@open-everywhere/core 0.1.0

package/dist/agent/access/taint-signal.js

@@ -0,0 +1,236 @@
+// The per-turn signal that this turn ingested untrusted external content, carried in a per-session eve state slot. The turn boundary clears it only on positive proof of a new turn id, so every failure of the reset keeps the older, stricter value, and a missing eve context reads as not tainted.
+import { defineState } from "eve/context";
+import { taintEnabled } from "./taint-enforcement.js";
+// VALUE imports, and safe for the same reason taint-enforcement.ts's are: identity/trust.ts reaches
+// only the settings module and a pure string grammar, and settings/settings.ts reaches nothing in
+// audit.ts's cone. Neither touches channels/, which is the direction the note above forbids.
+import { declaredSurfaceTrust } from "../identity/trust.js";
+// Safe for the SAME reason (OPE-516): identity/author-trust.ts is a deliberate value-import LEAF —
+// it reaches only two zero-dependency string grammars, and imports `Group` type-only precisely so
+// this cone stays clean. Read its header before adding an import to it.
+import { authorRefutedByRegister } from "../identity/author-trust.js";
+import { getSettings } from "../settings/settings.js";
+const slot = defineState("open-everywhere.untrusted-ingested", () => ({ tainted: false }));
+/** Read the durable value defensively. The slot key is UNCHANGED from when it held a bare boolean,
+ *  so a session resumed across the OPE-299 deploy hands back `true`/`false`. A legacy `true` is
+ *  honoured as tainted-with-no-turn — the STRICTER migration: it survives until the first boundary
+ *  that can positively prove a new turn, rather than evaporating on resume. */
+function readState(v) {
+    if (v === true)
+        return { tainted: true };
+    if (v === false || v === undefined || v === null)
+        return { tainted: false };
+    if (typeof v === "object" && "tainted" in v) {
+        const s = v;
+        const kinds = Array.isArray(s.kinds) ? s.kinds.filter((k) => typeof k === "string") : [];
+        return {
+            turn: typeof s.turn === "string" ? s.turn : undefined,
+            tainted: s.tainted === true,
+            ...(kinds.length > 0 ? { kinds } : {}),
+        };
+    }
+    return { tainted: false };
+}
+/** Clears the signal at a turn boundary, called exactly once and first from the turn.started hook. An undefined turn id is not an error: the boundary cannot be proven, so the slot keeps what it had. */
+export function beginTaintTurn(turnId) {
+    try {
+        slot.update((cur) => {
+            const state = readState(cur);
+            if (turnId === undefined)
+                return state; // cannot prove a new turn ⇒ keep the stricter answer
+            if (state.turn === turnId)
+                return state; // same turn re-entered ⇒ never re-clear mid-turn
+            return { turn: turnId, tainted: false };
+        });
+    }
+    catch {
+        /* no session context here — nothing to reset, and never a reason to disturb the turn */
+    }
+}
+/** Marks that this turn ingested untrusted content, optionally naming the class of source, which is disclosure material and decides nothing. Called on every wrap, because wrapping stops structural breakout and not semantic injection, and it takes no turn id: it writes into whatever turn the boundary last established. */
+export function markUntrustedIngestedThisTurn(kind) {
+    // OPE-399: `taint.mode: "off"` ⇒ no mark is ever written, so no flip observer fires either (which
+    // is what keeps the native-subagent taint marker out of the store on an opted-out deployment).
+    if (!taintEnabled())
+        return;
+    let flipped = false;
+    let kindsGrew = false;
+    try {
+        slot.update((cur) => {
+            const state = readState(cur);
+            const kinds = state.kinds ?? [];
+            // MONOTONIC in both fields: the bit only ever sets, and the kind list only ever grows (first
+            // seen first, deduped). A repeat mark with no kind is a no-op on an already-tainted turn, so
+            // the common case still writes nothing new.
+            const nextKinds = kind !== undefined && !kinds.includes(kind) ? [...kinds, kind] : kinds;
+            if (state.tainted && nextKinds.length === kinds.length)
+                return state;
+            if (!state.tainted)
+                flipped = true;
+            if (nextKinds.length > kinds.length)
+                kindsGrew = true;
+            return { turn: state.turn, tainted: true, ...(nextKinds.length > 0 ? { kinds: nextKinds } : {}) };
+        });
+    }
+    catch {
+        /* no session context here — nothing to signal, never blocks the ingestion path */
+    }
+    // FIRST MARK OF THIS TURN ONLY (see registerTaintFlipObserver). Outside the `update` callback on
+    // purpose: `slot.update` is a state-transition function and must stay free of side effects, so a
+    // re-invocation by the serializer can never fire an observer twice.
+    if (flipped)
+        notifyTaintFlipped();
+    // EVERY DISTINCT NEW KIND (see registerTaintKindObserver) — the seam the forward stamp needs, and
+    // the reason the flip seam alone lost every source after the first. Outside the callback for the
+    // same reason, and AFTER the flip so an observer of both sees the bit before it sees the breakdown.
+    if (kindsGrew)
+        notifyTaintKindsGrew();
+}
+const flipObservers = [];
+/**
+ * Observe the moment THIS turn's taint bit goes false → true. Registered once at module load by
+ * hooks/spawn-taint.ts. Observers are side-effect-only and must never throw to the ingestion path —
+ * {@link notifyTaintFlipped} swallows anything they raise, because a failure to record a taint fact
+ * may not be allowed to fail the read that produced it (the approval-card control is primary).
+ */
+export function registerTaintFlipObserver(observer) {
+    flipObservers.push(observer);
+}
+function notifyTaintFlipped() {
+    for (const observer of flipObservers) {
+        try {
+            observer();
+        }
+        catch {
+            /* an observer is a recorder, never a gate — the mark itself has already landed */
+        }
+    }
+}
+const kindObservers = [];
+/**
+ * Observe the moment THIS turn's kind list GROWS — including the first kind of the turn, which also
+ * fires the flip seam. Registered once at module load by hooks/spawn-taint.ts. Same swallowing
+ * contract as {@link registerTaintFlipObserver}, and the same reason for it.
+ */
+export function registerTaintKindObserver(observer) {
+    kindObservers.push(observer);
+}
+function notifyTaintKindsGrew() {
+    for (const observer of kindObservers) {
+        try {
+            observer();
+        }
+        catch {
+            /* an observer is a recorder, never a gate — the mark itself has already landed */
+        }
+    }
+}
