@open-everywhere/core 0.1.0

package/dist/agent/control/writes.js

@@ -0,0 +1,1309 @@
+// Admin-plane WRITE tools — the mutating half of the control surface. These change
+// the running system's state (spend limits, connector revokes, routines) at runtime,
+// overlaying the config-as-code baseline. They are registered only when a server is
+// built with { includeWrites: true } — the HTTP deploy mounts that behind
+// requiredRole:"admin" (the stdio/local operator is trusted). Every mutation is
+// audited (action "admin.*") with the acting principal.
+//
+// Spend/connector writes are OVERRIDES in the operational store, not edits to the
+// budgets registry / bundles.ts — config-as-code stays the reviewed baseline; admin actions are the
+// runtime overlay the spend check (effectiveCaps) and the connector gate
+// (grantedConnectors) consult.
+//
+// WIDEN-SLOW / NARROW-FAST: connector overrides are the break-glass NARROW lane only —
+// `revoke_connector` cuts access instantly (no deploy), `clear_connector_override`
+// reverts to config. There is deliberately NO runtime *grant* tool: access widens only
+// through a reviewed PR to bundles.ts (config-as-code), and the overlay is narrow-only
+// at the point of effect (applyConnectorOverrides), so a runtime override can never
+// open access. Spend limits stay bidirectional — they are budget, not access.
+// `revoke_session_grants` (OPE-300) is the same narrow lane one layer in: it withdraws a live
+// session's "Approve for session" memos, which narrows DISCRETION (the card comes back) rather
+// than access. Its own registration comment argues why it is a separate verb from
+// `revoke_connector` rather than a side effect of it.
+//
+// memory_write_file/memory_delete_file (item 14, 2026-07-04) are a DIFFERENT shape —
+// a DIRECT edit to the memory silo itself (not an overlay row), gated on the org-wide
+// "admin" role only (v1; no domain-scoped memory writes yet). See docs/security/
+// control-plane.md "Memory-admin" for the full reasoning. (OPE-64) `memory_write_file`
+// also stamps an in-file human-edit marker (memory/provenance.ts) so the dream cycle's
+// destructive detectors don't mistake a human's direct edit for agent drift and propose
+// "correcting" it back out; `memory_delete_file` audits a FAILED delete attempt too
+// (not just a successful one), since a backend-level deletion failure is exactly the
+// kind of admin action a security review wants a row for.
+//
+// set_domain_model/clear_domain_model (F1 — model self-service) are a THIRD shape: like
+// spend/connector, they're an overlay in the operational store, not a git edit — but
+// unlike every write above, they're the runtime CHOICE layered UNDER an existing git
+// envelope (model/policy.ts) rather than a break-glass narrow or a temporary bridge. A
+// domain admin (not just org admin — the one control-plane write a domain admin gets on
+// their own scope, same `domain:<name>` role delete_skill/skills_list already honour)
+// picks a model/reasoning within whatever the org's model policy allows; the tool
+// validates the pick against the envelope at SET time (isModelUsable + the domain's
+// effective reasoningCeiling), and model/routing.ts's resolver re-clamps it at CALL time
+// as a backstop (defence in depth — see routing.ts's resolve()). It also reports at SET
+// time when the picked model carries no committed price (OPE-1157) — see the tool.
+import { z } from "zod";
+import { getOperationalStore } from "../operational/provider.js";
+import { CAP_LEVELS } from "../operational/store.js";
+import { appendAudit } from "../audit/audit.js";
+import { foreignOrgDenial, scopeDenial } from "./auth.js";
+import { deploymentOrg } from "../identity/binding.js";
+import { assertSafeRelPath } from "./views.js";
+import { getConfig } from "../access/config.js";
+import { providerById } from "../memory/provider.js";
+import { siloAccess } from "../memory/resolve.js";
+import { siloTier } from "../memory/store.js";
+import { controlPartition } from "../memory/partition.js";
+import { deleteDomainSkill } from "../skills/domain-skills.js";
+import { isModelUsable, reasoningRank } from "../model/policy.js";
+import { modelPricing } from "../spend/pricing.js";
+import { reasoningCeilingForDomain } from "../memory/domain.js";
+import { stampHumanEdit } from "../memory/provenance.js";
+import { writeMemoryTier } from "../memory/write-road.js";
+import { resolveApprovalClick, isOrgAdminOnlySpendCap } from "../approvals/flow.js";
+import { disarmApprovalJudge, rearmApprovalJudge } from "../approvals/judge-contradiction.js";
+import { orgWideWhere, whereFromScope } from "../approvals/actions.js";
+import { haltAddressFields, haltAddressFromParts } from "../access/halt.js";
+import { supervisorGrainFor } from "../channels/unified-supervisor.js";
+import { listLinkSetsWithIds, purgeLinkSetCredentials, revokeLinkSet, setLinkSetHold } from "../identity/link-store.js";
+import { directoryProvider } from "../identity/directory.js";
+import { lastDirectorySync, syncDirectoryOrg } from "../identity/directory-sync.js";
+import { directoryGroupAllowlist, groupPlanIsNoop, planDirectoryGroups, planOverlayContent, renderGroupPlan } from "../identity/group-sync.js";
+import { directoryGroupsOf } from "../identity/groups-codemod.js";
+import { deliverGroupsOverlay } from "../identity/groups-delivery.js";
+export const CONTROL_WRITE_TOOL_NAMES = [
+    "set_spend_limit",
+    "clear_spend_limit",
+    "revoke_connector",
+    "clear_connector_override",
+    "revoke_session_grants",
+    "cancel_routine",
+    "delete_skill",
+    "memory_write_file",
+    "memory_delete_file",
+    "set_domain_model",
+    "clear_domain_model",
+    "decide_pending_action",
+    "disarm_approval_judge",
+    "rearm_approval_judge",
+    "halt",
+    "resume",
+    "link_sets_list",
+    "suspend_link_set",
+    "reactivate_link_set",
+    "revoke_link_set",
+    // OPE-1194: registered below but MISSING from this list until 2026-09-09. The list is the
+    // DECLARED write roster the control tests read, and every check over it asked only "is each
+    // declared name registered?", so a registered verb absent from it was invisible to all of them.
+    // control-write-test.ts now compares the two sets BOTH WAYS, which is what keeps this honest.
+    "purge_link_set_credentials",
+    "directory_sync_now",
+    "directory_sync_status",
+    "directory_groups_plan",
+];
+/**
+ * THE ADDRESS BOTH JUDGE OPERATOR VERBS TAKE (OPE-1130) — one schema, so `disarm_approval_judge`
+ * and `rearm_approval_judge` can never drift into accepting different addresses. A one-way
+ * control would be worse than no control.
+ *
+ * 🔴 THE EXCLUSIVITY IS IN THE SCHEMA, NOT IN THE HANDLERS. A malformed call is refused before
+ * either handler runs, so neither can be reached with an ambiguous address and neither needs a
+ * hand-written guard to stay honest. This is also why there is NO SENTINEL DOMAIN NAME: a magic
+ * `domain` value like `"*"` would be one real domain name away from disarming the wrong plane,
+ * and every reader of `detail.domain` would have to learn it.
+ *
+ * This is a full ZodObject rather than the raw shape every sibling tool passes, because the
+ * constraint is ACROSS two fields and a raw shape can only constrain one field at a time. The MCP
+ * SDK accepts either (`registerTool`'s `inputSchema` takes a schema or a shape).
+ *
+ * WHAT THE WIRE CONTRACT CANNOT CARRY: `tools/list` renders this through `toJSONSchema`, which
+ * drops the refinement — a client sees both address fields as optional with no exclusivity. The
+ * REFUSAL is unaffected (the server parses against this schema, and a bad call comes back as a tool
+ * error naming the rule), but a model generating a call reads the JSON Schema, so the rule is
+ * repeated in both tool descriptions. Do not delete it from there believing the schema says it.
+ */
+const judgeOperatorScopeSchema = z
+    .object({
+    org: z.string().min(1),
+    /** One named domain — the shipped address. */
+    domain: z.string().min(1).optional(),
+    /** The DOMAIN-LESS consults, and nothing else. Never a wildcard over the domained rules. */
+    orgWide: z.literal(true).optional(),
+})
+    .refine((a) => (a.domain === undefined) !== (a.orgWide === undefined), {
+    message: 'name exactly one address: "domain" for one domain, or "orgWide": true for the domain-less consults — never both, never neither.',
+});
+/** The RBAC ask behind an address. A domain ask is covered by that `domain:<name>` role; the
+ *  org-wide ask names no scope, which `roleCoversScope` already treats as admin-only — the
+ *  fail-closed unscoped branch, not a new concept. */
+function judgeOperatorScopeRequest(a) {
+    return a.domain === undefined ? { org: a.org } : { org: a.org, domain: a.domain };
+}
+/**
+ * Refuse a judge-operator call whose `org` is not this deployment's, naming both.
+ *
+ * 🔴 THE ORG IS PART OF THE JUDGE'S DISARM ADDRESS SINCE OPE-1368, and this verb takes it from
+ * the CALLER. The reader (`access/approval-judge.ts`) pages the operator ledger scoped to the org
+ * the PROPOSE plane carries, so a row written under any other string is a row no consult will ever
+ * find. Before the org filter that mismatch was harmless — the reader was org-blind, so the disarm
+ * took effect anyway. Now it would be a SILENT PERMISSIVE FAILURE: the call answers
+ * `{ok: true, disarmed: true}`, the operator believes the judge is off during an incident, and the
+ * judge keeps lifting defer-flipped verbs card-free. A break-glass control must never fail that way,
+ * so it fails loudly instead.
+ *
+ * THE DEPLOYMENT IS SINGLE-ORG TODAY (`control/auth.ts` says the same of role scoping), so this
+ * refuses nothing a real operator sends. A deployment that grows a second org has to revisit these
+ * two verbs and the role scoping together; this refusal is what makes that a visible task rather
+ * than a quiet hole.
+ */
+function judgeOperatorOrgDenial(a) {
+    const mine = deploymentOrg();
+    if (a.org === mine)
+        return undefined;
+    return `org "${a.org}" is not this deployment's org ("${mine}"). The approval judge's disarm state is read per org, so a row written under another org would be found by no consult — the call is refused rather than silently doing nothing.`;
+}
+/** The address as the producer and the audit rows spell it — the schema above guarantees exactly
+ *  one branch is inhabited. */
+function judgeOperatorAddress(a) {
+    return a.domain === undefined ? { orgWide: true } : { domain: a.domain };
+}
+/**
+ * THE ADDRESS BOTH HALT VERBS TAKE (OPE-1602) — one schema, so `halt` and `resume` can never drift
+ * into accepting different addresses. A one-way control would be worse than no control, and here it
+ * would be an outage: an address you can halt and cannot resume is a bricked deployment.
