@open-everywhere/core 0.1.0

package/dist/agent/memory/domain.js

@@ -0,0 +1,911 @@
+// A channel belongs to AT MOST ONE domain, enforced at config load by assertChannelExclusivity, so a fact has exactly one home and resolution is a single hop.
+// This is ROUTING, not ISOLATION: a reach entry decides where a surface lands, never a confidentiality boundary. See docs/capabilities/memory.md.
+import { windowTopologyEnabled } from "../access/capabilities.js";
+import { isQualifiedPrincipalKey } from "../identity/principal-key.js";
+import { isGroupSegment, parseSurfaceKeyEntry, surfaceKeyEntriesEquivalent, surfaceKeyEntriesIntersect, surfaceKeyEntryContains, surfaceKeyEntryMatches, } from "../identity/surface-key-grammar.js";
+import { tenantRungRemedy } from "../access/tenant-admission.js";
+import { DM_ANCHOR_DOMAIN_PREFIX } from "../channels/window-key.js";
+// channels/seat-admission.ts imports only a TYPE from the wake envelope, so this edge adds no runtime cycle back into memory/.
+import { DEFAULT_ADMISSION, admissionFunctionNames, isAdmissionFunctionName } from "../channels/seat-admission.js";
+import { credentialGrantDeclarationProblems } from "../access/credential-grant.js";
+import { domainCredentialProblems } from "../access/domain-credentials.js";
+/**
+ * The name travels as a windowId through the session registry key and the supervisor token, where "/" and ":" are structure.
+ * Bounded at 64 characters so a name can never crowd out the token's other segments.
+ */
+export const WINDOW_GROUP_NAME_RE = /^(?=.{1,64}$)[a-z0-9]+(?:-[a-z0-9]+)*$/;
+export function memoryRefs(domain) {
+    if (!domain.memory)
+        return [];
+    return Array.isArray(domain.memory) ? [...domain.memory] : [domain.memory];
+}
+export function defineDomain(domain) {
+    return domain;
+}
+const parseReachEntry = parseSurfaceKeyEntry;
+const entryMatchesKey = surfaceKeyEntryMatches;
+/** Is every key of `inner` also a key of `outer`? Total on intersecting entries, because the grammar's sets are laminar. */
+const entryContains = surfaceKeyEntryContains;
+function parseEntries(entries) {
+    const out = [];
+    for (const entry of entries ?? []) {
+        const parsed = parseReachEntry(entry);
+        if (parsed)
+            out.push({ entry, parsed });
+    }
+    return out;
+}
+/**
+ * The grammar's sets are LAMINAR: when two entries intersect, one CONTAINS the other. So "narrowest" is a total order over the matching entries and this single pass finds it.
+ * Entries denoting the SAME set have no order. Within one domain the first is kept; across domains assertChannelExclusivity refuses the pair at config load.
+ */
+function mostSpecificMatch(entries, channelKey) {
+    let best;
+    for (const candidate of entries) {
+        if (!entryMatchesKey(candidate.parsed, channelKey))
+            continue;
+        if (best === undefined || entryContains(best.parsed, candidate.parsed)) {
+            if (best !== undefined && surfaceKeyEntriesEquivalent(best.parsed, candidate.parsed))
+                continue;
+            best = candidate;
+        }
+    }
+    return best;
+}
+/**
+ * The EXACT keys of a `reach` list — the enumerable half. Container entries are deliberately absent: a container still admits surfaces created tomorrow, so no list can stand for it.
+ * Declaration order is preserved, because several callers take the FIRST entry as the domain's anchor surface.
+ */
+export function domainRoster(domain) {
+    const out = [];
+    for (const entry of domain.reach ?? []) {
+        const parsed = parseReachEntry(entry);
+        if (parsed?.kind === "surface" && !parsed.glob)
+            out.push(entry);
+    }
+    return out;
+}
+export function domainContainers(domain) {
+    const out = [];
+    for (const entry of domain.reach ?? []) {
+        const parsed = parseReachEntry(entry);
+        if (parsed && (parsed.kind !== "surface" || parsed.glob))
+            out.push(entry);
+    }
+    return out;
+}
+/**
+ * One domain's verdict on one key: the MOST SPECIFIC matching `reach` entry, or the `exclude` entry that carved it back out — exclude ALWAYS wins.
+ * Exported so a vendor fence that re-walks the decision asks this same question; two implementations are how a fence and the router come to disagree about who owns a surface.
+ */
+export function domainReachVerdict(domain, channelKey) {
+    const admits = mostSpecificMatch(parseEntries(domain.reach), channelKey);
+    if (admits === undefined)
+        return undefined;
+    const excluded = mostSpecificMatch(parseEntries(domain.exclude), channelKey);
+    return excluded === undefined ? { kind: "admits", entry: admits.entry } : { kind: "excluded", entry: excluded.entry };
+}
+/**
+ * MOST SPECIFIC WINS: among the domains that admit the key, the one whose winning entry denotes the NARROWEST set takes it. Only explicit domains — the `match` pseudo-domains are selected from trust/mode, never by channel key.
+ * PURE and SYNCHRONOUS, and it stays that way: resolveAccess and EventScopeGrant.grantsRead sit downstream, so a fetch here would make EffectiveAccess time-varying.
+ */
+export function resolveDomainForChannel(channelKey, domains) {
+    let winner;
+    let vetoed;
+    for (const d of domains) {
+        const verdict = domainReachVerdict(d, channelKey);
+        if (!verdict)
+            continue;
+        if (verdict.kind === "excluded") {
+            // Carved out. Keep WHY for the provenance, and keep looking: another domain may reach it.
+            vetoed ??= `excluded:${d.name}:${verdict.entry}`;
+            continue;
+        }
+        const parsed = parseReachEntry(verdict.entry);
+        if (!parsed)
+            continue;
+        if (winner === undefined || (entryContains(winner.parsed, parsed) && !surfaceKeyEntriesEquivalent(winner.parsed, parsed))) {
+            winner = { domain: d, parsed, entry: verdict.entry };
+        }
+    }
+    if (!winner)
+        return { domain: undefined, via: vetoed ?? "none" };
+    const exact = winner.parsed.kind === "surface" && !winner.parsed.glob;
+    return { domain: winner.domain, via: exact ? "roster" : `container:${winner.entry}` };
+}
+export function domainForChannel(channelKey, domains) {
+    return resolveDomainForChannel(channelKey, domains).domain;
+}
+export function criteriaDomain(match, domains) {
+    return domains.find((d) => d.match === match);
+}
+/** Mirrors the memory resolver's own classification (memory/resolve.ts's dm branch plus the trust gate). Never returns "org" — that layer is unconditional, and knobLayersFor adds it itself. */
+export function domainMatchFor(mode, trust) {
+    if (mode === "mpim")
+        return undefined;
+    if (mode === "dm")
+        return trust === "internal" ? "dm" : "public";
+    if (trust === "external")
+        return "public";
+    return undefined;
+}
+export function nameDropWakeEnabled(channelKey, domains) {
+    const explicit = domainForChannel(channelKey, domains);
+    if (explicit)
+        return explicit.nameDropWake === true;
+    return criteriaDomain("org", domains)?.nameDropWake === true;
+}
+/**
+ * `undefined` means NO DOMAIN OVERRIDE, which the caller resolves to the org default field by field. It is not a value.
