@open-everywhere/core 0.1.0

package/dist/agent/channels/engagement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engagement.js","sourceRoot":"","sources":["../../../agent/channels/engagement.ts"],"names":[],"mappings":"AAAA,kQAAkQ;AAClQ,qRAAqR;AAErR,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,EAAE,WAAW,EAAkB,MAAM,wBAAwB,CAAC;AAGrE,8PAA8P;AAC9P,2OAA2O;AAC3O,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAgBnC;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAA4B,EAAE,OAAgB;IACjF,OAAO,IAAI,EAAE,SAAS,KAAK,IAAI,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,IAAI,OAAO,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,CAAY,EAAE,QAAgB,EAAE,KAAa,EAAE,IAAiB;IACtG,IAAI,CAAC;QACH,iGAAiG;QACjG,oBAAoB;QACpB,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC;QAC3C,0FAA0F;QAC1F,qFAAqF;QACrF,iGAAiG;QACjG,+FAA+F;QAC/F,yFAAyF;QACzF,MAAM,OAAO,GAAG,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAChH,4FAA4F;QAC5F,+CAA+C;QAC/C,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QACzH,MAAM,mBAAmB,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IAC3F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC,UAAU,IAAI,QAAQ,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChH,CAAC;AACH,CAAC;AAED;sEACsE;AACtE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,CAAY,EAAE,QAAgB;IACtE,IAAI,CAAC;QACH,OAAO,MAAM,mBAAmB,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAClF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC,UAAU,IAAI,QAAQ,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChH,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;6EAC6E;AAC7E,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,CAAY,EAAE,QAAgB;IACzE,IAAI,CAAC;QACH,OAAO,MAAM,mBAAmB,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACrF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC,UAAU,IAAI,QAAQ,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnH,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,CAAY,EAAE,QAAgB;IAClE,IAAI,CAAC;QACH,OAAO,MAAM,mBAAmB,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC,UAAU,IAAI,QAAQ,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5G,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,CAAY,EAAE,QAAgB;IACpE,IAAI,CAAC;QACH,OAAO,MAAM,mBAAmB,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAChF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC,UAAU,IAAI,QAAQ,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9G,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,CAAY,EAAE,MAA0B;IAC5E,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,iGAAiG;IACjG,kGAAkG;IAClG,gCAAgC;IAChC,OAAO,CAAC,MAAM,mBAAmB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;AAClE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CAAC,CAAY;IAChD,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO;QACL,SAAS,EAAE,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE;QACzG,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO;KAC7B,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,CAAY,EAAE,QAAgB;IAClE,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,mBAAmB,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,KAAK,IAAI,CAAC;IAC7F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC,UAAU,IAAI,QAAQ,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChH,OAAO,KAAK,CAAC,CAAC,2BAA2B;IAC3C,CAAC;AACH,CAAC;AA2BD;;;wFAGwF;AACxF,MAAM,CAAC,MAAM,2BAA2B,GAAG,yEAAyE,CAAC;AAQrH;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAyB;IAC1D,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,KAAK,iBAAiB,EAAE,CAAC;QACzD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,KAAK,CAAC,OAAO,uBAAuB,EAAE,CAAC;IAC9F,CAAC;IACD,IAAI,KAAK,CAAC,WAAW;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;IACjG,IAAI,KAAK,CAAC,YAAY;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;IACvG,IAAI,CAAC,KAAK,CAAC,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,+CAA+C,EAAE,CAAC;IACxG,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,4DAA4D,EAAE,CAAC;IACtH,oGAAoG;IACpG,+FAA+F;IAC/F,mDAAmD;IACnD,IAAI,KAAK,CAAC,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IAClF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,2DAA2D,EAAE,CAAC;AAChG,CAAC;AA8BD;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,CAAuB;IAC3D,IAAI,CAAC,CAAC,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;IAC5G,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACrG,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QACpD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,gDAAgD,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC;IAC3H,CAAC;IACD,8FAA8F;IAC9F,2EAA2E;IAC3E,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;IACjI,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,iDAAiD,EAAE,CAAC;IACxI,IAAI,CAAC,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;QACnC,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;IAC1G,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,MAAM,yBAAyB,EAAE,CAAC;AAC3G,CAAC"}