+ *
+ * COPIED FROM {@link judgeOperatorScopeSchema} DELIBERATELY, including the `.refine` that makes
+ * "name exactly one address" a SCHEMA refusal rather than a handler guard, and including the reason
+ * there is NO SENTINEL: `orgWide` is a marker field, so a magic scope key can never be one real
+ * domain name away from halting the wrong plane. What differs is the addressed branch — a halt
+ * addresses (level, scopeKey) over the persisted `CAP_LEVELS` vocabulary, where the judge addresses
+ * one domain — so the two are separate schemas rather than one shared one.
+ *
+ * The same wire-contract caveat applies: `toJSONSchema` drops the refinement, so the rule is
+ * repeated in both tool descriptions. Do not delete it from there believing the schema says it.
+ */
+const haltOperatorScopeFields = {
+    org: z.string().min(1),
+    /** A (level, scopeKey) address. Both or neither. */
+    level: z.enum(CAP_LEVELS).optional(),
+    scopeKey: z.string().min(1).optional(),
+    /** THE WHOLE ORG. Never a wildcard over the addressed rows — it is its own row. */
+    orgWide: z.literal(true).optional(),
+};
+function refineHaltOperatorScope(schema) {
+    return schema
+        .refine((raw) => {
+        const a = raw;
+        return (a.level === undefined) === (a.scopeKey === undefined);
+    }, {
+        message: 'an addressed halt needs BOTH "level" and "scopeKey" — a level with no key addresses nothing.',
+    })
+        .refine((raw) => {
+        const a = raw;
+        return (a.level === undefined) !== (a.orgWide === undefined);
+    }, {
+        message: 'name exactly one address: a ("level", "scopeKey") pair, or "orgWide": true for the whole org — never both, never neither.',
+    });
+}
+const haltOwnershipSchema = z.object({ setAt: z.string().datetime(), setBy: z.string().min(1).optional(), setRef: z.string().min(1).optional() });
+const haltOperatorScopeSchema = refineHaltOperatorScope(z.object(haltOperatorScopeFields));
+const resumeOperatorScopeSchema = refineHaltOperatorScope(z.object({ ...haltOperatorScopeFields, expected: haltOwnershipSchema.optional() }));
+const spendOwnershipSchema = z
+    .object({
+    monthlyTokens: z.number().int().positive().optional(),
+    monthlyUsd: z.number().positive().optional(),
+    expiresAt: z.number().int(),
+    reason: z.string().min(1),
+    setBy: z.string().min(1),
+})
+    .refine((a) => a.monthlyTokens != null || a.monthlyUsd != null, {
+    message: "an owned spend row needs monthlyTokens and/or monthlyUsd",
+});
+/** The RBAC ask behind a halt address. Same shape as the judge's: an addressed DOMAIN halt is
+ *  covered by that `domain:<name>` role; every other address names no domain, which `roleCoversScope`
+ *  already treats as admin-only — the fail-closed unscoped branch, not a new concept. */
+function haltOperatorScopeRequest(a) {
+    return a.level === "domain" && a.scopeKey !== undefined ? { org: a.org, domain: a.scopeKey } : { org: a.org };
+}
+/**
+ * Refuse a halt call whose `org` is not this deployment's, naming both — the same refusal
+ * {@link judgeOperatorOrgDenial} makes, for the same reason, which that function's docblock writes
+ * out in full: the halt's rows are read PER ORG by every enforcement arrow, so a row written under
+ * another string is a row no arrow will ever find. The call would answer `{ok: true, halted: true}`
+ * while the deployment kept acting. A break-glass control must never fail that way, so it fails
+ * loudly instead.
+ */
+function haltOperatorOrgDenial(a) {
+    const mine = deploymentOrg();
+    if (a.org === mine)
+        return undefined;
+    return `org "${a.org}" is not this deployment's org ("${mine}"). Every halt arrow reads the halt rows for its own org, so a row written under another org would stop nothing — the call is refused rather than silently doing nothing.`;
+}
+/** Every ModelReasoning level, in the z.enum a set_domain_model call accepts (mirrors
+ *  model/policy.ts's REASONING_ORDER — kept as a literal MUTABLE tuple here rather than
+ *  derived, since z.enum's generic wants a `[string, ...string[]]`, not the `readonly
+ *  ModelReasoning[]` REASONING_ORDER is typed as; scripts/control-write-test.ts asserts
+ *  the two stay in sync). */
+const REASONING_LEVELS = [
+    "provider-default",
+    "none",
+    "minimal",
+    "low",
+    "medium",
+    "high",
+    "xhigh",
+];
+/** control-plane memory writes are capped at 64KB/file — small enough that an admin's
+ *  hand-edit is always a deliberate, reviewable change, not a bulk data dump. */
+export const MEMORY_WRITE_MAX_BYTES = 64 * 1024;
+/**
+ * Write-tool policy shared by memory_write_file/memory_delete_file: `.md`/`.txt` only
+ * (memory content, not arbitrary files), capped at {@link MEMORY_WRITE_MAX_BYTES}, and
+ * never a `_`-prefixed name (a host-internal operational marker — e.g. onboarding's
+ * `_onboarded` — is bookkeeping, not agent-authored memory, and was never meant to be
+ * hand-edited from here). Throws an operator-friendly message; relPath TRAVERSAL safety
+ * is a separate concern (assertSafeRelPath, control/views.ts) checked by the caller.
+ * `content` is optional — omit it for a delete, where the size cap doesn't apply.
+ */
+function assertMemoryFileWritable(relPath, content) {
+    const base = relPath.split("/").pop() ?? relPath;
+    if (base.startsWith("_")) {
+        throw new Error(`"${relPath}" looks like a host-internal operational marker (a "_"-prefixed name, e.g. "_onboarded") — refusing to touch it from the control plane.`);
+    }
+    if (!/\.(md|txt)$/i.test(relPath)) {
+        throw new Error(`"${relPath}" must be a ".md" or ".txt" file (memory content only).`);
+    }
+    if (content !== undefined && Buffer.byteLength(content, "utf-8") > MEMORY_WRITE_MAX_BYTES) {
+        throw new Error(`"${relPath}" is ${Buffer.byteLength(content, "utf-8")} bytes, over the ${MEMORY_WRITE_MAX_BYTES / 1024}KB control-plane write cap.`);
+    }
+}
+// The audit-WHERE derivation is IMPORTED (approvals/actions.ts), never re-implemented here.
+// This file used to carry a private near-copy that lacked the single-segment branch, so a
+// bare domain NAME — the scopeKey form of CapLevel "domain" — was misread as a platform and
+// stamped `{platform:"<name>", workspace:"unknown"}` into the admin.* row (OPE-240). Both
+// front doors (this MCP plane and the in-chat approval card) audit through one function so a
+// governance record cannot depend on which door the mutation came through.
+function jsonResult(data) {
+    return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
+}
+function errorResult(message) {
+    return { isError: true, content: [{ type: "text", text: message }] };
+}
+/**
+ * Register the mutating tools on `server`, auditing each as `actor`. `roles` is the
+ * calling identity's RBAC roles (control/auth.ts) — defaults to `["admin"]`, matching the
+ * stdio-local-operator-is-trusted posture (unchanged) and every pre-existing caller that
+ * doesn't pass roles. A non-"admin" identity must carry a `domain:<name>` role covering
+ * the mutation's org+scopeKey/surfaceKey (roleCoversScope) or the tool returns a denial
+ * instead of executing — no audit entry, no store write.
+ */
+export function registerControlWriteTools(server, actor, roles = ["admin"]) {
+    const store = () => getOperationalStore();
+    server.registerTool("set_spend_limit", {
+        title: "Set spend limit",
+        description: "Set a monthly budget override for a scope (overlays the config caps) — a token count (monthlyTokens) and/or a USD amount (monthlyUsd); at least one is required. level=surface uses a surfaceKey 'platform/workspace/surface'; level=workspace uses 'platform/workspace'. Takes effect immediately, no redeploy; replaces any previous override at the same scope+level. An override is a TEMPORARY BRIDGE: pass ttlSeconds so it auto-reverts to the config cap (recommended — a raised cap should land in the spend-budgets registry via PR; an un-reconciled override drifts from git). reason is surfaced in the drift view (list_overrides).",
+        inputSchema: {
+            org: z.string().min(1),
+            scopeKey: z.string().min(1),
+            level: z.enum(["surface", "workspace"]),
+            monthlyTokens: z.number().int().positive().optional(),
+            monthlyUsd: z.number().positive().optional(),
+            ttlSeconds: z.number().int().positive().optional(),
+            reason: z.string().optional(),
+            ifAbsent: z.literal(true).optional(),
+        },
+    }, async (a) => {
+        const denial = scopeDenial(roles, { org: a.org, surfaceKey: a.scopeKey });
+        if (denial)
+            return errorResult(denial);
+        // At-least-one is enforced here (not just in the store) so the caller gets a
+        // tool-shaped error message rather than a generic "failed: ..." wrapper.