+ * An ABSENT `channelKey` is a room the caller could not name, not a reason to skip the question: it returns the `org` pseudo-domain's declaration, and only an explicit domain needs the key.
+ */
+export function externalPolicyOverrideFor(channelKey, domains) {
+    const explicit = channelKey === undefined ? undefined : domainForChannel(channelKey, domains);
+    if (explicit)
+        return explicit.externalPolicy;
+    return criteriaDomain("org", domains)?.externalPolicy;
+}
+/**
+ * WARN ONLY, NEVER REFUSES BOOT: two of the three external-room legs (vendor-external, guest-present) are runtime facts, so a channel armed by one carries no `public` declaration and a refusal would be a false positive.
+ * `orgDefaultRoomGrain` and `declaredPublic` are PURE INPUTS, not the runtime singletons: the trust register is populated by a separate boot import, so reading it here would race boot order.
+ */
+export function warnSilentRoomGrainWithoutPublicSignal(domains, orgDefaultRoomGrain, declaredPublic, deps = {}) {
+    const warn = deps.warn ?? ((m) => console.warn(m));
+    const checked = new Set();
+    for (const d of domains) {
+        for (const ch of domainRoster(d)) {
+            if (checked.has(ch))
+                continue;
+            checked.add(ch);
+            const override = externalPolicyOverrideFor(ch, domains);
+            const roomGrain = override?.roomGrain ?? orgDefaultRoomGrain;
+            if (roomGrain !== "silent")
+                continue;
+            const segs = ch.split("/");
+            const workspaceKey = segs.slice(0, 2).join("/");
+            if (declaredPublic(workspaceKey, ch))
+                continue;
+            warn(`[open-everywhere:external-policy] channel "${ch}" (domain "${d.name}") resolves ` +
+                `externalPolicy.roomGrain: "silent" but no "public" trust entry covers it in ` +
+                `agent/identity/surfaces.ts — the OPERATOR-DECLARED leg of the external-room class can ` +
+                `never arm here from static config. This is fine if a vendor-external (Slack Connect / ` +
+                `Teams shared channel) or guest-present signal is meant to arm it at runtime instead; if ` +
+                `the static declaration was meant to arm it, add a "public" surface entry for this channel.`);
+        }
+    }
+}
+/**
+ * Default everywhere is OFF, which is ADDRESSED-ONLY, never seatless.
+ * This is NOT the seat gate — the seat stands either way (windowedSupervisorEnabled). A refused ambient message enters the seat's context on its next wake.
+ */
+export function ambientSupervisorEnabled(channelKey, domains) {
+    const explicit = domainForChannel(channelKey, domains);
+    if (explicit)
+        return explicit.ambientSupervisor === true;
+    return criteriaDomain("org", domains)?.ambientSupervisor === true;
+}
+/** Decides nothing and changes nothing about whether the supervisor runs. It only names the outcome so an ingress can record it (channels/ambient-skip.ts); `undefined` means the supervisor DID engage. */
+export function ambientSkipFor(channelKey, domains) {
+    const routing = resolveDomainForChannel(channelKey, domains);
+    if (routing.domain) {
+        if (routing.domain.ambientSupervisor === true)
+            return undefined;
+        return { reason: "domain-refused", domain: routing.domain.name, via: routing.via };
+    }
+    if (criteriaDomain("org", domains)?.ambientSupervisor === true)
+        return undefined;
+    return { reason: "no-domain", via: routing.via };
+}
+/** Returns the NAME, not the function: the resolver stays free of the registry, which is what lets the config-load validation and the wake path read the same answer. */
+export function admissionNameFor(channelKey, domains) {
+    const explicit = domainForChannel(channelKey, domains);
+    if (explicit)
+        return explicit.admission ?? DEFAULT_ADMISSION;
+    return criteriaDomain("org", domains)?.admission ?? DEFAULT_ADMISSION;
+}
+/**
+ * True only when the code capability windowTopologyEnabled() holds (the one gate, default OFF, fail-closed) AND the channel resolves to a seat domain. Every channel the bot is in gets a seat.
+ * Gate off means false for every channel, so the caller keeps the native per-container `(org, surfaceKey)` grain unchanged.
+ */
+export function windowedSupervisorEnabled(channelKey, domains) {
+    if (!windowTopologyEnabled())
+        return false;
+    return standingSeatDomainFor(channelKey, domains) !== undefined;
+}
+/**
+ * Undefined only when the deployment declares NO `org` pseudo-domain and the channel is in no explicit domain; the channel then keeps the native per-container path. That is the one fail-closed arm.
+ * Ignores the capability gate on purpose, so a config-load check can ask which domain WOULD seat a channel.
+ */
+export function standingSeatDomainFor(channelKey, domains) {
+    return domainForChannel(channelKey, domains) ?? criteriaDomain("org", domains);
+}
+/** When defined, its `name` is the grain the seat's session, registry row and token are anchored by. Memory, access and trust stay DOMAIN-anchored under every topology. */
+export function windowedDomainFor(channelKey, domains) {
+    if (!windowedSupervisorEnabled(channelKey, domains))
+        return undefined;
+    return standingSeatDomainFor(channelKey, domains);
+}
+/**
+ * A channel with no explicit domain resolves `"solo"`, which gives that channel its OWN window, so an undeclared room never shares context with another.
+ * The SOLE reader of `mode`, consulted only after windowedSupervisorEnabled has confirmed the channel windows.
+ */
+export function windowModeFor(channelKey, domains) {
+    return domainForChannel(channelKey, domains)?.mode ?? "solo";
+}
+/**
+ * MOST SPECIFIC WINS, the same rule one grain up: the group whose winning entry denotes the narrowest set takes the key, whatever order the groups are declared in.
+ * A group that reaches the key but then excludes it does NOT capture it — the sweep continues, so another group can still take it.
+ */
+export function windowGroupFor(channelKey, domain) {
+    let winner;
+    for (const group of domain.windows ?? []) {
+        const admits = mostSpecificMatch(parseEntries(group.reach), channelKey);
+        if (admits === undefined)
+            continue;
+        if (mostSpecificMatch(parseEntries(group.exclude), channelKey) !== undefined)
+            continue;
+        if (winner === undefined || (entryContains(winner.parsed, admits.parsed) && !surfaceKeyEntriesEquivalent(winner.parsed, admits.parsed))) {
+            winner = { group, parsed: admits.parsed };
+        }
+    }
+    return winner?.group;
+}
+/**
+ * Undefined is the ordinary answer and means no group spoke: the caller keeps the `mode` residue untouched.
+ * Like windowModeFor it does NOT re-check windowedSupervisorEnabled; it is consulted only after the caller has confirmed the channel windows.
