@open-everywhere/core 0.1.0

package/agent/adapter-api.ts

@@ -0,0 +1,1795 @@
+// adapter-api — the SINGLE public door core opens to the adapter layer.
+//
+// Doctrine (R8 / OPE-89): every vendor implementation — Neon, Notion, the
+// own-rolled OAuth flow (OPE-88), and any future adapter — is an ADAPTER
+// riding a SMALL common API core exposes. This barrel IS that API, and it spans the THREE
+// capability planes a provider bundle plugs into:
+//   • connector/credential plane — a vendor's transport + secret custody (broker, ref codec,
+//     credential homes, OAuth flow, connector transport, attachments, blob putter);
+//   • work-surface plane — the entities an agent acts on (issues, docs, PRs) via an
+//     entity-action adapter that core resolves verbs (setState/assign/addLabel) against;
+//   • chat-surface plane — where an agent is woken, reasons over a conversation, and replies
+//     (identity mapper, capability manifest, post-arm, wake-origin codec + unified window,
+//     read adapter, reaction surface, and the wake/turn-delivery/supervisor support kit).
+// Core keeps exactly two reference credential homes (env + db) as the bootstrap floor;
+// everything else plugs in through the registration seams re-exported below.
+//
+// The boundary test (scripts/boundary-test.ts) enforces the rule STRICTLY: nothing under
+// packages/adapters/ (nor agent/lib/register-adapters.ts) may import `@open-everywhere/core`
+// by any specifier OTHER than this barrel. If an adapter needs a core symbol that isn't
+// re-exported here, that is the signal to add the missing port to the barrel — not to reach
+// past it with a deep import. Holding this line from day one keeps the future repo-cut
+// (core ↔ adapters) mechanical.
+//
+// Grouped by port. Types and values are split into `export type` / `export` re-exports so
+// the file is safe to load at runtime (a type-only name re-exported as a value would fail
+// under esbuild/tsx).
+
+// ── Credential broker (access/credentials.ts) — resolve a Connection's secret ──────────────
+export { CredentialError, registerBroker, getSecretVia, getSecretWithLifetimeVia, resetBrokers } from "./access/credentials.js";
+export type { CredentialBroker, BrokeredSecret } from "./access/credentials.js";
+
+// ── Per-credential endpoint rules (access/credential-endpoints.ts) — the CONNECTOR plane's own ──
+// host/path/method narrowing (OPE-505). A provider package that attaches a credential to a
+// host-side REST call wraps its fetch with `guardCredentialFetch(cred.endpoints, …)`, so a
+// wrong-credential bug becomes a blocked request instead of a leaked key.
+// The MCP-transport variant (OPE-523) checks ONLY the host of a connection's `directUrl` against a
+// bound credential's `endpoints.hosts` — eve's MCP client owns the individual requests once a
+// connection is wired, so there is no per-request path/method to check against.
+export {
+  guardCredentialFetch,
+  assertCredentialEndpointAllowed,
+  credentialEndpointVerdict,
+  credentialEndpointProblems,
+  assertCredentialEndpointHostAllowed,
+  credentialEndpointHostVerdict,
+  CredentialEndpointError,
+  CREDENTIAL_HTTP_METHODS,
+} from "./access/credential-endpoints.js";
+export type { CredentialEndpointRules, CredentialEndpointVerdict, GuardableFetch } from "./access/credential-endpoints.js";
+
+// ── Always-warm minted credentials (credentials/warm.ts) — hold a credential OE mints for ──
+// itself, re-mint ahead of expiry, fail LOUD (an audit row) rather than serve a dead token.
+// ConnectorCredentials packages that mint their own token (Linear's actor=app, GitHub installation tokens,
+// the Teams Graph app-only token) reach it through here rather than re-growing the machinery.
+export { warmCredential, DEFAULT_REFRESH_MARGIN_MS } from "./credentials/warm.js";
+export type { WarmCredential, WarmCredentialSpec } from "./credentials/warm.js";
+
+// ── AWS-access ports (connections/aws-identity.ts, aws-exec.ts) — Door 1 of the AWS plane ──
+// Core holds the ports; the AWS adapter (packages/adapters/agent/aws) satisfies them (OIDC→STS
+// federation + `aws` CLI spawn) and registers here at boot. Core stays vendor-SDK-free.
+export { registerAwsIdentityProvider, resetAwsIdentityProvider, awsRoleSessionName } from "./connections/aws-identity.js";
+export type { AwsIdentityProvider, AwsIdentityRequest, AwsCredentials, AwsIdentityKind } from "./connections/aws-identity.js";
+export { registerAwsExecutor, resetAwsExecutor } from "./connections/aws-exec.js";
+export type { AwsExecutor, AwsExecRequest, AwsExecResult } from "./connections/aws-exec.js";
+// Phase 1 (per-user AWS SSO linking): the per-principal Identity Center LINK store port. The adapter
+// backs it with the encrypted KV vault and registers it at boot; the token blob is opaque to core.
+export {
+  registerAwsSsoLinkStore,
+  resetAwsSsoLinkStore,
+  awsSsoLinkStore,
+  requireAwsSsoLinkStore,
+} from "./connections/aws-sso-link.js";
+export type { AwsSsoLinkStore } from "./connections/aws-sso-link.js";
+
+// ── Directory port (identity/directory.ts) — the IdP seam for identity-link pre-population ──
+// Core holds the port and the whole sync (pure diff + runner); an adapter (packages/adapters/
+// agent/directory/okta.ts) satisfies `DirectoryProvider` and registers here at boot, so core names
+// no IdP API. Unregistered ⇒ the feature is cleanly OFF (no throwing `require*` twin, on purpose —
+// a deployment with no IdP is the normal case, not a fault).
+export { registerDirectoryProvider, directoryProvider, resetDirectoryProvider } from "./identity/directory.js";
+export type { DirectoryProvider, DirectoryPerson, DirectoryAccount, DirectoryGrade } from "./identity/directory.js";
+
+// ── Credential-ref codec registry (credentials/ref.ts) — parse/derive a credential's home ──
+export { registerRefCodec } from "./credentials/ref.js";
+export type { RefCodec, CredentialRefDeriveInput, ParsedCredentialRef } from "./credentials/ref.js";
+
+// ── CredentialHome registry (credentials/home.ts) — a registration-based storage home ──────
+export { registerCredentialHome, hostWriteHomeAvailable } from "./credentials/home.js";
+export type { CredentialHome, CredentialHomeStoreInput } from "./credentials/home.js";
+
+// ── Exclusive credential home + home-bag helpers (access/connector-credentials.ts) ─────────
+// findConnectorCredential: a provider bundle's API layer resolves its configured credential
+// (e.g. notion-api's channel key) through this rather than reading access config directly.
+export { findConnectorCredential } from "./access/connector-credentials.js";
+export type { ConnectorCredential } from "./access/connector-credentials.js";
+export {
+  registerExclusiveCredentialHome,
+  vercelConnectorHome,
+  vercelConnectorOf,
+} from "./access/connector-credentials.js";
+export type { ExclusiveCredentialHome, CredentialHomeRef, ConnectorCredentialType } from "./access/connector-credentials.js";
+// Acting-identity axis (OPE-125) — a provider bundle declares whether its VENDOR can issue a
+// human-acting credential (`humanActing`) and stamps such a credential's `grantFamily`/`lifecycle`.
+// Orthogonal to ConnectorCredentialType; absent ⇒ install-family, unchanged behaviour.
+export { grantFamilyOf, isHumanActing, principalOfCredential, humanActingSupport } from "./access/connector-credentials.js";
+export type { CredentialGrantFamily, CredentialLifecycle, CredentialRefreshPosture, HumanActingSupport } from "./access/connector-credentials.js";
+
+// ── db reference broker (credentials/db-broker.ts) — one of the two bootstrap-floor homes ──
+export { registerDbCredentialBroker, CREDENTIAL_KEY_ENV } from "./credentials/db-broker.js";
+
+// ── Config-repo PR mechanism (credentials/config-pr.ts) — the credential-binding PR seam (OPE-86) ──
+// binding-pr.ts drives the custody-flip PR through this port; GitHub is the registered default
+// (registerGitHubConfigPrProvider — wired at boot from the app), a GitLab/Gitea
+// self-hoster registers their own ConfigPrProvider through registerConfigPrProvider.
+export { registerConfigPrProvider } from "./credentials/config-pr.js";
+export type { ConfigPrProvider, ConfigPrOutcome, ConfigFileContent, CommitIdentity } from "./credentials/config-pr.js";
+export { registerGitHubConfigPrProvider, makeGitHubConfigPrProvider } from "./credentials/config-pr-github.js";
+
+// ── SCM plane (scm/mint.ts, scm/config.ts) — the SINGLE SCM implementation stays in CORE ────
+// DOCTRINE (docs/extending/adapter-model.md — don't-pre-split): the SCM subsystem (PR/checkout/
+// issue verbs, App-token minting, App config) is GitHub-hardcoded in core until a SECOND SCM
+// (GitLab/Gitea) needs the abstraction — so it is NOT part of the GitHub provider bundle. But the
+// GitHub bundle's POST ARM (github-post-arm.ts) mints its own repo-scoped `issues:write`
+// installation token to post a unified reply, and reads the App config to find the installation —
+// SCM-plane helpers it reaches through this door, exactly as makeGitHubConfigPrProvider (above)
+// already crosses the barrel. The App identity itself (the credential) stays core-owned.
+export { parsePrivateKey, signAppJwt, mintInstallationToken, MEMORY_WRITE_PERMISSIONS } from "./scm/mint.js";
+export { loadGitHubAppConfig } from "./scm/config.js";
+// The self-registering owner→installation map (scm/installations.ts): the GitHub bundle's webhook
+// route LEARNS installs/uninstalls off the App's `installation` event, and its post arm RESOLVES an
+// owner through the same composition (env authoritative, discovered augmenting).
+export {
+  composeGitHubInstallations,
+  recordGitHubInstallation,
+  forgetGitHubInstallation,
+  resolveGitHubInstallationId,
+  hydrateGitHubInstallations,
+} from "./scm/installations.js";
+// The App identity + its Contents client (OPE-390): the GitHub bundle owns the github MEMORY
+// backing now (packages/providers/github/agent/memory/memory.ts), which piggybacks this same App
+// plane rather than holding a memory-only credential. Same door the post arm already crosses; the
+// App identity itself stays core-owned.
+export { getGitHubApp } from "./scm/provider.js";
+export { GitHubContents } from "./scm/contents.js";
+export type { CommitId } from "./scm/contents.js";
+// The READ credential + the REST header set (OPE-958): the GitHub bundle's READ ADAPTER fetches an
+// issue/PR conversation for `read_channel` / `read_work_channel`, and it must do so on the SAME
+// brokered read-scoped token every other GitHub read uses (`resolveReadToken` — App installation
+// first, `GITHUB_TOKEN` PAT fallback). A bundle-local token resolver would be a second credential
+// path to the one App, and a bundle-local header literal would be a second spelling of the API
+// version. Both stay core's, reached through this door.
+//
+// The read adapter takes `resolveConversationReadToken`, NOT `resolveReadToken` (OPE-1019): it opens
+// at `/issues/{n}`, which serves an issue and a pull request, so its token has to name both
+// permission families. The two mint sets live in scm/mint.ts with the measurement behind them.
+export { resolveReadToken, resolveConversationReadToken } from "./scm/pr-status.js";
+// The CONVERSATION-WRITE mint set (OPE-1020) — the GitHub post arm mints its OWN comment token
+// rather than holding an eve channel handle, so the set it names has to reach it through this door.
+export { CONVERSATION_WRITE_PERMISSIONS } from "./scm/mint.js";
+export { prApiHeaders } from "./scm/pr.js";
+export type { PrFetchFn } from "./scm/pr.js";
+export type { GitHubInstallationRow } from "./operational/store.js";
+
+// ── Encrypted KV vault (credentials/kv-vault.ts) — a connector-plane adapter's OWN secret store ──
+// Reuses the db broker's single AES crypto path + the stored_credential store; the own-rolled OAuth
+// adapter (OPE-88) persists its DCR client + tokens through this rather than a second crypto path.
+export { encryptedKvVault } from "./credentials/kv-vault.js";
+export type { EncryptedKvVault, EncryptedKvVaultDeps } from "./credentials/kv-vault.js";
+
+// ── Credential PURGE hook (credentials/purge.ts) — OPE-287 ─────────────────────────────────
+// The other end of the vault: core's offboarding lever (revokeLinkSet) has to make a subject's
+// stored credentials DIE, not merely stop being reachable — but only the adapter knows the key
+// shapes and the vendor revocation endpoint. So the adapter registers, and core calls. Fail-OPEN
+// by design (a vault outage must never block an offboarding); see the module header. Registration
+// is KEYED by holder name (OPE-300 G3) — more than one adapter stores per-subject credentials (the
+// OAuth vault and the AWS Identity Center token store), and a last-wins slot would have let
+// whichever registered second be the only one an offboarding reached.
+export { registerCredentialPurgeHook } from "./credentials/purge.js";
+export type { CredentialPurgeHook, CredentialPurgeOutcome } from "./credentials/purge.js";
+
+// ── Vendor-handshake secret capture (webhooks/handshake-capture.ts) — OPE-195 ──────────────
+// A provider whose own front door receives a vendor-issued signing key at subscription time stores
+// it here instead of logging it. ONE function, ONE call site (the Notion channel); moving that
+// ingress onto the declared-hook plane deletes both. See the module header for the bearer-only
+// posture of the reveal link it logs.
+export { captureHandshakeSecret, secretFingerprint, HANDSHAKE_REVEAL_PRINCIPAL } from "./webhooks/handshake-capture.js";
+export type { CaptureHandshakeSecretInput, CaptureHandshakeSecretDeps, CaptureHandshakeSecretOutcome } from "./webhooks/handshake-capture.js";
+export { NOTION_HANDSHAKE_REF_NAMESPACE } from "./credentials/reserved-refs.js";
+
+// ── Own-rolled OAuth callback seam (connections/oe-oauth-callback.ts) — OPE-88 ──────────────
+// The OE-owned `GET /oauth/v1/callback` landing; the adapter registers the code→token completer.
+export { registerOeOauthCallbackCompleter, OE_OAUTH_CALLBACK_PATH } from "./connections/oe-oauth-callback.js";
+export type { OeOauthCallbackArgs, OeOauthCallbackResult, OeOauthCallbackCompleter } from "./connections/oe-oauth-callback.js";
+
+// ── AWS Identity Center (SSO) link callback seam (connections/aws-sso-callback.ts) — Phase 1 ─
+// The OE-owned `GET /oauth/v1/aws-sso/callback` landing; the AWS adapter registers the code→token
+// completer (sso.ts completeLink) and imports the canonical path const from here.
+export { registerAwsSsoCallbackCompleter, OE_AWS_SSO_CALLBACK_PATH } from "./connections/aws-sso-callback.js";
+export type { AwsSsoCallbackArgs, AwsSsoCallbackResult, AwsSsoCallbackCompleter } from "./connections/aws-sso-callback.js";
+
+// ── AWS Identity Center link BINDING check (connections/aws-sso-identity-binding.ts) — OPE-1955 ─
+// Whose AWS sign-in may complete a personal link. Core owns the join (the identity-link plane) and the
+// refusal's audit row; the adapter supplies the signer's Identity Center `sub` and honours the verdict.
+export { checkAwsSsoIdentityBinding } from "./connections/aws-sso-identity-binding.js";
+export type { AwsSsoBindingVerdict } from "./connections/aws-sso-identity-binding.js";
+
+// ── Bundle shapes an adapter reads when scoping a grant (access/bundle.ts) ─────────────────
+export type { Connection, CredentialAuthorizationDetail } from "./access/bundle.js";
+
+// ── Connector-plane user-auth flow (connections/user-auth-flow.ts) — OAuth mint/authorize ──
+export { registerUserAuthFlow, requireUserAuthFlow } from "./connections/user-auth-flow.js";
+export type { UserAuthFlowProvider, UserAuthSubject, UserTokenMintParams } from "./connections/user-auth-flow.js";
+
+// ── Generic connector transport (connections/connector-transport.ts) ───────────────────────
+export { registerConnectorTransport } from "./connections/connector-transport.js";
+export type {
+  ConnectorTransport,
+  ConnectorTransportSpec,
+  ResolvedConnectorTransport,
+} from "./connections/connector-transport.js";
+
+// ── ActionKind approval registry (approvals/actions.ts + approvals/types.ts) ───────────────
+export { registerActionKind } from "./approvals/actions.js";
+export type { ActionKind, PendingActionRow } from "./approvals/types.js";
+
+// ── Platform seam (access/platform.ts) — is-this-Vercel without a raw process.env read ─────
+export { platformName, onVercel } from "./access/platform.js";
+
+// ── Off-Vercel sandbox backend kind (sandbox/backend-select.ts) ─────────────────────────────
+// The turn-end stop hook must pick the SAME backend the app built, so it reads the app's own
+// parse rather than re-reading OE_SANDBOX_BACKEND.
