answer is grounded in what was actually said rather than what your " +
+    "brief summarised.",
+  inputSchema: z.object({
+    limit: z
+      .number()
+      .int()
+      .min(1)
+      .max(MAX_LIMIT)
+      .optional()
+      .describe(`How many recent messages to fetch (default 50, max ${MAX_LIMIT}).`),
+  }),
+  outputSchema: z.object({
+    platform: z.string(),
+    channel: z.string(),
+    count: z.number(),
+    messages: z.array(z.object({ author: z.string(), ts: z.string(), text: z.string() })),
+    /** The grading fact, not content: a positively-refuted non-member authored one of these messages. Positive-only. */
+    authoredByNonMember: z.boolean().optional(),
+    /** The fetch landed exactly on its page size, so older history may exist beyond this page. Positive-only. */
+    possiblyIncomplete: z.boolean().optional(),
+    /** The adapter's own reason for a declared-partial page; read only alongside `possiblyIncomplete`. */
+    partialReason: z.string().optional(),
+    /** The page busted the inline cap and spooled to a file in this session's sandbox. */
+    spool: z.object({ path: z.string().optional(), shown: z.number(), total: z.number() }).optional(),
+  }),
+  // NO `approval:` — read-only, and a dynamic tool on a resumed session cannot carry one (the pin
+  // read_channel.ts documents). Absent approval === never() is correct.
+  async execute(input, ctx) {
+    const bctx = ctx as unknown as BindableContext;
+    const domains = safeDomains();
+    // The chat-plane gate chain FIRST, unchanged: the turn's origin platform ∈ this window's sources
+    // → the per-turn origin fence → the surface has a wired read adapter → the container comes from
+    // THIS turn's binding. OPE-732: either refusal is audited here before it propagates.
+    let resolved: ReturnType<typeof resolveWakeChannel>;
+    try {
+      resolved = resolveWakeChannel(bctx, domains);
+    } catch (err) {
+      if (err instanceof WindowSourcesRefusalError) await auditSourcesGateRefusal(bctx, err.platform);
+      else if (err instanceof TurnOriginFenceError) await auditOriginFenceRefusal(bctx, err.surface);
+      throw err;
+    }
+    const { platform, adapter, container } = resolved;
+    // THEN the work grant, for the platform this turn actually arrived on. The mount asked "any
+    // granted source"; a unified window can carry an ungranted one too.
+    assertSurfaceWorkGrant(bctx, domains, platform);
+    // The adapter runs the domain channel allowlist (fail-closed) before fetching; the shared body
+    // then grades the page's distinct authors (channels/read-author-trust.ts).
+    const out = await readChannelResult(bctx, platform, adapter, container, input.limit);
+    const keyed = keyedReadResult(out);
+    return await capReadForInline(bctx, out, "channel", keyed.channel, () => renderChannelBody(keyed));
+  },
+  toModelOutput(output) {
+    // The SAME ingestion declaration `read_channel` makes, and it has to be: the bytes are the same
+    // bytes off the same adapter, so a second `kind` would let one route taint where the other does
+    // not. This file declares WHAT it read; access/taint-tiers.ts's ratified table decides the tier.
+    const keyed = keyedReadResult(output);
+    return ingestUntrustedModelOutput(renderChannelBody(keyed), {
+      source: channelReadSource(keyed),
+      ingestion: chatReadIngestion(`read_work_channel:${output.platform}`, output),
+    });
+  },
+});
+preRegisterDynamicEntry("read_work_channel", "_single", readWorkChannelEntry);
+
+export default defineDynamic({
+  events: {
+    // session.started ONLY — a session's sources cannot change mid-session, so resolving once is
+    // correct and cheaper (the note read_notion_page.ts carries).
+    "session.started": (_event, ctx) => {
+      if (!surfaceWorkReadMount(ctx as BindableContext, safeDomains)) return null;
+      return readWorkChannelEntry;
+    },
+  },
+});

package/agent/tools/read_work_thread.ts

@@ -0,0 +1,90 @@
+// read_work_thread is the thread half of the delegated worker's chat-work-surface read. It carries the same three properties its channel sibling states in full: the GRANT is the mount, the verb is OFF the seat, and it runs no read budget because it is the tier the seat's recovery-read budget delegates TO. It maps per surface exactly as `read_thread` does, because it runs on the same registered read adapter.