+ */
+export function windowIdFor(channelKey, domains) {
+    const domain = domainForChannel(channelKey, domains);
+    if (!domain)
+        return undefined;
+    return windowGroupFor(channelKey, domain)?.name;
+}
+/** Everything decidable from one domain alone. Cross-domain problems — a name two domains share, a name that is also a domain name, two groups that can elect one key — belong to assertWindowGroupExclusivity. */
+function windowGroupShapeProblems(d) {
+    const groups = d.windows ?? [];
+    const bad = [];
+    if (d.match !== undefined) {
+        bad.push(`  "${d.name}" (match "${d.match}") must not set windows — a standing window is a TEAM-section feature, never a pseudo-domain (org=the "window everything" footgun; public/dm=external/personal surface)`);
+    }
+    if (groups.length === 0) {
+        bad.push(`  "${d.name}" declares an EMPTY windows list — that grants nothing and reads as if it did; name at least one group, or drop the field`);
+    }
+    const seen = new Set();
+    for (const g of groups) {
+        if (!WINDOW_GROUP_NAME_RE.test(g.name)) {
+            bad.push(`  "${d.name}" names the window group "${g.name}", which is not a legal window id — a group name is lowercase kebab (${String(WINDOW_GROUP_NAME_RE)}) because it travels as the windowId through the session registry key ("oe-domain::<name>") and the supervisor token ("oe-dom:<domain>:win:<name>:oe-sup:g<gen>"), where "/" and ":" are structure`);
+            continue; // an unusable name makes every further report about it noise
+        }
+        if (seen.has(g.name)) {
+            bad.push(`  "${d.name}" declares the window group "${g.name}" TWICE — a group name is the window id, so the second declaration could never be elected`);
+            continue;
+        }
+        seen.add(g.name);
+        if ((g.reach?.length ?? 0) === 0) {
+            bad.push(`  window group "${g.name}" of "${d.name}" names no members — give it a reach list, or drop it (an empty group elects nobody)`);
+        }
+        if ((g.exclude?.length ?? 0) > 0 && (g.reach?.length ?? 0) === 0) {
+            bad.push(`  window group "${g.name}" of "${d.name}" sets exclude with no reach — an exclusion carves out of a REACH, so this pair is dead config; delete it`);
+        }
+        // The "is this key a member of this domain" check needs the WHOLE roster, so it lives in assertWindowGroupExclusivity.
+        for (const entry of g.exclude ?? []) {
+            const parsed = parseReachEntry(entry);
+            if (!parsed || parsed.kind === "group") {
+                bad.push(`  window group "${g.name}" of "${d.name}" excludes "${entry}", which is not a legal exclusion entry (a surface key, or a same-level \`prefix*\` glob)`);
+                continue;
+            }
+            if (parsed.kind === "tenant") {
+                bad.push(`  window group "${g.name}" of "${d.name}" excludes the whole tenant "${entry}" — a tenant-wide exclusion either cancels the group's reach outright or means nothing; name the surfaces`);
+                continue;
+            }
+            // A group that names a key outright and then excludes it elects NOBODY for that key: it falls through to the `mode` residue, which is a different window from the one the operator wrote.
+            const ownExact = domainRoster(g).find((ch) => entryMatchesKey(parsed, ch));
+            if (ownExact !== undefined) {
+                bad.push(`  window group "${g.name}" of "${d.name}" excludes "${entry}" but also reaches "${ownExact}" outright — an exclusion and the exact key it cancels are a contradiction, and the key would silently fall through to this domain's \`mode\` residue instead of the group: delete the reach entry, or the exclusion.`);
+            }
+        }
+        for (const entry of g.reach ?? []) {
+            const parsed = parseReachEntry(entry);
+            // The GROUP rung parses, so without this refusal it would land as silently dead config that reads like membership.
+            if (parsed?.kind === "group") {
+                bad.push(`  window group "${g.name}" of "${d.name}" reaches "${entry}", which uses the GROUP rung (\`<marker>:<id>\`) — that shape belongs to the TRUST registry (agent/identity/surfaces.ts), never to a window group`);
+                continue;
+            }
+            if (!parsed) {
+                bad.push(`  window group "${g.name}" of "${d.name}" reaches "${entry}", which is not a legal reach entry (see Domain.reach)`);
+                continue;
+            }
+            // An EXACT key is checked for domain MEMBERSHIP one level up (it needs the whole roster). A CONTAINER must intersect one of the domain's own, because a window narrows WITHIN its domain and can never reach past it.
+            if (parsed.kind === "surface" && !parsed.glob)
+                continue;
+            const withinDomainReach = domainContainers(d).some((own) => {
+                const ownParsed = parseReachEntry(own);
+                return ownParsed !== undefined && surfaceKeyEntriesIntersect(ownParsed, parsed);
+            });
+            if (!withinDomainReach) {
+                bad.push(`  window group "${g.name}" of "${d.name}" reaches container "${entry}", which intersects none of that domain's own containers — a window narrows WITHIN its domain's reach and can never reach past it`);
+            }
+        }
+    }
+    return bad;
+}
+/**
+ * Refuses a `match` (org/public/dm) pseudo-domain that sets `mode` or `windows`, listing every problem at once — which is why a pseudo-domain seats every channel SOLO.
+ * Call it at the config-load seam beside assertDomainsValid, assertChannelExclusivity and assertWindowGroupExclusivity.
+ */
+export function assertUnifiedDomainTrust(domains) {
+    const bad = [];
+    for (const d of domains) {
+        if (d.windows !== undefined)
+            bad.push(...windowGroupShapeProblems(d));
+        if (d.mode === undefined)
+            continue;
+        const isPseudo = d.match !== undefined;
+        if (isPseudo) {
+            bad.push(`  "${d.name}" (match "${d.match}") must not set mode — a standing window is a TEAM-section feature, never a pseudo-domain (org=the "window everything" footgun; public/dm=external/personal surface)`);
+        }
+    }
+    if (bad.length > 0) {
+        throw new Error("open-everywhere: invalid standing-window topology configuration:\n" +
+            bad.join("\n") +
+            "\n(memory/domain.ts assertUnifiedDomainTrust).");
+    }
+}
+/**
+ * Platforms whose binding TRUST VERDICT is authoritative: the mapper re-derives it from a live per-wake check (Slack's externally-shared test; local is internal by construction).
+ * On every OTHER platform `trust: "external"` means NOT DETERMINED, not "guests present" — so a guard that refuses on it alone refuses those platforms entirely on a deployment that has not vouched them.
+ */
+export const BINDING_TRUSTED_PLATFORMS = new Set(["slack", "local"]);
+function vouchedPredicate(vouched) {
+    if (typeof vouched === "function")
+        return vouched;
+    const vset = new Set(vouched);
+    return (workspaceKey, surfaceKey) => vset.has(workspaceKey) || vset.has(surfaceKey);
+}
+/**
+ * The config-load twin of the live window election: a named `windows` group first, then the `mode` residue.
+ * ROSTER ONLY: a container-admitted surface is not enumerable without I/O.
+ */
+function windowMemberSets(d) {
+    const out = new Map();
+    for (const ch of domainRoster(d)) {
+        const windowId = windowGroupFor(ch, d)?.name ?? (d.mode === "unified" ? d.name : ch);
+        const members = out.get(windowId);
+        if (members)
+            members.push(ch);
+        else
+            out.set(windowId, [ch]);
+    }
+    return out;
+}
+/**
+ * A standing WINDOW holding MORE THAN ONE member requires every register-gated member to be operator-vouched-internal, throwing at config load. A one-member window cannot bleed cross-context and is exempt.
