@open-everywhere/core 0.1.0

package/dist/agent/access/eve-patch-probe-boot.js

@@ -0,0 +1,91 @@
+// The BOOT SIDE EFFECT of the unpatched-eve refusal (OPE-2182). Import this module for effect and
+// nothing else; every decision it takes lives in `eve-patch-probe.ts`, which stays pure so a test
+// can drive each missing part without a process that refuses to start.
+//
+// 🔴 THE TOP-LEVEL `await` IS THE MECHANISM, NOT A STYLE CHOICE. A module-evaluation throw is what
+// "refuses to boot" means here: every importer's evaluation fails, so the channel never mounts, the
+// agent root never finishes loading, and NO wake is served. A probe that merely set a flag would
+// leave the refusal up to whoever remembered to read it, which is the silent shape this ticket
+// closes.
+//
+// WHAT IT COSTS, PLAINLY. One eve-carrier load, about 0.7 s, once per process. A process that
+// serves a turn pays that load anyway and only pays it EARLIER. A process that never takes a turn
+// pays it as NEW cost, and most of the test chain is exactly that: `channels/unified.ts` is
+// imported by 40-odd core modules, so many suites now load four eve dist files they never needed.
+// That is the accepted price of deciding the question before the first wake rather than after it.
+//
+// WHERE IT IS IMPORTED, and why more than one place: `agent/agent.ts` is THIS deployment's boot
+// root, and `agent/channels/unified.ts` + `agent/channels/webhooks.ts` are core's two wake doors,
+// which is what an npm consumer of `@open-everywhere/core` mounts instead of our agent root. A
+// consumer cannot serve a wake through core without loading one of the two channels.
+//
+// 🔴 THE AUDIT ROW IS BEST-EFFORT AND USUALLY LOST — STDERR AND THE THROW ARE THE RECORD. This
+// module evaluates at its FIRST position in the import graph, not where an agent root lists it:
+// `agent/lib/register-config.js` reaches it transitively (measured — importing that module alone
+// publishes the markers), so it runs BEFORE `register-adapters.js` arms the operational store. A
+// row written then has no store to land in. `appendAudit` is contractually non-throwing, but its
+// provider can throw under a configured backend, so both calls are wrapped as well: the refusal
+// message must reach stderr and the throw must propagate even when the audit plane cannot answer.
+// Do NOT reorder anything to arm the store first — the throw is the mechanism, and it must not wait.
+//
+// The audit names are written as LITERALS at each call below, never through a helper that forwards
+// an `action` parameter: `lint:audit-actions` reads the write sites statically, and a forwarding
+// helper is a "road" it refuses until the road itself is declared.
+//
+// This closes the node_modules install. The INLINED hosted build is closed at the turn edge instead
+// — `hooks/eve-patch-gate.ts`, which needs no path to resolve. Neither path serves a wake on an
+// unpatched eve.
+import { appendAudit } from "../audit/audit.js";
+import { deploymentOrg } from "../identity/deployment-identity.js";
+import { assertEvePatched } from "./eve-patch-probe.js";
+try {
+    const result = await assertEvePatched();
+    if (result.status === "unverifiable") {
+        // Not a refusal, and NOT the end of the check — see eve-patch-probe.ts's header. The eve
+        // package root does not resolve here, which is expected on a hosted build that inlines eve.
+        // `hooks/eve-patch-gate.ts` re-asks at `turn.started`, where the carriers have evaluated and no
+        // path is needed, so an unpatched inlined build fails its first turn rather than serving it.
+        // The `test` chain (`lint:eve-patch`, `test:eve-install`) is the earlier control; nothing in
+        // `npm run build` itself re-checks the eve bytes.
+        console.warn(`[open-everywhere:eve-patch-probe:boot] eve patch state UNVERIFIABLE at boot — the eve package ` +
+            `root did not resolve (${result.reason ?? "unknown reason"}), which is expected on a hosted ` +
+            `build that inlines eve. This is NOT a pass: the turn gate (hooks/eve-patch-gate.ts) re-checks ` +
+            `the markers at turn.started and refuses the turn if any is missing. A node_modules install is ` +
+            `verified here; \`lint:eve-patch\` and \`test:eve-install\` verify the bytes before a deploy.`);
+        try {
+            await appendAudit({
+                org: deploymentOrg(),
+                platform: "boot",
+                workspace: "boot",
+                action: "eve.patch.unverifiable",
+                detail: { reason: result.reason ?? "unknown" },
+            });
+        }
+        catch {
+            /* the warn above is the record — see this file's header on the unarmed store */
+        }
+    }
+}
+catch (err) {
+    // The refusal reaches stderr FIRST: the re-throw below aborts this module's evaluation, and an
+    // operator reading a cold-start crash sees the framework's error, not necessarily ours. stderr is
+    // also the only channel that certainly works — a refusal can land before the audit plane is up.
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(message);
+    // The row is attempted AFTER the message is on stderr and its failure is swallowed, so nothing
+    // between here and the re-throw can suppress either the message or the refusal.