+        if (a.monthlyTokens == null && a.monthlyUsd == null) {
+            return errorResult("set_spend_limit needs monthlyTokens and/or monthlyUsd — an override must set at least one cap component.");
+        }
+        try {
+            const expiresAt = a.ttlSeconds != null ? Date.now() + a.ttlSeconds * 1000 : undefined;
+            const created = await store().setSpendLimit(a.org, a.scopeKey, a.level, { monthlyTokens: a.monthlyTokens, monthlyUsd: a.monthlyUsd }, { expiresAt, reason: a.reason, setBy: actor }, ...(a.ifAbsent ? [{ ifAbsent: true }] : []));
+            const amounts = { ...(a.monthlyTokens != null ? { monthlyTokens: a.monthlyTokens } : {}), ...(a.monthlyUsd != null ? { monthlyUsd: a.monthlyUsd } : {}) };
+            if (!created)
+                return jsonResult({ ok: true, created: false, org: a.org, scopeKey: a.scopeKey, level: a.level });
+            await appendAudit({ ...whereFromScope(a.org, a.scopeKey), principalId: actor, action: "admin.spend.set_limit", detail: { scopeKey: a.scopeKey, level: a.level, ...amounts, ...(expiresAt != null ? { expiresAt } : {}), ...(a.reason ? { reason: a.reason } : {}) } });
+            return jsonResult({ ok: true, created: true, org: a.org, scopeKey: a.scopeKey, level: a.level, ...amounts, ...(expiresAt != null ? { expiresAt } : {}), ...(a.reason ? { reason: a.reason } : {}), setBy: actor });
+        }
+        catch (e) {
+            return errorResult(`set_spend_limit failed: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    });
+    server.registerTool("clear_spend_limit", {
+        title: "Clear spend limit",
+        description: "Remove a spend-limit override (reverts the scope to the config-as-code caps).",
+        inputSchema: { org: z.string().min(1), scopeKey: z.string().min(1), level: z.enum(["surface", "workspace"]), expected: spendOwnershipSchema.optional() },
+    }, async (a) => {
+        const denial = scopeDenial(roles, { org: a.org, surfaceKey: a.scopeKey });
+        if (denial)
+            return errorResult(denial);
+        try {
+            const cleared = await store().clearSpendLimit(a.org, a.scopeKey, a.level, a.expected);
+            await appendAudit({ ...whereFromScope(a.org, a.scopeKey), principalId: actor, action: "admin.spend.clear_limit", detail: { scopeKey: a.scopeKey, level: a.level, cleared } });
+            return jsonResult({ ok: true, cleared, org: a.org, scopeKey: a.scopeKey, level: a.level });
+        }
+        catch (e) {
+            return errorResult(`clear_spend_limit failed: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    });
+    server.registerTool("revoke_connector", {
+        title: "Revoke connector from a surface (break-glass)",
+        description: "Break-glass: revoke an Eve connector (by name, e.g. 'notion') from a surface at runtime — the hard gate blocks it immediately, no redeploy. Use for incidents (leaked token, abuse). A revoke is STICKY (no auto-expiry — auto-clearing would re-open access); revert deliberately with clear_connector_override (or a PR removing the grant from bundles.ts). reason is surfaced in the drift view. surfaceKey is 'platform/workspace/surface'. (There is no runtime *grant* — access widens only through a reviewed PR.)",
+        inputSchema: { org: z.string().min(1), surfaceKey: z.string().min(1), connector: z.string().min(1), reason: z.string().optional() },
+    }, async (a) => {
+        const denial = scopeDenial(roles, { org: a.org, surfaceKey: a.surfaceKey });
+        if (denial)
+            return errorResult(denial);
+        try {
+            await store().setConnectorOverride(a.org, a.surfaceKey, a.connector, false, { reason: a.reason, setBy: actor });
+            await appendAudit({ ...whereFromScope(a.org, a.surfaceKey), principalId: actor, action: "admin.connector.revoke", detail: { connector: a.connector, ...(a.reason ? { reason: a.reason } : {}) } });
+            return jsonResult({ ok: true, revoked: a.connector, org: a.org, surfaceKey: a.surfaceKey });
+        }
+        catch (e) {
+            return errorResult(`revoke_connector failed: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    });
+    server.registerTool("clear_connector_override", {
+        title: "Clear a connector override",
+        description: "Remove a connector override for a surface, reverting it to the config-as-code bundle grants — i.e. undo a break-glass revoke_connector. Returns cleared=false if there was no override. surfaceKey is 'platform/workspace/surface'.",
+        inputSchema: { org: z.string().min(1), surfaceKey: z.string().min(1), connector: z.string().min(1) },
+    }, async (a) => {
+        const denial = scopeDenial(roles, { org: a.org, surfaceKey: a.surfaceKey });
+        if (denial)
+            return errorResult(denial);
+        try {
+            const cleared = await store().clearConnectorOverride(a.org, a.surfaceKey, a.connector);
+            await appendAudit({ ...whereFromScope(a.org, a.surfaceKey), principalId: actor, action: "admin.connector.clear_override", detail: { connector: a.connector, cleared } });
+            return jsonResult({ ok: true, cleared, org: a.org, surfaceKey: a.surfaceKey, connector: a.connector });
+        }
+        catch (e) {
+            return errorResult(`clear_connector_override failed: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    });
+    // (OPE-300 G2) THE REVOCATION LEVER FOR SESSION GRANTS.
+    //
+    // "Approve for session" writes a durable memo (approvals/flow.ts → setSessionApproval) keyed by the
+    // proposing session's own token, so later proposals of the same grantable kind in that session skip
+    // the human card. Until this verb there was NO way to take one back: the memo's death mechanism is
+    // the session token's GENERATION (a rotation misses it) plus a 24h GC TTL, and the only caller of
+    // `revokeSessionApprovals` was the routine-keyed one (routines/declared-permissions.ts). So an
+    // admin who granted a
+    // session too widely, or who saw a seat behaving oddly, had nothing to pull — a live seat kept its
+    // card-skip for up to a day.
+    //
+    // WHAT THIS DOES AND DOES NOT REACH, stated because the difference is the whole risk assessment: a
+    // session grant only ever skips the human APPROVAL CARD. Every capability gate still runs — the
+    // connector credential wall (access/connector-scope.ts assertConnectorGranted, inside getToken), the
+    // window gate, the taint fences. So this is a narrowing of DISCRETION, not of access, and
+    // `revoke_connector` remains the lever that cuts the access itself.
+    //
+    // WHY IT IS NOT FOLDED INTO `revoke_connector` (considered, deliberately not done): a revoked
+    // connector already fails closed at the credential wall on the very next call, so its session memo
+    // is inert — there is no card left to skip. Killing it anyway would need a per-KIND delete on the
+    // operational-store port (`revokeSessionApprovals` is whole-key), i.e. a port widening plus both
+    // backends to destroy a row that cannot be acted on; and the blunt alternative — calling
+    // `revokeSessionApprovals` from `revoke_connector` — would ALSO destroy that window's `pr.open`
+    // grant and every OTHER connector's grant, i.e. a connector revoke silently widening into unrelated
+    // authority. An admin who wants exactly that says so, here.
+    server.registerTool("revoke_session_grants", {
+        title: "Revoke a session's standing approval grants (break-glass)",
+        description: "Break-glass: withdraw every \"Approve for session\" grant held by a surface's LIVE session, so the next PR-open in it gets a fresh approval card again. On a LIVE SESSION that is the whole effect: PR-open is the only kind an \"Approve for session\" click ever wrote, so no other verb changes. The delete is WHOLE-KEY, though — passed a ROUTINE grant key it also removes that routine's DECLARED permissions (the `connector.tool:` rows), so the routine's next unattended connector write is refused and asks again. Use when a session was granted too widely, or when a seat is behaving oddly and you want its standing discretion gone without cancelling the work. Narrowing only — it can never grant. Note what it does NOT do: a session grant only skips the human card, so this does not remove any capability; to cut ACCESS use revoke_connector. surfaceKey is 'platform/workspace/surface'; the live session is resolved from the channel-session registry (a windowed domain resolves to its window). Pass sessionId to target a session that has no registry row (a thread seat, a routine grant key) directly. reason is recorded in the audit row.",
+        inputSchema: {
+            org: z.string().min(1),
+            surfaceKey: z.string().min(1),
+            sessionId: z.string().min(1).optional(),
+            reason: z.string().optional(),
+        },
+    }, async (a) => {
+        const denial = scopeDenial(roles, { org: a.org, surfaceKey: a.surfaceKey });
+        if (denial)
+            return errorResult(denial);
+        try {
+            // Resolve the SAME way the decision-wake path does (approvals/flow.ts wakeWindowOnDecision):
+            // the grain's registryKey is the synthetic window row when the surface's domain windows, and
+            // the bare surfaceKey otherwise — one derivation, so this verb can never target a different
+            // row than the one the seat actually runs under.
+            let sessionId = a.sessionId;
+            if (!sessionId) {
+                const registryKey = supervisorGrainFor(a.surfaceKey, getConfig().loadDomains()).registryKey;
+                const row = await store().getChannelSession(a.org, registryKey);
+                if (!row) {
+                    // A refusal, not a cheerful "0 revoked": a per-thread/task/native session has no registry
+                    // row at all, and reporting zero would read as "there was nothing to revoke".
+                    return errorResult(`revoke_session_grants: no live session registered for "${a.surfaceKey}" (registry key "${registryKey}"). ` +
+                        `A per-thread, task or native session has no registry row — pass its sessionId explicitly.`);
+                }
+                sessionId = row.token;
+            }
+            const revoked = await store().revokeSessionApprovals(a.org, sessionId);
+            await appendAudit({
+                ...whereFromScope(a.org, a.surfaceKey),
+                principalId: actor,
+                action: "admin.session_grants.revoke",
+                detail: { surfaceKey: a.surfaceKey, sessionId, revoked, ...(a.reason ? { reason: a.reason } : {}) },
+            });
+            return jsonResult({ ok: true, org: a.org, surfaceKey: a.surfaceKey, sessionId, revoked });
+        }
+        catch (e) {
+            return errorResult(`revoke_session_grants failed: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    });
+    server.registerTool("cancel_routine", {
+        title: "Cancel a routine",
+        description: "Cancel (delete) a routine by id on a given surface. Get org/surfaceKey/id from routines_list. Returns cancelled=false if no such routine.",
+        inputSchema: { org: z.string().min(1), surfaceKey: z.string().min(1), id: z.string().min(1) },
+    }, async (a) => {
+        const denial = scopeDenial(roles, { org: a.org, surfaceKey: a.surfaceKey });
+        if (denial)
+            return errorResult(denial);
+        try {
+            const cancelled = await store().removeRoutine(a.org, a.surfaceKey, a.id);
+            await appendAudit({ ...whereFromScope(a.org, a.surfaceKey), principalId: actor, action: "admin.routine.cancel", detail: { id: a.id, cancelled } });
+            return jsonResult({ ok: true, cancelled, org: a.org, surfaceKey: a.surfaceKey, id: a.id });
+        }
+        catch (e) {
+            return errorResult(`cancel_routine failed: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    });
+    server.registerTool("decide_pending_action", {
+        title: "Decide a pending approval (approve / deny)",
+        description: "Out-of-band twin of the Slack/Discord approval-card click: approve or deny a pending action by id (pending_actions_list for the ids + summaries) without a chat button — for a headless consumer or an admin driving the MCP. Approve EXECUTES the frozen args; deny rejects them. Reuses the ONE cross-surface decide core (approvals/flow.ts) — same CAS-decide, so a double-decide is safe (returns outcome:\"already-decided\", not an error) and approve semantics can never drift from the click path. RBAC: a control role must cover the pending's frozen scope (org \"admin\", or a covering \"domain:<name>\"); a DOMAIN-LEVEL or PER-USER spend cap is org-admin-only (a domain admin must never raise their own budget, nor one named person's allowance). The control identity is recorded as the decider.",
+        inputSchema: { org: z.string().min(1), id: z.string().min(1), decision: z.enum(["approve", "deny"]) },
+    }, async (a) => {
+        try {
+            // 🔴 THE ORG GATE RUNS BEFORE THE ROW READ (OPE-1438). `a.org` is the partition key
+            // `getPendingAction` reads under, so a foreign org here reads another tenant's row —
+            // and the spend-cap branch below then gated on the "admin" role ALONE, with no org
+            // check, so an admin-scoped caller (an org admin, or any read-only service token,
+            // which verifyServiceToken mints with roles ["admin"]) could name another tenant's
+            // pending spend cap and have `resolveApprovalClick` EXECUTE its frozen action under
+            // `platformAdmin: () => true`. Refusing before the read closes the execute and the
+            // read together.
+            const foreign = foreignOrgDenial(a.org);
+            if (foreign)
+                return errorResult(foreign);
+            const row = await store().getPendingAction(a.org, a.id);
+            // Not-found: getPendingAction is org-scoped and the org is this deployment's, so an
+            // absent row is a stale/aged-out or never-existing id — the same "unknown" the click
+            // handler treats as a stale card.
+            if (!row) {
+                return errorResult(`decide_pending_action: no pending action "${a.id}" in org "${a.org}" (already decided and aged out, or never existed).`);
+            }
+            // RBAC — same scope model as the sibling writes (scopeDenial against the row's
+            // FROZEN scope). The domain-level and USER-level spend-cap carve-outs are
+            // org-admin-only, mirroring flow.ts's clickerMayDecide: a domain admin must never
+            // decide their own domain's budget, nor one named person's allowance (OPE-274).
