@open-everywhere/core 0.1.0

package/dist/agent/channels/read-author-trust.js

@@ -0,0 +1,56 @@
+// read-author-trust — "did a chat READ pull in a non-member's message?", asked once for every chat surface, off the SAME evidence the wake leg uses: the surface's own refutation, or the operator's author-trust register on an ARMED tenant.
+// Only a POSITIVE refutation marks, never silence; the probe runs over DISTINCT authors, not messages; and the answer is the SET of refuted ids, because the turn mark asks "any?" while the author-grain withhold needs the ids. Fail-open in every direction — a throwing probe, an unreadable author id and an unarmed tenant all contribute nothing.
+import { armedAuthorTrustTenants, authorRefutedByRegister } from "../identity/author-trust.js";
+/**
+ * The DISTINCT human author ids in a read page — the exact set a surface probe runs over. It drops a MACHINE author (`bot`), an author the adapter could not attribute, and every repeat.
+ * Pure, and order is first-seen, so a probe's call order is deterministic and a test can pin it.
+ */
+export function distinctReadAuthorIds(lines) {
+    const ids = new Set();
+    for (const line of lines) {
+        if (line.bot === true)
+            continue; // machine author — not this leg's question
+        const id = line.authorId;
+        if (typeof id === "string" && id.length > 0)
+            ids.add(id);
+    }
+    return [...ids];
+}
+/**
+ * THE JOIN: WHICH of this page's authors is POSITIVELY REFUTED as a non-member — by the surface, or by the operator's register on an ARMED tenant. The answer is the SET, in first-seen order, and an EMPTY set means "no refutation", never "could not check".
+ * `tenantKey` is the register's `platform/tenant` arming key, taken from the surface's own binding and never from inspecting an author id. NEVER THROWS: a probe that explodes answers empty for the whole page, losing a mark rather than the read.
+ */
+export async function refutedReadAuthorIds(lines, tenantKey, probe = {}) {
+    try {
+        const ids = distinctReadAuthorIds(lines);
+        if (ids.length === 0)
+            return [];
+        const armed = tenantKey.length > 0 && armedAuthorTrustTenants().includes(tenantKey);
+        // THE COST GATE: neither leg can say anything here, so ask nothing and skip the whole fan-out. It is a COST decision only — the semantic authority for "an unarmed tenant contributes nothing" is the `!armed` arm inside {@link refutes}.
+        // Deleting either one alone changes no answer, which is why the test that pins the property has to break both to go red.
+        if (probe.surfaceRefuted === undefined && !armed)
+            return [];
+        const verdicts = await Promise.all(ids.map((id) => refutes(id, tenantKey, armed, probe)));
+        return ids.filter((_id, i) => verdicts[i] === true);
+    }
+    catch {
+        return []; // a broken probe must never fail the read it grades
+    }
+}
+/** One author, both legs, in the order that spends least: the surface's cached verdict, then the
+ *  register (which may need a membership lookup). */
+async function refutes(authorId, tenantKey, armed, probe) {
+    if (probe.surfaceRefuted !== undefined && (await probe.surfaceRefuted(authorId)) === true)
+        return true;
+    if (!armed)
+        return false;
+    if (probe.memberships === undefined) {
+        // No membership concept on this platform — the register matches on principal key alone.
+        return authorRefutedByRegister({ tenantKey, authorId });
+    }
+    const memberships = await probe.memberships(authorId);
+    if (memberships === undefined)
+        return false; // cannot check ⇒ SKIP, never an unverified `[]`
+    return authorRefutedByRegister({ tenantKey, authorId, memberships });
+}
+//# sourceMappingURL=read-author-trust.js.map

package/dist/agent/channels/read-author-trust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-author-trust.js","sourceRoot":"","sources":["../../../agent/channels/read-author-trust.ts"],"names":[],"mappings":"AAAA,+OAA+O;AAC/O,yVAAyV;AAEzV,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAG/F;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAA8B;IAClE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI;YAAE,SAAS,CAAC,2CAA2C;QAC5E,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QACzB,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC;AAiBD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAA8B,EAC9B,SAAiB,EACjB,KAAK,GAAoB,EAAE;IAE3B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,uBAAuB,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACpF,2OAA2O;QAC3O,yHAAyH;QACzH,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,CAAC;QAC5D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1F,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,oDAAoD;IACjE,CAAC;AACH,CAAC;AAED;qDACqD;AACrD,KAAK,UAAU,OAAO,CAAC,QAAgB,EAAE,SAAiB,EAAE,KAAc,EAAE,KAAsB;IAChG,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvG,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACpC,wFAAwF;QACxF,OAAO,uBAAuB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACtD,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,CAAC,gDAAgD;IAC7F,OAAO,uBAAuB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;AACvE,CAAC"}

package/dist/agent/channels/read-reach.d.ts

@@ -0,0 +1,156 @@
+import { type BindableContext } from "../identity/binding.js";
+import { type ConnectorRead } from "./reply-provenance.js";
+/** The reach stamp one recorded read carries — the proof, plus whichever single key that proof
+ *  names. Shaped for spreading straight into a {@link ConnectorRead}. */
+export type ReadReach = Pick<ConnectorRead, "proof" | "surfaceKey" | "wakeId">;
+/**
+ * WHICH CONVERSATION THIS READ WAS MADE FOR, recorded as the ONE thing that can prove it on THIS
+ * seat's posture (OPE-1713). The two keys are exclusive by construction, here, where the host knows
+ * the posture — so a reply can never fall back to the weaker proof for a read the stronger one was
+ * recorded for.
