@open-everywhere/core 0.1.0

package/dist/agent/access/credential-grant-revoke.d.ts

@@ -0,0 +1,33 @@
+import { type GrantAuditStamps } from "./credential-grant-flow.js";
+import { type GrantNoticeOutcome } from "./credential-grant-resolution.js";
+import { type CredentialGrantRow } from "../operational/credential-grant-rows.js";
+/** The ORDINAL is a VIEW, never an identifier: it means something only against the list the same call rendered. */
+export interface OwnerGrantHolding {
+    readonly grant: CredentialGrantRow;
+    /** 1-based position in the live list, oldest first. */
+    readonly ordinal: number;
+    /** The one clause that describes this grant to its owner. Id-free by construction. */
+    readonly phrase: string;
+}
+/** The grant ids the next `end` call must carry, kept OUT of the owner-facing message because a POSITION re-resolved later names whichever grant has moved into it. A grant id is not a capability: the lookup filters the owner's OWN live list, so an id belonging to somebody else matches no row. */
+export interface OwnerGrantHandle {
+    /** The grant's own id — what `end` takes. Stable across a re-read; a position is not. */
+    readonly id: string;
+    readonly number: number;
+}
+export declare function ownerGrantHandles(holdings: readonly OwnerGrantHolding[]): readonly OwnerGrantHandle[];
+/** Every grant this owner still lends, numbered OLDEST FIRST. That order is load-bearing: a grant approved while the owner is reading the list appends, so the numbers do not move under them. */
+export declare function ownerLiveGrants(org: string, ownerPrincipalId: string, nowMs: number): Promise<readonly OwnerGrantHolding[]>;
+/** The owner's live list as one message. The lines are the holdings' own `phrase`, never a second rendering, so the confirmation after a revoke names the same words. */
+export declare function ownerGrantListText(holdings: readonly OwnerGrantHolding[]): string;
+/** What one revoke call did. Every field is what ACTUALLY happened, never what was asked for. */
+export interface GrantRevokeOutcome {
+    readonly ended: readonly CredentialGrantRow[];
+    readonly remaining: readonly OwnerGrantHolding[];
+    readonly text: string;
+    /** What became of each borrowing room's notice, in `ended` order. See {@link GrantNoticeOutcome}. */
+    readonly notices: readonly GrantNoticeOutcome[];
+}
+/** `ownerPrincipalId` is read as given, so proving it is the caller's obligation; `grantIds` names ROWS, never positions, so a redelivered call matches an already-revoked row and ends nothing. `undefined` means EVERY live grant and keeps the redelivery hazard in a narrower form — it re-reads the live list and can end a grant approved between the two deliveries. */
+export declare function revokeOwnerGrants(stamps: GrantAuditStamps, ownerPrincipalId: string, grantIds: readonly string[] | undefined, nowMs: number): Promise<GrantRevokeOutcome>;
+//# sourceMappingURL=credential-grant-revoke.d.ts.map

package/dist/agent/access/credential-grant-revoke.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-grant-revoke.d.ts","sourceRoot":"","sources":["../../../agent/access/credential-grant-revoke.ts"],"names":[],"mappings":"AAGA,OAAO,EAAyB,KAAK,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC1F,OAAO,EAAuB,KAAK,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAChG,OAAO,EAAiB,KAAK,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAGjG,mHAAmH;AACnH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IACnC,uDAAuD;IACvD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,sFAAsF;IACtF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,ySAAyS;AACzS,MAAM,WAAW,gBAAgB;IAC/B,yFAAyF;IACzF,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,GAAG,SAAS,gBAAgB,EAAE,CAErG;AAQD,kMAAkM;AAClM,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC,CAGjI;AAED,yKAAyK;AACzK,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,GAAG,MAAM,CAQjF;AAED,iGAAiG;AACjG,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC9C,QAAQ,CAAC,SAAS,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,qGAAqG;IACrG,QAAQ,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,CAAC;CACjD;AAED,+WAA+W;AAC/W,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,gBAAgB,EACxB,gBAAgB,EAAE,MAAM,EACxB,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EACvC,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,kBAAkB,CAAC,CAqB7B"}

package/dist/agent/access/credential-grant-revoke.js

@@ -0,0 +1,62 @@
+// The caller's own principal key IS the query key, so a person can only ever read and end grants their own account pays for; nothing here takes an owner argument. Revoking is the DE-ESCALATING direction, so it takes no approval card, and the borrowing room's notice is best-effort — a post that fails never undoes the revoke.
+import { GRANT_NONE_LIVE_TEXT, grantHoldingPhrase, grantRevokedOwnerText } from "./credential-grant-copy.js";
+import { revokeCredentialGrant } from "./credential-grant-flow.js";
+import { postGrantResolution } from "./credential-grant-resolution.js";
+import { quotedPurpose } from "../operational/credential-grant-rows.js";
+import { getOperationalStore } from "../operational/provider.js";
+export function ownerGrantHandles(holdings) {
+    return holdings.map((h) => ({ id: h.grant.id, number: h.ordinal }));
+}
+/** The facts one row hands the copy module. The purpose is sanitised HERE, by its one owner, because
+ *  `credential-grant-copy.ts` imports nothing and must not carry a second quoting rule. */
+function holdingFacts(grant, nowMs) {
+    return { connector: grant.connector, expiresAt: grant.expiresAt, mcpTool: grant.mcpTool, nowMs, quotedPurpose: quotedPurpose(grant.purpose) };
+}
+/** Every grant this owner still lends, numbered OLDEST FIRST. That order is load-bearing: a grant approved while the owner is reading the list appends, so the numbers do not move under them. */
+export async function ownerLiveGrants(org, ownerPrincipalId, nowMs) {
+    const rows = await getOperationalStore().liveCredentialGrantsForOwner(org, ownerPrincipalId, new Date(nowMs).toISOString());
+    return rows.map((grant, i) => ({ grant, ordinal: i + 1, phrase: grantHoldingPhrase(holdingFacts(grant, nowMs)) }));
+}
+/** The owner's live list as one message. The lines are the holdings' own `phrase`, never a second rendering, so the confirmation after a revoke names the same words. */
+export function ownerGrantListText(holdings) {
+    if (holdings.length === 0)
+        return GRANT_NONE_LIVE_TEXT;
+    return [
+        `You are lending your account to ${holdings.length === 1 ? "one conversation" : `${String(holdings.length)} conversations`}:`,
+        ...holdings.map((h) => `${String(h.ordinal)}. ${h.phrase}`),
+        "",
+        "Say which number to end, and I will end it now. Ending one is immediate and it cannot be undone — a fresh ask would have to be approved again.",
+    ].join("\n");
+}
+/** `ownerPrincipalId` is read as given, so proving it is the caller's obligation; `grantIds` names ROWS, never positions, so a redelivered call matches an already-revoked row and ends nothing. `undefined` means EVERY live grant and keeps the redelivery hazard in a narrower form — it re-reads the live list and can end a grant approved between the two deliveries. */
+export async function revokeOwnerGrants(stamps, ownerPrincipalId, grantIds, nowMs) {
+    const holdings = await ownerLiveGrants(stamps.org, ownerPrincipalId, nowMs);
+    const wanted = grantIds === undefined ? holdings : holdings.filter((h) => grantIds.includes(h.grant.id));
+    const ended = [];
+    const endedHoldings = [];
+    const notices = [];
+    for (const holding of wanted) {
+        if (!(await revokeCredentialGrant(stamps, holding.grant.id, ownerPrincipalId, "thread", nowMs)))
+            continue;
+        ended.push(holding.grant);
+        const notice = await tellBorrowingRoom(stamps.org, holding.grant, nowMs);
+        notices.push(notice);
+        // 🔴 `sent` IS THE ONLY OUTCOME THAT COUNTS AS TOLD. `no_target` never attempted a post and
+        // `failed` threw, so both leave the borrowing room ignorant — and the owner's confirmation must
+        // not say otherwise (cold review, 2026-09-09).
