@open-everywhere/core 0.1.0

package/dist/agent/approvals/pr-open.d.ts

@@ -0,0 +1,36 @@
+import { createBranch, deleteRef, getBranchSha, updateRef } from "../scm/refs.js";
+import { createOrUpdatePullRequest } from "../scm/pr.js";
+import { type RepoCapability } from "../access/repo-capabilities.js";
+export interface PrOpenArgs {
+    readonly org: string;
+    readonly scopeKey: string;
+    readonly repo: string;
+    readonly head: string;
+    readonly base: string;
+    readonly title: string;
+    readonly body: string;
+    /** The exact commit the staging push parked on refs/oe-pending/<head> — the content pin. */
+    readonly headSha: string;
+    /** The proposing turn's verified principal (frozen); the approver is `decidedBy`. */
+    readonly requestedBy: string;
+    /** Proposing turn ingested untrusted content — reviewer-scrutiny flag, never auto-reject. */
+    readonly tainted?: boolean;
+    /** The capability sets the proposing scope's binding opted this repo into, FROZEN at propose because there is no ctx at decide time. Absent means no expansion — the default write job set. */
+    readonly capabilities?: readonly RepoCapability[];
+    /** Frozen so an "Approve for session" click can key the session-approval memo; absent means session approval is never offered or consulted for it. Not read by execute(). */
+    readonly sessionId?: string;
+}
+/** Injectable GitHub edges, so the whole publish path is offline-testable with the live defaults used byte-for-byte in production. */
+export interface PrOpenExecuteDeps {
+    readonly getBranchSha?: typeof getBranchSha;
+    readonly createBranch?: typeof createBranch;
+    readonly updateRef?: typeof updateRef;
+    readonly deleteRef?: typeof deleteRef;
+    readonly createPr?: typeof createOrUpdatePullRequest;
+    readonly resolveToken?: (repo: string, capabilities?: readonly RepoCapability[]) => Promise<string>;
+}
+/** Publishes the frozen proposal: fast-forward `refs/heads/<head>` to the frozen sha, open or update the PR, best-effort delete the staging ref, audit. Exported for the test; production reaches it only through the registered kind. */
+export declare function executePrOpen(args: PrOpenArgs, decidedBy: string, deps?: PrOpenExecuteDeps, opts?: {
+    sessionApproved?: boolean;
+}): Promise<string>;
+//# sourceMappingURL=pr-open.d.ts.map

package/dist/agent/approvals/pr-open.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pr-open.d.ts","sourceRoot":"","sources":["../../../agent/approvals/pr-open.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAElF,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAQzD,OAAO,EAAuC,KAAK,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAE1G,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4FAA4F;IAC5F,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,qFAAqF;IACrF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,6FAA6F;IAC7F,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,+LAA+L;IAC/L,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IAClD,6KAA6K;IAC7K,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAgDD,sIAAsI;AACtI,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,YAAY,CAAC;IAC5C,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,YAAY,CAAC;IAC5C,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,SAAS,CAAC;IACtC,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,SAAS,CAAC;IACtC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,yBAAyB,CAAC;IACrD,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,SAAS,cAAc,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACrG;AAED,0OAA0O;AAC1O,wBAAsB,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,GAAE,iBAAsB,EAAE,IAAI,GAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CA0DhK"}