+ *
+ *   • PER-SURFACE SEAT — the partition's SURFACE KEY. The seat holds one conversation, so it is
+ *     exact, and such a delivery carries no wake id at all (OPE-1601).
+ *   • UNIFIED SEAT — the WAKE, and DELIBERATELY NOT the surface key. Every conversation a unified
+ *     window holds resolves the SAME partition off the coalesced delivery's auth stamps, so the
+ *     surface key would name the delivery eve happened to keep and not the conversation this read
+ *     served. THE ADDRESSED WAKE FIRST, `currentWakeId` only as the fallback — the same expression
+ *     and the same ruling OPE-601 settled at the dispatch edge: the wake a turn ADDRESSES is a
+ *     statement the turn made, where the delivery a merge kept last is an accident of queue order.
+ *     That merge is unreachable on eve 0.54.3 — only the caller-less task completion cohort folds,
+ *     and it carries no `auth` — but the preference is still LOAD-BEARING: a turn woken by an
+ *     INTERNAL wake answers a sibling conversation through the reply fence with no merge at all,
+ *     which is the measured 2026-08-15 case (OPE-2042).
+ *
+ * A read the host can place under neither key is stamped `"none"`: counted by kind on every reply,
+ * which is the fail-closed floor.
+ */
+export declare function stampReadReach(bind: BindableContext, turnId: string | undefined, surfaceKey: string | undefined): ReadReach;
+/** The record kinds the door admits. A CLOSED set: core decides what a first-party read tool may be
+ *  recorded as, and the table below is the whole of it. */
+export type AuthoredRecordKind = "notion-page" | "linear-issue";
+/** One first-party read, as the tool that made it saw it. */
+export interface AuthoredRecordRead {
+    /** Which kind of record — picks the row in {@link AUTHORED_READ_TOOLS}. */
+    readonly kind: AuthoredRecordKind;
+    /** The record id to RECORD. The canonical one the tool would show a human: a Linear identifier
+     *  (`OPE-42`) where it resolved one, a Notion page id. */
+    readonly id: string;
+    /** Every OTHER id the host's own fetch resolved for this SAME record — a Linear issue's UUID
+     *  beside its identifier, the raw id a Notion block resolved from. They widen only the MATCH
+     *  against the room's stamp, never what is stored, and each one is an id the host observed rather
+     *  than a claim the model made. */
+    readonly alsoKnownAs?: readonly (string | undefined)[];
+    /** The record's display title, from the tool's own output. Kept for THIS TURN and this process
+     *  only (`rememberRecordName`), never on the ledger and never on the durable row. */
+    readonly name?: string;
+}
+/**
+ * THE DOOR — record that a FIRST-PARTY read tool read something, for this turn's reply footer.
+ *
+ * Called from the tool's own `execute`, after the fetch returned, with the ids and the title the
+ * fetch itself produced. Writes one ledger entry through `noteConnectorRead`, exactly as the
+ * connector hook does, carrying the same reach stamp.
+ *
+ * 🔴 THE RECORD REFERENCE IS WRITTEN ONLY WHERE RULE (ii) HOLDS. When the room's own stamp does not
+ * name this record, the entry still lands — the reply says the turn read `notion` — but it carries
+ * no record at all, so no later code path can name it. That is fail-closed at the earliest point:
+ * the id of a record the room may not be told about never enters the ledger, and therefore never
+ * reaches the durable row either.
+ *
+ * Never throws, and never disturbs the read it records.
+ */
+export declare function noteAuthoredRecordRead(ctx: unknown, read: AuthoredRecordRead): void;
+/** The record kind a BORROWED read is recorded under (OPE-2018) — one grant row, one record. It sits
+ *  outside {@link AuthoredRecordKind} because its connection comes off the GRANT ROW rather than the
+ *  closed authored-tool table, and because the room's entitlement to the name is proved differently
+ *  — see {@link noteBorrowedRecordRead}. `channels/reply-provenance.ts` owns the ledger; this module
+ *  stays the only writer of a record kind. */
+export declare const BORROWED_RECORD_KIND = "credential-grant";
+/** What a borrowed read is recorded as having DONE. HOST-AUTHORED, and deliberately not the vendor
+ *  tool name: that string is model-authored at ask time, and the durable `reply.provenance` row keeps
+ *  this one. The footer never shows an op at all. */
+export declare const BORROWED_READ_OP = "credential_grant_borrow";
+/** One read a lent, credential-granted tool made, as the mount saw it. */
+export interface BorrowedRecordRead {
+    /** The connection the GRANT ROW names — `notion`. The operator's own connector id, which is what
+     *  the footer already shows for every other read on that system. */
+    readonly connection: string;
+    /** The GRANT ROW's id. An id in a ledger of ids, and the one a reader joins back to the plane's own
+     *  `grant.used` row. It never reaches the durable row, which carries no record at all. */
+    readonly grantId: string;
+    /** The grant's TARGET LABEL — the requester's own words for what the owner approved, as
+     *  `grantResourceTargetLabel` recovers it. Kept for THIS TURN and this process only
+     *  (`rememberRecordName`). Absent means the row holds no recoverable label, and the read is then
+     *  recorded with no record at all. */
+    readonly targetLabel?: string;
+}
+/**
+ * THE BORROW DOOR — record that a LENT, const-pinned tool fetched something, for this turn's reply
+ * footer (OPE-2018).
+ *
+ * Called from the mounted grant tool's own `execute`, after the broker answered `ok`. A refusal never
+ * reaches here: nothing was read, so nothing was drawn on.