+ * A source passes on an operator vouch, on `OE_TRUST=internal`, or on a BINDING_TRUSTED_PLATFORMS platform; everything else fails closed. Membership is read from EXACT `reach` entries only.
+ */
+export function assertWindowSourcesVouched(domains, vouched) {
+    const isInternal = vouchedPredicate(vouched);
+    const trustEnv = (process.env.OE_TRUST ?? "").trim().toLowerCase() === "internal";
+    const bad = [];
+    for (const d of domains) {
+        for (const [windowId, members] of windowMemberSets(d)) {
+            if (members.length <= 1)
+                continue; // single-source window: cannot bleed cross-context
+            const where = windowId === d.name ? `domain "${d.name}"` : `window "${windowId}" of domain "${d.name}"`;
+            for (const ch of members) {
+                const segs = ch.split("/");
+                const platform = segs[0] ?? "";
+                if (BINDING_TRUSTED_PLATFORMS.has(platform))
+                    continue; // trust is a binding fact, not the register
+                const workspaceKey = segs.slice(0, 2).join("/"); // `platform/workspace` (memory/partition.ts)
+                const okay = isInternal(workspaceKey, ch) || trustEnv;
+                if (!okay) {
+                    bad.push(`  ${where} includes UN-vouched source "${ch}" in a multi-source (${members.length}-channel) cross-surface window — vouch it in agent/identity/surfaces.ts (add "${ch}" or its workspace "${workspaceKey}"), or set OE_TRUST=internal for an internal-only deploy` +
+                        // A Notion TRUST ROOT cannot satisfy this gate: the ancestor walk runs per delivery against the live Notion API, and config load has no delivery and no credential.
+                        (platform === "notion"
+                            ? `. A Notion TRUST ROOT does not satisfy this gate: the ancestor walk runs per delivery against the live Notion API, so config load cannot resolve it. Declare this page in the register as well`
+                            : // 🔴 THIS GATE ACCEPTS A TEAMS TENANT ENTRY, and so does the single-window privacy
+                                // floor: isVouchedSurface walks the declaration rungs, so one tenant line serves both planes.
+                                // Keep this advice in sync with identity/trust-preflight.ts undeclaredSurfacesFix.
+                                platform === "teams"
+                                    ? `. For TEAMS, this tenant entry is enough for a cross-surface SINGLE WINDOW member too: the window privacy floor walks the declaration rungs (OPE-1521), so a "teams/<tenantId>" declaration admits every room under the tenant. 🔴 Weigh that REACH — it covers rooms you never named, a cross-tenant Connect/shared channel among them, because an inbound Teams activity usually omits membershipType. Declare a "teams/<tenantId>/<threadId>" key to narrow it to one channel. See docs/deploy/surfaces/teams.md`
+                                    : ``));
+                }
+            }
+        }
+    }
+    if (bad.length > 0) {
+        throw new Error("open-everywhere: multi-source cross-surface window has un-vouched source(s):\n" +
+            bad.join("\n") +
+            "\n(memory/domain.ts assertWindowSourcesVouched).");
+    }
+}
+/** Chosen below the design's stated smell threshold, which calls a 40-channel governance domain clearly wrong: the venue's safety story is a SMALL, uniformly-privileged audience. */
+export const GOVERNANCE_CHANNEL_MAX = 20;
+export function governanceDomains(domains) {
+    return domains.filter((d) => d.governance === true);
+}
+/** Config designation only — arming is the separate runtime floor check (access/audience-floor.ts). */
+export function isGovernanceChannel(channelKey, domains) {
+    return domainForChannel(channelKey, domains)?.governance === true;
+}
+/**
+ * The FIRST channel of the FIRST governance domain, else `fallback` — the legacy `OE_ACCESS_ADMIN_CHANNEL` alias, which has no roster, so nothing unlocks there.
+ * Undefined means no governance channel is configured at all: a read redirects to the requester's DM, and a write refuses.
+ */
+export function governanceChannelFor(domains, fallback) {
+    const first = governanceDomains(domains).flatMap((d) => domainRoster(d))[0];
+    return first ?? fallback;
+}
+/** Defaults to `"channel"` when absent or set anywhere the lint would have rejected. Fail-safe either way: the default never DM-delivers, and the opt-in only narrows what a room may hear. */
+export function governanceDeliveryMode(domains) {
+    return criteriaDomain("org", domains)?.governanceDelivery === "dm-fallback" ? "dm-fallback" : "channel";
+}
+/**
+ * Config-load fail-loud lint: a governance domain must have an explicit `reach`, a non-empty `admins` roster, at most GOVERNANCE_CHANNEL_MAX channels, and every channel operator-vouched-internal.
+ * `vouched` is a PURE INPUT, never the runtime trust singleton, because the register is populated by a separate boot import.
+ */
+export function assertGovernanceDomains(domains, vouched) {
+    const isInternal = vouchedPredicate(vouched);
+    const trustEnv = (process.env.OE_TRUST ?? "").trim().toLowerCase() === "internal";
+    const bad = [];
+    for (const d of domains) {
+        // governanceDelivery is a single ORG-WIDE knob. Set on any other domain it would read as a per-domain policy that nothing implements, so it fails loud rather than being silently ignored.
+        if (d.governanceDelivery !== undefined && d.match !== "org") {
+            bad.push(`  "${d.name}" sets governanceDelivery, but that is a single ORG-WIDE knob — move it to the "org" pseudo-domain (the { match: "org" } domain); there is deliberately no per-domain delivery policy`);
+        }
+        if (d.governance !== true)
+            continue;
+        const channels = domainRoster(d);
+        if (d.match !== undefined || d.reach === undefined) {
+            bad.push(`  "${d.name}" is governance but has no reach — a governance venue must list concrete channels, never a match/pseudo-domain`);
+        }
+        if (!d.admins || d.admins.length === 0) {
+            bad.push(`  "${d.name}" is governance but has an empty admins roster — a governance venue with no admins unlocks nothing (add the org's admin principal ids to its admins list)`);
+        }
+        const governanceContainers = domainContainers(d);
+        if (governanceContainers.length > 0) {
+            // Not a confidentiality rule but a STRUCTURAL one: the channel cap and the per-channel vouch are decidable only over an enumerable roster.
+            // A same-level glob is narrower but still unbounded — it admits surfaces created tomorrow — so it is refused on the same grounds.
+            bad.push(`  "${d.name}" is governance but reaches container(s) [${governanceContainers.join(", ")}] — a governance venue is a SMALL, enumerated, individually-vouched audience, and neither the ${GOVERNANCE_CHANNEL_MAX}-channel cap nor the per-channel vouch can be decided over an unbounded container, whether it is a whole tenant or a \`prefix*\` glob (list the concrete channels, or drop governance from this domain)`);
+        }
+        if (d.exclude !== undefined) {
+            // A governance domain may not reach a container at all, so an exclusion here is dead config. It must not read as "this venue's membership is computed".
