@open-everywhere/core 0.1.0

package/agent/access/provider-selection-check.ts

@@ -0,0 +1,130 @@
+// The pure half of scripts/provider-selection-lint.ts — no fs, no eve — so the lint script and the unit test run the SAME check. It checks four things: a non-empty manifest, package.json agreeing with the selection, wiring that declares the selection before registering anything, and seam totality over core.
+
+export interface CoreSeamSource {
+  /** Path relative to `packages/core/agent`, e.g. `channels/post-arms.ts` (messages only). */
+  readonly path: string;
+  readonly source: string;
+}
+
+export interface ProviderSelectionInput {
+  readonly manifestSource: string;
+  readonly wiringSource: string;
+  readonly appDependencies: readonly string[];
+  readonly coreSeams: readonly CoreSeamSource[];
+  /** True only when `coreSeams` is the WHOLE of packages/core/agent. The stale-UNGATED_SEAMS check runs only then, because a crafted surface would report every row as stale. */
+  readonly fullCoreSweep?: boolean;
+}
+
+export interface ParsedProviderRow {
+  readonly id: string;
+  readonly registerFn: string;
+  readonly importedFrom?: string;
+}
+
+/** Provider-plane seams deliberately NOT gated, each with its reason. The rule-4 sweep fires on any `register*` export whose parameters or body mention `platform`, so a genuine non-selection use of that word belongs here rather than being silently skipped. */
+export const UNGATED_SEAMS: Readonly<Record<string, string>> = {
+  // Not a provider seam: the counter must stay armed for every platform, including the refusals themselves.
+  registerAuditDropCounter: "injects a single process-wide audit-drop counter; the `platform` is a callback ARGUMENT, not a registry key — nothing per-provider is stored",
+  // The sweep fires only because `link_sets_list` projects a linked account's `.platform` data column, which is not a selection key.
+  registerControlWriteTools: "registers control-plane MCP tools keyed by TOOL NAME; the `.platform` it touches is a linked-identity row's data column, not a per-provider registry key",
+  // Gating it again would ask the same question twice and would double-count the refusal warning.
+  registerWorkPlatform: "records a platform an ALREADY-ADMITTED adapter registration named; both callers gate with admitProviderRegistration before reaching it (proven in work-destinations-test §6)",
+  registeredWorkRole: "a pure READ of that registry — it stores nothing and admits nothing; the name matches the sweep's `register*` shape by accident of English",
+};
+
+/** `@open-everywhere/provider-<id>` (the bundle package-name grammar the whole repo uses). */
+const PROVIDER_PKG = /@open-everywhere\/provider-([a-z0-9-]+)/gu;
+/** A manifest import line: `import { registerFooProvider }` sourced from the foo bundle's register entry. */
+const MANIFEST_IMPORT = /import\s*\{\s*(register\w+Provider)\s*\}\s*from\s*"@open-everywhere\/provider-([a-z0-9-]+)\/agent\/register\.js"/gu;
+/** `{ id: "foo", register: registerFooProvider }` — one manifest row. */
+const MANIFEST_ROW = /\{\s*id:\s*"([a-z0-9-]+)"\s*,\s*register:\s*(register\w+Provider)\s*[,}]/gu;
+/** A core `export function registerX(...): T { … }` block, non-greedy to the first column-0 brace. */
+const CORE_SEAM = /^export function (register\w+)(?:<[^>]*>)?\(([\s\S]*?)\):\s*[^{]*\{([\s\S]*?)^\}/gmu;
+
+export function parseProviderManifest(manifestSource: string): ParsedProviderRow[] {
+  const imports = new Map<string, string>(); // register fn → package id
+  for (const m of manifestSource.matchAll(MANIFEST_IMPORT)) imports.set(m[1], m[2]);
+  const rows: ParsedProviderRow[] = [];
+  for (const m of manifestSource.matchAll(MANIFEST_ROW)) {
+    const importedFrom = imports.get(m[2]);
+    rows.push({ id: m[1], registerFn: m[2], ...(importedFrom ? { importedFrom } : {}) });
+  }
+  return rows;
+}
+
+/** Verifies a deployment's declared provider selection against everything that implements it. Returns human-readable problems, empty means clean; pure, because the caller enumerates the tree. */
+export function checkProviderSelection(input: ProviderSelectionInput): string[] {
+  const problems: string[] = [];
+  const rows = parseProviderManifest(input.manifestSource);
+  const selected = new Set(rows.map((r) => r.id));
+
+  if (rows.length === 0) {
+    problems.push(
+      `agent/lib/providers.generated.ts declares NO providers — roster.config.ts's \`providers\` map is this deployment's declaration of which bundles it carries; an instance with none can never wake on any surface`,
+    );
+  }
+
+  // Dependency honesty: package.json is AUTHORED, so this is the one triangulation rule that is still a real check.