+ *
+ * 🔴 IT NAMES THE GRANT'S PINNED TARGET, NEVER THE FETCHED PAGE'S OWN TITLE. The label is the one the
+ * owner approved, so no vendor byte reaches the footer through this door. That is what makes the
+ * footer a CORRECTION rather than a repetition: a reply that presents the pinned page's body as some
+ * other page is contradicted by a host-written line naming the target that was actually fetched.
+ *
+ * 🔴 RULE (ii) IS ANSWERED FROM THE GRANT ROW, AND IT IS NOT WAIVED. An authored read names its
+ * record only where the turn ARRIVED on it, because nothing weaker proves the room may be told. A
+ * borrowed read stands on the grant instead, and on two facts rather than one:
+ *
+ *   · THE LABEL IS THE REQUESTER'S OWN WORDS. They wrote it into the ask, and the owner approved that
+ *     exact wording on their card. It is not op output and no vendor byte reaches it.
+ *   · THE ROOM IS ONE THE OWNER APPROVED THE GRANT FOR. `credential-grant-scope.ts` `grantScopeAdmits`
+ *     spends a row only in the session it was minted for, or — for a `standing` row — in the domain
+ *     its owner tapped. So every room this record can reach is a room whose WORKERS may spend this
+ *     grant and post its acting-as-owner line. The WORKERS and never the seat: a lent tool mounts on
+ *     the workers spawned from the conversation it was lent to (`tools/grant_tools.ts`, OPE-2023),
+ *     and the seat reaches a lent page by delegating, exactly as it reaches the org connector.
+ *
+ * 🔴 THE GRANT-USE NOTICE IS A SECOND DISCLOSURE, NOT THE PREMISE (cold review). `credential-grant-notice.ts`
+ * posts the same label into the room the call ran in on every call, but that post is BEST-EFFORT: a
+ * surface with no mid-turn post arm, an unarmed port or a throw leaves a `grant.undisclosed` row and
+ * no line at all. So this footer can be the FIRST room-visible statement of the label, and the two
+ * facts above are what license it. Never restate the licence as "the room was already told".
+ *
+ * A row with no recoverable label, and a grant whose target is not pinned, both carry NO record —
+ * the under-reporting direction this module keeps everywhere else. `tools/grant_tools.ts` owns that
+ * gate, because the pin is a property of the grant rather than of the read.
+ *
+ * 🔴 RULE (i) IS UNCHANGED. The entry carries the same {@link stampReadReach} proof every other read
+ * carries, so a reply the host cannot place in the room this read was scoped to counts it by kind and
+ * names nothing.
+ *
+ * 🔴 THE MULTI-CONVERSATION RESIDUAL NOW CARRIES ONE RECORD, AND THE GRANT BOUNDS IT. A unified turn
+ * that coalesced two conversations can name a read into the sibling conversation — the residual
+ * `channels/reply-provenance.ts` states in full. It used to disclose a connection name alone; it can
+ * now carry this record. The bound is the second fact above: the sibling conversations of a standing
+ * grant's window are rooms of the domain its owner tapped, so the label lands only where that owner
+ * already lends the credential.
+ *
+ * 🔴 THE DELEGATED CARRIAGE IS REQUIRED, AND THE PREMISE THAT SAID OTHERWISE IS GONE (OPE-2023). This
+ * doc used to read "no delegated carriage, and none is missing", because a granted tool mounted on
+ * conversational ROOT grains alone and no worker could make this read. A lent tool now mounts on the
+ * WORKERS of the conversation it was lent to, so the worker fetches and the SEAT answers the room on
+ * the settlement turn — two sessions and two turns, which is exactly the boundary
+ * `channels/delegated-provenance.ts` exists to cross. Without the call below the seat's reply names no
+ * source at all, which is the state OPE-2018 closed: a misattribution in the prose is then contradicted
+ * by nothing a reader can see.
+ *
+ * 🔴 THE PINNED TARGET CROSSES TOO, AND ONLY THIS DOOR SENDS IT (OPE-2026). The carriage used to be
+ * ids-and-verbs for every door alike, so a delegated borrowed read footed as the connection alone
+ * while a seat-turn one footed with the target — two footers for one read, decided by which session
+ * happened to hold the lent tool. The record and its label now ride the durable delegated-read row,
+ * and the settle re-states the label under the SEAT's own session and turn. The licence is the two
+ * facts above, and neither of them is a wake stamp: the label is the requester's own approved words,
+ * and the grant is spendable only in the room its owner approved. The CONNECTOR door still carries
+ * no record, because its own licence — "the turn arrived on this record" — is read off the worker's
+ * stamps and does not cross (`channels/delegated-provenance.ts` ground 3).
+ *
+ * Never throws, and never disturbs the call it records.
+ */
+export declare function noteBorrowedRecordRead(ctx: unknown, read: BorrowedRecordRead): void;
+//# sourceMappingURL=read-reach.d.ts.map

package/dist/agent/channels/read-reach.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-reach.d.ts","sourceRoot":"","sources":["../../../agent/channels/read-reach.ts"],"names":[],"mappings":"AAyCA,OAAO,EAOL,KAAK,eAAe,EACrB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAyC,KAAK,aAAa,EAA2B,MAAM,uBAAuB,CAAC;AAG3H;yEACyE;AACzE,MAAM,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,OAAO,GAAG,YAAY,GAAG,QAAQ,CAAC,CAAC;AAE/E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAS3H;AAED;2DAC2D;AAC3D,MAAM,MAAM,kBAAkB,GAAG,aAAa,GAAG,cAAc,CAAC;AAUhE,6DAA6D;AAC7D,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC;8DAC0D;IAC1D,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB;;;uCAGmC;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC;IACvD;yFACqF;IACrF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AA4CD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAkCnF;AAED;;;;8CAI8C;AAC9C,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AAEvD;;qDAEqD;AACrD,eAAO,MAAM,gBAAgB,4BAA4B,CAAC;AAE1D,0EAA0E;AAC1E,MAAM,WAAW,kBAAkB;IACjC;wEACoE;IACpE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;8FAC0F;IAC1F,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;0CAGsC;IACtC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,GAAG,IAAI,CA8BnF"}

package/dist/agent/channels/read-reach.js

@@ -0,0 +1,293 @@
+// READ REACH (OPE-1714) — WHICH ROOM A READ MAY BE NAMED IN, and the DOOR first-party read tools
+// use to reach the reply-provenance ledger.