+// 🔴 It takes NO TARGET: container and thread root both come from THIS turn's binding, and a worker inherits its delegating seat's binding, so the thread it reads is the thread it was delegated from. A turn that arrived at the TOP LEVEL of its channel has no thread root and is refused by saying so and pointing at `read_work_channel`.
+
+import { defineDynamic, defineTool } from "eve/tools";
+import { z } from "zod";
+import { ingestUntrustedModelOutput } from "../access/untrusted.js";
+import { type BindableContext, TurnOriginFenceError } from "../identity/binding.js";
+import { getConfig } from "../access/config.js";
+import { readThreadResult, chatReadIngestion, renderThreadBody, threadReadSource, keyedReadResult, WindowSourcesRefusalError } from "../channels/channel-read.js";
+import { resolveWakeChannel, requireWakeThreadRoot } from "../channels/wake-container.js";
+import { auditSourcesGateRefusal, auditOriginFenceRefusal } from "../channels/read-scope-audit.js";
+import { preRegisterDynamicEntry } from "../access/window-gated.js";
+import { capReadForInline } from "../channels/read-spool.js";
+import { assertSurfaceWorkGrant, surfaceWorkReadMount } from "../access/surface-work-grant.js";
+import type { Domain } from "../memory/domain.js";
+
+/** The same ceiling `read_thread` uses — see read_work_channel.ts for why raising it would lie. */
+const MAX_LIMIT = 200;
+
+/** Domains, fail-soft (see read_work_channel.ts). */
+function safeDomains(): readonly Domain[] {
+  try {
+    return getConfig().loadDomains();
+  } catch {
+    return [];
+  }
+}
+
+const readWorkThreadEntry = defineTool({
+  description:
+    "Read every reply in the thread this task was delegated from — the work-surface read. It takes " +
+    "no target: it always reads the thread you were delegated in. If the task was delegated from the " +
+    "top level of a channel, use `read_work_channel` instead.",
+  inputSchema: z.object({
+    limit: z.number().int().min(1).max(MAX_LIMIT).optional().describe(`Max replies to fetch (default 100, max ${MAX_LIMIT}).`),
+  }),
+  outputSchema: z.object({
+    platform: z.string(),
+    channel: z.string(),
+    thread_ts: z.string(),
+    count: z.number(),
+    messages: z.array(z.object({ author: z.string(), ts: z.string(), text: z.string() })),
+    /** The grading fact, not content: a positively-refuted non-member authored one of these messages. Positive-only. */
+    authoredByNonMember: z.boolean().optional(),
+    /** The fetch landed exactly on its page size, so older history may exist beyond this page. Positive-only. */
+    possiblyIncomplete: z.boolean().optional(),
+    /** The adapter's own reason for a declared-partial page; read only alongside `possiblyIncomplete`. */
+    partialReason: z.string().optional(),
+    /** The page busted the inline cap and spooled to a file in this session's sandbox. */
+    spool: z.object({ path: z.string().optional(), shown: z.number(), total: z.number() }).optional(),
+  }),
+  // NO `approval:` — same pin as read_work_channel.ts.
+  async execute(input, ctx) {
+    const bctx = ctx as unknown as BindableContext;
+    const domains = safeDomains();
+    let resolved: ReturnType<typeof resolveWakeChannel>;
+    try {
+      resolved = resolveWakeChannel(bctx, domains);
+    } catch (err) {
+      if (err instanceof WindowSourcesRefusalError) await auditSourcesGateRefusal(bctx, err.platform);
+      else if (err instanceof TurnOriginFenceError) await auditOriginFenceRefusal(bctx, err.surface);
+      throw err;
+    }
+    const { platform, adapter, container } = resolved;
+    assertSurfaceWorkGrant(bctx, domains, platform);
+    const threadRoot = requireWakeThreadRoot(resolved);
+    const out = await readThreadResult(bctx, platform, adapter, container, threadRoot, input.limit);
+    const keyed = keyedReadResult(out);
+    return await capReadForInline(bctx, out, "thread", keyed.channel, () => renderThreadBody(keyed));
+  },
+  toModelOutput(output) {
+    // The same ingestion declaration `read_thread` makes — see read_work_channel.ts's note on why the
+    // two routes must not declare different kinds.
