@open-everywhere/core 0.1.0

package/agent/access/ingestion-binding-manifest.ts

@@ -0,0 +1,263 @@
+// The pure half of `npm run lint:ingestion`: every ingestion site must bind a LITERAL IngestionKind and a label, or the table falls through silently at runtime and nothing is logged.
+// A genuinely undecided kind may declare `kind: "TODO"`, but only with an adjacent `// TODO(ingestion): <reason>` comment; an unexplained one is itself a defect.
+
+import { INGESTION_KINDS, type IngestionKind } from "./taint-tiers.js";
+
+/** The declared-ambiguous escape hatch (see the file header). Never a real {@link IngestionKind} —
+ *  deliberately outside the table so a pending site can never be silently read as a real one. */
+export const TODO_KIND = "TODO";
+
+export type IngestionSiteForm = "ingestion-property" | "ingestion-const" | "noteIngestionVerdict" | "chatReadIngestion";
+
+export interface IngestionSite {
+  readonly file: string;
+  /** 1-based, the line the trigger token (`ingestion:`, `noteIngestionVerdict(`, `chatReadIngestion(`,
+   *  or the `const ingestion =`) appears on. Informational only — the inventory keys on
+   *  {@link routeKey}, not this, so an unrelated edit above a site does not read as a route change. */
+  readonly line: number;
+  readonly form: IngestionSiteForm;
+  /** The `kind` literal found in the site's window, verbatim. `undefined` when none was found (a
+   *  variable, or an outright omission) — the `no-kind` defect. */
+  readonly kindLiteral?: string;
+  /** True once a `label` field (literal, template, or bound identifier) was found anywhere in the
+   *  window — the value is never validated, only its presence. */
+  readonly hasLabel: boolean;
+  /** The label's source text when statically readable — a literal or template's inner text verbatim
+   *  (interpolations included, unevaluated), or a bound identifier's name. `undefined` when
+   *  {@link hasLabel} is false, or true only via the bare shorthand `label` property. */
+  readonly labelText?: string;
+  /** True when `kindLiteral === TODO_KIND` AND an adjacent `// TODO(ingestion): …` comment explains
+   *  it — the accepted-but-unresolved case. False for every other site. */
+  readonly pending: boolean;
+}
+
+export type IngestionBindingDefectRule = "no-kind" | "unknown-kind" | "no-label" | "todo-unexplained";
+
+export interface IngestionBindingDefect {
+  readonly file: string;
+  readonly line: number;
+  readonly rule: IngestionBindingDefectRule;
+  readonly message: string;
+}
+
+/** A stable identity for one site, independent of line number — file + how it names itself. Two
+ *  sites in the same file with the same label text are disambiguated by the generator, not here (see
+ *  scripts/ingestion-binding-lint.ts `uniqueKeys`). */
+export function routeKey(site: Pick<IngestionSite, "file" | "form" | "labelText">): string {
+  return `${site.file}#${site.labelText ?? `<${site.form}>`}`;
+}
+
+/** Blank out comment content so a read mentioned in prose (adapter-api.ts's own header, for one) is
+ *  never mistaken for a declaration site. Mirrors principal-gate-manifest.ts's stripper: block-comment
+ *  state tracked across lines, string literals not parsed, which can only make this checker see LESS,
+ *  never invent a site. */
+function stripComments(lines: readonly string[]): string[] {
+  let inBlock = false;
+  return lines.map((raw) => {
+    let out = "";
+    let i = 0;
+    while (i < raw.length) {
+      if (inBlock) {
+        if (raw.startsWith("*/", i)) {
+          inBlock = false;
+          out += "  ";
+          i += 2;
+        } else {
+          out += " ";
+          i += 1;
+        }
+        continue;
+      }
+      if (raw.startsWith("/*", i)) {
+        inBlock = true;
+        out += "  ";
+        i += 2;
+        continue;
+      }
+      if (raw.startsWith("//", i)) {
+        out += " ".repeat(raw.length - i);
+        break;
+      }
+      out += raw[i];
+      i += 1;
+    }
+    return out;
+  });
+}
+
+// How many lines past the trigger a site's `kind:`/`label:` may sit. Generous against the real literals (2 to 6 lines) and still too small to spill into the next unrelated declaration in the files this lint walks.
