@open-everywhere/core 0.1.0

package/dist/agent/routines/declared-permissions.js

@@ -0,0 +1,548 @@
+// A ROUTINE'S DECLARED PERMISSIONS (OPE-152) — the read / write / revoke seam.
+//
+// 🔴 THE WORD IS "DECLARED PERMISSION" (OPE-1303, Tommy ruling 2026-08-29). One declared
+// permission names ONE MCP tool, a human declares it on the routine's creation card, and it dies
+// with the routine's `promptGeneration`. Never call it a grant: "grant" is the CREDENTIAL plane's
+// word (access/credential-grant*), where a person lends a chat their own authority for a bounded
+// time — nothing is lent here, and the two were confused in review twice in one day before the
+// ruling. docs/glossary.md is the source of truth for both terms.
+//
+// ONE MOMENT, ONE MECHANISM. A triggered flow gets its permission set DECLARED at creation: the
+// model proposes it, it freezes into the pending's `argsJson`, a human reads it rendered on the
+// arming card, and clicks. Nothing is decided at run time by inference; the authority never moves to
+// the model, because that moment ends at a human click on a code-rendered card.
+//
+// 🔴 THE SECOND MOMENT IS ASYNCHRONOUS, AND BY DEFAULT IT DOES NOT DECIDE THE RUN THAT ASKED. A
+// fire's own `ask` is still turned into a `deny` with reason `ask-unattended`
+// (access/approver-chain.ts, the `unattended` transform) — the run gets nothing and ends. The one
+// exception is opt-in and bounded: with `approvals.routineCardWaitSeconds` armed (it ships 0) the
+// refusing call holds for a window on the card it posted, and a click inside that window lifts that
+// run too (routines/permission-card-wait.ts). What OPE-1290 added on top is the
+// ROUTINE PERMISSION CARD (approvals/routine-permission.ts, planned by routines/permission-card.ts):
+// that refusal posts one card into the routine's own room, and a click there writes a row through
+// {@link armDeclaredRoutinePermissions}'s exact shape, under the SAME generation key, so the NEXT
+// fire lifts. A decline is durable under the same key, so a refused permission is never re-asked
+// until the routine is edited. The session-grant button's standing wording ({@link
+// grantButtonLabel}) is still unreachable — that button belongs to `approve_session` on a pr.open
+// card, which is a different plane from this one. The connector plane refuses through its own gate
+// (connections/connector-auth.ts `withUnattendedConnectorFence`, OPE-1274) and posts the same card
+// for a WRITE-tier op, naming `tool:<the op>` (OPE-1357). {@link namesUnliftableTool} is exported for
+// that path: the card planner applies this file's own tier test, so neither plane can offer a click
+// on a declaration the arming path here would refuse.
+//
+// So: what a routine may do on its own is what a human declared on its creation card, plus what a
+// human later approved on a permission card. Both are the same row, written the same way, keyed the
+// same way, and both die on `edit_routine`. NOTHING is decided by inference at run time — the
+// authority still moves only at a human click on a code-rendered card.
+//
+// WHY THERE IS ALMOST NO CODE HERE. The predicate already exists and is already centralised:
+// approvals/session-grant.ts `sessionGrantKind()` is the ONE test for "may a click cover future
+// calls of this kind, and under what memo kind", and this ticket is that predicate keyed on a
+// ROUTINE instead of a session. The key swap happens once, in identity/binding.ts
+// `proposingSessionId`, off the host-set fire stamp (routines/routine.ts
+// ROUTINE_MARKER.permissionKey) — so the consult site (open_pull_request's session skip) and the
+// click path's memo write (approvals/flow.ts, off the frozen `sessionId` arg) land on the
+// routine's key with no branch of their own. Both invariants the session-grant header pins carry
+// unchanged and unmodified:
+//   • DESTRUCTIVE-NEVER — decided inside sessionGrantKind, which never learns which kind of key it
+//     is writing under. On the DECLARED half it no longer holds by CONSTRUCTION: the per-tool
+//     vocabulary can spell `tool:notion__delete_page`, where the superseded per-connector spelling
+//     could name no verb at all. So it is enforced at both ends instead, and neither end is
+//     redundant — {@link declaredPermissionKinds} refuses a destructive-tier tool where the AUTHOR
+//     can fix it and no misleading row is ever written, and the unattended fence refuses one at
+//     LIFT time whatever row exists, which is what covers a verb a bundle declaration RAISES to
+//     destructive after the card was armed;
+//   • TAINTED-NEVER — the run-time half is the frozen `tainted` check in the same predicate; the
+//     upfront half is {@link armDeclaredRoutinePermissions} refusing to write anything for a
+//     routine proposed in a turn that had ingested untrusted content.
+//
+// WHAT GENUINELY CHANGES IS LIFETIME, and that is what this file exists to serve. A session grant
+// dies with its session and is invisible because it does not need to be seen. A declared
+// permission is standing AND fires unattended, so it needs three things a session grant does not,
+// one per function below: it must be VISIBLE ({@link listRoutinePermissions} → `list_routines`),
+// REVOCABLE without cancelling the routine ({@link revokeRoutinePermissions} →
+// `revoke_routine_permissions`), and INVALIDATED WHOLESALE BY AN EDIT — which is free, because
+// `routinePermissionKey` embeds `promptGeneration` and `edit_routine` bumps it
+// (approvals/routine-lifecycle.ts). Otherwise "declare pr.open, then rewrite the prompt" launders
+// standing authority straight around the gate.