+    const keyed = keyedReadResult(output);
+    return ingestUntrustedModelOutput(renderThreadBody(keyed), {
+      source: threadReadSource(keyed),
+      ingestion: chatReadIngestion(`read_work_thread:${output.platform}`, output),
+    });
+  },
+});
+preRegisterDynamicEntry("read_work_thread", "_single", readWorkThreadEntry);
+
+export default defineDynamic({
+  events: {
+    "session.started": (_event, ctx) => {
+      if (!surfaceWorkReadMount(ctx as BindableContext, safeDomains)) return null;
+      return readWorkThreadEntry;
+    },
+  },
+});

package/agent/tools/record_follow_up.ts

@@ -0,0 +1,84 @@
+// The host-side half of the FOLLOW-UPS LEDGER (OPE-151 §3). A fired turn calls this to leave a named note for the NEXT run of the SAME routine, or to resolve one it has finished — the only continuity an ordinary stateless routine has, since its next fire starts on a fresh session and `jobState` is job-only.
+// Not consequential: it writes bookkeeping onto the calling routine's OWN row, located by the dispatcher-stamped auth marker rather than a caller-supplied id, so one routine cannot touch another's ledger. The same posture — and the same mechanism — as record_watch_state.
+
+import { defineTool } from "eve/tools";
+import { never } from "eve/tools/approval";
+import { z } from "zod";
+import { untrustedIngestedThisTurn } from "../access/taint-signal.js";
+import { routineMarker } from "../routines/routine.js";
+import {
+  applyFollowUp,
+  followUpNameValid,
+  resolveFollowUp,
+  FOLLOW_UP_NOTE_MAX_CHARS,
+  MAX_ROUTINE_FOLLOW_UPS,
+} from "../routines/follow-ups.js";
+import { getRoutine, updateRoutine } from "../routines/store.js";
+
+export default defineTool({
+  description:
+    "Leave a named follow-up for the NEXT run of this same routine, or resolve one you have finished. " +
+    "This routine's next fire starts on a fresh session with none of this conversation, so a follow-up here " +
+    "is the only thing that reaches it. Use it for work you could not finish, a thing worth re-checking, or " +
+    "a conclusion the next run should not have to re-derive. Call it again with the same name to update that " +
+    `note, or with resolved: true to remove it. At most ${MAX_ROUTINE_FOLLOW_UPS} follow-ups are kept; past ` +
+    "that the oldest is dropped. Only valid inside a routine's own run.",
+  inputSchema: z.object({
+    name: z
+      .string()
+      .min(1)
+      .max(64)
+      .describe("Short stable name for this follow-up — the address a later run reads it back by, and resolves it by."),
+    note: z
+      .string()
+      .max(FOLLOW_UP_NOTE_MAX_CHARS)
+      .optional()
+      .describe("What the next run needs to know. One or two sentences — a pointer, not a report. Required unless resolved is true."),
+    resolved: z.boolean().optional().describe("true = this follow-up is finished: remove it so it stops arriving on later runs."),
+  }),
+  outputSchema: z.object({
+    followUps: z.array(z.string()).describe("The names this routine now carries, in the order later runs will read them."),
+    evicted: z.string().optional().describe(`Set when this write dropped the oldest follow-up to stay under ${MAX_ROUTINE_FOLLOW_UPS}.`),
+  }),
+  approval: never(),
+  async execute(input, ctx) {
+    // The dispatcher stamps the routine link onto the fired session's auth (ROUTINE_MARKER) — the
+    // same attributes the outcome hook and record_watch_state read. That marker, not model input, is
+    // what locates the routine, which is the whole reason a fire cannot reach another routine's
+    // ledger: there is no id parameter to point somewhere else.
+    const auth = ctx.session?.auth;
+    const marker = routineMarker(auth?.current?.attributes ?? auth?.initiator?.attributes);
+    if (!marker) {
+      throw new Error("record_follow_up only works inside a routine's own run — this session has no routine attached.");
+    }
+    if (!followUpNameValid(input.name)) {
+      throw new Error(
+        `"${input.name}" is not a usable follow-up name: use letters, digits, spaces, ".", "-" or "_", up to 64 characters. ` +
+          "The name is an address a later run has to spell back, so it cannot carry newlines or punctuation that will not survive a round trip.",
+      );
+    }
+    const routine = await getRoutine(marker.org, marker.surfaceKey, marker.id);
+    if (!routine) throw new Error(`Routine ${marker.id} no longer exists (cancelled while this run was working).`);
+
+    if (input.resolved === true) {
+      const done = resolveFollowUp(routine, input.name);
+      await updateRoutine(marker.org, marker.surfaceKey, marker.id, done.patch);
+      return { followUps: done.followUps.map((f) => f.name) };
+    }
+    if (input.note === undefined || input.note.trim().length === 0) {
+      throw new Error("A follow-up needs a note saying what the next run should know — or resolved: true to remove one.");
+    }
+    // THE TAINT IS READ HERE AND RIDES THE ENTRY (OPE-151, routines/follow-ups.ts). If this turn had
+    // ingested untrusted content, the note may CONTAIN it, so the entry is marked and the next fire
+    // renders that entry inside a fence rather than as the routine's own words. Per-entry, never a
+    // row flag: a single tainted fire must not permanently downgrade every clean note beside it.