package/dist/agent/channels/entity-actions.d.ts

@@ -0,0 +1,80 @@
+import { type BindableContext } from "../identity/binding.js";
+import type { Domain } from "../memory/domain.js";
+import type { RepoCapability } from "../access/repo-capabilities.js";
+/** A neutral, cross-surface entity reference — {@link EntityRef.platform} is a runtime dispatch
+ *  key (never a tool name/schema field encoding a vendor), {@link EntityRef.id} is that platform's
+ *  own identifier shape: Linear issue UUID or human identifier ("ENG-42"); GitHub "owner/repo#123". */
+export interface EntityRef {
+    readonly platform: string;
+    readonly id: string;
+    /**
+     * The Linear WORKSPACE (organization) this entity lives in — the credential SELECTOR a Linear-platform ref needs.
+     * No more model-steerable than {@link EntityRef.id}: both come off the wake's own auth attributes via {@link currentTurnEntityRef}, never a tool argument. Absent for GitHub and for a ref resolved before the field existed, and the mutation then falls back to the org-free credential chain.
+     */
+    readonly organizationId?: string;
+}
+/** The three ticket-mutation verbs — adapter methods are named identically, so a platform switch
+ *  and a registry key share one vocabulary. */
+export type EntityVerb = "setState" | "assign" | "addLabel";
+/**
+ * One mutation call. Self-contained — it resolves its own credentials and takes no ctx — so it runs identically from an open-tier tool's execute() or a gated ActionKind's, which has no session ctx at all.
+ * `organizationId` is the same FROZEN fact as `entityId`, riding through propose, freeze and decide, so a Linear adapter can present the right workspace's token even when the mutation runs hours later with no ctx. Optional, and ignored by adapters that need no such selector.
+ */
+export type EntityActionFn = (entityId: string, value: string, organizationId?: string, capabilities?: readonly RepoCapability[]) => Promise<string>;
+/**
+ * One surface's ticket-action adapter. Each verb method is OPTIONAL, and presence IS the entity-gated declaration: undefined means this surface does not support that verb, never faked.
+ * `checkAccess` is the PROPOSE-TIME authz hook beyond the topology gate. It may be async and is awaited: a surface whose silo grain differs from its entity grain can only answer the question with a lookup.
+ */
+export interface EntityActionAdapter {
+    readonly platform: string;
+    /** The work-credential ROLE a domain declares to mutate here (OPE-959). Exactly
+     *  {@link TicketCreateAdapter.workRole}'s contract — one mechanism, not two — and read from the
+     *  same channels/work-registry.ts. */
+    readonly workRole?: string;
+    checkAccess?(ctx: BindableContext, entityId: string, domains: readonly Domain[]): void | Promise<void>;
+    /**
+     * The vendor WORKSPACE this mutation is made in when the REF ITSELF carries none. A cross-surface caller passes `ref` explicitly and an explicit ref never carries one, so the workspace comes from the domain's own work GRANT — which is also the credential selector, so the mutation is made with the identity the operator granted.
+     * Undefined means no answer and the org-free credential chain stands. Never a guess: an adapter that cannot name ONE workspace returns undefined and lets its own `checkAccess` refuse. The exact contract of {@link TicketCreateAdapter.workspaceFor} — one mechanism, not two.
+     */
+    workspaceFor?(ctx: BindableContext): string | undefined;
+    /**
+     * The NAMED CAPABILITY SETS this session's binding opted this entity's WORK SOURCE into. A surface with no such binding shape answers nothing, which is the default.
+     * Resolved at PROPOSE time exactly like {@link workspaceFor} and FROZEN onto the pending row by a gated verb, because there is no ctx at decide time. Empty or undefined means the closed per-plane job set alone.
+     */
+    capabilitiesFor?(ctx: BindableContext, entityId: string): readonly RepoCapability[];
+    setState?: EntityActionFn;
+    assign?: EntityActionFn;
+    addLabel?: EntityActionFn;
+}
+/** Register (or replace) one surface's adapter. Called once per surface at module load — see the
+ *  bottom of this file. Exported so a future surface (Jira, Notion databases) registers the same way. */
+export declare function registerEntityActionAdapter(adapter: EntityActionAdapter): void;
+/** The platforms with ANY ticket-action adapter registered (for "not supported" messages). */
+export declare function supportedEntityActionPlatforms(): readonly string[];
+/**
+ * Context-free adapter-fn lookup — what a gated verb's ActionKind.execute(), which has no ctx and no session, calls at decide time to re-resolve the mutation by its FROZEN platform.
+ * Undefined only when the platform and verb pair is unregistered, which propose time already validated: a defensive re-check, never the primary gate.
+ */
+export declare function entityActionFn(platform: string, verb: EntityVerb): EntityActionFn | undefined;
+/**
+ * The DEFAULT entity for this turn when no explicit `ref` is given: on Linear the issue this wake's session or comment is anchored to, on GitHub the issue or pull request the delivery is anchored to.
+ * Any other platform answers undefined, so the caller's "no ticket entity for this turn" refusal doubles as the honest "unsupported here" message.
+ */
+export declare function currentTurnEntityRef(ctx: BindableContext): EntityRef | undefined;
+/**
+ * One resolved, gated entity action: the concrete {@link EntityRef} plus a bound, already-authz-checked `run` closure.
+ * An open-tier tool calls `run` immediately; a gated tool freezes `ref` and the verb-specific value and never calls it, because the frozen platform and id are re-looked-up via {@link entityActionFn} at decide time.
+ */
+export interface ResolvedEntityAction {
+    readonly ref: EntityRef;
+    readonly run: (value: string) => Promise<string>;
+    /** The capability sets resolved for this entity's work source (OPE-1024) — bound into `run` for
+     *  an open verb, and FROZEN onto the pending row by a gated one. Empty = the default job set. */
+    readonly capabilities: readonly RepoCapability[];
+}
+/**
+ * Resolve and gate ONE verb call, FAIL-CLOSED at every step and never a silent no-op: the ref (explicit, else this turn's own), the ENTITY gate (the connectors this session's domain holds a work grant on), SUPPORT (a registered adapter implementing THIS verb, else a structured refusal naming what is), `await checkAccess`, then the workspace selector.
+ * It returns the ref plus a ready-to-call `run`; the caller decides whether to call it now for an open verb, or freeze it for later approval.
+ */
+export declare function resolveEntityAction(ctx: BindableContext, verb: EntityVerb, explicitRef: EntityRef | undefined, domains: readonly Domain[]): Promise<ResolvedEntityAction>;
+//# sourceMappingURL=entity-actions.d.ts.map