+/** Did this turn ingest untrusted external content? The bit is marking, not gating: it changes a verdict only at the gate-tier sinks, where it floors the decision to ask. Fail-soft, so no session context reads false. */
+export function untrustedIngestedThisTurn() {
+    if (!taintEnabled())
+        return false; // OPE-399 — including over a durable `true` written before the flip
+    try {
+        return readState(slot.get()).tainted;
+    }
+    catch {
+        return false;
+    }
+}
+/** Would a mark here actually land? The render-time ingestion sites call this instead of hardcoding false, so a render path that ever ran in-turn shows up as an over-taint row rather than a premise nobody re-checks. It reads the slot and never creates state. */
+export function taintMarkLands() {
+    try {
+        slot.get();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * WHICH classes of source this turn ingested, for disclosure (OPE-307). Ordered first-seen,
+ * deduped, and DELIBERATELY ALLOWED TO BE EMPTY on a tainted turn — the auth-attribute seeds mark
+ * without a kind, so an empty list means "no breakdown", never "clean". Always read alongside
+ * {@link untrustedIngestedThisTurn}, never instead of it. Fail-soft: no session context → empty.
+ */
+export function taintKindsThisTurn() {
+    if (!taintEnabled())
+        return []; // OPE-399 — no breakdown, because there is no marking to break down
+    try {
+        return readState(slot.get()).kinds ?? [];
+    }
+    catch {
+        return [];
+    }
+}
+// A triggered fire renders its prompt in the ingress process, outside any turn, so the mark would no-op there. The taint is carried instead by a host-set auth attribute that the turn.started hook seeds into the per-turn slot.
+/** Auth attribute marking a TRIGGERED FIRE whose opening prompt carries untrusted external content.
+ *  Host-set at dispatch, model-unforgeable (see channels/unified-window.ts §AUTH-ATTRIBUTE
+ *  PROVENANCE), and consumed by hooks/spawn-taint.ts at `turn.started`. */
+export const OE_TAINTED_FIRE_ATTR = "oe_tainted_fire";
+/** Positive-only: an untainted fire gets an empty bag, so nothing has to reason about a false string. The tainted flag is the caller's own judgement, and a config webhook always renders its raw body wrapped while an event fire is tainted unless the delivery was redacted. */
+export function taintedFireAttrs(tainted) {
+    return tainted ? { [OE_TAINTED_FIRE_ATTR]: "true" } : {};
+}
+// Taint keys on ingestion, not on presence: a turn marks when a message a non-member wrote actually enters the session context. A chat wake renders outside any turn, so the carriage is the same host-set auth attribute, and this leg never routes through decideIngestion.
+/** Auth attribute marking a chat wake whose ingested content includes a message written by an author
+ *  the surface's identity gate could not vouch as a member. Host-set at the wake dispatch,
+ *  model-unforgeable (see channels/unified-window.ts §AUTH-ATTRIBUTE PROVENANCE), and consumed by
+ *  hooks/spawn-taint.ts at `turn.started`. */
+export const OE_CHAT_NONMEMBER_ATTR = "oe_chat_nonmember";
+/**
+ * The attribute fragment a chat wake spreads into the woken session's auth bag. POSITIVE-ONLY, for
+ * the same reason as {@link taintedFireAttrs}: a member-only wake gets `{}`, so its bag is
+ * byte-identical to before this existed and nothing has to reason about a `"false"` string.
+ *
+ * `nonMember` is the JOIN the dispatching surface computes — see {@link nonMemberChatTrust}.
+ */
+export function nonMemberChatAttrs(nonMember) {
+    return nonMember ? { [OE_CHAT_NONMEMBER_ATTR]: "true" } : {};
+}
+/** The wake-trust tiers that name a HUMAN author. `relay` is the machine floor and is deliberately
+ *  absent — see {@link nonMemberChatTrust}. An entry with NO tier is not on this list either, which
+ *  is what keeps the register leg from grading an author the surface never graded. */
+const HUMAN_TIERS = new Set(["principal", "peer", "unauth"]);
+/** Marks only on a positive refutation, never on bare unauth, which is a three-way disjunction that once made every human-authored turn on an undeclared guild mark. The two sources of refutation are the surface's verdict and the operator's register, and a relay machine author is deliberately excluded. */
+export function nonMemberChatTrust(m) {
+    if (m.trust === "relay")
+        return false; // machine author — below peer, but not a person outside the org
+    if (m.refuted === true)
+        return true; // the SURFACE positively refuted this author
+    // THE REGISTER LEG (OPE-516) — the OPERATOR's refutation, for Discord and Notion, which have no
+    // surface verdict to give. It requires a POSITIVELY-HUMAN tier rather than merely "not relay":
+    // an entry the surface never graded must not be graded here either, or an ungraded machine author
+    // would start marking every turn it posts on — the always-on-bit failure, arriving by a third door.
+    if (m.authorTrust === undefined || m.trust === undefined || !HUMAN_TIERS.has(m.trust))
+        return false;
+    return authorRefutedByRegister(m.authorTrust);
+}
+/** A room declared public marks, a room declared internal does not, and an undeclared room follows the taint.undeclaredSurface setting, shipped clean. Undeclared is never read as public: silence means the operator has not declared, not that the room is open to the world. */
+export function chatRoomMarks(room) {
+    if (room.dm === true || room.surfaceKey === undefined)
+        return false;
+    const segs = room.surfaceKey.split("/");
+    if (segs.length < 3)
+        return false; // not a surface-grain key — nothing to resolve
+    const declared = declaredSurfaceTrust({
+        tenantKey: segs.slice(0, 2).join("/"),
+        surfaceKeys: [room.surfaceKey],
+        ...(room.groupKey === undefined ? {} : { groupKey: room.groupKey }),
+    });
+    if (declared === "public")
+        return true;
+    if (declared === "internal")
+        return false;
+    return getSettings().taint.undeclaredSurface === "mark";
+}
+/** The join over one wake: the room leg, then the author leg over every ingested message. The two are additive and neither subsumes the other, because the room gates audience and the register gates authority, and an entry the surface could not grade contributes nothing. */
+export function chatWakeIngestsNonMember(ingested, room) {
+    return chatRoomMarks(room) || ingested.some(nonMemberChatTrust);
+}
+/** Stamps the carriage onto the delivery auth when either leg says yes, returning the input auth by reference when neither does. The room argument is required rather than optional, because a call site that silently lost the room leg would lose the entire trust statement on Discord and Notion. */
+export function stampNonMemberChatAuth(auth, ingested, room) {
+    if (!chatWakeIngestsNonMember(ingested, room))
+        return auth;
+    return { ...auth, attributes: { ...(auth.attributes ?? {}), ...nonMemberChatAttrs(true) } };
+}
+//# sourceMappingURL=taint-signal.js.map