+            bad.push(`  "${d.name}" is governance but sets exclude [${d.exclude.join(", ")}] — an exclusion carves surfaces out of a CONTAINER, and a governance venue may not reach one at all; its audience is the exact keys of its \`reach\` and nothing else (drop exclude)`);
+        }
+        if (channels.length > GOVERNANCE_CHANNEL_MAX) {
+            bad.push(`  "${d.name}" is governance with ${channels.length} channels — that exceeds the ${GOVERNANCE_CHANNEL_MAX}-channel governance cap (a governance domain is a SMALL uniformly-privileged venue; split it or re-tag)`);
+        }
+        for (const ch of channels) {
+            const segs = ch.split("/");
+            const platform = segs[0] ?? "";
+            if (BINDING_TRUSTED_PLATFORMS.has(platform))
+                continue; // trust is a binding fact, confirmed per-wake
+            const workspaceKey = segs.slice(0, 2).join("/");
+            if (!(isInternal(workspaceKey, ch) || trustEnv)) {
+                bad.push(`  "${d.name}" is governance but its channel "${ch}" is not operator-vouched-internal — vouch it in agent/identity/surfaces.ts (add "${ch}" or its workspace "${workspaceKey}"), or set OE_TRUST=internal for an internal-only deploy`);
+            }
+        }
+    }
+    if (bad.length > 0) {
+        throw new Error("open-everywhere: invalid governance domain(s):\n" +
+            bad.join("\n") +
+            "\n(memory/domain.ts assertGovernanceDomains).");
+    }
+}
+/**
+ * The channel's OWN explicit domain's reportChannel, and nothing else. Deliberately not inherited and not org-wide: only the audience already sharing this domain's brain can be said to have agreed to the redirect.
+ * A channel in no explicit domain gets no redirect at all.
+ */
+export function reportChannelFor(channelKey, domains) {
+    return domainForChannel(channelKey, domains)?.reportChannel;
+}
+/**
+ * Two rules: reportChannel may only be set on a domain with a `reach`, and it must name one of THAT domain's own channels — a redirect out of the domain posts to an audience the domain never agreed to.
+ * Whether the surface can actually be posted into is NOT checked here (the dispatch registry's boot order is not guaranteed); it is checked at routine-creation time.
+ */
+export function assertReportChannels(domains) {
+    const bad = [];
+    for (const d of domains) {
+        const rc = d.reportChannel;
+        if (rc === undefined)
+            continue;
+        if (d.reach === undefined || d.match !== undefined) {
+            bad.push(`  "${d.name}" sets reportChannel but has no reach — a report redirect must name a concrete room inside a concrete domain, never a match/pseudo-domain`);
+            continue;
+        }
+        const roster = domainRoster(d);
+        if (!roster.includes(rc)) {
+            bad.push(`  "${d.name}" sets reportChannel "${rc}", which is not one of its own exact reach entries — a routine may only be redirected INSIDE its domain, to a room config names outright (add "${rc}" to "${d.name}".reach, or point reportChannel at one of: ${roster.join(", ")})`);
+        }
+    }
+    if (bad.length > 0) {
+        throw new Error("open-everywhere: invalid domain reportChannel(s):\n" + bad.join("\n") + "\n(memory/domain.ts assertReportChannels — OPE-148).");
+    }
+}
+export function requestorEntitlementChecksEnabled(domains) {
+    return criteriaDomain("org", domains)?.requestorEntitlementChecks === true;
+}
+/** A doctrine guard, not a typo guard: `requestorEntitlementChecks` may appear ONLY on the `org` pseudo-domain. A per-room pre-check is the "different members of one room get different answers" shape the design rejected, so a misplacement is refused loudly instead of silently ignored. */
+export function assertComplianceDomains(domains) {
+    const bad = domains
+        .filter((d) => d.requestorEntitlementChecks !== undefined && d.match !== "org")
+        .map((d) => `  "${d.name}" sets requestorEntitlementChecks — that is an ORG-LEVEL compliance opt-in and ` +
+        `belongs on the \`org\` pseudo-domain (match: "org"), never on a room/criteria domain ` +
+        `(a per-room requestor pre-check is the per-user-answers-inside-a-room shape the design rejected)`);
+    if (bad.length > 0) {
+        throw new Error("open-everywhere: invalid compliance-mode config:\n" +
+            bad.join("\n") +
+            "\n(memory/domain.ts assertComplianceDomains).");
+    }
+}
+/** Platforms not listed default to `neutral`. Deliberately not extrapolated beyond the design's evidence: only GitHub has a stated non-neutral default. */
+const PLATFORM_ENGAGEMENT_TIER_DEFAULTS = {
+    github: "reserved",
+};
+/** UNLIKE the behaviour opt-ins, this is a TUNING knob and INHERITS: explicit domain, `org` pseudo-domain, then the per-platform default. Total — it always yields a tier, so callers carry no unset case. */
+export function engagementTierFor(channelKey, domains) {
+    const explicit = domainForChannel(channelKey, domains)?.engagementTier;
+    if (explicit)
+        return explicit;
+    const org = criteriaDomain("org", domains)?.engagementTier;
+    if (org)
+        return org;
+    const platform = channelKey.split("/")[0] ?? "";
+    return PLATFORM_ENGAGEMENT_TIER_DEFAULTS[platform] ?? "neutral";
+}
+/**
+ * An unknown role name simply contributes no rung — fail-open here, because config load already failed loud on it (roles/role.ts applyRoleDefaults).
+ * `surfaceMatch` inserts the dm/public criteria domain BETWEEN `org` and `target`; precedence stays org, criteria, target.
+ */
+function knobLayersForDomain(domains, roles, target, surfaceMatch) {
+    const layers = [];
+    const rungs = [criteriaDomain("org", domains)];
+    if (surfaceMatch === "dm" || surfaceMatch === "public") {
+        rungs.push(criteriaDomain(surfaceMatch, domains));
+    }
+    rungs.push(target);
+    for (const d of rungs) {
+        if (!d)
+            continue;
+        const role = d.role !== undefined ? roles.find((r) => r.name === d.role) : undefined;
+        if (role)
+            layers.push(role);
+        layers.push(d);
+    }
+    return layers;
+}
+function knobLayersFor(channelKey, domains, roles, surfaceMatch) {
+    return knobLayersForDomain(domains, roles, domainForChannel(channelKey, domains), surfaceMatch);
+}
+/**
+ * Merges FIELD BY FIELD over framework, org, role and domain, so a domain that sets only `reasoning` keeps the inherited model id.
+ * Returns {} when nothing routes: the caller falls through to the agent.ts static model and then to the model-policy envelope for tier resolution and clamping.
+ */
+export function modelRouteFor(role, channelKey, domains, roles = [], surfaceMatch) {
+    const layers = knobLayersFor(channelKey, domains, roles, surfaceMatch);
+    let route = {};
+    for (const d of layers) {
+        const r = d?.models?.[role];
+        if (!r)
+            continue;
+        route = {
+            // id and tier are mutually exclusive per layer: setting one drops the OTHER field's inherited value. A layer that sets neither keeps both.