+    try {
+        await appendAudit({
+            org: deploymentOrg(),
+            platform: "boot",
+            workspace: "boot",
+            action: "eve.patch.refused",
+            detail: { message },
+        });
+    }
+    catch {
+        /* the stderr line above is the record — see this file's header */
+    }
+    throw err;
+}
+//# sourceMappingURL=eve-patch-probe-boot.js.map

package/dist/agent/access/eve-patch-probe-boot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eve-patch-probe-boot.js","sourceRoot":"","sources":["../../../agent/access/eve-patch-probe-boot.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,kGAAkG;AAClG,uEAAuE;AACvE,EAAE;AACF,mGAAmG;AACnG,oGAAoG;AACpG,iGAAiG;AACjG,+FAA+F;AAC/F,UAAU;AACV,EAAE;AACF,8FAA8F;AAC9F,kGAAkG;AAClG,4FAA4F;AAC5F,kGAAkG;AAClG,kGAAkG;AAClG,EAAE;AACF,gGAAgG;AAChG,kGAAkG;AAClG,+FAA+F;AAC/F,qFAAqF;AACrF,EAAE;AACF,+FAA+F;AAC/F,gGAAgG;AAChG,iGAAiG;AACjG,iGAAiG;AACjG,iGAAiG;AACjG,gGAAgG;AAChG,kGAAkG;AAClG,qGAAqG;AACrG,EAAE;AACF,mGAAmG;AACnG,iGAAiG;AACjG,mEAAmE;AACnE,EAAE;AACF,oGAAoG;AACpG,gGAAgG;AAChG,iBAAiB;AAEjB,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,IAAI,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,EAAE,CAAC;IACxC,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QACrC,yFAAyF;QACzF,4FAA4F;QAC5F,gGAAgG;QAChG,6FAA6F;QAC7F,6FAA6F;QAC7F,kDAAkD;QAClD,OAAO,CAAC,IAAI,CACV,gGAAgG;YAC9F,yBAAyB,MAAM,CAAC,MAAM,IAAI,gBAAgB,mCAAmC;YAC7F,gGAAgG;YAChG,gGAAgG;YAChG,8FAA8F,CACjG,CAAC;QACF,IAAI,CAAC;YACH,MAAM,WAAW,CAAC;gBAChB,GAAG,EAAE,aAAa,EAAE;gBACpB,QAAQ,EAAE,MAAM;gBAChB,SAAS,EAAE,MAAM;gBACjB,MAAM,EAAE,wBAAwB;gBAChC,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,SAAS,EAAE;aAC/C,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,gFAAgF;QAClF,CAAC;IACH,CAAC;AACH,CAAC;AAAC,OAAO,GAAG,EAAE,CAAC;IACb,+FAA+F;IAC/F,kGAAkG;IAClG,gGAAgG;IAChG,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvB,+FAA+F;IAC/F,gFAAgF;IAChF,IAAI,CAAC;QACH,MAAM,WAAW,CAAC;YAChB,GAAG,EAAE,aAAa,EAAE;YACpB,QAAQ,EAAE,MAAM;YAChB,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,mBAAmB;YAC3B,MAAM,EAAE,EAAE,OAAO,EAAE;SACpB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;IACpE,CAAC;IACD,MAAM,GAAG,CAAC;AACZ,CAAC"}

package/dist/agent/access/eve-patch-probe.d.ts

@@ -0,0 +1,57 @@
+/** One live patch part: the marker its hunk publishes, and what the tree loses without it. */
+export interface EvePatchPart {
+    /** The patch's own stable part number — see `patches/eve+<pin>.patch` and the re-roll skill. */
+    readonly part: number;
+    /** The `globalThis` name the part's hunk sets to `true` when its bytes load. */
+    readonly marker: string;
+    /** The eve dist file the hunk edits, relative to the eve package root. */
+    readonly carrier: string;
+    /** What is silently lost when the part is absent — this is what the refusal message prints. */
+    readonly lost: string;
+}
+/** The seven live parts, in patch order. 🔴 A part added to `patches/` without a row here boots a
+ *  tree the probe believes is patched, so `eve-install-integrity-test.ts` cross-checks this table
+ *  against the committed patch file in both directions. Part 2 (turnPolicy carriage) and part 3
+ *  (the compaction trigger anchor) are RETIRED upstream and deliberately absent; the numbers are
+ *  stable identifiers and are never reused. */
+export declare const EVE_PATCH_PARTS: readonly EvePatchPart[];
+/** The distinct carrier files, so the probe imports each one exactly once. */
+export declare const EVE_PATCH_CARRIERS: readonly string[];
+/** What the probe concluded. `unpatched` is the only state {@link assertEvePatched} throws on;
+ *  `unverifiable` is the inlined hosted build this file's header describes. */
+export type EvePatchProbeStatus = "patched" | "unpatched" | "unverifiable";
+export interface EvePatchProbeResult {
+    readonly status: EvePatchProbeStatus;
+    readonly missing: readonly EvePatchPart[];
+    /** Why the eve package root could not be resolved, on `unverifiable` only. */
+    readonly reason?: string;
+}
+/** The marker names a carrier publishes, so a caller can reason about one file at a time. */
+export type MarkerGlobals = Readonly<Record<string, unknown>>;
+/** The parts whose marker is not `true` on `globals`. Pure, so a test can drive every subset. */
+export declare function missingEvePatchParts(globals: MarkerGlobals): readonly EvePatchPart[];
+/** The eve package root, resolved through the one path eve's exports map allows. Throws on a
+ *  hosted build that inlines eve and ships no `node_modules/eve` — the caller treats that throw as
+ *  the `unverifiable` state, never as a refusal. */
+export declare function defaultEvePackageRoot(): string;
+/** The refusal text: which parts are missing, what each one costs, the pinned version, and the fix. */
+export declare function evePatchRefusal(missing: readonly EvePatchPart[]): string;
+/** Load every carrier so its marker is published, then report what is still missing. The carrier
+ *  imports are best-effort per file: a carrier that fails to load leaves its own marker unset,
+ *  which is the refusal this probe exists to raise, so the failure needs no separate channel. */
+export declare function probeEvePatch(rootFn?: () => string, globals?: MarkerGlobals): Promise<EvePatchProbeResult>;
+/** Throw unless every live patch part is present. The `unverifiable` state does NOT throw at BOOT —
+ *  {@link assertEvePatchedAtTurn} is what closes that case, at the one point where the carriers have
+ *  certainly evaluated. */
+export declare function assertEvePatched(rootFn?: () => string, globals?: MarkerGlobals): Promise<EvePatchProbeResult>;
+/** Reset the turn gate's memo. Tests only — production has no reason to re-ask a settled process. */
+export declare function _resetEvePatchTurnCheckForTest(): void;