+  const deps = new Set(input.appDependencies);
+  for (const id of selected) {
+    if (!deps.has(`@open-everywhere/provider-${id}`)) {
+      problems.push(`package.json does not depend on @open-everywhere/provider-${id}, which roster.config.ts selects — add it (workspace version "*")`);
+    }
+  }
+  for (const dep of deps) {
+    const m = /^@open-everywhere\/provider-([a-z0-9-]+)$/u.exec(dep);
+    if (m && !selected.has(m[1])) {
+      problems.push(`package.json depends on @open-everywhere/provider-${m[1]} but roster.config.ts does not select it — drop the dependency or add \`providers.${m[1]}\``);
+    }
+  }
+
+  // 3. The wiring module owns NO provider knowledge: it declares the manifest's selection and
+  //    drives the manifest's rows. A direct provider import or a hand-written registerXProvider()
+  //    call there would be a second, unlinted selection list.
+  if (!/declareProviderSelection\s*\(/u.test(input.wiringSource)) {
+    problems.push(
+      `agent/lib/register-adapters.ts never calls declareProviderSelection(...) — without the declaration core stays in library mode and the boot gate admits EVERY provider`,
+    );
+  }
+  {
+    const declareAt = input.wiringSource.search(/declareProviderSelection\s*\(/u);
+    // Matches `.register()`, the manifest-driven call. Matching `register\w+Provider(` instead would false-positive on the core seam this module legitimately calls.
+    const firstRegisterAt = input.wiringSource.search(/\.register\(\)/u);
+    if (declareAt >= 0 && firstRegisterAt >= 0 && firstRegisterAt < declareAt) {
+      problems.push(
+        `agent/lib/register-adapters.ts registers a provider BEFORE declareProviderSelection(...) — rows that land ahead of the declaration predate the gate and cannot be retracted; declare first`,
+      );
+    }
+  }
+  for (const m of input.wiringSource.matchAll(PROVIDER_PKG)) {
+    problems.push(
+      `agent/lib/register-adapters.ts references @open-everywhere/provider-${m[1]} directly — provider selection lives in roster.config.ts alone, so there is exactly ONE list to prune`,
+    );
+  }
+
+  for (const { path, source } of input.coreSeams) {
+    for (const m of source.matchAll(CORE_SEAM)) {
+      const [, name, params, body] = m;
+      const providerPlane = /\bplatform\s*\??\s*:/u.test(params) || /\.platform\b/u.test(body);
+      if (!providerPlane) continue;
+      if (Object.prototype.hasOwnProperty.call(UNGATED_SEAMS, name)) continue;
+      if (/admitProviderRegistration\s*\(/u.test(body)) continue;
+      problems.push(
+        `packages/core/agent/${path}: ${name}() is a provider-plane registration seam (keyed by a platform) but never calls admitProviderRegistration(...) — an unselected provider would get a live row in this registry. Gate it, or declare it in UNGATED_SEAMS (access/provider-selection-check.ts) with the reason it carries no per-provider row.`,
+      );
+    }
+  }
+  // …and no stale exemption: an UNGATED_SEAMS name that is no longer a core seam hides a real gap.
+  // Only meaningful against the REAL, complete core surface — see ProviderSelectionInput.fullCoreSweep.