package/dist/agent/access/taint-signal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"taint-signal.js","sourceRoot":"","sources":["../../../agent/access/taint-signal.ts"],"names":[],"mappings":"AAAA,uSAAuS;AAEvS,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAM1C,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,oGAAoG;AACpG,kGAAkG;AAClG,6FAA6F;AAC7F,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,mGAAmG;AACnG,kGAAkG;AAClG,wEAAwE;AACxE,OAAO,EAAE,uBAAuB,EAAyB,MAAM,6BAA6B,CAAC;AAC7F,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAWtD,MAAM,IAAI,GAAG,WAAW,CAAa,oCAAoC,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AAEvG;;;+EAG+E;AAC/E,SAAS,SAAS,CAAC,CAAU;IAC3B,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5E,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,SAAS,IAAK,CAA6B,EAAE,CAAC;QACzE,MAAM,CAAC,GAAG,CAA2D,CAAC;QACtE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtG,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YACrD,OAAO,EAAE,CAAC,CAAC,OAAO,KAAK,IAAI;YAC3B,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,0MAA0M;AAC1M,MAAM,UAAU,cAAc,CAAC,MAA0B;IACvD,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC,CAAC,qDAAqD;YAC7F,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAO,KAAK,CAAC,CAAC,iDAAiD;YAC1F,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC1C,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,wFAAwF;IAC1F,CAAC;AACH,CAAC;AAED,kUAAkU;AAClU,MAAM,UAAU,6BAA6B,CAAC,IAAoB;IAChE,kGAAkG;IAClG,+FAA+F;IAC/F,IAAI,CAAC,YAAY,EAAE;QAAE,OAAO;IAC5B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;YAChC,6FAA6F;YAC7F,6FAA6F;YAC7F,4CAA4C;YAC5C,MAAM,SAAS,GAAG,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YACzF,IAAI,KAAK,CAAC,OAAO,IAAI,SAAS,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;YACrE,IAAI,CAAC,KAAK,CAAC,OAAO;gBAAE,OAAO,GAAG,IAAI,CAAC;YACnC,IAAI,SAAS,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM;gBAAE,SAAS,GAAG,IAAI,CAAC;YACtD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACpG,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,kFAAkF;IACpF,CAAC;IACD,iGAAiG;IACjG,iGAAiG;IACjG,oEAAoE;IACpE,IAAI,OAAO;QAAE,kBAAkB,EAAE,CAAC;IAClC,kGAAkG;IAClG,iGAAiG;IACjG,oGAAoG;IACpG,IAAI,SAAS;QAAE,oBAAoB,EAAE,CAAC;AACxC,CAAC;AAMD,MAAM,aAAa,GAAwB,EAAE,CAAC;AAE9C;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAA2B;IACnE,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,kBAAkB;IACzB,KAAK,MAAM,QAAQ,IAAI,aAAa,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,QAAQ,EAAE,CAAC;QACb,CAAC;QAAC,MAAM,CAAC;YACP,kFAAkF;QACpF,CAAC;IACH,CAAC;AACH,CAAC;AAMD,MAAM,aAAa,GAAwB,EAAE,CAAC;AAE9C;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAA2B;IACnE,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,oBAAoB;IAC3B,KAAK,MAAM,QAAQ,IAAI,aAAa,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,QAAQ,EAAE,CAAC;QACb,CAAC;QAAC,MAAM,CAAC;YACP,kFAAkF;QACpF,CAAC;IACH,CAAC;AACH,CAAC;AAED,4NAA4N;AAC5N,MAAM,UAAU,yBAAyB;IACvC,IAAI,CAAC,YAAY,EAAE;QAAE,OAAO,KAAK,CAAC,CAAC,oEAAoE;IACvG,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,sQAAsQ;AACtQ,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC;QACH,IAAI,CAAC,GAAG,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,CAAC,YAAY,EAAE;QAAE,OAAO,EAAE,CAAC,CAAC,oEAAoE;IACpG,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,kOAAkO;AAElO;;2EAE2E;AAC3E,MAAM,CAAC,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;AAEtD,mRAAmR;AACnR,MAAM,UAAU,gBAAgB,CAAC,OAAgB;IAC/C,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,8QAA8Q;AAE9Q;;;8CAG8C;AAC9C,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAE1D;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAkB;IACnD,OAAO,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/D,CAAC;AAsBD;;sFAEsF;AACtF,MAAM,WAAW,GAA2B,IAAI,GAAG,CAAY,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEhG,kTAAkT;AAClT,MAAM,UAAU,kBAAkB,CAAC,CAAsB;IACvD,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC,CAAC,gEAAgE;IACvG,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,6CAA6C;IAClF,gGAAgG;IAChG,+FAA+F;IAC/F,kGAAkG;IAClG,oGAAoG;IACpG,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpG,OAAO,uBAAuB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;AAChD,CAAC;AAoBD,mRAAmR;AACnR,MAAM,UAAU,aAAa,CAAC,IAAkB;IAC9C,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACpE,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,+CAA+C;IAClF,MAAM,QAAQ,GAAG,oBAAoB,CAAC;QACpC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACrC,WAAW,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC;QAC9B,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;KACpE,CAAC,CAAC;IACH,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,QAAQ,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,WAAW,EAAE,CAAC,KAAK,CAAC,iBAAiB,KAAK,MAAM,CAAC;AAC1D,CAAC;AAED,kRAAkR;AAClR,MAAM,UAAU,wBAAwB,CAAC,QAAwC,EAAE,IAAkB;IACnG,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAClE,CAAC;AAED,ySAAyS;AACzS,MAAM,UAAU,sBAAsB,CACpC,IAAO,EACP,QAAwC,EACxC,IAAkB;IAElB,IAAI,CAAC,wBAAwB,CAAC,QAAQ,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,OAAO,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,GAAG,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;AAC9F,CAAC"}