+/** Whether the turn gate has passed in this process. Exists so a test can prove the HOOK FIRED on a
+ *  real host: reset the memo, drive one turn, read this. It is the only externally visible trace the
+ *  gate leaves — it deliberately writes no audit row, because the gate must not depend on a store
+ *  that may not be armed, and a row on the passing path would be noise on every turn. */
+export declare function evePatchTurnCheckHasPassed(): boolean;
+/** Throw unless every live part's marker is on `globals`. Synchronous and allocation-free once it
+ *  has passed, because it runs on every turn's first hook edge. */
+export declare function assertEvePatchedAtTurn(globals?: MarkerGlobals): void;
+//# sourceMappingURL=eve-patch-probe.d.ts.map

package/dist/agent/access/eve-patch-probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eve-patch-probe.d.ts","sourceRoot":"","sources":["../../../agent/access/eve-patch-probe.ts"],"names":[],"mappings":"AAsDA,8FAA8F;AAC9F,MAAM,WAAW,YAAY;IAC3B,gGAAgG;IAChG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gFAAgF;IAChF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,+FAA+F;IAC/F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;+CAI+C;AAC/C,eAAO,MAAM,eAAe,EAAE,SAAS,YAAY,EAkDlD,CAAC;AAEF,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAAwD,CAAC;AAEzG;+EAC+E;AAC/E,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,WAAW,GAAG,cAAc,CAAC;AAE3E,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;IAC1C,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,6FAA6F;AAC7F,MAAM,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAE9D,iGAAiG;AACjG,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,aAAa,GAAG,SAAS,YAAY,EAAE,CAEpF;AAED;;oDAEoD;AACpD,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C;AAED,uGAAuG;AACvG,wBAAgB,eAAe,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,GAAG,MAAM,CAwBxE;AAED;;iGAEiG;AACjG,wBAAsB,aAAa,CACjC,MAAM,GAAE,MAAM,MAA8B,EAC5C,OAAO,GAAE,aAA2C,GACnD,OAAO,CAAC,mBAAmB,CAAC,CA6B9B;AAED;;2BAE2B;AAC3B,wBAAsB,gBAAgB,CACpC,MAAM,GAAE,MAAM,MAA8B,EAC5C,OAAO,GAAE,aAA2C,GACnD,OAAO,CAAC,mBAAmB,CAAC,CAI9B;AA6BD,qGAAqG;AACrG,wBAAgB,8BAA8B,IAAI,IAAI,CAErD;AAED;;;yFAGyF;AACzF,wBAAgB,0BAA0B,IAAI,OAAO,CAEpD;AAED;mEACmE;AACnE,wBAAgB,sBAAsB,CAAC,OAAO,GAAE,aAA2C,GAAG,IAAI,CAKjG"}

package/dist/agent/access/eve-patch-probe.js

@@ -0,0 +1,225 @@
+// THE UNPATCHED-EVE REFUSAL (OPE-2182). `patches/eve+<pin>.patch` carries seven LIVE parts, and
+// every one is a security or correctness control that fails SILENTLY when the patch is absent:
+// nothing throws, nothing logs, the behaviour the part adds simply is not there. `patch-package`
+// runs on `postinstall` and only WARNS when a patch does not apply, so a cold `npm install` of
+// `@open-everywhere/core` — or any install that skipped lifecycle scripts — produces exactly that
+// tree. This module reads one runtime marker per part and REFUSES TO BOOT when any is missing.
+//
+// WHY A RUNTIME MARKER AND NOT THE BYTES. `scripts/eve-patch-lint.ts` and
+// `packages/core/scripts/eve-install-integrity-test.ts` already read the installed bytes, and a
+// consumer runs neither — they are this repository's gates, not the consumer's. A marker the
+// patched bytes PUBLISH WHEN THEY LOAD is the only signal that travels with the install.
+//
+// WHAT THE MARKER PROVES, EXACTLY, AND WHAT IT DOES NOT. It proves that the carrier files under
+// the eve root CORE ITSELF RESOLVES carry the part. It does NOT prove that every installed eve
+// does: a workspace that pins a different version gets its own nested `node_modules/eve`, which
+// patch-package never patches, and which copy a given import resolves is a hoisting detail. That
+// second copy is out of scope here and is covered by `test:eve-install`, which walks EVERY
+// installed copy — see that file's header for the measured case.
+//
+// 🔴 THE CARRIERS MUST BE LOADED BEFORE THE MARKERS CAN BE READ, AND `import "eve"` DOES NOT LOAD
+// THEM. Measured on eve 0.54.3: importing `eve`, `eve/context` or `eve/tools` publishes NOTHING,
+// because eve reaches `harness/tool-loop.js`, `tasks/session-index.js` and
+// `context/dynamic-tool-lifecycle.js` lazily, on the first turn. Only `eve/tools/web_fetch` pulls
+// part 7's carrier. A probe that read `globalThis` at boot would therefore find six of the seven
+// markers absent on a CORRECTLY patched tree and refuse every boot. So the probe LOADS the four
+// carriers first, by absolute file URL — the same reach `connector-scope.ts` takes into eve's
+// internals, and for the same reason: eve's exports map publishes none of these paths. A process
+// that serves a turn pays that load anyway and only pays it EARLIER; a process that never takes a
+// turn — most of the test chain — pays it as new cost. See the boot module's header.
+//
+// 🔴 THE INLINED BUILD IS NOT DECIDABLE **HERE**, SO A SECOND CHECK OWNS IT. A hosted Vercel build
+// inlines eve into one `index.mjs` and ships no `node_modules/eve`, so the eve package root does not
+// resolve and no carrier can be loaded by path (`connector-scope.ts`'s header records the same
+// constraint, and the resolve THROWING there took prod down once). This probe reports that state as
+// `unverifiable` and does NOT throw — refusing at boot would take down every hosted deploy.
+//
+// 🔴 `unverifiable` IS NOT WARN-AND-CONTINUE, BECAUSE THE TURN EDGE STILL REFUSES.
+// {@link assertEvePatchedAtTurn}, mounted as `hooks/eve-patch-gate.ts`, re-asks the question at
+// `turn.started`, where running the turn has ALREADY evaluated every carrier — inlined or not — so
+// the markers are readable with no path at all. A hosted deploy whose bytes are unpatched therefore
+// fails its first turn instead of serving it. The two checks divide the cases: this one fails
+// earlier and cheaper on a node_modules install; the turn gate is the one that is always decidable.
