@open-everywhere/core 0.1.0

package/agent/access/native-admin.ts

@@ -0,0 +1,35 @@
+// Per-platform registry of a surface's NATIVE standing checks, registered by the provider bundle at boot so the vendor REST call stays out of core. `NativeMemberCheck` is registered by the bundles but has NO caller in core today — never describe it as feeding a live gate. FAIL-CLOSED BY OMISSION: a platform with no registered check resolves undefined, so the caller falls back to the roster verdict for admin and to a refusal for member.
+
+import { admitProviderRegistration } from "./provider-selection.js";
+
+/** A surface's native admin-standing check: is `principalId` an administrator of the scope named by
+ *  `scopeKey` (a `<platform>/<workspace>[/<surface>]` key)? Resolves a boolean; MUST NOT throw (the
+ *  caller treats a rejection as "not admin"). */
+export type NativeAdminCheck = (scopeKey: string, principalId: string) => Promise<boolean>;
+
+const REGISTRY = new Map<string, NativeAdminCheck>();
+
+/** Register (or replace) a platform's native admin-standing check. Called once per bundle at boot. */
+export function registerNativeAdminCheck(platform: string, check: NativeAdminCheck): void {
+  if (!admitProviderRegistration(platform, "native-admin-check")) return;
+  REGISTRY.set(platform, check);
+}
+
+export function nativeAdminCheck(platform: string | undefined): NativeAdminCheck | undefined {
+  return platform === undefined ? undefined : REGISTRY.get(platform);
+}
+
+/** Is `principalId` a FULL member of the scope named by `scopeKey`? "Full member" is the platform's strongest membership signal: a guest, a cross-organisation participant, a bot, a deleted account and a non-member all read false. Must not throw — the caller treats a rejection as "not a member". */
+export type NativeMemberCheck = (scopeKey: string, principalId: string) => Promise<boolean>;
+
+const MEMBER_REGISTRY = new Map<string, NativeMemberCheck>();
+
+/** Register (or replace) a platform's native member-standing check. Called once per bundle at boot. */
+export function registerNativeMemberCheck(platform: string, check: NativeMemberCheck): void {
+  if (!admitProviderRegistration(platform, "native-member-check")) return;
+  MEMBER_REGISTRY.set(platform, check);
+}
+
+export function nativeMemberCheck(platform: string | undefined): NativeMemberCheck | undefined {
+  return platform === undefined ? undefined : MEMBER_REGISTRY.get(platform);
+}

package/agent/access/native-delegation-state.ts

@@ -0,0 +1,40 @@
+// Per-wake verdict for "may this seat hold eve's built-in `agent`?", written at `turn.started` and read at the projection seam, which is the only lever — the built-in is injected on every root session and cannot be re-registered. FAIL-CLOSED, the opposite of the lean slot: it clears to DENY, because a wrongly-allowed built-in hands a child the parent's whole credentialed identity in the parent's own sandbox.
+
+import { defineState } from "eve/context";
+
+/** Why the built-in was allowed or denied for the wake in flight. Recorded for the audit row and for
+ *  a human reading a "why did the model not delegate?" question; never model-visible. */
+export type NativeDelegationVerdict =
+  /** Positively classified: a delegating conversational seat that is not a child. */
+  | "allow"
+  /** This session IS an eve subagent child — a leaf. Recursion is closed here (eve closes its own). */
+  | "leaf"
+  /** No window to mint from, wrong grain, or the delegation model is disarmed. */
+  | "no-seat"
+  /** Nothing classified this wake (the hook did not run, or threw). The clear-first default. */
+  | "unclassified";
+
+const slot = defineState<NativeDelegationVerdict>("open-everywhere.native-delegation", () => "unclassified");
+
+/** Record whether the wake in flight may hold eve's built-in `agent`. Written CLEAR-FIRST as `unclassified` by hooks/lean-seat.ts, so a throw mid-classification leaves the seat DENIED rather than allowed. Fail-soft outside an eve context. */
+export function setNativeDelegationSeat(verdict: NativeDelegationVerdict): void {
+  try {
+    slot.update(() => verdict);
+  } catch {
+  }
+}
+
+/** The verdict for the wake in flight. `unclassified` for every context-less caller — which reads as
+ *  DENY at the one consumer, by design (see this file's header). */
+function currentNativeDelegationSeat(): NativeDelegationVerdict {
+  try {
+    return slot.get();
+  } catch {
+    return "unclassified";
+  }
+}
+
+/** May the model be offered eve's built-in `agent` on this model call? ONE conjunct, the per-wake seat: a tainted turn KEEPS its delegation verb and the child inherits the parent's taint mark. The residual is a step that issues an untrusted read and an `agent` call in the same response, where that one child can run clean; on a `taint.mode: "off"` deployment nothing taints and no child is marked at all. */
+export function nativeAgentAllowedNow(): boolean {
+  return currentNativeDelegationSeat() === "allow";
+}

package/agent/access/network-access.ts

@@ -0,0 +1,132 @@
+// A network-access level only ADDS credential-less reach on top of what a bundle already grants; it never removes a host a bundle opened. Resolution is narrowest-wins on the container ladder only (org/tenant/domain/surface), defaulting to "none" when no pin matches.