package/dist/agent/access/taint-tiers.d.ts

@@ -0,0 +1,64 @@
+/** Does the source taint the turn that reads it? */
+export type IngestionTier = "trusted" | "untrusted";
+/** The classes of ingestion OE has. One row of the table each — adding an ingestion site means
+ *  naming its kind here, which is the point: a new read tool cannot quietly invent its own policy. */
+export type IngestionKind = 
+/** Chat message bodies + backscroll on a conversational surface (Slack / Discord / Teams). */
+"chat-message"
+/** Notion page bodies and page comments. */
+ | "notion"
+/** Linear issue bodies and comments. */
+ | "linear"
+/** GitHub: PR review feedback, issue bodies, diffs. */
+ | "github"
+/** A connector / MCP tool result. */
+ | "connector"
+/** web_fetch, web_search, browser_*. */
+ | "web"
+/** A webhook delivery payload. */
+ | "webhook"
+/** A routine's event body (the hydrated entity a triggered fire is about). */
+ | "routine-event"
+/** A delegated worker's returned result. */
+ | "delegation-result"
+/** describe_image's model-authored description + OCR of an image. */
+ | "image-description"
+/** read_file_upload's file content. */
+ | "file-upload"
+/** The `aws` CLI's stdout/stderr — CloudWatch log bodies, DynamoDB items, S3 listings, EC2 tags. */
+ | "aws"
+/** A skill script's self-declared external fetch (OPE-361): a sandbox script wrapped bytes it
+ *  fetched in the stdout taint envelope, and the host (bash `toModelOutput`) routed the span
+ *  here. Unconditionally untrusted, no metadata branch — a sandbox script may only ADD taint. */
+ | "skill-declared"
+/** The federated `search` tool's result. Unconditionally untrusted with no metadata branch: one call can federate several connectors, so no single instance's trust tier could stand for the row. */
+ | "work-search";
+/** What a site declares about the bytes it is ingesting. Sites pass THIS; they never inline a tier
+ *  decision. Every field beyond `kind` is a fact about the SOURCE INSTANCE, readable at read time —
+ *  never a judgement, and never anything derived from the content itself. */
+export interface IngestionSource {
+    readonly kind: IngestionKind;
+    /** GitHub: `repository.private` as the API reports it. Absent ⇒ fail-closed. */
+    readonly repoPrivate?: boolean;
+    /** Notion / Linear: the BOUND workspace's declared tier. Absent ⇒ fail-closed. */
+    readonly workspaceTrust?: "internal" | "public";
+    /** Connector / MCP: the GRANT's declared `contentOrigin` for this connection AND this tool
+     *  (reviewed config; a grant may declare per-tool exceptions). Absent ⇒ fail-closed, which is also
+     *  the ruled DEFAULT for a connection whose grant says nothing. */
+    readonly grantContentOrigin?: "internal" | "external";
+    /** Chat: the read returned at least one message whose author was POSITIVELY REFUTED as a non-member. Absent and `false` mean the same thing here and neither is fail-closed, because this is a positive refutation rather than an instance fact, and the whole author plane fails OPEN. */
+    readonly authoredByNonMember?: boolean;
+    /** A short taint-CLEAN label for the audit row — a tool or connector NAME, never content. */
+    readonly label?: string;
+}
+export interface IngestionVerdict {
+    readonly tier: IngestionTier;
+    readonly reason: string;
+    /** True when the deciding metadata was ABSENT and the fail-closed default decided instead. */
+    readonly assumed: boolean;
+}
+/** The table: one case per IngestionKind. Pure, with no I/O, no context and no clock, so it is testable row by row and safe to call from anywhere. */
+export declare function classifyIngestion(src: IngestionSource): IngestionVerdict;
+/** Every kind, for the row-by-row test and for anything that wants to enumerate the table. */
+export declare const INGESTION_KINDS: readonly IngestionKind[];
+//# sourceMappingURL=taint-tiers.d.ts.map

package/dist/agent/access/taint-tiers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"taint-tiers.d.ts","sourceRoot":"","sources":["../../../agent/access/taint-tiers.ts"],"names":[],"mappings":"AAGA,oDAAoD;AACpD,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,WAAW,CAAC;AAEpD;sGACsG;AACtG,MAAM,MAAM,aAAa;AACvB,8FAA8F;AAC5F,cAAc;AAChB,4CAA4C;GAC1C,QAAQ;AACV,wCAAwC;GACtC,QAAQ;AACV,uDAAuD;GACrD,QAAQ;AACV,qCAAqC;GACnC,WAAW;AACb,wCAAwC;GACtC,KAAK;AACP,kCAAkC;GAChC,SAAS;AACX,8EAA8E;GAC5E,eAAe;AACjB,4CAA4C;GAC1C,mBAAmB;AACrB,qEAAqE;GACnE,mBAAmB;AACrB,uCAAuC;GACrC,aAAa;AACf,oGAAoG;GAClG,KAAK;AACP;;iGAEiG;GAC/F,gBAAgB;AAClB,qMAAqM;GACnM,aAAa,CAAC;AAElB;;6EAE6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,gFAAgF;IAChF,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,cAAc,CAAC,EAAE,UAAU,GAAG,QAAQ,CAAC;IAChD;;uEAEmE;IACnE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC;IACtD,2RAA2R;IAC3R,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IACvC,6FAA6F;IAC7F,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8FAA8F;IAC9F,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAUD,sJAAsJ;AACtJ,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,eAAe,GAAG,gBAAgB,CAuExE;AAED,8FAA8F;AAC9F,eAAO,MAAM,eAAe,EAAE,SAAS,aAAa,EAenD,CAAC"}