+  if (input.fullCoreSweep) {
+    const seamNames = new Set<string>();
+    for (const { source } of input.coreSeams) for (const m of source.matchAll(CORE_SEAM)) seamNames.add(m[1]);
+    for (const name of Object.keys(UNGATED_SEAMS)) {
+      if (!seamNames.has(name)) {
+        problems.push(`UNGATED_SEAMS names "${name}", which is no longer an exported core register* seam — remove the exemption (a stale row hides a real gap)`);
+      }
+    }
+  }
+
+  return problems;
+}

package/agent/access/provider-selection.ts

@@ -0,0 +1,96 @@
+// The BOOT gate: every platform-keyed registration seam in core asks admitProviderRegistration first, so an unselected bundle writes ZERO registry rows and the downstream resolution points inherit their existing fail-closed behaviour. A refusal returns false and logs loudly rather than throwing, and an UNDECLARED selection is library mode that admits everything — a deployed app declares as its first act.
+
+export interface ProviderRegistrationRefusal {
+  readonly provider: string;
+  /** Which seam refused it — a short label, e.g. `"identity-mapper"` (log/diagnostic only). */
+  readonly seam: string;
+}
+
+// The declared selection. `undefined` is the UNDECLARED (library) state — see the header; an empty
+// set is a real declaration that selected nothing, and refuses every provider.
+let SELECTION: ReadonlySet<string> | undefined;
+
+// Refusals + the one-warning-per-(provider,seam) dedupe. Both are process-local diagnostics; they
+// are never consulted by a security decision (absence from the registries is the control).
+const REFUSALS: ProviderRegistrationRefusal[] = [];
+const WARNED = new Set<string>();
+
+// Provider ids admitted since the last declaration. ESM makes a registration before the declaration unavoidable; such a row for an UNSELECTED provider is a real, unretractable leak, and the declaration says so loudly.
+const ADMITTED = new Set<string>();
+
+function warnOnce(key: string, message: string): void {
+  if (WARNED.has(key)) return;
+  WARNED.add(key);
+  console.warn(`[open-everywhere:provider-selection] ${message}`);
+}
+
+/** Called ONCE at boot from the app's adapter wiring, BEFORE any registerXProvider(). Ids are opaque to core, blanks are dropped and duplicates collapse, and it returns the normalised sorted selection so the caller can log what took effect. */
+export function declareProviderSelection(ids: Iterable<string>): readonly string[] {
+  const set = new Set<string>();
+  for (const id of ids) {
+    const trimmed = typeof id === "string" ? id.trim() : "";
+    if (trimmed.length > 0) set.add(trimmed);
+  }
+  for (const early of ADMITTED) {
+    if (set.has(early)) continue;
+    console.warn(
+      `[open-everywhere:provider-selection] provider "${early}" registered a seam BEFORE the selection was declared and is NOT selected — that row predates the gate and cannot be retracted. It comes from core's own module-load wiring (the SCM issue adapter is the only such row today); move it behind the boot wiring if this deployment must not carry it.`,
+    );
+  }
+  SELECTION = set;
+  ADMITTED.clear();
+  REFUSALS.length = 0;
+  WARNED.clear();
+  return [...set].sort();
+}
+
+/** The declared selection (sorted), or `undefined` in the undeclared library state. */
+export function providerSelection(): readonly string[] | undefined {
+  return SELECTION === undefined ? undefined : [...SELECTION].sort();
+}
+
+/** Has a deployment declared its selection? False = library mode (the gate admits everything). */
+export function providerSelectionDeclared(): boolean {
+  return SELECTION !== undefined;
+}
+
+/** Is `provider` selected? Undeclared ⇒ true (library mode — see the header). */
+export function isProviderSelected(provider: string): boolean {
+  return SELECTION === undefined || SELECTION.has(provider);
+}
+
+/** The registration gate: false means the provider is not selected and the seam must return WITHOUT registering, leaving the platform structurally absent from that registry. `seam` is a log label only and is never a security input. */
+export function admitProviderRegistration(provider: string, seam: string): boolean {
+  if (isProviderSelected(provider)) {
+    if (SELECTION === undefined) ADMITTED.add(provider);
+    return true;
+  }
+  REFUSALS.push({ provider, seam });
+  warnOnce(
+    `${provider}\u0000${seam}`,