+
+import type { EffectiveAccess } from "./resolver.js";
+import { PACKAGE_REGISTRY_HOSTS, TENANT_KEY, SURFACE_KEY, type Scope, type ScopeLevel } from "./bundle.js";
+
+export type NetworkAccessLevel = "trusted" | "none" | "full";
+
+const KNOWN_LEVELS: ReadonlySet<string> = new Set<NetworkAccessLevel>(["trusted", "none", "full"]);
+
+/** Developer hosts folded into "trusted". github.com is the only entry, and any further addition needs the same kind of evidence this one has. */
+export const TRUSTED_ACCESS_DEVELOPER_HOSTS: readonly string[] = ["github.com"];
+
+/** The one place the trusted host set is assembled; a level compiles by reading this constant, never by re-deriving the list. */
+export const TRUSTED_ACCESS_HOSTS: readonly string[] = [...PACKAGE_REGISTRY_HOSTS, ...TRUSTED_ACCESS_DEVELOPER_HOSTS];
+
+/** The floor when no networkAccess binding reaches a request at all. */
+export const DEFAULT_NETWORK_ACCESS_LEVEL: NetworkAccessLevel = "none";
+
+/** The scope levels a network-access binding may pin — the container ladder only. */
+const CONTAINER_LEVELS: ReadonlySet<ScopeLevel> = new Set<ScopeLevel>(["org", "tenant", "domain", "surface"]);
+
+/** Same specificity ordering resolver.ts uses for the container ladder — higher = narrower. */
+const SPECIFICITY: Readonly<Record<string, number>> = { org: 0, tenant: 1, domain: 2, surface: 3 };
+
+export interface NetworkAccessBinding {
+  readonly scope: Scope; // scope.level must be one of the container ladder — see CONTAINER_LEVELS
+  readonly level: NetworkAccessLevel;
+}
+
+export function defineNetworkAccess(binding: NetworkAccessBinding): NetworkAccessBinding {
+  return binding;
+}
+
+const LEVEL_FIELD: Readonly<Record<string, "tenant" | "domain" | "surface" | undefined>> = {
+  org: undefined,
+  tenant: "tenant",
+  domain: "domain",
+  surface: "surface",
+};
+
+export interface NetworkAccessValidationDeps {
+  /** OMITTED ⇒ `console.warn` (the boot log). A test passes its own sink to assert on the text. */
+  readonly warn?: (message: string) => void;
+}
+
+/** Fail-loud validation of networkAccess bindings at config load: known level, container-ladder scope, exactly its level's one address field, and no two bindings on the same scope. The broad-grant finding for a "full" pin at org or tenant scope is WARN ONLY — it never throws and never fails lint:access. */
+export function assertNetworkAccessValid(bindings: readonly NetworkAccessBinding[], deps: NetworkAccessValidationDeps = {}): void {
+  const bad: string[] = [];
+  const seen = new Set<string>();
+  for (const b of bindings) {
+    const where = `networkAccess binding (${b.scope.level} scope)`;
+    if (!KNOWN_LEVELS.has(b.level)) {
+      bad.push(`  ${where} has unknown level ${JSON.stringify(b.level)} — known levels: "trusted" | "none" | "full"`);
+    }
+    if (!CONTAINER_LEVELS.has(b.scope.level)) {
+      bad.push(
+        `  ${where} — network access is pinned on the CONTAINER LADDER only (org | tenant | domain | surface); ` +
+          `"group"/"principal" scopes are the DM personal universe and never pin a compute environment ` +
+          `(Tag's own Environment object is org-scoped, never per-account — see network-access.ts's header)`,
+      );
+      continue;
+    }
+    const required = LEVEL_FIELD[b.scope.level];
+    const { tenant, domain, surface } = b.scope;
+    for (const [field, value] of [["tenant", tenant], ["domain", domain], ["surface", surface]] as const) {
+      if (field === required) {
+        if (!value) bad.push(`  ${where} needs scope.${field} — a ${b.scope.level}-level binding can never match without one`);
+      } else if (value !== undefined) {
+        bad.push(`  ${where} also sets scope.${field} — a ${b.scope.level}-level scope carries only scope.${required ?? "(nothing)"}; drop it or change the level`);