package/dist/agent/access/taint-tiers.js

@@ -0,0 +1,93 @@
+// The code-pinned table that decides whether reading from a source taints the turn; declaring sites reach it through access/taint-enforcement.ts.
+// Enforcement is RELAXATION-ONLY (a site that taints may stop, a site that does not never starts), the granularity is source-instance-binary, and a row whose deciding metadata is ABSENT fails closed to untrusted with `assumed: true`.
+const untrusted = (reason, assumed = false) => ({ tier: "untrusted", reason, assumed });
+const trusted = (reason) => ({ tier: "trusted", reason, assumed: false });
+/** The fail-closed answer, used by every row whose deciding metadata is missing. */
+function unknownInstance(what) {
+    return untrusted(`${what} could not be read at ingestion time, so the source instance is unproven — fail-closed to untrusted`, true);
+}
+/** The table: one case per IngestionKind. Pure, with no I/O, no context and no clock, so it is testable row by row and safe to call from anywhere. */
+export function classifyIngestion(src) {
+    switch (src.kind) {
+        case "chat-message":
+            // The one branch: a chat read that returned a POSITIVELY-REFUTED non-member's message taints. REFUTE-ONLY, never "not vouched" - a probe that cannot answer, an unarmed tenant and a bot author all leave it absent, and a members-only read is never marked.
+            if (src.authoredByNonMember === true) {
+                return untrusted("a chat message written by an author POSITIVELY REFUTED as a non-member — the surface's own identity probe or the operator's author-trust register said guest/stranger/unlisted, so a person outside the org authored bytes this turn read");
+            }
+            // A member-authored chat body never integrity-taints: the wake body is rendered at INGRESS outside any turn, the authors are members verified by the surface's own identity system, and an external surface is already classified by surface trust one layer up.
+            return trusted("a chat message body on a member-authored surface; external surfaces are classified by surface trust one layer up, not here");
+        case "notion":
+        case "linear":
+            // Follow the BOUND workspace's declared tier. An internal Notion/Linear workspace is org
+            // property with org membership — the same trust basis as a private chat channel — and taints
+            // nothing. A public workspace is a stranger's typing surface and taints.
+            if (src.workspaceTrust === "internal")
+                return trusted(`the bound ${src.kind} workspace is declared internal — org-member-authored, same basis as a private channel`);
+            if (src.workspaceTrust === "public")
+                return untrusted(`the bound ${src.kind} workspace is declared public — anyone can author into it`);
+            return unknownInstance(`the bound ${src.kind} workspace's declared tier`);
+        case "github":
+            // REPO VISIBILITY, and it is the one row whose metadata is genuinely available at read time
+            // (`repository.private` rides every API response OE already fetches). A PRIVATE org repo is
+            // org property. A PUBLIC repo takes PR bodies, review comments and diffs from anyone with a
+            // fork — that is a stranger's typing surface with extra steps, and it taints.
+            if (src.repoPrivate === true)
+                return trusted("a private org repository — its issues, reviews and diffs are org-authored");
+            if (src.repoPrivate === false)
+                return untrusted("a PUBLIC repository — a PR body, review comment or diff can be authored by anyone with a fork");
+            return unknownInstance("the repository's `private` flag");
+        case "connector":
+            // The grant declares it, per connection and optionally per tool, in reviewed config. The question is who AUTHORS the bytes rather than how the connection is reached, and silence defaults to external because it must never read as an assurance.
+            if (src.grantContentOrigin === "internal")
+                return trusted("the connection's grant declares `contentOrigin: internal` for this tool in reviewed bundle config — org members author what it returns");
+            if (src.grantContentOrigin === "external")
+                return untrusted("the connection's grant declares `contentOrigin: external` for this tool — the bytes it returns are authored outside the org");
+            return untrusted("the connection's grant declares no content origin — the ruled DEFAULT is external/untrusted, because silence in config must never read as an assurance", true);
+        case "web":
+            // No instance to classify. A fetched page, a search result and a browsed DOM are the open
+            // internet; there is no configuration under which they are not.
+            return untrusted("the open web — no bound instance, no membership, no configuration that could make it internal");
+        case "webhook":
+            return untrusted("a webhook delivery payload — authored by whoever can reach the endpoint");
+        case "routine-event":
+            return untrusted("a routine's event body — the hydrated entity an outside party's action produced");
+        case "delegation-result":
+            // No site declares this kind since OPE-1145; the row stays because the switch must be total and its answer is the safe one. The surviving native return leg establishes a worker's taint through a durable marker row (access/subagent-taint.ts) that fails CLOSED, which this table never consults.
+            return untrusted("a delegated worker's result — untrusted by provenance: a worker's prose distils whatever wide-hands reads it made");
+        case "image-description":
+            // Ratified exception to the instance-binary rule (2026-08-08): always untrusted regardless of who posted the image. The bytes are a second model's transcription of pixels nobody proof-read, so the poster's own trustworthiness says nothing about the payload.
+            return untrusted("describe_image: a second model's transcription of pixels nobody proof-read — untrusted regardless of who posted it (ratified exception to the instance-binary rule, 2026-08-08)");
+        case "file-upload":
+            // Always untrusted regardless of who uploaded it (ruled 2026-08-07): "a member uploaded it" is a claim about the UPLOAD, not the FILE. No metadata branch, so this row needs no uploader identity and its verdicts are exact, never `assumed`.
+            return untrusted("a file upload — always untrusted regardless of who uploaded it (ruled 2026-08-07: authorship ≠ provenance; instructions inside a file are data, never acted on)");
+        case "aws":
+            // Unconditionally untrusted, and a POSITIVE ruling rather than the fail-closed default, so `assumed` stays false. An AWS account is a SUBSTRATE, not an authoring surface - nothing gates who writes a log line, a table item or an object body - and a per-service branch OE cannot decide correctly would be false precision.
+            return untrusted("the `aws` CLI's own output — an AWS account is a SUBSTRATE, not an authoring surface: nothing gates who writes a log line, a table item or an object body, so org ownership of the account says nothing about who wrote the bytes");
+        case "skill-declared":
+            // Unconditionally untrusted with no metadata branch, and that is the security property rather than an omission: the sandbox is an untrusted execution environment, so this row has no field a sandbox-emitted envelope could set to reach `trusted`. The envelope may only ever ADD taint.
+            return untrusted("a skill script's self-declared external fetch — a sandbox script vouching for its own bytes may only ADD taint, never relax; unconditional, no metadata branch");
+        case "work-search":
+            // Unconditionally untrusted: one call can mix several connectors' hits in a single result, so no one instance's trust tier could stand for the whole row.
+            return untrusted("the federated search tool's result — a single call can mix several connectors' hits, so no one instance's trust tier could stand for the whole row; titles are arbitrary workspace text either way");
+    }
+}
+/** Every kind, for the row-by-row test and for anything that wants to enumerate the table. */
+export const INGESTION_KINDS = [
+    "chat-message",
+    "notion",
+    "linear",
+    "github",
+    "connector",
+    "web",
+    "webhook",
+    "routine-event",
+    "delegation-result",
+    "image-description",
+    "file-upload",
+    "aws",
+    "skill-declared",
+    "work-search",
+];
+// Within-generation compaction deliberately has no row: the summary is produced and consumed inside one generation and never crosses an ingestion seam.
+// FRAGILE POINT: any future feature that pipes a compaction summary OUT, into a memory write, a delegation brief or anything a next generation reads, creates that seam and needs its own ratified row there.
+//# sourceMappingURL=taint-tiers.js.map