package/dist/agent/channels/entity-actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-actions.d.ts","sourceRoot":"","sources":["../../../agent/channels/entity-actions.ts"],"names":[],"mappings":"AAGA,OAAO,EAKL,KAAK,eAAe,EACrB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAErE;;uGAEuG;AACvG,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;+CAC+C;AAC/C,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,UAAU,CAAC;AAE5D;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,CAC3B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,cAAc,CAAC,EAAE,MAAM,EACvB,YAAY,CAAC,EAAE,SAAS,cAAc,EAAE,KACrC,OAAO,CAAC,MAAM,CAAC,CAAC;AAErB;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;0CAEsC;IACtC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,CAAC,GAAG,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvG;;;OAGG;IACH,YAAY,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS,CAAC;IACxD;;;OAGG;IACH,eAAe,CAAC,CAAC,GAAG,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,cAAc,EAAE,CAAC;IACpF,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B;AAMD;yGACyG;AACzG,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAM9E;AAED,8FAA8F;AAC9F,wBAAgB,8BAA8B,IAAI,SAAS,MAAM,EAAE,CAElE;AAWD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,cAAc,GAAG,SAAS,CAE7F;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,eAAe,GAAG,SAAS,GAAG,SAAS,CAahF;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACjD;qGACiG;IACjG,QAAQ,CAAC,YAAY,EAAE,SAAS,cAAc,EAAE,CAAC;CAClD;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,UAAU,EAChB,WAAW,EAAE,SAAS,GAAG,SAAS,EAClC,OAAO,EAAE,SAAS,MAAM,EAAE,GACzB,OAAO,CAAC,oBAAoB,CAAC,CAiC/B"}

package/dist/agent/channels/entity-actions.js

@@ -0,0 +1,94 @@
+// entity-actions — the NEUTRAL core behind the three ticket-mutation verbs: one per-verb registry keyed by platform, a context-aware RESOLVER that runs the entity gate once, and per-surface adapters supplying the mutation. A verb tool never encodes surface identity in its schema, so `platform` is a runtime dispatch key. Each surface DECLARES which verbs it supports by which adapter methods it implements — undefined is unsupported, never faked, and a miss fails LOUD naming what IS supported.
+// PROPOSE TIME IS THE ONLY TIME: `checkAccess` runs once inside `resolveEntityAction`, because a gated verb's execute() re-looks-up the adapter by its FROZEN platform with no ctx and no session. A fence that ran any later would already have let the approval card disclose the target into the asking room, which on a cross-domain ref is itself the leak. There is deliberately NO per-turn origin fence: a ticket ref is an explicit, separately-addressed target, so a Slack turn legitimately proposes a state change on a Linear issue in its domain.
+import { bindFrom, currentTurnIssue, currentTurnGithubTarget, currentTurnOrganization, } from "../identity/binding.js";
+import { workDestinationPlatforms } from "./work-destinations.js";
+import { registerWorkPlatform } from "./work-registry.js";
+import { admitProviderRegistration } from "../access/provider-selection.js";
+// Populated below, after the per-surface adapters are imported — see the bottom of this file for
+// why (avoids a require-cycle: linear-actions.ts/scm/issue-actions.ts import nothing from here).
+const ENTITY_ACTION_ADAPTERS = {};
+/** Register (or replace) one surface's adapter. Called once per surface at module load — see the
+ *  bottom of this file. Exported so a future surface (Jira, Notion databases) registers the same way. */
+export function registerEntityActionAdapter(adapter) {
+    if (!admitProviderRegistration(adapter.platform, "entity-action-adapter"))
+        return;
+    ENTITY_ACTION_ADAPTERS[adapter.platform] = adapter;
+    // OPE-959 — see registerTicketCreateAdapter's note. Additive on the role, so a platform that
+    // registers both adapters and names the role on only one of them still resolves it.
+    registerWorkPlatform(adapter.platform, adapter.workRole);
+}
+/** The platforms with ANY ticket-action adapter registered (for "not supported" messages). */
+export function supportedEntityActionPlatforms() {
+    return Object.keys(ENTITY_ACTION_ADAPTERS);
+}
+/** The platforms whose adapter implements THIS verb — the precise "supported on" list a
+ *  verb-specific refusal names (narrower than {@link supportedEntityActionPlatforms} once a
+ *  surface implements only some verbs, e.g. a future read-mostly ticketing surface). */
+function platformsSupporting(verb) {
+    return Object.values(ENTITY_ACTION_ADAPTERS)
+        .filter((a) => typeof a[verb] === "function")
+        .map((a) => a.platform);
+}
+/**
+ * Context-free adapter-fn lookup — what a gated verb's ActionKind.execute(), which has no ctx and no session, calls at decide time to re-resolve the mutation by its FROZEN platform.
+ * Undefined only when the platform and verb pair is unregistered, which propose time already validated: a defensive re-check, never the primary gate.
+ */
+export function entityActionFn(platform, verb) {
+    return ENTITY_ACTION_ADAPTERS[platform]?.[verb];
+}
+/**
+ * The DEFAULT entity for this turn when no explicit `ref` is given: on Linear the issue this wake's session or comment is anchored to, on GitHub the issue or pull request the delivery is anchored to.
+ * Any other platform answers undefined, so the caller's "no ticket entity for this turn" refusal doubles as the honest "unsupported here" message.
+ */
+export function currentTurnEntityRef(ctx) {
+    const binding = bindFrom(ctx);
+    if (binding.platform === "linear") {
+        const issue = currentTurnIssue(ctx);
+        if (!issue)
+            return undefined;
+        const organizationId = currentTurnOrganization(ctx);
+        return { platform: "linear", id: issue, ...(organizationId ? { organizationId } : {}) };
+    }
+    if (binding.platform === "github") {
+        const t = currentTurnGithubTarget(ctx);
+        return t ? { platform: "github", id: `${t.owner}/${t.repo}#${t.number}` } : undefined;
+    }
+    return undefined;
+}
+/**
+ * Resolve and gate ONE verb call, FAIL-CLOSED at every step and never a silent no-op: the ref (explicit, else this turn's own), the ENTITY gate (the connectors this session's domain holds a work grant on), SUPPORT (a registered adapter implementing THIS verb, else a structured refusal naming what is), `await checkAccess`, then the workspace selector.
+ * It returns the ref plus a ready-to-call `run`; the caller decides whether to call it now for an open verb, or freeze it for later approval.
+ */
+export async function resolveEntityAction(ctx, verb, explicitRef, domains) {
+    const ref = explicitRef ?? currentTurnEntityRef(ctx);
+    if (!ref) {
+        throw new Error(`${verb}: no ticket entity for this turn — pass \`ref\` explicitly ({ platform, id }), or call this from a turn on a ticketing entity (a Linear issue or a GitHub issue/PR). ` +
+            `Chat surfaces (Slack, Discord, Teams) and Notion have no entity for this verb — not supported there.`);
+    }
+    const destinations = workDestinationPlatforms(ctx, domains);
+    if (!destinations.includes(ref.platform)) {
+        throw new Error(`${verb}: "${ref.platform}" is not one of this session's work destinations (${destinations.join(", ") || "none"}) — ` +
+            "the memory domain must hold a work credential for it (`credentials`). Talking on that platform does not grant mutating its tickets.");
+    }
+    const adapter = ENTITY_ACTION_ADAPTERS[ref.platform];
+    const fn = adapter?.[verb];
+    if (!fn) {
+        const supported = platformsSupporting(verb);
+        throw new Error(`${verb} is not supported on "${ref.platform}" — entity-gated: ` +
+            (supported.length ? `supported on ${supported.join(", ")}.` : "no surface supports it yet."));
+    }
+    await adapter.checkAccess?.(ctx, ref.id, domains);
+    // THE CREDENTIAL SELECTOR, frozen here and nowhere later. The ref's own stamp WINS: a Linear wake mutates in the workspace it came from, unchanged.
+    // The fallback is the CROSS-SURFACE case — an explicitly-named ref carries no workspace, and `checkAccess` has already refused if the grant does not admit `ref.id`, so this can only ever name a workspace the operator granted.
+    const organizationId = ref.organizationId ?? adapter.workspaceFor?.(ctx);
+    const resolved = organizationId ? { ...ref, organizationId } : ref;
+    // THE CAPABILITY SETS, resolved here for the same reason the workspace is: this is the last point
+    // that holds a ctx. A gated verb freezes them; an open verb carries them into `run`.
+    const capabilities = adapter.capabilitiesFor?.(ctx, resolved.id) ?? [];
+    return { ref: resolved, capabilities, run: (value) => fn(resolved.id, value, resolved.organizationId, capabilities) };
+}
+// Imported here rather than the other way round, so the per-surface adapter files stay free of any dependency on this registry module: each exports its adapter object, and the registry owner does the wiring.
+import { githubEntityAdapter } from "../scm/issue-actions.js";
+// linear: registered by @open-everywhere/provider-linear's registerLinearProvider() (OPE-114 stage 4).
+registerEntityActionAdapter(githubEntityAdapter);
+//# sourceMappingURL=entity-actions.js.map