+//
+// Two things live here, and they live together because they are the same decision seen from two
+// ends. `stampReadReach` answers "which room can PROVE this read", and both writers into the ledger
+// use it: `hooks/connector-audit.ts` for a connector op, and `noteAuthoredRecordRead` below for an
+// authored read tool. One implementation is the point — the proof a read carries is what a reply
+// later tests, so two copies of this expression drifting apart would let a reply name a room it
+// cannot prove. `channels/reply-provenance.ts` owns the ledger itself and stays pure (it never reads
+// a context); this module is where the live context is read.
+//
+// ── THE AUTHORED-TOOL DOOR, AND WHY IT IS A DOOR RATHER THAN A WIDENING ─────────────────────────
+// `access/consequence.ts`'s `isConnectorOpTool` admits `<vendor>__<op>` and nothing else, and its
+// consumers — the approver chain, the taint column, the connection approval policy — are built on
+// that contract. Widening it so `read_notion_page` looked like a connector op would change what a
+// connector op IS for every one of them. So the authored tools get their own door instead: they call
+// `noteAuthoredRecordRead` from their own `execute`, where the host already knows what it fetched.
+//
+// 🔴 THE DOOR IS AN ALLOWLIST, NOT AN OPENING. {@link AUTHORED_READ_TOOLS} is a closed table in core:
+// it decides the connection name and the op name a caller is recorded under, so a provider cannot
+// choose its own label for the footer. Adding a row is a core change with core's review, which is
+// what keeps the footer's disclosure surface owned in one place.
+//
+// ── (ii) "THE RECORD'S ID ALREADY APPEARED IN THAT ROOM" ────────────────────────────────────────
+// This module decides that half of the record-naming rule, and it decides it from the HOST'S OWN
+// WAKE STAMPS, never from a tool argument: the record must be the one the turn ARRIVED on — the
+// Linear issue the comment sits on (`issue_id`), the Notion page the comment sits in (`page_id`).
+// A room whose own subject is that record already holds its id, so naming it discloses nothing the
+// room did not have. Every other record — a page the model went and fetched, an issue nobody in the
+// conversation named — fails here, and its read reaches the footer as the connection name alone.
+//
+// The match is deliberately ID-SHAPED and nothing more: lower-cased, and dash-blind only where the
+// id is a UUID, so a Notion page id written with dashes matches the same id written without while
+// `OPE-42` and `OPE4-2` stay two different issues (see `sameId`). A read whose ids simply do not line
+// up with the stamp (a Linear turn stamped with a UUID where the tool resolved a human identifier, a
+// Notion comment stamped with a discussion block) is NOT named. That is under-reporting, which is the
+// direction this whole feature errs in.
+//
+// FAIL-SOFT, ALWAYS. Every path here is wrapped: provenance is a courtesy to the reader, and it is
+// never worth losing a read — or a reply — over.
+import { currentSessionId, currentTurnId, currentTurnIssue, currentTurnPage, currentWakeId, isUnifiedWindowContext, } from "../identity/binding.js";
+import { addressedWakeThisTurn } from "../access/dispatch-origin-signal.js";
+import { resolvePartition } from "../memory/partition.js";
+import { noteConnectorRead, rememberRecordName } from "./reply-provenance.js";
+import { noteDelegatedRead } from "./delegated-provenance.js";
+/**
+ * WHICH CONVERSATION THIS READ WAS MADE FOR, recorded as the ONE thing that can prove it on THIS
+ * seat's posture (OPE-1713). The two keys are exclusive by construction, here, where the host knows
+ * the posture — so a reply can never fall back to the weaker proof for a read the stronger one was
+ * recorded for.
+ *
+ *   • PER-SURFACE SEAT — the partition's SURFACE KEY. The seat holds one conversation, so it is
+ *     exact, and such a delivery carries no wake id at all (OPE-1601).
+ *   • UNIFIED SEAT — the WAKE, and DELIBERATELY NOT the surface key. Every conversation a unified
+ *     window holds resolves the SAME partition off the coalesced delivery's auth stamps, so the
+ *     surface key would name the delivery eve happened to keep and not the conversation this read
+ *     served. THE ADDRESSED WAKE FIRST, `currentWakeId` only as the fallback — the same expression
+ *     and the same ruling OPE-601 settled at the dispatch edge: the wake a turn ADDRESSES is a
+ *     statement the turn made, where the delivery a merge kept last is an accident of queue order.
+ *     That merge is unreachable on eve 0.54.3 — only the caller-less task completion cohort folds,
+ *     and it carries no `auth` — but the preference is still LOAD-BEARING: a turn woken by an
+ *     INTERNAL wake answers a sibling conversation through the reply fence with no merge at all,
+ *     which is the measured 2026-08-15 case (OPE-2042).