+      }
+    }
+    if (tenant && !TENANT_KEY.test(tenant)) {
+      bad.push(`  ${where} scope.tenant "${tenant}" must be the PLATFORM-QUALIFIED tenant key "platform/<tenant-id>" (e.g. "slack/T0123ABC")`);
+    }
+    if (surface && !SURFACE_KEY.test(surface)) {
+      bad.push(`  ${where} scope.surface "${surface}" must be the fully-qualified surface key "platform/<tenant-id>/<container-id>" (e.g. "slack/T0123ABC/C0123ABC")`);
+    }
+    if (domain?.includes("/")) {
+      bad.push(`  ${where} scope.domain "${domain}" contains "/" — a domain scope takes the BARE domain name, deliberately not tenant-qualified`);
+    }
+    const key = `${b.scope.level}:${tenant ?? domain ?? surface ?? ""}`;
+    if (seen.has(key)) {
+      bad.push(`  two networkAccess bindings pin the SAME scope (${b.scope.level}${tenant ?? domain ?? surface ? ` "${tenant ?? domain ?? surface}"` : ""}) — resolution order would be undefined; merge them into one binding`);
+    }
+    seen.add(key);
+  }
+  if (bad.length > 0) {
+    throw new Error("open-everywhere: invalid networkAccess binding(s):\n" + bad.join("\n") + "\n(access/network-access.ts / docs/how-it-works/access-and-scoping.md)");
+  }
+  // WARN ONLY — see the doc comment above. Runs only once config is known-valid; never throws.
+  const warn = deps.warn ?? ((m: string) => console.warn(m));
+  for (const b of bindings) {
+    if (b.level !== "full") continue;
+    if (b.scope.level !== "org" && b.scope.level !== "tenant") continue;
+    const where = b.scope.level === "org" ? "org scope" : `tenant scope ("${b.scope.tenant}")`;
+    warn(
+      `[open-everywhere:network-access] broad grant: a "full" networkAccess pin sits at ${where} — every surface under it ` +
+        `(including future ones) gets unrestricted, credential-less egress. Narrow it to a domain or surface scope if possible.`,
+    );
+  }
+}
+
+/** Container ladder only. `org` matches everywhere, INCLUDING a DM; tenant, domain and surface require non-DM, because tenantKey and surfaceKey name the DM conversation itself in DM mode. */
+function scopeMatchesContainer(scope: Scope, access: Pick<EffectiveAccess, "mode" | "tenantKey" | "surfaceKey" | "domains">): boolean {
+  switch (scope.level) {
+    case "org":
+      return true;
+    case "tenant":
+      return access.mode !== "dm" && scope.tenant === access.tenantKey;
+    case "domain":
+      return access.mode !== "dm" && (scope.domain !== undefined && access.domains.includes(scope.domain));
+    case "surface":
+      return access.mode !== "dm" && scope.surface === access.surfaceKey;
+    default:
+      return false; // group/principal — this plane never resolves them
+  }
+}
+
+/** Resolve one request's network-access level — narrowest-wins, default otherwise. Pure, and deliberately separate from resolveAccess; it takes an EffectiveAccess-shaped echo rather than a raw request. */
+export function resolveNetworkAccessLevel(
+  access: Pick<EffectiveAccess, "mode" | "tenantKey" | "surfaceKey" | "domains">,
+  bindings: readonly NetworkAccessBinding[],
+): NetworkAccessLevel {
+  let best: { specificity: number; level: NetworkAccessLevel } | undefined;
+  for (const b of bindings) {
+    if (!CONTAINER_LEVELS.has(b.scope.level)) continue; // defence-in-depth: resolver never sees an invalid one that validation would have refused
+    if (!scopeMatchesContainer(b.scope, access)) continue;
+    const specificity = SPECIFICITY[b.scope.level]!;
+    if (best === undefined || specificity > best.specificity) best = { specificity, level: b.level };
+  }
+  return best?.level ?? DEFAULT_NETWORK_ACCESS_LEVEL;
+}

package/agent/access/nullable-optional-fields.ts

@@ -0,0 +1,184 @@
+// An OPTIONAL tool field is advertised to the model as NULLABLE, and a null the model sends for it is STRIPPED before the tool validates (OPE-2068).
