@open-everywhere/core 0.1.0

package/agent/access/window-gate-manifest.ts

@@ -0,0 +1,543 @@
+// Two tables that between them are TOTAL over the STATICALLY-AUTHORED runtime tool surface; every tool must carry exactly one posture, with no default, so a new tool declaring neither fails scripts/window-gate-lint.ts.
+// A WINDOW_GATED_TOOLS row is grain-scoped and structurally ABSENT elsewhere; WINDOW_UNGATED_TOOLS mount on every grain, where the orthogonal consequence registry is the gate instead.
+// ⚠️ "Total" does NOT cover the runtime-injected families: a connector op has no row here and is gated by the credential's DM-only context wall plus its per-op consequence tier, and `final_output` is a harness-internal sink with nothing to gate.
+// Declared subagents DO get rows, since the directory name is statically known, so a new subagent with no declared posture fails CI like any new tool.
+
+import type { WindowGrain } from "../identity/binding.js";
+import { oneshotAgentEnabled } from "./delegation-flag.js";
+
+// `fullKit()` is a FUNCTION, not a const, and must stay one: it reads `delegation.oneshotAgent` fresh on every call, while a module-load read is pinned to the schema's SHIPPED DEFAULT, because ESM evaluates this module before `register-config.ts` calls `registerSettings()`.
+// 🔴 Never snapshot the result at another module's top level — that re-creates the same defect one layer down, silently. Call it inside the function that needs it, or as a default parameter.
+
+/** Module-level and FROZEN so {@link fullKit} returns the same object every call: reference identity is how a row declares "wide hands", and a structural comparison would read any fixed ["task"] row as one. Freezing also makes the table tamper-evident at runtime. */
+const WIDE_HANDS_ARMED: readonly WindowGrain[] = Object.freeze(["task"] as const);
+const WIDE_HANDS_DISARMED: readonly WindowGrain[] = Object.freeze(["task", "native"] as const);
+
+/** The grains that hold the wide-hands kit RIGHT NOW — see the block comment above for why this is a
+ *  function. Cheap: one settings read plus a branch, no allocation. */
+export function fullKit(): readonly WindowGrain[] {
+  return oneshotAgentEnabled() ? WIDE_HANDS_ARMED : WIDE_HANDS_DISARMED;
+}
+
+/** The CONVERSATIONAL-ROOT grains — seats that talk + delegate, never hold wide hands (Stage T2). The
+ *  lint forbids any wide-hands tool on ANY of these. `task` (the one-shot worker) is deliberately ABSENT —
+ *  it is the worker, not a conversational root, and it is the one root grain permitted wide hands. */
+export const CONVERSATIONAL_ROOT_GRAINS = ["standing", "native", "thread"] as const;
+
+/**
+ * Every grain-gated tool and the grains that mount it — the single source of truth for the resolver, the backstop, the audit's withheld list and the baseline tests. Everything absent from it mounts on every grain and must be listed in WINDOW_UNGATED_TOOLS.
+ * The wide-hands rows are GETTERS over the flag-derived matrix, so a READ is live wherever it happens.
+ * 🔴 Never HOLD one: a module-level capture, a spread of the table, or a row closed over in a resolver freezes what the getters exist to keep live. `row === fullKit()` is the exact test for a wide-hands row; structure is not.
+ */
+export const WINDOW_GATED_TOOLS: Readonly<Record<string, readonly WindowGrain[]>> = {
+  // sandbox / egress (framework-named — provided per grain by tools/sandbox_tools.ts)
+  get bash() { return fullKit(); },
+  get glob() { return fullKit(); },
+  get grep() { return fullKit(); },
+  get read_file() { return fullKit(); },
+  get write_file() { return fullKit(); },
+  get web_fetch() { return fullKit(); },
+  get checkout_repo() { return fullKit(); },
+  get open_pull_request() { return fullKit(); },
+  get post_file() { return fullKit(); },
+  get create_skill() { return fullKit(); },
+  get delete_skill() { return fullKit(); },
+  // `spawn_thread_session` is standing-only (a thread seat must not mint further thread seats) and `complete_thread` is thread-only; `agent` is the one worker-delegation verb, on the conversational roots.
+  // 🔴 `agent`'s gate is NOT a mount: it is eve's built-in, so this row is the ADMITTED-GRAIN table hooks/lean-seat.ts reads and access/untrusted-projection.ts subtracts from — it must carry no kit key and no `disableTool()` sentinel.
+  agent: ["standing", "thread"],
+  spawn_thread_session: ["standing"],
+  complete_thread: ["thread"],
+  // The coordinator verbs are standing-only for the spawner's reason: the seat that OPENS a thread reads and steers it, a thread seat holding either could reach its siblings, and a worker holds no threads.
+  read_thread_seat: ["standing"],
+  message_thread_seat: ["standing"],
+};
+
+/**
+ * The always-available table — every tool that mounts on EVERY grain at mount time, and the positive complement of WINDOW_GATED_TOOLS, so a tool in neither fails the lint.
+ * 🔴 Mount time is no longer the whole answer: a DELEGATING conversational seat is narrowed PER WAKE to the conversational roster (access/lean-seat.ts), so a row here means it mounts on task workers, on fires, on non-delegating seats such as a DM, and on any seat this deployment cannot positively classify.