+import { getOperationalStore } from "../operational/provider.js";
+import { classifyConnectorOpTier } from "../access/consequence.js";
+import { connectorOpTierParts } from "../access/connector-op-gating.js";
+import { describeDeclaredPermissionKind, isLegacyConnectorOpKind, isRoutinePermissionMemoKind, routinePermissionKind, routinePermissionRefusal, } from "../approvals/session-grant.js";
+import { routinePermissionKey } from "./routine.js";
+/**
+ * The `expiresAt` a declared permission is written with. A session memo's TTL is a GC bound because
+ * the session token's generation is the real death mechanism; a declared permission's death
+ * mechanism is the generation in {@link routinePermissionKey} plus explicit revocation, and a TTL on
+ * top of that would be a THIRD one nobody asked for — it would silently disarm a standing permission
+ * mid-night and turn the 03:00 fire this ticket exists to unblock back into a card nobody clicks. So the row carries a
+ * far-future sentinel: it never satisfies the prune-on-write predicate (`expires_at <= now`), and it
+ * reads in the table as what it is — no expiry.
+ */
+export const ROUTINE_PERMISSION_NO_EXPIRY = "9999-12-31T23:59:59.999Z";
+/**
+ * How many permissions one creation card may declare. A card a human will not read is not a gate
+ * (the same argument routine-lifecycle.ts's CARD_PROMPT_CHARS makes about prompt text), and the
+ * declared set is the ONLY thing on that card granting standing unattended authority — so a
+ * shotgun declaration is refused at the tool rather than rendered as a wall nobody audits.
+ */
+export const MAX_DECLARED_PERMISSIONS = 6;
+/**
+ * Validate a model-proposed declaration, returning the memo KINDS it maps onto. Throws with the
+ * legal vocabulary named — the same create-time-is-the-primary-gate posture `validateSubscription`
+ * takes for event filters: a declaration that could never grant anything must be refused where the
+ * author can fix it, never armed and left inert on the card.
+ *
+ * Duplicates collapse (the memo table is keyed per kind, so declaring one tool twice is one row
+ * either way and rendering it twice would only pad the card).
+ *
+ * 🔴 A DESTRUCTIVE-TIER TOOL IS REFUSED HERE, and this is the DECLARED half of DESTRUCTIVE-NEVER.
+ * The per-tool vocabulary can spell `tool:notion__delete_page`; the fence would never lift it, so
+ * writing the row would put a line on the arming card promising authority the runtime withholds.
+ * The classifier used is the STATIC one (access/consequence.ts), not `effectiveConnectorOpTier`.
+ * 🔴 THE STATIC TIER IS NO LONGER A LOWER BOUND ON THE SEAM (OPE-1321): a consumer arm may LOWER a
+ * verdict as far as `write`, so the seam can answer `write` where this check says `destructive`. The
+ * two checks are therefore independent refusals, not one bounding the other, and the direction here
+ * is the conservative one — this refuses the declaration outright, so no row is ever minted and the
+ * fence's lift is unreachable for it. Keeping the static read also keeps the property the next
+ * sentence names: a declaration must not be refused on one deployment's config and allowed on
+ * another's. The converse residual stands and is the
+ * fence's to hold — a `write` verb a deployment's bundle RAISES to destructive declares cleanly
+ * here and is refused at lift time instead. (Bundles ARE readable at propose time — they register at
+ * boot, agent/lib/register-config.ts — so reading the STATIC tier is a deliberate choice, not an
+ * absence: reading the effective tier here would refuse a tool on one deployment's bundle config
+ * that the fence lifts on another.)
+ *
+ * 🔴 THE RESIDUAL IS NO LONGER SILENT (OPE-1307), AND IT IS STILL NOT REFUSED HERE. A `write` verb a
+ * deployment's bundle RAISES to destructive still declares cleanly at THIS layer, for the reason the
+ * paragraph above gives: the throw is model-facing and must not depend on one deployment's bundle
+ * config. What changed is the two moments AFTER it, both of which happen on the deployment whose
+ * bundles decide the answer — {@link describeDeclaredPermissions} renders the raise on the arming
+ * card, so the human reads "grants nothing here" BEFORE they click, and
+ * {@link armDeclaredRoutinePermissions} writes no row and audits the skip. The fence
+ * (connections/connector-auth.ts) is untouched: it is still the only reader of the effective tier at
+ * lift time, and it still refuses. See {@link namesBundleRaisedTool}.
+ */
+export function declaredPermissionKinds(declared) {
+    if (declared.length > MAX_DECLARED_PERMISSIONS) {
+        throw new Error(`A routine may declare at most ${MAX_DECLARED_PERMISSIONS} standing permissions (got ${declared.length}) — declare only what it certainly needs; anything else asks a human when it fires.`);
+    }
+    const kinds = [];
+    for (const d of declared) {
+        const trimmed = d.trim();
+        const kind = routinePermissionKind(trimmed);
+        if (!kind) {
+            // WHY, THEN THE VOCABULARY (OPE-1306). The reason clause comes first because it is the part an
+            // author can act on: the commonest real cause is one mis-spelled segment of a real tool, and a
+            // message that recited only the grammar left them to diff it themselves.
+            const why = routinePermissionRefusal(trimmed);
+            throw new Error(`"${d}" is not a declarable routine permission${why ? ` — ${why}` : ""}. The whole vocabulary is: "pr.open" (open pull requests) and "tool:<connector tool>" — one row per TOOL, named exactly as the tool is called, e.g. "tool:notion__share_page". A connector slug on its own ("tool:notion") names no tool and is refused. Anything else — deletes included — is never declarable up front and always asks a human when it fires.`);
+        }
+        if (namesUnliftableTool(trimmed)) {
+            throw new Error(`"${d}" names a tool the fence will never lift, so declaring it would put a promise on the arming card that the runtime does not keep. A DELETE-tier verb refuses on every unattended fire whatever is declared. So does a verb the tier classifier does not recognise, which fails closed to the delete tier — if this op really is an ordinary write, its verb has to be a recognised one (access/consequence.ts CONNECTOR_WRITE_VERBS). Have the routine ask a person for that step.`);
+        }
+        if (!kinds.includes(kind))
+            kinds.push(kind);
+    }
+    return kinds;
+}
+/** The `pr.open` declaration, which names no connector tool. */
+const PR_OPEN_DECLARATION = "pr.open";
+/** The tool name inside a `tool:<name>` declaration `routinePermissionKind` has already accepted. */
+function declaredToolName(declared) {
+    return declared.slice("tool:".length);
+}
+/** Would the fence refuse this declaration's tool on tier grounds, whatever row exists? True for a
+ *  DELETE-tier verb and for an unrecognised one, which `classifyConnectorOpTier` fails closed to the
+ *  same tier. Both cases render a card line naming authority the runtime withholds, which is why
+ *  neither is written.