+// Why: gpt-6-luna sends a value for every property in a tool's input schema, `required` or not (15 of 15 measured). It cannot omit a field, so an optional field it has no value for gets an invented one — a minimum, a maximum, or a copy of another field ("1 tokens/mo" on a spend card). When the field's type allows null, it sends null (5 of 5). The description text did not change this; the type did.
+// Where: this runs at the eve patch's `__oeProjectToolSet` seam, called from `projectToolSet` (access/untrusted-projection.ts) on the fully-assembled tool set before every model call. So it reaches every tool the model can call — authored, framework, dynamic and connector tools — with no per-tool edit.
+// How: the tool's model-facing JSON schema is rewritten (each property that is not in `required`, and does not already allow null, gets null added; nested object properties and array items recurse). The replacement's `validate` removes those null keys, then calls the ORIGINAL schema's `validate`, so the tool's own validation and its `execute` see "absent", exactly as before. A field that ALREADY allowed null keeps its null: there null is the tool's own meaning, not an absent value.
+// The tool object is MUTATED in place (only its `inputSchema` changes), because eve keys tool approvals in a WeakMap on the built tool object.
+
+import { asSchema, jsonSchema } from "ai";
+
+type Json = Record<string, unknown>;
+
+interface ToolWithInputSchema {
+  inputSchema?: unknown;
+}
+
+interface ValidatingSchema {
+  readonly jsonSchema: unknown;
+  readonly validate?: (value: unknown) => unknown;
+}
+
+function isRecord(v: unknown): v is Json {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+
+function isThenable(v: unknown): v is PromiseLike<unknown> {
+  return isRecord(v) && typeof (v as { then?: unknown }).then === "function";
+}
+
+/** Keys that constrain a JSON schema value. A node with none of them accepts anything, null included. */
+const CONSTRAINT_KEYS = ["type", "enum", "const", "anyOf", "oneOf", "allOf", "not", "$ref", "properties", "items"] as const;
+
+/** True when a JSON schema node already accepts `null`. */
+export function allowsNull(node: unknown): boolean {
+  if (node === true) return true;
+  if (!isRecord(node)) return false;
+  if (!CONSTRAINT_KEYS.some((k) => k in node)) return true;
+  const type = node["type"];
+  if (type === "null") return true;
+  if (Array.isArray(type) && type.includes("null")) return true;
+  if (Array.isArray(node["enum"]) && (node["enum"] as unknown[]).includes(null)) return true;
+  if ("const" in node && node["const"] === null) return true;
+  for (const key of ["anyOf", "oneOf"] as const) {
+    const branches = node[key];
+    if (Array.isArray(branches) && branches.some(allowsNull)) return true;
+  }
+  return false;
+}
+
+/** The same node, with null added to the values it accepts. */
+function withNull(node: Json): Json {
+  const type = node["type"];
+  const addEnumNull = (n: Json): Json => (Array.isArray(n["enum"]) ? { ...n, enum: [...(n["enum"] as unknown[]), null] } : n);
+  if (typeof type === "string" && !("const" in node)) return addEnumNull({ ...node, type: [type, "null"] });
+  if (Array.isArray(type) && !("const" in node)) return addEnumNull({ ...node, type: [...type, "null"] });
+  if (Array.isArray(node["anyOf"])) return { ...node, anyOf: [...(node["anyOf"] as unknown[]), { type: "null" }] };
+  // Any other shape (a `$ref`, a `oneOf`, a `const`): keep its annotations outside and offer null as a second branch.