+    `REFUSED ${seam} registration for provider "${provider}" — it is not in this deployment's declared selection [${[...(SELECTION ?? [])].sort().join(", ") || "(none)"}]. The platform stays absent from that registry and every resolution through it fails closed. If this deployment should carry it, add it to agent/lib/providers.ts (and its app-tree stubs + workspace dependency — scripts/provider-selection-lint.ts pins all four together).`,
+  );
+  return false;
+}
+
+/** The inbound gate: false means the caller must refuse the delivery and emit the audit row, since this module stays pure. It is the same predicate as isProviderSelected under its own name, because a refused inbound is live traffic rather than a mis-wired boot. */
+export function admitInboundSurface(provider: string): boolean {
+  if (isProviderSelected(provider)) return true;
+  warnOnce(
+    `inbound\u0000${provider}`,
+    `REFUSED an inbound wake from provider "${provider}" — it is not in this deployment's declared selection [${[...(SELECTION ?? [])].sort().join(", ") || "(none)"}]. The wake is dropped (audited), not delivered.`,
+  );
+  return false;
+}
+
+export function refusedProviderRegistrations(): readonly ProviderRegistrationRefusal[] {
+  return [...REFUSALS];
+}
+
+/** Returns to the UNDECLARED library state. For tests and embedders; a deployment never calls it. */
+export function clearProviderSelection(): void {
+  SELECTION = undefined;
+  ADMITTED.clear();
+  REFUSALS.length = 0;
+  WARNED.clear();
+}

package/agent/access/read-grant.ts

@@ -0,0 +1,104 @@
+// UNION, NEVER NARROWEST-WINS. `access/bundle.ts`'s `Scope` is shared with a read grant as a SHAPE and nothing else: bundles resolve narrowest-wins (which VALUE applies at this surface), while a read grant asks "may this surface read at all", so a broader entry can never be revoked by a narrower one and there are no deny entries. `{ level: "org" }` means EVERY domain, and an EMPTY list is refusal — it is required and validated non-empty, and scopeGrantsRead still refuses one rather than trusting the validator.
+//
+// 🔴 NOT AN ISOLATION MECHANISM, AND MUST NEVER BE ARGUED INTO BEING ONE. Isolation is PHYSICAL: ten teams that must not see each other's data need separate integrations, separate credentials and separate hooks, enforced by the SOURCE SYSTEM where no bug of ours can cross it. Routing is LOGICAL: ten teams that merely want different events share one hook and write different filters. `readableBy` is the routing-side boundary with a confidentiality floor under it — the day a requirement needs a guarantee only a separate integration can give, the answer is a second hook.
+
+import type { EffectiveAccess } from "./resolver.js";
+import { SURFACE_KEY, TENANT_KEY, type Scope } from "./bundle.js";
+
+/** A hook's read grant: the scopes whose surfaces may read its events. Non-empty by validation. */
+export type ReadableBy = readonly Scope[];
+
+/** The structural minimum of an `EffectiveAccess`, so the create-time diagnostic asks the identical question fire time asks instead of re-deriving the union rule. It narrows the parameter, never the check. */
+export type ReadGrantSubject = Pick<EffectiveAccess, "tenantKey" | "domains" | "surfaceKey">;
+
+/** Union semantics: does ANY entry grant this resolved surface a read. A `principal` scope NEVER grants, because a webhook's events are service-plane facts and a DM is the other universe; the switch is total on purpose, so a level added later is a compile error here rather than a silent false. */
+export function scopeGrantsRead(readableBy: ReadableBy | undefined, access: ReadGrantSubject): boolean {
+  if (!readableBy || readableBy.length === 0) return false;
+  return readableBy.some((s) => {
+    switch (s.level) {
+      case "org":
+        return true;
+      case "tenant":
+        return s.tenant !== undefined && s.tenant === access.tenantKey;
+      case "domain":
+        return s.domain !== undefined && access.domains.includes(s.domain);
+      case "surface":
+        return s.surface !== undefined && s.surface === access.surfaceKey;
+      case "principal":
+        return false;
+      default:
+        return false;
+    }
+  });
+}
+
+/** Why this read grant is unusable, as human sentences (empty means valid). RETURNED, not thrown, so each caller composes its own refusal, and the rules deliberately mirror assertBindingsValid's key forms. */
+export function readableByDefects(readableBy: ReadableBy | undefined): readonly string[] {
+  const bad: string[] = [];
+  if (!readableBy || readableBy.length === 0) {
+    bad.push(
