@open-everywhere/core 0.1.0

package/dist/agent/routines/fire-eligibility.js

@@ -0,0 +1,220 @@
+// fire-eligibility — THE creator-membership + account-status predicate re-checked AT FIRE TIME
+// (OPE-506, adopting Claude Tag's policy verbatim — a design note
+// §S2: "a creator-membership predicate re-checked at fire time — stop firing if the creator is
+// removed from the channel").
+//
+// A routine's creator can LEAVE THE ORG without stopping the routine — routines are surface-owned,
+// not principal-owned (routine.ts), so a fire runs on the ROOM's own authority, not the creator's
+// continued presence. That asymmetry is deliberate and is unaffected by this module (fire-creator.ts
+// already covers the DM-trust half of "left the org"). Two DIFFERENT facts DO stop a fire:
+//
+//   1. the creator is explicitly REMOVED from the room the routine posts into — "the org" and "the
+//      room" are different questions, and this asks the narrower one;
+//   2. the creator's ACCOUNT is deactivated/deleted outright — a stronger signal than merely losing
+//      internal-member standing, and one that survives even a workspace the creator otherwise still
+//      belongs to.
+//
+// Either one SKIPS this fire (never a failure — the ceiling and the three-strike counter never see
+// it, exactly like an over-budget decline), cached, with a `routine.skip` reason row
+// (routines/fire-audit.ts) so the gap is legible rather than a silent no-op.
+//
+// SCOPE: Slack + Teams (OPE-522 added the Teams leg) — the two platforms this tree has a
+// room-membership primitive and a per-account status field for. Every other platform has no such
+// check reachable from core today (fire-creator.ts's recheckFireCreator draws the identical line for
+// the same reason), so the predicate is a NO-OP there: PASS, never a manufactured skip. "Cannot
+// check" is a real answer, not a default of "removed" — the same fail-OPEN-on-uncertainty posture
+// channels/slack-events.ts's author probe and fire-creator.ts's recheck both take. Only a POSITIVE
+// "no" skips a fire; an unresolved probe never does.
+//
+// THE TEAMS ROOM CHECK ENFORCES, AND ONLY SINCE OPE-1810 COULD IT (Tommy, 2026-09-13). Its Graph
+// read addressed the team with the Bot Connector's id, which Graph does not answer, so the call
+// threw on every fire and the leg was fail-open on all of them — a check that had never once
+// skipped anything. The provider arm now resolves the Microsoft 365 group id first, and a creator
+// CONFIRMED out of the channel now skips the fire with the same `creator_removed_from_room` row the
+// Slack leg writes. Fail-open survives only where the probe could not GET an answer, and that arm
+// names its own cause (`TeamsMembershipUnresolved`) so schedules/dispatch.ts audits it — otherwise
+// a fail-open and a pass leave the same trace, which is exactly how this defect stayed invisible.
+//
+// TEAMS IDENTITY NOTE (OPE-522). `Routine.createdBy` (the `createdBy`/`roomId` pair below) is the
+// Bot Framework `from.id` for a Teams routine — the channel-account id captured on the creating
+// turn, NOT a Microsoft Graph identifier. Graph's `/users/{id}` and a channel roster's `userId` are
+// both keyed on the Azure AD OBJECT id, a DIFFERENT value (teams-identity.ts's `aadObjectId`
+// capture). So the Teams leg takes its OWN identity + room fields (`teamsTeamId`,
+// `teamsCreatorAadObjectId`) rather than overloading `createdBy`/`roomId` — an absent one is "cannot
+// check" (eligible), exactly like an absent `roomId` is for Slack.