+        endedHoldings.push({ phrase: holding.phrase, told: notice === "sent" });
+    }
+    // RE-READ RATHER THAN SUBTRACTED. The owner is being shown what they still lend, and a list
+    // computed by removing the ended rows from a snapshot would silently keep a grant a racing sweep
+    // had already expired.
+    const remaining = await ownerLiveGrants(stamps.org, ownerPrincipalId, nowMs);
+    return { ended, notices, remaining, text: grantRevokedOwnerText(endedHoldings, remaining.map((h) => h.phrase)) };
+}
+/** Tells the conversation that held the grant; `no_target` when the ask row is gone or pinned nothing postable. The address comes off the ASK row, because a grant names its chat by session key, which nothing can post to, and `nowMs` is the revoke's own tick. */
+async function tellBorrowingRoom(org, grant, nowMs) {
+    const ask = await getOperationalStore().getCredentialGrantAsk(org, grant.askId);
+    if (ask === null)
+        return "no_target";
+    return await postGrantResolution(ask, { kind: "revoked" }, nowMs);
+}
+//# sourceMappingURL=credential-grant-revoke.js.map

package/dist/agent/access/credential-grant-revoke.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-grant-revoke.js","sourceRoot":"","sources":["../../../agent/access/credential-grant-revoke.ts"],"names":[],"mappings":"AAAA,sUAAsU;AAEtU,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,qBAAqB,EAAoD,MAAM,4BAA4B,CAAC;AAC/J,OAAO,EAAE,qBAAqB,EAAyB,MAAM,4BAA4B,CAAC;AAC1F,OAAO,EAAE,mBAAmB,EAA2B,MAAM,kCAAkC,CAAC;AAChG,OAAO,EAAE,aAAa,EAA2B,MAAM,yCAAyC,CAAC;AACjG,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAkBjE,MAAM,UAAU,iBAAiB,CAAC,QAAsC;IACtE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AACtE,CAAC;AAED;2FAC2F;AAC3F,SAAS,YAAY,CAAC,KAAyB,EAAE,KAAa;IAC5D,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;AAChJ,CAAC;AAED,kMAAkM;AAClM,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAW,EAAE,gBAAwB,EAAE,KAAa;IACxF,MAAM,IAAI,GAAG,MAAM,mBAAmB,EAAE,CAAC,4BAA4B,CAAC,GAAG,EAAE,gBAAgB,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5H,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,kBAAkB,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACrH,CAAC;AAED,yKAAyK;AACzK,MAAM,UAAU,kBAAkB,CAAC,QAAsC;IACvE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,oBAAoB,CAAC;IACvD,OAAO;QACL,mCAAmC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,GAAG;QAC7H,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC3D,EAAE;QACF,gJAAgJ;KACjJ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAWD,+WAA+W;AAC/W,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAwB,EACxB,gBAAwB,EACxB,QAAuC,EACvC,KAAa;IAEb,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IACzG,MAAM,KAAK,GAAyB,EAAE,CAAC;IACvC,MAAM,aAAa,GAA0B,EAAE,CAAC;IAChD,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,KAAK,MAAM,OAAO,IAAI,MAAM,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,MAAM,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,gBAAgB,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;YAAE,SAAS;QAC1G,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACzE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,4FAA4F;QAC5F,gGAAgG;QAChG,+CAA+C;QAC/C,aAAa,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,4FAA4F;IAC5F,iGAAiG;IACjG,uBAAuB;IACvB,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;IAC7E,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,qBAAqB,CAAC,aAAa,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;AACnH,CAAC;AAED,sQAAsQ;AACtQ,KAAK,UAAU,iBAAiB,CAAC,GAAW,EAAE,KAAyB,EAAE,KAAa;IACpF,MAAM,GAAG,GAAG,MAAM,mBAAmB,EAAE,CAAC,qBAAqB,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAChF,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,WAAW,CAAC;IACrC,OAAO,MAAM,mBAAmB,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,CAAC,CAAC;AACpE,CAAC"}

package/dist/agent/access/credential-grant-scope.d.ts

@@ -0,0 +1,206 @@
+import { type BindableContext, type WindowGrain } from "../identity/binding.js";
+import type { CredentialGrantMode, CredentialGrantRow } from "../operational/credential-grant-rows.js";
+/** Why a conversation-stable key was NOT admitted for this seat. The two OPE-1972 gates report the
+ *  key they withheld beside the reason, because the mount writes an audit row naming what it refused
+ *  and a reason with no key names nothing.
+ *
+ *  🔴 `non_standing_grain` KEEPS ITS NAME AND WIDENS ITS MEANING (OPE-2012): it is the seat that is
+ *  not the room's own conversation at all — `thread` and `task` — now that `native` is admitted on the
+ *  room key. The word is the audit vocabulary an operator already greps and every stored row already
+ *  carries, so it is not re-spelled for a distinction the rows cannot make retrospectively. */
+export type GrantDomainScopeGate = "unreadable" | "unresolved_mode" | "dm" | "no_domain" | "unattended" | "non_standing_grain" | "ambiguous_domain_name";
+/** What {@link grantDomainScopeVerdict} answers. `scopeKey` rides an ADMITTED verdict, and also the
+ *  two withheld verdicts where a key exists and was refused (`unattended`, `non_standing_grain`) —
+ *  never the five where none was minted (`unreadable`, `unresolved_mode`, `dm`, `no_domain`,
+ *  `ambiguous_domain_name`). */
+export type GrantDomainScopeVerdict = {
+    readonly admitted: true;
+    readonly scopeKey: string;
+} | {
+    readonly admitted: false;
+    readonly gate: GrantDomainScopeGate;
+    readonly scopeKey?: string;
+};
+/**
+ * MAY THIS SEAT REACH A CONVERSATION-STABLE SCOPE KEY, and if not, which gate refused it?
+ *
+ * The key comes from the room's own DECLARED DOMAIN MEMBERSHIP, in one of two shapes decided by the
+ * seat's grain: `oe-grant-domain::<domain name>` for the domain's standing seat, and
+ * `oe-grant-room::<domain name>::<room key>` for a room's own `native` seat (OPE-2012). This function
+ * answers a VERDICT and never `undefined`: an ADMITTED verdict carries the key, and a refused one
+ * carries the gate plus, for the two gates that refuse a key that was minted, the key they withheld —
+ * which is what the mount's `grant.mount_withheld` row names. `grantDomainScopeKey` below is the
+ * flattening every call site reads.