+    const write = applyFollowUp(routine, {
+      name: input.name,
+      note: input.note,
+      at: new Date().toISOString(),
+      ...(untrustedIngestedThisTurn() ? { tainted: true } : {}),
+    });
+    await updateRoutine(marker.org, marker.surfaceKey, marker.id, write.patch);
+    return { followUps: write.followUps.map((f) => f.name), ...(write.evicted ? { evicted: write.evicted } : {}) };
+  },
+});

package/agent/tools/record_job_state.ts

@@ -0,0 +1,49 @@
+// The host-side half of the DURABLE JOB working-state ledger, the job analogue of the watch hash: it generalises "did it change?" into "where was I?". A job keeps its own persistent session across fires, but a durable session can still be replaced — so this persists a compact progress note onto the routine's OWN row, and the dispatcher renders it into every fire's preamble, letting a fire that lost its session restart WITH the note rather than cold.
+// Located by the dispatcher-stamped marker rather than a caller-supplied id, so a job writes only its OWN ledger. Oversize is REJECTED, never silently truncated: a truncated ledger is a corrupted one. Bookkeeping on the calling job's own row, so no approval.
+
+import { defineTool } from "eve/tools";
+import { never } from "eve/tools/approval";
+import { z } from "zod";
+import { routineMarker, JOB_STATE_MAX_BYTES } from "../routines/routine.js";
+import { applyJobStateObservation } from "../routines/job.js";
+import { getRoutine, updateRoutine } from "../routines/store.js";
+import { untrustedIngestedThisTurn } from "../access/taint-signal.js";
+
+export default defineTool({
+  description:
+    "Record your progress on this DURABLE JOB — a short, canonical note (goal, what's done, what's " +
+    `next) that survives even if this session is later replaced, so it's your reliable hand-off to ` +
+    `the next fire. Call it near the end of each fire. Max ${JOB_STATE_MAX_BYTES} bytes. Only valid ` +
+    "inside a job routine's own run.",
+  inputSchema: z.object({
+    state: z.string().min(1).describe("Canonical progress note: the goal, what's done so far, and what's left."),
+  }),
+  outputSchema: z.object({
+    recorded: z.boolean(),
+    bytes: z.number().describe("UTF-8 byte size of the note that was stored (or would have been, if rejected)."),
+  }),
+  approval: never(),
+  async execute(input, ctx) {
+    const auth = ctx.session?.auth;
+    const marker = routineMarker(auth?.current?.attributes ?? auth?.initiator?.attributes);
+    if (!marker) {
+      throw new Error("record_job_state only works inside a job routine's own run — this session has no routine attached.");
+    }
+    const routine = await getRoutine(marker.org, marker.surfaceKey, marker.id);
+    if (!routine) throw new Error(`Routine ${marker.id} no longer exists (cancelled while this job ran).`);
+    if (routine.sessionMode !== "job") {
+      throw new Error(`Routine ${marker.id} is not a durable job — there is no job ledger to write. (A watch uses record_watch_state.)`);
+    }
+
+    // OPE-111: carry THIS turn's taint onto the ledger. The note is model-authored text that the
+    // dispatcher re-injects into every later fire — including into a REPLACEMENT session that never
+    // saw the untrusted read — so a taint that stops at the session boundary is a laundering path.
+    // The flag is monotonic on the row (routines/routine.ts jobTainted): raised here, never lowered.