+const WINDOW = 8;
+
+const KIND_RE = /\bkind:\s*"([^"]*)"/;
+const LABEL_LITERAL_RE = /\blabel:\s*"([^"]*)"/;
+const LABEL_TEMPLATE_RE = /\blabel:\s*`([^`]*)`/;
+const LABEL_IDENT_RE = /\blabel:\s*([A-Za-z_$][\w$]*)\b/;
+const LABEL_SHORTHAND_RE = /(?:[{(,]|^)\s*label\s*(?:[,}]|$)/;
+const TODO_MARKER_RE = /\/\/\s*TODO\(ingestion\):\s*\S/;
+
+interface WindowScan {
+  readonly kindLiteral?: string;
+  readonly hasLabel: boolean;
+  readonly labelText?: string;
+  readonly pending: boolean;
+}
+
+function scanObjectWindow(code: readonly string[], rawLines: readonly string[], startIdx: number): WindowScan {
+  let kindLiteral: string | undefined;
+  let kindLine = -1;
+  let hasLabel = false;
+  let labelText: string | undefined;
+  const end = Math.min(startIdx + WINDOW, code.length);
+  for (let j = startIdx; j < end; j++) {
+    const l = code[j] ?? "";
+    if (kindLiteral === undefined) {
+      const m = KIND_RE.exec(l);
+      if (m) {
+        kindLiteral = m[1];
+        kindLine = j;
+      }
+    }
+    if (!hasLabel) {
+      const lit = LABEL_LITERAL_RE.exec(l);
+      const tpl = LABEL_TEMPLATE_RE.exec(l);
+      const ident = LABEL_IDENT_RE.exec(l);
+      if (lit) {
+        hasLabel = true;
+        labelText = lit[1];
+      } else if (tpl) {
+        hasLabel = true;
+        labelText = tpl[1];
+      } else if (ident) {
+        hasLabel = true;
+        labelText = ident[1];
+      } else if (LABEL_SHORTHAND_RE.test(l)) {
+        hasLabel = true;
+        labelText = undefined;
+      }
+    }
+  }
+  let pending = false;
+  if (kindLiteral === TODO_KIND && kindLine >= 0) {
+    // The marker may sit on the kind's own line or the line directly above it — the same "adjacent"
+    // rule the repo's other marker checks use (principal-gate-manifest.ts's markerAbove).
+    pending = TODO_MARKER_RE.test(rawLines[kindLine] ?? "") || TODO_MARKER_RE.test(rawLines[kindLine - 1] ?? "");
+  }
+  return { kindLiteral, hasLabel, labelText, pending };
+}
+
+/** Shape 3: `noteIngestionVerdict(` followed immediately by an object literal. The definition itself, and any call passing a variable, never match, because the `{` must be the next non-whitespace token. */
+const NOTE_VERDICT_TRIGGER_RE = /\bnoteIngestionVerdict\(\s*\{/;
+/** Shape 1. `ingestion?: IngestionSource` (the interface field) never matches — the `?` breaks the
+ *  `ingestion:` token — and `ingestion: chatReadIngestion(…)` never matches either, because shape 4's
+ *  trigger below claims it first, and this one requires a literal `{` right after the colon. */
+const INGESTION_PROPERTY_TRIGGER_RE = /\bingestion:\s*\{/;
+/** Shape 2: a hoisted `const`/`let` named exactly `ingestion`. */
+const INGESTION_CONST_TRIGGER_RE = /^\s*(?:const|let)\s+ingestion\s*(?::[^=]+)?=\s*\{/;
+/** Shape 4: a CALL (the first token after the paren is a quote), never the factory's own
+ *  `function chatReadIngestion(label: string, …)` declaration, whose first token is an identifier. */
+const CHAT_READ_TRIGGER_RE = /\bchatReadIngestion\(\s*["'`]/;
+const CHAT_READ_LABEL_RE = /\bchatReadIngestion\(\s*(?:"([^"]*)"|'([^']*)'|`([^`]*)`)/;
+
+// Cheap single-line pre-filters. Detection must be anchored to the line holding the bare keyword FIRST, or a forward-looking window re-detects the same call once per line it can still see it from.
+const NOTE_VERDICT_BARE_RE = /\bnoteIngestionVerdict\(/;
+const INGESTION_PROPERTY_BARE_RE = /\bingestion:/;
+const INGESTION_CONST_BARE_RE = /^\s*(?:const|let)\s+ingestion\s*(?::[^=]+)?=/;
+
+/** Find every ingestion-kind declaration site in one file, across all four shapes. Windows join raw lines with a newline before matching, so a trigger split across lines is rejected the same way as on one line. */
+export function findIngestionSites(file: string, source: string): IngestionSite[] {
+  const rawLines = source.split("\n");
+  const code = stripComments(rawLines);
+  const sites: IngestionSite[] = [];
+
+  for (let i = 0; i < code.length; i++) {
+    const line = code[i] ?? "";
+
+    // chatReadIngestion's own trigger already requires the quote, so it needs no separate bare
+    // pre-filter — a call never spans lines between the paren and its opening quote in this tree.
+    if (CHAT_READ_TRIGGER_RE.test(line)) {
+      const m = CHAT_READ_LABEL_RE.exec(line);
+      const labelText = m ? (m[1] ?? m[2] ?? m[3]) : undefined;
+      sites.push({
+        file,
+        line: i + 1,
+        form: "chatReadIngestion",
+        // The factory (channels/channel-read.ts `chatReadIngestion`) binds this unconditionally —
+        // see the file header's shape-4 note and the lint's own test, which pins the factory body.