+// Neither path serves a wake on an unpatched eve.
+//
+// The `test` chain remains the EARLIEST control — `npm run lint:eve-patch` (root `test:chain`) and
+// `npm run test:eve-install` (core's `test:chain`) read the installed bytes before a deploy. Nothing
+// inside `npm run build` re-checks them, so the chain is a convention, not a build-order guarantee;
+// the turn gate is what makes the refusal hold regardless.
+import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
+import { pathToFileURL } from "node:url";
+import { EVE_RUNTIME_VERSION } from "../channels/runtime-rotation.js";
+/** The seven live parts, in patch order. 🔴 A part added to `patches/` without a row here boots a
+ *  tree the probe believes is patched, so `eve-install-integrity-test.ts` cross-checks this table
+ *  against the committed patch file in both directions. Part 2 (turnPolicy carriage) and part 3
+ *  (the compaction trigger anchor) are RETIRED upstream and deliberately absent; the numbers are
+ *  stable identifiers and are never reused. */
+export const EVE_PATCH_PARTS = [
+    {
+        part: 1,
+        marker: "__oeProjectToolSetPatched",
+        carrier: "dist/src/harness/tool-loop.js",
+        lost: "the untrusted output projection (OPE-73) — connector and MCP results reach the model unfenced (a prompt-injection containment regression), and every per-wake seat cut is inert",
+    },
+    {
+        part: 4,
+        marker: "__oeCompactionContractPatched",
+        carrier: "dist/src/harness/tool-loop.js",
+        lost: "the compaction event contract (OPE-697) — `compaction.completed` carries no `reduced` field, so a pass that returned its input is indistinguishable from a real summary",
+    },
+    {
+        part: 5,
+        marker: "__oeEmptyStepTerminalPatched",
+        carrier: "dist/src/harness/tool-loop.js",
+        lost: "the empty-step terminal guard (OPE-762) — a correctly silent turn is reissued with an answer-now nudge, so the seat replies to the wake it just declined",
+    },
+    {
+        part: 6,
+        marker: "__oeProjectModelMessagesPatched",
+        carrier: "dist/src/harness/tool-loop.js",
+        lost: "the model-message projection (OPE-1396) — the `[Agents]` subtraction (OPE-593) leaves the model call, and the seat learns a live worker's agentId from the listing",
+    },
+    {
+        part: 7,
+        marker: "__oeWebFetchHopPatched",
+        carrier: "dist/src/execution/web-fetch/request.js",
+        lost: "the per-hop web_fetch egress fence (OPE-1568) — an allow-listed host can redirect the fetch to a host the session never declared. This part alone already refuses at the tool (access/web-fetch-fence.ts); the probe makes it refuse at boot instead",
+    },
+    {
+        part: 8,
+        marker: "__oeTaskCohortJoinPatched",
+        carrier: "dist/src/tasks/session-index.js",
+        lost: "the bounded task-cohort join (OPE-1856) — one worker parked on an unanswered question captures every later task, and eve delivers no later completion for the life of the session",
+    },
+    {
+        part: 9,
+        marker: "__oeSessionToolScopePatched",
+        carrier: "dist/src/context/dynamic-tool-lifecycle.js",
+        lost: "the delegated-binding refresh (OPE-2106) — a worker whose turn continues in a fresh process binds to the `subagent/…/unresolved` sentinel and its gated tools do not re-register",
+    },
+];
+/** The distinct carrier files, so the probe imports each one exactly once. */
+export const EVE_PATCH_CARRIERS = [...new Set(EVE_PATCH_PARTS.map((p) => p.carrier))];
+/** The parts whose marker is not `true` on `globals`. Pure, so a test can drive every subset. */
+export function missingEvePatchParts(globals) {
+    return EVE_PATCH_PARTS.filter((part) => globals[part.marker] !== true);
+}
+/** The eve package root, resolved through the one path eve's exports map allows. Throws on a
+ *  hosted build that inlines eve and ships no `node_modules/eve` — the caller treats that throw as
+ *  the `unverifiable` state, never as a refusal. */
+export function defaultEvePackageRoot() {
+    return dirname(createRequire(import.meta.url).resolve("eve/package.json"));
+}
+/** The refusal text: which parts are missing, what each one costs, the pinned version, and the fix. */
+export function evePatchRefusal(missing) {
+    const parts = missing.map((p) => `  • part ${p.part} (${p.marker}, ${p.carrier}): ${p.lost}`).join("\n");
+    return (`open-everywhere: this eve is UNPATCHED — refusing to boot.\n\n` +
+        `${missing.length} of ${EVE_PATCH_PARTS.length} required patch part(s) are missing from the eve ` +
+        `bytes this process loaded:\n${parts}\n\n` +
+        `Each one fails silently when absent, which is why this is a refusal and not a warning. ` +
+        `The pinned eve version is ${EVE_RUNTIME_VERSION}.\n\n` +
+        // 🔴 THIS BLOCK TOLD THE CONSUMER THE FIX WAS OUT OF REACH (OPE-2206). It used to open "the patch
+        // is NOT shipped in the published tarball" and send the reader to a GitHub repository that is
+        // private until launch. Both stopped being true at OPE-2184: `packages/core` carries `patches` in
+        // its `files` allowlist and ships the `oe-eve-patch` bin, and `publish-lint.ts` fails the package
+        // if either half is missing. The reader of this message is one command away from a patched tree,
+        // so that command is what the message leads with.