+ *
+ * 🔴 IT IS NOT THE SEAT'S REGISTRY KEY, and that is the correction OPE-1950 needed. An earlier
+ * revision asked `supervisorGrainFor` for the `channel_session` key the room's standing seat rotates
+ * under. That key is byte-identical to the seat's, which reads well — and it exists only where the
+ * `window.topology` capability is ARMED (it ships `false`), and even then is PER-CHANNEL under the
+ * default `solo` window mode. So the owner's ruling — a 30-day tap means 30 days — would have held on
+ * one armed instance and nowhere else. Domain MEMBERSHIP is the thing a room has whatever the
+ * topology gate says, so the binding is read from it and the seat key is not consulted at all.
+ *
+ * 🔴 IT IS THE ROOM'S EXPLICITLY DECLARED DOMAIN, AND THE `org` CATCH-ALL DOES NOT COUNT (Tommy's
+ * ruling on the narrowing, 2026-09-19). `domainForChannel` answers only when an operator named this
+ * room into a domain — through a `reach` entry or a roster — and `undefined` otherwise. The wider
+ * `standingSeatDomainFor` would fall back to the deployment's `org` pseudo-domain, and a room that
+ * reaches that only through the catch-all has no declared domain of its own: binding a standing grant
+ * there would make it spendable in EVERY room of the deployment, which is the widening the ruling
+ * refuses. A room with no declared domain falls back to the asking session for what it may READ —
+ * the exact-session rule, unchanged, which is the fail-closed direction rather than an invented key.
+ * Since OPE-2160 it may MINT no standing grant at all: see `grantScopeKeyForMode`.
+ *
+ * 🔴 A DM OR MPIM ANSWERS `undefined`, AND THAT ARM IS A SECURITY CONTROL RATHER THAN A TIDY-UP. A
+ * domain's `reach` can be workspace-grain (`reach: ["slack/T1"]`), which matches a DM's surface key
+ * as readily as a channel's — so without this a privately-approved standing grant would mount in
+ * every room of the domain, one person's private consent spent by another room's people. A DM keeps
+ * the exact-session rule; binding one to a DM-shaped scope of its own is a separate decision, and
+ * this refuses rather than taking it silently.
+ *
+ * 🔴 AN UNRESOLVED MODE IS REFUSED TOO, because the DM arm above fails OPEN without it.
+ * `bindFrom` GAP-FILLS an unclassified conversation to `"channel"` and says so only through
+ * `modeResolved` (`identity/binding.ts`): a Teams personal chat carrying no `conversationType`, or
+ * any context no platform mapper classified, would otherwise read as a room and mint the domain key.
+ * Requiring the positive flag costs nothing real — every shipped platform mapper returns a mode — and
+ * it closes the one shape where a private conversation could pass for a public one.
+ *
+ * The input is the partition's DOMAIN key, never its surface key: a Discord thread's domain key names
+ * the PARENT channel (`memory/partition.ts` `domainKeyOf`), so a thread binds to the domain its
+ * parent channel is in rather than minting a scope of its own. That collapse is exactly why the
+ * GRAIN gate below exists: without it, a thread of a declared channel reads the channel's key.
+ *
+ * 🔴 NOBODY IN THE ROOM MEANS NO KEY (OPE-1972). A grant is one person's credential spent on another
+ * person's ask, and it audits under both names — so a delivery with no acting principal has nobody to
+ * record as having asked and nobody to read the "acting as <owner>" line. `unattendedFrom` is the
+ * ratified spelling of that question (`identity/binding.ts`, `lint:principal-gate` rule 5 refuses any
+ * other), and it is fail-closed over three independent host-set facts. Before this gate the ONLY
+ * attendance filter on a borrowed tool was `JOB_WAKE_TOOLS`, which covers a durable JOB wake and
+ * nothing else — so a plain one-shot routine fire, which is not a job wake, mounted the domain's
+ * standing grants and could spend the granting person's credential with the room empty.
+ *
+ * 🔴 ATTENDANCE IS THE ONLY GATE A FIRE MEETS ON THE ROOM ARM, AND IT HOLDS WITHOUT A SINGLE STAMP.
+ * On the domain arm a fire is refused twice over — the grain gate below, then attendance — but an
+ * unseated room stamps no grain, so only attendance is left. `hooks/fire-carriage.ts` records the
+ * measured shape that makes this worth stating: on a deployed instance a fire can arrive with its
+ * whole attribute bag gone. `unattendedDelivery`'s third arm reads eve's SCHEDULE AUTH SLOT
+ * (`isScheduleOriginatedAuth` — authenticator, principalId and principalType, never the attributes),
+ * which is the arm written for exactly that case, so a fire that lost every stamp is still unattended.
+ *
+ * 🔴 AND THE GRAIN GATE IS THE OTHER HALF ON THE DOMAIN ARM, because attendance alone does not make a
+ * seat the conversation the card was tapped in. Every triggered fire lands on `thread`
+ * (`routines/fire-window.ts` `TRIGGERED_FIRE_GRAIN`), and so does every real platform thread a seated
+ * deployment stamps — a Notion page comment, a Slack thread reply. Those are attended, and they are
+ * still not the domain's own conversation, so the key is withheld and they keep the exact-session
+ * rule. The measured leak is board #226 leg 51: a standing grant tapped in a Discord room of
+ * `e2e-unified` was spent two hours later by a Notion-comment thread seat of the same domain, on an
+ * ordinary org read. That leak was CROSS-ROOM, which is why the room arm closes it by key rather than
+ * by grain.
+ *
+ * 🔴 AN UNSEATED ROOM TAKES THE OTHER ARM (OPE-2012), and it needs BOTH of its facts. A `native` wake
+ * in a room `windowedSupervisorEnabled` does not seat is that room's own conversation — nothing stands
+ * for it, so the wake keeps eve's own session and classifies `native`, which is exactly the
+ * `native-by-design` posture `access/window-routing.ts` records. It is admitted on the ROOM key, never
+ * the domain one, so it reaches strictly fewer rows than the `standing` arm does: one room of one
+ * domain, where the standing seat reaches every room of it. The board #226 shape was CROSS-ROOM — a
+ * Discord room's grant spent by a Notion-comment seat of the same domain — and those two rooms resolve
+ * two different room keys, so it cannot come back through this arm.
+ *
+ * 🔴 A `native` WAKE IN A SEATED ROOM IS REFUSED, AND THAT ARM IS A SECURITY CONTROL RATHER THAN
+ * TIDINESS. `access/window-routing.ts` records two things that produce one: a routing regression, and
+ * the runtime privacy floor standing the seat down — which is a room that has just been judged to need
+ * its seat stood down, typically because an outsider is present. Minting a 30-day binding there is the
+ * last thing this plane should do, so the seat check runs beside the grain check and such a wake keeps,
+ * for what it READS, the exact-session rule it had before this arm existed — and, since OPE-2160, is
+ * offered no 30-day arm to mint.