+export { resolveSelfHostBackendKind } from "./sandbox/backend-select.js";
+export type { SelfHostBackendKind } from "./sandbox/backend-select.js";
+
+// ── eve subagent-child discriminator (identity/binding.ts) ──────────────────────────────────
+// Model-unforgeable. An adapter hook that must not act inside a delegated child guards on it,
+// the same way core's memory / lean-seat / spawn-taint / egress hooks do.
+export { isSubagentChildContext, subagentParentSessionId } from "./identity/binding.js";
+
+// ── Browser toolkit seam (access/browser-toolkit.ts) — the flag-gated agent-browser family ──
+// An adapter registers vendor browser tools here at boot; tools/browser_tools.ts resolves them
+// per session grain. Unregistered (the flag-off default) ⇒ the resolver mounts nothing.
+// `browserPlaneRefusal` is the ONE platform gate, read in core by `resolveBrowserKit` and by
+// `openBrowserEgressHosts` — the plane's own egress opener, so the hosts cannot open off Vercel even
+// for a registrar that skipped the adapter's config loader — and by that loader for the tool mount
+// and the sandbox bake (OPE-1793).
+export { registerBrowserToolkit, registeredBrowserToolkit, resetBrowserToolkitForTest, resolveBrowserKit, browserPlaneRefusal, openBrowserEgressHosts, BROWSER_TOOL_NAMES } from "./access/browser-toolkit.js";
+export type { BrowserToolEntry } from "./access/browser-toolkit.js";
+
+// ── Browser host declaration (access/browser-hosts.ts) — the operator's browse-target rows ──
+// The ONE reach list for the capability: which hosts the browser may drive, under which HTTP
+// verbs, whose credential the firewall stamps there, and where `browser_evaluate` is armed. The
+// app registers it at boot (agent/access/browser-hosts.ts); the adapter reads it to bind both
+// containment walls. Empty (the flag-off default) ⇒ the capability does not arm.
+// Only the four names the adapter layer reads, plus the two test seams its suite drives: the schema,
+// the validation and the registration are core-and-app business and stay off the published surface.
+export { browserHostDeclarations, isLoopbackBrowseHost, _setBrowserHostsForTest, resetBrowserHostsForTest } from "./access/browser-hosts.js";
+export type { BrowserHostDeclaration } from "./access/browser-hosts.js";
+
+// ── Extra egress hosts seam (access/extra-hosts.ts) — capability-allowlisted bare hosts ─────
+// Merged into every compiled sandbox NetworkPolicy as credential-less allows; empty registry
+// (flag-off) leaves the policy byte-identical. Bundle-declared hosts always win.
+export { registerExtraEgressHosts, extraEgressHosts, resetExtraEgressHostsForTest } from "./access/extra-hosts.js";
+
+// ── Attachment plane (channels/attachments.ts) — platform-keyed attachment resolvers ──
+// A channel adapter registers { platform, resolve(attachmentId, ctx) → { bytes, ref } }; describe_image
+// consults the plane so its contract carries no per-platform union arm. A resolver MAY also implement
+// the size-guarded variant `resolveGuarded` (→ { ref, mimeType?, name?, pull({ maxBytes }) }) that
+// read_file_upload uses to read raw bytes with a pre-download Content-Length guard. Slack is the
+// reference resolver (registered in-core from channels/slack-attachments.ts); a non-core channel
+// adapter registers its own through this barrel.
+export { registerAttachmentResolver, resolveAttachment, resolveGuardedAttachment, AttachmentOversizeError } from "./channels/attachments.js";
+export type { AttachmentResolver, ResolvedAttachment, GuardedAttachment } from "./channels/attachments.js";
+
+// ── Blob putter seam (blob/hosting.ts) — host an HTML artifact via the vendor's blob store ─
+export { setBlobPutter } from "./blob/hosting.js";
+export type { BlobPutter } from "./blob/hosting.js";
+
+// ── Config accessor (access/config.ts) ─────────────────────────────────────────────────────
+export { getConfig, registerConfig } from "./access/config.js";
+
+// ── Behaviour settings (settings/settings.ts) — config-as-code for agent BEHAVIOUR ─────────
+// The typed home of every process-global behaviour opinion (OPE-371). Adapters read the
+// resolved values through `getSettings()`; the app defines its own overrides with
+// `defineSettings` and hands them over at boot with `registerSettings`, beside registerConfig.
+export { SETTINGS, getSettings, defineSettings, registerSettings, resetSettingsForTest, overrideSettingsForTest, settingDocs, settingEnvNames } from "./settings/settings.js";
+export type { AgentSettings, AgentSettingsOverrides, SettingSpec, SettingDoc, TaintTierMode, ApprovalJudgeMode } from "./settings/settings.js";
+
+// ── Memory provider registry + backing seams ───────────────────────────────────────────────
+// FIRST-PARTY backings (postgres, sqlite) live in core — their "connection" is the deployment
+// identity, so they are the degenerate case with no grant to check. Every CONNECTOR-OWNED backing
+// (github, notion, …) lives in its provider package and declares its capability through
+// `registerConnectorMemory` below — see memory/connector-memory.ts for the taxonomy (OPE-390).
+export { registerProvider, registerPostgres } from "./memory/provider.js";
+export type { MemoryProvider, MemoryAccess } from "./memory/provider.js";
+export { registerConnectorMemory, connectorMemoryFor, connectorMemoryCapabilities, assertConnectorMemoryGrants, resetConnectorMemoryForTest } from "./memory/connector-memory.js";
+export type { ConnectorMemoryCapability, ConnectorMemoryMode, DomainMemoryGrants } from "./memory/connector-memory.js";
+export { initPostgresSchema } from "./memory/postgres.js";
+export type { PgClient } from "./memory/postgres.js";
+export { registerOperationalPostgres, getOperationalStore, registerOperationalStore, resetOperationalStore } from "./operational/provider.js";
+// The proactive-address row (OPE-887) — a provider that must capture where it can reach somebody
+// with no live turn writes and reads it through `getOperationalStore()`. See the PROACTIVE ADDRESSES
+// section of operational/store.ts for what belongs in the `address` bag and what does not.
+export type {
+  ProactiveAddress,
+  OperationalStore,
+  IngressDeliveryKey,
+  IngressDeliveryWrite,
+  DueIngressDelivery,
+  ClaimedIngressDelivery,
+} from "./operational/store.js";
+export { initOperationalSchema } from "./operational/postgres.js";
+// Embedded-Postgres (PGlite) operational FLOOR (OPE-113) — the zero-wiring default the boot
+// wiring arms when no provider is selected and no DATABASE_URL is present.
+export { registerOperationalPglite, registerOperationalPgliteLazy, pgliteOperationalDataDir } from "./operational/pglite-client.js";
+
+// ── Memory layout / partition / silo / selection / store (a memory adapter's read surface) ──
+// `tierRelDir`/`seedFor` ride here for the SAME reason `safeName` always has: a connector-owned
+// backing keys its storage by the canonical tier path and seeds a fresh tier with the canonical
+// skeleton, and both must be byte-identical to what every other backing writes (memory/layout.ts's
+// whole reason to exist) — a bundle re-deriving either would fork the layout silently.
+export { safeName, tierRelDir, seedFor } from "./memory/layout.js";
+export { domainKeyOf, resolvePartition } from "./memory/partition.js";
+export type { Partition } from "./memory/partition.js";
+export type { MemorySilo } from "./memory/silo.js";
+export { makeSelector, normalizeSelection } from "./memory/selection.js";
+export type { Selector } from "./memory/selection.js";
+// Memory PLAN resolution (memory/resolve.ts) + silo definition (memory/silo.ts): a provider bundle's
+// identity/memory test drives resolveMemoryPlan over a fixture config to assert its surfaces route to
+// the right memory layer (e.g. teams' fail-closed external → read-only public, never the org brain).
+export { resolveMemoryPlan } from "./memory/resolve.js";
+export type { MemoryResolveConfig } from "./memory/resolve.js";
+export { defineMemorySilo } from "./memory/silo.js";
+export { siloTier } from "./memory/store.js";
+export type { Tier, MemoryFiles } from "./memory/store.js";
+
+// ── Model routing / vision / dream judge / stamp (a model adapter's plug-ins) ───────────────
+export { modelRouteFor, memoryRefs, defineDomain } from "./memory/domain.js";
+export type { ModelRoute } from "./memory/domain.js";
+export { liveIdentity, resolvePrimaryModel } from "./model/routing.js";
+export type { ModelBackend, RoutedCallOptions } from "./model/routing.js";
+export { registerImageDescriber } from "./model/vision.js";
+export type { ImageDescribeRequest, ImageDescribeResult, ImageDescribeUsage, ImageDescriber } from "./model/vision.js";
+export { judgeFromCompletion, registerDreamJudge, dreamJudge } from "./memory/dream/judge.js";
+export type { DreamCompletion, DreamJudge } from "./memory/dream/judge.js";
+export { facetJudgeFromCompletion, registerFailureFacetJudge } from "./memory/dream/mode3.js";
+export { registerApprovalJudgeCompletion } from "./access/approval-judge.js";
+export type { ApprovalJudgeCompletion, JudgePass } from "./access/approval-judge.js";
+export { stampModelCall, readModelStamp, swapModelStamp, withModelStampScope } from "./model/model-stamp.js";
+// The `/oe rate` scale. A surface that declares its command options up front — Discord registers
+// each option's `min_value`/`max_value` with the platform — needs the same two bounds core parses
+// the argument with, so the scale lives in core and reaches a provider through this door.
+export { MODEL_AB_RATING_MIN, MODEL_AB_RATING_MAX } from "./model/ab-test.js";
+export type { BindableContext } from "./identity/binding.js";
+
+// ── Observability (observability/ship.ts, telemetry.ts) ─────────────────────────────────────
+export { installLogShipping } from "./observability/ship.js";
+// registerSurfaceCredentialProbe: an extracted bundle owns its own credential-presence probe for
+// the telemetry heartbeat census (linear + slack register theirs; core keeps zero vendor env
+// names for extracted platforms). THE one probe seam — the registerConfiguredSurfaceProbe variant
+// from the linear extraction was unified into this registry at merge time.
+export { initTelemetry, emitTelemetry, registerSurfaceCredentialProbe } from "./observability/telemetry.js";
+
+// ── The own-account gate (OPE-1525) ─────────────────────────────────────────────────────────
+// A provider read that can run on a TEAM credential asks this which family it may use, so a
+// member's "use my own account" is never answered with the deployment's integration in silence.
+// See connections/own-account-ask.ts for the decision and connections/own-account-gate.ts for the
+// live binding a tool calls.
+export { connectorActingIdentityForTurn, CONNECTOR_ACTING_IDENTITY_ACTION } from "./connections/own-account-gate.js";
+export type { ActingIdentityVerdict, OwnAccountVendor } from "./connections/own-account-ask.js";
+// The vendor registry a gated call site reads, so a bundle declares its vendor's spoken words in the
+// ONE place the stamp producer reads them too (OPE-1641). A bundle that hand-wrote an alias list
+// recognised a word at its own call site and nowhere else, which refused a seat read and answered
+// the same sentence as the org inside a delegated worker.
+export { ownAccountVendorFor } from "./connections/own-account-vendors.js";
+// GITHUB'S OWN SEAM, which lives in CORE because three of its four call sites do (OPE-1642): the SCM
+// plane stays in core by doctrine, so a seam in the bundle could not reach them. The github bundle's
+// conversation reads call this through the barrel. See scm/github-acting-identity.ts.
+export { assertGithubActingIdentity, GITHUB_CONNECTOR, GITHUB_OWN_ACCOUNT_VENDOR } from "./scm/github-acting-identity.js";
+
+// ── Audit (audit/tool-action.ts, audit/audit.ts, audit/chain.ts) ────────────────────────────
+export { auditToolAction } from "./audit/tool-action.js";
+export { registerAuditDropCounter, appendAudit } from "./audit/audit.js";
+export type { AuditInput } from "./audit/audit.js";
+export { bootVerifyAuditChainTail } from "./audit/chain.js";
+export { bootBackfillLinkTenants } from "./identity/link-tenant-backfill.js";
+
+// ── Governance venue floor tripwire member supplier (OPE-110) ───────────────────────────────
+// Core owns the supplier seam + the fail-closed default (access/audience-floor.ts); a provider
+// bundle registers its live roster arm through this seam (slack's registerSlackProvider does) —
+// the old barrel re-export of the slack arm itself is GONE (a barrel must never reach into a
+// bundle; OPE-114 stage 4).
+export { registerGovernanceMemberSupplier, _resetGovernanceMemberSupplierForTest } from "./access/audience-floor.js";
+export type { RoomRoster, GovernanceMemberSupplier } from "./access/audience-floor.js";
+
+// ══════════════════════════════════════════════════════════════════════════════════════════════
+// CHAT-SURFACE PLANE — where an agent is woken, reasons over a conversation, and replies.
+// A provider's channel + supervisor implementation registers its surface seams here and calls the
+// provider-neutral support kit below. notion is the reference bundle; slack/discord/teams/linear/
+// github ride the SAME ports. Nothing surface-SPECIFIC (slackForm, notionNameDrop, …) crosses the
+// barrel — that lives inside the bundle.
+// ══════════════════════════════════════════════════════════════════════════════════════════════
+
+// ── ConnectorCredentials selection (access/provider-selection.ts) — WHICH bundles this deploy carries ──
+// declareProviderSelection is a BOOT seam: the app's agent/lib/register-adapters.ts declares its
+// manifest's ids (agent/lib/providers.ts) as its FIRST act, before any registerXProvider(). Every
+// platform-keyed registration seam below then refuses an unselected provider, so the platform stays
+// structurally absent from every registry rather than half-wired. Core never names a provider — the
+// ids are opaque strings the app supplies. See docs/extending/provider-bundles.md § selection.
+export {
+  declareProviderSelection,
+  providerSelection,
+  providerSelectionDeclared,
+  isProviderSelected,
+  admitProviderRegistration,
+  admitInboundSurface,
+  refusedProviderRegistrations,
+  clearProviderSelection,
+} from "./access/provider-selection.js";
+export type { ProviderRegistrationRefusal } from "./access/provider-selection.js";
+
+// ── Shipped-manual registry (docs/registry.ts) — the agent's own documentation, compiled in ──
+// registerProviderDocs is a provider-plane seam (gated by admitProviderRegistration above): each
+// bundle hands core its own `docs/deploy/surfaces/<id>.md` runbook from register<X>ConnectorCredentials(), so a
+// de-selected bundle's manual leaves the import graph AND would be refused if it didn't. The app
+// registers everything else once via registerDocs. Both take generated modules — docs/ is not on
+// disk at runtime; see agent/docs/registry.ts's header.
+export { registerDocs, registerProviderDocs, clearDocs, visibleDocs, docIndex, readDoc, normalizeDocPath } from "./docs/registry.js";
+export type { DocEntry, RegisteredDoc, DocLookup } from "./docs/registry.js";
+
+// ── Identity mapper seam (identity/binding.ts) — ctx → a platform's raw identity ────────────
+// (BindableContext itself is re-exported in the model-plane block above.)
+// bindFrom / SurfaceBinding: a bundle's tools resolve their own session's composed binding (e.g.
+// "default to THIS page" reads bindFrom(ctx).surface); assertTurnSurface is the per-turn origin
+// fence every source-scoped read tool runs in execute (a non-X-origin turn on a unified window
+// must not read X even though the tool is armed for the session).