package/dist/agent/approvals/pr-open.js

@@ -0,0 +1,134 @@
+// Propose stage-pushes the head branch to a hidden `refs/oe-pending/<head>` ref and FREEZES its sha; execute publishes host-side from that frozen sha, so a click can never publish commits other than the ones the card showed. The card confirms "publish THESE commits to THAT branch" — it is not a code review, and the tainted flag raises scrutiny but never auto-rejects.
+import { createBranch, deleteRef, getBranchSha, updateRef } from "../scm/refs.js";
+import { RateLimitExhaustedError } from "../channels/rate-limit-retry.js";
+import { createOrUpdatePullRequest } from "../scm/pr.js";
+import { PENDING_REF_PREFIX } from "../scm/git.js";
+import { appendAudit } from "../audit/audit.js";
+import { emitTelemetry } from "../observability/telemetry.js";
+import { registerActionKind, whereFromScope } from "./actions.js";
+import { resolvePrWriteToken } from "../scm/write-token.js";
+import { DEFAULT_PERMISSIONS, expandMintPermissions } from "../scm/mint.js";
+import { REPO_CAPABILITIES, isRepoCapability } from "../access/repo-capabilities.js";
+const CARD_BODY_MAX = 1200;
+/**
+ * The card's TOKEN lines — what the approve click's mint carries (OPE-1822).
+ *
+ * The grades come from `expandMintPermissions(DEFAULT_PERMISSIONS, …)`, which is the same pure
+ * derivation `resolvePrWriteToken` builds the GitHub App mint body from (scm/write-token.ts), over
+ * the same frozen `capabilities`. So the card names the App mint's own body. Without these lines a
+ * repo declared `capabilities: ["workflows"]` minted `workflows: write` on a click whose card read
+ * like any other PR card, and the approver was never told.
+ *
+ * 🔴 THE PAT FALLBACK IS NOT AN APP MINT, so the last line says so. `resolvePrWriteToken` returns
+ * `GITHUB_TOKEN` whenever no App is configured, or no installation covers the repo — and a classic
+ * PAT carries its OWNER's rights, which no derivation here can read. Naming the families as the
+ * ceiling on that path would be the same disclosure defect this block fixes, inverted.
+ *
+ * This DESCRIBES the mint. It reads no config, and it can widen nothing.
+ */
+function mintGradeLines(capabilities) {
+    // A pending row is frozen JSON, so neither the SHAPE nor the NAMES are guaranteed here, whatever
+    // the type says. `expandMintPermissions` THROWS on an unimplemented name and a spread THROWS on a
+    // non-list, and a throwing summarize() takes down the card render and every pending listing.
+    // Split both cases off instead and say what they cost at execute time.
+    const malformed = !Array.isArray(capabilities);
+    const declared = malformed ? [] : [...capabilities].sort();
+    const known = declared.filter((cap) => isRepoCapability(cap));
+    const unknown = declared.filter((cap) => !isRepoCapability(cap));
+    const grades = Object.entries(expandMintPermissions(DEFAULT_PERMISSIONS, known))
+        // Every family of `MintPermissions` is optional, so a present key with no grade would print
+        // "family: undefined" on the card. A family with no grade is a family the mint does not ask for.
+        .filter(([, grade]) => grade !== undefined)
+        .map(([family, grade]) => `${family}: ${grade}`)
+        .sort()
+        .join(", ");
+    const lines = declared.length === 0 && !malformed
+        ? [`Token the approve click mints — ${grades}. This repo declares no capability, so the mint carries the default write set.`]
+        : [`Token the approve click mints — ${grades}.`, ...known.map((cap) => `↳ this repo declares \`${cap}\` — ${REPO_CAPABILITIES[cap].summary}`)];
+    // Both malformed cases fail the APP publish: execute() hands the same frozen value to the same
+    // derivation. The PAT path never reaches that derivation at all, which the last line covers.
+    if (unknown.length)
+        lines.push(`⚠ this proposal froze capability names this build does not implement (${unknown.join(", ")}) — the App publish fails instead of minting them`);
+    if (malformed)
+        lines.push("⚠ this proposal's frozen capability list is not a list — the App publish fails instead of minting anything from it");
+    lines.push("These grades are the GitHub App mint. Where no App installation covers this repo, the publish falls back to the `GITHUB_TOKEN` PAT, which carries its own owner's rights instead.");
+    return lines;
+}
+/** Publishes the frozen proposal: fast-forward `refs/heads/<head>` to the frozen sha, open or update the PR, best-effort delete the staging ref, audit. Exported for the test; production reaches it only through the registered kind. */
+export async function executePrOpen(args, decidedBy, deps = {}, opts = {}) {
+    const token = await (deps.resolveToken ?? resolvePrWriteToken)(args.repo, args.capabilities ?? []);
+    // 1. Make refs/heads/<head> point at the FROZEN sha. Create when absent; fast-forward
+    //    when it exists elsewhere (force:false — git-push semantics: a non-FF publish, e.g.
+    //    someone rewrote the branch since propose, fails loudly onto the card rather than
+    //    clobbering their commits). A create-race ("exists") falls through to the update.
+    const current = await (deps.getBranchSha ?? getBranchSha)({ repo: args.repo, branch: args.head, token });
+    if (current === null) {
+        const created = await (deps.createBranch ?? createBranch)({ repo: args.repo, branch: args.head, sha: args.headSha, token });
+        if (created === "exists") {
+            await (deps.updateRef ?? updateRef)({ repo: args.repo, ref: `heads/${args.head}`, sha: args.headSha, token });
+        }
+    }
+    else if (current !== args.headSha) {
+        await (deps.updateRef ?? updateRef)({ repo: args.repo, ref: `heads/${args.head}`, sha: args.headSha, token });
+    }
+    // 2. Open the PR from the frozen title/body (422 already-exists resolves as UPDATE —
+    //    a follow-up push to an open PR branch flows through this same gate).
+    const pr = await (deps.createPr ?? createOrUpdatePullRequest)({
+        repo: args.repo,
+        head: args.head,
+        base: args.base,
+        title: args.title,
+        body: args.body,
+        token,
+    });
+    // The staging-ref cleanup is best-effort — leftover clutter, never a failure. A rate-limit exhaustion is LOGGED before it is swallowed, or that outcome would leave no trace anywhere.
+    await (deps.deleteRef ?? deleteRef)({ repo: args.repo, ref: `${PENDING_REF_PREFIX}/${args.head}`, token }).catch((err) => {
+        if (err instanceof RateLimitExhaustedError) {
+            console.warn(`[open-everywhere:github] rate limited: git.refs.delete gave up after ${err.attempts} attempts (waited ${err.waitedMs} ms) — the pending ref is leftover clutter, not a failed PR`);
+        }
+    });
+    // Audit the consequential write AFTER it succeeds, under the same pr.open/pr.update action names, so the trail reads continuously.
+    await appendAudit({
+        ...whereFromScope(args.org, args.scopeKey),
+        principalId: decidedBy,
+        action: pr.updated ? "pr.update" : "pr.open",
+        detail: {
+            repo: args.repo,
+            head: args.head,
+            base: args.base,
+            sha: args.headSha,
+            number: pr.number,
+            url: pr.url,
+            requestedBy: args.requestedBy,
+            tainted: Boolean(args.tainted),
+            // OPE-53: stamped ONLY on the session-skip path (a live memo published without a fresh card).
+            // `principalId` above is the memo-granting member; this flags that no card was clicked THIS time.
+            ...(opts.sessionApproved ? { sessionApproved: true } : {}),
+        },
+    });
+    emitTelemetry("oe.feature.used", { "oe.feature": "pr_opened", "oe.outcome": "ok" });
+    return pr.updated
+        ? `PR #${pr.number} was already open for \`${args.head}\` — the approved commits updated it: ${pr.url}`
+        : `pushed \`${args.head}\` and opened PR #${pr.number}: ${pr.url}`;
+}
+const prOpen = {
+    kind: "pr.open",
+    policy: "member",
+    summarize(args) {
+        const body = args.body.length > CARD_BODY_MAX ? `${args.body.slice(0, CARD_BODY_MAX)}\n… (${args.body.length - CARD_BODY_MAX} more bytes)` : args.body;
+        return [
+            `Open pull request — \`${args.repo}\`: \`${args.head}\` → \`${args.base}\` (commit \`${args.headSha.slice(0, 12)}\`)`,
+            ...(args.tainted ? ["⚠ proposed in a turn that read external content — review the diff before approving"] : []),
+            ...mintGradeLines(args.capabilities ?? []),
+            `*${args.title}*`,
+            "```",
+            body,
+            "```",
+        ];
+    },
+    execute(args, decidedBy) {
+        return executePrOpen(args, decidedBy);
+    },
+};
+registerActionKind(prOpen);
+//# sourceMappingURL=pr-open.js.map