+  const { description, title, default: dflt, ...rest } = node;
+  return {
+    ...(description !== undefined ? { description } : {}),
+    ...(title !== undefined ? { title } : {}),
+    ...(dflt !== undefined ? { default: dflt } : {}),
+    anyOf: [rest, { type: "null" }],
+  };
+}
+
+function requiredOf(node: Json): readonly string[] {
+  return Array.isArray(node["required"]) ? (node["required"] as string[]) : [];
+}
+
+/** The model-facing form of one JSON schema node. Returns the SAME object when nothing changes. */
+export function nullableOptionalJsonSchema(node: unknown): unknown {
+  if (!isRecord(node)) return node;
+  let out: Json = node;
+  const properties = node["properties"];
+  if (isRecord(properties)) {
+    const required = requiredOf(node);
+    let changed = false;
+    const next: Json = {};
+    for (const [key, prop] of Object.entries(properties)) {
+      let p = nullableOptionalJsonSchema(prop);
+      if (!required.includes(key) && isRecord(p) && !allowsNull(p)) p = withNull(p);
+      if (p !== prop) changed = true;
+      next[key] = p;
+    }
+    if (changed) out = { ...out, properties: next };
+  }
+  const items = node["items"];
+  if (isRecord(items)) {
+    const nextItems = nullableOptionalJsonSchema(items);
+    if (nextItems !== items) out = { ...out, items: nextItems };
+  }
+  return out;
+}
+
+/** Remove every null the rewrite ADDED, walking the ORIGINAL schema: an optional property that did not allow null, sent as null, becomes absent. */
+export function stripAddedNulls(node: unknown, value: unknown): unknown {
+  if (!isRecord(node)) return value;
+  if (Array.isArray(value)) {
+    const items = node["items"];
+    return isRecord(items) ? value.map((v) => stripAddedNulls(items, v)) : value;
+  }
+  const properties = node["properties"];
+  if (!isRecord(value) || !isRecord(properties)) return value;
+  const required = requiredOf(node);
+  const out: Json = {};
+  for (const [key, v] of Object.entries(value)) {
+    const prop = properties[key];
+    if (prop === undefined) {
+      out[key] = v;
+      continue;
+    }
+    if (v === null && !required.includes(key) && !allowsNull(prop)) continue;
+    out[key] = stripAddedNulls(prop, v);
+  }
+  return out;
+}
+
+/** Names every property path that is optional and does NOT allow null — the slots the model fills with an invented value. Empty on a model-facing schema this module has rewritten. */
+export function optionalNonNullablePaths(node: unknown, at = ""): string[] {
+  if (!isRecord(node)) return [];
+  const found: string[] = [];
+  const properties = node["properties"];
+  if (isRecord(properties)) {
+    const required = requiredOf(node);
+    for (const [key, prop] of Object.entries(properties)) {
+      const path = at === "" ? key : `${at}.${key}`;
+      if (!required.includes(key) && isRecord(prop) && !allowsNull(prop)) found.push(path);
+      found.push(...optionalNonNullablePaths(prop, path));
+    }
+  }
+  const items = node["items"];
+  if (isRecord(items)) found.push(...optionalNonNullablePaths(items, `${at}[]`));
+  return found;
+}
+
+/** One replacement per original schema object, so the advertised bytes and their identity stay stable across model calls (the prompt cache wants that). */
+const replacements = new WeakMap<object, unknown>();
+const ours = new WeakSet<object>();
+
+/** The replacement schema for one tool input schema, or `undefined` when the schema has nothing to rewrite. */
+export function nullableOptionalSchema(current: unknown): unknown {
+  if (current === null || typeof current !== "object") return undefined;
+  if (ours.has(current)) return undefined;
+  const cached = replacements.get(current);
+  if (cached !== undefined) return cached;
+
+  const original = asSchema(current as never) as unknown as ValidatingSchema;
+  const source = original.jsonSchema;
+  let advertised: unknown;
+  if (isThenable(source)) {
+    // A lazily-resolved schema: rewrite it when the SDK awaits it.
+    advertised = async () => nullableOptionalJsonSchema(await source);
+  } else {
+    const rewritten = nullableOptionalJsonSchema(source);
+    if (rewritten === source) return undefined;
+    advertised = rewritten;
+  }
+
+  const replacement = jsonSchema(advertised as never, {
+    validate: async (value: unknown) => {
+      const stripped = stripAddedNulls(await source, value);
+      // The original schema stays the rule: this replacement only removes the nulls it invited.