+      'readableBy is empty — a hook readable by nobody accepts deliveries and then refuses every routine, silently and forever. Name the domain(s) that may read it, or `{ level: "org" }` for EVERY domain in the org.',
+    );
+    return bad;
+  }
+  for (const s of readableBy) {
+    const where = `readableBy entry (${s.level} scope)`;
+    switch (s.level) {
+      case "org":
+        for (const [field, value] of [["tenant", s.tenant], ["domain", s.domain], ["surface", s.surface], ["principal", s.principal]] as const) {
+          if (value !== undefined) bad.push(`${where} also sets ${field} — org scope already means EVERY domain and carries no address field; drop it or change the level`);
+        }
+        break;
+      case "tenant":
+        if (!s.tenant) bad.push(`${where} needs tenant — a tenant-level grant can never match without one`);
+        else if (!TENANT_KEY.test(s.tenant)) {
+          bad.push(`${where} tenant "${s.tenant}" must be the PLATFORM-QUALIFIED key "platform/<tenant-id>" (e.g. "slack/T0123ABC") — a bare vendor id will NEVER match`);
+        }
+        break;
+      case "domain":
+        if (!s.domain) bad.push(`${where} needs domain — a domain-level grant can never match without one`);
+        else if (s.domain.includes("/")) {
+          bad.push(`${where} domain "${s.domain}" contains "/" — a domain scope takes the BARE name from memory/config/domains.ts ("payments"), deliberately NOT tenant-qualified`);
+        }
+        break;
+      case "surface":
+        if (!s.surface) bad.push(`${where} needs surface — a surface-level grant can never match without one`);
+        else if (!SURFACE_KEY.test(s.surface)) {
+          bad.push(`${where} surface "${s.surface}" must be the fully-qualified key "platform/<tenant-id>/<container-id>" (e.g. "slack/T0123ABC/C0123ABC")`);
+        }
+        break;
+      case "principal":
+        bad.push(
+          `${where} is principal-scoped — a DM is a separate connector universe and never reads a service-plane webhook. Grant a domain or a surface instead.`,
+        );
+        break;
+      default:
+        bad.push(`${where} has an unknown level ${JSON.stringify((s as Scope).level)} — the levels are org | tenant | domain | surface`);
+    }
+  }
+  return bad;
+}
+
+/** The one-line human rendering used by the approval card, the PR body, the validator's error and any refusal that names a grant. The org case spells its consequence out IN WORDS, or the widest grant expressible would read as the smallest. */
+export function describeReadableBy(readableBy: ReadableBy | undefined): string {
+  if (!readableBy || readableBy.length === 0) return "NOBODY (no routine can ever read this hook's events)";
+  const parts = readableBy.map((s) => {
+    switch (s.level) {
+      case "org":
+        return "EVERY domain in the org";
+      case "tenant":
+        return `every domain in tenant ${s.tenant}`;
+      case "domain":
+        return `domain "${s.domain}"`;
+      case "surface":
+        return `surface ${s.surface}`;
+      case "principal":
+        return `principal ${s.principal} (never grants — see readableByDefects)`;
+      default:
+        return JSON.stringify(s);
+    }
+  });
+  // De-duplicated, order preserved: a hand-written list repeating a domain should not read as two
+  // separate grants on a card a human is about to approve.
+  return [...new Set(parts)].join(", ");
+}

package/agent/access/repo-capabilities.ts

@@ -0,0 +1,74 @@
+// Named capability sets a work-source binding opts into, EXPANDING from the in-code per-plane job sets, which are the default rather than the maximum. A capability is a NAME this repo implements and never a raw vendor permission string, so the set of reachable permission families is closed in code; the name-to-GitHub-family mapping lives with the mint (scm/mint.ts), which is the security boundary.
+
+export interface RepoCapabilitySpec {
+  /** One line, operator-facing — rendered in the fit report. */
+  readonly summary: string;
+}
+
+/** THE CLOSED SET. Adding a member is a reviewed code change that must ALSO add the family mapping in scm/mint.ts and a row to the mint-derivation test, which are asserted against each other. */
+const CAPABILITY_TABLE = {
+  // GitHub lists the Issues REST endpoints under the Pull requests permission too, so the narrow `issues`-only job set is refused on a PULL REQUEST with 403 "Resource not accessible by integration" (measured, OPE-1020/OPE-1021). A domain that wants the agent to triage PRs opts in here; every other binding keeps the fence.