package/dist/agent/channels/entity-actions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-actions.js","sourceRoot":"","sources":["../../../agent/channels/entity-actions.ts"],"names":[],"mappings":"AAAA,gfAAgf;AAChf,iiBAAiiB;AAEjiB,OAAO,EACL,QAAQ,EACR,gBAAgB,EAChB,uBAAuB,EACvB,uBAAuB,GAExB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAyD5E,iGAAiG;AACjG,iGAAiG;AACjG,MAAM,sBAAsB,GAAwC,EAAE,CAAC;AAEvE;yGACyG;AACzG,MAAM,UAAU,2BAA2B,CAAC,OAA4B;IACtE,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC,QAAQ,EAAE,uBAAuB,CAAC;QAAE,OAAO;IAClF,sBAAsB,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC;IACnD,6FAA6F;IAC7F,oFAAoF;IACpF,oBAAoB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;AAC3D,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,8BAA8B;IAC5C,OAAO,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;AAC7C,CAAC;AAED;;wFAEwF;AACxF,SAAS,mBAAmB,CAAC,IAAgB;IAC3C,OAAO,MAAM,CAAC,MAAM,CAAC,sBAAsB,CAAC;SACzC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC;SAC5C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,IAAgB;IAC/D,OAAO,sBAAsB,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAoB;IACvD,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,MAAM,cAAc,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;QACpD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC1F,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACxF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAcD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAoB,EACpB,IAAgB,EAChB,WAAkC,EAClC,OAA0B;IAE1B,MAAM,GAAG,GAAG,WAAW,IAAI,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,uKAAuK;YAC5K,sGAAsG,CACzG,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,wBAAwB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5D,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,MAAM,GAAG,CAAC,QAAQ,qDAAqD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,MAAM;YACnH,qIAAqI,CACxI,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrD,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,yBAAyB,GAAG,CAAC,QAAQ,oBAAoB;YAC9D,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAC/F,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAClD,oJAAoJ;IACpJ,kOAAkO;IAClO,MAAM,cAAc,GAAG,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAc,cAAc,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IAC9E,kGAAkG;IAClG,qFAAqF;IACrF,MAAM,YAAY,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;IACvE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,cAAc,EAAE,YAAY,CAAC,EAAE,CAAC;AAChI,CAAC;AAED,gNAAgN;AAChN,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,uGAAuG;AACvG,2BAA2B,CAAC,mBAAmB,CAAC,CAAC"}