+ * The per-row prose below argues MOUNT posture; the lean filter is the routing answer layered on top, and it never changes what a fire or a DM seat holds.
+ */
+export const WINDOW_UNGATED_TOOLS: ReadonlySet<string> = new Set([
+  // same-room conversational verbs — the supervisor's actual output (fail all three consequence axes)
+  "reply",
+  // OPE-793 — rewrites one of this agent's OWN posts in the asking room, fenced to the own-post
+  // ledger. Same class as `reply` above it: no external effect, nothing leaves the conversation, and
+  // grain was never the control — what bounds it is the ledger plus the host-resolved locus.
+  "edit_reply",
+  "no_reply",
+  "react",
+  "update_status",
+  // `stand_down` REMOVES the agent's own reach, the opposite of a wide-hands tool, and rule 3 below would force a gated row here to carry the full wide-hands matrix. Withholding it from `standing` would take it from the one seat that can be asked to go quiet.
+  "stand_down",
+  // `halt` REMOVES the agent's own reach, one step wider than `stand_down`: after it runs the deployment can do strictly less.
+  // `resume`'s control is its `gate:admin` ActionKind, not the grain — a grain cut would leave the room that can see the halt unable to propose ending it.
+  "halt",
+  "resume",
+  // genuine reads — membership is the read tier; narrowing reads would violate L3 doctrine
+  "check_pr_status",
+  "get_pr_feedback",
+  // Grain is not the control on either: the channel's repo grant and the one config-declared governance channel are. Both are deliberately ABSENT from JOB_WAKE_TOOLS below.
+  "walk_pr",
+  "post_pr_walkthrough",
+  // Worker-side under the lean cut: it is the one read that would otherwise make a standing seat a taint ingress of its own, so a delegating seat's only taint arrives through the delegation return stamp. A non-delegating DM seat keeps it directly.
+  "describe_image",
+  "list_repos",
+  "list_routines",
+  // Same posture as list_routines: grain is not the control, the fire lookup's own partition is, and the untrusted fence bounds the content on the way out.
+  "read_routine_transcript",
+  "list_skills",
+  // A read of this scope's OWN policy that executes nothing and simulates only the scope it runs in, so grain is not the control; under the lean cut it is worker kit, and a non-delegating DM seat keeps it directly.
+  // NOT in JOB_WAKE_TOOLS: an unattended job has nobody to explain to.
+  "explain_permission",
+  // Ungated at every grain for a narrower reason than explain_permission's: the tightening loop is meant to run UNATTENDED on a schedule, so a grain narrowing would withhold it from the one seat it was built for. It executes nothing and names no principal.
+  "permission_fit_report",
+  // the deployment's own inbound-webhook inventory (OPE-150) — the DECLARED hooks, never a secret
+  // ref (tools/list_webhooks.ts pins that), so it is the same class of read as list_routines: which
+  // standing behaviour exists on this surface.
+  "list_webhooks",
+  // Grain is not the control: the hook's own `readableBy` is, checked with the same pair the FIRE path uses. Deliberately NOT in JOB_WAKE_TOOLS — it is a debugging read for a human in the room.
+  "read_webhook_history",
+  // Grain is not the control on either: the hook's own `readableBy` is, and `capture_events` writes only a deadline on one hook row under that same check, so a room cannot start retention it could not itself inspect.
+  // Both are deliberately ABSENT from JOB_WAKE_TOOLS: replaying thirty attacker-authored payloads into an unattended, accumulating session is exactly what that narrowing withholds.
+  "capture_events",
+  "list_recent_events",
+  // Its control is CONSEQUENCE — a code-rendered approval card, a verified clicker and a private reveal — not hands; a grain that could not propose one would just push the ask to a wider seat. Deliberately NOT in JOB_WAKE_TOOLS.
+  "rotate_webhook",
+  // the CONFIG-hook half (OPE-208) — proposes a PR rather than arming anything, so its control is
+  // weaker-than-consequential at click time and the real gate is the merge. Same grain reasoning as
+  // request_access below, which it shares a flow with.
+  "declare_webhook",
+  // the agent's own shipped manual (OPE-138) — first-party product prose, no org data, no external
+  // reach; every grain gets it (an ambient watcher explaining itself is the point, not a risk).
+  "read_docs",
+  "read_file_upload",
+  // Each of the three container reads has TWO mount arms and only one reads the grain: the chat arm mounts on the `task` grain alone, while the domain WORK-grant arm is grain-blind.
+  // A WINDOW_GATED_TOOLS row would therefore be a lie — it claims absence outside a matrix the grant arm ignores — and rules 3 and 4 forbid it anyway.
+  "read_notion_page",
+  "read_notion_comments",
+  // Its control is the DOMAIN WORK GRANT, not the grain: with no grant it mounts on no grain, and with one the credential's reach is the boundary. The lean seat keeps it off a conversational seat in practice.
+  // 🔴 Deliberately ABSENT from JOB_WAKE_TOOLS — an unattended fire gaining workspace enumeration is a widening for its own diff.
+  "notion_search",
+  // the third vendor container read — see the two-arm note above `read_notion_page`.
+  "read_linear_issue",
+  // ticket-mutation verbs (OPE-39) — entity-gated conversational-kit writes (Linear/GitHub), mount
+  // on every grain; consequence-gated (not grain-gated) like purge_memory below.