+export { registerIdentityMapper, registeredIdentityMapperPlatforms, deploymentOrg, bindFrom, assertTurnSurface, TurnOriginFenceError, currentTurnIssue, currentTurnOrganization, authPrincipalId, attestedFireCreatorId } from "./identity/binding.js";
+export type { IdentityMapper, RawIdentity, Visibility, SurfaceBinding } from "./identity/binding.js";
+export type { SessionMode } from "./access/resolver.js";
+
+// ── The authored-tool door into the reply-provenance ledger (channels/read-reach.ts) — OPE-1714 ──
+// A FIRST-PARTY read tool calls this from its own execute, after its fetch returned, so the reply
+// footer can say which system the turn consulted — and, under the narrow disclosure rule that module
+// states, name the record it read. Core owns the allowlist of admitted record kinds and what each is
+// footed as; a provider supplies only the ids and the title its own fetch produced.
+// `connectorReadsThisTurn` is the READING half of the same port: a bundle that writes through the
+// door may read back what this turn recorded, which is what lets its own suite prove the call is
+// still wired. Turn-scoped and read-only — it answers an empty list outside an eve context.
+export { noteAuthoredRecordRead } from "./channels/read-reach.js";
+export type { AuthoredRecordKind, AuthoredRecordRead } from "./channels/read-reach.js";
+export { connectorReadsThisTurn } from "./channels/reply-provenance.js";
+export type { ConnectorRead, ConnectorReadRecord } from "./channels/reply-provenance.js";
+
+// ── Surface-key spelling (identity/binding.ts) — OPE-1078 ──────────────────────────────────────
+// The ONE sanitiser a provider may use to name a container or a person the way the rest of the
+// deployment names it. A provider whose vendor ids are not already surface-key safe (Teams) reads
+// this to join its raw id to the rostered one; see providers/teams `teams-id-restore.ts`.
+export { surfaceKeySegment, trustGroupKeyFor } from "./identity/binding.js";
+
+// ── Operator-vouch registry (identity/trust.ts) — the per-surface trust registry ────────────
+// Trust is a typed per-surface PROPERTY (Surface.trust), not set-membership. registerSurfaces is
+// a BOOT seam (the app's identity/surfaces.ts calls it) and defineSurface is the fail-loud entry
+// builder each config line wraps; the reset is the test seam (the resetBrokers convention).
+// isVouchedInternal/isVouchedSurface are exported below with the wake-trust block.
+// A bundle whose surface key carries no hierarchy declares that it honours `Surface.subtree`
+// through registerSubtreePlatform, and receives the declared keys through the handler it passes
+// (OPE-539). applySubtreeSurfaceClaims is the app's ONE boot call that refuses a claim no selected
+// bundle owns — wired in agent/lib/register-adapters.ts after the bundle loop.
+export { registerSurfaces, defineSurface, _resetSurfacesForTest } from "./identity/trust.js";
+
+// ── The deployment's own identity (identity/deployment-identity.ts) — OPE-1545 ──────────────
+// Its org, its ambient workspace and its ambient surface, all TRACKED CONFIG: the app's
+// identity/surfaces.ts declares them and calls registerDeploymentIdentity at boot, exactly as it
+// calls registerSurfaces above. No env var carries any of the three. The two `_*ForTest` seams are
+// the same convention `_resetSurfacesForTest` follows, and a bundle's suite needs them for the
+// isolation it used to get by deleting an env var. (`deploymentOrg` is already exported above,
+// through identity/binding.ts's re-export.)
+export {
+  registerDeploymentIdentity,
+  _setDeploymentIdentityForTest,
+  _resetDeploymentIdentityForTest,
+} from "./identity/deployment-identity.js";
+export type { DeploymentIdentity } from "./identity/deployment-identity.js";
+export { registerSubtreePlatform, applySubtreeSurfaceClaims, subtreeSurfaceKeys, _resetSubtreePlatformsForTest } from "./identity/trust.js";
+export type { Surface, SurfaceTrust, SubtreeSurfaceHandler } from "./identity/trust.js";
+
+// ── Bot-name resolution (identity/bot-name.ts) — the surface-general name-token set + matcher ──
+// One place resolves the tokens the agent answers to (platform-resolved name ← OE_AGENT_NAME ←
+// OE_AGENT_SHORT_NAME, defaulting to the brand "open everywhere"/"oe"). Fed to Notion's synthetic
+// name-drop (notion-supervisor.ts) and the addressed link-claim recogniser (hooks/link-claim.ts).
+export { matchesAgentName, agentNameTokens, agentNameTokenPattern, configuredAgentName, DEFAULT_AGENT_SHORT_NAME, DEFAULT_AGENT_FULL_NAME, OE_ADDRESSED_ATTR, OE_BOT_NAME_ATTR } from "./identity/bot-name.js";
+
+// ── Surface-COMMAND reconcile plane (channels/command-registration.ts, OPE-1687) ──────────────
+// The deployment registers its OWN slash commands. The app declares the rooms
+// (`declareSurfaceCommandScope`, a tracked literal in config); a provider bundle registers the
+// vendor call that compares and writes; `reconcileSurfaceCommands()` is the app's ONE boot call
+// that joins them. Never throws — a stale command list must never stop a deployment answering.
+export {
+  declareSurfaceCommandScope,
+  registerSurfaceCommandReconciler,
+  surfaceCommandScopeFor,
+  reconcileSurfaceCommands,
+  resetSurfaceCommandRegistryForTest,
+} from "./channels/command-registration.js";
+export type {
+  SurfaceCommandScope,
+  SurfaceCommandReconciler,
+  SurfaceCommandOutcome,
+  SurfaceCommandStatus,
+  SurfaceCommandReport,
+} from "./channels/command-registration.js";
+
+// ── Bot DISPLAY-name registry (identity/bot-display-name.ts) — one arm per provider (OPE-587) ──
+// The LIVE name this deployment's own app carries on a platform, which the instruction assembler
+// renders as the agent's identity line. A provider registers its arm from its own boot entry; a
+// platform with no arm resolves undefined and the assembler renders the generic line.
+export { registerBotDisplayName, botDisplayNameFor, _resetBotDisplayNamesForTest } from "./identity/bot-display-name.js";
+export type { BotDisplayNameArm } from "./identity/bot-display-name.js";
+
+// ── Account DISPLAY-name registry (identity/account-display-name.ts) — one arm per provider,
+// mirroring bot-display-name.ts for a HUMAN account rather than the app's own identity (OPE-616) ──
+// The identity-linking flow (hooks/link-claim.ts, tools/confirm_link.ts) uses this to name the
+// claimant/initiator to a human instead of a bare principal key. A provider registers its arm
+// where a per-user name lookup already exists; a platform with no arm resolves undefined and the
+// caller falls back to a platform-named raw id.
+export { registerAccountDisplayName, accountProfileFor, humanAccountLabel, _resetAccountDisplayNamesForTest } from "./identity/account-display-name.js";
+export type { AccountProfile, AccountDisplayNameArm } from "./identity/account-display-name.js";
+
+// ── Account DIRECTORY registry (identity/account-directory.ts) — one arm per provider (OPE-617) ──
+// "Who, on this platform, is called that?" — the lookup the reverse-initiated link needs to NAME the
+// other account instead of posting a bearer code where anyone can read it. A provider registers its
+// arm where its API supports a user search (Slack `users.list`); a platform with no arm resolves an
+// empty list and `link_identity` falls back to the code transport.
+export { registerAccountDirectory, hasAccountDirectory, lookupAccountDirectory, rankDirectoryCandidates, _resetAccountDirectoriesForTest } from "./identity/account-directory.js";
+export type { DirectoryCandidate, AccountDirectoryArm, DirectoryLookup } from "./identity/account-directory.js";
+
+// ── The identity CONSENT button (OPE-622) — the surface half of the directory transport's consent
+// step. A provider bundle with a component plane renders `linkConsentActions` on the consent DM and
+// routes the tap back through `resolveLinkConsentClick`, which owns the whole decision; the bundle
+// reads its platform's verified envelope and writes its platform's answer, and nothing else.
+export { LINK_CONSENT_CLICK_PREFIX, LINK_CONSENT_CLICK_ACTION, linkConsentClickId, parseLinkConsentClickId, linkConsentActions, resolveLinkConsentClick, commitLinkConsent } from "./identity/link-consent.js";
+export type { LinkConsentVerdict, LinkConsentClickResult, ConsentingAccount } from "./identity/link-consent.js";
+export { linkTenantOf, tryLinkTenantOf, LINK_TENANT_NONE } from "./identity/link-tenant.js";
+
+// ── ConnectorCredentials registry (access/providers.ts) — the app's boot-time provider set ──────────────
+// setRegisteredConnectorCredentials is the boot seam register-config.ts wires (a bundle TEST registers its
+// own provider row the same way); resetRegisteredConnectorCredentials is its test reset.
+export { setRegisteredConnectorCredentials, resetRegisteredConnectorCredentials } from "./access/connector-credentials.js";
+
+// ── Untrusted-content ingestion (access/untrusted.ts) — wrap external text as DATA ──────────
+// Every read tool's toModelOutput funnels commenter/page text through ingestUntrustedModelOutput;
+// the OPEN/CLOSE markers are exported so a bundle's tests can assert the wrap without copying the
+// sentinel strings.
+export { ingestUntrustedModelOutput, untrustedCloseTag, normalizeFenceNonce, UNTRUSTED_OPEN, UNTRUSTED_CLOSE } from "./access/untrusted.js";
+
+// ── Dated reads (access/dated-read.ts, OPE-1012 / OPE-1026) — the LIVE-field-vs-OLD-prose
+// discriminator every read tool that returns a state field beside a history list (comments, a
+// discussion thread) shares. Stamp the read, age each history item against it with `ageAtRead`,
+// then say in one sentence which part of the render is current.
+export { ageAtRead } from "./access/dated-read.js";
+
+// ── SOURCE-TIER TABLE, ENFORCED (OPE-324; access/taint-tiers.ts + access/taint-enforcement.ts) ───
+// A provider read tool DECLARES what it is ingesting (`ingestion: { kind, … }` on its
+// ingestUntrustedModelOutput opts) and the ratified tier table DECIDES whether that read marks the
+// turn. 🔴 This is no longer a dry run: declaring a source the table calls `trusted` means the read
+// does NOT taint, where an undeclared read still taints unconditionally. It can only ever RELAX —
+// a declaration never mints a mark the funnel would not have set (see taint-enforcement.ts's header).
+// The type is exported so a bundle names the kind rather than a bare string; `classifyIngestion` so a
+// bundle's own test can pin what the table says about its source — which is now a behavioural pin.
+export type { IngestionSource, IngestionKind, IngestionTier, IngestionVerdict } from "./access/taint-tiers.js";
+export { classifyIngestion, INGESTION_KINDS } from "./access/taint-tiers.js";
+export { noteIngestionVerdict } from "./access/taint-enforcement.js";
+// The verdict SINK, published for the same reason the declarer above is (OPE-2141): a provider
+// bundle's own suite is where a route's declaration is driven, and the bundle reaches core ONLY
+// through this barrel (boundary-test.ts rule 4). `currentTaintVerdictSink` is the save/restore half
+// its own header offers, so a caller can install a capture and put the real sink back.
+export { registerTaintVerdictSink, currentTaintVerdictSink } from "./access/taint-enforcement.js";
+// `taintMarkLands` is for RENDER-TIME sites only (OPE-331): a bundle that composes a wake body in the
+// ingress process declares `noteIngestionVerdict(src, taintMarkLands())` rather than a hardcoded
+// boolean, so the log reports whether the taint mark ACTUALLY lands there instead of restating a
+// comment's assumption about which process is running. Those sites OBSERVE (their rows carry
+// `applied: false`) — the table governs an in-turn read tool, which never needs this and declares
+// through the `ingestion:` opt instead.
+export { taintMarkLands } from "./access/taint-signal.js";
+
+// `untrustedIngestedThisTurn` / `taintKindsThisTurn` read the in-turn taint signal a read tool's
+// `ingestUntrustedModelOutput` sets — exported so a bundle's own read-tool test can drive the REAL
+// registered `toModelOutput` (via `projectToolSet` below) and assert the mark landed, the same
+// end-to-end shape core's own read-tool tests use.
+export { untrustedIngestedThisTurn, taintKindsThisTurn } from "./access/taint-signal.js";
+
+// ── Non-member chat ingestion → taint (OPE-466; access/taint-signal.ts) ─────────────────────
+// A chat surface's wake dispatch computes the JOIN over the tiers it already resolved and stamps
+// the CARRIAGE onto the woken session's auth. The turn-side consumer is hooks/spawn-taint.ts's one
+// seeding rule — a surface never calls `markUntrustedIngestedThisTurn` itself (it runs in the
+// ingress process, where that call provably no-ops).
+export {
+  nonMemberChatTrust,
+  chatWakeIngestsNonMember,
+  nonMemberChatAttrs,
+  stampNonMemberChatAuth,
+  OE_CHAT_NONMEMBER_ATTR,
+} from "./access/taint-signal.js";
+export type { IngestedChatMessage, ChatWakeRoom } from "./access/taint-signal.js";
+
+// ── Source-scoped mount policy (access/source-scoped-mount.ts) — `X ∈ sources` tool gating ──
+// `workerChatArmMount` is the same rule narrowed to the delegated-worker grain (OPE-1014): the CHAT
+// arm of a vendor container read, which a conversational seat serves with `read_channel`/`read_thread`.
+export { sourceScopedMount, workerChatArmMount } from "./access/source-scoped-mount.js";
+
+// ── Dynamic-tool replay pre-registration (access/window-gated.ts) ───────────────────────────
+// A bundle's defineDynamic tool MUST keep its entry factored (top-level defineTool const, never
+// an inline literal) — eve's build-time bundler transform still hoists an inline one under a
+// build-order-counter name that shifts across deploys. A factored entry replays from a code-owned
+// DURABLE DESCRIPTOR (eve 0.44.0, OPE-903), which preRegisterDynamicEntry fills — eve's build
+// transform does not describe a gated wrapper. The fill covers the `toModelOutput` phase too — eve
+// REFUSES an entry that authors a phase it cannot describe, and drops the resolver's whole result,
+// so a gap in the fill takes the tool off the seat. It also registers a
+// stable `slug:entryKey` alias several tests use to reach the real callable directly
+// (replayStepNames derives that alias's name).
+export { preRegisterDynamicEntry, replayStepNames } from "./access/window-gated.js";
+export type { ReplayableToolEntry } from "./access/window-gated.js";
+
+// ── Signals a channel/test marks or consumes around a turn (reply/no-reply) ─────────────────
+// (consumeRepliedThisTurn is exported below; the mark side is here for bundle tests that drive a
+// channel's message.completed path directly.)
+export { markRepliedThisTurn } from "./channels/reply-signal.js";
+export { markNoReplyThisTurn } from "./channels/no-reply-signal.js";
+
+// ── Audit read (audit/audit.ts) — the append seam's read sibling (tests/ops tooling) ────────
+export { readAudit } from "./audit/audit.js";
+
+// ── Capability manifest seam (identity/capabilities.ts) — per-platform capability flags ─────
+export { registerCapabilityManifest, capabilitiesForPlatform, registeredCapabilityManifestPlatforms } from "./identity/capabilities.js";
+export type { CapabilityManifest } from "./identity/capabilities.js";
+
+// ── Surface-parity ledger (identity/surface-parity.ts) — the OPE-1499 sibling of the manifest ──
+// The manifest above is a RUNTIME GATE (a tool mounts on it). This is a DECLARATION: every
+// capability the chat-surface contract names, answered `supported` or `{ unsupported: "<reason>" }`
+// by every provider, read only by `lint:surface-parity` and the docs generator that renders §7.1,
+// §7.1.1 and §7.2 from it. Registered from the same `register<X>Provider()` seam.
+export {
+  registerSurfaceParity,
+  surfaceParityFor,
+  registeredSurfaceParityPlatforms,
+  checkSurfaceParity,
+  renderParityTable,
+  renderParityMatrix,
+  isSupported,
+  declarationNote,
+  SURFACE_CAPABILITIES,
+} from "./identity/surface-parity.js";
+export type {
+  SurfaceParityDeclaration,
+  SurfaceCapability,
+  SurfaceCapabilityId,
+  CapabilityDeclaration,
+  CapabilityGroup,
+  CapabilityProbe,
+  ParityProblem,
+} from "./identity/surface-parity.js";
+
+// ── Post-arm registry (channels/post-arms.ts) — per-provider reply/unified/redrive dispatch ─
+// An arm author also needs the target types the arm's methods speak: the per-surface ReplyTarget
+// (reply-post.ts), the UnifiedWakeOrigin (unified-window.ts, below), and UnifiedReplyDeps
+// (unified-reply.ts). TargetResolveBag is the bag handed to resolveTarget().