+        kindLiteral: "chat-message",
+        hasLabel: labelText !== undefined,
+        labelText,
+        pending: false,
+      });
+      continue;
+    }
+
+    if (NOTE_VERDICT_BARE_RE.test(line)) {
+      const joined = code.slice(i, Math.min(i + 4, code.length)).join("\n");
+      if (NOTE_VERDICT_TRIGGER_RE.test(joined)) {
+        const w = scanObjectWindow(code, rawLines, i);
+        sites.push({ file, line: i + 1, form: "noteIngestionVerdict", ...w });
+        continue;
+      }
+    }
+
+    if (INGESTION_PROPERTY_BARE_RE.test(line)) {
+      const joined = code.slice(i, Math.min(i + 4, code.length)).join("\n");
+      if (INGESTION_PROPERTY_TRIGGER_RE.test(joined)) {
+        const w = scanObjectWindow(code, rawLines, i);
+        sites.push({ file, line: i + 1, form: "ingestion-property", ...w });
+        continue;
+      }
+    }
+
+    if (INGESTION_CONST_BARE_RE.test(line)) {
+      const joined = code.slice(i, Math.min(i + 4, code.length)).join("\n");
+      if (INGESTION_CONST_TRIGGER_RE.test(joined)) {
+        const w = scanObjectWindow(code, rawLines, i);
+        sites.push({ file, line: i + 1, form: "ingestion-const", ...w });
+        continue;
+      }
+    }
+  }
+  return sites;
+}
+
+/** Validate a batch of sites against the three defect rules (see the file header). Pure — no I/O. */
+export function checkIngestionSites(sites: readonly IngestionSite[]): IngestionBindingDefect[] {
+  const defects: IngestionBindingDefect[] = [];
+  const knownKinds = INGESTION_KINDS as readonly string[];
+  for (const s of sites) {
+    if (s.kindLiteral === undefined) {
+      defects.push({
+        file: s.file,
+        line: s.line,
+        rule: "no-kind",
+        message: "no explicit `kind: \"…\"` literal found at this ingestion declaration site — every site must bind a literal IngestionKind, never a variable or an omission",
+      });
+    } else if (s.kindLiteral === TODO_KIND) {
+      if (!s.pending) {
+        defects.push({
+          file: s.file,
+          line: s.line,
+          rule: "todo-unexplained",
+          message: 'kind: "TODO" needs an adjacent `// TODO(ingestion): <reason>` comment explaining why the kind is not yet decided',
+        });
+      }
+    } else if (!knownKinds.includes(s.kindLiteral)) {
+      defects.push({
+        file: s.file,
+        line: s.line,
+        rule: "unknown-kind",
+        message: `kind "${s.kindLiteral}" is not one of the ratified IngestionKind values in access/taint-tiers.ts — add a row to INGESTION_KINDS and classifyIngestion before a site can declare it, or use kind: "TODO" with a TODO(ingestion) comment if the classification is genuinely undecided`,
+      });
+    }
+    if (!s.hasLabel) {
+      defects.push({
+        file: s.file,
+        line: s.line,
+        rule: "no-label",
+        message: "no `label` field found at this ingestion declaration site — every site needs one for the audit row's provenance name",
+      });
+    }
+  }
+  return defects;
+}

package/agent/access/ingestion-route-inventory.generated.ts

@@ -0,0 +1,58 @@
+// GENERATED by `npx tsx scripts/ingestion-binding-lint.ts` — DO NOT HAND-EDIT.
+// `npm run lint:ingestion` (in the test chain) fails the build if this file no longer matches
+// what packages/*/agent/ actually declares. This is the AUTHORITATIVE route inventory OPE-470's
+// route-join sweep reads from — see packages/core/agent/access/ingestion-binding-manifest.ts for
+// what a "route" is and the three rules a site must satisfy to appear here.
+//
+// A row appearing or disappearing is a read/connector/webhook/… surface gaining or losing its
+// ingestion declaration — read the diff as that, the same way a worker-capability-index diff is
+// read as a capability moving on or off the conversational seat.
+//
+// ⚠️ A `form: "noteIngestionVerdict"` row is an OBSERVER: it reports its kind to the table
+// without governing the route's own `ingestUntrusted` call. Do not read such a row as "this
+// route is table-governed" — the route's fence stands on its own and marks unconditionally.