package/dist/agent/channels/front-queue.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Short-lived seen-set so a vendor RETRY never wakes an engaged thread twice. Keyed by the envelope event id, falling back to `(channel, ts)`, and bounded in both time and size so a long-lived warm instance cannot leak memory.
+ * In-memory PER INSTANCE: a retry landing on a different instance is not caught here, but the wake is a session `send` that eve keys by continuation token, so the duplicate is squashed downstream too.
+ */
+export declare class EventDedupe {
+    private readonly ttlMs;
+    private readonly max;
+    private readonly seenAt;
+    constructor(ttlMs?: number, max?: number);
+    /** True if this key was marked within the TTL. Expired entries are pruned on read. */
+    seen(key: string, nowMs?: number): boolean;
+    /** Record a key as handled. Prunes when the map exceeds its cap. */
+    mark(key: string, nowMs?: number): void;
+    private prune;
+}
+/**
+ * Per-thread serial delivery. eve warns not to treat concurrent `send`s as an ordered queue, so a BURST in one engaged thread delivers the next item only after the previous settles. Different threads run concurrently; one thread's items run strictly in arrival order.
+ * `enqueue` returns a promise for THIS item's completion, so the route can hand it to `waitUntil()` and return 200 immediately.
+ */
+export declare class ThreadFifo {
+    private readonly onFailure?;
+    private readonly tails;
+    /**
+     * @param onFailure best-effort loud handler for a swallowed wake failure, wired by the front handler to a durable log-ship record and an audit row.
+     * It must never throw: it runs inside the swallow.
+     */
+    constructor(onFailure?: ((key: string, err: unknown) => void) | undefined);
+    enqueue(key: string, run: () => Promise<void>): Promise<void>;
+    get activeThreads(): number;
+}
+//# sourceMappingURL=front-queue.d.ts.map

package/dist/agent/channels/front-queue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"front-queue.d.ts","sourceRoot":"","sources":["../../../agent/channels/front-queue.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,qBAAa,WAAW;IAEV,OAAO,CAAC,QAAQ,CAAC,KAAK;IAAgB,OAAO,CAAC,QAAQ,CAAC,GAAG;IADtE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;IACpD,YAA6B,KAAK,SAAc,EAAmB,GAAG,SAAQ,EAAI;IAElF,sFAAsF;IACtF,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,GAAE,MAAmB,GAAG,OAAO,CAQrD;IAED,oEAAoE;IACpE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,GAAE,MAAmB,GAAG,IAAI,CAGlD;IAED,OAAO,CAAC,KAAK;CAYd;AAED;;;GAGG;AACH,qBAAa,UAAU;IAOT,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IANvC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoC;IAE1D;;;OAGG;IACH,YAA6B,SAAS,CAAC,GAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,KAAK,IAAI,aAAA,EAAI;IAEhF,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAkB5D;IAED,IAAI,aAAa,IAAI,MAAM,CAE1B;CACF"}

package/dist/agent/channels/front-queue.js

@@ -0,0 +1,86 @@
+// front-queue — provider-NEUTRAL webhook front-door plumbing: a short-lived retry de-dupe and a per-thread FIFO burst queue, for any surface whose vendor redelivers webhooks on non-200 and whose engaged threads can burst.
+/**
+ * Short-lived seen-set so a vendor RETRY never wakes an engaged thread twice. Keyed by the envelope event id, falling back to `(channel, ts)`, and bounded in both time and size so a long-lived warm instance cannot leak memory.
+ * In-memory PER INSTANCE: a retry landing on a different instance is not caught here, but the wake is a session `send` that eve keys by continuation token, so the duplicate is squashed downstream too.
+ */
+export class EventDedupe {
+    ttlMs;
+    max;
+    seenAt = new Map();
+    constructor(ttlMs = 10 * 60_000, max = 5_000) {
+        this.ttlMs = ttlMs;
+        this.max = max;
+    }
+    /** True if this key was marked within the TTL. Expired entries are pruned on read. */
+    seen(key, nowMs = Date.now()) {
+        const at = this.seenAt.get(key);
+        if (at === undefined)
+            return false;
+        if (nowMs - at > this.ttlMs) {
+            this.seenAt.delete(key);
+            return false;
+        }
+        return true;
+    }
+    /** Record a key as handled. Prunes when the map exceeds its cap. */
+    mark(key, nowMs = Date.now()) {
+        this.seenAt.set(key, nowMs);
+        if (this.seenAt.size > this.max)
+            this.prune(nowMs);
+    }
+    prune(nowMs) {
+        for (const [k, t] of this.seenAt)
+            if (nowMs - t > this.ttlMs)
+                this.seenAt.delete(k);
+        // Still over cap after TTL prune → drop oldest-inserted (Map preserves insertion order).
+        if (this.seenAt.size > this.max) {
+            const drop = this.seenAt.size - this.max;
+            let i = 0;
+            for (const k of this.seenAt.keys()) {
+                if (i++ >= drop)
+                    break;
+                this.seenAt.delete(k);
+            }
+        }
+    }
+}
+/**
+ * Per-thread serial delivery. eve warns not to treat concurrent `send`s as an ordered queue, so a BURST in one engaged thread delivers the next item only after the previous settles. Different threads run concurrently; one thread's items run strictly in arrival order.
+ * `enqueue` returns a promise for THIS item's completion, so the route can hand it to `waitUntil()` and return 200 immediately.
+ */
+export class ThreadFifo {
+    onFailure;
+    tails = new Map();
+    /**
+     * @param onFailure best-effort loud handler for a swallowed wake failure, wired by the front handler to a durable log-ship record and an audit row.
+     * It must never throw: it runs inside the swallow.
+     */
+    constructor(onFailure) {
+        this.onFailure = onFailure;
+    }
+    enqueue(key, run) {
+        const prev = this.tails.get(key) ?? Promise.resolve();
+        const next = prev
+            .then(() => run())
+            .catch((err) => {
+            console.warn(`[open-everywhere:front-queue] wake delivery failed (${key}): ${String(err)}`);
+            try {
+                this.onFailure?.(key, err);
+            }
+            catch {
+                /* the loud handler is best-effort — never let it re-throw into the swallow */
+            }
+        });
+        this.tails.set(key, next);
+        // Drop the chain once this item is the tail and has settled, so idle threads don't retain it.
+        void next.finally(() => {
+            if (this.tails.get(key) === next)
+                this.tails.delete(key);
+        });
+        return next;
+    }
+    get activeThreads() {
+        return this.tails.size;
+    }
+}
+//# sourceMappingURL=front-queue.js.map