+import { bridgeSlackForm } from "../channels/slack-bridge.js";
+import { bridgeTeamsRoomMembership, bridgeTeamsAccountActive, } from "../channels/teams-bridge.js";
+import { dmTrustTtlMs } from "../identity/trust.js";
+/** Bounds the worst-case pagination cost of a single membership probe (~10k members scanned at
+ *  Slack's max page size) — a huge channel that still doesn't contain the creator degrades to
+ *  "unresolved" (pass) rather than an unbounded loop. */
+const ROOM_MEMBER_MAX_PAGES = 10;
+const roomMemberCache = new Map();
+/**
+ * Slack room-membership probe (pure but for the injected `form`): paginate `conversations.members`
+ * looking for `userId`, bounded at {@link ROOM_MEMBER_MAX_PAGES}. Exported (not the cache-wrapped
+ * live wrapper below) so the pagination + fail-open logic is unit-testable with a canned form
+ * function, no bridge registration or network call — the same split
+ * teams-fire-eligibility.ts's `teamsRoomMembershipViaGraph` draws for the Teams leg.
+ */
+export async function slackRoomMembershipViaConversationsMembers(channelId, userId, form) {
+    if (channelId.length === 0 || userId.length === 0)
+        return undefined;
+    try {
+        let cursor;
+        for (let page = 0; page < ROOM_MEMBER_MAX_PAGES; page++) {
+            const qs = new URLSearchParams({ channel: channelId, limit: "1000" });
+            if (cursor)
+                qs.set("cursor", cursor);
+            const info = await form("conversations.members", qs.toString());
+            if (!info || info["ok"] !== true)
+                return undefined; // no provider / no token / a real API error ⇒ unresolvable
+            // A genuine Slack success ALWAYS carries `members` as an array, even an empty one — a
+            // response missing the key entirely is not a members list at all (a malformed/unexpected
+            // shape), so it is read as UNRESOLVABLE rather than as "confirmed nobody's in this channel".
+            // Fabricating a negative from a shape this module doesn't recognise is exactly the "cannot
+            // check" case the whole module exists to distinguish from "confirmed no".
+            if (!Array.isArray(info["members"]))
+                return undefined;
+            const members = info["members"];
+            if (members.includes(userId))
+                return true;
+            const meta = info["response_metadata"];
+            cursor = typeof meta?.next_cursor === "string" && meta.next_cursor.length > 0 ? meta.next_cursor : undefined;
+            if (!cursor)
+                break;
+        }
+        // `cursor` still set here means the page bound was hit with roster left unseen — that is NOT
+        // the same fact as "scanned every member and they weren't in it", so it stays unresolved
+        // rather than becoming a confirmed (and possibly wrong) "removed". Only a loop that ended
+        // because pagination itself ran out (`cursor` fell to `undefined`) has actually seen the WHOLE
+        // roster. Mirrors teams-fire-eligibility.ts's identical `url`-still-set check.
+        return cursor ? undefined : false;
+    }
+    catch {
+        return undefined; // never block a fire on a failed probe
+    }
+}
+/**
+ * Live Slack room-membership probe: {@link slackRoomMembershipViaConversationsMembers} through the
+ * real bridge, TTL-cached per (channel, user) on the same clock the rest of this tree's trust
+ * probes use (`dmTrustTtlMs` — identity/trust.ts). A cache hit costs nothing; a miss costs at most
+ * {@link ROOM_MEMBER_MAX_PAGES} Web API calls, once per (channel, user) per TTL window regardless
+ * of how many routines share that creator+room. Only a CONFIRMED result (the whole roster seen, or
+ * the creator found early) is cached — an unresolved probe, including a page-bound hit with more
+ * roster left unseen, is never cached, so the very next check gets a fresh chance to resolve it.