+
+export interface IngestionRoute {
+  /** Stable identity: file + label text (or an index suffix on a same-file collision). */
+  readonly key: string;
+  readonly file: string;
+  readonly form: "ingestion-property" | "ingestion-const" | "noteIngestionVerdict" | "chatReadIngestion";
+  readonly kind: string;
+  /** The label's source text, or `null` when it is only a bare `label` shorthand property. */
+  readonly label: string | null;
+  /** `kind: "TODO"`, accepted because it carries a `// TODO(ingestion): …` comment — resolved OR removed before this may ship as a real gated route. */
+  readonly pending: boolean;
+}
+
+export const INGESTION_ROUTES: readonly IngestionRoute[] = [
+  { key: "packages/core/agent/access/aws-output.ts#aws", file: "packages/core/agent/access/aws-output.ts", form: "ingestion-const", kind: "aws", label: "aws", pending: false },
+  { key: "packages/core/agent/access/browser-toolkit.ts#browser_${op}", file: "packages/core/agent/access/browser-toolkit.ts", form: "ingestion-property", kind: "web", label: "browser_${op}", pending: false },
+  { key: "packages/core/agent/access/untrusted-projection.ts#name", file: "packages/core/agent/access/untrusted-projection.ts", form: "ingestion-property", kind: "connector", label: "name", pending: false },
+  { key: "packages/core/agent/channels/context-render.ts#context-render", file: "packages/core/agent/channels/context-render.ts", form: "noteIngestionVerdict", kind: "chat-message", label: "context-render", pending: false },
+  { key: "packages/core/agent/channels/wake-envelope.ts#wake-envelope:${sourcePlatform}", file: "packages/core/agent/channels/wake-envelope.ts", form: "noteIngestionVerdict", kind: "chat-message", label: "wake-envelope:${sourcePlatform}", pending: false },
+  { key: "packages/core/agent/review/pr-walkthrough.ts#walk_pr:${pr.repo}", file: "packages/core/agent/review/pr-walkthrough.ts", form: "noteIngestionVerdict", kind: "github", label: "walk_pr:${pr.repo}", pending: false },
+  { key: "packages/core/agent/routines/events.ts#github-event", file: "packages/core/agent/routines/events.ts", form: "ingestion-property", kind: "routine-event", label: "github-event", pending: false },
+  { key: "packages/core/agent/scm/pr-feedback.ts#get_pr_feedback:${d.repo}", file: "packages/core/agent/scm/pr-feedback.ts", form: "ingestion-const", kind: "github", label: "get_pr_feedback:${d.repo}", pending: false },
+  { key: "packages/core/agent/tools/describe_image.ts#describe_image", file: "packages/core/agent/tools/describe_image.ts", form: "ingestion-property", kind: "image-description", label: "describe_image", pending: false },
+  { key: "packages/core/agent/tools/grant_tools.ts#<ingestion-property>", file: "packages/core/agent/tools/grant_tools.ts", form: "ingestion-property", kind: "connector", label: null, pending: false },
+  { key: "packages/core/agent/tools/list_recent_events.ts#list_recent_events", file: "packages/core/agent/tools/list_recent_events.ts", form: "ingestion-property", kind: "webhook", label: "list_recent_events", pending: false },
+  { key: "packages/core/agent/tools/read_channel.ts#read_channel:${output.platform}", file: "packages/core/agent/tools/read_channel.ts", form: "chatReadIngestion", kind: "chat-message", label: "read_channel:${output.platform}", pending: false },
+  { key: "packages/core/agent/tools/read_file_upload.ts#read_file_upload", file: "packages/core/agent/tools/read_file_upload.ts", form: "ingestion-property", kind: "file-upload", label: "read_file_upload", pending: false },
+  { key: "packages/core/agent/tools/read_routine_transcript.ts#read_routine_transcript", file: "packages/core/agent/tools/read_routine_transcript.ts", form: "ingestion-property", kind: "routine-event", label: "read_routine_transcript", pending: false },
+  { key: "packages/core/agent/tools/read_thread.ts#read_thread:${output.platform}", file: "packages/core/agent/tools/read_thread.ts", form: "chatReadIngestion", kind: "chat-message", label: "read_thread:${output.platform}", pending: false },
+  { key: "packages/core/agent/tools/read_webhook_history.ts#read_webhook_history", file: "packages/core/agent/tools/read_webhook_history.ts", form: "ingestion-property", kind: "webhook", label: "read_webhook_history", pending: false },
+  { key: "packages/core/agent/tools/read_work_channel.ts#read_work_channel:${output.platform}", file: "packages/core/agent/tools/read_work_channel.ts", form: "chatReadIngestion", kind: "chat-message", label: "read_work_channel:${output.platform}", pending: false },
+  { key: "packages/core/agent/tools/read_work_thread.ts#read_work_thread:${output.platform}", file: "packages/core/agent/tools/read_work_thread.ts", form: "chatReadIngestion", kind: "chat-message", label: "read_work_thread:${output.platform}", pending: false },
+  { key: "packages/core/agent/tools/sandbox_tools.ts#<ingestion-property>", file: "packages/core/agent/tools/sandbox_tools.ts", form: "ingestion-property", kind: "skill-declared", label: null, pending: false },
+  { key: "packages/core/agent/tools/sandbox_tools.ts#web_fetch", file: "packages/core/agent/tools/sandbox_tools.ts", form: "ingestion-property", kind: "web", label: "web_fetch", pending: false },
+  { key: "packages/core/agent/tools/search.ts#search", file: "packages/core/agent/tools/search.ts", form: "ingestion-property", kind: "work-search", label: "search", pending: false },
+  { key: "packages/core/agent/tools/subscribe_pr.ts#subscribe_pr:title", file: "packages/core/agent/tools/subscribe_pr.ts", form: "noteIngestionVerdict", kind: "github", label: "subscribe_pr:title", pending: false },
+  { key: "packages/core/agent/webhooks/dispatch.ts#webhook-body", file: "packages/core/agent/webhooks/dispatch.ts", form: "ingestion-property", kind: "webhook", label: "webhook-body", pending: false },
+  { key: "packages/core/agent/webhooks/dispatch.ts#webhook-summary", file: "packages/core/agent/webhooks/dispatch.ts", form: "ingestion-property", kind: "webhook", label: "webhook-summary", pending: false },
+  { key: "packages/providers/linear/agent/tools/read_linear_issue.ts#read_linear_issue", file: "packages/providers/linear/agent/tools/read_linear_issue.ts", form: "ingestion-property", kind: "linear", label: "read_linear_issue", pending: false },
+  { key: "packages/providers/notion/agent/tools/notion_search.ts#notion_search", file: "packages/providers/notion/agent/tools/notion_search.ts", form: "ingestion-property", kind: "notion", label: "notion_search", pending: false },
+  { key: "packages/providers/notion/agent/tools/read_notion_comments.ts#read_notion_comments", file: "packages/providers/notion/agent/tools/read_notion_comments.ts", form: "ingestion-property", kind: "notion", label: "read_notion_comments", pending: false },
+  { key: "packages/providers/notion/agent/tools/read_notion_page.ts#read_notion_page", file: "packages/providers/notion/agent/tools/read_notion_page.ts", form: "ingestion-property", kind: "notion", label: "read_notion_page", pending: false },
+  { key: "packages/providers/slack/agent/channels/slack-events.ts#slack:channel-join-intro", file: "packages/providers/slack/agent/channels/slack-events.ts", form: "noteIngestionVerdict", kind: "chat-message", label: "slack:channel-join-intro", pending: false },
+  { key: "packages/providers/slack/agent/channels/slack-shortcut.ts#slack:shortcut", file: "packages/providers/slack/agent/channels/slack-shortcut.ts", form: "noteIngestionVerdict", kind: "chat-message", label: "slack:shortcut", pending: false },
+];

package/agent/access/instructions.ts

@@ -0,0 +1,89 @@
+// Renders resolved access into the system-prompt fragment the dynamic instructions resolver injects: the scope instruction stack, stated to OUTRANK channel memory, and a capability summary. Returns null when there is nothing scope-specific to add.