+ *
+ * A read the host can place under neither key is stamped `"none"`: counted by kind on every reply,
+ * which is the fail-closed floor.
+ */
+export function stampReadReach(bind, turnId, surfaceKey) {
+    const unified = isUnifiedWindowContext(bind);
+    const wakeId = unified ? (addressedWakeThisTurn(turnId) ?? currentWakeId(bind)) : undefined;
+    const proof = unified ? (wakeId !== undefined ? "wake" : "none") : surfaceKey !== undefined ? "surface" : "none";
+    return {
+        proof,
+        ...(proof === "surface" && surfaceKey !== undefined ? { surfaceKey } : {}),
+        ...(proof === "wake" && wakeId !== undefined ? { wakeId } : {}),
+    };
+}
+/** What each admitted kind is recorded — and therefore FOOTED — as. The connection is the system's
+ *  own display name, which is what a reader wants ("which system was consulted"); the op is the
+ *  authored tool's own name, which the durable row keeps and the footer never shows. */
+const AUTHORED_READ_TOOLS = {
+    "notion-page": { connection: "notion", op: "read_notion_page" },
+    "linear-issue": { connection: "linear", op: "read_linear_issue" },
+};
+/** Ids compare case-insensitively, and DASHES ARE STRIPPED FOR A UUID AND NOTHING ELSE.
+ *
+ *  🔴 THE NARROWING IS THE POINT. Notion writes one page id both with and without its dashes, so a
+ *  UUID has to compare either way. A Linear identifier does not: its team key may carry digits, so
+ *  stripping every dash makes `OPE-42` and `OPE4-2` — two different issues on two different teams —
+ *  compare EQUAL, and a turn woken on one would name the other. That is exactly the record rule (ii)
+ *  refuses. So the dash-blind form applies only where the de-dashed id is UUID-shaped. Nothing else
+ *  is normalised: two ids that differ by anything but case are two records. */
+function idKey(v) {
+    const lower = v.toLowerCase();
+    const dashless = lower.replace(/-/g, "");
+    return /^[0-9a-f]{32}$/.test(dashless) ? dashless : lower;
+}
+function sameId(a, b) {
+    const key = idKey(a);
+    return key.length > 0 && key === idKey(b);
+}
+/** The id of the record THIS ROOM IS ABOUT, read off the host's own wake stamps. `undefined` on any
+ *  turn that carries no such stamp — a unified delivery that omits it, an agent-initiated session,
+ *  a turn woken somewhere else entirely — and the record is then never named. */
+function roomRecordId(kind, bind) {
+    switch (kind) {
+        case "linear-issue":
+            return currentTurnIssue(bind);
+        case "notion-page":
+            return currentTurnPage(bind);
+    }
+}
+/** Rule (ii): did the record's id ALREADY appear in the room this read was scoped to? True only when
+ *  the host's own stamp for that room names this same record. */
+function roomHoldsRecordId(read, bind) {
+    const room = roomRecordId(read.kind, bind);
+    if (room === undefined || room.length === 0)
+        return false;
+    for (const candidate of [read.id, ...(read.alsoKnownAs ?? [])]) {
+        if (typeof candidate === "string" && candidate.length > 0 && sameId(candidate, room))
+            return true;
+    }
+    return false;
+}
+/**
+ * THE DOOR — record that a FIRST-PARTY read tool read something, for this turn's reply footer.
+ *
+ * Called from the tool's own `execute`, after the fetch returned, with the ids and the title the
+ * fetch itself produced. Writes one ledger entry through `noteConnectorRead`, exactly as the
+ * connector hook does, carrying the same reach stamp.
+ *
+ * 🔴 THE RECORD REFERENCE IS WRITTEN ONLY WHERE RULE (ii) HOLDS. When the room's own stamp does not
+ * name this record, the entry still lands — the reply says the turn read `notion` — but it carries
+ * no record at all, so no later code path can name it. That is fail-closed at the earliest point:
+ * the id of a record the room may not be told about never enters the ledger, and therefore never
+ * reaches the durable row either.
+ *
+ * Never throws, and never disturbs the read it records.
+ */
+export function noteAuthoredRecordRead(ctx, read) {
+    try {
+        const spec = AUTHORED_READ_TOOLS[read.kind];
+        if (spec === undefined || typeof read.id !== "string" || read.id.length === 0)
+            return;
+        const bind = ctx;
+        const turnId = currentTurnId(bind);
+        if (turnId === undefined || turnId.length === 0)
+            return;
+        let surfaceKey;
+        try {
+            surfaceKey = resolvePartition(bind).surfaceKey;
+        }
+        catch {
+            surfaceKey = undefined;
+        }
+        const named = roomHoldsRecordId(read, bind);
+        noteConnectorRead(turnId, {
+            ...stampReadReach(bind, turnId, surfaceKey),
+            connection: spec.connection,
+            op: spec.op,
+            ...(named ? { record: { kind: read.kind, id: read.id } } : {}),
+        });
+        // OPE-1849 — AND FOR THE DELEGATING SEAT, when this door was used inside a WORKER's turn. The same
+        // call `hooks/connector-audit.ts` makes beside its own ledger write, so a delegated read reaches the
+        // seat through EITHER door. The RECORD is deliberately not carried, and OPE-2026 did not change it:
+        // rule (ii) is decided against this worker's own wake stamps, which describe no room the seat
+        // replies into. The BORROW door below carries one because its licence is the grant row instead.