+            // Checked HERE, before we assert platform-admin standing to the core. The org is
+            // already refused above, so this arm answers the ROLE question alone — the same
+            // split `scopeDenial` makes internally.
+            const denial = isOrgAdminOnlySpendCap(row)
+                ? roles.includes("admin")
+                    ? null
+                    : `forbidden: a domain-level or per-user spend cap is org-admin-only (have: ${roles.length ? roles.join(", ") : "none"}; need "admin").`
+                : scopeDenial(roles, { org: a.org, surfaceKey: row.scopeKey, domain: row.domain ?? undefined });
+            if (denial)
+                return errorResult(denial);
+            // Reuse the shared decide implementation — never a parallel decide path. We've
+            // already authorized via control-plane RBAC above, so we assert platform-native
+            // admin standing to the core (the same `platformAdmin` seam Discord uses for guild
+            // admins) rather than re-checking the config roster against a control identity that
+            // isn't in it. The core does the expiry CAS, the decide CAS, execute, and the
+            // approval.approved/rejected/failed audit (stamped with `actor`).
+            const res = await resolveApprovalClick({
+                org: a.org,
+                id: a.id,
+                decision: a.decision === "approve" ? "approve" : "reject",
+                clickerId: actor,
+                platformAdmin: () => true,
+            });
+            switch (res.outcome) {
+                case "unknown":
+                    return errorResult(`decide_pending_action: pending action "${a.id}" is no longer known (decided and aged out between read and decide).`);
+                case "unregistered-kind":
+                    return errorResult(`decide_pending_action: pending action "${a.id}" has no registered ActionKind ("${row.kind}") — cannot decide.`);
+                case "denied":
+                    // Unreachable given platformAdmin:()=>true above — belt-and-braces, never execute.
+                    return errorResult(`decide_pending_action: not authorized to decide "${a.id}".`);
+                case "clicker-denied":
+                    // Unreachable BY CONSTRUCTION: the clicker gate (OPE-185, approvals/clicker-floor.ts)
+                    // runs only when the caller supplies a `clickContext`, and this plane deliberately
+                    // supplies none — it is headless, has no room, and is already authorized by the
+                    // control-plane RBAC above. Present so the switch stays exhaustive over the shared
+                    // resolution union and never silently falls through to the "unexpected" line below.
+                    return errorResult(`decide_pending_action: the click for "${a.id}" was refused (${res.reason}).`);
+                case "halted":
+                    // THE BREAK-GLASS HALT ARROW at the shared decide core (OPE-1604). REACHABLE HERE,
+                    // unlike the two branches above: the arrow needs no `clickContext` and runs for every
+                    // click path, so a headless operator decide during a halt lands on it. Refusing is the
+                    // right answer — this door decides a card whose execute is a consequential act, and
+                    // `resume` is a SEPARATE control-MCP verb that never consults the halt reader, so the
+                    // operator can still lift the stop and come back. `res.notice` is core's ONE halt
+                    // sentence, relayed rather than re-worded, so this door says exactly what the chat
+                    // doors say and names the fail-closed case when the state could not be read.
+                    return errorResult(`decide_pending_action: ${res.notice}`);
+                case "contradicted":
+                    // Unreachable BY CONSTRUCTION: this tool's schema accepts only approve/deny and maps
+                    // both to a decide verb, so the shared core can never take its contradict branch here.
+                    // Present so the switch stays exhaustive over the shared resolution union. The
+                    // operator's own contradiction door is `disarm_approval_judge` below.
+                    return errorResult(`decide_pending_action: "${a.id}" resolved as a judge contradiction, which this tool never requests.`);
+                case "not-pending":
+                case "lost-race":
+                    // CAS-safe: already decided (a double-decide, or a concurrent decide won). Idempotent, not an error.
+                    return jsonResult({ ok: true, outcome: "already-decided", org: a.org, id: a.id });
+                case "expired":
+                case "expired-race":
+                    return jsonResult({ ok: true, outcome: "expired", org: a.org, id: a.id });
+                case "decided": {
+                    // TODO(#105 follow-up): an out-of-band decide posts NO decision feedback — the chat
+                    // card stays visibly pending and the proposing session never hears the outcome.
+                    // The pieces now exist (row.postedTo + flow.ts deliverDecisionFeedback, the same
+                    // sequence the sweep uses); wiring them here needs the decided-card re-render per
+                    // platform from a headless process, which warrants its own pass.
+                    // The state transition + execution are ALREADY audited by the core
+                    // (approval.approved/rejected/failed, stamped with `actor`). Emit ONE control-plane
+                    // provenance row (which front door decided it) — same posture as every sibling
+                    // write auditing its admin.* action and the read route's control.service_call.
+                    await appendAudit({
+                        ...whereFromScope(a.org, row.scopeKey),
+                        principalId: actor,
+                        action: "admin.approval.decide",
+                        detail: { id: a.id, kind: row.kind, decision: res.row.status, outcome: res.outcomeLine },
+                    });
+                    return jsonResult({ ok: true, outcome: "decided", org: a.org, id: a.id, kind: row.kind, decision: res.row.status, decidedBy: res.row.decidedBy, result: res.outcomeLine });
+                }
+            }
+            // The safety net for a resolution added to the shared union WITHOUT an arm above. Nothing
+            // makes the switch exhaustive at compile time — there is no `never` assertion — so a new
+            // outcome typechecks and lands here instead. This line is what keeps that a refusal rather
+            // than a silent fall-through: the door executes nothing and edits no row when it does not
+            // understand the answer. It is not dead code, and an earlier comment claiming it was
+            // unreachable outlived the union by exactly one outcome (`halted`, OPE-1604).
+            return errorResult(`decide_pending_action: unexpected resolution for "${a.id}".`);
+        }
+        catch (e) {
+            return errorResult(`decide_pending_action failed: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    });
+    server.registerTool("disarm_approval_judge", {
+        title: "Disarm the approval judge for a domain or org-wide (break-glass)",
+        description: "Turn the LLM approval judge OFF for one address, now. The judge lifts explicitly defer-flipped gated verbs without a card (agent/access/approval-judge.ts), and an operator is the only thing that disarms it — no volume of human overrules does. Name EXACTLY ONE address: `domain` for one domain, or `orgWide: true` for the DOMAIN-LESS consults. 🔴 KNOW THE BLAST RADIUS OF `orgWide`: it covers every defer-flipped propose that carries no domain, which today means `pr.open` and `routine.create` always, `spend.set` on every user-level cap and on any scope no domain claims, and `memory.purge` / `access.request` from any surface with no domain (a DM, for one). It is NOT a wildcard: it reaches no domained consult, and there is deliberately no \"disarm everywhere at once\" switch. Effect: every defer-flipped verb at that address falls back to its last-resort approval card, which is the pre-judge behaviour — the degrade never widens access. Recorded as one `approval.judge.contradicted` audit row (humanAction \"admin-disarm\"). It LASTS UNTIL AN OPERATOR RE-ARMS with `rearm_approval_judge`; no clock lifts it. `domain` requires a role covering the domain (a domain:<name> role, or org-wide \"admin\"); `orgWide` is an unscoped ask and requires \"admin\". \ud83d\udd34 `org` MUST be this deployment's own org: the judge's disarm state is read per org (OPE-1368), so a row written under any other string would be found by no consult \u2014 the call is refused by name rather than reporting success for a no-op.",
+        inputSchema: judgeOperatorScopeSchema,
+    }, async (a) => {
+        // The SPECIFIC refusal first: scopeDenial now refuses a foreign org too (OPE-1438), and this
+        // verb has a sharper thing to say about one — the disarm state is read per org, so a row under
+        // another string is a row no consult finds. Both orders refuse; this one keeps the better message.
+        const denial = judgeOperatorOrgDenial(a) ?? scopeDenial(roles, judgeOperatorScopeRequest(a));
+        if (denial)
+            return errorResult(denial);
+        const address = judgeOperatorAddress(a);
+        try {
+            await disarmApprovalJudge({ org: a.org, principalId: actor, ...address });
+            // The provenance row — which front door disarmed it — beside the ledger row the judge
+            // itself reads. Same two-row posture as decide_pending_action above: the mechanism's own
+            // record is written by the mechanism, this names the door.
+            await appendAudit({ org: a.org, platform: "control", workspace: "control", principalId: actor, action: "admin.approval.judge_disarm", detail: { ...address } });
+            return jsonResult({ ok: true, org: a.org, ...address, disarmed: true });
+        }
+        catch (e) {
+            return errorResult(`disarm_approval_judge failed: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    });
+    server.registerTool("rearm_approval_judge", {
+        title: "Re-arm the approval judge for a domain or org-wide",
+        description: "Turn the LLM approval judge back ON for one address, now — the symmetric partner of `disarm_approval_judge` and the only thing that cancels a disarm. Name EXACTLY ONE address, the same two the disarm takes: `domain`, or `orgWide: true` for the DOMAIN-LESS consults. Effect: defer-flipped verbs at that address are judged again, exactly as before the disarm; an address that was never disarmed is already armed and this call changes nothing. 🔴 THIS DIRECTION IS PERMISSIVE, so know the blast radius of `orgWide` before using it: it restores card-free auto-approval on every defer-flipped propose that carries no domain — `pr.open` and `routine.create` always, `spend.set` on every user-level cap and on any scope no domain claims, and `memory.purge` / `access.request` from any surface with no domain. 🔴 The two addresses are a strict partition: an org-wide re-arm restores the domain-less consults ONLY, and never a domain another operator disarmed. Recorded as one `approval.judge.contradicted` audit row (humanAction \"admin-rearm\"). The ledger is APPEND-ONLY: this cancels the operator's disarm and erases nothing — every human overrule stays in the trail, and overrules drive no automatic behaviour to suppress. `domain` requires a role covering the domain (a domain:<name> role, or org-wide \"admin\"); `orgWide` is an unscoped ask and requires \"admin\". \ud83d\udd34 `org` MUST be this deployment's own org: the judge's disarm state is read per org (OPE-1368), so a row written under any other string would be found by no consult \u2014 the call is refused by name rather than reporting success for a no-op.",
+        inputSchema: judgeOperatorScopeSchema,
+    }, async (a) => {
+        // The SPECIFIC refusal first: scopeDenial now refuses a foreign org too (OPE-1438), and this
+        // verb has a sharper thing to say about one — the disarm state is read per org, so a row under
+        // another string is a row no consult finds. Both orders refuse; this one keeps the better message.
+        const denial = judgeOperatorOrgDenial(a) ?? scopeDenial(roles, judgeOperatorScopeRequest(a));
+        if (denial)
+            return errorResult(denial);
+        const address = judgeOperatorAddress(a);
+        try {
+            await rearmApprovalJudge({ org: a.org, principalId: actor, ...address });
+            // The provenance row — which front door re-armed it — beside the ledger row itself.