+ *
+ * 🔴 THE ROOM KEY DOES NOT EXCLUDE THE ROOM'S THREADS, AND SAYING IT DID WOULD BE THE WORST DEFECT
+ * CLASS HERE. An unseated deployment stamps no `oe_grain` at all, so a thread reply classifies
+ * `native` like every other wake in the room, and `domainKeyOf` collapses a thread onto its parent
+ * room regardless. There is nothing left to tell them apart, so the key names the ROOM — its own
+ * conversation and its threads — and the owner's card (`credential-grant-card.ts`) says exactly that.
+ * The THREAD grain gate below is still the control it was on the domain arm, where a seated
+ * deployment does stamp one.
+ *
+ * 🔴 THE ROOM KEY IS A PAIR, SO IT REFUSES A DOMAIN NAME IT COULD NOT PACK UNAMBIGUOUSLY. The key is
+ * `<domain name>::<room key>`, and a domain name containing `::` would make two different pairs spell
+ * one string — which is the only way this key could ever collide across rooms. Domain names are
+ * operator-chosen and nothing validates them against that shape (`memory/domain.ts`
+ * `assertDomainsValid` refuses one reserved PREFIX and no charset), so the pair is refused here rather
+ * than assumed: `ambiguous_domain_name`, no key, and the seat keeps the exact-session rule for what it
+ * READS while being offered no 30-day arm to mint (OPE-2160). The room
+ * key itself needs no such guard — with a `::`-free first segment the split point is the FIRST `::`
+ * after the prefix, whatever the room key contains.
+ */
+/**
+ * THE GRAIN OF THE CONVERSATION THIS CONTEXT BELONGS TO (OPE-2023), which is the grain this whole rule
+ * asks about — never the grain of the session in hand.
+ *
+ * 🔴 THE TWO DIVERGE ONLY INSIDE A DELEGATED WORKER, and that is the case this exists for. Since
+ * OPE-2023 a lent tool mounts on the WORKERS of the conversation it was lent to, so a worker is what
+ * spends its conversation's grants — while `windowGrainOf` answers `task` for every worker by the
+ * subagent-child override. Asking it here would refuse every worker at `non_standing_grain`, which
+ * would leave both keyed arms reachable by nothing at all; and re-admitting them outside this function
+ * would be a SECOND SPELLING of a rule this file states is spelled once. eve copies the parent's whole
+ * auth bag into the child, so the host's `oe_grain` stamp on a worker describes the SEAT it was
+ * spawned from, and reading it here lets a worker inherit every gate below unchanged — the room arm
+ * and the domain arm alike.
+ *
+ * 🔴 IT WIDENS NOTHING. The stamp is host-set and model-unreachable (channels/unified-window.ts
+ * §AUTH-ATTRIBUTE PROVENANCE), a non-child answers exactly what it answered before, and a child whose
+ * stamp is unreadable falls back to `task`, which both arms refuse. A worker of a THREAD seat still
+ * reads `thread` and is still refused, so the cross-room reach board #226 leg 51 measured stays shut.
+ */
+export declare function conversationGrainOf(ctx: BindableContext): WindowGrain;
+export declare function grantDomainScopeVerdict(ctx: BindableContext): GrantDomainScopeVerdict;
+/** The conversation-stable key this seat may reach — domain-shaped or room-shaped — or `undefined`
+ *  when it may reach none. THE READER EVERY CALL SITE USES — the mint, the mount, the execute backstop
+ *  and the own-account gate — so the rule above moves in one place. Every one of them treats the key
+ *  as OPAQUE and compares it for equality, so the two shapes need no reader of their own; a caller
+ *  that must say WHY takes {@link grantDomainScopeVerdict}, and one that must say HOW WIDE takes
+ *  {@link grantScopeReachOf}. */
+export declare function grantDomainScopeKey(ctx: BindableContext): string | undefined;
+/**
+ * The scope key a grant of `mode` binds to, given the asking session's key and the room's domain key —
+ * or `undefined` when the mode may not be minted against these keys at all.
+ *
+ * 🔴 IT IS DECIDED FROM THE APPROVED MODE, NOT THE REQUESTED ONE. The owner's card offers the
+ * buttons and their answer wins (`access/credential-grant-card.ts`), so an ask raised as `session`
+ * can be approved `standing` and an ask raised as `standing` can be approved `once`. Deciding this
+ * from the requested mode would mint exactly the row the ruling forbids — a standing grant keyed to a
+ * session that rotates out from under it — or, in the other direction, a once-mode grant reachable
+ * from every seat in the domain. The ask row therefore carries BOTH keys and the mint picks here.
+ *
+ * 🔴 A `standing` MODE WITH NO DOMAIN KEY REFUSES, AND THAT IS THE WHOLE OF OPE-2160. It used to fall
+ * back to `sessionScopeKey`, which minted the exact row the paragraph above forbids: the clock still
+ * stamped `GRANT_STANDING_MAX_MS`, so the owner read "30 days" on the card and on the lent tool, and
+ * the row became unreachable the moment the asking seat rotated — 7 days, a 12-hour quiet gap, a turn
+ * or token backstop, or any deploy that changes the eve build. Nobody was told; the audit trail showed
+ * a live, unexpired, unrevoked grant nobody could spend for another 29 days. The fallback is therefore
+ * a REFUSAL, not a narrowing: a 30-day promise is only ever made where the mechanism can keep it. The
+ * owner's card omits the standing arm on such an ask, so this refusal is the belt behind that
+ * control rather than the control itself.
+ */
+export declare function grantScopeKeyForMode(mode: CredentialGrantMode, sessionScopeKey: string, domainScopeKey: string | undefined): string | undefined;
+/**
+ * May the seat identified by `sessionScopeKey` (in the room whose domain key is `domainScopeKey`)
+ * reach `grant`? THE EXECUTE BACKSTOP'S copy of the scope rule, and its only caller is
+ * `credential-grant-broker.ts`.
+ *
+ * 🔴 IT IS NOT THE ONLY SPELLING OF THE RULE, so a change here is half a change. The MOUNT
+ * (`tools/grant_tools.ts`) and the OWN-ACCOUNT GATE (`connections/own-account-gate.ts`) read
+ * `credential-grant-reach.ts` `credentialGrantsInReach`, whose half of the rule lives in two SQL
+ * predicates. Anything that narrows or widens what a seat may reach has to move BOTH.
+ * The OPE-1972 attendance and grain gates are NOT a third spelling: they decide the `domainScopeKey`
+ * this predicate and that SQL are both HANDED, upstream of either, so a seat those gates refuse
+ * arrives here with `undefined` and is already on the exact-session rule.
+ * The two differ on STATE, deliberately: the SQL filters a domain-keyed row to active, unexpired and
+ * unrevoked, while this predicate ignores status entirely, because the broker has already run
+ * `credentialGrantStateRefusal` and a second state test here would refuse with the wrong word.
+ *
+ * 🔴 THE CONVERSATION ARM IS GATED ON `mode === "standing"`. Without that conjunct a once- or
+ * session-mode row that somehow carried a domain- or room-shaped key would be reachable from every
+ * seat that resolves the same key, and the exact-session rule those two modes keep would be decided by
+ * the shape of a string instead of by the mode the owner tapped.