+// DirectMessageRequest/Delivery are the OPE-44 DM-delivery member's in/out types.
+// `registeredPostArmPlatforms` is the read side, used by `lint:surface-parity` to probe the
+// post-arm row of the §7.1 table against what the bundles actually registered (OPE-1499).
+// `unifiedActionCapablePlatforms` is the same read side for the COMPONENT-PLANE member
+// (`dispatchUnifiedActions`), probing the `unified-action-plane` row of the same table (OPE-1720).
+export { registerPostArm, registeredPostArmPlatforms, unifiedActionCapablePlatforms } from "./channels/post-arms.js";
+export type { PostArm, PostIntent, TargetResolveBag, DirectMessageRequest, DirectMessageDelivery, DirectMessageAction, ReactTarget } from "./channels/post-arms.js";
+export type { ReplyTarget } from "./channels/reply-post.js";
+export type { UnifiedReplyDeps } from "./channels/unified-reply.js";
+// EditLocus is the address the OPE-793 `editMessage` member dispatches on. `recordOwnPost` is
+// exported for the ONE arm that posts somewhere its spine cannot name: Discord's unified auto-thread
+// leg opens a thread at post time and answers THERE, so the spine's own ledger write records the base
+// channel and the arm must record the thread as well. No arm may use it to widen what is editable
+// beyond a message it genuinely just posted.
+export type { EditLocus } from "./channels/reply-edit.js";
+// markNotApplied is how an arm says its failed call was DEFINITIVE — the platform read the request
+// and refused it, or the call never left this host, so nothing happened (OPE-802/OPE-821). Without
+// that statement an unclassifiable failure counts as AMBIGUOUS, and the spine then keeps the dedupe
+// claim (a post) or ends the turn (an edit) rather than letting a retry through. So an arm that KNOWS
+// nothing happened must say so. A numeric `status` on the error says the same thing for a plain HTTP
+// rejection; the flag is for the arms whose platform answers 200 with a refusal body, or that refuse
+// before the call. It reads the same on every verb — a post, a reaction and an edit share one
+// classifier (channels/platform-failure.ts).
+// carryFailureSignals is for the arms that RE-WRAP a transport error in their own token-free copy
+// (Teams does): without it the re-wrap drops the class and every such failure reads as AMBIGUOUS.
+// platformFailureClass is the READ side of the same statement — exported so an arm (or an arm's
+// test) can ask what its own error would tell the spine, without re-deriving the rule.
+export { markNotApplied, carryFailureSignals, platformFailureClass } from "./channels/platform-failure.js";
+export type { PlatformFailureClass } from "./channels/platform-failure.js";
+export { recordOwnPost } from "./channels/own-post-ledger.js";
+
+// ── Closing-prose drop (channels/closing-prose-drop.ts) — OPE-2006 ────────────────────────────
+// dropClosingProse: what a chat-surface channel's message.completed calls INSTEAD of posting the
+// model's ending-turn text. The terminal-prose poster is deleted — the `reply` tool is the only
+// channel a seat's words leave by — so a turn that ends in prose is DROPPED and audited, and this
+// writes that one row. It posts nothing, and holds no target, arm or transport to post with.
+export { dropClosingProse, CLOSING_PROSE_DROPPED_ACTION } from "./channels/closing-prose-drop.js";
+export type { ClosingProseDrop, ClosingProseDropRow } from "./channels/closing-prose-drop.js";
+export type { ReplyAudit, ReplierLabel } from "./channels/reply-post.js";
+// postHostNotice is `postReply` with the audit parameter removed from its SIGNATURE, not merely
+// omitted at the call site (OPE-1275) — exporting audit-OPTIONAL `postReply` bare to a provider
+// bundle would let a provider post a model's actual answer with no `reply.post` row, which is the
+// canonical-post invariant `postReply`'s own header states and the eval scorers join on. A
+// provider's own `input.requested` handler uses this to show a parked question or approval prompt
+// on a surface with no other way to render one — the same posture channels/question-bridge.ts's
+// unified-only bridge already takes for the identical event.
+export { postHostNotice } from "./channels/reply-post.js";
+// detectBridgeableInputRequest / renderQuestionForSurface let a provider's own channel show a
+// non-park `input.requested` batch (an `ask_question` or a `tool-approval`) on a surface eve ships no
+// built-in default for. BridgeableQuestion is the reduced shape both take.
+export { detectBridgeableInputRequest, renderQuestionForSurface } from "./channels/question-bridge.js";
+export type { BridgeableQuestion } from "./channels/question-bridge.js";
+// ── THE RETURN LEG, FOR A NATIVE ROUTE (OPE-1305) ────────────────────────────────────────────────
+// The outbound half above shows a parked question. These four are what let the room ANSWER it, and
+// until now they were reachable only from the unified channel (channels/unified.ts), which is why a
+// DELEGATED WORKER's question on a native route was visible and still unanswerable: eve proxies the
+// child's request up through the PARENT's adapter, and the answer reaches the child ONLY through an
+// `inputResponses` entry whose `requestId` sits in the parent's proxy map. A plain message falls to
+// `forSelf`, the parent eats it, and the worker stays parked forever.
+//
+// 🔴 A PROVIDER WIRING THIS OWES ALL FOUR, NOT THREE. `rememberBridgedQuestion` on a POSTED question
+// only; `resolveInboundAnswerRouting` on every inbound message; `forgetBridgedQuestion` the moment an
+// answer is delivered (consume-once — without it the message AFTER the answer is eaten too). The
+// room comparison is not optional either: the caller must pass a container key on BOTH sides, or the
+// routing answers `foreign-room` and nothing is ever an answer. Read that module's header first.
+export {
+  rememberBridgedQuestion,
+  readBridgedQuestion,
+  forgetBridgedQuestion,
+  resolveInboundAnswerRouting,
+  QUESTION_ANSWERED_AUDIT_ACTION,
+  QUESTION_ANSWER_DROPPED_AUDIT_ACTION,
+} from "./channels/question-bridge.js";
+export type { OutstandingQuestion, InboundAnswerRouting, BridgedQuestionStore } from "./channels/question-bridge.js";
+// THE TAPPABLE HALF OF THE SAME BRIDGE (OPE-1720, channels/approval-card.ts). A surface whose post
+// arm declares `dispatchUnifiedActions` also owes the RETURN leg for the button it renders: classify
+// the `oe_input:` click on its front, `parseApprovalClickId` it, `resolveApprovalCardClick` it, and on
+// a `settle` deliver `respond([{requestId, optionId}])` and consume BOTH rows — the ticket here and
+// the outstanding question above. An arm that renders the button without the return leg ships a
+// button that settles nothing, which on a governed approval is worse than no button at all.
+export {
+  OE_INPUT_CLICK_PREFIX,
+  APPROVAL_BUTTON_LABELS,
+  approvalClickId,
+  parseApprovalClickId,
+  mintApprovalCardTicket,
+  approvalCardActions,
+  rememberApprovalCardTicket,
+  readApprovalCardTicket,
+  forgetApprovalCardTicket,
+  resolveApprovalCardClick,
+  // The tap's own audit row, core-owned so the two action NAMES cannot drift per surface, and so the
+  // two outcomes that never reach a routing decision (`spend-declined`, `error`) are recorded rather
+  // than logged — see the type's own note (OPE-1856).
+  APPROVAL_CARD_SETTLED_AUDIT_ACTION,
+  APPROVAL_CARD_REFUSED_AUDIT_ACTION,
+  auditApprovalCardTap,
+  // THE DELIVERY ITSELF (OPE-1863). A front route binds its `args.attachSession` through this and
+  // hands the result to its tap handler. Core owns the address for the reason it owns the two action
+  // names above: a surface that spelled it itself spelled it WRONG — `from(bareToken)` on the
+  // surface's own channel names a session that has never existed, and the settle threw.
+  approvalCardRespondVia,
+} from "./channels/approval-card.js";
+export type { ApprovalCardInputResponse, ApprovalCardRespondFn, AttachSessionForRespond } from "./channels/approval-card.js";
+export type { ApprovalCardTicket, ApprovalClickRouting, ApprovalClickRefusal, ApprovalClickDeps, ApprovalClickAuditReason, ApprovalCardTapOutcome } from "./channels/approval-card.js";
+// The eve-context token strip (channels/window-key.ts). A provider's `input.requested` handler reads
+// `channel.continuation.token`, which eve NAMESPACES with the channel definition name
+// (`notion:notion:<page>:oe-sup:g1`), while its own dispatch holds the BARE token it minted. The two
+// must key one row, so the namespaced side goes through this and the bare side does not — passing a
+// bare colon-bearing token through it strips a real segment (that ambiguity is stated in the
+// function's own header, and pinned for Notion by providers/notion/scripts/notion-test.ts).
+export { bareTokenFromEveContext } from "./channels/window-key.js";
+
+// ── Chat-turn audit partition (channels/chat-turn-audit.ts) — OPE-114 stage 4 addendum ────────
+// auditNoReplySentinelObserved: the NO_REPLY sentinel's own ALWAYS-ON audit row (OPE-890) — a chat
+// surface's message.completed calls this when the turn's final text was the bare sentinel, the
+// twin of tools/no_reply.ts's tool-route `reply.no_reply_observed` row.
+export { auditNoReplySentinelObserved } from "./channels/chat-turn-audit.js";
+export type { ChatAuditPartition } from "./channels/chat-turn-audit.js";
+
+// ── Wake-origin codec + unified-window target store (channels/wake-origin-codec.ts, unified-window.ts) ─
+// A bundle's channel registers a codec for its platform's UnifiedWakeOrigin, mints a wake id, stows
+// the origin in the target store, and consults the single-window mention policy.
+export { registerWakeOriginCodec, wakeOriginCodec } from "./channels/wake-origin-codec.js";
+export type { WakeOriginCodec } from "./channels/wake-origin-codec.js";
+// (rootDmGrainAttrs / OE_GRAIN_ATTR ride along here: the single shared expression of the
+// window-tool-gating §D-DM narrowing every per-surface auth builder stamps on a 1:1 DM or group-DM
+// ingress, and the raw attribute key a bundle's own grain-stamp tests assert against.)
+export { registerUnifiedWakeTarget, mintWakeId, singleWindowMentionPolicy, rootDmGrainAttrs, unifiedThreadRef, OE_GRAIN_ATTR, OE_TASK_LABEL_ATTR } from "./channels/unified-window.js";
+export type { UnifiedWakeOrigin, UnifiedWindowWake, SingleWindowMentionPolicy } from "./channels/unified-window.js";
+// (OPE-1716) The vendor-clock readers a front door calls to stamp `UnifiedWindowWake.vendorTs` —
+// the first of the four latency anchors, and readable only where the vendor's payload is: here.
+export { slackVendorEventTime, discordVendorEventTime, vendorInstantEventTime, receiptEventTime, spreadVendorTs } from "./channels/wake-timing.js";
+export type { VendorEventTime, VendorEventSource } from "./channels/wake-timing.js";
+
+// ── Window-grain classification (identity/binding.ts) — OPE-114 stage 4 addendum ──────────────
+// windowGrainOf: the PRIMARY (oe_grain stamp) over BACKSTOP (token shape) grain classifier a
+// bundle's own window-tool-gate coverage drives its buildXxxAuth fixtures through.
+export { windowGrainOf } from "./identity/binding.js";
+export type { WindowGrain } from "./identity/binding.js";
+
+// ── Channel read adapter (channels/channel-read.ts) — a surface's backscroll/thread reader ──
+// A provider bundle that owns a read surface (e.g. teams over Microsoft Graph) registers its adapter
+// here; READ_ADAPTERS / SUPPORTED_READ_PLATFORMS / resolveReadAdapter are the live registry views the
+// bundle's own read-adapter test drives (asserting its adapter routes once registerXProvider ran).
+export { registerReadAdapter, resolveReadAdapter, READ_ADAPTERS, SUPPORTED_READ_PLATFORMS, supportedReadPlatforms } from "./channels/channel-read.js";
+export type { ReadAdapter, WakeReadAddress, AdapterReadFetch } from "./channels/channel-read.js";
+// ChannelScopeError: a read adapter throws this fail-closed shape when a requested surface is outside
+// the session's memory-domain read scope (its own cycle-free module since the slack extraction —
+// channels/read-scope-error.ts; the slack + teams read adapters both reuse it).
+export { ChannelScopeError } from "./channels/read-scope-error.js";
+
+// ── Work-plane federated search (channels/work-search.ts, OPE-961) — the `search` tool's registry.
+// A provider bundle that owns a searchable work surface (Notion, Linear) registers its adapter here,
+// gated by provider selection exactly like registerReadAdapter above. GitHub's SCM plane registers
+// through registerCoreWorkSearchAdapter instead — it does not participate in provider selection.
+export { registerWorkSearchAdapter, registerCoreWorkSearchAdapter, workSearchAdapterFor, registeredSearchConnectors, searchGrantedConnectors } from "./channels/work-search.js";
+export type { WorkSearchAdapter, WorkSearchHit, WorkSearchAbsence, WorkSearchOpts } from "./channels/work-search.js";
+// Front-door plumbing (channels/front-queue.ts) — the provider-neutral retry-dedupe + per-container
+// FIFO a fronted channel (slack-front, teams-front) reuses rather than reimplements (lifted out of
+// slack-front.ts when slack left core).
+export { EventDedupe, ThreadFifo } from "./channels/front-queue.js";
+// (dropClosingProse / ChatAuditPartition — the closing-prose drop — are exported in the
+// chat-surface support-kit section above.)
+
+// ── Reaction surface registry (channels/reaction-ingest.ts) — emoji-feedback ingest ─────────
+export { registerReactionSurface, isRegisteredReactionSurface } from "./channels/reaction-ingest.js";
+
+// ── Wake builder support (channels/normalized-wake.ts, channels/wake-envelope.ts) ───────────
+// A supervisor builds a NormalizedWake (mkMessageTrigger over a WakeMessageInput, engagement tier,
+// author WakeTrust) and hands it to renderWake for the model-facing envelope.
+export { renderWake, mkMessageTrigger } from "./channels/normalized-wake.js";
+export type { NormalizedWake, WakeEngagementTier } from "./channels/normalized-wake.js";
+export type { WakeMessageInput, WakeTrust, WakeReason } from "./channels/wake-envelope.js";
+// The ENROLMENT fact an engaged conversation's wake states (channels/engaged-wake.ts): the ONE
+// contract helper every enveloped surface calls, and the trusted turn-context line the one surface
+// with no envelope — GitHub's native `githubChannel` session — carries instead.
+export { engagedFollowUpContract, ENGAGED_FOLLOW_UP_CONTEXT } from "./channels/engaged-wake.js";
+// The NAME-DROP road's own two rows (channels/name-drop-wake-audit.ts, OPE-1899). Every surface with
+// no @mention primitive depends on that road, so the ADMIT row is what tells a judged NO_REPLY apart
+// from a dead `nameDropWake` from outside the deployment.
+export { auditNameDropWoke, auditNameDropSilent, NAME_DROP_WOKE_ACTION, NAME_DROP_SILENT_ACTION } from "./channels/name-drop-wake-audit.js";
+export type { NameDropRoad, NameDropVia, NameDropAuditKey } from "./channels/name-drop-wake-audit.js";
+
+// ── Unified-window diversion (channels/unified.ts) — send a turn into the domain's single window ─
+export { divertToUnifiedWindow } from "./channels/unified.js";
+
+// ── Pruned-deployment strand (channels/stranded-seat.ts) — a surface's re-delivery predicate ─────
+// The divert already classifies and marks the seat; a surface reads THIS to decide whether the same
+// wake is worth delivering a second time (slack-front.ts deliverWithStrandRetry). OPE-971:
+// `healPrunedDeploymentStrand` itself is exported too — the four ambient-supervisor surfaces call it
+// directly on their own NATIVE (flag-off) send failure, passing their own known registryKey.