+            await appendAudit({ org: a.org, platform: "control", workspace: "control", principalId: actor, action: "admin.approval.judge_rearm", detail: { ...address } });
+            return jsonResult({ ok: true, org: a.org, ...address, rearmed: true });
+        }
+        catch (e) {
+            return errorResult(`rearm_approval_judge failed: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    });
+    // --- the break-glass halt (OPE-1602) — THE SECOND DOOR ---------------------------------------
+    //
+    // 🔴 THIS DOOR IS THE ONE THAT WORKS WHEN THE CHAT DOOR DOES NOT. The chat `resume` is
+    // `gate:admin`, so it needs an admin in the room and a venue that can host a card — neither is
+    // guaranteed during an incident, and the chat platform may itself BE the incident. These two verbs
+    // touch neither the approver chain nor the halt reader: they write the row and read the store
+    // directly. That is the FAIL-OPEN half of this plane's deliberate asymmetry (the arrows fail
+    // closed; the lift does not), and it is why a fail-closed reader cannot brick the deployment.
+    //
+    // Both verbs take the SAME address schema, so nothing can be halted at an address that cannot be
+    // resumed. The org denial is the judge's, verbatim in reasoning: a row under a foreign org would
+    // stop nothing while answering ok.
+    server.registerTool("halt", {
+        title: "Halt everything consequential at one address (break-glass)",
+        description: "Stop every consequential act at one address, now. While halted: no gated verb passes the approver chain, no routine fires on either leg, no connector op through a connected integration and no borrowed credential grant is spendable, the sandbox firewall is deny-all, and `web_fetch`, `web_search` and every `assertEgressReach` fetch are refused. 🔴 A HALT PAUSES ACTS, NOT READING. A consequential act is one whose effect leaves the conversation, so the agent still reads, still replies, still delegates a read to a worker, still posts a file into the asking room and still keeps that room in memory — and it says that it is halted. Do not read this verb as an information blackout: it is not one, and telling a seat otherwise stops work nobody stopped (OPE-1758). Name EXACTLY ONE address: a (`level`, `scopeKey`) pair — level is one of surface/workspace/domain/user, scopeKey the matching scope key — or `orgWide: true` for the whole org. Halted if ANY covering row is active, so an org-wide halt covers everything regardless of the addressed rows. It LASTS UNTIL SOMEBODY RESUMES; no clock lifts it. 🔴 `org` MUST be this deployment's own org, or the call is refused by name rather than writing a row no arrow would read.",
+        inputSchema: haltOperatorScopeSchema,
+    }, async (a) => {
+        const denial = haltOperatorOrgDenial(a) ?? scopeDenial(roles, haltOperatorScopeRequest(a));
+        if (denial)
+            return errorResult(denial);
+        try {
+            const address = haltAddressFromParts(a);
+            await getOperationalStore().setHalt(a.org, address, { setBy: actor });
+            await appendAudit({
+                ...(address.orgWide ? orgWideWhere(a.org) : whereFromScope(a.org, address.scopeKey)),
+                principalId: actor,
+                action: "admin.halt.set",
+                detail: { ...haltAddressFields(address), door: "control-mcp" },
+            });
+            return jsonResult({ ok: true, org: a.org, ...haltAddressFields(address), halted: true });
+        }
+        catch (e) {
+            return errorResult(`halt failed: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    });
+    server.registerTool("resume", {
+        title: "Lift the break-glass halt at one address",
+        description: "Lift a halt at one address, now — the symmetric partner of `halt` and the door that works when the in-chat one does not (that one is carded and needs an admin present). It restores the consequential acts `halt` paused; reading and replying never stopped, so nothing about them changes here. Name EXACTLY ONE address, the same two `halt` takes: a (`level`, `scopeKey`) pair, or `orgWide: true`. 🔴 The addresses are a strict partition: lifting the org-wide halt does not lift an addressed one, and vice versa — if both cover a call, both must be resumed. `cleared: false` means nothing was halted there; that is not an error. 🔴 `org` MUST be this deployment's own org.",
+        inputSchema: resumeOperatorScopeSchema,
+    }, async (a) => {
+        const denial = haltOperatorOrgDenial(a) ?? scopeDenial(roles, haltOperatorScopeRequest(a));
+        if (denial)
+            return errorResult(denial);
+        try {
+            const address = haltAddressFromParts(a);
+            const cleared = await getOperationalStore().clearHalt(a.org, address, { clearedBy: actor }, a.expected);
+            await appendAudit({
+                ...(address.orgWide ? orgWideWhere(a.org) : whereFromScope(a.org, address.scopeKey)),
+                principalId: actor,
+                action: "admin.halt.cleared",
+                detail: { ...haltAddressFields(address), door: "control-mcp", cleared },
+            });
+            return jsonResult({ ok: true, org: a.org, ...haltAddressFields(address), cleared });
+        }
+        catch (e) {
+            return errorResult(`resume failed: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    });
+    server.registerTool("delete_skill", {
+        title: "Delete a domain skill (break-glass)",
+        description: "Break-glass removal of a runtime domain skill (agent/skills/domain-skills.ts) without needing Slack channel membership — the out-of-band twin of the in-channel delete_skill agent tool. Requires a domain:<name> role covering the domain (or org-wide \"admin\"). Returns deleted=false if no such skill existed.",
+        inputSchema: { org: z.string().min(1), domain: z.string().min(1), name: z.string().min(1) },
+    }, async (a) => {
+        const denial = scopeDenial(roles, { org: a.org, domain: a.domain });
+        if (denial)
+            return errorResult(denial);
+        try {
+            const deleted = await deleteDomainSkill(a.org, a.domain, a.name);
+            await appendAudit({ org: a.org, platform: "control", workspace: "control", principalId: actor, action: "skill.delete", detail: { domain: a.domain, name: a.name, deleted } });
+            return jsonResult({ ok: true, deleted, org: a.org, domain: a.domain, name: a.name });
+        }
+        catch (e) {
+            return errorResult(`delete_skill failed: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    });
+    // --- domain model self-serve (F1 — runtime pick within the git model-policy envelope) ---
+    // THE DESCRIPTION LENGTH HERE IS FREE (OPE-1194 — the earlier warning was wrong, and is gone).
+    //
+    // An older note said that adding ~340 characters to this description turned
+    // `tests/integration/liveness/cancel-note-prefix-stability.test.ts` red, on a 2-green/3-red/2-green
+    // bisect, with "the mechanism is unknown". There is no mechanism. A control-plane write tool is
+    // registered ONLY on the control MCP server (control/server.ts, mounted over HTTP by
+    // control/http.ts), and no agent seat mounts that server: `set_domain_model` appears in
+    // CONTROL_WRITE_TOOL_NAMES and in NO seat or worker roster, so its description reaches no turn's
+    // prompt and cannot move any prompt prefix.
+    // The red it was blamed for is MOST LIKELY the OPEN eve cancel-path race the liveness file's own
+    // header measures (OPE-1185 / OPE-1190): when eve drops a cancel, `onTurnCancelled` never runs, no
+    // reconstruction is written, and turn C carries no cancel reminder. That red lands on whichever
+    // member of the cancel family loses the race, so a 7-run bisect over it proves nothing.
+    // 🔴 THAT SUBSTITUTE CAUSE IS A HYPOTHESIS, NOT A MEASUREMENT. OPE-1194 refuted the description
+    // coupling; it did NOT reproduce the 2-green/3-red/2-green split, so the race is the leading
+    // explanation and no more. A future red in the cancel family is still owed its own bisect — do not
+    // close one on this comment.
+    // The liveness file now asserts the mechanism directly — no control-plane write verb's
+    // DESCRIPTION appears in the turn, and the tool block is byte-identical across the cancel flap.
+    // It reads the descriptions this build registers and carries a positive control proving the
+    // matcher sees one that IS present, so the absence it reports is measured, not assumed.
+    // (The verb NAMES are a false instrument: several control verbs are the out-of-band twin of an
+    // in-channel agent tool of the same name, and a seat really is offered `halt`.)
+    // This description carries the `unpriced` sentence OPE-1157 gave up for the old warning.
+    server.registerTool("set_domain_model", {
+        title: "Set a domain's model / reasoning pick",
+        description: "Runtime SELF-SERVE of a domain's model id and/or reasoning effort — the free CHOICE within the org's model-policy envelope (agent/model/policy.ts is the git-config allow-list/ceiling; this is the per-domain runtime pick layered under it, see docs/deploy/configuration-reference.md \"Model policy\"). Requires a DOMAIN ADMIN of `domain` (or org-wide admin) — the one control-plane write a domain admin, not just an org admin, may make on their own domain. modelId must be usable under the org's model policy (allow-listed and not provider-denied — any id if no policy is configured); reasoning must be at/under the domain's effective reasoning ceiling. At least one of modelId/reasoning is required. Takes effect immediately (no redeploy, no session restart needed); replaces any previous pick for the domain wholesale. clear_domain_model reverts to the git-config route. 🔴 AN UNPRICED PICK STILL LANDS, AND REPORTS ITSELF (OPE-1157): when `modelId` carries no committed price in this deployment (agent/spend/model-pricing.ts, or core's built-in table), the result adds `unpriced: true` and a warning, and the audit row carries the same flag. Calls on that model add $0 to the spend ledger, so this domain's turn spend stops counting against any USD cap over it until the rate is committed. The cap is not dead: it still sums every other priced row in its scope, and a TOKEN cap is unaffected, because tokens are counted for every call. Measure the rate with `npm run probe:models` and commit it.",
+        inputSchema: {
+            org: z.string().min(1),
+            domain: z.string().min(1),
+            modelId: z.string().min(1).optional(),
+            reasoning: z.enum(REASONING_LEVELS).optional(),
+        },
+    }, async (a) => {
+        const denial = scopeDenial(roles, { org: a.org, domain: a.domain });
+        if (denial)
+            return errorResult(denial);
+        if (a.modelId == null && a.reasoning == null) {
+            return errorResult("set_domain_model needs modelId and/or reasoning — a pick must set at least one.");
+        }
+        try {
+            const domains = getConfig().loadDomains();
+            const target = domains.find((d) => d.name === a.domain);
+            if (!target)
+                return errorResult(`set_domain_model failed: no domain named "${a.domain}" is configured.`);
+            const policy = getConfig().loadModelPolicy?.();
+            if (a.modelId !== undefined && !isModelUsable(a.modelId, policy)) {
+                return errorResult(`set_domain_model failed: model "${a.modelId}" is not usable under the org model policy (not allow-listed, or its vendor is provider-denied).`);
+            }
+            // The reasoning-ceiling check ONLY applies when a policy is configured — mirroring
+            // model/routing.ts's resolver, which computes `effectiveCeiling` only `if (policy)`
+            // (no policy → no reasoning clamp at all). Refusing a reasoning pick the resolver
+            // would then happily pass unclamped would be an inconsistency, so gate it the same way.