package/dist/agent/approvals/pr-open.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pr-open.js","sourceRoot":"","sources":["../../../agent/approvals/pr-open.ts"],"names":[],"mappings":"AAAA,kXAAkX;AAElX,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAClF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAElE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAuB,MAAM,gCAAgC,CAAC;AAsB1G,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B;;;;;;;;;;;;;;;GAeG;AACH,SAAS,cAAc,CAAC,YAAuC;IAC7D,iGAAiG;IACjG,kGAAkG;IAClG,6FAA6F;IAC7F,uEAAuE;IACvE,MAAM,SAAS,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3D,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;QAC9E,4FAA4F;QAC5F,iGAAiG;SAChG,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;SAC1C,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,KAAK,KAAK,EAAE,CAAC;SAC/C,IAAI,EAAE;SACN,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,KAAK,GACT,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS;QACjC,CAAC,CAAC,CAAC,mCAAmC,MAAM,gFAAgF,CAAC;QAC7H,CAAC,CAAC,CAAC,mCAAmC,MAAM,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,0BAA0B,GAAG,QAAQ,iBAAiB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACnJ,+FAA+F;IAC/F,6FAA6F;IAC7F,IAAI,OAAO,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,yEAAyE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;IAC/K,IAAI,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,oHAAoH,CAAC,CAAC;IAChJ,KAAK,CAAC,IAAI,CAAC,mLAAmL,CAAC,CAAC;IAChM,OAAO,KAAK,CAAC;AACf,CAAC;AAYD,0OAA0O;AAC1O,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAgB,EAAE,SAAiB,EAAE,IAAI,GAAsB,EAAE,EAAE,IAAI,GAAkC,EAAE;IAC7I,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,mBAAmB,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IAEnG,sFAAsF;IACtF,wFAAwF;IACxF,sFAAsF;IACtF,sFAAsF;IACtF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzG,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5H,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAChH,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAChH,CAAC;IAED,qFAAqF;IACrF,0EAA0E;IAC1E,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,yBAAyB,CAAC,CAAC;QAC5D,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,KAAK;KACN,CAAC,CAAC;IAEH,uLAAuL;IACvL,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,kBAAkB,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QAChI,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;YAC3C,OAAO,CAAC,IAAI,CAAC,wEAAwE,GAAG,CAAC,QAAQ,qBAAqB,GAAG,CAAC,QAAQ,6DAA6D,CAAC,CAAC;QACnM,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,mIAAmI;IACnI,MAAM,WAAW,CAAC;QAChB,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC;QAC1C,WAAW,EAAE,SAAS;QACtB,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QAC5C,MAAM,EAAE;YACN,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,EAAE,IAAI,CAAC,OAAO;YACjB,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,GAAG,EAAE,EAAE,CAAC,GAAG;YACX,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;YAC9B,8FAA8F;YAC9F,kGAAkG;YAClG,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D;KACF,CAAC,CAAC;IACH,aAAa,CAAC,iBAAiB,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IACpF,OAAO,EAAE,CAAC,OAAO;QACf,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,2BAA2B,IAAI,CAAC,IAAI,yCAAyC,EAAE,CAAC,GAAG,EAAE;QACvG,CAAC,CAAC,YAAY,IAAI,CAAC,IAAI,qBAAqB,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,GAAG,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,MAAM,GAA2B;IACrC,IAAI,EAAE,SAAS;IACf,MAAM,EAAE,QAAQ;IAChB,SAAS,CAAC,IAAI;QACZ,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,aAAa,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACvJ,OAAO;YACL,yBAAyB,IAAI,CAAC,IAAI,SAAS,IAAI,CAAC,IAAI,UAAU,IAAI,CAAC,IAAI,gBAAgB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK;YACrH,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,oFAAoF,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/G,GAAG,cAAc,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;YAC1C,IAAI,IAAI,CAAC,KAAK,GAAG;YACjB,KAAK;YACL,IAAI;YACJ,KAAK;SACN,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,IAAI,EAAE,SAAS;QACrB,OAAO,aAAa,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACxC,CAAC;CACF,CAAC;AAEF,kBAAkB,CAAC,MAAM,CAAC,CAAC"}

package/dist/agent/approvals/review-surface.d.ts

@@ -0,0 +1,3 @@
+/** Collapse a model-authored string to ONE LINE before embedding it in a review surface. Line breaks are the whole fix — every markdown construct that could forge a verdict (a fence, heading, blockquote, list item, table row, thematic break) must begin a line — which is stronger than escaping an enumerated blocklist. Backticks are deliberately left alone, and that holds only while no caller wraps a model-authored value in inline code. */
+export declare function inlineForReview(text: string): string;
+//# sourceMappingURL=review-surface.d.ts.map