+  "set_state",
+  "assign",
+  "add_label",
+  // the work-surface CREATE verb (OPE-137) — same posture as the three mutation verbs above:
+  // destination-gated, mounts on every grain, consequence-gated (ticket.create) not grain-gated.
+  "create_ticket",
+  // Its control is the DESTINATION GRANT, never the grain: a domain that granted no container mounts nothing, and what it does mount is consequence-gated behind a card that renders the destination and the full body.
+  // A DELEGATING seat still sheds it — the name is deliberately not in LEAN_SEAT_TOOLS, because a cross-container write is task-grain work a worker holds.
+  "post_message",
+  // Its control is the RECIPIENT GRANT plus the recipient's own stop, never the grain: a domain that granted nobody mounts nothing whatever the grain. A DELEGATING seat still sheds it — deliberately not in LEAN_SEAT_TOOLS.
+  "dm_person",
+  // A conversational verb about the caller's OWN relationship with this agent, tier `open`, mounted only in a one-to-one DM. Grain-gating it would strand the exact seat a person uses to ask the agent to leave them alone; it IS on LEAN_SEAT_TOOLS.
+  "set_dm_delivery",
+  // Its control is the DOMAIN WORK GRANT, not the grain: no grant on any connector ⇒ it never mounts, whatever the grain. Deliberately absent from JOB_WAKE_TOOLS, mirroring notion_search.
+  "search",
+  // External hands, but the grain is not the control: the reviewed per-scope `awsRoles` grant (default-deny), the role's IAM policy and the wired adapter are — so mounting it on every grain grants nothing an operator did not configure, and it fails closed wherever no AWS is granted.
+  // A DELEGATING seat routes the ask through a worker, where the SAME grant check runs against the same window-derived scope; a granted fire keeps it.
+  "aws",
+  // the generic read verbs — conversational-kit reads, mount on every grain. Since OPE-1145 no
+  // PER-SURFACE chat reader stands beside them (the WORK-plane pair below is the worker's, and is a
+  // different plane, not a second spelling of these two).
+  "read_channel",
+  "read_thread",
+  // Grain is not their control: the surface work grant (checked at mount AND per turn) plus the read adapter's own domain allowlist are. A conversational seat never sees either verb — they are off the lean-seat roster, which is what keeps the chat plane the seat's and the work plane the worker's.
+  "read_work_channel",
+  "read_work_thread",
+  "session_cost",
+  // OPE-991 — the running-version seam: a read of the deployment's own registered AppInfo
+  // (version, deployment sha, eve pin). Same class as session_cost next to it: OE's own
+  // operational facts, no principal in the output, grain is not the control.
+  "agent_version",
+  "spend_report",
+  "usage_report",
+  // constrained NL analytics read (OPE-66) — an always-available aggregate read like the reporting
+  // tools; org scope + rows mode are gated in-tool (consequence-orthogonal), never by grain.
+  "query_analytics",
+  // The one surviving memory verb, consequence-gated rather than grain-gated. Memory WRITES are not a verb at all now — they are sandbox file edits governed at the capture seam (hooks/memory.ts), which is why nothing else memory-shaped is listed here.
+  "purge_memory",
+  // Grain is not the control on any of the three: each REFUSES outside a DM and refuses without an ACTING principal, which is strictly narrower than any grain.
+  // Deliberately NOT in JOB_WAKE_TOOLS — an unattended job wake has no acting principal, and no business holding verbs about who somebody is.
+  "link_identity",
+  "confirm_link",
+  "unlink_identity",
+  // Grain is not the control: it refuses outside a DM and without an ACTING principal, strictly narrower than any grain. Deliberately NOT in JOB_WAKE_TOOLS — a fire has no business ending a person's grants.
+  "revoke_credential_grant",
+  // request a grant it lacks — judge-native; the grant merge is the real privilege gate
+  "request_access",
+  // It grants nothing: the owner decides, in their own DM, on host-rendered copy. Its own mount predicate is much narrower than this table — a domain that declares a grant role, plus a DELEGATED WORKER (OPE-2023): a conversational seat hands "use my own account" to a task, exactly as it hands over every other job.
+  // Deliberately NOT in JOB_WAKE_TOOLS: an unattended fire names no verified requester, so the ask would refuse anyway.
+  "request_credential_grant",
+  // Proposes a PR rather than arming anything, so its control is the merge, not hands; consequence-gated (`agent.create`). Deliberately NOT in JOB_WAKE_TOOLS — it refuses fires anyway.
+  "create_agent",
+  // post connect options for a provider — a conversational affordance, available on every grain (a
+  // standing seat can offer connect too); the consequential act is the human click, gated host-side
+  "connector",
+  // standing-behaviour bookkeeping / watch-arming — a standing seat's native duty (D1 keeps these)
+  "cancel_routine",
+  "create_routine",
+  // Conversational bookkeeping over standing behaviour: edit and enable are consequence-gated with member cards, and run_routine_now refuses without a verified principal, so grain was never the control for any of them.
+  "edit_routine",
+  "enable_routine",
+  "run_routine_now",
+  // 🔴 DO NOT ADD EITHER TO JOB_WAKE_TOOLS: a rule is rendered as TRUSTED text into every future unattended fire, so a restricted wake holding these could amend, or strip, its own doctrine with nobody in the room.