+ *
+ *  EXPORTED for `routines/permission-card.ts` (OPE-1357), which must apply the SAME test before it
+ *  plans a card: a card offering a declaration this arming path would refuse promises a human
+ *  something the fence breaks on every fire. One spelling of the tier rule, read by both. */
+export function namesUnliftableTool(trimmed) {
+    if (trimmed === PR_OPEN_DECLARATION)
+        return false;
+    return classifyConnectorOpTier(declaredToolName(trimmed)) === "destructive";
+}
+/**
+ * Does THIS DEPLOYMENT's bundle CONFIGURATION raise this declaration's tool to the delete tier — so
+ * the row would be written, rendered on the card, and then refused by the fence on every fire?
+ *
+ * 🔴 THIS IS THE OPE-1307 RESIDUAL, AND IT IS A DIFFERENT QUESTION FROM {@link namesUnliftableTool}.
+ * That one asks the STATIC classifier, and its answer is the same on every deployment — which is
+ * exactly why it is the one the model-facing throw reads. This one asks the DECLARED half of the
+ * seam (`connectorOpTierParts(tool).declared`, access/connector-op-gating.ts), which is this
+ * deployment's `connectorOps` config and nothing else. A tool both agree on is not interesting here:
+ * the static test already refused it. The set this names is precisely
+ * `static ≠ destructive AND declared = destructive` — the verb that declares cleanly and lifts
+ * nothing, which the human previously armed and was never told about.
+ *
+ * 🔴 THE DECLARED HALF, NOT `effectiveConnectorOpTier`, AND THE DIFFERENCE IS LOAD-BEARING. The
+ * effective tier is `base ⊕ consumer arm ⊕ declared`, and a registered `AppConfig.connectorOpTier`
+ * arm can raise a verdict too. Reading the whole seam here would be wrong twice over. It would make
+ * the card copy and the audit row FALSE — they name the bundle config, and an operator sent to their
+ * `connectorOps.destructive` list would not find the op there. And a consumer arm's verdict is PER
+ * CALL: the slot's contract asks only that an arm answer the same way within one process, so an arm
+ * that reads a cache built at boot may answer differently in the next process, and the same frozen
+ * card would skip the row on one delivery and write it on the next. A config declaration has
+ * neither property: it registers at boot and answers the same way every time.
+ *
+ * 🔴 SO AN ARM-RAISED VERB IS NOT COVERED HERE, DELIBERATELY, and the fence is where it belongs. The
+ * fence reads the effective tier itself at lift time and refuses on its own terms — which is the
+ * right place for a per-call verdict, and the only place that can see one. What this function buys
+ * is the case that IS stable enough to put on a human's card before they click.
+ *
+ * 🔴 IT IS A DIAGNOSIS, NOT A SECOND FENCE. Nothing here decides whether a call may proceed. Note
+ * that `declared` is joined LAST in `connectorOpTierParts`, so a declared `destructive` makes the
+ * effective tier destructive whatever an arm answered: everything this names really is unliftable.
+ *
+ * TOTAL. A config read that throws must not break an arming click on a routine that is already
+ * durably added. A throw answers `false`, which is exactly today's behaviour: the row is written and
+ * the fence refuses it, silently, as it did before.
+ */
+export function namesBundleRaisedTool(trimmed) {
+    if (trimmed === PR_OPEN_DECLARATION)
+        return false;
+    const tool = declaredToolName(trimmed);
+    if (classifyConnectorOpTier(tool) === "destructive")
+        return false; // already refused, statically
+    try {
+        return connectorOpTierParts(tool).declared === "destructive";
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The ARM-TIME reader — the kinds a click may write, skipping every declaration this build's
+ * vocabulary does not accept instead of throwing on it.
+ *
+ * 🔴 IT MUST NOT THROW, and that is the whole reason it is not {@link declaredPermissionKinds}. A
+ * creation card FREEZES its declaration strings and a human clicks it later, possibly after a
+ * deploy that changed the vocabulary — the per-tool re-key is exactly such a change, so a card
+ * frozen with the superseded `connector:<slug>` spelling is a live shape. The routine is already
+ * durably added by the time this runs, so a throw here would arm the routine AND render the card
+ * FAILED: the work runs nightly while the human is told nothing was armed. Skipping the row instead
+ * costs one refused step at fire time, which is the direction this whole plane fails in anyway.
+ *
+ * The per-declaration cap is NOT re-applied here for the same reason: the human read every line on
+ * the card, and lowering the cap later must not silently turn one frozen card into a failure.
+ * {@link unarmedDeclarations} names what did not arm, so the outcome line can say so.
+ *
+ * 🔴 A BUNDLE-RAISED TOOL IS SKIPPED HERE TOO (OPE-1307), where the model-facing throw deliberately
+ * lets it through. The asymmetry is the point: the throw is deployment-independent by design, and
+ * THIS moment is not — the click is on the very deployment whose bundles decide the answer, and the
+ * fence on that deployment refuses that tool on every fire. Writing the row anyway would leave a
+ * standing permission that lifts nothing, which is precisely the silence this ticket removes. The
+ * skip lands in {@link unarmedDeclarations} for free (it is declared MINUS granted), so the arming
+ * outcome names the declaration instead of implying it armed.