+export {
+  isPrunedDeploymentWakeError,
+  markUndeliveredAfterHeal,
+  isUndeliveredAfterHeal,
+  healPrunedDeploymentStrand,
+  RUN_KEY_FETCH_MARKER,
+  HTTP_404_MARKER,
+  PRUNED_DEPLOYMENT_AUDIT_ACTION,
+} from "./channels/stranded-seat.js";
+export type { StrandHealInput, StrandHealOutcome } from "./channels/stranded-seat.js";
+
+// ── Supervisor grain + rotation (channels/unified-supervisor.ts) ────────────────────────────
+export { supervisorGrainFor, grainUsesUnifiedWindow, mintRotationToken } from "./channels/unified-supervisor.js";
+export type { SupervisorGrain } from "./channels/unified-supervisor.js";
+
+// ── Runtime-change rotation (channels/runtime-rotation.ts) — the OPE-599 pre-dispatch self-heal ─
+// EVERY surface's `getOrCreateSession` claims this BEFORE it reads the registry row, and passes the
+// boolean into `shouldRotate` as `runtimeChanged`. A stranded session cannot be detected any other
+// way (the failure reaches no userland seam), so the first wake after an eve bump rotates the seat
+// and delivers into the fresh token. Read the module header before changing a call site.
+// `stampMintedRuntime` rides beside it: every mint arm that consumes the claim must also stamp the
+// row it mints, or that seat never rotates for the deploy its second wake crosses (OPE-1821).
+export { claimRuntimeRotation, stampMintedRuntime } from "./channels/runtime-rotation.js";
+
+// ── Supervisor turn completion (channels/supervisor-complete.ts) — the shared ticketing arm ─
+// auditSupervisorFailure: a provider's channel audits a supervisor turn/session failure through the
+// same append helper (no Activities target to post it to) — used by the linear/github supervisors.
+export { completeSupervisorTurn, auditSupervisorFailure, consumeSupervisorReplyMark } from "./channels/supervisor-complete.js";
+export type { SupervisorCompletionSpec } from "./channels/supervisor-complete.js";
+
+// ── Turn delivery decisions (channels/turn-delivery.ts) — reply / silence / rotate resolution ─
+export {
+  finalMessageAction,
+  finalMessageActionForTurn,
+  isBareStop,
+  isNoReply,
+  shouldRotate,
+  supervisorTextDelivery,
+  isSupervisorProseLeak,
+  nameDropPattern,
+  wakeNameDropTokens,
+  NO_REPLY_SENTINEL,
+  NO_REPLY_SENTINEL_REASON,
+  replierLabelFor,
+  replierLabelFromAuthAttributes,
+  withReplierPrefix,
+  truncateTaskLabel,
+} from "./channels/turn-delivery.js";
+export type { FinalMessageAction, SupervisorTextDelivery } from "./channels/turn-delivery.js";
+
+// ── Silent-routine turn signal (routines/report.ts) — the OPE-149 structural silence gate ─
+// Five surfaces get it for free through finalMessageActionForTurn. The TWO that delegate a
+// non-supervisor `message.completed` straight to eve's defaults (github.ts, linear.ts) never reach
+// that function, so they must consult the signal themselves BEFORE delegating — otherwise a silent
+// routine firing into an issue posts the literal string "NO_REPLY". That is the only reason this
+// is on the barrel: it is a provider-side pre-check, not core-internal state.
+// markSilentRoutineTurn is the WRITER (hooks/routine-silence.ts owns it in production, off the
+// host-set fire stamp). It rides the barrel because each bundle's own suite must be able to drive
+// its pre-check — a bundle script may not deep-import past this barrel (boundary-test rule 4), and
+// an untested pre-check on a surface that leaks by default is the failure this ticket exists to
+// stop. A provider must not call it in a channel: the stamp, not a channel, decides silence.
+export { silentRoutineThisTurn, markSilentRoutineTurn, SILENT_ROUTINE_DROP_REASON } from "./routines/report.js";
+
+// ── Per-turn reply signal (channels/reply-signal.ts) — read-and-reset "did we reply this turn?" ─
+export { consumeRepliedThisTurn } from "./channels/reply-signal.js";
+
+// ── Wake-trust resolution (identity/wake-trust.ts, identity/trust.ts) ───────────────────────
+export { resolveWakeTrustFromContext } from "./identity/wake-trust.js";
+export { isVouchedInternal, isVouchedSurface, declaredWorkspaceTrust, declaredSurfaceTrust, declaredTrustForKeys } from "./identity/trust.js";
+export type { SurfaceTrustQuery } from "./identity/trust.js";
+export { dmTrustTtlMs } from "./identity/trust.js";
+
+// ── AUTHOR trust (OPE-516; identity/author-trust.ts) — the AUTHORITY plane ──────────────────
+// The sibling of the surface (AUDIENCE) registry above, for the platforms that cannot refute an
+// author themselves: Discord has no organisation concept, Notion has no per-author membership
+// signal. The operator declares who is internal per tenant; an armed tenant then grades every
+// unlisted author `external`, and an UNARMED one grades nobody. A surface passes the query on its
+// ingested messages (`IngestedChatMessage.authorTrust`) and the join in taint-signal.ts applies it.
+export {
+  declaredAuthorTrust,
+  authorRefutedByRegister,
+  registerAuthorTrust,
+  defineAuthorTrust,
+  armedAuthorTrustTenants,
+  _resetAuthorTrustForTest,
+} from "./identity/author-trust.js";
+export type { AuthorTrust, AuthorTrustEntry, AuthorTrustQuery, AuthorMember } from "./identity/author-trust.js";
+
+// ── EXTERNAL-PARTICIPANT POLICY (OPE-507 author grain / OPE-504 room grain) ─────────────────
+// CONSEQUENCE, not classification. The two registries above answer WHO is external; this answers
+// what follows — whether an excluded author's text is taint-wrapped (shipped) or WITHHELD, and
+// whether the agent engages in an external room at all. A surface resolves the policy once per wake
+// (`resolveExternalPolicy` over `externalPolicyOverrideFor`), transforms its wake through
+// `withholdWakeBodies`, and hands the taint join `ingestedAfterWithholding` so a body that never
+// entered never keys taint.
+export {
+  resolveExternalPolicy,
+  shippedExternalPolicy,
+  authorIsExcluded,
+  withholdsBody,
+  withholdWakeBodies,
+  withheldWakeMessage,
+  ingestedAfterWithholding,
+  suppressesAddressedWake,
+  suppressesAmbientWake,
+  externalPolicyIsInert,
+  roomIsExternalClass,
+  roomIsSilenced,
+  silentRoomNotice,
+  silentNoticeKey,
+  WITHHELD_BODY_MARKER,
+  EXTERNAL_SENDER_NOTICE,
+  // OPE-885 — the fixed line an EXPLICITLY ADDRESSED suppressed wake gets, the one predicate that
+  // decides whether it is owed, and the audit `rendering` field that records the choice. All five
+  // suppression sites read these three so no surface spells the rule its own way.
+  EXTERNAL_MENTION_ACK,
+  owesSuppressedMentionAck,
+  suppressionRendering,
+  SILENT_NOTICE_KINDS,
+} from "./access/external-policy.js";
+export type {
+  ExternalPolicy,
+  ExternalPolicyOverride,
+  ExternalAuthorGrain,
+  ExternalRoomGrain,
+  ExternalAuthorFacts,
+  ExternalRoomFacts,
+  SilentNoticeKind,
+} from "./access/external-policy.js";
+export { externalPolicyOverrideFor } from "./memory/domain.js";
+
+// ── Domain engagement predicates (memory/domain.ts) — ambient/engagement-tier gating ────────
+// (defineDomain / modelRouteFor / memoryRefs are re-exported in the model-plane block above.)
+// domainForChannel + the Domain shape: a read adapter resolves the caller's domain to compute its
+// per-channel read allowlist (teams-read.ts's allowedTeamsChannelIds).
+export { ambientSupervisorEnabled, admissionNameFor, standingSeatDomainFor, windowedSupervisorEnabled, engagementTierFor, domainForChannel, resolveDomainForChannel, domainReachVerdict, domainRoster, domainContainers, ambientSkipFor, assertDomainsValid, partitionTenantProblems } from "./memory/domain.js";
+export type { EngagementTier, Domain, DomainVia, DomainRouting, AmbientSkip } from "./memory/domain.js";
+// The recorder every ambient ingress calls when the gate above said no — see channels/ambient-skip.ts
+// for why "never having been asked" needed to become as answerable as "asked and chose silence".
+export { auditAmbientSkip, resetAmbientSkipSightings } from "./channels/ambient-skip.js";
+export type { AmbientSkipRecord } from "./channels/ambient-skip.js";
+
+// ── Per-domain credential override (access/domain-credentials.ts, OPE-467) ─────────────────
+// A provider bundle asks "which credential does THIS domain call the vendor with?" and derives
+// its ingress integration registry from the same answer. A domain with no binding gets the org
+// default; a binding that names nothing is refused at boot, never silently downgraded.
+export { credentialOverrideFor, domainCredentialId, connectorIntegrations } from "./access/domain-credentials.js";
+export type { DomainCredentialOverride, ConnectorIntegration, CredentialBoundDomain } from "./access/domain-credentials.js";
+// ── The WORK-SURFACE grant (access/work-grant.ts, OPE-913 / the OPE-928 provider contract) ──
+// The SAME field, read by the OPPOSITE rule: declaring a provider's WORK role on a domain IS the
+// grant, and absence is a refusal — never the org default. A provider's work tools mount on this
+// predicate and nothing else.
+// `callerWorkDomain` / `callerWorkGrant` are the ONE grant→mount chain (OPE-951): resolve the
+// caller's own domain from its ctx, then read the grant off it, with every failure absorbed to "no
+// grant". A provider's mount predicate is that call read as a boolean; its work-credential resolver
+// is the same call read as a string. Do not re-spell the chain in a bundle.
+export { callerWorkDomain, callerWorkGrant, workGrantCredential, hasWorkGrant, type WorkDomainResolver } from "./access/work-grant.js";
+// ── The CREDENTIAL-GRANT plane (access/credential-grant.ts, OPE-1060) ──────────────────────────
+// 🔴 THIS FILE OFFERS NO REGISTRATION FOR THIS PLANE, AND A BUNDLE MUST NOT REACH PAST IT FOR ONE.
+// Personal lending BORROWS one of the owner's vendor MCP tools. Core registers the one generic
+// borrow transport for every connector the deployment admits grants for
+// (connections/grant-mcp-transport.ts), and a provider bundle registers nothing. The plane once
+// carried a second, provider-registered arm — a bundle declared a grantable VERB, the broker
+// COMPOSED a REST request from it, and the bundle's transport sent that request under a per-user
+// credential bounded only by that credential's URL rule, never by the MCP call fence. OPE-1136
+// deleted the last bundle that did so (notion), and OPE-1334 deleted the registry, the mint arm,
+// the send arm and the exports for all of it.
+// ⚠️ WHAT IS NOT DELETED, said plainly rather than implied: `registerGrantBorrowTransport`
+// (access/credential-grant-broker.js) is on core's published export map, so a bundle can still
+// deep-import it. It can no longer TAKE THE CONNECTOR FROM CORE (OPE-1391). The registry is
+// FIRST-write-wins: core registers its fenced transport where the granted tools mount, a later
+// registration for that connector throws `GrantBorrowTransportAlreadyRegisteredError`, and the first
+// transport keeps every call. That refusal is the fence for the surface OPE-1136 removed — a
+// replacing transport spent the owner's credential outside the MCP call fence.
+// 🔴 REGISTERING FIRST IS NOT A WAY ROUND IT, AND IS NOT HARMLESS EITHER. A bundle module that
+// evaluates before the granted tools mount registers into an empty registry and holds the connector.
+// Core's own boot registration then THROWS instead of yielding, so the deployment FAILS TO BOOT
+// rather than serving granted calls through the bundle's transport. Either way the bundle never gets
+// a granted call: the outcome it buys is a dead deployment. It is core's own seam. Never call it
+// from a bundle.
+// The type below is what a transport is handed, and it is read-only reference for a bundle.
+// 🔴 CORE ANSWERS "WHOSE CREDENTIAL", THE TRANSPORT ANSWERS "HOW TO GET AND SEND IT" (OPE-1074).
+// The broker hands a transport a `GrantOwnerSubject` — the OAuth vault subject the owner's own
+// authorization keyed their token by — and the transport mints against it with its own connector's
+// flow. A provider must never derive that subject itself: the composer lives in core
+// (identity/oauth-vault-share.ts) and a second spelling addresses a row that does not exist.
+export type { GrantOwnerSubject } from "./access/credential-grant-owner.js";
+export type { CredentialGrantRow, CredentialGrantMode } from "./operational/credential-grant-rows.js";
+// The window's SOURCES ∪ the connectors its domain holds a work grant on (channels/work-destinations.ts,
+// OPE-931) — the admissible-platform set the neutral entity-action/ticket-create tools mount on, and
+// (OPE-948) the same set a provider's own bespoke read tool mounts on when it wants the same union.
+export { workDestinationPlatforms } from "./channels/work-destinations.js";
+// The operator-secret resolver (credentials/operator-secrets.ts) — db-store wins, env is the
+// migration on-ramp. An INBOUND signing key is read by NAME through this, never as an outbound
+// credential (credentials/reserved-refs.ts draws that line).
+// `OperatorSecretNotSetError` is the ONE failure a caller may treat as "this optional secret is
+// simply not configured". Every other throw is a real fault (an unarmed encryption key, a store
+// that will not open) and must be reported — and the two MESSAGES are not distinguishable, so the
+// class is the seam.
+export { getOperatorSecret, OperatorSecretNotSetError } from "./credentials/operator-secrets.js";
+
+// ── Window-topology capability (access/capabilities.ts) — is the domain's single-window mode on? ─
+// A provider channel consults this to decide solo vs unified window keying for its supervisor.
+export { windowTopologyEnabled } from "./access/capabilities.js";
+
+// ── Context-render shape (channels/context-render.ts) — a supervisor's context-line type ────
+// A bundle's ambient supervisor builds `ContextLine[]` (the platform-agnostic speaker+text slice
+// renderWake consumes as the wake's context block).
+export type { ContextLine } from "./channels/context-render.js";
+
+// ── Idempotent host-side post (operational/post-once.ts) — crash-resume dedupe for raw posts ─
+// A supervisor completion that posts host-side (bypassing eve's durable reply primitive) wraps the
+// post in postOnce keyed by outboundKey so a step re-run after the post lands never double-posts.
+export { postOnce, outboundKey } from "./operational/post-once.js";
+
+// ── Live memory-delta dependency (memory/wake-delta.ts) — wake-time "what changed" pointer ──
+export { liveMemoryDeltaDep } from "./memory/wake-delta.js";
+
+// ══════════════════════════════════════════════════════════════════════════════════════════════
+// OPE-114 stage 4 (discord bundle) — the additional chat-surface / approvals / spend / dispatch
+// ports the deepest-integrated provider (discord: a custom gateway transport + admin approval cards
+// + guild-admin bypass + routine dispatch) rides. Each is a REGISTRY seam a bundle registers into,
+// or a provider-neutral support function a bundle's channel/supervisor/tools call.
+// ══════════════════════════════════════════════════════════════════════════════════════════════
+
+// ── Ancillary surface message ops (channels/surface-message-ops.ts) — post-with-anchor / edit / upload ──
+// A bundle registers its bot-token REST transport here; post_file / the approval
+// decision-notice dispatch these secondary ops by platform key (Slack keeps its arms inline).
+// THE SHARED EGRESS EXIT (OPE-1132) — exported so a provider bundle whose transport does NOT come
+// back through a core registry (the Slack status glyph rides eve's own channel handle) can take the
+// same gate every core room post takes. A bundle that posts through a core seam needs neither
+// import: the seam gates for it.
+export { swallowRoomPost, swallowRoomOp } from "./channels/egress-spoof.js";
+export { registerSurfaceMessageOps, surfaceMessageOps, postSurfaceText, resolveMessagePermalink, setSurfaceReaction } from "./channels/surface-message-ops.js";
+export type { SurfaceMessageOps, OutboundFile, MessageRef } from "./channels/surface-message-ops.js";
+
+// ── STOP: the pre-dispatch turn cancel (channels/turn-cancel.ts + channels/turn-registry.ts) ──
+// A surface's ingress route resolves the anchor and cancels WITHOUT minting a session — the free,
+// pre-model, over-cap-proof half of "stop". `turnAnchorKey`/`turnChannelKey` build the two keys a
+// trigger can offer (a reaction knows its exact message; a slash command knows only its channel).