package/dist/agent/approvals/review-surface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-surface.d.ts","sourceRoot":"","sources":["../../../agent/approvals/review-surface.ts"],"names":[],"mappings":"AAEA,0bAA0b;AAC1b,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGpD"}

package/dist/agent/approvals/review-surface.js

@@ -0,0 +1,7 @@
+// The one bound for a model-authored string about to be embedded in anything a human reads to make an approval decision — an approval card, a config-PR body, an admin-channel note. THE INVARIANT: no model-authored value can BEGIN A LINE in a review surface. A new flow that needs a different bound should say why in that flow rather than weakening this one.
+/** Collapse a model-authored string to ONE LINE before embedding it in a review surface. Line breaks are the whole fix — every markdown construct that could forge a verdict (a fence, heading, blockquote, list item, table row, thematic break) must begin a line — which is stronger than escaping an enumerated blocklist. Backticks are deliberately left alone, and that holds only while no caller wraps a model-authored value in inline code. */
+export function inlineForReview(text) {
+    // Escapes, not literals: a raw U+2028/U+2029 in a character class is invisible in a diff.
+    return text.replace(/[\r\n\u2028\u2029]+/g, " ").trim();
+}
+//# sourceMappingURL=review-surface.js.map

package/dist/agent/approvals/review-surface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-surface.js","sourceRoot":"","sources":["../../../agent/approvals/review-surface.ts"],"names":[],"mappings":"AAAA,sWAAsW;AAEtW,0bAA0b;AAC1b,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,0FAA0F;IAC1F,OAAO,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAC1D,CAAC"}

package/dist/agent/approvals/routine-cancel.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=routine-cancel.d.ts.map

package/dist/agent/approvals/routine-cancel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routine-cancel.d.ts","sourceRoot":"","sources":["../../../agent/approvals/routine-cancel.ts"],"names":[],"mappings":""}

package/dist/agent/approvals/routine-cancel.js

@@ -0,0 +1,39 @@
+// The gated `cancel_routine` kind: cancelling removes a standing guardrail, so the durable `removeRoutine` happens HERE, on a human's click, outside any session. The target `(org, surfaceKey, id)` is frozen at propose time by LOADING the routine, never re-derived from model-visible state at click time, so the click cancels exactly the routine the card named.
+import { removeRoutine } from "../routines/store.js";
+import { appendAudit } from "../audit/audit.js";
+import { emitTelemetry } from "../observability/telemetry.js";
+import { registerActionKind } from "./actions.js";
+const routineCancel = {
+    kind: "routine.cancel",
+    policy: "member",
+    summarize(args) {
+        return [
+            `Cancel routine \`${args.id}\` — ${args.description}`,
+            ...(args.tainted ? ["⚠ proposed in a turn that read external content — check who actually wanted this stopped before approving"] : []),
+            "(reversible: it can be re-created with create_routine)",
+        ];
+    },
+    async execute(args, decidedBy) {
+        // Remove the EXACT frozen id on its frozen surface. A routine already gone between
+        // propose and click returns false — report it plainly rather than throwing.
+        const cancelled = await removeRoutine(args.partition, args.id);
+        // Preserve the pre-gate audit action name ("routine.cancel") + its {id} shape; add the
+        // description + who confirmed. Same partition stamping the pre-gate tool used.
+        await appendAudit({
+            org: args.partition.org,
+            platform: args.partition.platform,
+            workspace: args.partition.workspace,
+            surface: args.partition.surface,
+            principalId: decidedBy,
+            action: "routine.cancel",
+            detail: { id: args.id, description: args.description, cancelled, requestedBy: args.requestedBy ?? null, confirmedBy: decidedBy, tainted: Boolean(args.tainted) },
+        });
+        const outcomeTag = cancelled ? "ok" : "noop";
+        emitTelemetry("oe.feature.used", { "oe.feature": "routine_cancelled", "oe.outcome": outcomeTag });
+        return cancelled
+            ? `routine ${args.id} cancelled — ${args.description}.`
+            : `no routine ${args.id} on this surface — nothing to cancel (it may already be gone).`;
+    },
+};
+registerActionKind(routineCancel);
+//# sourceMappingURL=routine-cancel.js.map

package/dist/agent/approvals/routine-cancel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routine-cancel.js","sourceRoot":"","sources":["../../../agent/approvals/routine-cancel.ts"],"names":[],"mappings":"AAAA,yWAAyW;AAEzW,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAE9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAiBlD,MAAM,aAAa,GAAkC;IACnD,IAAI,EAAE,gBAAgB;IACtB,MAAM,EAAE,QAAQ;IAChB,SAAS,CAAC,IAAI;QACZ,OAAO;YACL,oBAAoB,IAAI,CAAC,EAAE,QAAQ,IAAI,CAAC,WAAW,EAAE;YACrD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,2GAA2G,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtI,wDAAwD;SACzD,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS;QAC3B,mFAAmF;QACnF,4EAA4E;QAC5E,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/D,uFAAuF;QACvF,+EAA+E;QAC/E,MAAM,WAAW,CAAC;YAChB,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG;YACvB,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ;YACjC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS;YACnC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;YAC/B,WAAW,EAAE,SAAS;YACtB,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;SACjK,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QAC7C,aAAa,CAAC,iBAAiB,EAAE,EAAE,YAAY,EAAE,mBAAmB,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC;QAClG,OAAO,SAAS;YACd,CAAC,CAAC,WAAW,IAAI,CAAC,EAAE,gBAAgB,IAAI,CAAC,WAAW,GAAG;YACvD,CAAC,CAAC,cAAc,IAAI,CAAC,EAAE,gEAAgE,CAAC;IAC5F,CAAC;CACF,CAAC;AAEF,kBAAkB,CAAC,aAAa,CAAC,CAAC"}