+ */
+function armablePermissionKinds(declared) {
+    const kinds = [];
+    for (const d of declared) {
+        const trimmed = d.trim();
+        const kind = routinePermissionKind(trimmed);
+        if (kind === null || namesUnliftableTool(trimmed) || namesBundleRaisedTool(trimmed))
+            continue;
+        if (!kinds.includes(kind))
+            kinds.push(kind);
+    }
+    return kinds;
+}
+/** The audit row for a declaration this deployment's bundle configuration raises out of reach
+ *  (OPE-1307). Ids and enums only — the declaration string is model-authored, but it is the very
+ *  thing an operator has to read to fix this, and it is already rendered verbatim on the card a
+ *  human clicked, so it carries. No prompt text and no target ever does. */
+export const ROUTINE_PERMISSION_NEVER_LIFTS_ACTION = "routine.permission_never_lifts";
+/**
+ * The audit actions the declared-permission plane writes: one when a creation-card click ARMS the
+ * declared set (approvals/routine-create.ts), one when `revoke_routine_permissions` withdraws it.
+ *
+ * 🔴 BOTH VALUES ARE PERSISTED AND NEITHER MOVES (OPE-1303). Rows carrying `routine.grant` and
+ * `routine.grants_revoked` sit in deployed audit chains, and the chain is append-only and
+ * hash-linked — a renamed action would not rewrite one row, it would only stop every reader from
+ * finding the old ones. So the vocabulary sweep named the constants for what the plane calls the
+ * thing (a DECLARED PERMISSION) and left the strings alone. Read the constant, never the literal.
+ */
+export const ROUTINE_PERMISSIONS_ARMED_ACTION = "routine.grant";
+export const ROUTINE_PERMISSIONS_REVOKED_ACTION = "routine.grants_revoked";
+/**
+ * The declarations a click did NOT arm, so the arming outcome can name them rather than leaving a
+ * human to believe a permission is live.
+ *
+ * 🔴 IT IS DECLARED MINUS GRANTED, never the vocabulary check alone. THREE things stop a declared
+ * permission becoming a live row, and a clause that walks only the first one affirmatively misleads
+ * on the other two — on a TAINTED card carrying one legacy string it would name that one string and
+ * imply the rest armed, when nothing armed at all:
+ *   • this build's vocabulary or the tier check refuses it ({@link armablePermissionKinds} skips it);
+ *   • the proposal was TAINTED, so {@link armDeclaredRoutinePermissions} wrote nothing;
+ *   • the row write failed, and that function degrades per row rather than failing the click.
+ * `granted` is what that function actually WROTE, which is the only reading that sees all three.
+ * A legacy `connector:<slug>` string lands here after the per-tool re-key.
+ */
+export function unarmedDeclarations(declared, granted) {
+    const out = [];
+    for (const d of declared) {
+        const trimmed = d.trim();
+        const kind = routinePermissionKind(trimmed);
+        const armed = kind !== null && !namesUnliftableTool(trimmed) && !namesBundleRaisedTool(trimmed) && granted.includes(kind);
+        if (!armed && !out.includes(d))
+            out.push(d);
+    }
+    return out;
+}
+/**
+ * The declared set as the arming card renders it: plain language, in the declaration's order.
+ *
+ * 🔴 EVERY DECLARATION GETS A LINE, and none of them over-promises. Those are two rules, and the
+ * function used to break both. It rendered ONLY the declarations `routinePermissionKind` mapped,
+ * so a card carrying nothing else showed NO permission line at all — the human read an ordinary
+ * card and never learned the model had declared anything. That is the failure the sibling renderer
+ * ({@link describeDeclaredPermissionKind}) names as the one it must not have: silently hiding a row is worse
+ * than an ugly row. A card FREEZES its declaration strings and is clicked later, possibly after a
+ * deploy that changed the vocabulary — the per-tool re-key is exactly such a change, so a card
+ * frozen with the superseded `connector:<slug>` spelling is a live shape, not a hypothetical.
+ *
+ * So a declaration this build cannot map renders as an explicit `unrecognised declaration` line
+ * instead of vanishing. It names the frozen text and promises nothing.
+ *
+ * The other half is {@link namesUnliftableTool}, applied here exactly as {@link
+ * armablePermissionKinds} applies it. A destructive-tier tool is refused at propose time, but the
+ * tier is read from a classifier a later deploy can change: a verb that declared cleanly can be
+ * DELETE-tier by the time the frozen card renders. Rendering it as `use the "…" tool` would then
+ * name standing authority the fence refuses on every fire — the same over-promise `describeDeclaredPermissionKind`
+ * removed from the legacy arm. It renders as lifting nothing instead.
+ *
+ * 🔴 A BUNDLE-RAISED TOOL GETS ITS OWN LINE (OPE-1307), and this is the moment the residual stops
+ * being silent. The card is what a human reads BEFORE they click, so it is the only place the
+ * warning can still change their mind. The line names the deployment, not the tool's nature — the
+ * same verb on a deployment without that bundle declaration lifts perfectly well, and a line saying
+ * otherwise would be false there.
+ *
+ * The direction stays UNDER-PROMISE throughout: a line here may say a declaration buys less than a
+ * click will write, never more.
+ *
+ * 🔴 EACH LINE IS A NOUN PHRASE, because ONE list feeds TWO sentence frames in
+ * approvals/routine-create.ts `permissionLines`, and this function cannot see which one it is
+ * filling. The armed frame reads "may, without asking: <lines>"; the TAINTED frame reads "asked for
+ * standing permission to <lines> — NOT granted". A line that opened with a bare "nothing" satisfied
+ * the first frame and made the second one FALSE — it said the model asked for nothing, when the
+ * model asked for the very string being echoed. So a non-arming line NAMES the declaration first and
+ * carries "(grants nothing)" as a trailing qualifier, which is true in both frames. Read both
+ * renderings before changing this wording.