+        `Fix — @open-everywhere/core ships both the patch and the applier, and it runs no postinstall of ` +
+        `its own, so applying the patch is your project's explicit step:\n` +
+        `  npm i eve@${EVE_RUNTIME_VERSION}\n` +
+        `  npx oe-eve-patch\n\n` +
+        `The applier is idempotent and refuses any eve version but the pin. To apply the patch by hand ` +
+        `instead, copy \`patches/eve+${EVE_RUNTIME_VERSION}.patch\` out of the installed ` +
+        `@open-everywhere/core package into your own \`patches/\` directory, add \`patch-package\` to your ` +
+        `devDependencies, and add \`"postinstall": "patch-package"\` to your own package.json.\n` +
+        `See docs/dev/publishing.md.`);
+}
+/** Load every carrier so its marker is published, then report what is still missing. The carrier
+ *  imports are best-effort per file: a carrier that fails to load leaves its own marker unset,
+ *  which is the refusal this probe exists to raise, so the failure needs no separate channel. */
+export async function probeEvePatch(rootFn = defaultEvePackageRoot, globals = globalThis) {
+    // Read BEFORE loading anything, so a caller that ALREADY holds the markers pays neither the
+    // carrier load nor the root resolve: a synthetic bag in a test, or a process that has taken a
+    // turn and let eve load the carriers itself. It is NOT a claim that a bundled build arrives here
+    // with markers set — the header says the opposite, and that is the measured state.
+    if (missingEvePatchParts(globals).length === 0)
+        return { status: "patched", missing: [] };
+    let root;
+    try {
+        root = rootFn();
+    }
+    catch (err) {
+        return { status: "unverifiable", missing: missingEvePatchParts(globals), reason: String(err) };
+    }
+    await Promise.all(EVE_PATCH_CARRIERS.map(async (rel) => {
+        try {
+            // hosted-inline-exempt: a deliberate reach into eve's installed internals by absolute path;
+            // eve's exports map publishes none of these files, and an unresolvable root was already
+            // handled as `unverifiable` above.
+            await import(pathToFileURL(join(root, rel)).href);
+        }
+        catch {
+            /* the part's marker stays unset, which the missing-part check below reports */
+        }
+    }));
+    const missing = missingEvePatchParts(globals);
+    return missing.length === 0 ? { status: "patched", missing: [] } : { status: "unpatched", missing };
+}
+/** Throw unless every live patch part is present. The `unverifiable` state does NOT throw at BOOT —
+ *  {@link assertEvePatchedAtTurn} is what closes that case, at the one point where the carriers have
+ *  certainly evaluated. */
+export async function assertEvePatched(rootFn = defaultEvePackageRoot, globals = globalThis) {
+    const result = await probeEvePatch(rootFn, globals);
+    if (result.status === "unpatched")
+        throw new Error(evePatchRefusal(result.missing));
+    return result;
+}
+// ── the TURN-TIME check (OPE-2182) ────────────────────────────────────────────────────────────
+//
+// 🔴 THIS IS WHAT MAKES THE REFUSAL TOTAL, AND THE BOOT PROBE ALONE DOES NOT. The boot probe can
+// only reach carriers it can resolve a PATH to. A hosted build inlines eve and resolves no path, so
+// boot reports `unverifiable` and serves the wake — which on the product's primary deploy target is
+// exactly the silent state this ticket exists to close.
+//
+// By TURN time the question is decidable with no path at all. Running a turn IS running eve's tool
+// loop, so every carrier has evaluated and published its marker, whether those bytes came from
+// `node_modules` or from an inlined bundle. A marker still absent here means the bytes really are
+// unpatched. So the turn gate reads `globalThis` and NOTHING else — it never resolves a root, never
+// imports a carrier, and has no `unverifiable` state to fall through.
+//
+// It is memoised on SUCCESS only. One pass proves the loaded bytes for the life of the process, and
+// nothing can un-patch them; a failure is never cached, so a caller that somehow recovers is not
+// held to an earlier verdict.
+//
+// 🔴 THE MEMO LIVES ON `globalThis`, NOT IN A MODULE VARIABLE, FOR THE SAME REASON THE WEB-FETCH HOP
+// SCOPE DOES (see access/web-fetch-fence.ts). A process can hold more than one copy of this module —
+// the built `dist` copy the agent runs and the source copy a test or another workspace imports — and
+// a module-local flag would give each copy its own. That is not merely untidy: the fact "this
+// process has verified its eve" is a property of the PROCESS, so two copies would re-verify
+// independently, and nothing outside the agent's own copy could observe that the gate ever ran.
+// Measured: the integration tier's test copy read `false` while the agent's copy had already passed.
+const MEMO_KEY = "__oeEvePatchTurnCheckPassed";
+const memo = globalThis;
+/** Reset the turn gate's memo. Tests only — production has no reason to re-ask a settled process. */
+export function _resetEvePatchTurnCheckForTest() {
+    memo[MEMO_KEY] = false;
+}
+/** Whether the turn gate has passed in this process. Exists so a test can prove the HOOK FIRED on a
+ *  real host: reset the memo, drive one turn, read this. It is the only externally visible trace the
+ *  gate leaves — it deliberately writes no audit row, because the gate must not depend on a store
+ *  that may not be armed, and a row on the passing path would be noise on every turn. */
+export function evePatchTurnCheckHasPassed() {
+    return memo[MEMO_KEY] === true;
+}
+/** Throw unless every live part's marker is on `globals`. Synchronous and allocation-free once it
+ *  has passed, because it runs on every turn's first hook edge. */