package/dist/agent/channels/front-queue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"front-queue.js","sourceRoot":"","sources":["../../../agent/channels/front-queue.ts"],"names":[],"mappings":"AAAA,8NAA8N;AAE9N;;;GAGG;AACH,MAAM,OAAO,WAAW;IAEO,KAAK;IAAiC,GAAG;IADrD,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACpD,YAA6B,KAAK,GAAG,EAAE,GAAG,MAAM,EAAmB,GAAG,GAAG,KAAK;qBAAjD,KAAK;mBAAiC,GAAG;IAAW,CAAC;IAElF,sFAAsF;IACtF,IAAI,CAAC,GAAW,EAAE,KAAK,GAAW,IAAI,CAAC,GAAG,EAAE;QAC1C,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,EAAE,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACnC,IAAI,KAAK,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YAC5B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,oEAAoE;IACpE,IAAI,CAAC,GAAW,EAAE,KAAK,GAAW,IAAI,CAAC,GAAG,EAAE;QAC1C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC5B,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG;YAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC;IAEO,KAAK,CAAC,KAAa;QACzB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM;YAAE,IAAI,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACpF,yFAAyF;QACzF,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC;YACzC,IAAI,CAAC,GAAG,CAAC,CAAC;YACV,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;gBACnC,IAAI,CAAC,EAAE,IAAI,IAAI;oBAAE,MAAM;gBACvB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,UAAU;IAOQ,SAAS;IANrB,KAAK,GAAG,IAAI,GAAG,EAAyB,CAAC;IAE1D;;;OAGG;IACH,YAA6B,SAA+C;yBAA/C,SAAS;IAAyC,CAAC;IAEhF,OAAO,CAAC,GAAW,EAAE,GAAwB;QAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACtD,MAAM,IAAI,GAAG,IAAI;aACd,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC;aACjB,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,OAAO,CAAC,IAAI,CAAC,uDAAuD,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5F,IAAI,CAAC;gBACH,IAAI,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACP,8EAA8E;YAChF,CAAC;QACH,CAAC,CAAC,CAAC;QACL,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC1B,8FAA8F;QAC9F,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;YACrB,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACzB,CAAC;CACF"}