+ */
+export const liveRoomMembership = async (channelId, userId) => {
+    if (channelId.length === 0 || userId.length === 0)
+        return undefined;
+    const key = `${channelId}/${userId}`;
+    const hit = roomMemberCache.get(key);
+    if (hit && Date.now() - hit.at < dmTrustTtlMs())
+        return hit.member;
+    const member = await slackRoomMembershipViaConversationsMembers(channelId, userId, bridgeSlackForm);
+    if (member !== undefined)
+        roomMemberCache.set(key, { member, at: Date.now() });
+    return member;
+};
+const accountActiveCache = new Map();
+/** Live Slack account-status probe: `users.info.deleted`, TTL-cached the same way. Deliberately
+ *  NARROWER than `slackAuthorIsMember`/`partnerFactsFromInfo` (which also fold in guest/stranger
+ *  status): those answer "is this person internal", which is the ORG question this module does not
+ *  ask; this answers only whether the account itself still exists and is enabled. */
+const liveAccountActive = async (userId) => {
+    if (userId.length === 0)
+        return undefined;
+    const hit = accountActiveCache.get(userId);
+    if (hit && Date.now() - hit.at < dmTrustTtlMs())
+        return hit.active;
+    try {
+        const info = await bridgeSlackForm("users.info", new URLSearchParams({ user: userId }).toString());
+        if (!info || info["ok"] !== true)
+            return undefined; // no provider / no token / a real API error ⇒ unresolvable
+        const u = info["user"];
+        if (!u || typeof u !== "object")
+            return undefined; // an unexpected shape ⇒ unresolvable, never a fabricated "active"
+        const active = !u["deleted"];
+        accountActiveCache.set(userId, { active, at: Date.now() });
+        return active;
+    }
+    catch {
+        return undefined;
+    }
+};
+/** Test seam — drop both in-process caches so one test can't inherit another's verdicts. */
+export function _resetFireEligibilityCachesForTest() {
+    roomMemberCache.clear();
+    accountActiveCache.clear();
+}
+/** Live Teams room-membership probe: the registered bridge, which answers `no_provider` when no
+ *  Teams provider is booted. Args are already non-empty-checked by the caller. */
+const liveTeamsRoomMembership = (teamId, channelId, aadObjectId, serviceUrl) => bridgeTeamsRoomMembership(teamId, channelId, aadObjectId, serviceUrl);
+/** Live Teams account-status probe: the registered bridge, or `undefined` when unregistered. */
+const liveTeamsAccountActive = (aadObjectId) => bridgeTeamsAccountActive(aadObjectId);
+/** Positive-only refusal from a (member, active) pair, shared by every platform leg below: a
+ *  CONFIRMED "no" on either axis skips; anything else (both true, or either unresolved) is eligible.
+ *  Membership is read first only for READ ORDER (it is the one Tag's own wording names — "removed
+ *  from the channel"); a confirmed-inactive account skips just the same either way. */
+function verdictFromChecks(member, active) {
+    if (member === false)
+        return { eligible: false, reason: "creator_removed_from_room" };
+    if (active === false)
+        return { eligible: false, reason: "creator_account_inactive" };
+    return { eligible: true };
+}
+/**
+ * Is this fire's creator still eligible to have it run? Positive-only refusal: a CONFIRMED "no"
+ * (removed from the room, or an inactive account) skips the fire; anything else — no creator to
+ * check, an unsupported platform, an unresolvable room, or a probe that could not answer — is
+ * eligible. Never throws: both probes are already internally fail-soft, but a caller that races a
+ * network read still gets a definite answer either way.
+ */
+export async function checkFireEligibility(input) {
+    if (!input.createdBy)
+        return { eligible: true };
+    if (input.platform === "slack") {
+        if (!input.roomId)
+            return { eligible: true };
+        const membershipCheck = input.membershipCheck ?? liveRoomMembership;
+        const activeCheck = input.activeCheck ?? liveAccountActive;
+        const [member, active] = await Promise.all([
+            membershipCheck(input.roomId, input.createdBy).catch(() => undefined),
+            activeCheck(input.createdBy).catch(() => undefined),
+        ]);
+        return verdictFromChecks(member, active);
+    }
+    if (input.platform === "teams") {
+        // NO ROOM, NOTHING TO ASK — a Teams personal chat carries no channel, so room membership is not
+        // a question that exists there. Silent and eligible, exactly like the Slack branch's own
+        // `!input.roomId` arm, and deliberately NOT a `missing_ids` row: a row on every DM fire would
+        // bury the signal the row exists to carry.