+            id: r.id !== undefined ? r.id : r.tier !== undefined ? undefined : route.id,
+            tier: r.tier !== undefined ? r.tier : r.id !== undefined ? undefined : route.tier,
+            // a pin follows its model: an overlay that changes `id` without `providers` DROPS the inherited pin
+            providers: r.providers ?? (r.id !== undefined && r.id !== route.id ? undefined : route.providers),
+            reasoning: r.reasoning ?? route.reasoning,
+        };
+    }
+    return route;
+}
+export const DEFAULT_STATUS_VERBS = [
+    "Tinkering",
+    "Untangling",
+    "Sifting",
+    "Weaving",
+    "Whittling",
+    "Rummaging",
+    "Distilling",
+    "Plotting",
+    "Doodling",
+    "Juggling",
+];
+/** An empty result (for example `replace` with an empty list) falls back to the defaults — the status line must never go verb-less. Blank entries are dropped. */
+export function statusVerbsFor(channelKey, domains, roles = [], surfaceMatch) {
+    const layers = knobLayersFor(channelKey, domains, roles, surfaceMatch);
+    let verbs = [...DEFAULT_STATUS_VERBS];
+    for (const d of layers) {
+        const own = (d?.statusVerbs ?? []).map((v) => v.trim()).filter((v) => v.length > 0);
+        if (own.length === 0 && d?.statusVerbsMode !== "replace")
+            continue;
+        verbs = d?.statusVerbsMode === "replace" ? own : [...verbs, ...own.filter((v) => !verbs.includes(v))];
+    }
+    return verbs.length > 0 ? verbs : DEFAULT_STATUS_VERBS;
+}
+/** `base` is the org policy default the caller passes. Each domain layer overrides it in order: `org`, dm/public criteria, explicit domain. A domain may raise or lower it. */
+export function reasoningCeilingFor(channelKey, domains, roles = [], surfaceMatch, base) {
+    let ceiling = base;
+    for (const d of knobLayersFor(channelKey, domains, roles, surfaceMatch)) {
+        if (d?.reasoningCeiling !== undefined)
+            ceiling = d.reasoningCeiling;
+    }
+    return ceiling;
+}
+/**
+ * The WRITE-TIME twin of reasoningCeilingFor, keyed by domain name because a set has no live channel to resolve from.
+ * The envelope re-clamps at call time regardless, so this is the friendlier refusal message, not the enforcement. An unknown name contributes no rung beyond `org`.
+ */
+export function reasoningCeilingForDomain(domainName, domains, roles = [], base) {
+    const target = domains.find((d) => d.name === domainName);
+    let ceiling = base;
+    for (const d of knobLayersForDomain(domains, roles, target, undefined)) {
+        if (d?.reasoningCeiling !== undefined)
+            ceiling = d.reasoningCeiling;
+    }
+    return ceiling;
+}
+/**
+ * At-most-one-domain holds by construction only if this question is decidable at config load, which is why the pattern language is a single trailing `*`: two prefixes overlap iff one is a prefix of the other.
+ * The sets form a LAMINAR family, so the intersection is never some third set nobody wrote, which is what lets an exclusion cancel it exactly.
+ */
+const entriesIntersect = surfaceKeyEntriesIntersect;
+/** Does one of this domain's exclusions cancel the WHOLE of `set`? (Exclude always wins.) */
+function exclusionCovering(domain, set) {
+    for (const entry of domain.exclude ?? []) {
+        const parsed = parseReachEntry(entry);
+        if (parsed && entryContains(parsed, set))
+            return entry;
+    }
+    return undefined;
+}
+/**
+ * Refuses only what specificity cannot order: two entries in DIFFERENT domains that denote the SAME set of keys, unless one of the two domains excludes the whole overlap.
+ * A strictly narrower entry beside a wider one is deliberately allowed; it is the ordinary way to hand a slice of a tenant to another domain.
+ */
+export function assertChannelExclusivity(domains) {
+    const clashes = [];
+    // The sweep is over domain PAIRS, so a domain's own overlapping entries (harmless) are never compared. A malformed entry is assertDomainsValid's report, not this one's.
+    const reach = domains.map((d) => ({ domain: d, entries: parseEntries(d.reach) }));
+    for (let i = 0; i < reach.length; i++) {
+        for (let j = i + 1; j < reach.length; j++) {
+            const a = reach[i];
+            const b = reach[j];
+            if (a.domain.name === b.domain.name)
+                continue;
+            for (const ae of a.entries) {
+                for (const be of b.entries) {
+                    if (!surfaceKeyEntriesEquivalent(ae.parsed, be.parsed))
+                        continue;
+                    if (exclusionCovering(a.domain, be.parsed) !== undefined)
+                        continue;
+                    if (exclusionCovering(b.domain, ae.parsed) !== undefined)
+                        continue;
+                    // A whole-tenant exclusion is itself refused (assertDomainsValid), so the tenant branch must not offer one as the remedy; the only fix there is to narrow one side.
+                    clashes.push(ae.parsed.kind === "surface" && !ae.parsed.glob
+                        ? `  "${ae.entry}" is in the reach of both "${a.domain.name}" and "${b.domain.name}"`
+                        : ae.parsed.kind === "tenant"
+                            ? `  the tenant "${ae.entry}" is reached by both "${a.domain.name}" and "${b.domain.name}", so which domain owns a key under it would depend on declaration order — narrow one of them to a \`<prefix>*\` glob or to exact keys`
+                            : `  the reach entries "${ae.entry}" ("${a.domain.name}") and "${be.entry}" ("${b.domain.name}") match exactly the SAME keys, so which domain owns them would depend on declaration order — narrow one of them, or add exclude: ["${be.entry}"] to the domain that should NOT get them`);
+                }
+            }
+        }
+    }
+    // AND AT LEAST ONE: every room a domain names OUTRIGHT must route back to that domain, or the only symptom is silence. An exact key wins by construction, and this proves it rather than assuming it.
+    // Container entries are deliberately not checked: their answer is unbounded, so there is no set of keys to round-trip.
+    for (const d of domains) {
+        for (const key of domainRoster(d)) {
+            const owner = resolveDomainForChannel(key, domains);
+            if (owner.domain?.name === d.name)
+                continue;
+            clashes.push(`  "${key}" is named by "${d.name}" but routes to ${owner.domain ? `"${owner.domain.name}"` : `NO domain (via: ${owner.via})`} — a room config names outright must land in the domain that named it, or it gets no memory, no bundle and no ambient supervisor, and says so only by staying silent`);
+        }
+    }
+    if (clashes.length > 0) {
+        throw new Error("open-everywhere: a channel belongs to at most one memory domain, and a room a domain names outright belongs to that one, but:\n" +
+            clashes.join("\n") +
+            "\nRemove the channel from all but one domain (docs/capabilities/memory.md).");
+    }
+}
+/**
+ * A window id keys the `channel_session` registry row GLOBALLY and carries no domain segment, so a group name must be unique across domains and must never equal a domain name; otherwise two domains share one standing context window.
+ * Also refuses two groups in one domain whose entries denote the SAME set, and a group member that config routes to another domain.
+ */
+export function assertWindowGroupExclusivity(domains) {
+    const clashes = [];
+    const domainNames = new Map();
+    for (const d of domains)
+        domainNames.set(d.name, d.name);
+    const groupOwner = new Map();
+    for (const d of domains) {
+        for (const g of d.windows ?? []) {
+            if (domainNames.has(g.name)) {
+                clashes.push(`  window group "${g.name}" of "${d.name}" has the same name as the domain "${g.name}" — a domain name is itself a window id (the id-equals-domain form), so the two would share the session registry row "oe-domain::${g.name}"`);
+            }
+            // A group may only slice what its domain already HOLDS, and holding is the resolver's answer: a key this domain merely reaches by container while another domain rosters it belongs to that other domain, so listing it here is dead config that reads as a grant.