+
+import { workGrantedConnectors } from "./work-grant.js";
+import type { CredentialBoundDomain } from "./domain-credentials.js";
+import type { EffectiveAccess } from "./resolver.js";
+
+/** `domains` are the session's OWN memory domains and a second input on purpose, because work grants live on the domain rather than on the access bundle. Empty means no work line, which is the honest answer — such a session holds no work grant at the fences either. */
+export function assembleAccessInstructions(access: EffectiveAccess, domains: readonly (CredentialBoundDomain | undefined)[] = []): string | null {
+  const parts: string[] = [];
+  // The repo grant is GitHub's work declaration, so it is the second input to the work line.
+  const workConnectors = workGrantedConnectors(domains, access.repos);
+
+  if (access.instructionStack.length > 0) {
+    const lines = access.instructionStack.map((l) => `- (${l.source}) ${l.text}`).join("\n");
+    parts.push(
+      `### Standing instructions for this scope\n\n` +
+        `These are scope-level rules and **outrank channel memory**. Where layers differ, ` +
+        `the narrower/later scope wins. Follow them:\n\n${lines}`,
+    );
+  }
+
+  const caps: string[] = [];
+  if (access.reachableHosts.length > 0) {
+    caps.push(
+      `- Hosts you can reach: ` +
+        access.reachableHosts
+          .map((h) => `\`${h.host}\`${h.viaConnection ? " (authenticated)" : ""}`)
+          .join(", "),
+    );
+  }
+  if (access.repos.length > 0) {
+    caps.push(`- Repositories granted: ${access.repos.map((r) => `\`${r}\``).join(", ")}`);
+  }
+  // The work line is COOPERATIVE only: each provider's own fence is the hard gate and refuses regardless of what this paragraph says.
+  const workList = workConnectors.map((w) => `\`${w}\``).join(", ");
+  if (workConnectors.length > 0) {
+    // The route stays GENERIC on purpose. A per-connector tool list would be a false capability claim at the SEAT grain, because the providers' own work tools are worker-only.
+    caps.push(
+      `- Work surfaces your domain is granted: ${workList} — your domain may do work on each of ` +
+        `these from this channel. That work runs on the provider's own tools, never on a connection.`,
+    );
+  }
+  if (access.plugins.length > 0) {
+    caps.push(`- Plugins granted: ${access.plugins.map((p) => `\`${p}\``).join(", ")}`);
+  }
+  if (access.skills.length > 0) {
+    caps.push(`- Skills available: ${access.skills.map((s) => `\`${s}\``).join(", ")}`);
+  }
+  if (caps.length > 0) {
+    parts.push(
+      `### What you can access in this channel\n\n${caps.join("\n")}\n\n` +
+        `Anything not listed is blocked at the firewall. If a task needs something you don't ` +
+        `have, say so plainly — don't try to route around the restriction.\n\n` +
+        // The wall cannot explain itself: on Vercel the deny happens out of band and arrives as an unexplained connection failure, whose default response is a retry — the one response that can never work.
+        `A blocked request is policy, never a blip: **don't retry it**, and don't reach for a ` +
+        `mirror or a proxy. Report which host you needed and why — the individual block isn't ` +
+        `recorded anywhere, so your report is the only signal it happened, and widening is a ` +
+        `reviewed config change either way. Inside the sandbox, \`egress/STATUS.json\` lists what ` +
+        `is reachable right now and \`egress/README.md\` explains the rest.`,
+    );
+  }
+
+  // The COOPERATIVE half of the connector grant; the hard gate is access/connector-scope.ts. It renders for any scope with a capability surface, because there an empty grant must read as "use none" rather than "unspecified".