+ */
+export declare function grantScopeAdmits(grant: Pick<CredentialGrantRow, "scopeKey" | "mode">, sessionScopeKey: string, domainScopeKey: string | undefined): boolean;
+//# sourceMappingURL=credential-grant-scope.d.ts.map

package/dist/agent/access/credential-grant-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-grant-scope.d.ts","sourceRoot":"","sources":["../../../agent/access/credential-grant-scope.ts"],"names":[],"mappings":"AAMA,OAAO,EAAyF,KAAK,eAAe,EAAE,KAAK,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAGvK,OAAO,KAAK,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAmCvG;;;;;;;+FAO+F;AAC/F,MAAM,MAAM,oBAAoB,GAAG,YAAY,GAAG,iBAAiB,GAAG,IAAI,GAAG,WAAW,GAAG,YAAY,GAAG,oBAAoB,GAAG,uBAAuB,CAAC;AAEzJ;;;gCAGgC;AAChC,MAAM,MAAM,uBAAuB,GAC/B;IAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAElG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6GG;AACH;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,eAAe,GAAG,WAAW,CAcrE;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,eAAe,GAAG,uBAAuB,CA+BrF;AAED;;;;;iCAKiC;AACjC,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS,CAG5E;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAG/I;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,IAAI,CAAC,kBAAkB,EAAE,UAAU,GAAG,MAAM,CAAC,EACpD,eAAe,EAAE,MAAM,EACvB,cAAc,EAAE,MAAM,GAAG,SAAS,GACjC,OAAO,CAGT"}

package/dist/agent/access/credential-grant-scope.js

@@ -0,0 +1,282 @@
+// What a credential grant BINDS TO, per mode (OPE-1950, narrowed by OPE-1972, extended to the solo topology by OPE-2012). `once` and `session` bind to the asking eve session and die with it; `standing` binds to the OWNER and to THE ROOM'S OWN CONVERSATION, and survives a seat rotation inside it.
+// 🔴 THIS FILE WIDENS ONE AXIS AND NOTHING ELSE. A standing grant still names one org, one owner, one connector, one vendor tool and one frozen-argument set — every one of those rides the ROW, so no lookup here can reach across them. What changes is the scope key alone: a conversation-stable key instead of a session id.
+// 🔴 AND THE KEY NAMES A CONVERSATION, NOT A DOMAIN'S WHOLE TRAFFIC (OPE-1972). A tapped card is one person's consent given in one conversation, so a key is admitted only where that conversation is the one running: an ATTENDED turn on the seat that IS the room's own conversation. A thread seat, a one-shot routine fire and a job wake all carry the room's name and are none of them that conversation, so they keep the exact-session rule for what they READ — and, since OPE-2160, are offered no 30-day arm to mint at all.
+// 🔴 THE ROOM'S OWN CONVERSATION HAS TWO SHAPES, AND WHICH ONE A ROOM HAS DEPENDS ON WHETHER IT IS SEATED (OPE-2012). A room the standing-seat capability SEATS has the domain's STANDING seat as its conversation, and the key names the domain. A room it does not seat — which is every room while `window.topology` is unarmed, the shipped default — has no seat at all (`memory/domain.ts` `windowedSupervisorEnabled`), so its own wake classifies `native` and the key names THAT ROOM: `oe-grant-room::<domain>::<room key>`. Both facts are required, so a `native` wake in a SEATED room (a routing regression, or the runtime privacy floor standing the seat down) mints nothing and keeps the exact-session rule exactly as it did before this arm existed; since OPE-2160 such a seat is offered no 30-day arm either.
+// 🔴 AND THE ROOM KEY'S BOUNDARY IS THE ROOM, THREADS INCLUDED — NOT THE ROOM'S MAIN CONVERSATION. An unseated deployment stamps no grain at all, so a platform thread reply classifies `native` like every other wake, and `domainKeyOf` collapses a thread onto its parent room anyway. Nothing there can tell a thread from the room, so the key claims no boundary it cannot keep. It is still strictly NARROWER than the domain key, which reaches every room declared into the domain — the cross-room reach board #226 leg 51 measured stays shut.
+import { bindFrom, isSubagentChildContext, stampedWindowGrainOf, unattendedFrom, windowGrainOf } from "../identity/binding.js";
+import { domainForChannel, windowedSupervisorEnabled } from "../memory/domain.js";
+import { domainKeyOf, resolvePartition } from "../memory/partition.js";
+import { getConfig } from "./config.js";
+// 🔴 THE KEY'S SHAPE LIVES IN A LEAF MODULE (OPE-2160). A stored ROW has to read the same shapes —
+// `operational/credential-grant-rows.ts` states a span against them — and importing THIS module from
+// there would close a cycle through `memory/domain.ts`. The prefixes are spelled once, over there.
+import { GRANT_DOMAIN_KEY_PREFIX, GRANT_KEY_SEGMENT_SEPARATOR, GRANT_ROOM_KEY_PREFIX, } from "./credential-grant-key-shape.js";
+/**
+ * THE GRAIN THAT IS A SEATED ROOM'S OWN CONVERSATION (OPE-1972) — the domain's STANDING seat, which
+ * is the only seat that spans a domain's rooms.
+ *
+ * 🔴 IT IS A WHITELIST, NOT A BLACKLIST OF THE GRAINS WE HAPPEN TO KNOW ABOUT. `thread` is the grain
+ * every triggered fire lands on (`routines/fire-window.ts` `TRIGGERED_FIRE_GRAIN`) as well as every
+ * thread a seated deployment stamps, and `task` is the delegated worker. Naming the admitted grains
+ * means a fifth grain refuses rather than inherits.
+ */
+const GRANT_CONVERSATION_GRAIN = "standing";
+/**
+ * THE GRAIN AN UNSEATED ROOM'S OWN CONVERSATION CARRIES (OPE-2012) — everything, because an unseated
+ * deployment stamps no grain and every token it mints classifies `native`.
+ *
+ * 🔴 IT IS ADMITTED ON A NARROWER KEY, AND ONLY WHERE THE ROOM HAS NO SEAT, WHICH IS WHY IT IS
+ * ADMITTED AT ALL. `native` is also what an unclassifiable token fail-softs to (`identity/binding.ts`
+ * `classifyTokenGrain`), so admitting it on the DOMAIN key would hand a lost stamp the whole domain's
+ * grants. It reaches one room instead. It does NOT exclude that room's threads: there is nothing on
+ * an unseated deployment that could tell one from the room, so the room is the smallest unit this
+ * key can honestly name.
+ */
+const GRANT_ROOM_GRAIN = "native";
+/**
+ * MAY THIS SEAT REACH A CONVERSATION-STABLE SCOPE KEY, and if not, which gate refused it?
+ *
+ * The key comes from the room's own DECLARED DOMAIN MEMBERSHIP, in one of two shapes decided by the
+ * seat's grain: `oe-grant-domain::<domain name>` for the domain's standing seat, and
+ * `oe-grant-room::<domain name>::<room key>` for a room's own `native` seat (OPE-2012). This function
+ * answers a VERDICT and never `undefined`: an ADMITTED verdict carries the key, and a refused one
+ * carries the gate plus, for the two gates that refuse a key that was minted, the key they withheld —
+ * which is what the mount's `grant.mount_withheld` row names. `grantDomainScopeKey` below is the
+ * flattening every call site reads.