+            for (const ch of domainRoster(g)) {
+                const owner = domainForChannel(ch, domains);
+                if (owner?.name !== d.name) {
+                    clashes.push(`  window group "${g.name}" of "${d.name}" lists "${ch}", which config routes to ${owner ? `domain "${owner.name}"` : "no domain"} — a window slices a domain it cannot widen, so add the key to "${d.name}".reach first (or list it in a group of the domain that does own it)`);
+                }
+            }
+            const prev = groupOwner.get(g.name);
+            if (prev !== undefined && prev !== d.name) {
+                clashes.push(`  the window group name "${g.name}" is declared by both "${prev}" and "${d.name}" — a window id keys the session registry GLOBALLY ("oe-domain::${g.name}"), so the two domains would share one standing context window`);
+            }
+            else {
+                groupOwner.set(g.name, d.name);
+            }
+        }
+        const groups = d.windows ?? [];
+        for (let i = 0; i < groups.length; i++) {
+            for (let j = i + 1; j < groups.length; j++) {
+                const a = groups[i];
+                const b = groups[j];
+                if (a.name === b.name)
+                    continue; // already reported as a duplicate by the shape check
+                for (const ae of parseEntries(a.reach)) {
+                    for (const be of parseEntries(b.reach)) {
+                        if (!surfaceKeyEntriesEquivalent(ae.parsed, be.parsed))
+                            continue;
+                        const covers = (g, set) => parseEntries(g.exclude).some((x) => surfaceKeyEntryContains(x.parsed, set));
+                        if (covers(a, be.parsed) || covers(b, ae.parsed))
+                            continue;
+                        clashes.push(ae.parsed.kind === "surface" && !ae.parsed.glob
+                            ? `  "${ae.entry}" is in the reach of both window groups "${a.name}" and "${b.name}" of "${d.name}"`
+                            : `  the reach entries "${ae.entry}" (window group "${a.name}") and "${be.entry}" (window group "${b.name}") of "${d.name}" match exactly the SAME keys, so which WINDOW owns them would depend on declaration order — narrow one of them, or add exclude: ["${be.entry}"] to the group that should NOT get them`);
+                    }
+                }
+            }
+        }
+    }
+    if (clashes.length > 0) {
+        throw new Error("open-everywhere: invalid standing-window group configuration:\n" +
+            clashes.join("\n") +
+            "\n(memory/domain.ts assertWindowGroupExclusivity — a window id keys one standing session).");
+    }
+}
+/**
+ * Config-load fail-loud validation of the structural rules: `reach` XOR `match`, the legal reach and exclude shapes, no reserved `oe-dm/` name, one domain per match value, includeOrg's requirements, and well-formed qualified admin keys.
+ * Each illegal shape is refused BY NAME rather than silently ignored, because dead config reads as a grant or a carve-out that does not exist.
+ */
+export function assertDomainsValid(domains) {
+    const bad = [];
+    const byMatch = new Map();
+    let hasOrg = false;
+    for (const d of domains) {
+        // `oe-dm/…` is the DM delegation anchor's reserved namespace (channels/window-key.ts). Its safety property is EXCLUSIVITY: no surface key may be recovered from a name an operator chose, and no anchor may resolve a real domain's channels.
+        if (d.name.startsWith(DM_ANCHOR_DOMAIN_PREFIX)) {
+            bad.push(`  "${d.name}" starts with the RESERVED prefix "${DM_ANCHOR_DOMAIN_PREFIX}" — that namespace belongs to the DM delegation anchor (channels/window-key.ts dmAnchorDomain, OPE-306) and can never be a configured domain name. Rename it.`);
+        }
+        // SHAPE only here. Whether the named credentials exist is a provider-registry question, answered at boot by assertDomainCredentialsResolvable.
+        bad.push(...domainCredentialProblems(d));
+        // SHAPE and ADMISSION both, because the admitted connector list is a reviewed constant in this tree rather than a provider registry read at boot.
+        bad.push(...credentialGrantDeclarationProblems(d));
+        // An unknown name is refused LOUD here because the runtime resolver falls back to the default, which would otherwise turn a typo into a silently WIDER seat than the deployer wrote.
+        if (d.admission !== undefined && !isAdmissionFunctionName(d.admission)) {
+            bad.push(`  "${d.name}" sets admission "${d.admission}", which is not a registered admission function — use one of: ${admissionFunctionNames().join(", ")} (channels/seat-admission.ts SEAT_ADMISSION_FUNCTIONS; a new policy is deterministic code added there by PR, never a config string)`);
+        }
+        const hasExplicit = d.reach !== undefined;
+        const hasMatch = d.match !== undefined;
+        if (hasExplicit === hasMatch) {
+            bad.push(`  "${d.name}" must have EITHER a reach list OR match (criteria), not ${hasExplicit ? "both" : "neither"}`);
+        }
+        const reachEntries = [];
+        for (const key of [...(d.reach ?? []), ...(d.exclude ?? [])]) {
+            // The GROUP rung parses, so without this refusal it would land as silently DEAD config: no memory key carries a colon, so the entry could never match anything.
+            const seg3 = key.split("/")[2];
+            if (seg3 !== undefined && isGroupSegment(seg3)) {
+                bad.push(`  "${d.name}" names "${key}", which uses the GROUP rung (\`<marker>:<id>\`) — that shape belongs to the TRUST registry (agent/identity/surfaces.ts), never to a memory domain. A memory key is \`platform/<tenant>\` or \`platform/<tenant>/<surface>\`, and no surface segment can contain a colon, so this entry could never match anything.`);
+            }
+        }
+        for (const key of d.reach ?? []) {
+            const parsed = parseReachEntry(key);
+            if (parsed?.kind === "group")
+                continue; // already reported above; do not also call it malformed
+            if (parsed) {
+                reachEntries.push({ entry: key, parsed });
+                continue;
+            }
+            const segs = key.split("/");
+            bad.push(segs.length > 3
+                ? `  "${d.name}" reaches "${key}", but INTERMEDIATE containers are not supported — a reach entry is an exact surface key \`platform/<tenant>/<surface>\`, a two-segment tenant key \`platform/<tenant>\` (e.g. "github/acme", "linear/<orgId>", "notion/<workspaceId>"), or a three-segment same-level glob \`platform/<tenant>/<prefix>*\` (e.g. "github/acme/payments-*") — never a deeper path. A deeper container ("every row under this database") needs an ancestor walk the webhook payload cannot prove and an API call per level, so it is refused BY NAME rather than admitted with no reader. List the concrete surfaces instead.`
+                : `  "${d.name}" reaches "${key}", which is none of the three legal shapes: an exact surface key \`platform/<tenant>/<surface>\`, a tenant key \`platform/<tenant>\`, or a same-level glob \`platform/<tenant>/<prefix>*\`. The glob is deliberately ONE trailing \`*\` on the LAST segment — never \`**\`, never mid-string, never in the platform or tenant segment, never a regex — because overlap between two entries has to be decidable at config load (assertChannelExclusivity), and an undecidable overlap is an at-most-one-domain hole.`);
+        }
+        for (const key of d.exclude ?? []) {
+            const parsed = parseReachEntry(key);
+            if (parsed?.kind === "group")
+                continue; // already reported above; do not also call it malformed
+            if (!parsed || parsed.kind === "tenant") {
+                bad.push(parsed
+                    ? `  "${d.name}" excludes "${key}", which is a WHOLE TENANT — an exclusion carves surfaces out of a domain's reach, so it is a three-segment surface key ("github/acme/payments-secrets") or a same-level glob ("github/acme/payments-secret-*"). A tenant-wide exclusion either cancels the reach outright or means nothing; drop the reach entry instead.`
+                    : `  "${d.name}" excludes "${key}", which is not a surface key \`platform/<tenant>/<surface>\` nor a same-level glob \`platform/<tenant>/<prefix>*\` (one trailing \`*\` on the last segment only — see the reach rule)`);
+                continue;
+            }
+            // An exclusion against this domain's OWN EXACT key is a contradiction, not a carve-out: deleting one of the two lines says the same thing, and says it once.