+export { cancelAnchoredTurn, isStopDirective, TURN_CANCEL_ACTION } from "./channels/turn-cancel.js";
+export type { AttachSessionForCancel, CancelAnchoredTurnInput, CancelResult, CancelOutcome } from "./channels/turn-cancel.js";
+export { turnAnchorKey, turnChannelKey, TURN_ANCHOR_TTL_MS } from "./channels/turn-registry.js";
+
+// ── Approval-card + judge-lift-notice poster registries, and the decide/notice/feedback funnel a
+//    non-Slack flow rides (approvals/flow.ts). The two poster registries are separate on purpose —
+//    see the JUDGE_LIFT_NOTICE_POSTERS header there for why one hook cannot serve both. ──
+export {
+  registerCardPoster,
+  cardPosterFor,
+  registerJudgeLiftNoticePoster,
+  judgeLiftNoticePosterFor,
+  resolveApprovalClick,
+  deliverDecisionFeedback,
+  discordDecisionWakeTarget,
+  postDiscordDecisionNotice,
+} from "./approvals/flow.js";
+export type { CardPoster, JudgeLiftNoticePoster, ApprovalClickResolution, DecisionWakeDeps } from "./approvals/flow.js";
+// The refused-click copy (OPE-185) — ONE renderer, so a bundle's ephemeral and the Slack thread
+// note cannot drift into two different explanations of the same refusal.
+export { clickerFloorRefusalNotice } from "./approvals/clicker-floor.js";
+export type { ClickerFloorRefusal } from "./approvals/clicker-floor.js";
+// The judge-contradiction copy (OPE-965) — same one-renderer rule as the refused-click copy above.
+export { judgeContradictionNotice } from "./approvals/judge-contradiction.js";
+export type { ContradictJudgeAllowOutcome } from "./approvals/judge-contradiction.js";
+// The eve-owned HITL answer admission (OPE-574) — FIVE call sites run this ONE decision: three
+// WIDGET arms (the Slack and Teams `onInputResponse` hooks, and the click on the bridged approval
+// card) and two ROOM-MESSAGE arms (the unified window's inbound leg, and Notion's native return
+// leg). A refusal reports the same reason vocabulary and one audit action
+// (`input_response.denied`) on every arm. What each arm can OBSERVE differs: only the three WIDGET
+// arms supply leg B, so the two ROOM-MESSAGE arms are where a guest in an ordinary internal channel
+// may answer. The module header lists every call site by file, with the leg B verdict each arm
+// supplies.
+export { admitInputResponse, inputResponseRefusalNotice, INPUT_RESPONSE_DENIED_AUDIT_ACTION } from "./approvals/input-response-floor.js";
+export type { InputResponseAdmission, InputResponseRefusal, InputResponseScope } from "./approvals/input-response-floor.js";
+export type { ApprovalOutcome } from "./approvals/decision-wake.js";
+
+
+// ── Native standing-check registries (access/native-admin.ts) — the spend-cap bypass's native leg,
+//    and the float-undo actor gate's native leg (OPE-303) ──
+export { registerNativeAdminCheck, registerNativeMemberCheck } from "./access/native-admin.js";
+export type { NativeAdminCheck, NativeMemberCheck } from "./access/native-admin.js";
+
+// ── Scope-label resolver registry (approvals/scope-label.ts) — friendly approval-card labels per surface ──
+export { registerScopeLabelResolver } from "./approvals/scope-label.js";
+export type { ScopeLabelResolver } from "./approvals/scope-label.js";
+
+// ── Zero-inference "/oe" control command (commands/core.ts) — a surface's slash-command half runs it ──
+export { OE_COMMAND_NAME, runOeCommand } from "./commands/core.js";
+export type { OeCommand, OeCommandDeps } from "./commands/core.js";
+
+// ── Webhook signature gate (webhooks/gate.ts) — a custom relay transport verifies its HMAC ──
+// `webhookMaxSkewSeconds` rides out with it (OPE-197) because a bundle-resident verifier that
+// declares `signedTimestamp: true` MUST bound freshness by the DEPLOYMENT's one window
+// (`OE_WEBHOOK_MAX_SKEW_SECONDS`) rather than by a second constant of its own — gate.ts's own header
+// says the bound lives there precisely so schemes share it, and a bundle that cannot reach it would
+// have no way to obey that but to copy the number.
+export { verifyWebhookSignature, webhookMaxSkewSeconds } from "./webhooks/gate.js";
+
+// ── Authenticated self-hop primitives ────────────────────────────────────────────────────────
+// Provider-owned durable ingress drains use the same deployment-local HMAC custody and own-URL
+// resolution as core's unified dispatch and transcript relay. Export the small primitives rather
+// than letting a provider copy the secret/bootstrap rules or reach through this barrel.
+export { getOrMintSelfSecret, selfSecretsArmed } from "./credentials/self-secrets.js";
+export { readCappedBody, selfDispatchBaseUrl } from "./channels/self-dispatch.js";
+
+// ── Webhook VERIFIER REGISTRY (webhooks/verifier.ts, OPE-164) — a provider bundle contributes the
+// signature scheme of the vendor it owns, so a GENERIC hook can declare `source: "<vendor>"` and be
+// verified in that vendor's own scheme. Core holds no vendor scheme (its own `oe-standard-webhook` is just one
+// more registered entry); resolution is by the hook's DECLARED source, never sniffed. ──
+export {
+  registerWebhookVerifier,
+  webhookVerifier,
+  registeredWebhookVerifierSources,
+  registeredWebhookVerifiers,
+  resetWebhookVerifiersForTest,
+} from "./webhooks/verifier.js";
+export type { WebhookVerifier, WebhookVerifyInput, WebhookVerdict, WebhookVerifyFailure, WebhookSenderGuidance } from "./webhooks/verifier.js";
+
+// ── EVENT PLANE (routines/event-model.ts + routines/event-authz.ts, OPE-193) — the OTHER TWO THIRDS
+// of a work-surface ingress, opened through the same door the verifier registry already comes
+// through. Understanding how a system emits webhooks, and implementing the verifier + normalizer +
+// scope grant to fit, is part of AUTHORING THAT ADAPTER — not a topology decision core takes once.
+//
+// WHY THE OMISSION WAS A CONSTRAINT, NOT A POSTURE. Both registries already carry `provider?: string`
+// routed through `admitProviderRegistration`, i.e. they were built adapter-ready — but neither
+// registrar was on this barrel, and `scripts/boundary-test.ts` rule 4 hard-fails a deep import past
+// it. So a bundle could contribute a verifier and nothing else, which is the whole reason
+// `routines/github-normalizer.ts` registers FROM CORE: it had no other door. Read that module's
+// "WHY IT REGISTERS FROM CORE" as the record of a missing export, not as a precedent to copy.
+//
+// LETTING A BUNDLE DEFINE SCOPE SEMANTICS IS LETTING IT DEFINE AN AUTHORIZATION BOUNDARY — stated
+// out loud rather than assumed by shipping the export. It is admissible for the same reason the
+// verifier export is: a bundle is SELECTED BY AN OPERATOR in config-as-code, which is already an
+// authorization act, and a de-selected bundle registers nothing (`admitProviderRegistration`), so
+// every event on its source then fails closed with `no-grant-adapter` rather than defaulting open.
+// The grant adapter can only ever REFUSE a fire the deployment would otherwise have allowed on the
+// strength of a grant an admin already wrote; it cannot mint access. The escape hatch if that
+// analysis ever goes bad is the narrower export (normalizer from the bundle, grant kept core-side).
+//
+// The lookups and reset seams ride along for the reason the verifier block already concedes: both
+// registries are module-level Maps shared across a test process, so a BUNDLE'S OWN test — held to
+// rule 4, unable to reach `routines/event-model.js` deep — cannot otherwise clear state an import
+// side-effect installed, nor read its own registration back to assert it landed. That is exactly the
+// reset-then-re-register shape `scripts/event-authz-test.ts` already uses in core.
+//
+// `scopeIdOf` is here because every grant adapter needs it (GitHub's picks the `container` step).
+// `innermostScope` is DELIBERATELY NOT EXPORTED: core uses it purely as a non-emptiness predicate
+// (`event-authz.ts`), and WHICH step is authoritative is the adapter's own choice — exporting it
+// under that name would re-suggest the reading the doc comments there had to be corrected of. ──
+export {
+  registerEventNormalizer,
+  eventNormalizer,
+  registeredEventSources,
+  resetEventNormalizersForTest,
+  scopeIdOf,
+} from "./routines/event-model.js";
+export type { EventNormalizer, NormalizedEvent, TriggerDelivery, ScopeStep, ScopeKind, EntityPointer } from "./routines/event-model.js";
+// ── Provider event inventory seam (routines/provider-events.ts) — what each vendor can send ──────
+//
+// The DECLARATION sibling of the normalizer registry above, and it is here for the same reason
+// `registerSurfaceParity` is: a provider bundle states what its vendor emits through the one barrel
+// it reaches core by. The registry above answers "what can this deployment ROUTE"; this one answers
+// "what could the vendor SEND, and how far does the routing carry each one" — including the events
+// nothing routes yet, which the normalizer registry is structurally unable to mention.
+//
+// `checkProviderEvents` and the renderers ride along for `scripts/provider-events.ts` (the lint +
+// doc generator) and its unit suite, exactly as `checkSurfaceParity` does for the parity gate.
+export {
+  registerProviderEvents,
+  providerEventsFor,
+  registeredProviderEventPlatforms,
+  checkProviderEvents,
+  renderProviderEventTable,
+  renderProviderEventInventory,
+  renderProviderEventMatrix,
+} from "./routines/provider-events.js";
+export type {
+  ProviderEvent,
+  ProviderEventDeclaration,
+  ProviderEventProblem,
+  EventRouting,
+  NormalizerFacts,
+  NormalizerProbe,
+} from "./routines/provider-events.js";
+export {
+  registerEventScopeGrant,
+  eventScopeGrant,
+  registeredEventGrantSources,
+  resetEventScopeGrantsForTest,
+} from "./routines/event-authz.js";
+export type { EventScopeGrant } from "./routines/event-authz.js";
+// `checkEventReadGrant` rides along for the same reason the reset seams above do: a bundle that
+// registers its OWN grant adapter cannot otherwise assert the VERDICT its adapter produces — and
+// the distinction that matters (`refused` vs `no-grant-adapter`) is exactly the one a registration
+// bug erases, since a grant that failed to register looks like a grant that said no.
+export { checkEventReadGrant } from "./routines/event-authz.js";
+// `admitTrigger` — THE transport-agnostic entry point into the routing plane (routines/ingress.ts,
+// OPE-179). A bundle owning a NATIVE front door (the `POST /eve/v1/notion` route) needs it to hand
+// its already-verified delivery to the plane; without it OPE-193 exposed the two registrars and no
+// way to feed them. `fanOutGitHubDelivery` (below) is the vendor-shaped wrapper that predates this
+// and stays for GitHub's own route.
+export { admitTrigger } from "./routines/ingress.js";
+// The MATCH LANGUAGE (jq since OPE-210). A normalizer's declarations are still CREATE-TIME surface —
+// `scopeKeys`/`scopeKinds` drive the mandatory-narrowing refusal, and `matchKeys` is what the tool
+// description and the create-time probe document quote — so a bundle that DECLARES them and cannot
+// run them can only assert that it wrote three arrays, never that they produce the refusals it
+// intended. Same argument as the reset seams above, one level up.
+//
+// `evaluateJqFilter` + `filterDocument` replace the old structural `evaluateFilter`: a bundle
+// asserting "this payload matches this subscription" now runs the same predicate the fan-out will.
+export { validateSubscription } from "./routines/event-match.js";
+export { evaluateJqFilter, filterDocument } from "./routines/jq-filter.js";
+export type { EventFilterDocument } from "./routines/jq-filter.js";
+
+// ── Supervisor rotation token (channels/unified-supervisor.ts) + single-window policy / DM-grain (unified-window.ts) ──
+export { unifiedSupervisorToken, standingSeatRegistryKey, dmWindowRegistryKey } from "./channels/unified-supervisor.js";
+// (rootDmGrainAttrs / SingleWindowMentionPolicy are exported in the unified-window section above.)
+
+// ── Name-drop wake gate (memory/domain.ts) ──────────────────────────────────────────────────
+export { nameDropWakeEnabled } from "./memory/domain.js";
+
+// ── The WAKE seam's drop-in arm (channels/wake-arm.ts) — OPE-1367 ───────────────────────────
+// A chat surface adapter reaches this seam through `wakeArmOffered` (the sync cost check its route
+// runs before paying for the gates an arm rung needs) and `wakeAfterArm` (the composer). The
+// per-surface declaration is `WAKE_ARM_SURFACE_CONTRACT` — an adapter that wants to offer the seam
+// adds its entry there, in core, rather than deciding for itself: the composer READS that table, so
+// a surface can neither call an arm it declined nor widen the fields the arm receives.
+export {
+  wakeAfterArm,
+  wakeArmOffered,
+  wakeArmTimeoutMs,
+  WAKE_ARM_SURFACE_CONTRACT,
+  WAKE_ARM_MAX_TEXT_CHARS,
+} from "./channels/wake-arm.js";
+export type {
+  WakeArmAnswer,
+  WakeArmField,
+  WakeArmInput,
+  WakeArmMessage,
+  WakeArmSurface,
+  WakeArmSurfaceDeclaration,
+  BuiltInWakeAnswer,
+} from "./channels/wake-arm.js";
+
+// ── Wake-time backscroll render + the bootstrap fetch core (context-render.ts, backscroll-window.ts) ──
+// (the ContextLine type itself is exported in the supervisor context-line section above.)
+// `hydrationSlices` is the ONE road holding the cap-versus-de-duplication ORDER, plus the two slices
+// one hydration produces — what renders, and what the taint join keys off (OPE-1749).
+export { renderContext, capLines, sinceLastAgentReply, WAKE_BACKSCROLL_MAX, contextLineIngestion, contextLinesNotInEnvelope, hydrationSlices } from "./channels/context-render.js";
+export type { HydrationSlices } from "./channels/context-render.js";
+export { fetchedBackscroll, approxMessageTokens, seatCatchUpSinceMs, catchUpSender } from "./channels/backscroll-window.js";
+export type { NormalizedMessage, BackscrollTrustFor } from "./channels/backscroll-window.js";
+// ── The shared since-last-wake catch-up path + its per-surface fetch registry (channels/seat-catch-up.ts, OPE-1726) ──
+// A provider bundle registers ONE fetch — its own container history, normalized and visibility-gated
+// — and `seatCatchUp` applies the neutral bounds, the domain's admission policy and the shared cap.
+// A platform with no registered fetch answers UNAVAILABLE, which the wake renderer states out loud.
+export {
+  registerSeatCatchUp,
+  seatCatchUp,
+  seatCatchUpFetchFor,
+  seatCatchUpPrecisionFor,
+  seatCatchUpBounds,
+  seatAdmissionFor,
+  catchUpUnavailableReason,
+  _resetSeatCatchUp,
+  SEAT_CATCH_UP_ACTION,
+  DEFAULT_TIMESTAMP_PRECISION_MS,
+} from "./channels/seat-catch-up.js";
+export type { SeatCatchUpFetch, SeatCatchUpRequest, SeatCatchUpResult, SeatCatchUpOpts, SeatCatchUpDeclaration } from "./channels/seat-catch-up.js";
+
+// ── Standing-seat ADMISSION (channels/seat-admission.ts) — WHAT enters a seat, by named function ──
+// A surface's catch-up read resolves the policy NAME from the domain and hands the FUNCTION to the
+// fetch core, so the policy is chosen in one place and applied in one place.
+export { admissionFunction, admissionFunctionNames, isAdmissionFunctionName, admitToSeat, admitContextLines, DEFAULT_ADMISSION } from "./channels/seat-admission.js";
+export type { SeatAdmissionFn, SeatAdmissionCandidate } from "./channels/seat-admission.js";
+
+// ── Standing-seat TAIL ring (channels/session-tail.ts) — the normal rotation rebuild path ──────
+// `tailAuthorGrain` is the ONE road a record site resolves its author refutation through, and
+// `SessionTailWakeRow` is the write shape that makes it compulsory (OPE-1747).