+ *
+ * 🔴 IT IS NOT THE SEAT'S REGISTRY KEY, and that is the correction OPE-1950 needed. An earlier
+ * revision asked `supervisorGrainFor` for the `channel_session` key the room's standing seat rotates
+ * under. That key is byte-identical to the seat's, which reads well — and it exists only where the
+ * `window.topology` capability is ARMED (it ships `false`), and even then is PER-CHANNEL under the
+ * default `solo` window mode. So the owner's ruling — a 30-day tap means 30 days — would have held on
+ * one armed instance and nowhere else. Domain MEMBERSHIP is the thing a room has whatever the
+ * topology gate says, so the binding is read from it and the seat key is not consulted at all.
+ *
+ * 🔴 IT IS THE ROOM'S EXPLICITLY DECLARED DOMAIN, AND THE `org` CATCH-ALL DOES NOT COUNT (Tommy's
+ * ruling on the narrowing, 2026-09-19). `domainForChannel` answers only when an operator named this
+ * room into a domain — through a `reach` entry or a roster — and `undefined` otherwise. The wider
+ * `standingSeatDomainFor` would fall back to the deployment's `org` pseudo-domain, and a room that
+ * reaches that only through the catch-all has no declared domain of its own: binding a standing grant
+ * there would make it spendable in EVERY room of the deployment, which is the widening the ruling
+ * refuses. A room with no declared domain falls back to the asking session for what it may READ —
+ * the exact-session rule, unchanged, which is the fail-closed direction rather than an invented key.
+ * Since OPE-2160 it may MINT no standing grant at all: see `grantScopeKeyForMode`.
+ *
+ * 🔴 A DM OR MPIM ANSWERS `undefined`, AND THAT ARM IS A SECURITY CONTROL RATHER THAN A TIDY-UP. A
+ * domain's `reach` can be workspace-grain (`reach: ["slack/T1"]`), which matches a DM's surface key
+ * as readily as a channel's — so without this a privately-approved standing grant would mount in
+ * every room of the domain, one person's private consent spent by another room's people. A DM keeps
+ * the exact-session rule; binding one to a DM-shaped scope of its own is a separate decision, and
+ * this refuses rather than taking it silently.
+ *
+ * 🔴 AN UNRESOLVED MODE IS REFUSED TOO, because the DM arm above fails OPEN without it.
+ * `bindFrom` GAP-FILLS an unclassified conversation to `"channel"` and says so only through
+ * `modeResolved` (`identity/binding.ts`): a Teams personal chat carrying no `conversationType`, or
+ * any context no platform mapper classified, would otherwise read as a room and mint the domain key.
+ * Requiring the positive flag costs nothing real — every shipped platform mapper returns a mode — and
+ * it closes the one shape where a private conversation could pass for a public one.
+ *
+ * The input is the partition's DOMAIN key, never its surface key: a Discord thread's domain key names
+ * the PARENT channel (`memory/partition.ts` `domainKeyOf`), so a thread binds to the domain its
+ * parent channel is in rather than minting a scope of its own. That collapse is exactly why the
+ * GRAIN gate below exists: without it, a thread of a declared channel reads the channel's key.
+ *
+ * 🔴 NOBODY IN THE ROOM MEANS NO KEY (OPE-1972). A grant is one person's credential spent on another
+ * person's ask, and it audits under both names — so a delivery with no acting principal has nobody to
+ * record as having asked and nobody to read the "acting as <owner>" line. `unattendedFrom` is the
+ * ratified spelling of that question (`identity/binding.ts`, `lint:principal-gate` rule 5 refuses any
+ * other), and it is fail-closed over three independent host-set facts. Before this gate the ONLY
+ * attendance filter on a borrowed tool was `JOB_WAKE_TOOLS`, which covers a durable JOB wake and
+ * nothing else — so a plain one-shot routine fire, which is not a job wake, mounted the domain's
+ * standing grants and could spend the granting person's credential with the room empty.
+ *
+ * 🔴 ATTENDANCE IS THE ONLY GATE A FIRE MEETS ON THE ROOM ARM, AND IT HOLDS WITHOUT A SINGLE STAMP.
+ * On the domain arm a fire is refused twice over — the grain gate below, then attendance — but an
+ * unseated room stamps no grain, so only attendance is left. `hooks/fire-carriage.ts` records the
+ * measured shape that makes this worth stating: on a deployed instance a fire can arrive with its
+ * whole attribute bag gone. `unattendedDelivery`'s third arm reads eve's SCHEDULE AUTH SLOT
+ * (`isScheduleOriginatedAuth` — authenticator, principalId and principalType, never the attributes),
+ * which is the arm written for exactly that case, so a fire that lost every stamp is still unattended.
+ *
+ * 🔴 AND THE GRAIN GATE IS THE OTHER HALF ON THE DOMAIN ARM, because attendance alone does not make a
+ * seat the conversation the card was tapped in. Every triggered fire lands on `thread`
+ * (`routines/fire-window.ts` `TRIGGERED_FIRE_GRAIN`), and so does every real platform thread a seated
+ * deployment stamps — a Notion page comment, a Slack thread reply. Those are attended, and they are
+ * still not the domain's own conversation, so the key is withheld and they keep the exact-session
+ * rule. The measured leak is board #226 leg 51: a standing grant tapped in a Discord room of
+ * `e2e-unified` was spent two hours later by a Notion-comment thread seat of the same domain, on an
+ * ordinary org read. That leak was CROSS-ROOM, which is why the room arm closes it by key rather than
+ * by grain.
+ *
+ * 🔴 AN UNSEATED ROOM TAKES THE OTHER ARM (OPE-2012), and it needs BOTH of its facts. A `native` wake
+ * in a room `windowedSupervisorEnabled` does not seat is that room's own conversation — nothing stands
+ * for it, so the wake keeps eve's own session and classifies `native`, which is exactly the
+ * `native-by-design` posture `access/window-routing.ts` records. It is admitted on the ROOM key, never
+ * the domain one, so it reaches strictly fewer rows than the `standing` arm does: one room of one
+ * domain, where the standing seat reaches every room of it. The board #226 shape was CROSS-ROOM — a
+ * Discord room's grant spent by a Notion-comment seat of the same domain — and those two rooms resolve
+ * two different room keys, so it cannot come back through this arm.
+ *
+ * 🔴 A `native` WAKE IN A SEATED ROOM IS REFUSED, AND THAT ARM IS A SECURITY CONTROL RATHER THAN
+ * TIDINESS. `access/window-routing.ts` records two things that produce one: a routing regression, and
+ * the runtime privacy floor standing the seat down — which is a room that has just been judged to need
+ * its seat stood down, typically because an outsider is present. Minting a 30-day binding there is the
+ * last thing this plane should do, so the seat check runs beside the grain check and such a wake keeps,
+ * for what it READS, the exact-session rule it had before this arm existed — and, since OPE-2160, is
+ * offered no 30-day arm to mint.
+ *
+ * 🔴 THE ROOM KEY DOES NOT EXCLUDE THE ROOM'S THREADS, AND SAYING IT DID WOULD BE THE WORST DEFECT
+ * CLASS HERE. An unseated deployment stamps no `oe_grain` at all, so a thread reply classifies
+ * `native` like every other wake in the room, and `domainKeyOf` collapses a thread onto its parent
+ * room regardless. There is nothing left to tell them apart, so the key names the ROOM — its own
+ * conversation and its threads — and the owner's card (`credential-grant-card.ts`) says exactly that.