+  // Absence from that default-deny set is the whole implementation; each also hard-refuses inside any routine fire and on any tainted turn.
+  "add_routine_rule",
+  "remove_routine_rule",
+  // De-escalation only, so grain was never the control. It refuses without an ACTING principal, and because it posts no card that refusal is the only thing between a fire and a silent unattended disarming attributed to the routine's creator.
+  "revoke_routine_permissions",
+  "record_watch_state",
+  // Own-row bookkeeping that aims at nobody else, and the ONLY continuity an ordinary stateless routine has — a grain that withheld it would leave the commonest routine shape with no hand-off at all.
+  "record_follow_up",
+  // Own-row bookkeeping, marker-located, on EVERY grain: semantic failure is not a property of a trigger kind or a seat shape, and a fire that cannot declare failure is one that runs forever.
+  "report_run_failed",
+  // durable-job bookkeeping (OPE-55): a job fire writes its own ledger / declares itself done —
+  // marker-located, aims at nobody else, available on any grain the job fires as (same as record_watch_state)
+  "record_job_state",
+  "complete_job",
+  "subscribe_pr",
+  // this-session housekeeping / admin-gated config verbs — none are wide-hands
+  "extend_workspace_time",
+  "set_spend_limit",
+  "clear_spend_limit",
+  "revoke_connector",
+  "clear_connector_override",
+  "memory_admin_list",
+  "memory_admin_read",
+  // The per-grain kit PROVIDER files: each mounts nothing under its own name — the tools they provide are the WINDOW_GATED_TOOLS rows — so these slugs are machinery and always present.
+  "sandbox_tools",
+  // The resolver FILE is always-present machinery; the `browser_*` tools it injects are a runtime-injected family whose grain gate lives in access/browser-toolkit.ts (wide-hands grains only, plus an execute backstop), and flag-off it mounts nothing at all.
+  "browser_tools",
+  // The resolver FILE is always-present machinery; the `grant__…` tools it returns are runtime-minted and cannot sit in a static table.
+  // Their gate lives IN the resolver — DELEGATED WORKERS of the lent conversation only, never the seat (OPE-2023) — and their per-call gate is the broker's own state check. The credential never reaches either side: the broker spends it host-side, so what a worker holds is one pinned call on one vendor tool.
+  "grant_tools",
+  // eve framework tools with no OE override — reads / in-context helpers, escape nothing
+  "web_search",
+  "ask_question",
+  "todo",
+  "load_skill",
+  "connection_search",
+  // UNGATED is FORCED, not chosen: rule 3 pins every non-delegation gated row to the wide-hands matrix, and eve exports no `task_*` definition for a kit to re-provide, so a bare `disableTool()` sentinel would remove them from every seat including the delegating one whose own work they coordinate.
+  // 🔴 The family is VERSION-PINNED to the installed eve and `lint:window-gate` fails in both directions, so a name moves in the SAME commit that moves the pin.
+  "task_cancel",
+  // A declared subagent is ungated because grain is about HANDS and this one has none: a zero-tool reasoning pass whose result returns into the CALLING session's own context, pinned zero-hands by scripts/subagents-lint.ts.
+  // ⚠️ If a future subagent is given real tools it is no longer an ungated row — give it a grain matrix in WINDOW_GATED_TOOLS before loosening its tools/ dir.
+  "fresh_eyes_review",
+  // No `workflow` row: the reshape dropped the eve-subagent sync path and there is no enabler file, so nothing mounts under that name.
+]);
+
+/** Tool names of {@link WINDOW_GATED_TOOLS} a seat of `grain` does NOT get (the audit row's list). */
+export function withheldFromGrain(grain: WindowGrain): string[] {
+  return Object.keys(WINDOW_GATED_TOOLS).filter((name) => !WINDOW_GATED_TOOLS[name].includes(grain));
+}
+
+/**
+ * Which verb a seat uses to read its materialised memory: `file-tools` when it holds the sandbox kit, `agent` when it can delegate to a worker whose sandbox materialises the same silos, and `none` when it can do neither (a per-container standing root, or a DM that reached a native token by degradation).
+ * The memory index renders itself from this, so a seat is never told to use a tool it does not hold, and `none` says "unreachable" out loud rather than inviting the model to bluff.
+ */
+export type MemoryRecallRoute = "file-tools" | "agent" | "none";
+
+/**
+ * The verb a seat of `grain` uses to read its materialised memory.
+ * `wideHandsGrains` and `armed` default to a LIVE read and are injectable so a test can pin either matrix; `canDelegate` cannot be derived from the grain — a DM root and a window seat are both `standing`, and only one has a window to mint a worker into — and it defaults TRUE so a caller with no ctx keeps today's answer.
+ */
+export function memoryRecallRouteFor(
+  grain: WindowGrain,
+  wideHandsGrains: readonly WindowGrain[] = fullKit(),
+  armed: boolean = oneshotAgentEnabled(),
+  canDelegate: boolean = true,
+): MemoryRecallRoute {
+  if (wideHandsGrains.includes(grain)) return "file-tools";
+  // Disarmed, a conversational seat holds NO delegation verb at all, so the honest answer is "none" rather than a verb the seat cannot call. Read the grain matrix off the table so a row edit cannot leave this pointing at a tool the seat no longer mounts.