+export function assertEvePatchedAtTurn(globals = globalThis) {
+    if (memo[MEMO_KEY] === true)
+        return;
+    const missing = missingEvePatchParts(globals);
+    if (missing.length > 0)
+        throw new Error(evePatchRefusal(missing));
+    memo[MEMO_KEY] = true;
+}
+//# sourceMappingURL=eve-patch-probe.js.map

package/dist/agent/access/eve-patch-probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eve-patch-probe.js","sourceRoot":"","sources":["../../../agent/access/eve-patch-probe.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,+FAA+F;AAC/F,iGAAiG;AACjG,+FAA+F;AAC/F,kGAAkG;AAClG,+FAA+F;AAC/F,EAAE;AACF,0EAA0E;AAC1E,gGAAgG;AAChG,6FAA6F;AAC7F,yFAAyF;AACzF,EAAE;AACF,gGAAgG;AAChG,+FAA+F;AAC/F,gGAAgG;AAChG,iGAAiG;AACjG,2FAA2F;AAC3F,iEAAiE;AACjE,EAAE;AACF,kGAAkG;AAClG,iGAAiG;AACjG,2EAA2E;AAC3E,kGAAkG;AAClG,iGAAiG;AACjG,gGAAgG;AAChG,8FAA8F;AAC9F,iGAAiG;AACjG,kGAAkG;AAClG,qFAAqF;AACrF,EAAE;AACF,mGAAmG;AACnG,qGAAqG;AACrG,+FAA+F;AAC/F,oGAAoG;AACpG,4FAA4F;AAC5F,EAAE;AACF,mFAAmF;AACnF,gGAAgG;AAChG,mGAAmG;AACnG,oGAAoG;AACpG,8FAA8F;AAC9F,oGAAoG;AACpG,kDAAkD;AAClD,EAAE;AACF,mGAAmG;AACnG,qGAAqG;AACrG,oGAAoG;AACpG,2DAA2D;AAE3D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AActE;;;;+CAI+C;AAC/C,MAAM,CAAC,MAAM,eAAe,GAA4B;IACtD;QACE,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,2BAA2B;QACnC,OAAO,EAAE,+BAA+B;QACxC,IAAI,EACF,iLAAiL;KACpL;IACD;QACE,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,+BAA+B;QACvC,OAAO,EAAE,+BAA+B;QACxC,IAAI,EACF,yKAAyK;KAC5K;IACD;QACE,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,8BAA8B;QACtC,OAAO,EAAE,+BAA+B;QACxC,IAAI,EACF,0JAA0J;KAC7J;IACD;QACE,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,iCAAiC;QACzC,OAAO,EAAE,+BAA+B;QACxC,IAAI,EACF,oKAAoK;KACvK;IACD;QACE,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,wBAAwB;QAChC,OAAO,EAAE,yCAAyC;QAClD,IAAI,EACF,sPAAsP;KACzP;IACD;QACE,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,2BAA2B;QACnC,OAAO,EAAE,iCAAiC;QAC1C,IAAI,EACF,mLAAmL;KACtL;IACD;QACE,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,6BAA6B;QACrC,OAAO,EAAE,4CAA4C;QACrD,IAAI,EACF,kLAAkL;KACrL;CACF,CAAC;AAEF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,kBAAkB,GAAsB,CAAC,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAgBzG,iGAAiG;AACjG,MAAM,UAAU,oBAAoB,CAAC,OAAsB;IACzD,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;AACzE,CAAC;AAED;;oDAEoD;AACpD,MAAM,UAAU,qBAAqB;IACnC,OAAO,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,eAAe,CAAC,OAAgC;IAC9D,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzG,OAAO,CACL,gEAAgE;QAChE,GAAG,OAAO,CAAC,MAAM,OAAO,eAAe,CAAC,MAAM,mDAAmD;QACjG,+BAA+B,KAAK,MAAM;QAC1C,yFAAyF;QACzF,6BAA6B,mBAAmB,OAAO;QACvD,kGAAkG;QAClG,8FAA8F;QAC9F,kGAAkG;QAClG,kGAAkG;QAClG,iGAAiG;QACjG,kDAAkD;QAClD,kGAAkG;QAClG,mEAAmE;QACnE,eAAe,mBAAmB,IAAI;QACtC,wBAAwB;QACxB,gGAAgG;QAChG,+BAA+B,mBAAmB,gCAAgC;QAClF,oGAAoG;QACpG,yFAAyF;QACzF,6BAA6B,CAC9B,CAAC;AACJ,CAAC;AAED;;iGAEiG;AACjG,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAM,GAAiB,qBAAqB,EAC5C,OAAO,GAAkB,UAA2B;IAEpD,4FAA4F;IAC5F,8FAA8F;IAC9F,iGAAiG;IACjG,mFAAmF;IACnF,IAAI,oBAAoB,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAE1F,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,EAAE,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,oBAAoB,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IACjG,CAAC;IAED,MAAM,OAAO,CAAC,GAAG,CACf,kBAAkB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACnC,IAAI,CAAC;YACH,4FAA4F;YAC5F,wFAAwF;YACxF,mCAAmC;YACnC,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,+EAA+E;QACjF,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IAEF,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9C,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;AACtG,CAAC;AAED;;2BAE2B;AAC3B,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAM,GAAiB,qBAAqB,EAC5C,OAAO,GAAkB,UAA2B;IAEpD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACpF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,iGAAiG;AACjG,EAAE;AACF,iGAAiG;AACjG,oGAAoG;AACpG,oGAAoG;AACpG,wDAAwD;AACxD,EAAE;AACF,mGAAmG;AACnG,+FAA+F;AAC/F,kGAAkG;AAClG,oGAAoG;AACpG,sEAAsE;AACtE,EAAE;AACF,oGAAoG;AACpG,iGAAiG;AACjG,8BAA8B;AAC9B,EAAE;AACF,qGAAqG;AACrG,qGAAqG;AACrG,qGAAqG;AACrG,8FAA8F;AAC9F,4FAA4F;AAC5F,gGAAgG;AAChG,qGAAqG;AACrG,MAAM,QAAQ,GAAG,6BAA6B,CAAC;AAC/C,MAAM,IAAI,GAAG,UAAqC,CAAC;AAEnD,qGAAqG;AACrG,MAAM,UAAU,8BAA8B;IAC5C,IAAI,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC;AACzB,CAAC;AAED;;;yFAGyF;AACzF,MAAM,UAAU,0BAA0B;IACxC,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC;AACjC,CAAC;AAED;mEACmE;AACnE,MAAM,UAAU,sBAAsB,CAAC,OAAO,GAAkB,UAA2B;IACzF,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI;QAAE,OAAO;IACpC,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IAClE,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;AACxB,CAAC"}

package/dist/agent/access/external-policy.d.ts

@@ -0,0 +1,95 @@
+import { type ExternalAuthorGrain, type ExternalRoomGrain } from "../settings/settings.js";
+import { type ChatWakeRoom, type IngestedChatMessage } from "./taint-signal.js";
+import type { NormalizedWake } from "../channels/normalized-wake.js";
+import type { WakeMessageInput } from "../channels/wake-envelope.js";
+export type { ExternalAuthorGrain, ExternalRoomGrain };
+export interface ExternalPolicy {
+    readonly authorGrain: ExternalAuthorGrain;
+    readonly roomGrain: ExternalRoomGrain;
+}
+/** A domain's override. Both fields are optional and resolve FIELD BY FIELD, so a domain that sets only `roomGrain` keeps the org default's `authorGrain`. */
+export interface ExternalPolicyOverride {
+    readonly authorGrain?: ExternalAuthorGrain;
+    readonly roomGrain?: ExternalRoomGrain;
+}
+/** The SHIPPED policy — what a deployment that declares nothing runs. Both grains are today's
+ *  behaviour, so this is the value every existing deployment resolves to after an upgrade. */