package/dist/agent/channels/generation-retirement.d.ts

@@ -0,0 +1,189 @@
+import type { OperationalStore } from "../operational/store.js";
+/** The durable audit action for "Open Everywhere terminally retired a rotated generation, so eve
+ *  reaped its parked workers". One row per retirement. */
+export declare const GENERATION_RETIRED_AUDIT_ACTION = "session.generation_retired";
+/** The durable audit action for a retirement that was NOT issued, with the guard that refused it.
+ *  A skip is audited, never silent: a generation whose workers were not reaped must be visible. */
+export declare const GENERATION_RETIRE_SKIPPED_AUDIT_ACTION = "session.generation_retire_skipped";
+/** No acting human — the rotation is the actor — so a synthetic, low-cardinality service identity,
+ *  the same posture channels/runtime-rotation.ts and channels/session-park.ts take. */
+export declare const GENERATION_RETIREMENT_PRINCIPAL = "oe:rotation";
+/** The `reason` eve records on the retired session. Human prose, no ids: it is read in eve's own
+ *  logs, not joined against anything here. */
+export declare const GENERATION_RETIREMENT_REASON = "open-everywhere: the seat rotated to a fresh generation";
+/**
+ * How many outgoing generations may wait for a `receive` at once. A rotation is normally followed by
+ * its own wake within the same call stack, so the real depth is 0 or 1; the cap exists for the
+ * rotation whose wake never reaches the unified channel (a per-container grain, a wake that threw
+ * before the divert). Oldest entries are dropped first — a generation that waited longest is the one
+ * whose wake is least likely to still be coming.
+ */
+export declare const MAX_PENDING = 64;
+/** One outgoing generation waiting to be retired. The token is BARE — `from(address)` takes a
+ *  channel-local address, and eve prefixes the channel namespace itself. */
+export interface PendingGenerationRetirement {
+    readonly org: string;
+    /** The `channel_session` registry key the rotation replaced — the STILL-LIVE guard reads it. */
+    readonly registryKey: string;
+    /** The retired generation's bare continuation token. */
+    readonly token: string;
+}
+/**
+ * Record that `token`'s generation has been rotated away and its workers are owed a reap. Called at
+ * the rotation seam, which holds the outgoing token but not `from`.
+ * IGNORES a token that is not a WINDOW supervisor token: a per-container seat lives on its own
+ * provider channel, so `from(token)` on `unified` would address a session that does not exist.
+ * Idempotent per (org, token) — a rotation seam that is reached twice notes one retirement.
+ */
+export declare function noteGenerationForRetirement(input: {
+    readonly org: string;
+    readonly registryKey: string;
+    readonly token: string;
+}): void;
+/** Take every generation noted for `org` and clear them from the list. A taken entry is NEVER
+ *  re-queued, whatever the verdict: the ticket's rule is that a skipped generation is simply not
+ *  retired, and the seat's next rotation notes it again. */
+export declare function takeGenerationsForRetirement(org: string): readonly PendingGenerationRetirement[];
+/** Test seam: the current list, unfiltered. Not part of the contract. */
+export declare function __pendingGenerationRetirementsForTest(): readonly PendingGenerationRetirement[];
+/** Test seam: empty the list, so one test's rotation cannot leak into another's drain. */
+export declare function __resetGenerationRetirementsForTest(): void;
+/**
+ * How long an owed-delegation row lives. Six hours — the wake-target TTL
+ * ({@link import("./unified-window.js").WAKE_TARGET_TTL_MS}), duplicated as a literal so this module
+ * keeps the leaf import set its header promises, and pinned equal by
+ * `scripts/generation-retirement-test.ts`.
+ *
+ * 🔴 IT BOUNDS THE KEYSPACE, NOT REAPABILITY, and the difference matters. A generation's row is read
+ * ONCE — by the drain, on the wake that follows its own rotation — so an expiry hours later reaches
+ * no reader and un-blocks no retirement (see §THE OWED-DELEGATION LEDGER'S ONE COST). What the TTL
+ * really stops is a row outliving every question anyone could ask of it: past six hours the task's own
+ * `oe-task-wake:` row has expired too, so its report could no longer reach the conversation that asked
+ * for it, and the row is then pure residue.
+ */
+export declare const GENERATION_DELEGATION_TTL_MS: number;
+/** How many owed tasks one generation's row carries. A seat fans out a handful per conversation; the
+ *  cap only stops a looping seat from growing the serialized row without bound. Past it the ledger
+ *  stops recording, so the extra tasks are UNCOUNTED — the guard never starts refusing on work it
+ *  cannot account for, which is the same direction `access/pending-delegation-signal.ts` takes. */
+export declare const MAX_GENERATION_DELEGATIONS = 32;
+/** The one store surface the ledger needs. Narrowed so a unit test can drive every arm with three
+ *  functions and no database. */
+export type DelegationLedgerStore = Pick<OperationalStore, "getTaskResult" | "putTaskResult" | "deleteTaskResult">;
+/**
+ * DISPATCH EDGE — record that the generation `windowToken` names has started a background task that
+ * has not settled. Called from `hooks/spawn-taint.ts` BRANCH 1, with the same
+ * `resolveOwnWindowToken` value the wake mint takes.
+ *
+ * IGNORES a token that is not a WINDOW supervisor token, for the reason
+ * {@link noteGenerationForRetirement} does: no other seat is ever retired by this module, so a row
+ * for one would be a row nothing reads.
+ *
+ * NEVER THROWS. A hook edge may not fail because a store blipped, and an unwritten row leaves this
+ * generation exactly where it was before this ledger existed.
+ */
+export declare function noteGenerationDelegation(org: string, windowToken: string | undefined, taskId: string, store?: DelegationLedgerStore): Promise<void>;
+/**
+ * SETTLEMENT EDGE — the task has reached a terminal state, so the generation that dispatched it no
+ * longer owes it. Called from `hooks/spawn-taint.ts` {@link import("../hooks/spawn-taint.js").applyTaskSettlement}.
+ *
+ * 🔴 IT FINDS THE GENERATION THROUGH THE REVERSE POINTER, never through the settling seat's own
+ * token. A settlement can land on a turn whose seat has already rotated, and clearing the row the
+ * NEW generation names would leave the outgoing one owing a task that has finished — the exact state
+ * that blocks its reap for a full TTL.
+ *
+ * NEVER THROWS, for the same reason the writer does not.
+ */
+export declare function clearGenerationDelegation(org: string, taskId: string, store?: DelegationLedgerStore): Promise<void>;
+/**
+ * Does `token`'s generation still owe a delegation its answer? The FOURTH guard's own read, and the
+ * one reader of the ledger — exported so a test drives the real parse rather than a copy of it.
+ *
+ * `unreadable` on any store error, which the verdict turns into a refusal — the same posture
+ * {@link registryState} takes. A row this build cannot recognise reads as `none`: a resumed
+ * deployment can hand back anything a previous one wrote, and a value nobody can parse is no evidence
+ * that a worker is running. That is the one place this reader fails OPEN, and it must: the other
+ * direction would hold a generation un-reapable forever on one malformed row.
+ */
+export declare function generationOwedDelegation(org: string, token: string, store?: Pick<OperationalStore, "getTaskResult">): Promise<"owed" | "none" | "unreadable">;
+/** What a drain decided about one noted generation. Every value except `retire` is audited as a skip. */
+export type RetirementVerdict = "retire" | "skip-incoming" | "skip-still-live" | "skip-live-turn" | "skip-owed-delegation" | "skip-unreadable";
+/**
+ * THE DECISION, kept PURE so every arm is testable without a store, a channel or a live turn.
+ * The ORDER is the policy, most-certain refusal first: a token that is the wake's own target is the
+ * FRESH generation and retiring it would kill the session this wake is being delivered into; a
+ * registry row that still points at the token means the rotation did not complete; an unreadable
+ * read proves nothing, so it refuses; a live turn anchor means a reset would cancel that turn; an
+ * owed delegation means the reset would cancel a worker a human is still waiting on.
+ *
+ * 🔴 THE OWED-DELEGATION ARM IS LAST AMONG THE SKIPS, AND ONLY THE ORDER OF THE AUDIT ROWS TURNS ON
+ * IT. Every arm refuses, so a generation meeting two of them is not retired either way; what the
+ * order decides is which single reason the skip row names. A live turn is the more urgent fact — it
+ * would cost a human's turn a "Stood down" note — so it is named first.
+ */
+export declare function retirementVerdict(input: {
+    /** The noted (outgoing) bare token. */
+    readonly token: string;
+    /** The bare token THIS wake is being delivered to. */
+    readonly incomingToken: string;
+    /** Does the registry row still point at the noted token? */
+    readonly registry: "rotated" | "still-live" | "unreadable";
+    /** Does the noted token carry a live turn anchor? */
+    readonly turn: "live" | "none" | "unreadable";
+    /** Does the noted token still owe a background worker its answer (OPE-1620)? */
+    readonly delegation: "owed" | "none" | "unreadable";
+}): RetirementVerdict;
+/**
+ * The one channel operation this module needs — structurally what `from(address)` returns. Narrowed
+ * to `reset` deliberately: nothing here may send, respond or cancel.
+ * 🔴 THE RESULT IS READ, NOT DISCARDED. eve does NOT throw for an address it cannot resolve: its
+ * `dispatchWorkflowCommand` catches the not-found and expired cases and answers
+ * `{ status: "no_active_session" }`, while a real retirement answers `{ status: "reset" }`. A drain
+ * that ignored the status would write a `session.generation_retired` row for a session eve never
+ * opened, and the census both docs sell would count reaps that did not happen.
+ */
+export interface RetirementSource {
+    reset(options?: {
+        readonly reason?: string;
+    }): Promise<{
+        readonly status?: string;
+    } | undefined>;
+}
+/** eve's `ResetSessionResult` status for a retirement that really happened (`channel/types.d.ts`). */
+export declare const RESET_STATUS_RETIRED = "reset";
+/** The `from` a channel `receive` is handed, narrowed to the one call this module makes. */
+export type RetirementFrom = (address: string) => RetirementSource;
+export interface RetirementDeps {
+    readonly store?: Pick<OperationalStore, "getChannelSession" | "getTurnAnchorByWindow" | "getTaskResult">;
+    /**
+     * The audit `workspace` / `surface` labels for a window token. INJECTED rather than imported:
+     * channels/unified.ts owns that derivation and imports THIS module, so importing it back would
+     * close a cycle — and a second local copy of the derivation is exactly the drift the single seam
+     * exists to prevent.
+     */
+    readonly labelsFor: (token: string) => {
+        readonly workspace: string;
+        readonly surface: string | undefined;
+    };
+    /** Override {@link RETIREMENT_CONFIRM_TIMEOUT_MS}. Tests only — the live receive takes the default. */
+    readonly confirmTimeoutMs?: number;
+}
+/**
+ * How long the drain waits for eve to confirm one `reset`, in ms. The drain runs INSIDE a `receive`,
+ * on the path of a human's wake, so an unbounded await would let a slow dispatch to a dead address
+ * hold that wake open. The retirement is bookkeeping about a generation the registry has already
+ * replaced; the message is not. On the bound the drain stops WAITING — it does not cancel the reset,
+ * which may still land — and audits the retirement as unconfirmed rather than claiming it.
+ */
+export declare const RETIREMENT_CONFIRM_TIMEOUT_MS = 5000;
+/**
+ * Retire every generation noted for this org, from inside the `unified` channel's `receive`.
+ * NEVER THROWS and never delays a wake's meaning: a retirement is bookkeeping about a generation
+ * that is already gone from the registry, and a failed one must not cost the message that triggered it.
+ * Every outcome — one retirement, one skip, one failed reset — writes exactly one audit row.
+ */
+export declare function drainGenerationRetirements(from: RetirementFrom, input: {
+    readonly org: string;
+    readonly incomingToken: string;
+}, deps: RetirementDeps): Promise<void>;
+//# sourceMappingURL=generation-retirement.d.ts.map