+  "pr-admin": {
+    summary: "act on PULL REQUESTS as well as issues — close/reopen, assign and label a PR, and set PR metadata",
+  },
+  // Pushing a branch that touches `.github/workflows/**` needs GitHub's own Workflows permission on
+  // top of contents:write; without it the push is refused outright. A domain whose work includes CI
+  // changes opts in; the default PR job set stays unable to edit a workflow file.
+  workflows: {
+    summary: "push branches that add or change GitHub Actions workflow files under .github/workflows",
+  },
+} as const satisfies Readonly<Record<string, RepoCapabilitySpec>>;
+
+/** A capability name this deployment implements — a LITERAL union, so a typo is a compile error in
+ *  code config and a load-time refusal in parsed config. */
+export type RepoCapability = keyof typeof CAPABILITY_TABLE;
+
+export const REPO_CAPABILITIES: Readonly<Record<RepoCapability, RepoCapabilitySpec>> = CAPABILITY_TABLE;
+
+/** Every implemented capability name, sorted — the closed vocabulary an error message lists. */
+export const REPO_CAPABILITY_NAMES: readonly RepoCapability[] = (Object.keys(CAPABILITY_TABLE) as RepoCapability[]).sort();
+
+/** Is this string one of the capability sets we implement? Unknown ⇒ false, always: an
+ *  unrecognised name is a config error, never a silently-ignored expansion. */
+export function isRepoCapability(value: string): value is RepoCapability {
+  return Object.hasOwn(CAPABILITY_TABLE, value);
+}
+
+/** Every problem with one repo grant's `capabilities` list; empty means valid. Fail-LOUD on an unknown name rather than dropping it, and refuse an EMPTY list too: a silently-ignored expansion reads as a working narrow fence right up until the mint 403s in production. */
+export function repoCapabilityProblems(where: string, capabilities: readonly string[] | undefined): string[] {
+  if (capabilities === undefined) return [];
+  if (!Array.isArray(capabilities)) {
+    return [`  ${where} has a \`capabilities\` that is not an array — got ${JSON.stringify(capabilities)}`];
+  }
+  const known = REPO_CAPABILITY_NAMES.map((n) => JSON.stringify(n)).join(", ");
+  if (capabilities.length === 0) {
+    return [
+      `  ${where} declares \`capabilities: []\` — an empty list expands nothing; write the repo as a bare string ("owner/repo") for the default job sets, or name a capability (${known})`,
+    ];
+  }
+  const bad: string[] = [];
+  const seen = new Set<string>();
+  for (const cap of capabilities) {
+    if (typeof cap !== "string" || cap.trim() === "") {
+      bad.push(`  ${where} declares an empty capability name — name one of ${known}`);
+      continue;
+    }
+    if (!isRepoCapability(cap)) {
+      bad.push(
+        `  ${where} declares unknown capability ${JSON.stringify(cap)} — the implemented sets are ${known}. ` +
+          `Capabilities are NAMES this deployment implements, never raw GitHub permission strings (e.g. "pull_requests: write" is not writable here).`,
+      );
+      continue;
+    }
+    if (seen.has(cap)) bad.push(`  ${where} declares capability ${JSON.stringify(cap)} more than once — remove the duplicate`);
+    seen.add(cap);
+  }
+  return bad;
+}
+
+/** Union two capability lists, sorted and deduped — the additive join the resolver uses when
+ *  several bundles grant the same repo. Expansion is additive config: a domain that holds two
+ *  bundles granting one repo holds the union of what both opted into. */
+export function unionRepoCapabilities(a: readonly RepoCapability[], b: readonly RepoCapability[]): readonly RepoCapability[] {
+  return [...new Set([...a, ...b])].sort();
+}

package/agent/access/request.ts

@@ -0,0 +1,126 @@
+// Builds a ResolveRequest from runtime context, and exposes the per-session mode and principal. All of it comes from the shared identity seam (agent/identity/binding.ts), so access, memory and routine dispatch resolve the SAME identity from the same place.