package/dist/agent/approvals/routine-create.d.ts

@@ -0,0 +1,38 @@
+import { type RoutineReport, type RoutineTrigger } from "../routines/routine.js";
+import type { Partition } from "../memory/partition.js";
+import type { ModelRole } from "../memory/domain.js";
+export interface RoutineCreateArgs {
+    readonly org: string;
+    readonly partition: Partition;
+    readonly surfaceKey: string;
+    /** The post-back target off the surface binding (Slack `{ channelId }`, etc.). */
+    readonly target: unknown;
+    readonly trigger: RoutineTrigger;
+    /** Where this routine reports: `silent` posts nothing into the surface, `surface` a config-governed report channel resolved host-side, absent an ordinary routine that posts where it lives. Frozen at propose time and never model-authored. */
+    readonly report?: RoutineReport;
+    readonly prompt: string;
+    readonly createdBy?: string;
+    readonly tainted?: boolean;
+    /** OPE-55: arm this as a DURABLE JOB (its own persistent session across fires). Absent = an
+     *  ordinary stateless routine. Frozen at propose time from create_routine's `job` flag. */
+    readonly sessionMode?: "job";
+    /** The job's ceiling in relative terms, composed host-side and frozen so the card says what it says without a clock. The bound ITSELF is minted at CLICK time: a card that sat for two days must not arm a job with two days already spent. */
+    readonly boundPolicy?: string;
+    /** The standing permissions this routine may use without asking. Model-proposed, validated and frozen at propose time, and written as grants only by `execute` on the human's click. Absent, never `[]`, for a routine that declared none. */
+    readonly permissions?: readonly string[];
+    /** The pre-run collectors and the condition gate, validated at propose time against this deployment's config and against the permissions above, then frozen, so the card and the armed row cannot disagree. Absent, never `[]`, when none were named. */
+    readonly collectors?: readonly string[];
+    readonly gate?: string;
+    /** OPE-1627: the model ROLE the armed routine's fires resolve, or absent to INHERIT the
+     *  deployment's model stack. Frozen at propose time and rendered by {@link modelRoleLines}, so
+     *  the human clicking arm has read which role they are arming. */
+    readonly modelRole?: ModelRole;
+}
+/** The card's standing-permission lines. Pure, and empty for a routine that declared nothing, so such a card is byte-identical to before. */
+export declare function permissionLines(args: Pick<RoutineCreateArgs, "permissions" | "tainted">): string[];
+/** The card's pre-run collection lines. A name the registry no longer resolves renders as an explicit "no longer declared" line rather than vanishing, because a card freezes its args and is clicked later, possibly after a deploy that removed the entry. */
+export declare function collectorLines(args: Pick<RoutineCreateArgs, "collectors">): string[];
+export declare function gateLines(args: Pick<RoutineCreateArgs, "gate">): string[];
+/** The card's model-role line. It renders nothing for the default, unlike the routine PERMISSION card: a line on every creation card saying "the usual model" trains a reader to skip the row. */
+export declare function modelRoleLines(args: Pick<RoutineCreateArgs, "modelRole">): string[];
+//# sourceMappingURL=routine-create.d.ts.map

package/dist/agent/approvals/routine-create.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routine-create.d.ts","sourceRoot":"","sources":["../../../agent/approvals/routine-create.ts"],"names":[],"mappings":"AAIA,OAAO,EAA8D,KAAK,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAc7I,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAIrD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,kFAAkF;IAClF,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,iPAAiP;IACjP,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B;+FAC2F;IAC3F,QAAQ,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC;IAC7B,+OAA+O;IAC/O,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,8OAA8O;IAC9O,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,yPAAyP;IACzP,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;sEAEkE;IAClE,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;CAChC;AAED,6IAA6I;AAC7I,wBAAgB,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,iBAAiB,EAAE,aAAa,GAAG,SAAS,CAAC,GAAG,MAAM,EAAE,CAOlG;AAED,gQAAgQ;AAChQ,wBAAgB,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,GAAG,MAAM,EAAE,CAQpF;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,GAAG,MAAM,EAAE,CAQzE;AAED,kMAAkM;AAClM,wBAAgB,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,GAAG,MAAM,EAAE,CAMnF"}