+      if (typeof original.validate !== "function") return { success: true as const, value: stripped };
+      return (await original.validate(stripped)) as { success: true; value: unknown } | { success: false; error: Error };
+    },
+  });
+  replacements.set(current, replacement);
+  ours.add(replacement as object);
+  return replacement;
+}
+
+/** Rewrite every tool in an assembled tool set, in place. A tool whose schema cannot be read keeps its schema: that is the behaviour before this module, not a new failure. */
+export function nullableOptionalToolSet(toolset: Record<string, unknown>): void {
+  for (const raw of Object.values(toolset)) {
+    if (raw === null || typeof raw !== "object") continue;
+    const tool = raw as ToolWithInputSchema;
+    let replacement: unknown;
+    try {
+      replacement = nullableOptionalSchema(tool.inputSchema);
+    } catch {
+      continue;
+    }
+    if (replacement !== undefined) tool.inputSchema = replacement;
+  }
+}

package/agent/access/overlay-module.ts

@@ -0,0 +1,70 @@
+// One pinned module grammar for the machine-owned config overlays: a fixed header, one type-only import, and a single `export default <canonical JSON> satisfies T;`. The bytes are a pure function of the parsed structure, which determinism, idempotency and the PR dedupe all lean on. A `.ts` file EXECUTES at load, so the guarantee is not the format but the drift lint: it reads the file as TEXT, re-emits it and fails on any byte difference, header and import included.
+
+/** One overlay's fixed module grammar. Every field is a CONSTANT — nothing here is derived from the
+ *  overlay's data, so the emitted bytes depend only on the parsed structure. */
+export interface OverlayModuleGrammar {
+  /** Human name of the overlay, for refusal messages ("grants overlay"). */
+  readonly what: string;
+  /** The fixed header comment. Every line already `//`-prefixed; ends with a newline. */
+  readonly header: string;
+  /** The single type-only import line (no trailing newline). Always the PACKAGE specifier, never a
+   *  relative one: the overlay's location in the deployer repo is configurable
+   *  (`OE_ACCESS_GRANTS_PATH` and friends), so a relative path could not be part of a fixed grammar. */
+  readonly typeImport: string;
+  readonly typeName: string;
+}
+
+function overlayModulePrefix(g: OverlayModuleGrammar): string {
+  return `${g.header}\n${g.typeImport}\n\nexport default `;
+}
+
+function overlayModuleSuffix(g: OverlayModuleGrammar): string {
+  return ` satisfies ${g.typeName};\n`;
+}
+
+/** Wrap a codemod's canonical JSON body into the module text. The body's own trailing newline is consumed by the suffix, so the emitted statement is one line-terminated `export default … satisfies T;`. */
+export function wrapOverlayModule(g: OverlayModuleGrammar, canonicalJson: string): string {
+  const body = canonicalJson.endsWith("\n") ? canonicalJson.slice(0, -1) : canonicalJson;
+  return `${overlayModulePrefix(g)}${body}${overlayModuleSuffix(g)}`;
+}
+
+/** Strip the grammar off an overlay module and `JSON.parse` the body, REFUSING through the caller's own error type when the prefix or suffix is absent — that is, when anything outside the data was touched. Whether the data is canonical, and whether it is well-shaped, are the caller's own checks. */
+export function unwrapOverlayModule(g: OverlayModuleGrammar, text: string, refuse: (message: string) => Error): unknown {
+  const prefix = overlayModulePrefix(g);
+  const suffix = overlayModuleSuffix(g);
+  if (!text.startsWith(prefix)) {
+    throw refuse(
+      `${g.what} module does not start with the generated header + \`export default \` (this file is machine-owned; run \`npm run overlays:normalize\` after editing its data, and never edit anything outside it)`,
+    );
+  }
+  if (!text.endsWith(suffix)) {
+    throw refuse(
+      `${g.what} module does not end with \`${suffix.trimEnd()}\` — it must contain exactly one \`export default <data> satisfies ${g.typeName};\` statement and nothing else`,
+    );
+  }
+  if (text.length < prefix.length + suffix.length) {
+    throw refuse(`${g.what} module has no data between its header and its \`satisfies\` clause`);
+  }
+  const body = text.slice(prefix.length, text.length - suffix.length);
+  try {
+    return JSON.parse(body) as unknown;
+  } catch (err) {
+    throw refuse(`${g.what} module's data is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+
+/** The fixed header, parameterised only by what the file is and which codemod owns it. One function, so all three overlay headers state the machine-owned contract in the SAME words rather than drifting apart. */
+export function overlayModuleHeader(what: string, codemodPath: string): string {
+  return (
+    `// GENERATED + MACHINE-OWNED — DO NOT HAND-EDIT.\n` +
+    `//\n` +
+    `// The ${what}: DATA ONLY. Written exclusively by the deterministic codemod\n` +
+    `// (${codemodPath}) on a bot-PR branch; the PR merge is the approval gate.\n` +
+    `//\n` +
+    `// \`npm run lint:overlays\` (in the \`npm test\` chain) re-emits this file from its own parsed\n` +
+    `// content and FAILS on any byte difference, so a hand-edit — including one that adds executable\n` +
+    `// code — cannot merge green. That check is what makes it safe for this data to live in a module.\n` +
+    `//\n` +
+    `// To change it by hand: edit the data below, then run \`npm run overlays:normalize\`.\n`
+  );
+}

package/agent/access/own-account-gate-manifest.ts

@@ -0,0 +1,134 @@
+// The rule `lint:own-account-gate` enforces: every connector the own-account stamp producer recognises has at least one call site consulting the acting-identity gate. Each gated site names its connector in a marker, because the connector is passed as a value no scan of the source can resolve.