+            if (a.reasoning !== undefined && policy) {
+                const rolesCfg = getConfig().loadRoles?.() ?? [];
+                const ceiling = reasoningCeilingForDomain(a.domain, domains, rolesCfg, policy.reasoningCeiling ?? "medium");
+                if (reasoningRank(a.reasoning) > reasoningRank(ceiling)) {
+                    return errorResult(`set_domain_model failed: reasoning "${a.reasoning}" exceeds domain "${a.domain}"'s effective reasoning ceiling "${ceiling}".`);
+                }
+            }
+            // PRICING COVERAGE AT THE RUNTIME-PICK DOOR (OPE-1157).
+            //
+            // `lint:model-ids` RULE 4 proves every model the COMMITTED config can select carries a
+            // code rate. A runtime pick is not committed config. It is bounded by the model-policy
+            // allow-list, which that rule does enumerate — but only when a NON-EMPTY allow-list is
+            // configured, and the shipped envelope is fully permissive by default (model/policy.ts).
+            // With no policy, or with an empty `allow`, isModelUsable above passes ANY id, so no
+            // offline gate has seen this model at all.
+            //
+            // The consequence is money, not routing. An unpriced call adds $0 to the spend ledger's
+            // `usd_micros` (spend/pricing.ts's evidence rule — never a guessed rate), so this
+            // domain's turn spend stops counting against a USD cap over it while the cap reads as
+            // armed. Not "the cap is dead": spend/check.ts sums a SCOPE's rows, so every other
+            // priced row in that scope — other surfaces under a workspace cap, the out-of-band
+            // vision role, sandbox runtime, which writes its own usdMicros — still counts. A token
+            // cap is unaffected either way: tokens are counted for every call, priced or not.
+            //
+            // THE FLAG IS A REPORT ON THIS DOOR, NOT AN INVARIANT ON THE STORE. This tool is the
+            // only front door for a pick, but the eval harnesses (scripts/eval/ambient-eval.ts,
+            // scripts/eval/memory-eval.ts) call `setDomainModel` on the store directly. A row in the
+            // store carrying no flag therefore means "not set through here", never "priced".
+            //
+            // The pick still LANDS. An unpriced model is not an error here, and refusing one would
+            // turn a deployer's pricing gap into a self-serve outage. What it must not be is SILENT:
+            // the caller reads the warning and the audit row carries the flag.
+            const unpriced = a.modelId !== undefined && modelPricing(a.modelId) === undefined;
+            await store().setDomainModel(a.org, a.domain, { modelId: a.modelId, reasoning: a.reasoning }, actor);
+            const picked = { ...(a.modelId ? { modelId: a.modelId } : {}), ...(a.reasoning ? { reasoning: a.reasoning } : {}) };
+            await appendAudit({ org: a.org, platform: "control", workspace: "control", principalId: actor, action: "admin.model.set_domain", detail: { domain: a.domain, ...picked, ...(unpriced ? { unpriced: true } : {}) } });
+            return jsonResult({
+                ok: true,
+                org: a.org,
+                domain: a.domain,
+                ...picked,
+                ...(unpriced
+                    ? {
+                        unpriced: true,
+                        warning: `The pick is set, but model "${a.modelId}" has no committed price in this deployment ` +
+                            `(agent/spend/model-pricing.ts, or core's built-in table). Calls on that model add $0 to the ` +
+                            `spend ledger, so domain "${a.domain}"'s turn spend stops counting against any USD cap over it ` +
+                            `until the rate is committed. The cap still sums every other priced row in the scope. Token ` +
+                            `caps are unaffected. Measure the rate (\`npm run probe:models\`) and commit it.`,
+                    }
+                    : {}),
+            });
+        }
+        catch (e) {
+            return errorResult(`set_domain_model failed: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    });
+    server.registerTool("clear_domain_model", {
+        title: "Clear a domain's model pick",
+        description: "Remove a domain's runtime model/reasoning pick (reverts to the git-config route). Requires a domain admin of `domain` (or org-wide admin). Returns cleared=false if no pick was set.",
+        inputSchema: { org: z.string().min(1), domain: z.string().min(1) },
+    }, async (a) => {
+        const denial = scopeDenial(roles, { org: a.org, domain: a.domain });
+        if (denial)
+            return errorResult(denial);
+        try {
+            const cleared = await store().clearDomainModel(a.org, a.domain);
+            await appendAudit({ org: a.org, platform: "control", workspace: "control", principalId: actor, action: "admin.model.clear_domain", detail: { domain: a.domain, cleared } });
+            return jsonResult({ ok: true, cleared, org: a.org, domain: a.domain });
+        }
+        catch (e) {
+            return errorResult(`clear_domain_model failed: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    });
+    // --- identity link-sets (P1.4) -------------------------------------------------
+    // ORG-ADMIN ONLY, all four — including the LIST, which is a read. A link-set names a person and
+    // enumerates every account they hold across every surface, which is exactly the org-wide
+    // read-across a `domain:<name>` role is scoped to NOT have (memory_admin_list takes the same
+    // line, for the same reason: it discloses beyond the caller's own scope). scopeDenial is
+    // deliberately not used here — a link-set belongs to no surface and no domain, so there is no
+    // scope for a domain role to cover.
+    //
+    // WIDEN-SLOW / NARROW-FAST, as everywhere on this plane: suspend, revoke and
+    // purge_link_set_credentials all NARROW (a held or revoked set resolves to nothing and attribution
+    // degrades to per-surface identity — the §5 fallback; a purge destroys stored authority and grants
+    // none). Reactivate is the ONLY verb here that widens — which is why it is its own verb rather
+    // than a parameter on suspend, and why it cannot reach a revoked set.
+    // 🔴 The ORG BEFORE THE ROLE, the same order `scopeDenial` enforces (OPE-1438). Every verb behind
+    // this gate takes `org` from the caller and hands it to a store read or write, so a role-only gate
+    // let an admin-scoped caller name another tenant: `link_sets_list { org: "other-tenant" }` returns
+    // that tenant's people and every account they hold.
+    const requireOrgAdminForLinks = (verb, org) => foreignOrgDenial(org) ??
+        (roles.includes("admin") ? null : `forbidden: ${verb} requires the org-wide "admin" role — a link-set spans every surface, so no domain role covers it (have: ${roles.length ? roles.join(", ") : "none"}).`);
+    server.registerTool("link_sets_list", {
+        title: "List identity link-sets",
+        description: "Every cross-surface identity link-set in an org: the person's display handle, the set's status (active | suspended | revoked), and each linked account with its own status (suggested | confirmed | revoked) and the evidence that established it (`challenge:<id>`, `config-import`, `directory-sync:<provider>`). Org-admin only — a link-set enumerates one human's accounts across every surface. This is the offboarding worklist: find the person's set here, then revoke_link_set.",
+        inputSchema: { org: z.string().min(1) },
+    }, async (a) => {
+        const denial = requireOrgAdminForLinks("link_sets_list", a.org);
+        if (denial)
+            return errorResult(denial);
+        try {
+            const rows = await listLinkSetsWithIds(a.org);
+            return jsonResult({
+                ok: true,
+                org: a.org,
+                linkSets: rows.map(({ set, ids }) => ({
+                    id: set.id,
+                    handle: set.handle,
+                    status: set.status,
+                    createdAt: set.createdAt,
+                    updatedAt: set.updatedAt,
+                    ids: ids.map((r) => ({ platform: r.platform, nativeId: r.nativeId, status: r.status, establishedBy: r.establishedBy, updatedAt: r.updatedAt })),
+                })),
+            });
+        }
+        catch (e) {
+            return errorResult(`link_sets_list failed: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    });
+    server.registerTool("suspend_link_set", {
+        title: "Suspend an identity link-set",
+        description: "Put a person's identity link-set on HOLD: it stops resolving, so cross-surface attribution for those accounts degrades to per-surface identity until it is reactivated. Reversible (reactivate_link_set) — use this for a suspected compromise or an observed directory deprovision; use revoke_link_set for a real offboarding. Org-admin only. Get the id from link_sets_list.",
+        inputSchema: { org: z.string().min(1), linkSetId: z.string().min(1) },
+    }, async (a) => {
+        const denial = requireOrgAdminForLinks("suspend_link_set", a.org);
+        if (denial)
+            return errorResult(denial);
+        try {
+            // link-store.ts appends the identity.link.suspended audit row itself (it is the one writer
+            // over these tables, and every mutation audits there). The control-plane PROVENANCE row
+            // below is the same second row every sibling write on this plane emits — which front door
+            // the mutation came through.
+            const res = await setLinkSetHold({ org: a.org, linkSetId: a.linkSetId, hold: "suspended", actor });
+            if (!res.ok)
+                return errorResult(`suspend_link_set failed: ${res.reason}`);
+            await appendAudit({ org: a.org, platform: "control", workspace: "control", principalId: actor, action: "admin.identity.suspend_link_set", detail: { linkSetId: a.linkSetId } });
+            return jsonResult({ ok: true, org: a.org, linkSetId: a.linkSetId, status: "suspended" });
+        }
+        catch (e) {
+            return errorResult(`suspend_link_set failed: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    });
+    server.registerTool("reactivate_link_set", {
+        title: "Reactivate a suspended identity link-set",
+        description: "Lift a suspend_link_set hold — the set resolves again and cross-surface attribution resumes. Only a SUSPENDED set can be reactivated: a revoked one is terminal, and a person who needs standing back builds a fresh set through the ordinary link_identity challenge. Org-admin only.",
+        inputSchema: { org: z.string().min(1), linkSetId: z.string().min(1) },
+    }, async (a) => {
+        const denial = requireOrgAdminForLinks("reactivate_link_set", a.org);
+        if (denial)
+            return errorResult(denial);
+        try {
+            const res = await setLinkSetHold({ org: a.org, linkSetId: a.linkSetId, hold: "active", actor });
+            if (!res.ok)
+                return errorResult(`reactivate_link_set failed: ${res.reason}`);
+            await appendAudit({ org: a.org, platform: "control", workspace: "control", principalId: actor, action: "admin.identity.reactivate_link_set", detail: { linkSetId: a.linkSetId } });
+            return jsonResult({ ok: true, org: a.org, linkSetId: a.linkSetId, status: "active" });
+        }
+        catch (e) {
+            return errorResult(`reactivate_link_set failed: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    });
+    server.registerTool("revoke_link_set", {
+        title: "Revoke an identity link-set (offboarding, TERMINAL)",
+        description: "THE OFFBOARDING LEVER, and it does not come back: closes a person's link-set and tombstones every account on it, so none of those accounts can be re-linked to anyone by a later challenge. Cross-surface attribution for them stops immediately. There is deliberately no un-revoke — a mistake is repaired by running link_identity again with the accounts that should be linked, because \"this person no longer has standing\" must not be quietly reversible. Prefer suspend_link_set if you might want it back. Org-admin only.",
+        inputSchema: { org: z.string().min(1), linkSetId: z.string().min(1) },
+    }, async (a) => {
+        const denial = requireOrgAdminForLinks("revoke_link_set", a.org);
+        if (denial)
+            return errorResult(denial);
+        try {
+            const res = await revokeLinkSet({ org: a.org, linkSetId: a.linkSetId, actor });
+            if (!res.ok)
+                return errorResult(`revoke_link_set failed: ${res.reason}`);
+            await appendAudit({ org: a.org, platform: "control", workspace: "control", principalId: actor, action: "admin.identity.revoke_link_set", detail: { linkSetId: a.linkSetId, note: res.note } });
+            return jsonResult({ ok: true, org: a.org, linkSetId: a.linkSetId, status: "revoked", note: res.note });
+        }
+        catch (e) {
+            return errorResult(`revoke_link_set failed: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    });
+    server.registerTool("purge_link_set_credentials", {
+        title: "Purge a link-set's stored credentials",
+        description: "DESTROY the OAuth credentials stored against a person's link-set: revoked at the provider (RFC 7009) where the provider supports it, then deleted from the encrypted vault. revoke_link_set already does this as part of offboarding — reach for this verb for the two cases it does not cover: a set REVOKED BEFORE this existed (its tokens are unreachable but still stored), and a suspected token compromise where you want the credential dead without spending the terminal revoke. Works on a set in any status; purging only ever removes authority, never grants it. Not reversible — the person re-authorizes through the ordinary consent flow. Org-admin only. Get the id from link_sets_list.",
+        inputSchema: { org: z.string().min(1), linkSetId: z.string().min(1) },
+    }, async (a) => {
+        const denial = requireOrgAdminForLinks("purge_link_set_credentials", a.org);
+        if (denial)
+            return errorResult(denial);
+        try {
+            // link-store.ts appends the identity.link.credentials_purged row itself (one writer over
+            // these tables); the control-plane PROVENANCE row below is the second row every sibling
+            // write on this plane emits — which front door the mutation came through.