+  if (!canDelegate || !armed) return "none";
+  return WINDOW_GATED_TOOLS.agent.includes(grain) ? "agent" : "none";
+}
+
+/**
+ * THE JOB-WAKE KIT — the allow-list an un-escalated (autonomous, scheduler-fired) durable-job wake is narrowed to. The only DEFAULT-DENY table here: a name absent from it is withheld, so a new tool is outside the kit until someone adds it on purpose.
+ * Applied PER WAKE at the model-call toolset seam and the execute backstop, never at mount time, because a durable-job session is resumed and its grain-time mount decision is frozen at the first fire. It never grants — only removes.
+ * It keeps what cannot escape the conversation or the job's own row: reads, the same-room reply verbs, and the job's own bookkeeping. Every consequential write is withheld until a human escalates, and so are `web_search` and `read_routine_transcript`, whose payloads would be replayed into a session that accumulates for weeks with nobody watching.
+ * 🔴 This table fences a DURABLE-JOB WAKE and nothing else — reading it as "nothing autonomous touches this plane" has produced two defects. An ordinary routine fire is not a job wake: it mounts WINDOW_UNGATED_TOOLS in full, and what stops a verb there is each tool's own refusal, which since OPE-273 demands an ACTING principal.
+ * Runtime-injected names are filtered at call time instead: a connector op survives only at tier `read` (an unrecognised verb classifies `destructive`), and a granted-credential tool is withheld whatever its tier, because a grant spends one person's credential on another person's ask.
+ */
+export const JOB_WAKE_TOOLS: ReadonlySet<string> = new Set([
+  "reply",
+  // A durable job is the seat that most often posts a message it later needs to keep current, and the verb reaches nothing but a message this deployment posted into this conversation — no lever it did not already have through `reply`.
+  "edit_reply",
+  "no_reply",
+  "react",
+  "update_status",
+  // the job's own protocol + watch bookkeeping + the declared-failure seam (own-row writes only)
+  "record_job_state",
+  "complete_job",
+  "record_watch_state",
+  "record_follow_up",
+  "report_run_failed",
+  "read_channel",
+  "read_thread",
+  "read_notion_page",
+  "read_notion_comments",
+  "read_linear_issue",
+  "read_file_upload",
+  "describe_image",
+  "check_pr_status",
+  "get_pr_feedback",
+  "list_repos",
+  "list_routines",
+  "list_skills",
+  // a read, and it stays for the same reason list_routines does: it is how an unattended job can
+  // notice which ingress it depends on exists. It discloses no secret ref.
+  "list_webhooks",
+  // 🔴 DELIBERATELY ABSENT: `rotate_webhook`. An unattended job wake has no human present, and issuing an ingress's signing secret MINTS a value that has to be handed to somebody; `list_webhooks` above is a read and stays.
+  "session_cost",
+  "spend_report",
+  "usage_report",
+  "query_analytics",
+  // Same class as the telemetry reads above — OE's own operational data, no outward effect, no principal in the output — and a durable job doing standing permission review is the unattended seat the tightening loop was written for.
+  "permission_fit_report",
+  // The reason this table gets the row: a watch routine is the unattended wake that has to answer "am I behind?" against an upstream release it just detected. No outward effect, no principal in the output.
+  "agent_version",
+  "todo",
+  "load_skill",
+]);
+
+/** Static-surface names a restricted job wake withholds — the audit row's list. Covers BOTH posture tables; runtime-injected families are filtered by name or tier at call time and are deliberately not enumerable here. */
+export function withheldFromJobWake(
+  gated: Readonly<Record<string, readonly WindowGrain[]>> = WINDOW_GATED_TOOLS,
+  ungated: ReadonlySet<string> = WINDOW_UNGATED_TOOLS,
+  jobKit: ReadonlySet<string> = JOB_WAKE_TOOLS,
+): string[] {
+  return [...new Set([...Object.keys(gated), ...ungated])].filter((name) => !jobKit.has(name)).sort();
+}
+
+/** One tool's slug + authoring source, as enumerated by the caller (file slug + file text). */
+export interface WindowToolSource {
+  readonly name: string;
+  readonly source: string;
+}
+
+/**
+ * How the installed eve mounts a framework tool of this name — the input rule 4's `disableTool()` demand turns on.
+ * "default" (eve registers it on every session) DEMANDS the sentinel, or the raw built-in stays mounted on standing seats and the grain gate is bypassed; "opt-in" (eve mounts nothing on its own) drops that demand and fires on the app opting in instead; "unknown" fails closed and demands the sentinel.
+ */
+export type FrameworkToolMount = "default" | "opt-in" | "unknown";
+
+/**
+ * Classify every framework tool name by how eve mounts it — the map rule 4 reads. PURE, which is what keeps this module free of any eve import: the caller reads the mount sets and hands the name lists in.
+ * 🔴 The halves are sourced differently on purpose: DEFAULT is read LIVE off the installed eve, so a release that moves a tool into the default set re-arms the sentinel demand with no code change here, while OPT-IN is a committed snapshot asserted against the installed dist.
+ * Fail-closed in three places, all landing on "unknown" so the sentinel stays mandatory: either list undefined, a name in neither list, or a name in both.