+ */
+export function describeDeclaredPermissions(declared) {
+    const out = [];
+    for (const d of declared) {
+        const trimmed = d.trim();
+        const kind = routinePermissionKind(trimmed);
+        const line = kind === null
+            ? `unrecognised declaration: "${trimmed}" (grants nothing)`
+            : namesUnliftableTool(trimmed)
+                ? `the "${declaredToolName(trimmed)}" tool, never lifted on an unattended fire (grants nothing)`
+                : namesBundleRaisedTool(trimmed)
+                    ? `the "${declaredToolName(trimmed)}" tool, which this deployment's bundle configuration raises to the delete tier — the fence refuses it on every unattended fire (grants nothing here)`
+                    : describeDeclaredPermissionKind(kind);
+        if (!out.includes(line))
+            out.push(line);
+    }
+    return out;
+}
+/**
+ * Write the DECLARED set as standing grants, at ARM time (the human's click on the creation card),
+ * returning the kinds actually written. Returns `[]` — writing nothing — when the proposal was
+ * TAINTED: a routine authored in a turn that had ingested untrusted content starts from zero
+ * standing authority even if a human arms it, exactly as approvals/routine-lifecycle.ts describes
+ * for an edit. The routine itself is still armed; it simply asks when it fires.
+ *
+ * Best-effort per row, deliberately: the routine is already durably added by the time this runs, and
+ * a failed grant write degrades to "it will ask a human", which is the safe direction. Failing the
+ * whole click over it would leave an armed routine and a card rendered FAILED. That is why the
+ * kinds come from {@link armablePermissionKinds} and not from {@link declaredPermissionKinds} — a
+ * frozen card can name a declaration this build no longer accepts, and the throw would be exactly
+ * the failure this paragraph rules out.
+ *
+ * 🔴 THE BUNDLE-RAISED SKIP IS AUDITED BY THE CALLER (OPE-1307), not here. The row belongs in the
+ * arming partition beside the sibling {@link ROUTINE_PERMISSIONS_ARMED_ACTION} row, and this
+ * function is handed an org and a
+ * routine rather than a partition — writing it here would file it under an invented one. So the
+ * caller reads {@link bundleRaisedDeclarations} and writes
+ * {@link ROUTINE_PERMISSION_NEVER_LIFTS_ACTION} itself (approvals/routine-create.ts).
+ */
+export async function armDeclaredRoutinePermissions(input) {
+    if (input.tainted || input.declared.length === 0)
+        return [];
+    const store = getOperationalStore();
+    const sessionId = routinePermissionKey(input.routine);
+    const written = [];
+    for (const kind of armablePermissionKinds(input.declared)) {
+        const done = await store
+            .setSessionApproval({
+            org: input.org,
+            sessionId,
+            kind,
+            grantedBy: input.grantedBy,
+            createdAt: input.nowIso,
+            expiresAt: ROUTINE_PERMISSION_NO_EXPIRY,
+        })
+            .then(() => true)
+            .catch(() => false);
+        if (done)
+            written.push(kind);
+    }
+    return written;
+}
+/**
+ * The declarations THIS DEPLOYMENT's bundles raise to the delete tier — the set
+ * {@link armDeclaredRoutinePermissions} skips, in the declaration's own spelling.
+ *
+ * The caller writes the {@link ROUTINE_PERMISSION_NEVER_LIFTS_ACTION} row from this, in the arming
+ * partition. Pure and total: `namesBundleRaisedTool` swallows an unreadable bundle read, so this
+ * answers `[]` on a deployment whose config cannot be read — which is exactly the pre-OPE-1307
+ * behaviour, silence, rather than a throw on a click that has already armed a routine.
+ */
+export function bundleRaisedDeclarations(declared) {
+    const out = [];
+    for (const d of declared) {
+        const trimmed = d.trim();
+        if (routinePermissionKind(trimmed) === null || !namesBundleRaisedTool(trimmed))
+            continue;
+        if (!out.includes(trimmed))
+            out.push(trimmed);
+    }
+    return out;
+}
+/**
+ * The declarations that name a STANDING UNATTENDED WRITE, in the declaration's own spelling: a
+ * declared `pr.open`, and a connector tool whose tier is not `read`. Empty when the set declares
+ * only reads.
+ *
+ * 🔴 THIS IS THE HUMAN-ONLY CLASS (OPE-2101 and OPE-2103, Tommy rulings 2026-09-23). The armed
+ * approval judge may not lift a `routine.create` that declares one of these: a person's click on the
+ * creation card is the only lift. The approver chain reads this set to decide whether the judge is
+ * eligible at all (access/approver-chain.ts `judgeHumanOnlyReason`).
+ *
+ * FAIL CLOSED, in two ways. A tool counts when EITHER the static classifier or this deployment's
+ * effective tier says it is not a read, so a bundle that raises a read verb to a write is covered.
+ * A tier read that throws counts the tool as a write. A string the vocabulary does not accept is
+ * skipped: it can arm nothing, and create_routine refuses it before the card exists.
+ */
+export function declaredStandingWrites(declared) {
+    const out = [];
+    for (const d of declared) {
+        const trimmed = d.trim();
+        if (routinePermissionKind(trimmed) === null)
+            continue;
+        if (trimmed === PR_OPEN_DECLARATION) {
+            if (!out.includes(trimmed))
+                out.push(trimmed);
+            continue;
+        }
+        const tool = declaredToolName(trimmed);
+        let write;
+        try {
+            write = classifyConnectorOpTier(tool) !== "read" || connectorOpTierParts(tool).tier !== "read";
+        }
+        catch {
+            write = true;
+        }
+        if (write && !out.includes(trimmed))
+            out.push(trimmed);
+    }
+    return out;
+}
+/** The routine's live PERMISSION kinds — the rows that actually lift a gate. Reads only the live
+ *  generation's key, so a set invalidated by an edit reads as empty the moment the edit lands.
+ *
+ *  🔴 THE PERMISSION CARD'S BOOKKEEPING IS FILTERED OUT (OPE-1290). The card's "asked" and
+ *  "declined" markers ride the SAME key as the grants they are about, and neither grants anything.