+export declare function shippedExternalPolicy(): ExternalPolicy;
+/** Org default, then the domain override, field by field. Pure and synchronous; never throws. */
+export declare function resolveExternalPolicy(override?: ExternalPolicyOverride): ExternalPolicy;
+/** True when the policy can suppress nothing (`taint`/`engage`). Ask it before BUYING per-author evidence; a route that already resolved its author facts must not. */
+export declare function externalPolicyIsInert(policy: ExternalPolicy): boolean;
+/** One message as the author grain reads it. It EXTENDS IngestedChatMessage rather than restating it, because the exclusion question and the taint join's refutation question are the same question; only `id` is added. */
+export interface ExternalAuthorFacts extends IngestedChatMessage {
+    /** The platform message id — matches {@link WakeMessageInput.id} on the wake being transformed. */
+    readonly id: string;
+}
+/** Is this author excluded from tasking the agent? It is `nonMemberChatTrust` with no extra leg, so an UNARMED tenant excludes nobody, a `relay` author is never excluded, and the room leg is not consulted. */
+export declare function authorIsExcluded(m: IngestedChatMessage): boolean;
+/**
+ * Does this message's BODY get withheld — the author grain's one decision. `taint` withholds
+ * nothing, ever, which is what makes the shipped default a no-op.
+ *
+ * 🔴 AN UNGRADED AUTHOR IS WITHHELD (OPE-1747), and that is the one place this plane fails CLOSED
+ * rather than open. `authorIsExcluded` asks "did something positively refute this author", and it
+ * fails open because absence of evidence is not evidence. This function asks a different question on
+ * behalf of a deployment that DECLARED non-member bytes must not reach the model, and an author
+ * nothing ever graded cannot be shown to be one of theirs. The only producer is a persisted
+ * session-tail row written before the row shape carried a verdict (channels/session-tail.ts): a
+ * present `refuted: false` is a graded answer and passes, a MISSING one does not.
+ * `relay` is exempt — a machine author is below peer but is not a person outside the organisation, so
+ * the seat's own recorded posts are never withheld by this arm.
+ */
+export declare function withholdsBody(m: IngestedChatMessage, policy: ExternalPolicy): boolean;
+/** The arrived-marker the model sees in place of a withheld body: it states the fact and the reason and carries no content. Core-owned trusted text, with nothing the excluded author wrote interpolated. */
+export declare const WITHHELD_BODY_MARKER = "[a message arrived here \u2014 this deployment does not pass on messages from senders outside the organisation, so its text was not delivered]";
+/** The private notice an excluded author gets when they @mention or DM; the agent takes no other action. It names no configuration, setting or register, because the sender is the person the policy excludes. */
+export declare const EXTERNAL_SENDER_NOTICE: string;
+/** The one line an explicitly addressed wake gets when this policy suppresses it. It is the SAME host-written string for every surface and verdict, and names no person, organisation, setting or verdict. */
+export declare const EXTERNAL_MENTION_ACK = "I can't help with this request here.";
+/** Does a suppressed wake owe the room the ack? `addressed` is the surface's own @mention-or-DM predicate, never a name-drop; `alreadyAnswered` is true when the private notice landed or the room's once-ever announcement fired on this wake. */
+export declare function owesSuppressedMentionAck(input: {
+    readonly addressed: boolean;
+    readonly alreadyAnswered: boolean;
+}): boolean;
+/** The `rendering` field the suppression audit row carries when the host posted the ack, and absent when it stayed dark — so an operator can tell a member-visible suppression from an invisible one. */
+export declare function suppressionRendering(acked: boolean): {
+    readonly rendering?: "ack";
+};
+/** Rewrite a wake so every withheld message carries the arrived-marker. It must run BEFORE renderWake, and it replaces `body`, `previousBody` and `attachments` (a surviving attachment leaves the content fetchable); a surface that hydrates `contextLines` must pass `excludedAuthorId`, which Discord's name-drop path does not. */
+export declare function withholdWakeBodies(nw: NormalizedWake, isWithheld: (m: WakeMessageInput) => boolean, 
+/** The author grain for one raw platform sender id, for the `contextLines` slot. See above: a
+ *  surface that hydrates side-channel context must supply it, or an author who wrote nothing in
+ *  the envelope keeps their hydrated lines. */
+excludedAuthorId?: (senderId: string) => boolean): NormalizedWake;
+/** One message stripped of every field carrying the author's content: the body becomes the marker, `previousBody` and `attachments` are removed. A new content-bearing field on WakeMessageInput SURVIVES this by default, so add it here too. */
+export declare function withheldWakeMessage(m: WakeMessageInput): WakeMessageInput;
+/** The ingested set the taint join sees after withholding, the withheld entries REMOVED: under `withhold` those bytes never entered. Returns the same array by reference when nothing is withheld.
+ *  It filters on {@link withholdsBody}, the same predicate that did the withholding, so the two cannot disagree about which bytes entered — an UNGRADED row whose body was withheld leaves the join with every other withheld entry. */
+export declare function ingestedAfterWithholding<M extends IngestedChatMessage>(ingested: readonly M[], policy: ExternalPolicy): readonly M[];
+/** An excluded author's ADDRESSED message stands down and the caller posts EXTERNAL_SENDER_NOTICE. Split from the ambient predicate so a caller cannot use the wrong one by accident.