package/dist/agent/access/taint-tiers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"taint-tiers.js","sourceRoot":"","sources":["../../../agent/access/taint-tiers.ts"],"names":[],"mappings":"AAAA,kJAAkJ;AAClJ,0OAA0O;AAiE1O,MAAM,SAAS,GAAG,CAAC,MAAc,EAAE,OAAO,GAAG,KAAK,EAAoB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;AAClH,MAAM,OAAO,GAAG,CAAC,MAAc,EAAoB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;AAEpG,oFAAoF;AACpF,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,SAAS,CAAC,GAAG,IAAI,qGAAqG,EAAE,IAAI,CAAC,CAAC;AACvI,CAAC;AAED,sJAAsJ;AACtJ,MAAM,UAAU,iBAAiB,CAAC,GAAoB;IACpD,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,cAAc;YACjB,8PAA8P;YAC9P,IAAI,GAAG,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;gBACrC,OAAO,SAAS,CACd,2OAA2O,CAC5O,CAAC;YACJ,CAAC;YACD,iQAAiQ;YACjQ,OAAO,OAAO,CAAC,4HAA4H,CAAC,CAAC;QAE/I,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ;YACX,yFAAyF;YACzF,6FAA6F;YAC7F,yEAAyE;YACzE,IAAI,GAAG,CAAC,cAAc,KAAK,UAAU;gBAAE,OAAO,OAAO,CAAC,aAAa,GAAG,CAAC,IAAI,wFAAwF,CAAC,CAAC;YACrK,IAAI,GAAG,CAAC,cAAc,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC,aAAa,GAAG,CAAC,IAAI,2DAA2D,CAAC,CAAC;YACxI,OAAO,eAAe,CAAC,aAAa,GAAG,CAAC,IAAI,4BAA4B,CAAC,CAAC;QAE5E,KAAK,QAAQ;YACX,4FAA4F;YAC5F,4FAA4F;YAC5F,4FAA4F;YAC5F,8EAA8E;YAC9E,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI;gBAAE,OAAO,OAAO,CAAC,2EAA2E,CAAC,CAAC;YAC1H,IAAI,GAAG,CAAC,WAAW,KAAK,KAAK;gBAAE,OAAO,SAAS,CAAC,+FAA+F,CAAC,CAAC;YACjJ,OAAO,eAAe,CAAC,iCAAiC,CAAC,CAAC;QAE5D,KAAK,WAAW;YACd,mPAAmP;YACnP,IAAI,GAAG,CAAC,kBAAkB,KAAK,UAAU;gBAAE,OAAO,OAAO,CAAC,wIAAwI,CAAC,CAAC;YACpM,IAAI,GAAG,CAAC,kBAAkB,KAAK,UAAU;gBAAE,OAAO,SAAS,CAAC,6HAA6H,CAAC,CAAC;YAC3L,OAAO,SAAS,CAAC,wJAAwJ,EAAE,IAAI,CAAC,CAAC;QAEnL,KAAK,KAAK;YACR,0FAA0F;YAC1F,gEAAgE;YAChE,OAAO,SAAS,CAAC,+FAA+F,CAAC,CAAC;QAEpH,KAAK,SAAS;YACZ,OAAO,SAAS,CAAC,yEAAyE,CAAC,CAAC;QAE9F,KAAK,eAAe;YAClB,OAAO,SAAS,CAAC,iFAAiF,CAAC,CAAC;QAEtG,KAAK,mBAAmB;YACtB,qSAAqS;YACrS,OAAO,SAAS,CAAC,mHAAmH,CAAC,CAAC;QAExI,KAAK,mBAAmB;YACtB,kQAAkQ;YAClQ,OAAO,SAAS,CAAC,iLAAiL,CAAC,CAAC;QAEtM,KAAK,aAAa;YAChB,+OAA+O;YAC/O,OAAO,SAAS,CAAC,iKAAiK,CAAC,CAAC;QAEtL,KAAK,KAAK;YACR,gUAAgU;YAChU,OAAO,SAAS,CAAC,mOAAmO,CAAC,CAAC;QAExP,KAAK,gBAAgB;YACnB,2RAA2R;YAC3R,OAAO,SAAS,CAAC,gKAAgK,CAAC,CAAC;QAErL,KAAK,aAAa;YAChB,0JAA0J;YAC1J,OAAO,SAAS,CAAC,oMAAoM,CAAC,CAAC;IAC3N,CAAC;AACH,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,MAAM,eAAe,GAA6B;IACvD,cAAc;IACd,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,WAAW;IACX,KAAK;IACL,SAAS;IACT,eAAe;IACf,mBAAmB;IACnB,mBAAmB;IACnB,aAAa;IACb,KAAK;IACL,gBAAgB;IAChB,aAAa;CACd,CAAC;AAEF,wJAAwJ;AACxJ,8MAA8M"}

package/dist/agent/access/task-wake-signal.d.ts

@@ -0,0 +1,9 @@
+/** Records once per turn whether this turn brought a delivery of its own. Pure state with no I/O, because a store read in a turn preamble re-executes on eve's inline-step redelivery; `deliveryStamp` must be the RAW value from `deliveryStampOf`, never `currentWakeId`, which answers undefined for an uningressed turn. */
+export declare function noteTurnBoundary(turnId: string | undefined, deliveryStamp: string | undefined): void;
+/** Did this turn start without a delivery of its own — the shape of a background-task settlement wake. Answers `false` for every turn the comparison cannot prove, which is the direction that changes nothing. */
+export declare function uningressedTurn(turnId: string | undefined): boolean;
+/** Gives this turn the wake identity minted for one background task and reports whether it landed. FIRST WRITE WINS within a turn: two tasks can settle into one turn, and a later settlement must not move the address out from under an answer already composed. */
+export declare function adoptTaskWakeThisTurn(turnId: string | undefined, taskId: string, wakeId: string): boolean;
+/** The wake identity this turn adopted, or `undefined`. The turn id is the whole fence: a value stamped for another turn is never returned, so the durable slot cannot leak an address into a later turn. */
+export declare function taskWakeThisTurn(turnId: string | undefined): string | undefined;
+//# sourceMappingURL=task-wake-signal.d.ts.map

package/dist/agent/access/task-wake-signal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-wake-signal.d.ts","sourceRoot":"","sources":["../../../agent/access/task-wake-signal.ts"],"names":[],"mappings":"AAkCA,gUAAgU;AAChU,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAepG;AAED,mNAAmN;AACnN,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAQnE;AAED,sQAAsQ;AACtQ,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAkBzG;AAED,6MAA6M;AAC7M,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAQ/E"}