+ *  A reader that showed one would tell a human the routine may do something no row permits — the
+ *  one direction every reader on this plane must never fail in. */
+async function livePermissionKinds(org, routine, nowIso) {
+    return await permissionKindsUnderKey(org, routinePermissionKey(routine), nowIso);
+}
+/**
+ * The routine's live permission KINDS read under a permission key that is already RESOLVED — the
+ * same rows {@link routinePermissionKinds} answers, addressed by the key instead of by the routine.
+ *
+ * It exists for the FIRE-TIME TOOLSET PROJECTION (OPE-2135, hooks/fire-toolset.ts). A fire carries
+ * its key stamped on its own auth bag (`routines/routine.ts routinePermissionKeyStamped`) and never carries the
+ * routine row, so the sibling readers above cannot serve it: reconstructing `{id, promptGeneration}`
+ * from the key would spell the generation a second time, and a fire whose generation the two
+ * spellings disagreed about would project a toolset off a key no gate reads.
+ *
+ * Both filters below are why this is not an open-coded store read at the call site. Fails SOFT to an
+ * empty list, like every other reader on this plane: the direction is "the routine holds less than
+ * it might", which projects no tool rather than one no row permits.
+ */
+export async function permissionKindsUnderKey(org, permissionKey, nowIso) {
+    const rows = await getOperationalStore().listSessionApprovals(org, permissionKey, nowIso).catch(() => []);
+    // 🔴 AND THE INERT LEGACY CONNECTOR ROWS ARE FILTERED OUT TOO (OPE-1308). A `connector.op:<slug>`
+    // row lifts no tool on any code path since the per-tool re-key, so counting one here would report
+    // a standing permission the routine does not hold — the same over-report the memo filter above
+    // exists to prevent, from a different row shape.
+    return rows.map((r) => r.kind).filter((k) => !isRoutinePermissionMemoKind(k) && !isLegacyConnectorOpKind(k));
+}
+/**
+ * The routine's live permission KINDS — the raw memo kinds, not their descriptions.
+ *
+ * It exists for the PRE-RUN COLLECTOR check (OPE-151, routines/collector.ts): a collector runs under
+ * the routine's declared permission and nothing wider, so the dispatcher has to compare the
+ * collector's tool against the kinds the routine actually holds. {@link listRoutinePermissions}
+ * cannot serve that — it renders each kind as prose for a human, and matching on prose would make a
+ * permission check depend on the wording of a card.
+ *
+ * It reads the LIVE rows, so a revoked permission stops its collector on the very next fire, and it
+ * fails SOFT to an empty list for the reason {@link listRoutinePermissions} does: the direction is
+ * "the routine holds less than it might", which refuses a collector rather than running one.
+ */
+export async function routinePermissionKinds(org, routine, nowIso) {
+    return await livePermissionKinds(org, routine, nowIso);
+}
+/**
+ * The routine's CURRENT standing set in plain language — what a human declared on the creation
+ * card, plus what a human later approved on a permission card (OPE-1290). Both are the same row
+ * shape under the same key.
+ *
+ * Fails SOFT to an empty list: `list_routines` must still answer the schedule question when the
+ * grant read fails. That direction is safe for the reader (it under-reports authority in a view,
+ * never over-reports it) and it is the same posture readRoutineForensics takes.
+ */
+export async function listRoutinePermissions(org, routine, nowIso) {
+    return (await livePermissionKinds(org, routine, nowIso)).map(describeDeclaredPermissionKind);
+}
+/**
+ * Withdraw the routine's WHOLE declared standing set without touching the routine row — the
+ * channel-side off switch for the authority alone.
+ *
+ * 🔴 TWO COUNTS, AND THEY ANSWER DIFFERENT QUESTIONS. `permissions` is how much AUTHORITY went, and
+ * it is what a human is told ("no longer has standing permission to …"); `rows` is how much this
+ * call actually DELETED. They diverge because the delete is by key, so it also takes the permission
+ * card's asked/declined markers (OPE-1290) — a revoke is a clean slate, and the routine may ask
+ * again on its next fire. Collapsing them into one number breaks one caller or the other: reporting
+ * `rows` names authority that was never held, and gating an audit row on `permissions` would let a
+ * call that destroyed a human's durable "never ask me again" leave no trace at all.
+ */
+export async function revokeRoutinePermissions(org, routine) {
+    const permissions = (await livePermissionKinds(org, routine, new Date().toISOString())).length;
+    const rows = await getOperationalStore().revokeSessionApprovals(org, routinePermissionKey(routine));
+    return { permissions, rows };
+}
+/**
+ * ONE-SHOT: delete every inert legacy `connector.op:<slug>` row this org holds under a routine
+ * grant key. Returns how many rows went (OPE-1308).
+ *
+ * 🔴 IT WITHDRAWS NO AUTHORITY, WHICH IS WHY IT MAY RUN UNATTENDED. Nothing reads a
+ * `connector.op:` row on any code path — the per-tool re-key refuses the shape rather than widening
+ * it — so these rows lift nothing and never did. They persist only because the routine grain
+ * carries a far-future expiry sentinel, so the prune-on-write GC never reaches them.
+ *
+ * Deliberately NOT folded into `revokeRoutinePermissions`: that call answers for ONE routine and
+ * must stay a withdrawal of that routine's authority, while this is an org-wide clean-up of dead
+ * records. `packages/core/scripts/sweep-legacy-connector-op-rows.ts` is the operator's entry point.