package/dist/agent/channels/generation-retirement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generation-retirement.d.ts","sourceRoot":"","sources":["../../../agent/channels/generation-retirement.ts"],"names":[],"mappings":"AAyHA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAIhE;0DAC0D;AAC1D,eAAO,MAAM,+BAA+B,+BAA+B,CAAC;AAE5E;mGACmG;AACnG,eAAO,MAAM,sCAAsC,sCAAsC,CAAC;AAE1F;uFACuF;AACvF,eAAO,MAAM,+BAA+B,gBAAgB,CAAC;AAE7D;8CAC8C;AAC9C,eAAO,MAAM,4BAA4B,4DAA4D,CAAC;AAEtG;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,KAAK,CAAC;AAE9B;4EAC4E;AAC5E,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,gGAAgG;IAChG,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,wDAAwD;IACxD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAID;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAMvI;AAED;;4DAE4D;AAC5D,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,2BAA2B,EAAE,CAIhG;AAED,yEAAyE;AACzE,wBAAgB,qCAAqC,IAAI,SAAS,2BAA2B,EAAE,CAE9F;AAED,0FAA0F;AAC1F,wBAAgB,mCAAmC,IAAI,IAAI,CAE1D;AAcD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,4BAA4B,QAAqB,CAAC;AAE/D;;;mGAGmG;AACnG,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAgB7C;iCACiC;AACjC,MAAM,MAAM,qBAAqB,GAAG,IAAI,CAAC,gBAAgB,EAAE,eAAe,GAAG,eAAe,GAAG,kBAAkB,CAAC,CAAC;AAEnH;;;;;;;;;;;GAWG;AACH,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE,qBAAqB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAmBf;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,yBAAyB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBzH;AAED;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,KAAK,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,eAAe,CAAC,GAC9C,OAAO,CAAC,MAAM,GAAG,MAAM,GAAG,YAAY,CAAC,CAQzC;AAED,yGAAyG;AACzG,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,eAAe,GAAG,iBAAiB,GAAG,gBAAgB,GAAG,sBAAsB,GAAG,iBAAiB,CAAC;AAE/I;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,uCAAuC;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,sDAAsD;IACtD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,EAAE,SAAS,GAAG,YAAY,GAAG,YAAY,CAAC;IAC3D,qDAAqD;IACrD,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,YAAY,CAAC;IAC9C,gFAAgF;IAChF,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,YAAY,CAAC;CACrD,GAAG,iBAAiB,CAOpB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,CAAC;CAClG;AAED,sGAAsG;AACtG,eAAO,MAAM,oBAAoB,UAAU,CAAC;AAE5C,4FAA4F;AAC5F,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,gBAAgB,CAAC;AAEnE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,mBAAmB,GAAG,uBAAuB,GAAG,eAAe,CAAC,CAAC;IACzG;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC;IAC5G,uGAAuG;IACvG,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAgCD;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,OAAQ,CAAC;AAqCnD;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,cAAc,EACpB,KAAK,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAAE,EAC/D,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,IAAI,CAAC,CAqCf"}