+        noteDelegatedRead(bind, spec.connection, spec.op);
+        // The SESSION id rides with the turn id: the name map is process-global and eve's turn ids repeat
+        // across sessions (`turn_0` for every session's first turn), so the pair is what identifies one
+        // turn. A session the host cannot name stores no display name and the footer says the connection
+        // alone — see `rememberRecordName`.
+        if (named)
+            rememberRecordName(currentSessionId(bind), turnId, read.kind, read.id, read.name);
+    }
+    catch {
+        /* fail-soft: a read that cannot be recorded is still a read that happened */
+    }
+}
+/** The record kind a BORROWED read is recorded under (OPE-2018) — one grant row, one record. It sits
+ *  outside {@link AuthoredRecordKind} because its connection comes off the GRANT ROW rather than the
+ *  closed authored-tool table, and because the room's entitlement to the name is proved differently
+ *  — see {@link noteBorrowedRecordRead}. `channels/reply-provenance.ts` owns the ledger; this module
+ *  stays the only writer of a record kind. */
+export const BORROWED_RECORD_KIND = "credential-grant";
+/** What a borrowed read is recorded as having DONE. HOST-AUTHORED, and deliberately not the vendor
+ *  tool name: that string is model-authored at ask time, and the durable `reply.provenance` row keeps
+ *  this one. The footer never shows an op at all. */
+export const BORROWED_READ_OP = "credential_grant_borrow";
+/**
+ * THE BORROW DOOR — record that a LENT, const-pinned tool fetched something, for this turn's reply
+ * footer (OPE-2018).
+ *
+ * Called from the mounted grant tool's own `execute`, after the broker answered `ok`. A refusal never
+ * reaches here: nothing was read, so nothing was drawn on.
+ *
+ * 🔴 IT NAMES THE GRANT'S PINNED TARGET, NEVER THE FETCHED PAGE'S OWN TITLE. The label is the one the
+ * owner approved, so no vendor byte reaches the footer through this door. That is what makes the
+ * footer a CORRECTION rather than a repetition: a reply that presents the pinned page's body as some
+ * other page is contradicted by a host-written line naming the target that was actually fetched.
+ *
+ * 🔴 RULE (ii) IS ANSWERED FROM THE GRANT ROW, AND IT IS NOT WAIVED. An authored read names its
+ * record only where the turn ARRIVED on it, because nothing weaker proves the room may be told. A
+ * borrowed read stands on the grant instead, and on two facts rather than one:
+ *
+ *   · THE LABEL IS THE REQUESTER'S OWN WORDS. They wrote it into the ask, and the owner approved that
+ *     exact wording on their card. It is not op output and no vendor byte reaches it.
+ *   · THE ROOM IS ONE THE OWNER APPROVED THE GRANT FOR. `credential-grant-scope.ts` `grantScopeAdmits`
+ *     spends a row only in the session it was minted for, or — for a `standing` row — in the domain
+ *     its owner tapped. So every room this record can reach is a room whose WORKERS may spend this
+ *     grant and post its acting-as-owner line. The WORKERS and never the seat: a lent tool mounts on
+ *     the workers spawned from the conversation it was lent to (`tools/grant_tools.ts`, OPE-2023),
+ *     and the seat reaches a lent page by delegating, exactly as it reaches the org connector.
+ *
+ * 🔴 THE GRANT-USE NOTICE IS A SECOND DISCLOSURE, NOT THE PREMISE (cold review). `credential-grant-notice.ts`
+ * posts the same label into the room the call ran in on every call, but that post is BEST-EFFORT: a
+ * surface with no mid-turn post arm, an unarmed port or a throw leaves a `grant.undisclosed` row and
+ * no line at all. So this footer can be the FIRST room-visible statement of the label, and the two
+ * facts above are what license it. Never restate the licence as "the room was already told".
+ *
+ * A row with no recoverable label, and a grant whose target is not pinned, both carry NO record —
+ * the under-reporting direction this module keeps everywhere else. `tools/grant_tools.ts` owns that
+ * gate, because the pin is a property of the grant rather than of the read.
+ *
+ * 🔴 RULE (i) IS UNCHANGED. The entry carries the same {@link stampReadReach} proof every other read
+ * carries, so a reply the host cannot place in the room this read was scoped to counts it by kind and
+ * names nothing.
+ *
+ * 🔴 THE MULTI-CONVERSATION RESIDUAL NOW CARRIES ONE RECORD, AND THE GRANT BOUNDS IT. A unified turn
+ * that coalesced two conversations can name a read into the sibling conversation — the residual
+ * `channels/reply-provenance.ts` states in full. It used to disclose a connection name alone; it can
+ * now carry this record. The bound is the second fact above: the sibling conversations of a standing
+ * grant's window are rooms of the domain its owner tapped, so the label lands only where that owner
+ * already lends the credential.
+ *
+ * 🔴 THE DELEGATED CARRIAGE IS REQUIRED, AND THE PREMISE THAT SAID OTHERWISE IS GONE (OPE-2023). This
+ * doc used to read "no delegated carriage, and none is missing", because a granted tool mounted on
+ * conversational ROOT grains alone and no worker could make this read. A lent tool now mounts on the
+ * WORKERS of the conversation it was lent to, so the worker fetches and the SEAT answers the room on
+ * the settlement turn — two sessions and two turns, which is exactly the boundary
+ * `channels/delegated-provenance.ts` exists to cross. Without the call below the seat's reply names no
+ * source at all, which is the state OPE-2018 closed: a misattribution in the prose is then contradicted
+ * by nothing a reader can see.