package/dist/agent/approvals/routine-create.js

@@ -0,0 +1,171 @@
+// The ActionKind behind the gated `create_routine`. The tool validates and freezes the trigger, prompt and target and posts a card; the durable `addRoutine` (status active) happens here, on a human's click, outside any session.
+import { addRoutine, newRoutineId } from "../routines/store.js";
+import { computeNextRun } from "../routines/schedule.js";
+import { describeTrigger, routinePermissionGeneration } from "../routines/routine.js";
+import { mintJobBound } from "../routines/bound.js";
+import { ROUTINE_PERMISSIONS_ARMED_ACTION, ROUTINE_PERMISSION_NEVER_LIFTS_ACTION, bundleRaisedDeclarations, describeDeclaredPermissions, armDeclaredRoutinePermissions, unarmedDeclarations, } from "../routines/declared-permissions.js";
+import { resolveRoutineCollector } from "../routines/collector.js";
+import { resolveRoutineGate } from "../routines/gate.js";
+import { describeDeclaredPermissionKind } from "./session-grant.js";
+import { appendAudit } from "../audit/audit.js";
+import { registerActionKind } from "./actions.js";
+/** The card's standing-permission lines. Pure, and empty for a routine that declared nothing, so such a card is byte-identical to before. */
+export function permissionLines(args) {
+    const described = describeDeclaredPermissions(args.permissions ?? []);
+    if (described.length === 0)
+        return [];
+    if (args.tainted) {
+        return [`🔑 asked for standing permission to ${described.join(" · ")} — NOT granted, because it was authored in a turn that read external content; it will ask a human every time`];
+    }
+    return [`🔑 may, without asking: ${described.join(" · ")} — anything else will ask you first`];
+}
+/** The card's pre-run collection lines. A name the registry no longer resolves renders as an explicit "no longer declared" line rather than vanishing, because a card freezes its args and is clicked later, possibly after a deploy that removed the entry. */
+export function collectorLines(args) {
+    const names = args.collectors ?? [];
+    if (names.length === 0)
+        return [];
+    const described = names.map((n) => {
+        const def = resolveRoutineCollector(n);
+        return def ? `${n} (${def.describe})` : `${n} — no longer declared by this deployment, so it will collect nothing`;
+    });
+    return [`📥 reads BEFORE every run, under the permissions above: ${described.join(" · ")} — the result is handed to the run as data, never as instructions`];
+}
+export function gateLines(args) {
+    if (!args.gate)
+        return [];
+    const def = resolveRoutineGate(args.gate);
+    return [
+        def
+            ? `⛔ runs ONLY when: ${def.describe} — checked host-side before any session starts, so a run that should not happen costs nothing`
+            : `⛔ names the condition gate "${args.gate}", which this deployment no longer declares — it will therefore NEVER run until it is re-created`,
+    ];
+}
+/** The card's model-role line. It renders nothing for the default, unlike the routine PERMISSION card: a line on every creation card saying "the usual model" trains a reader to skip the row. */
+export function modelRoleLines(args) {
+    if (args.modelRole === undefined)
+        return [];
+    return [
+        `🧠 this routine — and the work it delegates — runs the \`${args.modelRole}\` role of this deployment's model stack ` +
+            "instead of the default `primary` one; a cheaper role can degrade its judgement, and nothing will report that it did",
+    ];
+}
+const routineCreate = {
+    kind: "routine.create",
+    policy: "member",
+    summarize(args) {
+        return [
+            `Create ${args.sessionMode === "job" ? "durable JOB" : "routine"} — ${describeTrigger(args.trigger, args.report)} — fires WITHOUT a fresh @-mention`,
+            // A SILENT routine is the one arm where the card is the ONLY chance to say what arming it
+            // means: after this click it will never speak up on its own again, so "no news" stops being
+            // evidence of anything. Spelled out, not left to be inferred from "posts nothing".
+            ...(args.report?.kind === "silent" ? ["🔇 reports NOTHING here — you will only hear from it if it hits a problem it can't resolve, or if it self-disables"] : []),
+            // The only producer of this arm is host-side config resolution (`Domain.reportChannel`), so the line can state the destination as fact rather than as a claim about what the model asked for.
+            ...(args.report?.kind === "surface" ? [`📤 posts into ${args.report.surfaceKey} — this surface can't post proactively, so its domain's configured reportChannel is where every run will land`] : []),
+            ...(args.sessionMode === "job"
+                ? ["↻ keeps going until it decides the work is DONE, building on what each earlier run learned — where an ordinary routine starts fresh each time and repeats forever. Arm a job only for work that can actually finish."]
+                : []),
+            ...(args.sessionMode === "job" && args.boundPolicy ? [`⏹️ ${args.boundPolicy} — it will say so here, and you can start it again`] : []),
+            ...(args.tainted ? ["⚠ authored in a turn that read external content — review before arming"] : []),
+            // A TAINTED proposal renders the declaration as REFUSED rather than hiding it: the human should see what was asked for and that it is not being granted, because `execute` writes nothing.
+            ...permissionLines(args),
+            ...collectorLines(args),
+            ...gateLines(args),
+            ...modelRoleLines(args),
+            `> ${args.prompt}`,
+            `Target: ${args.surfaceKey}`,
+        ];
+    },
+    async execute(args, decidedBy) {
+        // Recompute the first run at CLICK time (fresher than propose time); `once` fires at its
+        // explicit instant. A schedule that no longer computes a run is refused at propose time,
+        // so a null here (non-once) means it fired-and-passed — leave nextRunAt null (dispatcher
+        // is the source of truth for the next tick).
+        const now = new Date();
+        const next = args.trigger.kind === "once" ? new Date(args.trigger.at) : computeNextRun(args.trigger, now);
+        const routine = {
+            id: newRoutineId(),