package/dist/agent/access/task-wake-signal.js

@@ -0,0 +1,86 @@
+// A task-settlement wake carries no auth, so the turn inherits the PREVIOUS delivery's `oe_wake_id` — which is a live reply address into another conversation. This slot stamps the turn id into the value and refuses to answer for any other turn, because eve `defineState` is durable across turns.
+import { defineState } from "eve/context";
+const slot = defineState("open-everywhere.task-wake", () => ({}));
+/** Read the durable value defensively — the slot is eve state, so a resumed session can hand back
+ *  anything a previous deployment wrote. Anything unrecognised reads as "no identity". */
+function readState(v) {
+    if (v === null || typeof v !== "object")
+        return {};
+    const s = v;
+    const identity = typeof s.turn === "string" && s.turn.length > 0 && typeof s.wakeId === "string" && s.wakeId.length > 0
+        ? { turn: s.turn, wakeId: s.wakeId, ...(typeof s.taskId === "string" && s.taskId.length > 0 ? { taskId: s.taskId } : {}) }
+        : {};
+    const boundary = typeof s.seenTurn === "string" && s.seenTurn.length > 0
+        ? { seenTurn: s.seenTurn, ...(typeof s.seenDelivery === "string" && s.seenDelivery.length > 0 ? { seenDelivery: s.seenDelivery } : {}), uningressed: s.uningressed === true }
+        : {};
+    return { ...identity, ...boundary };
+}
+/** Records once per turn whether this turn brought a delivery of its own. Pure state with no I/O, because a store read in a turn preamble re-executes on eve's inline-step redelivery; `deliveryStamp` must be the RAW value from `deliveryStampOf`, never `currentWakeId`, which answers undefined for an uningressed turn. */
+export function noteTurnBoundary(turnId, deliveryStamp) {
+    if (turnId === undefined || turnId.length === 0)
+        return; // cannot prove a new turn ⇒ record nothing
+    try {
+        slot.update((cur) => {
+            const state = readState(cur);
+            if (state.seenTurn === turnId)
+                return state; // a re-fired boundary for the same turn
+            // UNINGRESSED ⇔ a previous boundary exists AND this turn's stamp is byte-identical to it. A
+            // session's first turn, and any turn with no readable stamp, read as INGRESSED — the
+            // conservative direction, which installs nothing and clears nothing.
+            const uningressed = state.seenTurn !== undefined && deliveryStamp !== undefined && deliveryStamp.length > 0 && state.seenDelivery === deliveryStamp;
+            return { seenTurn: turnId, ...(deliveryStamp !== undefined && deliveryStamp.length > 0 ? { seenDelivery: deliveryStamp } : {}), uningressed };
+        });
+    }
+    catch {
+        /* no eve context — nothing to record, and never a reason to disturb the turn */
+    }
+}
+/** Did this turn start without a delivery of its own — the shape of a background-task settlement wake. Answers `false` for every turn the comparison cannot prove, which is the direction that changes nothing. */
+export function uningressedTurn(turnId) {
+    if (turnId === undefined || turnId.length === 0)
+        return false;
+    try {
+        const state = readState(slot.get());
+        return state.seenTurn === turnId && state.uningressed === true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Gives this turn the wake identity minted for one background task and reports whether it landed. FIRST WRITE WINS within a turn: two tasks can settle into one turn, and a later settlement must not move the address out from under an answer already composed. */
+export function adoptTaskWakeThisTurn(turnId, taskId, wakeId) {
+    if (turnId === undefined || turnId.length === 0)
+        return false;
+    if (taskId.length === 0 || wakeId.length === 0)
+        return false;
+    let installed = false;
+    try {
+        slot.update((cur) => {
+            const state = readState(cur);
+            if (state.turn === turnId)
+                return state; // already named by an earlier settlement in this turn
+            installed = true;
+            // The boundary record is CARRIED, not replaced: `uningressedTurn` is read again by every later
+            // settlement in this turn, and dropping it here would make the second one read as ingressed.
+            return { ...state, turn: turnId, wakeId, taskId };
+        });
+    }
+    catch {
+        /* no eve context (a unit test, a sessionless run) — nothing to install, never break the turn */
+        return false;
+    }
+    return installed;
+}
+/** The wake identity this turn adopted, or `undefined`. The turn id is the whole fence: a value stamped for another turn is never returned, so the durable slot cannot leak an address into a later turn. */
+export function taskWakeThisTurn(turnId) {
+    if (turnId === undefined || turnId.length === 0)
+        return undefined;
+    try {
+        const state = readState(slot.get());
+        return state.turn === turnId ? state.wakeId : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=task-wake-signal.js.map

package/dist/agent/access/task-wake-signal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-wake-signal.js","sourceRoot":"","sources":["../../../agent/access/task-wake-signal.ts"],"names":[],"mappings":"AAAA,wSAAwS;AAExS,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAc1C,MAAM,IAAI,GAAG,WAAW,CAAgB,2BAA2B,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAEjF;0FAC0F;AAC1F,SAAS,SAAS,CAAC,CAAU;IAC3B,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACnD,MAAM,CAAC,GAAG,CAA8H,CAAC;IACzI,MAAM,QAAQ,GACZ,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QACpG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;QAC1H,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,QAAQ,GACZ,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QACrD,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,KAAK,IAAI,EAAE;QAC7K,CAAC,CAAC,EAAE,CAAC;IACT,OAAO,EAAE,GAAG,QAAQ,EAAE,GAAG,QAAQ,EAAE,CAAC;AACtC,CAAC;AAED,gUAAgU;AAChU,MAAM,UAAU,gBAAgB,CAAC,MAA0B,EAAE,aAAiC;IAC5F,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,2CAA2C;IACpG,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM;gBAAE,OAAO,KAAK,CAAC,CAAC,wCAAwC;YACrF,4FAA4F;YAC5F,qFAAqF;YACrF,qEAAqE;YACrE,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,YAAY,KAAK,aAAa,CAAC;YACpJ,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,aAAa,KAAK,SAAS,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC;QAChJ,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,gFAAgF;IAClF,CAAC;AACH,CAAC;AAED,mNAAmN;AACnN,MAAM,UAAU,eAAe,CAAC,MAA0B;IACxD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACpC,OAAO,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,sQAAsQ;AACtQ,MAAM,UAAU,qBAAqB,CAAC,MAA0B,EAAE,MAAc,EAAE,MAAc;IAC9F,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7D,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAO,KAAK,CAAC,CAAC,sDAAsD;YAC/F,SAAS,GAAG,IAAI,CAAC;YACjB,+FAA+F;YAC/F,6FAA6F;YAC7F,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACpD,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,gGAAgG;QAChG,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,6MAA6M;AAC7M,MAAM,UAAU,gBAAgB,CAAC,MAA0B;IACzD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAClE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACpC,OAAO,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/agent/access/tenant-admission.d.ts