+ *  🔴 IT ASKS `authorIsExcluded`, NOT `withholdsBody` (OPE-1747), so the ungraded arm cannot reach it — but READ WHAT THAT DOES AND DOES NOT BUY. This function has no production caller: the five live stand-down gates (slack-events.ts, discord-gateway.ts, teams-front.ts, github.ts, linear.ts) each call `withholdsBody` on the trigger's own facts, and that DOES take the ungraded arm. What keeps a live ask safe is therefore not this function — it is that `tailEntryToWakeMessage` is the ONLY producer of `ungraded`, so no live trigger carries it. If a route ever builds its trigger facts from a tail row, that route stands a member's addressed ask down; the pin for the arm and its negative control is in scripts/external-policy-test.ts. */
+export declare function suppressesAddressedWake(m: IngestedChatMessage, policy: ExternalPolicy): boolean;
+/** Does an excluded author's AMBIENT message fail to trigger the agent — behaviour 2? Silent: an
+ *  ambient message was never owed a reply, so there is nothing to tell anybody. */
+export declare function suppressesAmbientWake(m: IngestedChatMessage, policy: ExternalPolicy): boolean;
+export interface ExternalRoomFacts {
+    readonly room: ChatWakeRoom;
+    /** The surface's own vendor verdict that this room spans another organisation. Absent or false means "not reported", which includes a probe that could not answer: this leg fails OPEN. */
+    readonly vendorExternal?: boolean;
+    /** The ingested set, for the GUEST-PRESENT leg. Empty is normal and contributes nothing. */
+    readonly ingested?: readonly IngestedChatMessage[];
+}
+/** Is this room in the EXTERNAL class — vendor-external, guest-present, or operator-declared? A DM never is, and there is NO undeclared leg: operator silence is not a declaration. */
+export declare function roomIsExternalClass(f: ExternalRoomFacts): boolean;
+/** Does the room grain suppress engagement here? `engage` suppresses nothing, ever. */
+export declare function roomIsSilenced(f: ExternalRoomFacts, policy: ExternalPolicy): boolean;
+/** The CLOSED set of announcements a silenced room ever makes: one on join, one on the first suppressed wake. Each claim is durable and at-most-once, so the pair is a lifetime total per room, not per process. */
+export declare const SILENT_NOTICE_KINDS: readonly ["join", "suppressed-wake"];
+export type SilentNoticeKind = (typeof SILENT_NOTICE_KINDS)[number];
+/** The text each announcement posts. Core-owned and trusted: no surface content is interpolated. */
+export declare function silentRoomNotice(kind: SilentNoticeKind): string;
+/** The durable claim key for one room's one announcement. Namespaced so it can never collide with
+ *  another caller's key, and keyed on the SURFACE so the pair is per-room. */
+export declare function silentNoticeKey(surfaceKey: string, kind: SilentNoticeKind): string;
+//# sourceMappingURL=external-policy.d.ts.map

package/dist/agent/access/external-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-policy.d.ts","sourceRoot":"","sources":["../../../agent/access/external-policy.ts"],"names":[],"mappings":"AAEA,OAAO,EAAe,KAAK,mBAAmB,EAAE,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAExG,OAAO,EAAsB,KAAK,YAAY,EAAE,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACpG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAErE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAErE,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,CAAC;AAEvD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;CACvC;AAED,8JAA8J;AAC9J,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAC3C,QAAQ,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC;CACxC;AAED;8FAC8F;AAC9F,wBAAgB,qBAAqB,IAAI,cAAc,CAGtD;AAED,iGAAiG;AACjG,wBAAgB,qBAAqB,CAAC,QAAQ,CAAC,EAAE,sBAAsB,GAAG,cAAc,CAMvF;AAED,uKAAuK;AACvK,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAErE;AAED,4NAA4N;AAC5N,MAAM,WAAW,mBAAoB,SAAQ,mBAAmB;IAC9D,mGAAmG;IACnG,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,iNAAiN;AACjN,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAEhE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,mBAAmB,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAIrF;AAED,6MAA6M;AAC7M,eAAO,MAAM,oBAAoB,mJAC4G,CAAC;AAE9I,kNAAkN;AAClN,eAAO,MAAM,sBAAsB,QAEmD,CAAC;AAEvF,8MAA8M;AAC9M,eAAO,MAAM,oBAAoB,yCAAyC,CAAC;AAE3E,mPAAmP;AACnP,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CACnC,GAAG,OAAO,CAEV;AAED,yMAAyM;AACzM,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG;IAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,CAAA;CAAE,CAEnF;AAED,wUAAwU;AACxU,wBAAgB,kBAAkB,CAChC,EAAE,EAAE,cAAc,EAClB,UAAU,EAAE,CAAC,CAAC,EAAE,gBAAgB,KAAK,OAAO;AAC5C;;+CAE+C;AAC/C,gBAAgB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,GAC/C,cAAc,CAiBhB;AAED,kPAAkP;AAClP,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,gBAAgB,GAAG,gBAAgB,CAGzE;AAED;wOACwO;AACxO,wBAAgB,wBAAwB,CAAC,CAAC,SAAS,mBAAmB,EACpE,QAAQ,EAAE,SAAS,CAAC,EAAE,EACtB,MAAM,EAAE,cAAc,GACrB,SAAS,CAAC,EAAE,CAId;AAED;quBACquB;AACruB,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,mBAAmB,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAE/F;AAED;mFACmF;AACnF,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,mBAAmB,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAE7F;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,2LAA2L;IAC3L,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,4FAA4F;IAC5F,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACpD;AAED,uLAAuL;AACvL,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAKjE;AAkBD,uFAAuF;AACvF,wBAAgB,cAAc,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAEpF;AAED,oNAAoN;AACpN,eAAO,MAAM,mBAAmB,YAAI,MAAM,EAAE,iBAAiB,CAAU,CAAC;AAExE,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpE,oGAAoG;AACpG,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,CAI/D;AAED;8EAC8E;AAC9E,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,MAAM,CAElF"}