+export { buildTail, selectTail, tailEntryToWakeMessage, tailAuthorGrain, approxEntryTokens, tailTokenCap, SESSION_TAIL_MAX_ENTRIES } from "./channels/session-tail.js";
+export type { SessionTailEntry, SessionTailWakeRow } from "./channels/session-tail.js";
+export { recordWakeTail, recordPostTail, carryTailForward, seedTailWindow } from "./channels/session-tail-record.js";
+
+// ── Thread engagement store (channels/engagement.ts) — warm-streak / stop / engage state ────
+export {
+  bumpThreadSilentStreak,
+  disengageThread,
+  getThreadEngagement,
+  isThreadEngaged,
+  markThreadEngaged,
+  roomEngagementAddress,
+  WARM_SILENT_LIMIT,
+} from "./channels/engagement.js";
+
+// ── Spend gates a chat surface enforces at ingress (spend/check.ts, spend/bypass.ts) ────────
+export { scopeOverBudget } from "./spend/check.js";
+export { capBypassFor } from "./spend/bypass.js";
+// THE gate itself — ONE decision table for every ingress door (spend/ingress-gate.ts). A surface
+// calls this rather than re-deriving check → audit → bypass → refuse; the cross-surface window's
+// divert (channels/unified.ts) calls the same function at door "window". Never hand-copy it: five
+// copies is exactly the condition under which a sixth door goes unguarded.
+export { ingressSpendGate, spendRefusalCopy, spendBypassWarnCopy, UNICODE_SPEND_BADGES, SLACK_SPEND_BADGES, type SpendRefusalCopyInput } from "./spend/ingress-gate.js";
+export type { IngressSpendGateInput, SpendGateBadges, SpendGateDecision, SpendGateDoor, SpendGateAuditRow } from "./spend/ingress-gate.js";
+
+// ── Unmapped-channel wake guard (access/wake-mapping.ts, OPE-119) ───────────────────────────
+// The identity analogue of the spend gate: a channel wake whose TENANT can't be resolved must
+// not run a model turn. Pure decision + the operator nudge; wired at each surface's ingress door.
+export { classifyWakeMapping, unmappedWakeCopy, UNMAPPED_WAKE_DROP_REASON } from "./access/wake-mapping.js";
+export type { WakeMappingDecision, WakeMappingInput } from "./access/wake-mapping.js";
+
+// ── Tenant fence (access/tenant-admission.ts, OPE-309 phase 0c) ──────────────────────────────
+// The unmapped guard's sibling, one question further along: that one asks "did this wake resolve
+// a tenant at all", this one asks "is it a tenant this deployment ADMITS". On a tenant-scoped
+// platform a person id is issued per tenant, so a second workspace's delivery makes two humans
+// share one `platform/<id>` principal key — and our front door verifies an app-level secret every
+// installing workspace shares, so nothing else stops it. Pure decision + the operator log line.
+export { classifyTenantAdmission, admittedTenants, admittedTenantsFromConfig, unadmittedTenantLog, multiTenantPrincipalsAllowed, UNADMITTED_TENANT_DROP_REASON, MULTI_TENANT_ENV } from "./access/tenant-admission.js";
+export type { TenantAdmissionDecision, TenantAdmissionInput } from "./access/tenant-admission.js";
+
+// ── Approval-card posted-this-turn signal (approvals/card-signal.ts) ────────────────────────
+export { consumeCardPostedThisTurn, peekCardPostedThisTurn } from "./approvals/card-signal.js";
+
+// ── "Approve for session" grant predicate (approvals/session-grant.ts, OPE-53) ──────────────
+// The ONE rule for which pending kinds render/honour a session button — consumed by each
+// provider bundle's card renderer so the Slack and Discord cards agree on the third button.
+//
+// 🔴 `connectorSessionKind` IS DELIBERATELY NOT HERE (OPE-1303, from the PR #472 round-3 review).
+// It mints the retired per-connector `connector.op:` grain, no card renderer consults it, and the
+// fence REFUSES a row of that shape. Exporting it invited a bundle author to mint a row that lifts
+// nothing. Core keeps the primitive so the two sites that must recognise a stored legacy row name
+// one constant; nothing outside core needs it.
+export { sessionGrantKind, grantButtonLabel } from "./approvals/session-grant.js";
+
+// (dropClosingProse / ChatAuditPartition — the closing-prose drop — are exported in the
+// chat-surface support-kit section above.)
+
+// ── Allowlisted e2e driver check (testing/driver-allowlist.ts) ──────────────────────────────
+export { isAllowedDriver } from "./testing/driver-allowlist.js";
+
+// ── Reaction-ingest internals (channels/reaction-ingest.ts) — a surface's reaction path ─────
+export { buildIngestedReaction, ingestReaction, liveReactionSink } from "./channels/reaction-ingest.js";
+export type { ReactionSinkDeps, ReactionIngestOutcome, ReactionVerb } from "./channels/reaction-ingest.js";
+
+// ── Generic channel-read allowlist + rendered-line shape (channels/channel-read.ts) ─────────
+export { assertSurfaceAllowed, chatReadIngestion, readChannelResult, readThreadResult } from "./channels/channel-read.js";
+export type { RenderedLine } from "./channels/channel-read.js";
+
+// ── The OPAQUE CHANNEL KEY (OPE-746; channels/channel-key.ts) ───────────────────────────────
+// The one address the model holds for a container: the wake envelope's `<channel id>` and the
+// generic read verbs' `channel` argument are the SAME string. Minting happens in the single core
+// wake renderer, so no provider builder mints a key of its own. Since OPE-1145 no per-surface chat
+// reader takes an address from the model, so the tolerant per-platform decoder is gone with them.
+export { encodeChannelKey, decodeChannelKey, isChannelKey, CHANNEL_KEY_PREFIX } from "./channels/channel-key.js";
+export type { ChannelAddress } from "./channels/channel-key.js";
+
+// ── The READ-TOOL non-member author leg (OPE-474/534; channels/read-author-trust.ts) ─────────
+// A chat provider's read adapter implements `ReadAdapter.refutedAuthorIds` by handing its own
+// per-author evidence to THIS join — never by hand-rolling a second one. The join answers with the
+// refuted AUTHOR IDS, and core reads that one answer twice: the turn MARK and the `withhold` body
+// replacement (OPE-534). `distinctReadAuthorIds` is the DISTINCT-authors rule a 200-message page
+// depends on; it is exported so a provider test can pin its own probe-call count rather than
+// trusting the join to be frugal.
+export { refutedReadAuthorIds, distinctReadAuthorIds } from "./channels/read-author-trust.js";
+export type { ReadAuthorProbe } from "./channels/read-author-trust.js";
+
+// The `read.refused` row every domain-read fence appends before it throws — shared so the slack
+// and teams bundles' own fences (which keep their own decisions) emit the SAME shape core's
+// generic gate does. See channels/read-scope-audit.ts.
+export { auditChannelReadRefusal, auditOriginFenceRefusal, auditSourcesGateRefusal } from "./channels/read-scope-audit.js";
+export type { ReadScopeAuditDeps, ReadScopeReason, ReadScopeRefusal } from "./channels/read-scope-audit.js";
+
+// ── Trust boundary type (identity/binding.ts) — a mapper that positively demotes reads it ───
+export type { Trust } from "./identity/binding.js";
+
+// ══════════════════════════════════════════════════════════════════════════════════════════════
+// CHAT-SURFACE SUPPORT KIT, WIDENED FOR THE SLACK EXTRACTION (OPE-114 stage 4). Slack is the
+// deepest-coupled surface — its bundle consumes the engagement model, the onboarding markers, the
+// wake-backscroll render spine, the DM seat, the approvals/intake/connector click planes, the
+// status pins, and the spend gates. Every port below is a core seam a full-fat chat surface needs;
+// nothing surface-SPECIFIC crosses here (the doctrine holds — slackForm etc. live in the bundle).
+// ══════════════════════════════════════════════════════════════════════════════════════════════
+
+// ── Slack bridge (channels/slack-bridge.ts) — the bundle→core seam for generic-spine branches ─
+// registerSlackBridge is called once by registerSlackProvider(); core's generic modules (approval
+// cards, connector cards, credential intake, dispatchers, reports) consume the fail-closed
+// accessors, never the bundle directly.
+export { registerSlackBridge, _resetSlackBridgeForTest, slackBridge } from "./channels/slack-bridge.js";
+export type { SlackBridge, SlackFormFn, SlackReadCallFn } from "./channels/slack-bridge.js";
+
+// ── Teams bridge (channels/teams-bridge.ts) — the bundle→core seam for the routine fire-eligibility
+// leg's Graph checks (OPE-522). registerTeamsBridge is called once by registerTeamsProvider(); core's
+// routines/fire-eligibility.ts consumes the "unresolvable when unregistered" accessors, never the
+// Graph client directly.
+export { registerTeamsBridge, _resetTeamsBridgeForTest, teamsBridge } from "./channels/teams-bridge.js";
+export type {
+  TeamsBridge,
+  TeamsRoomMembershipCheck,
+  TeamsAccountActiveCheck,
+  TeamsRoomMembership,
+  TeamsMembershipUnresolved,
+} from "./channels/teams-bridge.js";
+
+// ── Engagement model (channels/engagement.ts) — thread engage/stop/deliver policy ───────────
+// (isThreadEngaged / markThreadEngaged / getThreadEngagement / disengageThread /
+// bumpThreadSilentStreak / WARM_SILENT_LIMIT are exported in the thread-engagement section above;
+// the slack extraction adds the deliver-policy half.)
+//
+// 🔴 `isStopRequest` / `STOP_ACK_COPY` ARE GONE (OPE-418) — an adapter-api REMOVAL, deliberately.
+// The stop REGEX is deleted, not deprecated: a bundle must not be able to reach for it, because
+// there is no correct way to use it. Its two jobs split into an affordance (channels/turn-cancel.ts)
+// and an inference verb (tools/stand_down.ts).
+export { markThreadStopped, shouldDeliverReply, classifyParticipation, STAND_DOWN_DELIVERY_REFUSAL } from "./channels/engagement.js";
+export type { ReplyDecision, ParticipationSignals } from "./channels/engagement.js";
+
+// ── Wake trust + attributes (identity/wake-trust.ts) ────────────────────────────────────────
+// (the Trust type itself is exported in the trust-boundary section above.)
+export { resolveWakeTrust, backscrollTrustResolver } from "./identity/wake-trust.js";
+
+// ── Untrusted ingestion (raw-string variant) ────────────────────────────────────────────────
+export { ingestUntrusted } from "./access/untrusted.js";
+
+// ── Status verbs a chat surface renders (memory/domain.ts) ──────────────────────────────────
+// (the domain predicates nameDropWakeEnabled / domainForChannel and the Domain type are exported
+// in sections above.)
+export { statusVerbsFor, DEFAULT_STATUS_VERBS } from "./memory/domain.js";
+
+// (rootDmGrainAttrs / SingleWindowMentionPolicy are exported in the unified-window section above;
+// postOnce / outboundKey in the idempotent host-side post section above.)
+
+// ── Operational store rows (operational/store.ts) ───────────────────────────────────────────
+export type { EngagementRow, ChannelSessionRow, SlackAttachmentRow } from "./operational/store.js";
+
+// ── Onboarding markers + first-act intro copy (onboarding/onboarding.ts) ────────────────────
+export {
+  isSurfaceOnboarded,
+  markSurfaceOnboarded,
+  extractPinnedInstructions,
+  introMessage,
+  instructionBullet,
+  ONBOARDED_MARKER,
+} from "./onboarding/onboarding.js";
+
+// ── Per-turn signals a channel's completion path consumes ───────────────────────────────────
+// (consumeCardPostedThisTurn is exported in the approval-card-signal section above.)
+export { consumeNoReplyThisTurn } from "./channels/no-reply-signal.js";
+export { consumeReactedThisTurn } from "./channels/react-signal.js";
+// The stand-down silence latch (OPE-1647). An arm whose closing prose POSTS takes it inside
+// `finalMessageActionForTurn`, by passing that function its turn id, and never names these exports.
+// The Discord GATEWAY handler is the one caller that cannot: it consumes the `no_reply` signal
+// itself, to tell the two silence routes apart, so it calls the pure `finalMessageAction` and reads
+// this latch directly. Exported for that one caller.
+// 🔴 THE UNIFIED WINDOW (`channels/unified.ts`) PASSES NO TURN ID, and that is correct rather than an
+// oversight: its terminal prose is dropped structurally, on every addressing, so it has no door for
+// the latch to shut. Since OPE-1982 that is the whole story there — the addressed-prose bridge that
+// used to be the window's second door is deleted, so no unified path puts a turn's closing text in a
+// room.
+// (REPLY_STAND_DOWN_ACK_ACTION stays unpublished: its only writer is core's own `tools/reply.ts`.)
+export { consumeStandDownSilenceThisTurn, STAND_DOWN_SILENCE_REASON } from "./channels/stand-down-silence.js";
+
+// ── Backscroll render spine (channels/context-render.ts) ────────────────────────────────────
+// (renderContext / sinceLastAgentReply / WAKE_BACKSCROLL_MAX / ContextLine / fetchedBackscroll /
+// NormalizedMessage / BackscrollTrustFor are exported in the wake-time backscroll section above.)
+export { MAX_MESSAGES } from "./channels/context-render.js";
+
+// ── Wake envelope extras (channels/wake-envelope.ts, channels/normalized-wake.ts) ───────────
+export type { WakeAttachment, WakeParticipant } from "./channels/wake-envelope.js";
+export { PREFER_NO_REPLY_TOOL } from "./channels/normalized-wake.js";
+
+// ── Reaction-ingest spine (channels/reaction-ingest.ts) — parse-side support ────────────────
+// (buildIngestedReaction / ingestReaction / liveReactionSink / ReactionSinkDeps /
+// ReactionIngestOutcome / ReactionVerb are exported in the reaction-ingest section above.)
+export { registeredReactionSurfaces } from "./channels/reaction-ingest.js";
+export type { IngestedReaction } from "./channels/reaction-ingest.js";
+
+// ── E2E driver allowlist (testing/driver-allowlist.ts) — the loop-safety carve-out ──────────
+// (isAllowedDriver is exported in the allowlisted-driver section above.)
+export { isAllowedSlackDriver, parseDriverAllowlist, e2eDriverPrincipals, isE2eDriver, e2eDriversProblem } from "./testing/driver-allowlist.js";
+export type { E2eDriverIdentity } from "./testing/driver-allowlist.js";
+
+// ── Status pins (status/status.ts) ──────────────────────────────────────────────────────────
+// (dropClosingProse is exported in the chat-surface support-kit section above.)
+export { STATUS_REACTION, renderPinned, isPinnedStatusMessage, STOP_HAND_SLACK_NAME, STOP_HAND_UNICODE } from "./status/status.js";
+export type { ReactionState } from "./status/status.js";
+
+// ── Memory surfaces a channel's first-act onboarding writes (memory/) ───────────────────────
+export { SURFACE, tierId } from "./memory/store.js";
+export { getProvider, providerById } from "./memory/provider.js";
+// THE ONE DURABLE MEMORY WRITE ROAD (OPE-1873) — a provider adapter writes a tier through this and
+// never through `provider.writeTier`, which is what keeps the `memory.write` row on every write.
+export { writeMemoryTier, type MemoryWriteRequest, type MemoryWriteResult, type MemoryWriteRoad, type MemoryWriteKind } from "./memory/write-road.js";
+export { upsertUnderSection } from "./memory/markdown.js";
+export { planFor, surfaceProvider } from "./memory/resolve.js";
+
+// (scopeOverBudget / capBypassFor — the ingress spend gates — are exported in the section above.)
+
+// ── DM seat (channels/dm-seat.ts) — the durable 1:1 session anchor ──────────────────────────
+export { getOrCreateDmSeat, touchDmSeat, dmSeatThresholds } from "./channels/dm-seat.js";
+export type { DmSeat } from "./channels/dm-seat.js";
+
+// ── Unified-window inbound divert (channels/unified.ts) ─────────────────────────────────────
+export { divertInboundToUnifiedWindow } from "./channels/unified.js";
+
+// ── Click planes a surface's interactivity route funnels into ───────────────────────────────
+// Approvals (approvals/flow.ts), credential intake (credentials/intake.ts), connector cards
+// (connections/connector-card.ts) — the platform-neutral decide cores; the surface owns only
+// the wire parse + the ack rendering.