+            org: args.org,
+            surfaceKey: args.surfaceKey,
+            target: args.target,
+            trigger: args.trigger,
+            // OPE-149/OPE-148: absent (never `{kind:"post"}`) for an ordinary routine, so a posting row is
+            // byte-identical to a pre-OPE-149 one and no migration is implied. Frozen from the propose-time
+            // args in BOTH arms: re-resolving `reportChannel` at click time would let a config change
+            // between propose and click move the destination out from under the card a human just read.
+            ...(args.report ? { report: args.report } : {}),
+            prompt: args.prompt,
+            createdBy: args.createdBy,
+            createdAt: now.toISOString(),
+            status: "active",
+            nextRunAt: next ? next.toISOString() : null,
+            consecutiveFailures: 0,
+            // Freeze the propose-time taint verdict onto the ROW, so `list_routines` can answer which standing routines were authored in a turn that read external content. Absent, never `false`, when clean.
+            ...(args.tainted ? { taintedAtCreation: true } : {}),
+            // OPE-55: arm as a durable job iff proposed as one. Absent ⇒ today's stateless routine.
+            ...(args.sessionMode === "job" ? { sessionMode: "job" } : {}),
+            // OPE-248 THE CEILING, minted HERE at click time (fresher than propose, like `nextRunAt`
+            // above) and only for a JOB. A plain routine is unbounded on purpose — a daily digest is
+            // MEANT to run forever, and retiring one after a week would be a defect, not a fence. Absent
+            // ⇒ unbounded, so every non-job row is byte-identical to a pre-OPE-248 one.
+            ...(args.sessionMode === "job" ? { bound: mintJobBound(args.trigger, now), fireCount: 0 } : {}),
+            // The collector and gate NAMES are frozen for the same reason `report` is, but what each name DOES still comes from the live registry at fire time: a collector's tool and arguments change by PR, under review, never on a stored row.
+            ...(args.collectors && args.collectors.length > 0 ? { collectors: [...args.collectors] } : {}),
+            ...(args.gate ? { gate: args.gate } : {}),
+            ...(args.modelRole === undefined ? {} : { modelRole: args.modelRole }),
+        };
+        await addRoutine(args.partition, routine);
+        // DECLARED PERMISSIONS (OPE-152) — written AFTER the routine exists (the key embeds its id) and
+        // attributed to the CLICKER, who is the person who actually armed them. Writes nothing for a
+        // TAINTED proposal (TAINTED-NEVER: a routine authored inside an injected turn starts from zero
+        // standing authority even when a human arms it) and nothing when none were declared.
+        const armed = await armDeclaredRoutinePermissions({
+            org: args.org,
+            routine,
+            declared: args.permissions ?? [],
+            grantedBy: decidedBy,
+            tainted: Boolean(args.tainted),
+            nowIso: now.toISOString(),
+        });
+        if (armed.length > 0) {
+            await appendAudit({
+                org: args.partition.org,
+                platform: args.partition.platform,
+                workspace: args.partition.workspace,
+                surface: args.partition.surface,
+                principalId: decidedBy,
+                action: ROUTINE_PERMISSIONS_ARMED_ACTION,
+                // The KINDS, not a re-render: the audit log records exactly what was made standing, by
+                // whose click, on which generation — the row an incident review reads back.
+                detail: { id: routine.id, grantedBy: decidedBy, kinds: armed, generation: routinePermissionGeneration(routine), declared: true },
+            });
+        }
+        // A declaration this deployment's config raises out of reach gets its own audit row, carrying ids, enums and the declaration string only. Not written on a TAINTED arm, where nothing armed and the reason is taint rather than the raise.
+        for (const declaration of args.tainted ? [] : bundleRaisedDeclarations(args.permissions ?? [])) {
+            await appendAudit({
+                org: args.partition.org,
+                platform: args.partition.platform,
+                workspace: args.partition.workspace,
+                surface: args.partition.surface,
+                principalId: decidedBy,
+                action: ROUTINE_PERMISSION_NEVER_LIFTS_ACTION,
+                detail: { id: routine.id, declaration, generation: routinePermissionGeneration(routine), reason: "bundle-declared-destructive" },
+            });
+        }
+        await appendAudit({
+            org: args.partition.org,
+            platform: args.partition.platform,
+            workspace: args.partition.workspace,
+            surface: args.partition.surface,
+            principalId: decidedBy,
+            action: "routine.create",
+            detail: { id: routine.id, trigger: describeTrigger(args.trigger, args.report), nextRunAt: routine.nextRunAt, armedBy: decidedBy, tainted: Boolean(args.tainted), ...(args.sessionMode === "job" ? { sessionMode: "job" } : {}), ...(args.report ? { report: args.report.kind } : {}) },
+        });
+        // A declaration that was not armed is NAMED, never dropped in silence. The set is DECLARED MINUS ARMED, so all three failure paths are covered: a card frozen before a vocabulary change, a tainted proposal, and a row write that failed.
+        const unarmed = unarmedDeclarations(args.permissions ?? [], armed);
+        return (`routine ${routine.id} armed — ${describeTrigger(args.trigger, args.report)}${routine.nextRunAt ? ` (first run ${routine.nextRunAt})` : ""}` +
+            `${armed.length > 0 ? `; standing permission to ${armed.map(describeDeclaredPermissionKind).join(" · ")} (revoke with revoke_routine_permissions)` : ""}` +
+            `${unarmed.length > 0 ? `; NOT armed: ${unarmed.map((d) => `"${d}"`).join(" · ")} — the routine asks a person when it reaches that step${args.tainted ? " (nothing was made standing: this routine was authored in a turn that read external content)" : ""}` : ""}.`);
+    },
+};
+registerActionKind(routineCreate);
+//# sourceMappingURL=routine-create.js.map