+  if (caps.length > 0 || access.connectors.length > 0) {
+    const granted = access.connectors;
+    const list = granted.length > 0 ? granted.map((c) => `\`${c}\``).join(", ") : "(none)";
+    // This paragraph and the work line render from the SAME `workConnectors` value, because they once contradicted each other and a worker believed the denial. The reconciliation names the capability section by heading, which is always valid: it renders only when a work grant exists, and a work grant always puts a line in `caps`.
+    const workReconciliation =
+      workConnectors.length > 0
+        ? `\n\nThat connection list governs CONNECTIONS only. It does not narrow the work surfaces ` +
+          `in **What you can access in this channel**. Your domain is granted ${workList}. Work on ` +
+          `those runs on each provider's own tools, and no connection grant governs them. So an ` +
+          `empty connection list is never a reason to call a granted work surface unavailable. ` +
+          `Check your own tools for that provider first. If this session cannot call them but can ` +
+          `delegate, delegate.`
+        : "";
+    parts.push(
+      `### Connections you may use\n\n` +
+        `- Allowed connections for this channel: ${list}\n\n` +
+        `Use **only** the connections listed above. \`connection_search\` may surface other ` +
+        `connections that exist on this deployment — you are **not** authorized to use them here. ` +
+        `If a task needs a connection you haven't been granted, say so plainly; do not invoke it.` +
+        workReconciliation,
+    );
+  }
+
+  if (parts.length === 0) return null;
+  return `## Channel scope: \`${access.scopeKey}\` (mode: ${access.mode})\n\n${parts.join("\n\n")}`;
+}

package/agent/access/invoker-posture-state.ts

@@ -0,0 +1,25 @@
+// Per-wake slot carrying who caused this run, written at `turn.started` and read per model call. The CLASSIFIER clears to `untrusted-remote` before it classifies anything, so a throw lands on the narrowest kit. The SLOT's own default is `interactive`, which answers a different question — a caller with no eve context has no delivery and therefore no invoker to have been remote.
+
+import { defineState } from "eve/context";
+import type { InvokerPosture } from "./invoker-posture.js";
+
+const slot = defineState<InvokerPosture>("open-everywhere.invoker-posture", () => "interactive");
+
+/** Record WHO caused this wake. Written CLEAR-FIRST-NARROW by hooks/lean-seat.ts:
+ *  `setInvokerPosture("untrusted-remote")` runs before any classification. Fail-soft outside an eve
+ *  context (nothing to narrow — see the header's split). */
+export function setInvokerPosture(posture: InvokerPosture): void {
+  try {
+    slot.update(() => posture);
+  } catch {
+  }
+}
+
+/** The invoker posture for the wake in flight. `interactive` for every context-less caller, which has no delivery and therefore no invoker. */
+export function currentInvokerPosture(): InvokerPosture {
+  try {
+    return slot.get();
+  } catch {
+    return "interactive";
+  }
+}

package/agent/access/invoker-posture.ts

@@ -0,0 +1,96 @@
+// Kit derived from WHO CAUSED THE RUN. Only `untrusted-remote` subtracts, it subtracts exactly the wide-hands family, and only from the PARENT WINDOW: a `task`-grain delegated worker keeps the full kit, because delegation escalates hands, not authority.
+// Fail direction is NARROW: an unclassified seat lands on the narrowest kit, and postures compose as a MINIMUM, so a forged or stale stamp can only ever tighten.
+
+/** The four invoker classes, and {@link INVOKER_POSTURE_RANK} orders them narrowest-first. */
+export type InvokerPosture = "untrusted-remote" | "unattended-fire" | "attended-fire" | "interactive";
+
+/** The auth attribute carrying an invoker's own posture across a delegation edge, for the one class whose raw discriminator does not survive the hop. A dropped, stale or forged stamp can never widen anything, because the composition is a minimum. */
+export const INVOKER_POSTURE_ATTR = "oe_invoker_posture";
+
+/** Narrowest (0) to widest (3). The lattice {@link narrowerInvokerPosture} minimises over. */
+const INVOKER_POSTURE_RANK: Readonly<Record<InvokerPosture, number>> = {
+  "untrusted-remote": 0,
+  "unattended-fire": 1,
+  "attended-fire": 2,
+  interactive: 3,
+};
+
+/** The NARROWER of two postures. Composition is a minimum so a stamp can only ever tighten. */
+export function narrowerInvokerPosture(a: InvokerPosture, b: InvokerPosture): InvokerPosture {
+  return INVOKER_POSTURE_RANK[a] <= INVOKER_POSTURE_RANK[b] ? a : b;
+}
+
+/** Is `v` one of the four class names? Anything else — absent, garbage, a name from a future
+ *  version — reads as {@link parseInvokerPosture}'s widest answer, which the minimum then ignores. */
+function isInvokerPosture(v: unknown): v is InvokerPosture {
+  return typeof v === "string" && Object.prototype.hasOwnProperty.call(INVOKER_POSTURE_RANK, v);
+}
+
+/** Read a stamped posture, defaulting to the WIDEST (`interactive`) so an absent or unparseable
+ *  stamp is a no-op under {@link narrowerInvokerPosture} and the delivery's own markers decide. */