+    const obs = applyJobStateObservation(input.state, untrustedIngestedThisTurn());
+    if (!obs.accepted) {
+      throw new Error(`That note is ${obs.bytes} bytes — the job ledger cap is ${JOB_STATE_MAX_BYTES}. Trim it to a compact progress summary (it's a ledger, not a document store).`);
+    }
+    await updateRoutine(marker.org, marker.surfaceKey, marker.id, obs.patch);
+    return { recorded: true, bytes: obs.bytes };
+  },
+});

package/agent/tools/record_watch_state.ts

@@ -0,0 +1,47 @@
+// The host-side half of the WATCH protocol. A fired watch turn calls this with a canonical representation of what it observed, and the hashing and the comparison against the routine's stored hash happen HERE — so the diff verdict is authoritative and the model never diffs from memory. Unchanged records the run as skipped, and the turn is told to end with the silence sentinel so nothing posts.
+// Not consequential: it writes bookkeeping onto the calling routine's OWN row, located by the dispatcher-stamped auth marker rather than a caller-supplied id, so one routine cannot touch another's state.
+
+import { defineTool } from "eve/tools";
+import { never } from "eve/tools/approval";
+import { z } from "zod";
+import { routineMarker } from "../routines/routine.js";
+import { applyWatchObservation, WATCH_SILENCE_SENTINEL } from "../routines/watch.js";
+import { getRoutine, updateRoutine } from "../routines/store.js";
+
+export default defineTool({
+  description:
+    "Record the state a WATCH routine just observed, and learn whether it changed since the last check. " +
+    "Call this exactly once per watch check, with a canonical text representation of the watched state " +
+    "(stable ordering; leave out values that differ on every look, like timestamps). If it returns " +
+    `changed: false, end your turn with exactly ${WATCH_SILENCE_SENTINEL} and nothing else. ` +
+    "Only valid inside a watch routine's own run.",
+  inputSchema: z.object({
+    state: z.string().min(1).describe("Canonical text representation of the watched state as observed right now."),
+  }),
+  outputSchema: z.object({
+    changed: z
+      .boolean()
+      .describe(`false = unchanged since the last check: end the turn with exactly ${WATCH_SILENCE_SENTINEL}, posting nothing.`),
+    firstObservation: z.boolean().describe("true = no baseline existed yet — report what you observed as the baseline."),
+  }),
+  approval: never(),
+  async execute(input, ctx) {
+    // The dispatcher stamps the routine link onto the fired session's auth
+    // (ROUTINE_MARKER) — the same attributes the outcome hook reads. That marker,
+    // not model input, is what locates the routine.
+    const auth = ctx.session?.auth;
+    const marker = routineMarker(auth?.current?.attributes ?? auth?.initiator?.attributes);
+    if (!marker) {
+      throw new Error("record_watch_state only works inside a watch routine's own run — this session has no routine attached.");
+    }
+    const routine = await getRoutine(marker.org, marker.surfaceKey, marker.id);
+    if (!routine) throw new Error(`Routine ${marker.id} no longer exists (cancelled while this check ran).`);
+    if (routine.trigger.kind !== "watch") {
+      throw new Error(`Routine ${marker.id} is a ${routine.trigger.kind} routine, not a watch — there is no state to diff.`);
+    }
+
+    const obs = applyWatchObservation(routine, input.state);
+    await updateRoutine(marker.org, marker.surfaceKey, marker.id, obs.patch);
+    return { changed: obs.changed, firstObservation: obs.firstObservation };
+  },
+});

package/agent/tools/remove_routine_rule.ts

@@ -0,0 +1,158 @@
+// remove_routine_rule PROPOSES dropping one standing rule from a routine. Gated for the OPPOSITE reason its sibling is: removing a rule SILENTLY TAKES A GUARDRAIL AWAY, which is also why nothing auto-evicts at the cap. The card names the rule, who armed it, when and why, so the person removing it decides against a stated reason rather than against an id.
+// There is deliberately NO edit verb — changing a rule is remove plus add, two cards — because an edit card would have to render a diff of two model-supplied strings, and mutating the provenance under a rewrite would attribute a rule to someone who approved different words. It carries the same first three gates as the add, and not for symmetry: a turn that could REMOVE rules would strip the rule written specifically to stop whatever it is trying next, which is a strictly easier attack than authoring one.