+ * The THREAD grain gate below is still the control it was on the domain arm, where a seated
+ * deployment does stamp one.
+ *
+ * 🔴 THE ROOM KEY IS A PAIR, SO IT REFUSES A DOMAIN NAME IT COULD NOT PACK UNAMBIGUOUSLY. The key is
+ * `<domain name>::<room key>`, and a domain name containing `::` would make two different pairs spell
+ * one string — which is the only way this key could ever collide across rooms. Domain names are
+ * operator-chosen and nothing validates them against that shape (`memory/domain.ts`
+ * `assertDomainsValid` refuses one reserved PREFIX and no charset), so the pair is refused here rather
+ * than assumed: `ambiguous_domain_name`, no key, and the seat keeps the exact-session rule for what it
+ * READS while being offered no 30-day arm to mint (OPE-2160). The room
+ * key itself needs no such guard — with a `::`-free first segment the split point is the FIRST `::`
+ * after the prefix, whatever the room key contains.
+ */
+/**
+ * THE GRAIN OF THE CONVERSATION THIS CONTEXT BELONGS TO (OPE-2023), which is the grain this whole rule
+ * asks about — never the grain of the session in hand.
+ *
+ * 🔴 THE TWO DIVERGE ONLY INSIDE A DELEGATED WORKER, and that is the case this exists for. Since
+ * OPE-2023 a lent tool mounts on the WORKERS of the conversation it was lent to, so a worker is what
+ * spends its conversation's grants — while `windowGrainOf` answers `task` for every worker by the
+ * subagent-child override. Asking it here would refuse every worker at `non_standing_grain`, which
+ * would leave both keyed arms reachable by nothing at all; and re-admitting them outside this function
+ * would be a SECOND SPELLING of a rule this file states is spelled once. eve copies the parent's whole
+ * auth bag into the child, so the host's `oe_grain` stamp on a worker describes the SEAT it was
+ * spawned from, and reading it here lets a worker inherit every gate below unchanged — the room arm
+ * and the domain arm alike.
+ *
+ * 🔴 IT WIDENS NOTHING. The stamp is host-set and model-unreachable (channels/unified-window.ts
+ * §AUTH-ATTRIBUTE PROVENANCE), a non-child answers exactly what it answered before, and a child whose
+ * stamp is unreadable falls back to `task`, which both arms refuse. A worker of a THREAD seat still
+ * reads `thread` and is still refused, so the cross-room reach board #226 leg 51 measured stays shut.
+ */
+export function conversationGrainOf(ctx) {
+    if (!isSubagentChildContext(ctx))
+        return windowGrainOf(ctx);
+    // 🔴 AN ABSENT STAMP FALLS TO THE ROOM GRAIN, NOT TO `task` (cold review). An UNSEATED deployment —
+    // the shipped default — stamps no grain at all: `stampUnifiedWindowAuth` is the writer and
+    // `windowEnabledFor` only diverts a surface `windowedSupervisorEnabled` seats, so an unseated seat's
+    // own grain comes from its TOKEN. A child does not inherit that token, so an absent stamp inside a
+    // child means the PARENT carried none, and only an unseated room produces that. Falling back to
+    // `windowGrainOf` would answer `task` for every such worker, close the ROOM arm, and leave OPE-2012's
+    // 30-day survival dead on the default deployment — neither mintable nor spendable.
+    // It widens nothing. The DOMAIN arm needs a positive `standing` stamp, and the ROOM arm below
+    // independently requires `!windowedSupervisorEnabled(roomKey, domains)` — a seated room always
+    // stamps, so an unstamped child there reads `native`, fails the room arm on seating, and is refused
+    // `non_standing_grain` exactly as it was.
+    return stampedWindowGrainOf(ctx) ?? GRANT_ROOM_GRAIN;
+}
+export function grantDomainScopeVerdict(ctx) {
+    try {
+        const binding = bindFrom(ctx);
+        // PROVENANCE FIRST: a gap-filled mode is not a classification, and the DM arm below is only a
+        // control while the value it reads was actually answered by a mapper.
+        if (binding.modeResolved !== true)
+            return { admitted: false, gate: "unresolved_mode" };
+        if (binding.mode === "dm" || binding.mode === "mpim")
+            return { admitted: false, gate: "dm" };
+        const roomKey = domainKeyOf(resolvePartition(ctx));
+        const domains = getConfig().loadDomains();
+        const domain = domainForChannel(roomKey, domains);
+        if (domain === undefined || domain.name.length === 0)
+            return { admitted: false, gate: "no_domain" };
+        // WHICH SHAPE OF KEY THIS SEAT WOULD REACH (OPE-2012). The ROOM arm needs BOTH facts: a `native`
+        // grain AND a room that has NO standing seat, which is the same question `access/window-routing.ts`
+        // asks to call such a wake `native-by-design`. Every other case is measured against the domain arm,
+        // so a refused thread, task or seat-down wake still reports the DOMAIN key it was withheld — the
+        // reach an operator reading the audit row needs to see.
+        const grain = conversationGrainOf(ctx);
+        const roomArm = grain === GRANT_ROOM_GRAIN && !windowedSupervisorEnabled(roomKey, domains);
+        if (roomArm && domain.name.includes(GRANT_KEY_SEGMENT_SEPARATOR))
+            return { admitted: false, gate: "ambiguous_domain_name" };
+        const scopeKey = roomArm
+            ? `${GRANT_ROOM_KEY_PREFIX}${domain.name}${GRANT_KEY_SEGMENT_SEPARATOR}${roomKey}`
+            : `${GRANT_DOMAIN_KEY_PREFIX}${domain.name}`;
+        // THE TWO OPE-1972 GATES, and they run LAST so each reports the key it withheld. The gates above
+        // mint no key at all, so there is nothing for them to name.
+        if (unattendedFrom(binding))
+            return { admitted: false, gate: "unattended", scopeKey };
+        if (!roomArm && grain !== GRANT_CONVERSATION_GRAIN)
+            return { admitted: false, gate: "non_standing_grain", scopeKey };
+        return { admitted: true, scopeKey };
+    }
+    catch {
+        // An unreadable binding, partition, grain or domain config leaves the caller on the session key. Fail closed.
+        return { admitted: false, gate: "unreadable" };
+    }
+}
+/** The conversation-stable key this seat may reach — domain-shaped or room-shaped — or `undefined`
+ *  when it may reach none. THE READER EVERY CALL SITE USES — the mint, the mount, the execute backstop
+ *  and the own-account gate — so the rule above moves in one place. Every one of them treats the key
+ *  as OPAQUE and compares it for equality, so the two shapes need no reader of their own; a caller
+ *  that must say WHY takes {@link grantDomainScopeVerdict}, and one that must say HOW WIDE takes
+ *  {@link grantScopeReachOf}. */
+export function grantDomainScopeKey(ctx) {
+    const verdict = grantDomainScopeVerdict(ctx);
+    return verdict.admitted ? verdict.scopeKey : undefined;
+}
+/**
+ * The scope key a grant of `mode` binds to, given the asking session's key and the room's domain key —
+ * or `undefined` when the mode may not be minted against these keys at all.