+
+/** One source file offered to the checker. `file` is a repo-relative path, used only in messages. */
+export interface OwnAccountGateFile {
+  readonly file: string;
+  readonly source: string;
+}
+
+/** One call of the acting-identity gate, with the connector its marker declared (when it had one). */
+export interface OwnAccountGateSite {
+  readonly file: string;
+  /** 1-based line of the call. */
+  readonly line: number;
+  /** The connector the marker above the call declared. `undefined` when there was no marker. */
+  readonly connector?: string;
+}
+
+/** The live binding every gated read calls. Named here so the checker and its message agree. */
+export const OWN_ACCOUNT_GATE_CALL = "connectorActingIdentityForTurn";
+
+/** The marker a gated call site carries, in the comment block immediately above the call:
+ *  `own-account-gate: <connector>`. One connector per marker; a site covering two carries two. */
+export const OWN_ACCOUNT_GATE_MARKER = "own-account-gate:";
+
+const MARKER_RE = /own-account-gate:\s*([A-Za-z0-9][A-Za-z0-9._-]*)/u;
+
+/** Comments and string literals blanked to spaces, line structure preserved, so a commented-out or quoted gate call can NEVER satisfy a gate. A template literal is blanked whole, so a call inside a substitution is invisible — fail-closed, since the connector then reads as ungated. */
+function codeOnlyLines(source: string): string {
+  const blank = (m: string): string => m.replace(/[^\n]/gu, " ");
+  return source
+    .replace(/\/\*[\s\S]*?\*\//gu, blank)
+    .replace(/\/\*[\s\S]*$/u, blank)
+    .replace(/\/\/[^\n]*/gu, blank)
+    .replace(/`[\s\S]*?`/gu, blank)
+    .replace(/"(?:[^"\\\n]|\\.)*"/gu, blank)
+    .replace(/'(?:[^'\\\n]|\\.)*'/gu, blank);
+}
+
+/** A CALL of the gate, and not its declaration, its import or its re-export. The call is the only
+ *  shape that carries an open parenthesis and is not a `function` declaration. Read from a
+ *  comment- and string-blanked line, never from raw text — see {@link codeOnlyLines}. */
+function isGateCall(line: string): boolean {
+  if (!line.includes(`${OWN_ACCOUNT_GATE_CALL}(`)) return false;
+  return !/\bfunction\s+connectorActingIdentityForTurn\s*\(/u.test(line);
+}
+
+/** The connectors declared by the contiguous comment block immediately above `line`. Contiguous means comment and blank lines only: a statement between the marker and the call detaches it, so a marker can never be inherited by a call below the one it was written for. */
+function markersAbove(lines: readonly string[], line: number): string[] {
+  const found: string[] = [];
+  for (let i = line - 2; i >= 0; i--) {
+    const text = (lines[i] ?? "").trim();
+    if (text === "") continue;
+    const isComment = text.startsWith("//") || text.startsWith("*") || text.startsWith("/*");
+    if (!isComment) break;
+    const m = MARKER_RE.exec(text);
+    if (m?.[1] !== undefined) found.push(m[1]);
+  }
+  return found;
+}
+
+/** Every acting-identity gate call in `files`, with the connectors its marker declared. */
+export function findOwnAccountGateSites(files: readonly OwnAccountGateFile[]): OwnAccountGateSite[] {
+  const sites: OwnAccountGateSite[] = [];
+  for (const { file, source } of files) {
+    // TWO VIEWS OF ONE FILE, and both are needed. The CALL is read from code only, so a comment can
+    // never satisfy a gate; the MARKER is read from the raw lines, because a marker IS a comment.