+
+import { defineTool } from "eve/tools";
+import { never } from "eve/tools/approval";
+import { z } from "zod";
+import { bindFrom } from "../identity/binding.js";
+import { principalIdOf, unattendedOf } from "../access/request.js";
+import { resolvePartition } from "../memory/partition.js";
+import { proposalScopeKey } from "../channels/propose-scope.js";
+import { getRoutine } from "../routines/store.js";
+import { describeTrigger, routineMarker } from "../routines/routine.js";
+import { policyAuthorRefusal, policyRules } from "../routines/policy.js";
+import { requestApproval, autoApprovedNote } from "../approvals/flow.js";
+import { approvalPostDeps } from "./set_spend_limit.js";
+import { checkApprovalVenue, describeVenueRefusal, cardPostedPrefix, cardPostedTail } from "../approvals/card-venue.js";
+import { getConfig } from "../access/config.js";
+import { requireSessionContinuation } from "../spend/checkpoint.js";
+
+export default defineTool({
+  description:
+    "PROPOSE removing ONE standing rule from a routine — the rule stops being applied to every future run. Use when a rule is stale, wrong, or is being replaced (to change a rule, remove it and add the new one: two confirmations, so each wording is read on its own). Get the routine id and its rule ids from list_routines. This does NOT remove it on the spot: a card posts naming the rule, who armed it and why they did, and it goes only when a human confirms. The posted card IS the reply — do not add narration after this call. EXCEPT when this surface can't host a card: it then goes to a card-capable channel in the same domain, the `message` field names it, and you MUST relay that.",
+  inputSchema: z.object({
+    routineId: z.string().min(1).describe("The routine id, e.g. 'r-1a2b3c4d' (from list_routines)."),
+    ruleId: z.string().min(1).describe("The rule id, e.g. 'p-1a2b3c4d' (from list_routines's `rules`, or the rule block in a run's message)."),
+  }),
+  outputSchema: z.object({
+    pending: z.boolean(),
+    pendingId: z.string().optional(),
+    routineId: z.string(),
+    ruleId: z.string(),
+    message: z.string(),
+    autoApproved: z.boolean().optional().describe("The approver chain lowered this verb: no card was posted and it has ALREADY run."),
+  }),
+  approval: never(),
+  async execute(input, ctx) {
+    await requireSessionContinuation(ctx, "remove_routine_rule");
+
+    // Gate 1, from the ONE shared definition the add verb feeds, so the two verbs cannot drift apart. This one matters MORE: stripping a rule is an easier attack than authoring one.
+    // The TAINT gate that used to sit here is gone: this row declares `taint: "gate"`, so the approver chain floors a tainted turn at a human decision and denies it unattended. One control, one enforcement point.
+    const auth = ctx.session?.auth;
+    const refusal = policyAuthorRefusal(
+      { inRoutineFire: routineMarker(auth?.current?.attributes ?? auth?.initiator?.attributes) !== null },
+      "remove",
+    );
+    if (refusal) throw new Error(refusal);
+
+    const p = resolvePartition(ctx);
+    // 🔴 THE ROOM THAT ASKED, NOT THE ROOM THAT ARRIVED LAST (OPE-1756). `p` above is the TURN's
+    // partition, and a turn that merged queued deliveries carries only the LAST delivery's auth —
+    // so on a turn answering two rooms it names the wrong one. The GOVERNED scope follows the
+    // ADDRESSED wake instead, through the same road the reply path uses; it falls back to `p` on
+    // every unknown, so a single-wake turn is unchanged.
+    // 🔴 THE MERGE ROAD IS UNREACHABLE ON eve 0.54.3; THIS READ IS STILL LIVE (OPE-2042). eve batches
+    // adjacent queued deliveries only when their full auth contexts match, and OE stamps a fresh
+    // per-delivery `oe_delivery_id` into `auth.attributes`, so two auth-carrying deliveries on one
+    // unified window never compare equal; only the caller-less task COMPLETION COHORT still folds,
+    // and it carries no `auth` at all. But the TURN's ctx names the wrong room WITHOUT any merge
+    // too: a turn woken by an INTERNAL wake — an approval decision, a completion — answers a
+    // conversation whose envelope is in the seat's shared context, through the reply fence's
+    // same-conversation and pending arms (`channels/unified-window.ts` `resolveAnswerableReplyTarget`,
+    // arms 3 and 4). Measured in production on 2026-08-15 (`docs/glossary.md`). So this read is
+    // LOAD-BEARING, not defensive. `scripts/coalesced-delivery-merge-assumption-test.ts` pins only
+    // the merge road's impossibility.