+ *
+ * 🔴 IT IS DECIDED FROM THE APPROVED MODE, NOT THE REQUESTED ONE. The owner's card offers the
+ * buttons and their answer wins (`access/credential-grant-card.ts`), so an ask raised as `session`
+ * can be approved `standing` and an ask raised as `standing` can be approved `once`. Deciding this
+ * from the requested mode would mint exactly the row the ruling forbids — a standing grant keyed to a
+ * session that rotates out from under it — or, in the other direction, a once-mode grant reachable
+ * from every seat in the domain. The ask row therefore carries BOTH keys and the mint picks here.
+ *
+ * 🔴 A `standing` MODE WITH NO DOMAIN KEY REFUSES, AND THAT IS THE WHOLE OF OPE-2160. It used to fall
+ * back to `sessionScopeKey`, which minted the exact row the paragraph above forbids: the clock still
+ * stamped `GRANT_STANDING_MAX_MS`, so the owner read "30 days" on the card and on the lent tool, and
+ * the row became unreachable the moment the asking seat rotated — 7 days, a 12-hour quiet gap, a turn
+ * or token backstop, or any deploy that changes the eve build. Nobody was told; the audit trail showed
+ * a live, unexpired, unrevoked grant nobody could spend for another 29 days. The fallback is therefore
+ * a REFUSAL, not a narrowing: a 30-day promise is only ever made where the mechanism can keep it. The
+ * owner's card omits the standing arm on such an ask, so this refusal is the belt behind that
+ * control rather than the control itself.
+ */
+export function grantScopeKeyForMode(mode, sessionScopeKey, domainScopeKey) {
+    if (mode !== "standing")
+        return sessionScopeKey;
+    return domainScopeKey !== undefined && domainScopeKey.length > 0 ? domainScopeKey : undefined;
+}
+/**
+ * May the seat identified by `sessionScopeKey` (in the room whose domain key is `domainScopeKey`)
+ * reach `grant`? THE EXECUTE BACKSTOP'S copy of the scope rule, and its only caller is
+ * `credential-grant-broker.ts`.
+ *
+ * 🔴 IT IS NOT THE ONLY SPELLING OF THE RULE, so a change here is half a change. The MOUNT
+ * (`tools/grant_tools.ts`) and the OWN-ACCOUNT GATE (`connections/own-account-gate.ts`) read
+ * `credential-grant-reach.ts` `credentialGrantsInReach`, whose half of the rule lives in two SQL
+ * predicates. Anything that narrows or widens what a seat may reach has to move BOTH.
+ * The OPE-1972 attendance and grain gates are NOT a third spelling: they decide the `domainScopeKey`
+ * this predicate and that SQL are both HANDED, upstream of either, so a seat those gates refuse
+ * arrives here with `undefined` and is already on the exact-session rule.
+ * The two differ on STATE, deliberately: the SQL filters a domain-keyed row to active, unexpired and
+ * unrevoked, while this predicate ignores status entirely, because the broker has already run
+ * `credentialGrantStateRefusal` and a second state test here would refuse with the wrong word.
+ *
+ * 🔴 THE CONVERSATION ARM IS GATED ON `mode === "standing"`. Without that conjunct a once- or
+ * session-mode row that somehow carried a domain- or room-shaped key would be reachable from every
+ * seat that resolves the same key, and the exact-session rule those two modes keep would be decided by
+ * the shape of a string instead of by the mode the owner tapped.
+ */
+export function grantScopeAdmits(grant, sessionScopeKey, domainScopeKey) {
+    if (sessionScopeKey.length > 0 && grant.scopeKey === sessionScopeKey)
+        return true;
+    return grant.mode === "standing" && domainScopeKey !== undefined && domainScopeKey.length > 0 && grant.scopeKey === domainScopeKey;
+}
+//# sourceMappingURL=credential-grant-scope.js.map

package/dist/agent/access/credential-grant-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-grant-scope.js","sourceRoot":"","sources":["../../../agent/access/credential-grant-scope.ts"],"names":[],"mappings":"AAAA,ySAAyS;AACzS,kUAAkU;AAClU,ygBAAygB;AACzgB,syBAAsyB;AACtyB,0hBAA0hB;AAE1hB,OAAO,EAAE,QAAQ,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,cAAc,EAAE,aAAa,EAA0C,MAAM,wBAAwB,CAAC;AACvK,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAClF,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAEvE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,mGAAmG;AACnG,qGAAqG;AACrG,mGAAmG;AACnG,OAAO,EACL,uBAAuB,EACvB,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,iCAAiC,CAAC;AAEzC;;;;;;;;GAQG;AACH,MAAM,wBAAwB,GAAgB,UAAU,CAAC;AAEzD;;;;;;;;;;GAUG;AACH,MAAM,gBAAgB,GAAgB,QAAQ,CAAC;AAoB/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6GG;AACH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAoB;IACtD,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC;QAAE,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;IAC5D,oGAAoG;IACpG,2FAA2F;IAC3F,qGAAqG;IACrG,mGAAmG;IACnG,gGAAgG;IAChG,sGAAsG;IACtG,mFAAmF;IACnF,8FAA8F;IAC9F,+FAA+F;IAC/F,oGAAoG;IACpG,0CAA0C;IAC1C,OAAO,oBAAoB,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,GAAoB;IAC1D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC9B,8FAA8F;QAC9F,sEAAsE;QACtE,IAAI,OAAO,CAAC,YAAY,KAAK,IAAI;YAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;QACvF,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC7F,MAAM,OAAO,GAAG,WAAW,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACpG,iGAAiG;QACjG,oGAAoG;QACpG,oGAAoG;QACpG,iGAAiG;QACjG,wDAAwD;QACxD,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,KAAK,KAAK,gBAAgB,IAAI,CAAC,yBAAyB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC3F,IAAI,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,2BAA2B,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;QAC5H,MAAM,QAAQ,GAAG,OAAO;YACtB,CAAC,CAAC,GAAG,qBAAqB,GAAG,MAAM,CAAC,IAAI,GAAG,2BAA2B,GAAG,OAAO,EAAE;YAClF,CAAC,CAAC,GAAG,uBAAuB,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC/C,iGAAiG;QACjG,4DAA4D;QAC5D,IAAI,cAAc,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;QACtF,IAAI,CAAC,OAAO,IAAI,KAAK,KAAK,wBAAwB;YAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,CAAC;QACrH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,8GAA8G;QAC9G,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IACjD,CAAC;AACH,CAAC;AAED;;;;;iCAKiC;AACjC,MAAM,UAAU,mBAAmB,CAAC,GAAoB;IACtD,MAAM,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC7C,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAyB,EAAE,eAAuB,EAAE,cAAkC;IACzH,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,eAAe,CAAC;IAChD,OAAO,cAAc,KAAK,SAAS,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;AAChG,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAoD,EACpD,eAAuB,EACvB,cAAkC;IAElC,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,KAAK,eAAe;QAAE,OAAO,IAAI,CAAC;IAClF,OAAO,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,KAAK,cAAc,CAAC;AACrI,CAAC"}