+
+import { resolvePartition } from "../memory/partition.js";
+import { auditToolAction } from "../audit/tool-action.js";
+import { actingPrincipalId, bindFrom, currentSessionId, currentTurnId, delegationRootSessionId, unattendedFrom, type BindableContext } from "../identity/binding.js";
+import { adoptedOwnAccountAsk } from "../connections/own-account-carriage.js";
+import { credentialGrantConnectors } from "./credential-grant.js";
+import { ownAccountEgressRefusalText, resolveAccess, type EffectiveAccess, type ResolveRequest, type SessionMode } from "./resolver.js";
+import { getConfig } from "./config.js";
+import { groupsForPrincipal } from "../identity/groups.js";
+import { tryPrincipalKey } from "../identity/principal-key.js";
+import { memberPlaneGrants } from "./member-grant.js";
+
+export function resolveMode(ctx: BindableContext): SessionMode {
+  return bindFrom(ctx).mode;
+}
+
+// There is deliberately no `resolveVisibility` wrapper: `SurfaceBinding.visibility` is carried and audited, never read to gate anything, and `resolveMemoryPlan` does not take it as an input. Add a reader here only alongside the code that makes visibility decide something.
+
+/** WHO this turn is attributable to — the acting human, or on a triggered fire the attested creator of the routine. This is the PROVENANCE answer, not the authorization one: a gate that means "there is a human in this room asking" must call {@link actingPrincipalIdOf}. */
+export function principalIdOf(ctx: BindableContext): string | undefined {
+  return bindFrom(ctx).principalId;
+}
+
+/** The principal ACTING on this turn; `undefined` on an autonomous fire, whatever creator it is attributable to. Use this, not {@link principalIdOf}, for any gate whose real question is whether a person is present. */
+export function actingPrincipalIdOf(ctx: BindableContext): string | undefined {
+  return actingPrincipalId(bindFrom(ctx));
+}
+
+/** Is nobody watching this turn? A SECURITY control: the approver chain turns `ask` into `deny` when it reads true, every approval site feeds the chain from HERE, `lint:principal-gate` rule 5 refuses any other spelling, and it reads the ACTING principal because a fire binds as its routine's creator. */
+export function unattendedOf(ctx: BindableContext): boolean {
+  return unattendedFrom(bindFrom(ctx));
+}
+
+export function buildResolveRequest(ctx: BindableContext): ResolveRequest {
+  const b = bindFrom(ctx);
+  const p = resolvePartition(ctx);
+  const memberPlane = memberPlaneFor(b.domainSurface ?? p.surface, p.workspaceKey);
+  // The acting principal is hoisted because both the principal address and the person-group membership below derive from it: a fire that must not inherit its creator's personal universe must not inherit their group memberships either.
+  const acting = actingPrincipalId(b);
+  return {
+    mode: b.mode,
+    platform: p.platform,
+    workspace: p.workspace,
+    // Memory's "surface" fills `ResolveRequest.channel` — a raw coordinate, not a scope level. DOMAIN grain, not conversational grain: a Discord thread's own channel id can never match a channel-scoped grant naming its parent, so a thread turn gets exactly the channel's access.
+    channel: b.domainSurface ?? p.surface,
+    // Domains this surface belongs to, for `domain`-scoped bindings. Computed here rather than in the resolver so the resolver stays pure, at the same domain grain as `channel`.
+    domains: getConfig().domainsForSurface({ workspaceKey: p.workspaceKey, surface: b.domainSurface ?? p.surface }),
+    // The ACTING principal. In DM mode this field IS the personal capability universe, and a fire bound as its creator must not inherit it: "may read the org brain" is a memory claim, "may authenticate as the creator" is a credential claim nobody made.
+    principalId: acting,
+    // The PURE half only: members written as qualified principal keys. The other member form is a database read, so it is added by the awaitable twin in access/group-request.ts; the asymmetry is fail-closed, because the async path can only ADD group names and a synchronous caller therefore resolves strictly less access.
+    groups: groupsForPrincipal(getConfig().loadGroups?.() ?? [], acting === undefined ? undefined : tryPrincipalKey(p.platform, p.workspace, acting)),
+    // The member-plane grant set, computed here rather than in the resolver so the resolver stays pure. FAIL-CLOSED on every unreadable arm — a throwing config seam, a surface in no domain, or a domain declaring nothing all produce an EMPTY set, which refuses — and it is omitted when empty rather than carried as `[]`.