+ */
+export async function sweepLegacyConnectorOpRows(org) {
+    return await getOperationalStore().sweepLegacyConnectorOpRows(org);
+}
+//# sourceMappingURL=declared-permissions.js.map

package/dist/agent/routines/declared-permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"declared-permissions.js","sourceRoot":"","sources":["../../../agent/routines/declared-permissions.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,EAAE;AACF,yFAAyF;AACzF,iGAAiG;AACjG,kGAAkG;AAClG,iGAAiG;AACjG,+FAA+F;AAC/F,kEAAkE;AAClE,EAAE;AACF,gGAAgG;AAChG,gGAAgG;AAChG,qGAAqG;AACrG,gFAAgF;AAChF,EAAE;AACF,gGAAgG;AAChG,8EAA8E;AAC9E,kGAAkG;AAClG,kGAAkG;AAClG,oGAAoG;AACpG,gFAAgF;AAChF,qGAAqG;AACrG,kGAAkG;AAClG,kGAAkG;AAClG,iGAAiG;AACjG,mFAAmF;AACnF,kGAAkG;AAClG,mGAAmG;AACnG,mGAAmG;AACnG,sGAAsG;AACtG,oGAAoG;AACpG,sDAAsD;AACtD,EAAE;AACF,kGAAkG;AAClG,oGAAoG;AACpG,8FAA8F;AAC9F,uEAAuE;AACvE,EAAE;AACF,6FAA6F;AAC7F,gGAAgG;AAChG,8FAA8F;AAC9F,kFAAkF;AAClF,yEAAyE;AACzE,iGAAiG;AACjG,0FAA0F;AAC1F,iGAAiG;AACjG,4BAA4B;AAC5B,mGAAmG;AACnG,8FAA8F;AAC9F,mGAAmG;AACnG,4FAA4F;AAC5F,mGAAmG;AACnG,gGAAgG;AAChG,gGAAgG;AAChG,4CAA4C;AAC5C,iGAAiG;AACjG,6FAA6F;AAC7F,sEAAsE;AACtE,EAAE;AACF,kGAAkG;AAClG,yFAAyF;AACzF,kGAAkG;AAClG,iGAAiG;AACjG,+EAA+E;AAC/E,+FAA+F;AAC/F,+EAA+E;AAC/E,kGAAkG;AAClG,+CAA+C;AAE/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EACL,8BAA8B,EAC9B,uBAAuB,EACvB,2BAA2B,EAC3B,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAgB,MAAM,cAAc,CAAC;AAKlE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,0BAA0B,CAAC;AAEvE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAA2B;IACjE,IAAI,QAAQ,CAAC,MAAM,GAAG,wBAAwB,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,iCAAiC,wBAAwB,8BAA8B,QAAQ,CAAC,MAAM,qFAAqF,CAC5L,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,+FAA+F;YAC/F,+FAA+F;YAC/F,yEAAyE;YACzE,MAAM,GAAG,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,IAAI,CAAC,2CAA2C,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,iWAAiW,CACxa,CAAC;QACJ,CAAC;QACD,IAAI,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,IAAI,CAAC,mdAAmd,CACzd,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gEAAgE;AAChE,MAAM,mBAAmB,GAAG,SAAS,CAAC;AAEtC,qGAAqG;AACrG,SAAS,gBAAgB,CAAC,QAAgB;IACxC,OAAO,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;6FAO6F;AAC7F,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,IAAI,OAAO,KAAK,mBAAmB;QAAE,OAAO,KAAK,CAAC;IAClD,OAAO,uBAAuB,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,KAAK,aAAa,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,IAAI,OAAO,KAAK,mBAAmB;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,aAAa;QAAE,OAAO,KAAK,CAAC,CAAC,8BAA8B;IACjG,IAAI,CAAC;QACH,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,aAAa,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,SAAS,sBAAsB,CAAC,QAA2B;IACzD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,IAAI,KAAK,IAAI,IAAI,mBAAmB,CAAC,OAAO,CAAC,IAAI,qBAAqB,CAAC,OAAO,CAAC;YAAE,SAAS;QAC9F,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;4EAG4E;AAC5E,MAAM,CAAC,MAAM,qCAAqC,GAAG,gCAAgC,CAAC;AAEtF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,eAAe,CAAC;AAChE,MAAM,CAAC,MAAM,kCAAkC,GAAG,wBAAwB,CAAC;AAE3E;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAA2B,EAAE,OAA0B;IACzF,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,IAAI,KAAK,IAAI,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1H,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAA2B;IACrE,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,IAAI,GACR,IAAI,KAAK,IAAI;YACX,CAAC,CAAC,8BAA8B,OAAO,oBAAoB;YAC3D,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC;gBAC5B,CAAC,CAAC,QAAQ,gBAAgB,CAAC,OAAO,CAAC,6DAA6D;gBAChG,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC;oBAC9B,CAAC,CAAC,QAAQ,gBAAgB,CAAC,OAAO,CAAC,sJAAsJ;oBACzL,CAAC,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAOnD;IACC,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC5D,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAG,MAAM,KAAK;aACrB,kBAAkB,CAAC;YAClB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,SAAS;YACT,IAAI;YACJ,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,MAAM;YACvB,SAAS,EAAE,4BAA4B;SACxC,CAAC;aACD,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;aAChB,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QACtB,IAAI,IAAI;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAA2B;IAClE,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,qBAAqB,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC;YAAE,SAAS;QACzF,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAA2B;IAChE,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,qBAAqB,CAAC,OAAO,CAAC,KAAK,IAAI;YAAE,SAAS;QACtD,IAAI,OAAO,KAAK,mBAAmB,EAAE,CAAC;YACpC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9C,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YACH,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC,KAAK,MAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC;QACjG,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;QACD,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;mEAMmE;AACnE,KAAK,UAAU,mBAAmB,CAAC,GAAW,EAAE,OAA4B,EAAE,MAAc;IAC1F,OAAO,MAAM,uBAAuB,CAAC,GAAG,EAAE,oBAAoB,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;AACnF,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,GAAW,EAAE,aAAqB,EAAE,MAAc;IAC9F,MAAM,IAAI,GAAG,MAAM,mBAAmB,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1G,kGAAkG;IAClG,kGAAkG;IAClG,+FAA+F;IAC/F,iDAAiD;IACjD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/G,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,GAAW,EAAE,OAA4B,EAAE,MAAc;IACpG,OAAO,MAAM,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,GAAW,EAAE,OAA4B,EAAE,MAAc;IACpG,OAAO,CAAC,MAAM,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;AAC/F,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,GAAW,EACX,OAA4B;IAE5B,MAAM,WAAW,GAAG,CAAC,MAAM,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/F,MAAM,IAAI,GAAG,MAAM,mBAAmB,EAAE,CAAC,sBAAsB,CAAC,GAAG,EAAE,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC;IACpG,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,GAAW;IAC1D,OAAO,MAAM,mBAAmB,EAAE,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC;AACrE,CAAC"}

package/dist/agent/routines/disable-notice.d.ts

@@ -0,0 +1,75 @@
+import { type Routine } from "./routine.js";
+import type { BoundVerdict } from "./bound.js";
+import { resolveRoutineTarget } from "../schedules/routine-dispatch.js";
+/**
+ * The one line. Names the routine, says it STOPPED (not "failed" — the failures already happened;
+ * the news is that it will not run again), gives the reason verbatim from the row, and closes with
+ * the recovery action, mirroring `subscribe_pr`'s retirement notice ("say it can be re-subscribed").