@@ -0,0 +1,52 @@
+import type { Domain } from "../memory/domain.js";
+/** Which rung of a tenant-scoped platform a tenant id names. */
+export type TenantRung = "workspace" | "enterprise";
+/** Declared tenant ids of one platform, split by the rung each names. */
+export interface TenantRungSets {
+    /** Workspace-rung ids (Slack `T…`) — the rung a person id is issued under. */
+    readonly workspaces: ReadonlySet<string>;
+    /** Enterprise-rung ids (Slack `E…`) — an Enterprise Grid organisation. */
+    readonly enterprises: ReadonlySet<string>;
+}
+/** Which rung `tenant` names on `platform`, by id shape. Pure. A platform with no enterprise rung
+ *  answers `"workspace"` for every id. */
+export declare function tenantRungOf(platform: string, tenant: string): TenantRung;
+export declare function splitTenantRungs(platform: string, tenants: Iterable<string>): TenantRungSets;
+/** The opt-in that turns the whole fence off. It is an ENV knob rather than a config field because it is an operator's assertion about a topology, and because turning it on accepts a KNOWN aliasing exposure until the tenant rung lands in the principal grammar. */
+export declare const MULTI_TENANT_ENV = "OE_ALLOW_MULTI_TENANT_PRINCIPALS";
+export declare function multiTenantPrincipalsAllowed(): boolean;
+/** The tenants this deployment declares: the second segment of every Domain.reach entry, in any of its shapes. An entry that does not parse contributes nothing, because inventing a tenant from a broken string hides the real bug. */
+export declare function admittedTenants(platform: string, domains: readonly Domain[]): ReadonlySet<string>;
+/** Fail-soft to an empty set when no config is registered, which the classifier reads as "nothing declared, fence inert", never as "everything refused". */
+export declare function admittedTenantsFromConfig(platform: string): ReadonlySet<string>;
+/** The deterministic source for every site with no tenant in hand, and it is deterministic only because the config-load fence refuses two tenants of one tenant-scoped platform. undefined on zero, on more than one, and on ANY declared enterprise: an E… entry admits every workspace under that organisation, so answering with the one workspace written down would stamp it onto people in a sibling one. */
+export declare function soleAdmittedTenant(platform: string, domains: readonly Domain[]): string | undefined;
+/** {@link soleAdmittedTenant} against the registered app config; `undefined` when no config is
+ *  registered, on the same fail-soft grounds as {@link admittedTenantsFromConfig}. */
+export declare function soleAdmittedTenantFromConfig(platform: string): string | undefined;
+/** Fails LOUD at boot rather than degrading at runtime, because the failure it prevents is invisible by construction: two people sharing a principal key produce no error, only the wrong answer to "is this an admin". It counts each RUNG separately, and it still cannot catch the exposure inside ONE organisation, whose workspace count the config does not state. */
+export declare function assertSingleTenantPerTenantScopedPlatform(domains: readonly Domain[]): void;
+/** The remedy sentence for a rejected principal-key entry on a tenant-scoped platform, and "" for every other entry, so a validator can concatenate it unconditionally. `domains` is passed explicitly by a validator that already holds the array, because reaching back through getConfig would re-enter the validator currently running. */
+export declare function tenantRungRemedy(entry: string, domains?: readonly Domain[]): string;
+/** proceed = admit the wake. `unadmitted` = the delivery names a tenant this deployment never
+ *  declared: the caller MUST drop it with an audit row and run no model turn. */
+export type TenantAdmissionDecision = "proceed" | "unadmitted";
+export interface TenantAdmissionInput {
+    /** The surface platform slug (`slack`, `discord`, …). Only tenant-scoped ones are fenced. */
+    readonly platform: string;
+    /** The tenant/workspace id this delivery resolved (Slack: `team_id`), after every heal the
+     *  surface can do. */
+    readonly tenant: string | undefined | null;
+    /** The ENTERPRISE-rung id this delivery named, or nothing. An org-wide Enterprise Grid install carries this WITHOUT a workspace, which the workspace alone cannot judge; a door that cannot read one omits it and gets exactly the workspace-only decision. */
+    readonly enterprise?: string | undefined | null;
+    /** The tenants this deployment declares — {@link admittedTenantsFromConfig} at a live door. */
+    readonly admitted: ReadonlySet<string>;
+}
+/** Four proceed paths, each deliberate: the platform is not tenant-scoped, the operator opted in, the admitted set is EMPTY (fence inert, never refuse-everything), or the delivery named NEITHER a workspace nor an enterprise. Otherwise each named id is matched at its OWN rung, and a delivery carrying both is admitted when either is declared. */
+export declare function classifyTenantAdmission(input: TenantAdmissionInput): TenantAdmissionDecision;
+/** The audit `reason` an unadmitted-tenant drop carries — one greppable string, shared by every
+ *  door and its test (same convention as UNMAPPED_WAKE_DROP_REASON). */
+export declare const UNADMITTED_TENANT_DROP_REASON = "tenant is not admitted on this deployment \u2014 principal keys would alias";
+/** Deliberately NOT posted into the originating room: we cannot safely identify anybody there, and a foreign tenant learning it reached a real deployment is more than it needs to know. It names EVERY id the refused delivery carried, because an org-wide install names only the enterprise. */
+export declare function unadmittedTenantLog(platform: string, tenant: string | undefined | null, admitted: ReadonlySet<string>, enterprise?: string | undefined | null): string;
+//# sourceMappingURL=tenant-admission.d.ts.map

package/dist/agent/access/tenant-admission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-admission.d.ts","sourceRoot":"","sources":["../../../agent/access/tenant-admission.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,gEAAgE;AAChE,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,YAAY,CAAC;AAEpD,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC7B,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACzC,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC3C;AAKD;0CAC0C;AAC1C,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,CAGzE;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,cAAc,CAK5F;AAED,wQAAwQ;AACxQ,eAAO,MAAM,gBAAgB,qCAAqC,CAAC;AAEnE,wBAAgB,4BAA4B,IAAI,OAAO,CAEtD;AAED,wOAAwO;AACxO,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,CAYjG;AAED,4JAA4J;AAC5J,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAM/E;AAED,mZAAmZ;AACnZ,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAInG;AAED;sFACsF;AACtF,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMjF;AAED,4WAA4W;AAC5W,wBAAgB,yCAAyC,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAsC1F;AAED,+UAA+U;AAC/U,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAMnF;AAED;iFACiF;AACjF,MAAM,MAAM,uBAAuB,GAAG,SAAS,GAAG,YAAY,CAAC;AAE/D,MAAM,WAAW,oBAAoB;IACnC,6FAA6F;IAC7F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;0BACsB;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC;IAC3C,+PAA+P;IAC/P,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC;IAChD,+FAA+F;IAC/F,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACxC;AAQD,0VAA0V;AAC1V,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,oBAAoB,GAAG,uBAAuB,CAY5F;AAED;wEACwE;AACxE,eAAO,MAAM,6BAA6B,gFAA2E,CAAC;AAEtH,mSAAmS;AACnS,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EACjC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,EAC7B,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GACrC,MAAM,CAWR"}