+ */
+export function classifyFrameworkTools(
+  allNames: Iterable<string>,
+  defaultMountedNames: Iterable<string> | undefined,
+  optInNames: Iterable<string> | undefined,
+): Map<string, FrameworkToolMount> {
+  const out = new Map<string, FrameworkToolMount>();
+  if (defaultMountedNames === undefined || optInNames === undefined) {
+    for (const name of allNames) out.set(name, "unknown");
+    return out;
+  }
+  const mountedByDefault = new Set(defaultMountedNames);
+  const optIn = new Set(optInNames);
+  for (const name of allNames) {
+    out.set(name, mountedByDefault.has(name) ? "default" : optIn.has(name) ? "opt-in" : "unknown");
+  }
+  return out;
+}
+
+/** Grain matrix (sorted, comma-joined) for the invariant comparisons below. */
+const grainKey = (grains: readonly WindowGrain[]): string => [...grains].sort().join(",");
+/** Render a grain matrix as the literal a message/table uses (source order, quoted): `"task","native"`. */
+const grainList = (grains: readonly WindowGrain[]): string => grains.map((g) => `"${g}"`).join(",");
+
+/**
+ * Verify the two posture tables are TOTAL and single-valued over the runtime tool surface, that no row is stale, that the grain-scoping invariants hold, and that every gated tool's SOURCE carries its gate. Returns human-readable problems; empty = clean.
+ * Pure: the caller enumerates the core tool files, the deploy shims and the eve framework names. `gated`/`ungated` default to the real tables and are injectable so a unit test can exercise each failure mode against a crafted surface.
+ */
+export function checkWindowGateManifest(
+  coreTools: readonly WindowToolSource[],
+  appShims: ReadonlyMap<string, string>,
+  /**
+   * The eve framework tool surface, in one of two spellings. A plain ARRAY is the FAIL-CLOSED spelling: every name classifies "unknown", so rule 4 demands a `disableTool()` sentinel for each grain-gated one.
+   * A MAP additionally carries each name's {@link FrameworkToolMount}, which lets rule 4 drop that demand for an OPT-IN name the app does not opt into.
+   */
+  frameworkTools: readonly string[] | ReadonlyMap<string, FrameworkToolMount>,
+  gated: Readonly<Record<string, readonly WindowGrain[]>> = WINDOW_GATED_TOOLS,
+  ungated: ReadonlySet<string> = WINDOW_UNGATED_TOOLS,
+  /** The grain matrix a WIDE-HANDS tool must carry — the "no wide hands on any conversational-root grain" invariant. Defaults to a LIVE {@link fullKit} read and is injectable so a test can assert either matrix without moving the ambient setting. */
+  wideHandsGrains: readonly WindowGrain[] = fullKit(),
+  /** Declared-subagent directory names, which eve lowers into tools in this same namespace and which are therefore part of the SURFACE: rules 1 and 3 bind, rule 4 does not, because a subagent has no tool source and its own tools/ dir is pinned zero-hands. */
+  subagentNames: readonly string[] = [],
+  /** The OPE-111 job-wake allow-list, injectable for the same reason `gated`/`ungated` are (rule 6). */
+  jobKit: ReadonlySet<string> = JOB_WAKE_TOOLS,
+): string[] {
+  const WIDE_HANDS_KEY = grainKey(wideHandsGrains);
+  const problems: string[] = [];
+  const coreByName = new Map(coreTools.map((t) => [t.name, t.source] as const));
+  // Accept both spellings of the framework surface (see the param doc). A ReadonlyMap IS a Map at
+  // runtime, so `instanceof` is the exact test; anything else is the fail-closed array spelling and
+  // every name classifies "unknown".
+  const frameworkMount = frameworkTools instanceof Map ? (frameworkTools as ReadonlyMap<string, FrameworkToolMount>) : undefined;
+  const frameworkToolNames: readonly string[] = frameworkMount ? [...frameworkMount.keys()] : (frameworkTools as readonly string[]);
+  const mountOf = (name: string): FrameworkToolMount => frameworkMount?.get(name) ?? "unknown";
+  const surface = new Set<string>([...coreByName.keys(), ...appShims.keys(), ...frameworkToolNames, ...subagentNames]);
+
+  // Every name provided as a KEY of some `windowGatedKit(...)` resolver — how a framework-named tool with no authoring file of its own is re-provided per grain (rule 4). Source-level, because this checker must fail in CI without resolving the agent graph.
+  const kitKeyProviders = new Map<string, string>();
+  for (const [slug, src] of coreByName) {
+    if (!/windowGatedKit\s*\(/.test(src)) continue;
+    for (const m of src.matchAll(/\n\s+([a-z_][\w]*)\s*:/gu)) kitKeyProviders.set(m[1], slug);
+  }
+
+  // 1. Every tool on the surface carries EXACTLY ONE positive posture (the drift guard).
+  for (const name of surface) {
+    const inGated = Object.prototype.hasOwnProperty.call(gated, name);
+    const inUngated = ungated.has(name);
+    if (inGated && inUngated) {
+      problems.push(
+        `tool "${name}" is declared in BOTH WINDOW_GATED_TOOLS and WINDOW_UNGATED_TOOLS — a tool has exactly ONE window-gate posture; remove one (access/window-gate-manifest.ts)`,
+      );
+    } else if (!inGated && !inUngated) {
+      problems.push(
+        `tool "${name}" has NO window-gate posture — declare it in access/window-gate-manifest.ts: add a grain matrix to WINDOW_GATED_TOOLS if it is a wide-hands (sandbox/egress/audience) or delegation tool, OR add its name to WINDOW_UNGATED_TOOLS if it is an always-available conversational/read verb. There is deliberately no default — a new tool must state its posture or it lands wide-open on standing seats.`,
+      );
+    }
+  }
+
+  // 2. No stale rows — a declared name that isn't a tool file nor a mounted framework tool.
+  for (const name of Object.keys(gated)) {
+    if (!surface.has(name)) {
+      problems.push(
+        `WINDOW_GATED_TOOLS names "${name}" which is neither a tool file (packages/core/agent/tools ∪ agent/tools) nor a mounted framework tool — remove the row or fix the name (a stale row hides a real gap)`,
+      );
+    }
+  }
+  for (const name of ungated) {
+    if (!surface.has(name)) {
+      problems.push(`WINDOW_UNGATED_TOOLS names "${name}" which is neither a tool file nor a mounted framework tool — remove it or fix the name`);
+    }
+  }
+
+  // Grain-scoping invariants: the delegation and thread-lifecycle tools each carry a fixed grain, and every OTHER gated tool is a wide-hands tool that must carry EXACTLY the wide-hands matrix — the "no wide hands on any conversational-root grain" invariant.
+  for (const [name, grains] of Object.entries(gated)) {
+    if (name === "spawn_thread_session") {
+      // The window-only spawner is STANDING-scoped: a task/native/thread session must never spawn
+      // recursively (no recursive thread trees). Its window-only restriction is the tool's own mount
+      // predicate (canSpawnThreadFromWindow); the manifest pins the grain.
+      if (grainKey(grains) !== "standing") {
+        problems.push(`WINDOW_GATED_TOOLS["${name}"] must be exactly ["standing"] (a window-only spawner: no recursive spawn from a task/native/thread seat) — got [${grains.join(", ")}]`);
+      }
+    } else if (name === "agent") {
+      // The ONE delegation tool: the CONVERSATIONAL-ROOT seats that hand work off (standing + thread).
+      // NOT native (the T5 access-scope gate broadens it), NEVER task — a worker leaf that could
+      // delegate is a recursion hole, and it is the one grain that already holds the wide hands.
+      if (grainKey(grains) !== grainKey(["standing", "thread"])) {
+        problems.push(`WINDOW_GATED_TOOLS["agent"] must be exactly ["standing", "thread"] (the conversational-root seats delegate; NEVER task — a worker leaf holds the wide hands already and must not spawn recursively) — got [${grains.join(", ")}]`);
+      }
+    } else if (name === "complete_thread") {
+      if (grainKey(grains) !== "thread") {
+        problems.push(`WINDOW_GATED_TOOLS["complete_thread"] must be exactly ["thread"] (only a thread seat owns a thread) — got [${grains.join(", ")}]`);
+      }
+    } else if (name === "read_thread_seat" || name === "message_thread_seat") {
+      // Standing-scoped for the spawner's reason: the seat that OPENED a thread reads and steers it, a thread seat holding either could reach its siblings, and a worker holds no threads. Grain-scoped, not wide-hands — neither verb reaches a sandbox, an egress, or a surface the seat could not already reach.
+      if (grainKey(grains) !== "standing") {
+        problems.push(`WINDOW_GATED_TOOLS["${name}"] must be exactly ["standing"] (the coordinator verbs: the seat that OPENED a thread reads and steers it; never a thread seat's sibling reach, never a worker) — got [${grains.join(", ")}]`);
+      }
+    } else if (grainKey(grains) !== WIDE_HANDS_KEY) {
+      problems.push(
+        `WINDOW_GATED_TOOLS["${name}"] is a wide-hands tool and must be exactly [${grainList(wideHandsGrains)}] (the worker grain(s); withheld from every CONVERSATIONAL-ROOT seat — standing/native/thread) — got [${grains.join(", ")}]; mounting it on any conversational-root grain would give a talking seat heavy hands`,
+      );
+    }
+  }
+
+  // 4. Every gated tool's SOURCE actually carries the gate (the A6 silent-re-introduction guard).
+  const subagentSet = new Set(subagentNames);
+  for (const name of Object.keys(gated)) {
+    // A declared subagent (OPE-45) has no tool source and no windowGatedKit entry — eve lowers the
+    // whole agent directory into the tool. Its mount gate would be a resolver, and what it can DO is
+    // fixed by its own tools/ dir; rule 1 (posture declared) and rule 3 (grain matrix) still bind.
+    if (subagentSet.has(name)) continue;
+    const coreSrc = coreByName.get(name);
+    if (coreSrc === undefined) {
+      // A framework-named gated tool must be re-provided per grain by SOME `windowGatedKit(...)` resolver AND have its built-in removed by a `disableTool()` sentinel shim, unless the installed eve classifies the name "opt-in".
+      // Both halves are load-bearing and neither implies the other: the sentinel alone leaves the tool absent everywhere, and the kit alone leaves eve's built-in mounted and WINNING the name.
+      // 🔴 `agent` is the one exemption, enforced as its own pair below: eve's built-in IS this deployment's delegation verb, so a kit key would register a dynamic tool that collides with it.
+      const shim = appShims.get(name);
+      const isSentinel = shim !== undefined && /\bdisableTool\s*\(\s*\)/.test(shim);
+      if (name === "agent") {
+        // The delegation pair — both halves must be ABSENT, and each is a distinct failure.