+ *
+ * 🔴 THE PINNED TARGET CROSSES TOO, AND ONLY THIS DOOR SENDS IT (OPE-2026). The carriage used to be
+ * ids-and-verbs for every door alike, so a delegated borrowed read footed as the connection alone
+ * while a seat-turn one footed with the target — two footers for one read, decided by which session
+ * happened to hold the lent tool. The record and its label now ride the durable delegated-read row,
+ * and the settle re-states the label under the SEAT's own session and turn. The licence is the two
+ * facts above, and neither of them is a wake stamp: the label is the requester's own approved words,
+ * and the grant is spendable only in the room its owner approved. The CONNECTOR door still carries
+ * no record, because its own licence — "the turn arrived on this record" — is read off the worker's
+ * stamps and does not cross (`channels/delegated-provenance.ts` ground 3).
+ *
+ * Never throws, and never disturbs the call it records.
+ */
+export function noteBorrowedRecordRead(ctx, read) {
+    try {
+        if (read.connection.length === 0 || read.grantId.length === 0)
+            return;
+        const bind = ctx;
+        const turnId = currentTurnId(bind);
+        if (turnId === undefined || turnId.length === 0)
+            return;
+        let surfaceKey;
+        try {
+            surfaceKey = resolvePartition(bind).surfaceKey;
+        }
+        catch {
+            surfaceKey = undefined;
+        }
+        const label = read.targetLabel !== undefined && read.targetLabel.length > 0 ? read.targetLabel : undefined;
+        noteConnectorRead(turnId, {
+            ...stampReadReach(bind, turnId, surfaceKey),
+            connection: read.connection,
+            op: BORROWED_READ_OP,
+            ...(label === undefined ? {} : { record: { kind: BORROWED_RECORD_KIND, id: read.grantId } }),
+        });
+        if (label !== undefined)
+            rememberRecordName(currentSessionId(bind), turnId, BORROWED_RECORD_KIND, read.grantId, label);
+        // AND FOR THE DELEGATING SEAT (OPE-1849's door, OPE-2023's need). The same call the connector door
+        // makes beside its own ledger write, so a borrowed read reaches the seat that delegated it. It
+        // no-ops outside a subagent child, so a seat-turn borrowed read still records once.
+        // 🔴 AND IT CARRIES THE RECORD (OPE-2026) — the SAME grant row and the SAME label the ledger entry
+        // above took, on the same condition, so the delegated footer and the seat-turn footer state one
+        // thing. A row with no recoverable label carries no record here either.
+        noteDelegatedRead(bind, read.connection, BORROWED_READ_OP, label === undefined ? undefined : { kind: BORROWED_RECORD_KIND, id: read.grantId, name: label });
+    }
+    catch {
+        /* fail-soft: a read that cannot be recorded is still a read that happened */
+    }
+}
+//# sourceMappingURL=read-reach.js.map

package/dist/agent/channels/read-reach.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-reach.js","sourceRoot":"","sources":["../../../agent/channels/read-reach.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,4CAA4C;AAC5C,EAAE;AACF,gGAAgG;AAChG,oGAAoG;AACpG,mGAAmG;AACnG,iGAAiG;AACjG,gGAAgG;AAChG,qGAAqG;AACrG,6DAA6D;AAC7D,EAAE;AACF,mGAAmG;AACnG,kGAAkG;AAClG,kGAAkG;AAClG,kGAAkG;AAClG,qGAAqG;AACrG,mGAAmG;AACnG,EAAE;AACF,sGAAsG;AACtG,kGAAkG;AAClG,kGAAkG;AAClG,iEAAiE;AACjE,EAAE;AACF,mGAAmG;AACnG,iGAAiG;AACjG,gGAAgG;AAChG,kGAAkG;AAClG,mGAAmG;AACnG,oGAAoG;AACpG,iGAAiG;AACjG,EAAE;AACF,mGAAmG;AACnG,kGAAkG;AAClG,sGAAsG;AACtG,qGAAqG;AACrG,sGAAsG;AACtG,wCAAwC;AACxC,EAAE;AACF,mGAAmG;AACnG,iDAAiD;AAEjD,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,sBAAsB,GAEvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAA+C,MAAM,uBAAuB,CAAC;AAC3H,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAM9D;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,cAAc,CAAC,IAAqB,EAAE,MAA0B,EAAE,UAA8B;IAC9G,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,MAAM,KAAK,GAAuB,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IACrI,OAAO;QACL,KAAK;QACL,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,KAAK,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,CAAC;AACJ,CAAC;AAMD;;wFAEwF;AACxF,MAAM,mBAAmB,GAA+F;IACtH,aAAa,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE,kBAAkB,EAAE;IAC/D,cAAc,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE,mBAAmB,EAAE;CAClE,CAAC;AAmBF;;;;;;;+EAO+E;AAC/E,SAAS,KAAK,CAAC,CAAS;IACtB,MAAM,KAAK,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACzC,OAAO,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;AAC5D,CAAC;AAED,SAAS,MAAM,CAAC,CAAS,EAAE,CAAS;IAClC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACrB,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED;;iFAEiF;AACjF,SAAS,YAAY,CAAC,IAAwB,EAAE,IAAqB;IACnE,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,cAAc;YACjB,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAChC,KAAK,aAAa;YAChB,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED;iEACiE;AACjE,SAAS,iBAAiB,CAAC,IAAwB,EAAE,IAAqB;IACxE,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1D,KAAK,MAAM,SAAS,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QAC/D,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACpG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAY,EAAE,IAAwB;IAC3E,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACtF,MAAM,IAAI,GAAG,GAAsB,CAAC;QACpC,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACxD,IAAI,UAA8B,CAAC;QACnC,IAAI,CAAC;YACH,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,GAAG,SAAS,CAAC;QACzB,CAAC;QACD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC5C,iBAAiB,CAAC,MAAM,EAAE;YACxB,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC;YAC3C,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAC,CAAC;QACH,mGAAmG;QACnG,qGAAqG;QACrG,oGAAoG;QACpG,8FAA8F;QAC9F,gGAAgG;QAChG,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAClD,kGAAkG;QAClG,gGAAgG;QAChG,iGAAiG;QACjG,oCAAoC;QACpC,IAAI,KAAK;YAAE,kBAAkB,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/F,CAAC;IAAC,MAAM,CAAC;QACP,6EAA6E;IAC/E,CAAC;AACH,CAAC;AAED;;;;8CAI8C;AAC9C,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAEvD;;qDAEqD;AACrD,MAAM,CAAC,MAAM,gBAAgB,GAAG,yBAAyB,CAAC;AAiB1D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAY,EAAE,IAAwB;IAC3E,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACtE,MAAM,IAAI,GAAG,GAAsB,CAAC;QACpC,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACxD,IAAI,UAA8B,CAAC;QACnC,IAAI,CAAC;YACH,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,GAAG,SAAS,CAAC;QACzB,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3G,iBAAiB,CAAC,MAAM,EAAE;YACxB,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC;YAC3C,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,EAAE,EAAE,gBAAgB;YACpB,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;SAC7F,CAAC,CAAC;QACH,IAAI,KAAK,KAAK,SAAS;YAAE,kBAAkB,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACvH,mGAAmG;QACnG,+FAA+F;QAC/F,oFAAoF;QACpF,mGAAmG;QACnG,gGAAgG;QAChG,wEAAwE;QACxE,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,gBAAgB,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9J,CAAC;IAAC,MAAM,CAAC;QACP,6EAA6E;IAC/E,CAAC;AACH,CAAC"}

package/dist/agent/channels/read-scope-audit.d.ts

@@ -0,0 +1,39 @@
+import { appendAudit } from "../audit/audit.js";
+import { type BindableContext } from "../identity/binding.js";
+import { type Domain } from "../memory/domain.js";
+/** Why the read was refused — the same two arms notion-scope.ts and linear-scope.ts report: a
+ *  caller in no domain has no siblings to reach, a caller in one asked outside it. */
+export type ReadScopeReason = "cross-domain" | "caller-unassigned";
+/** Test seam — the audit sink, defaulting to the real append (the notion-scope.ts shape), so the
+ *  refusal ROW is assertable without standing up an operational store. */
+export interface ReadScopeAuditDeps {
+    readonly audit?: (entry: Parameters<typeof appendAudit>[0]) => Promise<void>;
+}
+/**
+ * What the fence already worked out, handed over verbatim so this module reads no config and re-decides nothing.
+ * `callerKey` is the key the fence ACTUALLY compared against — `surfaceKey` for Slack and Discord, the channel grain for Teams — and `surfaceId` is in that fence's own comparison form.
+ */
+export interface ReadScopeRefusal {
+    readonly platform: string;
+    readonly surfaceId: string;
+    readonly callerKey: string;
+    readonly callerDomain?: string;
+    readonly domains: readonly Domain[];
+    /**
+     * OPTIONAL: which PLATFORM boundary governs this surface's reads, when the platform has more than one and the fence can tell them apart. Teams is the only such surface today, where a per-team RSC grant and a tenant-wide application permission are not equivalent; Slack and Discord pass nothing.
+     * A verdict string only — never a credential, an endpoint or message content.
+     */
+    readonly boundary?: string;
+}
+/**
+ * Append the refusal row, then let the caller throw. Never throws, and never returns a decision.
+ * `platform` is the REFUSED surface's own platform, and `workspace`/`surface` name the ROW'S SUBJECT rather than a foreign caller — see {@link stampedWorkspaceSurface}.
+ */
+export declare function auditChannelReadRefusal(ctx: BindableContext, refusal: ReadScopeRefusal, deps?: ReadScopeAuditDeps): Promise<void>;
+/** GATE 1 (TOPOLOGY) refused — the target platform is not one of this window's sources
+ *  (channels/channel-read.ts resolveReadAdapter's WindowSourcesRefusalError). */
+export declare function auditSourcesGateRefusal(ctx: BindableContext, target: string, deps?: ReadScopeAuditDeps): Promise<void>;
+/** GATE 2 (ORIGIN FENCE) refused — this turn's origin does not match the surface being read
+ *  (identity/binding.ts assertTurnSurface's TurnOriginFenceError). */
+export declare function auditOriginFenceRefusal(ctx: BindableContext, target: string, deps?: ReadScopeAuditDeps): Promise<void>;
+//# sourceMappingURL=read-scope-audit.d.ts.map

package/dist/agent/channels/read-scope-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-scope-audit.d.ts","sourceRoot":"","sources":["../../../agent/channels/read-scope-audit.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAkD,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9G,OAAO,EAAoB,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAGpE;sFACsF;AACtF,MAAM,MAAM,eAAe,GAAG,cAAc,GAAG,mBAAmB,CAAC;AAEnE;0EAC0E;AAC1E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9E;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAqBD;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,eAAe,EACpB,OAAO,EAAE,gBAAgB,EACzB,IAAI,CAAC,EAAE,kBAAkB,GACxB,OAAO,CAAC,IAAI,CAAC,CAyBf;AA6BD;iFACiF;AACjF,wBAAsB,uBAAuB,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5H;AAED;sEACsE;AACtE,wBAAsB,uBAAuB,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5H"}