+    ...(memberPlane.length === 0 ? {} : { memberPlane }),
+  };
+}
+
+/** The caller's member-plane grant keys, or `[]` on any unreadable input. Split out so the fail-closed
+ *  arm is one statement rather than a try/catch inlined in an object literal. */
+function memberPlaneFor(surface: string, workspaceKey: string): readonly string[] {
+  try {
+    const names = new Set(getConfig().domainsForSurface({ workspaceKey, surface }));
+    return memberPlaneGrants(getConfig().loadDomains().filter((d) => names.has(d.name)));
+  } catch {
+    return [];
+  }
+}
+
+/** The own-account ask this session runs under, read off the host-set stamp; anything unreadable resolves NO ask and leaves the reach exactly as it was. A seat is covered only from the moment the stamp lands — the sandbox policy compiles at `turn.started`, before the words exist — so the vendor host survives that one turn. */
+function ownAccountAskFor(ctx: BindableContext): { readonly connector: string } | undefined {
+  try {
+    const ask = adoptedOwnAccountAsk(
+      ctx,
+      credentialGrantConnectors().map((connector) => ({ connector })),
+    );
+    return ask === undefined ? undefined : { connector: ask.connector };
+  } catch {
+    return undefined;
+  }
+}
+
+/** Turns whose own-account egress refusal has already been audited, so the row is written once per turn rather than once per call. It may only ever DUPLICATE a row, never drop one: the key is session plus turn plus connector, and an unreadable session or turn id skips the memo and audits every time. */
+const ownAccountRefusalAudited = new Set<string>();
+const OWN_ACCOUNT_AUDIT_MEMO_MAX = 512;
+
+/** One audit row per turn naming what an own-account ask cost this session's reach. Best effort by
+ *  contract, exactly like every other `auditToolAction` caller: a store outage must never turn a
+ *  refusal into a reach. */
+function auditOwnAccountEgressRefusal(ctx: BindableContext, access: EffectiveAccess): void {
+  const refusals = access.ownAccountEgressRefusals ?? [];
+  if (refusals.length === 0) return;
+  const session = currentSessionId(ctx) ?? delegationRootSessionId(ctx);
+  const turn = currentTurnId(ctx);
+  if (session !== undefined && turn !== undefined) {
+    const key = [session, turn, refusals[0]!.connector].join("\u0000");
+    if (ownAccountRefusalAudited.has(key)) return;
+    if (ownAccountRefusalAudited.size >= OWN_ACCOUNT_AUDIT_MEMO_MAX) ownAccountRefusalAudited.clear();
+    ownAccountRefusalAudited.add(key);
+  }
+  void auditToolAction(ctx, OWN_ACCOUNT_EGRESS_REFUSAL_ACTION, {
+    connector: refusals[0]!.connector,
+    hosts: refusals.map((r) => r.host),
+    viaConnections: [...new Set(refusals.map((r) => r.viaConnection))].sort(),
+    reason: ownAccountEgressRefusalText(refusals[0]!),
+  }).catch(() => undefined);
+}
+
+/** The audit action an own-account withholding writes. Named for the PLANE it happened on: the
+ *  connector plane's own row is `connector.acting_identity`, and reading one as the other would
+ *  answer "which account read this page" with a route that never ran. */
+export const OWN_ACCOUNT_EGRESS_REFUSAL_ACTION = "egress.own_account_refusal";
+
+/** Resolve this session's effective access from runtime context — the registry-backed convenience over the pure `resolveAccess`, pulling deployer-owned config from the registered AppConfig. It is also where the own-account ask is read and its refusal audited, because the ask is a fact about the live session. */
+export function resolveAccessFor(ctx: BindableContext): EffectiveAccess {
+  const cfg = getConfig();
+  const ask = ownAccountAskFor(ctx);
+  const access = resolveAccess(
+    { ...buildResolveRequest(ctx), ...(ask === undefined ? {} : { ownAccountAsk: ask }) },
+    cfg.loadBundles(),
+    cfg.loadBindings(),
+    cfg.pluginRegistry,
+    cfg.loadConnectorCredentials?.() ?? [],
+  );
+  auditOwnAccountEgressRefusal(ctx, access);
+  return access;
+}