+    const lines = source.split("\n");
+    const code = codeOnlyLines(source).split("\n");
+    for (let i = 0; i < code.length; i++) {
+      if (!isGateCall(code[i] ?? "")) continue;
+      const declared = markersAbove(lines, i + 1);
+      if (declared.length === 0) sites.push({ file, line: i + 1 });
+      else for (const connector of declared) sites.push({ connector, file, line: i + 1 });
+    }
+  }
+  return sites;
+}
+
+/** Three rules: every admitted connector is gated, every gate names its connector, and a gate naming a connector NEITHER list recognises is a stale join. A `human-acting` connector with no borrow route is the one legitimate refusing gate; `humanActingConnectors` defaults to empty, the strict reading in both directions. */
+export function checkOwnAccountGateSites(
+  files: readonly OwnAccountGateFile[],
+  connectors: readonly string[],
+  humanActingConnectors: readonly string[] = [],
+): string[] {
+  const sites = findOwnAccountGateSites(files);
+  const problems: string[] = [];
+
+  for (const site of sites) {
+    if (site.connector !== undefined) continue;
+    problems.push(
+      `${site.file}:${site.line} — a \`${OWN_ACCOUNT_GATE_CALL}\` call with no \`${OWN_ACCOUNT_GATE_MARKER} <connector>\` ` +
+        `marker in the comment block above it. Say which connector this gate covers: the connector is passed as a value ` +
+        `and cannot be read from the source, so an unmarked gate covers nothing this lint can see.`,
+    );
+  }
+
+  const gated = new Set(sites.map((s) => s.connector).filter((c): c is string => c !== undefined));
+  const admitted = new Set(connectors);
+  const userPrincipal = new Set(humanActingConnectors);
+
+  // Rule 1 walks the producer's own UNION, not the borrow list alone: a rule keyed on one half would cover the human-acting half in one direction only. Sorted, so a config with several ungated vendors reports in a stable order.
+  for (const connector of [...new Set([...connectors, ...humanActingConnectors])].sort()) {
+    if (gated.has(connector)) continue;
+    const via = admitted.has(connector)
+      ? "is in CREDENTIAL_GRANT_ROLES (access/credential-grant.ts)"
+      : "declares a `human-acting` credential family (access/connector-credentials.ts)";
+    problems.push(
+      `\`${connector}\` ${via} but no call site consults the ` +
+        `acting-identity gate for it. The own-account grammar recognises the vendor the moment it reaches EITHER half of ` +
+        `\`ownAccountAskVendors()\` (connections/own-account-vendors.ts), so a ` +
+        `requester asking to act with their own ${connector} account is stamped — and every read then runs on the ` +
+        `deployment's own integration, which is the OPE-1525 defect. Add a \`${OWN_ACCOUNT_GATE_CALL}\` call at the line ` +
+        `that resolves the ${connector} credential, and mark it \`${OWN_ACCOUNT_GATE_MARKER} ${connector}\`.`,
+    );
+  }
+
+  for (const connector of [...gated].sort()) {
+    if (admitted.has(connector)) continue;
+    // A user-principal family with no borrow route refuses BY DESIGN — the legitimate second case
+    // rule 3's doc comment states. Only a connector neither list recognises is a stale join.
+    if (userPrincipal.has(connector)) continue;
+    problems.push(
+      `a gate marked \`${OWN_ACCOUNT_GATE_MARKER} ${connector}\` covers a connector NEITHER list recognises — ` +
+        `a stale join. ${connector} is not in CREDENTIAL_GRANT_ROLES (access/credential-grant.ts), so no grant can be ` +
+        `minted for it, and its catalogue declares no \`human-acting\` credential family (access/connector-credentials.ts), ` +
+        `so nothing says this deployment ever means to act as the person there. The gate still recognises an ask for ${connector} and ` +
+        `can then only ever REFUSE: a member naming their own ${connector} account is turned away with a route this ` +
+        `deployment cannot open, and no review decided that. Add ${connector} to the reviewed list, declare a ` +
+        `\`human-acting\` credential family for it, or delete the gate call together with its marker.`,
+    );
+  }
+
+  return problems;
+}