+            const res = await purgeLinkSetCredentials({ org: a.org, linkSetId: a.linkSetId, actor });
+            if (!res.ok)
+                return errorResult(`purge_link_set_credentials failed: ${res.reason}`);
+            await appendAudit({ org: a.org, platform: "control", workspace: "control", principalId: actor, action: "admin.identity.purge_link_set_credentials", detail: { linkSetId: a.linkSetId, credentialsPurged: res.purged ?? 0 } });
+            return jsonResult({ ok: true, org: a.org, linkSetId: a.linkSetId, purged: res.purged ?? 0, note: res.note });
+        }
+        catch (e) {
+            return errorResult(`purge_link_set_credentials failed: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    });
+    // --- identity-directory sync (P2.4) --------------------------------------------
+    // ORG-ADMIN ONLY, both — including the STATUS read, on exactly the link-set verbs' reasoning: a
+    // sync summary is a statement about the whole org's people plane, which is the read-across a
+    // `domain:<name>` role is scoped not to have. Also on the write plane rather than the read one,
+    // even for status, so a read-only service token cannot enumerate the org's IdP posture.
+    //
+    // `directory_sync_now` is a WIDEN-SLOW verb despite being manual: everything it can create is a
+    // `suggested` row (inert until a human confirms in their DM), and the only thing it applies
+    // eagerly is the NARROWING one — a deprovisioned person's link-set goes on hold. It cannot revoke
+    // (terminal decisions stay human, `revoke_link_set`) and it cannot unlink an account the
+    // directory has merely stopped mentioning.
+    server.registerTool("directory_sync_now", {
+        title: "Sync identity links from the directory (Okta) now",
+        description: "Run the identity-directory sync for an org immediately instead of waiting for the daily schedule, and return the plan it applied. New IdP→platform mappings land as `suggested` links — INERT until the person confirms them in their own DM (`confirm_link`) — unless the org has set OE_DIRECTORY_AUTOCONFIRM=attested, which auto-confirms only mappings the IdP itself provisions. A person the directory reports as deprovisioned has their link-set SUSPENDED eagerly. It never unlinks or revokes anything: absence from the directory is not evidence, and revocation stays a human act (revoke_link_set). Safe to run repeatedly and concurrently — a second run over an unchanged directory is all no-ops. Returns `{ provider: null }` when no directory adapter is wired. Org-admin only.",
+        inputSchema: { org: z.string().min(1) },
+    }, async (a) => {
+        const denial = requireOrgAdminForLinks("directory_sync_now", a.org);
+        if (denial)
+            return errorResult(denial);
+        try {
+            const res = await syncDirectoryOrg({ org: a.org });
+            if (!res) {
+                return jsonResult({
+                    ok: true,
+                    org: a.org,
+                    provider: null,
+                    note: "no directory provider is registered — set OE_DIRECTORY_PROVIDER and wire the adapter at boot to arm directory sync.",
+                });
+            }
+            // directory-sync.ts appends its own `identity.directory.sync` summary (and link-store.ts
+            // one `identity.link.*` row per mutation). This second row is the control-plane PROVENANCE
+            // every sibling write here emits — which front door the run came through, and who asked.
+            await appendAudit({
+                org: a.org,
+                platform: "control",
+                workspace: "control",
+                principalId: actor,
+                action: "admin.identity.directory_sync_now",
+                detail: { provider: res.provider, policy: res.policy, planned: res.plan.counts, applied: res.applied, warnings: res.plan.warnings.length },
+            });
+            return jsonResult({
+                ok: true,
+                org: a.org,
+                provider: res.provider,
+                policy: res.policy,
+                people: res.plan.people,
+                planned: res.plan.counts,
+                applied: res.applied,
+                warnings: res.plan.warnings,
+                refusals: res.refusals,
+                startedAt: res.startedAt,
+                finishedAt: res.finishedAt,
+            });
+        }
+        catch (e) {
+            return errorResult(`directory_sync_now failed: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    });
+    server.registerTool("directory_sync_status", {
+        title: "Last identity-directory sync result",
+        description: "What the last identity-directory sync did for an org: when it ran, which provider, the auto-confirm policy in force, how many suggestions/confirmations/suspensions it planned and applied, and any warnings it refused to act on (an account two directory records claim, a person whose accounts already span two link-sets). Read straight off the audit trail, so it reflects scheduled runs and manual ones alike. Org-admin only.",
+        inputSchema: { org: z.string().min(1) },
+    }, async (a) => {
+        const denial = requireOrgAdminForLinks("directory_sync_status", a.org);
+        if (denial)
+            return errorResult(denial);
+        try {
+            const provider = directoryProvider();
+            const last = await lastDirectorySync(a.org);
+            return jsonResult({
+                ok: true,
+                org: a.org,
+                provider: provider ? { id: provider.id, name: provider.name } : null,
+                lastRun: last ? { ts: last.ts, ...last.detail } : null,
+                note: provider
+                    ? last
+                        ? undefined
+                        : "a directory provider is wired but this org has never synced — run directory_sync_now, or wait for the daily schedule."
+                    : "no directory provider is registered (OE_DIRECTORY_PROVIDER unset or its adapter is not wired) — directory sync is off.",
+            });
+        }
+        catch (e) {
+            return errorResult(`directory_sync_status failed: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    });
+    // --- IdP GROUP sync, review mode (G.4) -----------------------------------------
+    //
+    // 🔴 REVIEW MODE, ALWAYS — AND THAT IS ITS DESIGN, NOT A LIMITATION. Person-groups are
+    // ACCESS-BEARING config: a membership grants capability in every member's DM, so it lives in a
+    // reviewed git diff, not in a table this plane could write. What this verb can do falls into two
+    // modes, and NEITHER is a silent apply:
+    //   • DEFAULT (`deliver` unset/false): PLAN ONLY. Diff the directory against the overlay and return
+    //     the next overlay FILE CONTENT plus a human-readable diff, for a person to commit by hand.
+    //     Touches nothing.
+    //   • `deliver: true`: open a BOT-PR that writes the overlay to the config repo, whose GitHub merge
+    //     IS the approval (identity/groups-delivery.ts) — the same branch/commit/PR machinery and the
+    //     same "an unmerged PR grants nothing" doctrine the grants overlay uses. This is review mode
+    //     AUTOMATED, not review mode replaced: the memberships take effect only when the PR merges and
+    //     the merged config redeploys. There is deliberately NO 'auto' mode that writes a running
+    //     instance — silently granting credentials to whoever an IdP group happens to contain is the
+    //     thing the reviewed-diff rule exists to prevent, and a deployed function has no repo to write
+    //     to anyway.
+    //
+    // The bot-PR path reuses the SCM/config-repo primitives (scm/refs + scm/contents + scm/pr) the
+    // grants flow uses, WITHOUT the approval-card apparatus (frozen AccessDelta, pending-action row,
+    // decidedBy, Slack thread) — a group-sync PR is initiated by this control verb, not a card, so it
+    // invents none of that. See identity/groups-delivery.ts for why that was the clean seam (Option 2)
+    // rather than factoring a shared helper out of the card-shaped access-request path (Option 1).
+    //
+    // NARROWING already has its fast lever elsewhere in BOTH modes: a deprovisioned person's LINK-SET
+    // is suspended eagerly by `directory_sync_now`, and a suspended set expands to nothing, so their
+    // `{ linkSet }` membership stops granting immediately — before any diff is merged. The removal in
+    // the plan is the bookkeeping that follows.
+    //
+    // ALLOWLIST (rule 5, group-sync.ts): OE_DIRECTORY_GROUP_ALLOWLIST, when set, restricts WHICH IdP
+    // groups sync into the overlay — a deployer who grants the agent 3 of their 50 Okta groups is not
+    // forced to carry 50. Read at this edge (`directoryGroupAllowlist`) and passed into the pure
+    // planner; unset ⇒ every group syncs, unchanged.
+    server.registerTool("directory_groups_plan", {
+        title: "Plan (or bot-PR-deliver) the IdP person-group overlay — review mode either way",
+        description: "Diff the directory's (Okta's) GROUP memberships against this deployment's machine-owned person-group overlay. DEFAULT (deliver unset/false): returns the next overlay file plus a readable list of the additions and removals it would make, and APPLIES NOTHING — commit the returned `overlayContent` to `agent/identity/groups.generated.ts` (or open a PR with it) and the memberships take effect on the next deploy. With `deliver: true`: opens (or updates) a BOT-PR that writes that overlay to the config repo — the GitHub merge is the approval, so nothing takes effect until an admin merges and the config redeploys (still review mode, just automated; there is no silent auto-apply). Person-groups grant capability in each member's DM, so they are config-as-code and change only through a merged diff. Groups are named `directory:<idp-group>` so they can never collide with hand-written ones, and members are link-set references, so a person only ever contributes the accounts they have CONFIRMED. A person the directory reports as deprovisioned is dropped from every group — and their link-set is separately suspended by directory_sync_now, which stops their access immediately without waiting for this diff. If OE_DIRECTORY_GROUP_ALLOWLIST is set, only the listed IdP groups sync. `deliver:true` needs the config repo configured (OE_ACCESS_CONFIG_REPO) and refuses politely otherwise. Returns `{ provider: null }` when no directory adapter is wired. Org-admin only.",
+        inputSchema: { org: z.string().min(1), deliver: z.boolean().optional() },
+    }, async (a) => {
+        const denial = requireOrgAdminForLinks("directory_groups_plan", a.org);
+        if (denial)
+            return errorResult(denial);
+        try {
+            const provider = directoryProvider();
+            if (!provider) {
+                return jsonResult({
+                    ok: true,
+                    org: a.org,
+                    provider: null,
+                    note: "no directory provider is registered — set OE_DIRECTORY_PROVIDER and wire the adapter at boot to arm directory group sync. Person-groups declared by hand in agent/identity/groups.ts work regardless.",
+                });
+            }
+            // The CURRENT overlay, recovered from the loaded registry by its reserved namespace — a
+            // deployed function cannot read its own repo, and the namespace partition (hand-written
+            // groups are refused the `directory:` prefix) is what makes the filter exact.