+ *
+ * `reason` comes from `disabledReason`, which is host-composed (lifecycle.ts), not model text —
+ * but it is bounded anyway, on the standing rule that a notice is not the place to discover a
+ * surprisingly long string.
+ *
+ * 🔴 KEEP IT HOST-COMPOSED. OPE-177 gave a fire a way to DECLARE why its run failed, and the obvious
+ * next move — splice that declared line into `disabledReason` so this notice reads better — is
+ * refused on purpose. This message is host-posted, which is exactly how it reaches the room past the
+ * silent-routine delivery gate (routines/report.ts drops a silent fire's terminal prose). Threading
+ * model-authored text through it would hand a silent routine a three-fire path to posting arbitrary
+ * prose past its own gate. The declared reason lives on the `routine.fire` / `routine.disabled`
+ * audit rows instead; a unit assertion in scripts/routine-semantic-failure-test.ts pins the split.
+ */
+export declare function disableNoticeText(r: Pick<Routine, "id" | "prompt" | "report">, reason: string, consecutiveFailures: number): string;
+/**
+ * THE CEILING NOTICE (OPE-248) — the same one message, for the OTHER reason a routine stops itself.
+ *
+ * 🔴 A NOTICE, NOT AN APPROVAL CARD, AND THAT IS THE WHOLE DESIGN. The tempting shape for "should I
+ * keep going?" is a card, and it is wrong here for a reason the rest of the approvals plane does not
+ * share: a routine hits its ceiling at whatever hour its cadence lands on, with nobody present by
+ * construction. A card posted at 03:00 to an empty room does not gate anything — it SITS, and the
+ * job sits with it, in a state that is neither running nor stopped. A notice is read the next
+ * morning, and re-arming is one `enable_routine` (or one `create_routine`) away. Stopping is the safe
+ * default; asking is not.
+ *
+ * ⚠️ That argument used to end "…a third state that NOTHING IN THE TREE REAPS", and OPE-253 made the
+ * second half of it false: a fire soft-blocked by a spend checkpoint sits in exactly that state, and
+ * routines/stall.ts now reaps it — as a third {@link BoundDimension}, `stalled`, through this same
+ * notice. The reasoning that survives is the FIRST half, which is a property of an unattended fire
+ * rather than of what the tree happens to implement: nobody is in the room at the hour a fire lands,
+ * so a card cannot be the stop. That is why the stall's remedy is a notice too, and why the stall
+ * dimension changes this message's WORDS rather than its shape.
+ *
+ * IT LEADS WITH "NOTHING BROKE" — for a CEILING stop. The three-strike notice above reports failures,
+ * and a reader who has learned to read a 🛑 from a routine as "it broke" will misdiagnose one — the
+ * job may have been working perfectly the whole time and simply never reached an end. Saying so is
+ * what turns the message into a decision ("do I still want this?") instead of an incident. A STALL
+ * stop says the opposite half ("nothing broke, but it was never allowed to work") and names the step
+ * that has to happen before a re-arm, because there the operator's next action is genuinely different.
+ *
+ * HOST-COMPOSED, for exactly the reason {@link disableNoticeText} is: this posts past the
+ * silent-routine delivery gate. `verdict.reason` comes from routines/bound.ts, which composes it
+ * from the row's own numbers; no model text reaches this path.
+ */
+export declare function boundNoticeText(r: Pick<Routine, "id" | "prompt" | "report" | "sessionMode">, verdict: Extract<BoundVerdict, {
+    exhausted: true;
+}>): string;
+/** Injectable edges — the live defaults resolve the routine's dispatch target and post through the
+ *  per-platform unified arm, so the notice lands wherever a fire's own reply would have. */
+export interface DisableNoticeDeps {
+    readonly resolveTarget?: typeof resolveRoutineTarget;
+    readonly post?: (origin: NonNullable<ReturnType<typeof resolveRoutineTarget>>["origin"], text: string) => Promise<string>;
+}
+/** Post the self-disable notice into the routine's own surface. Returns whether a message landed.
+ *  Routing, fail-soft posture and the origin argument all live in {@link postRoutineNotice}, which
+ *  the ceiling notice shares. */
+export declare function announceSelfDisable(r: Routine, reason: string, consecutiveFailures: number, deps?: DisableNoticeDeps): Promise<boolean>;
+/**
+ * Post the CEILING notice (OPE-248) into the routine's own surface. Returns whether one landed.
+ *
+ * Deliberately the same delivery path as {@link announceSelfDisable}, not a second one: both are
+ * "this routine stopped itself, host-composed, must reach the room past the silent gate", and a
+ * second post arm would be a second thing to keep in step with `DispatchTarget.origin`.
+ */
+export declare function announceBoundExhausted(r: Routine, verdict: Extract<BoundVerdict, {
+    exhausted: true;
+}>, deps?: DisableNoticeDeps): Promise<boolean>;
+//# sourceMappingURL=disable-notice.d.ts.map