+    // 🔴 WHAT MOVES IS THE GOVERNANCE KEY ONLY. Anything else this tool derives from `p` — the memory
+    // tier, the card's venue walk, and any surface key frozen into the proposal's own `args` — keeps
+    // reading the TURN's partition, deliberately: those name what the act DOES and where this seat
+    // lives, while the scope key names who may approve it and which halt covers it. Moving the act's
+    // own target is a design choice this task does not hold.
+    const proposeScopeKey = await proposalScopeKey(ctx, p);
+    const routineId = input.routineId.trim();
+    const ruleId = input.ruleId.trim();
+
+    const routine = await getRoutine(p.org, p.surfaceKey, routineId);
+    if (!routine) {
+      throw new Error(`No routine '${routineId}' on this surface — check the id with list_routines.`);
+    }
+    const rules = policyRules(routine);
+    // FREEZE FROM THE LIVE ROW. The execute deletes the only live copy of this text, so the card must
+    // carry it verbatim rather than re-derive it at click (OPE-242's reasoning, applied to a rule).
+    const target = rules.find((x) => x.id === ruleId);
+    if (!target) {
+      const known = rules.length > 0 ? ` It has: ${rules.map((x) => x.id).join(", ")}.` : " It has no standing rules.";
+      throw new Error(`Routine '${routineId}' has no rule '${ruleId}'.${known}`);
+    }
+
+    const description = describeTrigger(routine.trigger, routine.report);
+    const binding = bindFrom(ctx);
+    // principal-gate: accountability — the card's "asked by" line. Same as add_routine_rule: the presence
+    // question is already answered by routines/policy.ts's `inRoutineFire` refusal above, which is the
+    // sharper control, since taking a guardrail away is the direction an injected fire wants.
+    const requestedBy = principalIdOf(ctx);
+    if (!requestedBy) {
+      throw new Error(
+        "remove_routine_rule needs a verified sender to gate the removal — no principal id resolved, so there's no requester to show on the approval card.",
+      );
+    }
+
+    // Where the card goes: this room when it can host one, otherwise a card-capable channel in the SAME domain. This also subsumes the old "couldn't resolve this channel's id" throw.
+    const venueResult = await checkApprovalVenue(binding, p, () => getConfig().loadDomains());
+    if ("refusal" in venueResult) {
+      throw new Error(describeVenueRefusal(venueResult.refusal, binding.platform, "remove that rule"));
+    }
+    const venue = venueResult.venue;
+
+    const posted = await requestApproval(
+      {
+        org: p.org,
+        kind: "routine.policy.remove",
+        args: {
+          org: p.org,
+          partition: p,
+          surfaceKey: p.surfaceKey,
+          routineId,
+          description,
+          ruleId: target.id,
+          ruleText: target.rule,
+          why: target.why,
+          addedAt: target.addedAt,
+          addedBy: target.addedBy,
+          countBefore: rules.length,
+          requestedBy,
+        },
+        scopeKey: proposeScopeKey,
+        domain: null,
+        requestedBy,
+        channelId: venue.channelId,
+        threadTs: venue.sameRoom ? binding.threadTs ?? null : null,
+        postedTo: venue.surfaceKey,
+        // OPE-296 P3: the chain's unattended signal — a fire (no ACTING sender) must deny fast on an
+        // undeclared gate rather than post a card into an empty room (ask-unattended; feeds OPE-297).
+        chain: { unattended: unattendedOf(ctx) },
+      },
+      approvalPostDeps(venue.platform, ctx),
+    );
+
+    // Chain-lowered (OPE-296) ⇒ no card, the rule is already gone — the exact inverse of the
+    // card path's "until someone clicks, the rule still applies".
+    const subject = `removal of standing rule ${target.id} from routine ${routineId} (${description})`;
+    if (posted.autoApproved) {
+      return {
+        pending: false,
+        autoApproved: true,
+        pendingId: posted.id,
+        routineId,
+        ruleId: target.id,
+        message: autoApprovedNote(subject, posted.autoApproved),
+      };
+    }
+    return {
+      pending: true,
+      pendingId: posted.id,
+      routineId,
+      ruleId: target.id,
+      message: `${cardPostedPrefix(venue)} — ${subject} awaiting a human to confirm (pending ${posted.id}). Until someone clicks, the rule still applies.${cardPostedTail(venue, "confirm the removal", posted)}`,
+    };
+  },
+});