+export { OE_APPROVAL_PREFIX, handleApprovalPayload } from "./approvals/flow.js";
+export {
+  OE_SETKEY_ACTION_PREFIX,
+  OE_SETKEY_MODAL_CALLBACK,
+  handleSetKeyClick,
+  handleSetKeyViewSubmission,
+} from "./credentials/intake.js";
+export type { SetKeyViewResult } from "./credentials/intake.js";
+export { OE_CONNECT_ACTION_PREFIX, handleConnectClick } from "./connections/connector-card.js";
+
+// ── The CREDENTIAL-GRANT card button (OPE-1060 S3) — the surface half of the owner's answer. A
+// provider bundle with a component plane classifies an interactivity payload on
+// `OE_GRANT_ACTION_PREFIX` and hands it to `handleGrantCardClick`, which owns the whole decision:
+// it verifies the CLICKER is the ask's owner, approves or declines, and answers the clicker
+// privately. The bundle learns nothing about the owner, the requester or the credential.
+// `GRANT_MODE_WORDS` rides the bundle boundary so a PROVIDER's own pack can pin that the card it
+// renders spells each mode with the one reader-facing word every other surface spells it with.
+export { OE_GRANT_ACTION_PREFIX, grantCardActionId, parseGrantCardActionId, grantCardActions, grantCardText, GRANT_MODE_WORDS } from "./access/credential-grant-card.js";
+export type { GrantCardAnswer } from "./access/credential-grant-card.js";
+export { handleGrantCardClick, resolveGrantCardClick, GRANT_CARD_CLICK_ACTION } from "./access/credential-grant-click.js";
+export type { GrantClicker, GrantClickResult, GrantClickInput } from "./access/credential-grant-click.js";
+
+// ── Log-ship records (observability/ship.ts) — durable loud-failure records ─────────────────
+export { buildRecord, enqueue, flushLogShip } from "./observability/ship.js";
+
+// ── Chat commands core (commands/core.ts) — the slash-command decide core ───────────────────
+// (runOeCommand is exported in the zero-inference "/oe" section above.)
+export { parseSlackCommandText } from "./commands/core.js";
+
+// (ChannelScopeError / RenderedLine — the channel-read support shapes — and EventDedupe /
+// ThreadFifo — the front-door plumbing — are exported in sections above.)
+
+// ── Attachment fetch SSRF guard (access/host-egress.ts) ─────────────────────────────────────
+// A bundle's credentialed vendor-host fetch (slack's url_private downloader) reuses core's
+// resolve-then-check-then-PIN primitive rather than rolling its own rebind check.
+// setHostEgressLookup is the DNS-injection test seam a bundle's host-pin test drives.
+// EgressDispatch carries WHICH anti-rebind posture held (OPE-322): the pin on the direct path, the
+// forward proxy's ACL on the docker tier — so a bundle annotates its own audit row the same way.
+export { assertSafeFetchUrl, setHostEgressLookup, type EgressDispatch, type EgressRefusalCause } from "./access/host-egress.js";
+// The ONE cross-plane egress row shape (OPE-1547). Exported so a provider's own credentialed
+// host-side fetch — the Slack attachment seam — writes the SAME six field names core's own seams
+// write, rather than a second spelling that no auditor can join.
+export {
+  egressAuditFields,
+  hostCallAuditFields,
+  sandboxPolicyAuditFields,
+  normaliseVerbs,
+  EGRESS_AUDIT_ROW_FIELDS,
+  type EgressAuditRow,
+  type EgressPlane,
+  type EgressRowUnit,
+  type EgressOutcome,
+} from "./access/egress.js";
+
+// ── Reaction feedback audit action (channels/reaction-ingest.ts) ────────────────────────────
+export { REACTION_FEEDBACK_ACTION } from "./channels/reaction-ingest.js";
+// The emoji bucketer, exported so a bundle's suite can assert its OWN vendor vocabulary buckets
+// correctly (OPE-1502 — Teams' six fixed values, GitHub's eight). Production code never calls it
+// directly: `buildIngestedReaction` does that once, for every surface.
+export { classifyEmoji } from "./channels/reaction-ingest.js";
+
+// ── Untrusted-projection registry names (access/untrusted-projection.ts) — a bundle's tripwire ─
+export { registeredProjectionNames } from "./access/untrusted-projection.js";
+// `projectToolSet` is the seam the eve patch calls per model call. It applies the CONNECTOR wrap and
+// every seat cut; it does NOT touch a name the process registered, because eve's own replay serves
+// that name's authored envelope (OPE-378). Exported so a bundle's suite can assert that its own
+// read tool is left alone here rather than double-wrapped.
+// A bundle's read-tool test drives its own tool's envelope through the ENTRY it already exports
+// (packages/providers/linear/scripts/linear-route-taint-test.ts is the shape), so nothing here needs
+// to publish an accessor for the authored projection.
+export { projectToolSet } from "./access/untrusted-projection.js";
+
+// ── Ops-plane registries (ops/quickstart.ts, observability/telemetry.ts) ────────────────────
+// A bundle owns its vendor's env-key knowledge (boundary rule 6): its quickstart goal step and
+// its telemetry credential-presence probe register here.
+export { registerQuickstartSurfaceGoal } from "./ops/quickstart.js";
+export type { SurfaceGoalStep, PlanStep, Check } from "./ops/quickstart.js";
+// registerSurfaceAppManifest: the chat-app manifest a vendor console reserves for a human to paste
+// (ops/surface-manifest.ts, OPE-1603). The bundle owns the document — it is vendor knowledge — and
+// core substitutes the deployment's own host into it for the `surface_manifest` ops MCP tool.
+export { registerSurfaceAppManifest, DEPLOY_HOST_PLACEHOLDER } from "./ops/surface-manifest.js";
+// The READ side rides the barrel for the same reason `projectToolSet` above does: a bundle's own
+// test drives its REAL registration end to end rather than a copy of it. Without it the bundle
+// could only re-assert the document it just built, and a `registerSlackOps()` that stopped
+// registering the manifest would pass every test in the tree.
+export { surfaceAppManifest, surfaceAppManifestSurfaces, normalizeDeployHost } from "./ops/surface-manifest.js";
+export type { SurfaceAppManifestSource, SurfaceAppManifest } from "./ops/surface-manifest.js";
+// registerPreflightProbe: a bundle's LIVE preflight check (ops/probes.ts, OPE-428) — for a
+// prerequisite that env alone cannot answer, so the probe calls the vendor. Teams rides this to
+// report which Microsoft boundary governs its channel reads. Fail-soft; a probe never returns
+// `missing`, so it can never make `ready` false.
+export { registerPreflightProbe } from "./ops/probes.js";
+export type { PreflightProbe } from "./ops/probes.js";
+// (the telemetry credential-presence probe seam is registerSurfaceCredentialProbe, exported in the
+// telemetry section above — the slack extraction's registerSurfaceCredsProbe duplicate was unified
+// onto it at merge time, exactly like linear's.)
+
+// ── Operational test reset (operational/sqlite.ts) — a bundle test's store isolation seam ───
+export { _resetOperationalDbForTest } from "./operational/sqlite.js";
+
+// ── Access resolution + config authoring (a bundle test's resolver fixtures) ────────────────
+export { resolveAccessFor } from "./access/request.js";
+export { resolveAccess } from "./access/resolver.js";
+export type { EffectiveAccess } from "./access/resolver.js";
+export { defineBundle, defineBinding } from "./access/bundle.js";
+// The ONE surface-key grammar (identity/surface-key-grammar.ts) — a provider matching a granted
+// WORK-SURFACE entry against a resolved key must use the SAME parser the domain plane uses, or the
+// two planes would disagree about what one line of config denotes.
+export { parseSurfaceKeyEntry, surfaceKeyEntryMatches } from "./identity/surface-key-grammar.js";
+export type { SurfaceKeyEntry } from "./identity/surface-key-grammar.js";
+
+// ── Rotation triggers (channels/turn-delivery.ts) — shouldRotate's thresholds ──────────────────
+// Since OPE-345 the PRIMARY is the expiry clock (time); the token/turn numbers are backstops.
+// FUNCTIONS, not constants, since OPE-409: each reads `getSettings()` at CALL time, so an adapter
+// that captures one into its own module-level `const` re-introduces the load-order defect the
+// change removed. Call them where you need the value.
+export {
+  supervisorRotateQuietGapMs,
+  supervisorRotateExpiryMs,
+  supervisorRotateTurnBudget,
+  supervisorRotateTokenBudget,
+  rotationTrigger,
+  rotationClockMsFromDays,
+  type RotationTrigger,
+  type RotationThresholds,
+} from "./channels/turn-delivery.js";
+
+// ── Binding fallback resolver + bridge reconstitution (a bundle identity test's seams) ──────
+export { bindBridged } from "./identity/binding.js";
+export { bridgedContext } from "./identity/binding-bridge.js";
+
+// ══════════════════════════════════════════════════════════════════════════════════════════════
+// WORK-SURFACE PLANE — the entities an agent acts on (issues, docs, PRs). A provider registers an
+// entity-action adapter; core resolves verbs (setState/assign/addLabel) against it surface-neutrally.
+// ══════════════════════════════════════════════════════════════════════════════════════════════
+
+// ── Entity-action adapter (channels/entity-actions.ts) — status/assign/label on a work item ─
+export { registerEntityActionAdapter, entityActionFn } from "./channels/entity-actions.js";
+export type { EntityActionAdapter, EntityActionFn, EntityRef, EntityVerb } from "./channels/entity-actions.js";
+export type { RepoCapability } from "./access/repo-capabilities.js";
+
+// ── Ticket-create adapter (channels/ticket-create.ts) — FILE a new work item (OPE-137) ──────
+// The create sibling of the entity-action seam, a SEPARATE registry because a creation dispatches
+// on a DESTINATION (a repo, a team) and returns a new ref, where a mutation keys on an entity that
+// already exists. Registration IS the declaration of support — a bundle that cannot honestly create
+// (Notion: a database row's property schema can't be inferred) registers nothing and the verb
+// refuses on that platform, naming the surfaces that can.
+export { registerTicketCreateAdapter } from "./channels/ticket-create.js";
+export type { TicketCreateAdapter, TicketCreateFn, TicketDestination, TicketDraft, CreatedTicket } from "./channels/ticket-create.js";
+
+// ══════════════════════════════════════════════════════════════════════════════════════════════
+// ROUTINES / WEBHOOK-INGEST PLANE — a provider's chat surface takes the vendor webhook, but the
+// event→routine FAN-OUT (a GitHub push/CI event firing a Slack routine) is a ROUTINES-subsystem
+// concern that stays in core: it bridges the vendor's events to whatever surface the routine
+// targets (Slack today), so it neither belongs to nor may drag the routines/slack internals across
+// the barrel into a bundle. A bundle's webhook route calls fanOutGitHubDelivery (which owns the
+// slack-channel + routines coupling in core) and gateGithubDelivery (the signature/fail-closed gate
+// that rejects the WHOLE delivery) — nothing more of the routines subsystem crosses the door.
+// ══════════════════════════════════════════════════════════════════════════════════════════════
+export { gateGithubDelivery, verifyGithubSignature } from "./routines/events.js";
+export { fanOutGitHubDelivery } from "./routines/github-fanout.js";
+
+// ── Routine dispatch seam (schedules/routine-dispatch.ts) — proactive fires on a bundle's surface ─
+// A provider bundle whose surface supports scheduled/proactive routine fires registers its
+// DispatchTarget resolver here (teams + discord ride it); the dispatcher consults the registry
+// FIRST for any platform, before its in-core inline wiring. Routine is the stored routine row the
+// resolver reads. (THE one routine seam — an earlier registerRoutineDispatchTarget variant was
+// unified into this registry at merge time.)
+export { registerRoutineDispatch } from "./schedules/routine-dispatch.js";
+export type { RoutineDispatchProvider, DispatchTarget } from "./schedules/routine-dispatch.js";
+export type { Routine } from "./routines/routine.js";
+
+// ── Spend (spend/usage-events.ts, spend/store.ts, spend/pricing.ts) ─────────────────────────
+export { appendUsageEvent, usageForSession } from "./spend/usage-events.js";
+export type { ModelPricing } from "./spend/pricing.js";
+// The CAP ledger's write + SUM read (OPE-265/OPE-266): the sandbox lifecycle adapter writes its
+// runtime spend here so USD caps can see it; spendTotals is the read its tests verify through.
+export { recordSpend, spendTotals } from "./spend/store.js";
+export { periodOf } from "./spend/spend.js";
+export { estimateSandboxCostUsd } from "./spend/sandbox-pricing.js";
+// The ONE reading of "which routine does this turn belong to" (the dispatcher-stamped marker,
+// current-falling-back-to-initiator) — exported so the sandbox lifecycle adapter attributes its
+// ledger rows with the SAME derivation the core spend hook uses, never a re-derived copy
+// (OPE-275). bindFrom (the principal half of the same attribution) is exported in the
+// identity-plane block above.
+export { routineIdOf, turnSurfaceMode } from "./hooks/spend.js";
+// THE `step.completed` HOOK ITSELF (OPE-1611). Core boots it; a provider bundle never registers it.
+// A bundle still needs to REACH it, because cost attribution is the one turn-level behaviour a
+// surface cannot prove from its own sources: the hook derives the ledger partition from the bound
+// context, so "does a turn on THIS surface land a priced row?" is only answerable by driving the
+// real hook over a real binding of that surface. `packages/providers/teams/scripts/
+// teams-spend-attribution-test.ts` is the first such suite. The alternative — a copy of the suite
+// under packages/core/scripts/ — cannot exist: boundary rule 1 refuses core any sibling-package
+// import, so a core-side copy could not call registerTeamsProvider() and would prove nothing about
+// Teams. Adding the port is what the barrel doctrine names for exactly this case.
+export { default as spendHook } from "./hooks/spend.js";
+
+// ── Live delegated tasks (access/live-delegated-tasks.ts) — WHO STILL HOLDS THE SHARED VM ──
+// The sandbox stop-after-turn hook (packages/adapters/agent/sandbox/vercel-lifecycle.ts) stops the
+// session's VM the moment a turn ends. A BACKGROUND child outlives its parent's turn and runs on
+// that same VM (eve keys the child's sandbox with the parent's session id), so the hook must know
+// whether one is still live before it stops anything. This is the READ side of that answer and the
+// ONLY part the adapter layer needs: the writers stay on core's own hook edges.
+// 🔴 The adapter READS and never mutates — see live-delegated-tasks.ts on why the sandbox guard
+// spends no hold.
+export { liveTaskIds, liveTaskCount } from "./access/live-delegated-tasks.js";
+// The state slot's FROZEN name. Exported so the adapter's own test can arm the real slot by the
+// real name — a rename in core then reds that test instead of silently emptying it — and so an
+// eve-bump audit can find the one key this plane depends on. It is a NAME, not a writer: the arm
+// and clear verbs stay on core's hook edges.
+export { LIVE_DELEGATED_TASKS_STATE_KEY } from "./access/live-delegated-tasks.js";
+
+// ── Provider rate limits (channels/rate-limit-retry.ts) — THE 429/Retry-After BACKOFF ──
+// Every provider in this repo talks raw HTTP: no provider package depends on a vendor SDK, so no
+// vendor retry policy applies to any write seam. A provider's ONE Web API seam wraps its request in
+// `withRetryAfter`, which honours a 429's `Retry-After` with a bounded cap and bounded attempts and
+// then throws the NAMED `RateLimitExhaustedError`. Exported through the barrel because a bundle may
+// reach core only this way, and because a second private copy of this logic is exactly what the
+// shared primitive exists to prevent. See docs/extending/provider-rate-limits.md for the
+// per-provider audit of which seams carry it.
+export { withRetryAfter, withRetryAfterLoose, parseRetryAfterMs, RateLimitExhaustedError } from "./channels/rate-limit-retry.js";
+// `DEFAULT_TOTAL_BUDGET_MS` joined the other three at OPE-1254. It is the default that bounds a
+// call's whole latency, so it is the one a provider sizing a tightened policy against a function's
+// maxDuration has to read — and the barrel was withholding exactly that one.
+export { RATE_LIMITED_STATUS, DEFAULT_MAX_ATTEMPTS, DEFAULT_CAP_MS, DEFAULT_FALLBACK_MS, DEFAULT_TOTAL_BUDGET_MS } from "./channels/rate-limit-retry.js";
+export type { RateLimitRetryOptions, RetryPolicy } from "./channels/rate-limit-retry.js";
+
+// ── Native wake dispatch retry (channels/native-wake-retry.ts) ──
+export { dispatchNativeWakeWithRetry } from "./channels/native-wake-retry.js";
+export type { NativeWakeRetryAttribution } from "./channels/native-wake-retry.js";