+function parseInvokerPosture(v: unknown): InvokerPosture {
+  return isInvokerPosture(v) ? v : "interactive";
+}
+
+export interface InvokerSignals {
+  /** `authenticator:"webhook"` or the `open_everywhere_webhook_id` marker (webhooks/dispatch.ts,
+   *  routines/fire-auth.ts WEBHOOK_MARKER_ATTR — the latter rides a delegation hop verbatim). */
+  readonly webhookFire: boolean;
+  /** `principalId:"<source>:webhook"` (routines/ingress.ts) — an event-subscription delivery. */
+  readonly eventSubFire: boolean;
+  /** `oe_fire_unattended` (identity/binding.ts FIRE_UNATTENDED_ATTR — stamped UNCONDITIONALLY by
+   *  every fire-auth builder), the durable-job fire stamp, or a routine marker. Any fire at all. */
+  readonly unattendedFire: boolean;
+  /** `ROUTINE_MARKER.manual` (routines/routine.ts) — a human asked for this run off-schedule. */
+  readonly manualFire: boolean;
+  /** {@link INVOKER_POSTURE_ATTR} forwarded from the invoker across a delegation edge. */
+  readonly stamped?: unknown;
+}
+
+/** Ordering is the doctrine: a remote-origin fire wins outright, then a human-requested fire, then any other fire, then interactive. The invoker's own stamp folds in as a minimum, so a child is never wider than the run that spawned it. */
+export function resolveInvokerPosture(s: InvokerSignals): InvokerPosture {
+  const derived: InvokerPosture =
+    s.webhookFire || s.eventSubFire ? "untrusted-remote" : s.manualFire ? "attended-fire" : s.unattendedFire ? "unattended-fire" : "interactive";
+  return narrowerInvokerPosture(derived, parseInvokerPosture(s.stamped));
+}
+
+/** Names withheld from an `untrusted-remote` PARENT WINDOW: exactly the WINDOW_GATED_TOOLS rows carrying the wide-hands grain matrix, an equality scripts/invoker-posture-test.ts pins by REFERENCE IDENTITY against `fullKit()`. A `task`-grain child holds every one of them. */
+export const UNTRUSTED_REMOTE_WITHHELD_TOOLS: ReadonlySet<string> = new Set([
+  "bash",
+  "glob",
+  "grep",
+  "read_file",
+  "write_file",
+  "web_fetch",
+  "checkout_repo",
+  "open_pull_request",
+  "post_file",
+  "create_skill",
+  "delete_skill",
+]);
+
+/** What `posture` withholds from this seat. `delegatedWorker` is the one exemption, and it DEFAULTS to false, i.e. to withholding: a caller that does not know whether it is a worker is treated as the window. */
+export function withheldForInvokerPosture(posture: InvokerPosture, delegatedWorker = false): ReadonlySet<string> {
+  if (delegatedWorker) return EMPTY;
+  return posture === "untrusted-remote" ? UNTRUSTED_REMOTE_WITHHELD_TOOLS : EMPTY;
+}
+
+const EMPTY: ReadonlySet<string> = new Set<string>();
+
+/** Allow-by-default, the opposite of the job kit's and the lean roster's direction: this is a bounded EXCLUSION of a named family, so an unknown name is simply not in it. */
+function allowedUnderInvokerPosture(name: string, posture: InvokerPosture, withheld: ReadonlySet<string> = withheldForInvokerPosture(posture)): boolean {
+  return !withheld.has(name);
+}
+
+/** Applies the subtraction in place and returns the removed names, sorted. Mutation rather than replacement: eve keys tool approvals in a WeakMap on the toolset's tool OBJECTS, so deleting a key is safe while swapping a value would drop an approval. */
+export function restrictToolsetForInvokerPosture(toolset: Record<string, unknown>, posture: InvokerPosture, delegatedWorker = false): string[] {
+  const withheld = withheldForInvokerPosture(posture, delegatedWorker);
+  if (withheld.size === 0) return [];
+  const removed: string[] = [];
+  for (const name of Object.keys(toolset)) {
+    if (allowedUnderInvokerPosture(name, posture, withheld)) continue;
+    delete toolset[name];
+    removed.push(name);
+  }
+  return removed.sort();
+}

package/agent/access/job-posture.ts

@@ -0,0 +1,83 @@
+// The PURE policy half of the durable-job toolset restriction, applied per WAKE: an un-escalated fire is narrowed to the job kit, and a wake a real human addressed keeps that human's normal posture. Fail-closed over wake classification INSIDE a job session only, never over job-session detection.
+
+import { JOB_WAKE_TOOLS, withheldFromJobWake } from "./window-gate-manifest.js";
+import { classifyConnectorOpTier, isReservedNamespaceTool } from "./consequence.js";
+
+/** The host-set auth attribute marking a delivery as an AUTONOMOUS durable-job fire. Host-set only, unforgeable, and fresh on every delivery; an attribute rather than a token shape, because the continuation-token grammar is frozen. */
+export const JOB_FIRE_ATTR = "oe_job_fire";
+
+/** The host-set attribute marking a job fire whose LEDGER is tainted — the taint-forward carriage across a session replacement, so a durable write on the fire gates as if that turn had itself read the untrusted content. */
+export const JOB_TAINT_ATTR = "oe_job_tainted";
+
+type Attrs = Readonly<Record<string, string | readonly string[]>> | undefined;
+
+/** The attributes a job fire adds to its delivery auth — the dispatcher's one call site. Empty for
+ *  a non-job routine, so every other fire stays byte-identical. Mirrors rootDmGrainAttrs' shape.