package/dist/agent/approvals/routine-create.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routine-create.js","sourceRoot":"","sources":["../../../agent/approvals/routine-create.ts"],"names":[],"mappings":"AAAA,oOAAoO;AAEpO,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,2BAA2B,EAAyD,MAAM,wBAAwB,CAAC;AAC7I,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EACL,gCAAgC,EAChC,qCAAqC,EACrC,wBAAwB,EACxB,2BAA2B,EAC3B,6BAA6B,EAC7B,mBAAmB,GACpB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGhD,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AA+BlD,6IAA6I;AAC7I,MAAM,UAAU,eAAe,CAAC,IAAwD;IACtF,MAAM,SAAS,GAAG,2BAA2B,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IACtE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACtC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO,CAAC,uCAAuC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,8GAA8G,CAAC,CAAC;IACtL,CAAC;IACD,OAAO,CAAC,2BAA2B,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;AACjG,CAAC;AAED,gQAAgQ;AAChQ,MAAM,UAAU,cAAc,CAAC,IAA2C;IACxE,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;IACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAChC,MAAM,GAAG,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC;QACvC,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,sEAAsE,CAAC;IACrH,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,2DAA2D,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC;AAC/J,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAqC;IAC7D,IAAI,CAAC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IAC1B,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,OAAO;QACL,GAAG;YACD,CAAC,CAAC,qBAAqB,GAAG,CAAC,QAAQ,+FAA+F;YAClI,CAAC,CAAC,+BAA+B,IAAI,CAAC,IAAI,kGAAkG;KAC/I,CAAC;AACJ,CAAC;AAED,kMAAkM;AAClM,MAAM,UAAU,cAAc,CAAC,IAA0C;IACvE,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAC5C,OAAO;QACL,4DAA4D,IAAI,CAAC,SAAS,2CAA2C;YACnH,qHAAqH;KACxH,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAAkC;IACnD,IAAI,EAAE,gBAAgB;IACtB,MAAM,EAAE,QAAQ;IAChB,SAAS,CAAC,IAAI;QACZ,OAAO;YACL,UAAU,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,MAAM,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,oCAAoC;YACpJ,0FAA0F;YAC1F,4FAA4F;YAC5F,mFAAmF;YACnF,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,oHAAoH,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjK,8LAA8L;YAC9L,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,iBAAiB,IAAI,CAAC,MAAM,CAAC,UAAU,+GAA+G,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACpM,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK;gBAC5B,CAAC,CAAC,CAAC,sNAAsN,CAAC;gBAC1N,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,oDAAoD,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACvI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,wEAAwE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnG,2LAA2L;YAC3L,GAAG,eAAe,CAAC,IAAI,CAAC;YACxB,GAAG,cAAc,CAAC,IAAI,CAAC;YACvB,GAAG,SAAS,CAAC,IAAI,CAAC;YAClB,GAAG,cAAc,CAAC,IAAI,CAAC;YACvB,KAAK,IAAI,CAAC,MAAM,EAAE;YAClB,WAAW,IAAI,CAAC,UAAU,EAAE;SAC7B,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS;QAC3B,yFAAyF;QACzF,yFAAyF;QACzF,yFAAyF;QACzF,6CAA6C;QAC7C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC1G,MAAM,OAAO,GAAY;YACvB,EAAE,EAAE,YAAY,EAAE;YAClB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,MAAM,EAAE,IAAI,CAAC,MAA2B;YACxC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,+FAA+F;YAC/F,gGAAgG;YAChG,0FAA0F;YAC1F,4FAA4F;YAC5F,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;YAC5B,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;YAC3C,mBAAmB,EAAE,CAAC;YACtB,mMAAmM;YACnM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,wFAAwF;YACxF,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,yFAAyF;YACzF,yFAAyF;YACzF,6FAA6F;YAC7F,4EAA4E;YAC5E,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/F,wOAAwO;YACxO,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9F,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;SACvE,CAAC;QACF,MAAM,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC1C,gGAAgG;QAChG,6FAA6F;QAC7F,+FAA+F;QAC/F,qFAAqF;QACrF,MAAM,KAAK,GAAG,MAAM,6BAA6B,CAAC;YAChD,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,OAAO;YACP,QAAQ,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE;YAChC,SAAS,EAAE,SAAS;YACpB,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;YAC9B,MAAM,EAAE,GAAG,CAAC,WAAW,EAAE;SAC1B,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,WAAW,CAAC;gBAChB,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG;gBACvB,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ;gBACjC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS;gBACnC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;gBAC/B,WAAW,EAAE,SAAS;gBACtB,MAAM,EAAE,gCAAgC;gBACxC,uFAAuF;gBACvF,4EAA4E;gBAC5E,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,2BAA2B,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE;aACjI,CAAC,CAAC;QACL,CAAC;QACD,2OAA2O;QAC3O,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/F,MAAM,WAAW,CAAC;gBAChB,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG;gBACvB,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ;gBACjC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS;gBACnC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;gBAC/B,WAAW,EAAE,SAAS;gBACtB,MAAM,EAAE,qCAAqC;gBAC7C,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,2BAA2B,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,6BAA6B,EAAE;aACjI,CAAC,CAAC;QACL,CAAC;QACD,MAAM,WAAW,CAAC;YAChB,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG;YACvB,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ;YACjC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS;YACnC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;YAC/B,WAAW,EAAE,SAAS;YACtB,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SACvR,CAAC,CAAC;QACH,2OAA2O;QAC3O,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;QACnE,OAAO,CACL,WAAW,OAAO,CAAC,EAAE,YAAY,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC5I,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,4BAA4B,KAAK,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC,CAAC,EAAE,EAAE;YACzJ,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,yDAAyD,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,8FAA8F,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CACtQ,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,kBAAkB,CAAC,aAAa,CAAC,CAAC"}

package/dist/agent/approvals/routine-lifecycle.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=routine-lifecycle.d.ts.map

package/dist/agent/approvals/routine-lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routine-lifecycle.d.ts","sourceRoot":"","sources":["../../../agent/approvals/routine-lifecycle.ts"],"names":[],"mappings":""}