+        // A KIT would re-register a dynamic `agent` beside the built-in, and eve's tool loop throws on the collision and kills the turn.
+        // A SENTINEL would remove the built-in with nothing re-providing it, so every seat would lose delegation entirely; one on disk means the roster artefacts are stale (run `oe build --accept`). The runtime gate is the per-model-call projection seam instead.
+        if (kitKeyProviders.has(name)) {
+          problems.push(
+            `"agent" is re-provided by a windowGatedKit(...) — it must NOT be: eve's built-in \`agent\` is this deployment's delegation route, and a dynamic tool of that name COLLIDES with it (eve harness/tool-loop.js throws and kills the model call). Delete the kit key; the gate is access/untrusted-projection.ts.`,
+          );
+        }
+        if (isSentinel) {
+          problems.push(
+            `agent/tools/agent.ts is a disableTool() sentinel — it must NOT be: the sentinel removes eve's built-in \`agent\`, and since OPE-1145 item 2 nothing re-provides it, so every seat would lose delegation entirely. Roster artefacts are stale; run \`oe build --accept\`.`,
+          );
+        }
+      } else {
+        if (!kitKeyProviders.has(name)) {
+          problems.push(
+            `framework tool "${name}" is grain-gated but no windowGatedKit(...) in packages/core/agent/tools/ re-provides it per grain — add it as a key to a kit resolver (e.g. sandbox_tools.ts for the sandbox/egress names), or the tool is simply absent on every grain`,
+          );
+        }
+        if (mountOf(name) === "opt-in") {
+        // The OPT-IN half of the guard: the installed eve mounts NOTHING under this name on its own, so the sentinel disables nothing and, since eve 0.45.0, is refused outright.
+        // The purpose moves one door along — an app shim that is NOT a sentinel IS the opt-in, and it mounts the name statically on standing seats — so the demand returns the moment the app opts in.
+          if (shim !== undefined && !isSentinel) {
+            problems.push(
+              `framework tool "${name}" is grain-gated, and the installed eve mounts it only when the app OPTS IN — but its app shim agent/tools/${name}.ts is an authored tool rather than a \`disableTool()\` sentinel, which IS opting in. An authored tool of a framework name mounts on EVERY session incl. standing seats, silently bypassing the grain gate; make the shim a \`disableTool()\` sentinel and let the windowGatedKit(...) resolver provide it per grain.`,
+            );
+          }
+        } else if (!isSentinel) {
+          problems.push(
+            `framework tool "${name}" is grain-gated but its app shim agent/tools/${name}.ts is not a \`disableTool()\` sentinel — without it eve's built-in of that name stays mounted on EVERY session incl. standing seats, silently bypassing the grain gate`,
+          );
+        }
+      }
+    } else if (!new RegExp(`windowGated\\(\\s*"${name}"`).test(coreSrc)) {
+      problems.push(
+        `gated tool "${name}" does not wrap its export in windowGated("${name}", …) — packages/core/agent/tools/${name}.ts must \`export default windowGated("${name}", defineTool({…}))\` or the wide-hands tool mounts statically on standing seats (silent static re-introduction). If it should no longer be gated, move it to WINDOW_UNGATED_TOOLS.`,
+      );
+    }
+  }
+
+  // This numbered slot is retired: `agent` is eve's built-in and nothing else, pinned by rule 4's delegation-pair branch and by rule 3's grain matrix. Do NOT reinstate a shape rule for it without first checking what the installed eve does with the name.
+
+  // 5. Shim integrity — every core tool is deployed, and every core re-export resolves (the Stage-C
+  //    "unmounted because the shim was missing" bug guard).
+  for (const name of coreByName.keys()) {
+    if (!appShims.has(name)) {
+      problems.push(
+        `core tool packages/core/agent/tools/${name}.ts has NO deploy shim agent/tools/${name}.ts — it will not be mounted in the deployed app; add \`export { default } from "@open-everywhere/core/agent/tools/${name}.js"\``,
+      );
+    }
+  }
+  for (const [slug, src] of appShims) {
+    const m = src.match(/@open-everywhere\/core\/agent\/tools\/([\w-]+)\.js/u);
+    if (m && !coreByName.has(m[1])) {
+      problems.push(`agent/tools/${slug}.ts re-exports @open-everywhere/core/agent/tools/${m[1]}.js but no such core tool file exists (dangling shim)`);
+    }
+  }
+
+  // The job kit is default-deny and needs no totality rule, but it needs the STALE-ROW guard the other tables get: a kit row that is no longer a tool reads as "the job can still do X" and hides that X's replacement is now silently withheld.
+  // Scoped to a REAL-surface check, because this rule compares a table against a surface it did not come from: table identity is the signal, and a test can still drive it by injecting `jobKit` alone.
+  if (gated === WINDOW_GATED_TOOLS && ungated === WINDOW_UNGATED_TOOLS) {
+    for (const name of jobKit) {
+      if (!surface.has(name)) {
+        problems.push(
+          `JOB_WAKE_TOOLS names "${name}" which is neither a tool file nor a mounted framework tool — remove it or fix the name (a stale job-kit row misrepresents what an un-escalated durable-job wake can do)`,
+        );
+      }
+    }
+  }
+
+  return problems;
+}