+ *  `ledgerTainted` rides along so a resumed OR replaced session inherits the ledger's taint. */
+export function jobFireAttrs(isJobFire: boolean, ledgerTainted = false): Record<string, string> {
+  if (!isJobFire) return {};
+  return ledgerTainted ? { [JOB_FIRE_ATTR]: "true", [JOB_TAINT_ATTR]: "true" } : { [JOB_FIRE_ATTR]: "true" };
+}
+
+/** Does THIS delivery carry the tainted-ledger stamp? Same positive-only read as the fire stamp; the seeding consumer is hooks/spawn-taint.ts, and this stays the named reader of the attribute. */
+export function jobTaintStamped(attributes: Attrs): boolean {
+  const v = attributes?.[JOB_TAINT_ATTR];
+  const first = typeof v === "string" ? v : Array.isArray(v) ? v[0] : undefined;
+  return first === "true";
+}
+
+/** Is THIS delivery a stamped autonomous job fire? Tolerates the `string[]` attribute spelling eve
+ *  can hand back (same collapse as routines/routine.ts routineMarker). */
+export function jobFireStamped(attributes: Attrs): boolean {
+  const v = attributes?.[JOB_FIRE_ATTR];
+  const first = typeof v === "string" ? v : Array.isArray(v) ? v[0] : undefined;
+  return first === "true";
+}
+
+/** What hands this WAKE gets. `restricted` ⇒ the {@link JOB_WAKE_TOOLS} kit only. */
+export type JobWakePosture = "restricted" | "unrestricted";
+
+export interface JobWakeSignals {
+  /** `oe_job_fire` on THIS delivery — the scheduler started this turn. */
+  readonly jobFire: boolean;
+  /** Has THIS session ever taken a stamped job fire? Sticky/monotonic — a job session never
+   *  becomes an ordinary one, so a later unstamped wake is still judged as a job session. */
+  readonly jobSession: boolean;
+  /** Is a real principal positively present in THIS turn (an addressed mention, or a delivery
+   *  carrying a principal id)? The ESCALATION signal. */
+  readonly humanPrincipal: boolean;
+}
+
+/** The decision, and the ordering is the security argument: a stamped fire is ALWAYS restricted, checked first, because a human signal on a scheduler-built delivery is a bug or a forge. No job signal at all is out of scope, and a job session without a positive human signal is RESTRICTED. */
+export function resolveJobWakePosture(s: JobWakeSignals): JobWakePosture {
+  if (s.jobFire) return "restricted";
+  if (!s.jobSession) return "unrestricted";
+  return s.humanPrincipal ? "unrestricted" : "restricted";
+}
+
+/** Harness-internal names a per-wake toolset filter never removes: dropping `final_output` would leave a structured-output turn unable to return at all. Exported because the lean-seat filter shares the same seam and must share the same exemption — two lists would drift. */
+export const HARNESS_INTERNAL_TOOLS: ReadonlySet<string> = new Set(["final_output"]);
+
+/** May `name` be held on a RESTRICTED job wake? DEFAULT-DENY, so an unknown name is withheld and the restriction cannot rot open; the one computed arm admits a connector op only when it classifies `read`, and a reserved namespace (`grant__…`) is refused ahead of it as ambient credential use. */
+export function allowedOnRestrictedJobWake(name: string, jobKit: ReadonlySet<string> = JOB_WAKE_TOOLS): boolean {
+  if (jobKit.has(name)) return true;
+  if (HARNESS_INTERNAL_TOOLS.has(name)) return true;
+  // The reserved namespaces are refused whatever their verb reads as. {@link isReservedNamespaceTool}, not `isGrantToolName`, on purpose: a default-deny roster must also refuse a reserved name the mount path could never have minted.
+  if (isReservedNamespaceTool(name)) return false;
+  // A qualified connector op: admit READS only, and through the pure built-in classifier rather than the seam, because a consumer arm may call an op `read` and an unattended wake has no human to card. This floor covers the job-wake toolset only.
+  if (name.includes("__")) return classifyConnectorOpTier(name) === "read";
+  return false;
+}
+
+/** Apply the restriction to an assembled toolset IN PLACE, returning the removed names sorted; mutation is required because eve keys tool approvals in a WeakMap on the tool OBJECTS, so deleting a key is safe while swapping a value would drop an approval. Absence, not refusal — the model never sees the tool. */
+export function restrictToolsetForJobWake(toolset: Record<string, unknown>, jobKit: ReadonlySet<string> = JOB_WAKE_TOOLS): string[] {
+  const removed: string[] = [];
+  for (const name of Object.keys(toolset)) {
+    if (allowedOnRestrictedJobWake(name, jobKit)) continue;
+    delete toolset[name];
+    removed.push(name);
+  }
+  return removed.sort();
+}
+
+export { withheldFromJobWake };