+            const current = directoryGroupsOf(getConfig().loadGroups?.() ?? []);
+            const people = await provider.listPeople();
+            // Rule 5 — the operator allowlist, resolved at this edge so the planner stays pure. Unset ⇒
+            // every group syncs (no behaviour change).
+            const allowGroups = directoryGroupAllowlist();
+            const plan = planDirectoryGroups({ provider: provider.id, people, current, allowGroups });
+            const noop = groupPlanIsNoop(plan);
+            // DELIVER MODE: open (or update) the bot-PR. Fail-closed if the config repo is unset — the
+            // delivery helper throws politely, and it becomes a tool-shaped error here.
+            if (a.deliver) {
+                const delivery = await deliverGroupsOverlay(plan);
+                await appendAudit({
+                    org: a.org,
+                    platform: "control",
+                    workspace: "control",
+                    principalId: actor,
+                    action: "admin.identity.directory_groups_pr",
+                    detail: {
+                        provider: provider.id,
+                        people: plan.people,
+                        planned: plan.counts,
+                        warnings: plan.warnings.length,
+                        outcome: delivery.outcome,
+                        ...(delivery.pr ? { pr: delivery.pr.number, url: delivery.pr.url, branch: delivery.branch } : {}),
+                        ...(allowGroups ? { allowlisted: allowGroups.length } : {}),
+                    },
+                });
+                return jsonResult({
+                    ok: true,
+                    org: a.org,
+                    provider: provider.id,
+                    people: plan.people,
+                    planned: plan.counts,
+                    changed: !noop,
+                    diff: renderGroupPlan(plan),
+                    warnings: plan.warnings,
+                    delivered: delivery.outcome,
+                    ...(delivery.pr ? { pr: delivery.pr } : {}),
+                    note: delivery.note,
+                });
+            }
+            // PLAN-ONLY MODE (default): return the content, apply nothing.
+            await appendAudit({
+                org: a.org,
+                platform: "control",
+                workspace: "control",
+                principalId: actor,
+                action: "admin.identity.directory_groups_plan",
+                detail: { provider: provider.id, people: plan.people, planned: plan.counts, warnings: plan.warnings.length, ...(allowGroups ? { allowlisted: allowGroups.length } : {}) },
+            });
+            return jsonResult({
+                ok: true,
+                org: a.org,
+                provider: provider.id,
+                people: plan.people,
+                planned: plan.counts,
+                changed: !noop,
+                diff: renderGroupPlan(plan),
+                warnings: plan.warnings,
+                overlayPath: "agent/identity/groups.generated.ts",
+                overlayContent: planOverlayContent(plan),
+                note: noop
+                    ? "the overlay already matches the directory — nothing to commit."
+                    : "REVIEW MODE: nothing was applied. Commit `overlayContent` to `overlayPath` (a PR is the reviewed diff), or re-run with deliver:true to open a bot-PR — the memberships take effect on the next deploy of the merged config.",
+            });
+        }
+        catch (e) {
+            return errorResult(`directory_groups_plan failed: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    });
+    // --- memory-admin writes (item 14) -----------------------------------------
+    // ADMIN ONLY in v1 — unlike every write above (scopeDenial: a domain:<name> role
+    // covers its own scope), a domain-role holder gets memory_list/memory_read only.
+    // Direct write, not a dream-cycle-style PROPOSAL: the propose gate exists because the
+    // AGENT is untrusted-autonomous; the caller here is an authenticated human org admin —
+    // they already ARE the approver (docs/control-plane.md "memory-admin"). Fragile point,
+    // recorded rather than solved: if domain-scoped write access is later granted, a domain
+    // admin editing a SHARED org silo should probably go through the propose gate instead
+    // of a direct write — revisit then, not now.
+    // 🔴 The ORG BEFORE THE ROLE (OPE-1438). `memory_write_file`/`memory_delete_file` build
+    // `controlPartition(a.org)` from the caller's string and then READ AND OVERWRITE that silo tier, so
+    // a role-only gate here was strictly worse than the read gap the ticket names: an admin-scoped
+    // caller could rewrite another tenant's org-brain. `memory_read` is pinned by `siloScopeDenial`;
+    // the writer over the same tier must not disagree with it.
+    const requireAdmin = (org) => foreignOrgDenial(org) ??
+        (roles.includes("admin")
+            ? null
+            : `forbidden: memory writes require the org-wide "admin" role (v1 — domain roles get memory_list/memory_read only; have: ${roles.length ? roles.join(", ") : "none"}).`);
+    server.registerTool("memory_write_file", {
+        title: "Write a memory file (full-file replace)",
+        description: "Full-file replace of one file inside one memory silo (creates it if absent). ADMIN ONLY (v1) — an org admin IS the approver here, unlike the dream cycle's propose-only gate for the untrusted-autonomous agent. `.md`/`.txt` only, 64KB cap, refuses a `_`-prefixed operational marker (e.g. `_onboarded`). Stamps an in-file human-edit marker (edited_by/edited_at) so the dream cycle never treats this write as agent drift. Audited (`memory.write`) and committed with a `control-plane edit by <subject>` message.",
+        inputSchema: { org: z.string().min(1), silo: z.string().min(1), relPath: z.string().min(1), content: z.string() },
+    }, async (a) => {
+        const denial = requireAdmin(a.org);
+        if (denial)
+            return errorResult(denial);
+        try {
+            assertSafeRelPath(a.relPath);
+            assertMemoryFileWritable(a.relPath, a.content);
+            const silo = getConfig()
+                .loadSilos()
+                .find((s) => s.name === a.silo);
+            if (!silo)
+                return errorResult(`memory_write_file failed: no memory silo named "${a.silo}".`);
+            const provider = providerById(silo.provider);
+            const p = controlPartition(a.org);
+            const tier = siloTier(silo.name);
+            const access = siloAccess(silo.name, getConfig().loadDomains());
+            const files = await provider.readTier(p, tier, silo, access);
+            // Stamp provenance BEFORE writing (not on the caller's raw content used for the
+            // cap check above) — this is the one thing that distinguishes this DIRECT,
+            // authenticated-human write from an agent's own `remember`/dream-tidy write,
+            // which never calls stampHumanEdit (memory/provenance.ts).
+            files[a.relPath] = stampHumanEdit(a.content);
+            // THE ONE ROAD (OPE-1873). The row keeps this edit's own `relPath`/`bytes`/`commit` detail
+            // and gains the canonical fields every `memory.write` row now carries.
+            const { version: commit } = await writeMemoryTier({
+                provider,
+                partition: p,
+                tier,
+                files,
+                message: `control-plane edit by ${actor}`,
+                silo,
+                access,
+                road: "control-edit",
+                principalId: actor,
+                platform: "control",
+                workspace: "control",
+                // `commit` is GONE from the detail: the road's canonical `version` field is the same token,
+                // and one write may not describe its version twice under two names. Nothing read it
+                // (`rg detail.commit` over the tree finds no reader); the tool's own JSON result still
+                // returns it to the caller under that name.
+                extra: { relPath: a.relPath, bytes: Buffer.byteLength(a.content, "utf-8") },
+            });
+            return jsonResult({ ok: true, org: a.org, silo: a.silo, relPath: a.relPath, commit });
+        }
+        catch (e) {
+            return errorResult(`memory_write_file failed: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    });
+    server.registerTool("memory_delete_file", {
+        title: "Delete a memory file",
+        description: "Delete one file from one memory silo. ADMIN ONLY (v1), same posture as memory_write_file. Refuses a `_`-prefixed operational marker. Returns deleted=false if the file wasn't there. Audited (`memory.delete`) and committed with a `control-plane edit by <subject>` message.",
+        inputSchema: { org: z.string().min(1), silo: z.string().min(1), relPath: z.string().min(1) },
+    }, async (a) => {
+        const denial = requireAdmin(a.org);
+        if (denial)
+            return errorResult(denial);
+        try {
+            assertSafeRelPath(a.relPath);
+            assertMemoryFileWritable(a.relPath);
+            const silo = getConfig()
+                .loadSilos()
+                .find((s) => s.name === a.silo);
+            if (!silo)
+                return errorResult(`memory_delete_file failed: no memory silo named "${a.silo}".`);
+            const provider = providerById(silo.provider);
+            // writeTier is upsert-only (every backend — provider.ts) and can NEVER express
+            // "remove this file"; deleteFile is the dedicated primitive. Fail loud on a
+            // backend that hasn't implemented it (github, today) rather than silently doing
+            // nothing while reporting deleted:true.
+            if (!provider.deleteFile) {
+                return errorResult(`memory_delete_file failed: the "${provider.id}" memory backend doesn't support single-file deletion yet (silo "${a.silo}").`);
+            }
+            // The delete call itself gets its own try/catch (distinct from the outer one)
+            // so a backend-level FAILURE (github: a permission/network error from the
+            // Contents API — scm/contents.ts throws rather than swallowing a non-404) lands
+            // an audit row too, not just an error back to the caller. Every other branch
+            // above (bad org/silo, unsupported backend) never reached a real durable-store
+            // call, so — matching every other write tool here — those stay unaudited;
+            // this one DID attempt a mutation against a real backend, so it's the one
+            // failure mode worth a permanent record of "an admin tried to delete this and
+            // it didn't happen" (never a silent, falsely-successful no-op AND never a
+            // silent, un-audited failure).
+            let commit;
+            try {
+                commit = await provider.deleteFile(controlPartition(a.org), siloTier(silo.name), a.relPath, silo, siloAccess(silo.name, getConfig().loadDomains()));
+            }
+            catch (e) {
+                const message = e instanceof Error ? e.message : String(e);
+                await appendAudit({
+                    org: a.org,
+                    platform: "control",
+                    workspace: "control",
+                    principalId: actor,
+                    action: "memory.delete",
+                    detail: { silo: a.silo, relPath: a.relPath, deleted: false, error: message },
+                });
+                return errorResult(`memory_delete_file failed: ${message}`);
+            }
+            const deleted = commit !== null;
+            await appendAudit({ org: a.org, platform: "control", workspace: "control", principalId: actor, action: "memory.delete", detail: { silo: a.silo, relPath: a.relPath, deleted, ...(commit ? { commit } : {}) } });
+            return jsonResult({ ok: true, deleted, org: a.org, silo: a.silo, relPath: a.relPath, commit });
+        }
+        catch (e) {
+            return errorResult(`memory_delete_file failed: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    });
+}
+//# sourceMappingURL=writes.js.map