+            const ownExact = domainRoster(d).find((ch) => entryMatchesKey(parsed, ch));
+            if (ownExact !== undefined) {
+                bad.push(`  "${d.name}" excludes "${key}" but also reaches "${ownExact}" outright — an exclusion and the exact key it cancels are a contradiction: delete the reach entry, or the exclusion.`);
+                continue;
+            }
+            const cancels = reachEntries.find((c) => entryContains(parsed, c.parsed));
+            if (cancels) {
+                bad.push(`  "${d.name}" excludes "${key}", which cancels the WHOLE of its reach entry "${cancels.entry}" — that pair is dead config (the reach can never admit anything). Delete both, or narrow the exclusion.`);
+                continue;
+            }
+            // A dead exclusion is the dangerous typo: it reads as a carve-out and grants everything.
+            if (!reachEntries.some((c) => entriesIntersect(parsed, c.parsed))) {
+                bad.push(`  "${d.name}" excludes "${key}", but none of its \`reach\` entries [${(d.reach ?? []).join(", ") || "<none>"}] can match it — a dead exclusion reads like a carve-out and grants everything it was meant to withhold. Fix the key, or drop it.`);
+            }
+        }
+        if (d.approvalMode !== undefined) {
+            // The allowlist is APPROVE_ALL's restoration list. On any other mode it cannot mean anything, and a dead allowlist on DENY_ALL would read like an escape hatch that does not exist.
+            const mode = d.approvalMode.mode;
+            if (mode !== "DANGEROUSLY_BYPASS" && mode !== "APPROVE_ALL" && mode !== "DENY_ALL") {
+                bad.push(`  "${d.name}" sets approvalMode.mode "${String(mode)}" — must be DANGEROUSLY_BYPASS, APPROVE_ALL or DENY_ALL (access/approver-chain.ts)`);
+            }
+            if (d.approvalMode.allowlist !== undefined && mode !== "APPROVE_ALL") {
+                bad.push(`  "${d.name}" sets approvalMode.allowlist under ${mode} — the allowlist is APPROVE_ALL's restoration list and means nothing on any other mode (remove it, or it reads as an escape hatch that does not exist)`);
+            }
+            if (d.approvalMode.allowlist?.some((t) => t.trim() === "")) {
+                bad.push(`  "${d.name}" approvalMode.allowlist has an empty entry — every entry must name a tool`);
+            }
+        }
+        for (const entry of d.admins ?? []) {
+            if (isQualifiedPrincipalKey(entry))
+                continue;
+            bad.push(`  "${d.name}" lists admin "${entry}", which is not a well-formed principal key \`platform/<principal-id>\` — or, on a tenant-scoped platform, \`platform/<tenant-id>/<principal-id>\` (e.g. "slack/T0AB1CD2E/U0EXUSER002", "discord/300000000000000104"). Admin standing is exact-id ONLY — static and diff-auditable, with no runtime link-set resolution on the highest-privilege gate. A bare vendor id names no namespace and can never match; a \`linkSet:<id>\` reference is deliberately refused here (use a \`principal\` credential binding or a person-group for link-set-keyed grants).${tenantRungRemedy(entry, domains)} (identity/principal-key.ts)`);
+        }
+        if (hasMatch) {
+            if (d.match === "org")
+                hasOrg = true;
+            const prev = byMatch.get(d.match);
+            if (prev)
+                bad.push(`  match "${d.match}" is claimed by both "${prev}" and "${d.name}" (at most one per match value)`);
+            else
+                byMatch.set(d.match, d.name);
+            if (d.includeOrg && (d.match === "org" || d.match === "public")) {
+                bad.push(`  "${d.name}" (match "${d.match}") must not set includeOrg (${d.match === "org" ? "self-reference" : "would leak org memory to the external surface"})`);
+            }
+        }
+    }
+    for (const d of domains) {
+        if (d.includeOrg && !hasOrg) {
+            bad.push(`  "${d.name}" sets includeOrg but no { match: "org" } domain is defined to include`);
+        }
+    }
+    bad.push(...partitionTenantProblems(domains));
+    if (bad.length > 0) {
+        throw new Error("open-everywhere: invalid memory domain(s):\n" + bad.join("\n") + "\n(memory/domain.ts / docs/capabilities/memory.md)");
+    }
+}
+/**
+ * A Notion delivery's `workspace_id` is an unauthenticated payload field and no REST object carries one, so the partition's workspace segment comes from the matched `reach` entry instead.
+ * Every other platform names its tenant in a signed or vendor-verified envelope, so the delivery is the source there.
+ */
+const CONFIG_DERIVED_TENANT_PLATFORMS = new Set(["notion"]);
+/**
+ * THE RULE: a domain may reach at most ONE tenant of such a platform BY CONTAINER. With two, the same surface id can key under either, decided by an unauthenticated payload field.
+ * An EXACT entry carries its own tenant and is never ambiguous, so cross-workspace domains stay expressible. The rule is per domain, not per deployment.
+ */
+export function partitionTenantProblems(domains) {
+    const bad = [];
+    for (const d of domains) {
+        const byPlatform = new Map();
+        for (const entry of domainContainers(d)) {
+            const parsed = parseReachEntry(entry);
+            if (!parsed || !CONFIG_DERIVED_TENANT_PLATFORMS.has(parsed.platform))
+                continue;
+            const tenants = byPlatform.get(parsed.platform) ?? new Set();
+            tenants.add(parsed.tenant);
+            byPlatform.set(parsed.platform, tenants);
+        }
+        for (const [platform, tenants] of [...byPlatform].sort(([a], [b]) => a.localeCompare(b))) {
+            if (tenants.size < 2)
+                continue;
+            bad.push(`  "${d.name}" reaches ${tenants.size} ${platform} tenants by container (${[...tenants].sort().map((t) => JSON.stringify(t)).join(", ")}) — on ${platform} the session partition's tenant segment comes from the matched \`reach\` entry, because the delivery's own tenant field is unauthenticated and no API call can confirm it. A container states no tenant for the surfaces it sweeps in, so with two of them one surface's history can key under either depending on what a payload says. Split this into one domain per ${platform} tenant, or name the surfaces outright (an exact entry carries its own tenant and is never ambiguous).`);
+        }
+    }
+    return bad;
+}
+//# sourceMappingURL=domain.js.map