+        if (!input.roomId)
+            return { eligible: true };
+        // 🔴 THERE IS A ROOM AND WE CANNOT ASK ABOUT IT (OPE-1810). A routine created before its team id
+        // or its creator's Azure AD object id was captured reaches here, and the fire proceeds UNCHECKED
+        // — the same fail-open as a Graph read that failed, so it owes the same row. Returning a bare
+        // `{ eligible: true }` here is what let a whole population of routines escape the check in
+        // silence, which is the defect this ticket removes rather than one it may reintroduce.
+        if (!input.teamsTeamId || !input.teamsCreatorAadObjectId)
+            return { eligible: true, teamsMembershipUnresolved: "missing_ids" };
+        const membershipCheck = input.teamsMembershipCheck ?? liveTeamsRoomMembership;
+        const activeCheck = input.teamsActiveCheck ?? liveTeamsAccountActive;
+        const [membership, active] = await Promise.all([
+            // A probe that THROWS is the same fact as a Graph read that failed — it never reaches the
+            // caller as a bare `undefined`, because an unnamed fail-open is the one this ticket removes.
+            membershipCheck(input.teamsTeamId, input.roomId, input.teamsCreatorAadObjectId, input.teamsServiceUrl).catch(() => ({ member: undefined, unresolved: "read_error" })),
+            activeCheck(input.teamsCreatorAadObjectId).catch(() => undefined),
+        ]);
+        const verdict = verdictFromChecks(membership.member, active);
+        // An unresolved MEMBERSHIP read still fires (the ruled fail-open), and the cause rides out so
+        // the dispatcher can write its row. An unresolved read that loses to a CONFIRMED-inactive
+        // account carries nothing: that fire is already skipped, with its own reason.
+        if (verdict.eligible && membership.member === undefined) {
+            return { eligible: true, teamsMembershipUnresolved: membership.unresolved };
+        }
+        return verdict;
+    }
+    return { eligible: true };
+}
+//# sourceMappingURL=fire-eligibility.js.map

package/dist/agent/routines/fire-eligibility.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fire-eligibility.js","sourceRoot":"","sources":["../../../agent/routines/fire-eligibility.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,kEAAkE;AAClE,+FAA+F;AAC/F,8BAA8B;AAC9B,EAAE;AACF,mGAAmG;AACnG,kGAAkG;AAClG,qGAAqG;AACrG,2FAA2F;AAC3F,EAAE;AACF,mGAAmG;AACnG,sEAAsE;AACtE,oGAAoG;AACpG,oGAAoG;AACpG,mBAAmB;AACnB,EAAE;AACF,mGAAmG;AACnG,qFAAqF;AACrF,6EAA6E;AAC7E,EAAE;AACF,yFAAyF;AACzF,iGAAiG;AACjG,qGAAqG;AACrG,gGAAgG;AAChG,kGAAkG;AAClG,mGAAmG;AACnG,qDAAqD;AACrD,EAAE;AACF,iGAAiG;AACjG,gGAAgG;AAChG,6FAA6F;AAC7F,kGAAkG;AAClG,oGAAoG;AACpG,kGAAkG;AAClG,mGAAmG;AACnG,kGAAkG;AAClG,EAAE;AACF,kGAAkG;AAClG,gGAAgG;AAChG,oGAAoG;AACpG,6FAA6F;AAC7F,kFAAkF;AAClF,qGAAqG;AACrG,mEAAmE;AAEnE,OAAO,EAAE,eAAe,EAAoB,MAAM,6BAA6B,CAAC;AAChF,OAAO,EACL,yBAAyB,EACzB,wBAAwB,GAKzB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAWpD;;yDAEyD;AACzD,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC,MAAM,eAAe,GAAG,IAAI,GAAG,EAA6D,CAAC;AAE7F;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,0CAA0C,CAAC,SAAiB,EAAE,MAAc,EAAE,IAAiB;IACnH,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACpE,IAAI,CAAC;QACH,IAAI,MAA0B,CAAC;QAC/B,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,qBAAqB,EAAE,IAAI,EAAE,EAAE,CAAC;YACxD,MAAM,EAAE,GAAG,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YACtE,IAAI,MAAM;gBAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,uBAAuB,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;YAChE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC,CAAC,2DAA2D;YAC/G,sFAAsF;YACtF,yFAAyF;YACzF,6FAA6F;YAC7F,2FAA2F;YAC3F,0EAA0E;YAC1E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAAE,OAAO,SAAS,CAAC;YACtD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAc,CAAC;YAC7C,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,mBAAmB,CAA0C,CAAC;YAChF,MAAM,GAAG,OAAO,IAAI,EAAE,WAAW,KAAK,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7G,IAAI,CAAC,MAAM;gBAAE,MAAM;QACrB,CAAC;QACD,6FAA6F;QAC7F,yFAAyF;QACzF,0FAA0F;QAC1F,+FAA+F;QAC/F,+EAA+E;QAC/E,OAAO,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC,CAAC,uCAAuC;IAC3D,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAwB,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE;IACjF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,GAAG,GAAG,GAAG,SAAS,IAAI,MAAM,EAAE,CAAC;IACrC,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,EAAE,GAAG,YAAY,EAAE;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC;IACnE,MAAM,MAAM,GAAG,MAAM,0CAA0C,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;IACpG,IAAI,MAAM,KAAK,SAAS;QAAE,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC/E,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA6D,CAAC;AAEhG;;;qFAGqF;AACrF,MAAM,iBAAiB,GAAuB,KAAK,EAAE,MAAM,EAAE,EAAE;IAC7D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,EAAE,GAAG,YAAY,EAAE;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,YAAY,EAAE,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QACnG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC,CAAC,2DAA2D;QAC/G,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAwC,CAAC;QAC9D,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC,CAAC,kEAAkE;QACrH,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC7B,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3D,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAC;AAEF,4FAA4F;AAC5F,MAAM,UAAU,kCAAkC;IAChD,eAAe,CAAC,KAAK,EAAE,CAAC;IACxB,kBAAkB,CAAC,KAAK,EAAE,CAAC;AAC7B,CAAC;AAQD;kFACkF;AAClF,MAAM,uBAAuB,GAA6B,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE,CACvG,yBAAyB,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AAExE,gGAAgG;AAChG,MAAM,sBAAsB,GAA4B,CAAC,WAAW,EAAE,EAAE,CAAC,wBAAwB,CAAC,WAAW,CAAC,CAAC;AA+C/G;;;uFAGuF;AACvF,SAAS,iBAAiB,CAAC,MAA2B,EAAE,MAA2B;IACjF,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IACtF,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IACrF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAA2B;IACpE,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAChD,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC7C,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,IAAI,kBAAkB,CAAC;QACpE,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,iBAAiB,CAAC;QAC3D,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACzC,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAwB,EAAE,CAAC,SAAS,CAAC;YAC1F,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAwB,EAAE,CAAC,SAAS,CAAC;SACzE,CAAC,CAAC;QACH,OAAO,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC/B,gGAAgG;QAChG,yFAAyF;QACzF,8FAA8F;QAC9F,2CAA2C;QAC3C,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC7C,iGAAiG;QACjG,iGAAiG;QACjG,8FAA8F;QAC9F,2FAA2F;QAC3F,uFAAuF;QACvF,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,uBAAuB;YAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,yBAAyB,EAAE,aAAa,EAAE,CAAC;QAC9H,MAAM,eAAe,GAAG,KAAK,CAAC,oBAAoB,IAAI,uBAAuB,CAAC;QAC9E,MAAM,WAAW,GAAG,KAAK,CAAC,gBAAgB,IAAI,sBAAsB,CAAC;QACrE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC7C,0FAA0F;YAC1F,6FAA6F;YAC7F,eAAe,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,uBAAuB,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC,KAAK,CAC1G,GAAwB,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAC7E;YACD,WAAW,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,KAAK,CAAC,GAAwB,EAAE,CAAC,SAAS,CAAC;SACvF,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,iBAAiB,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC7D,8FAA8F;QAC9F,0FAA0F;QAC1F,8EAA8E;QAC9E,IAAI,OAAO,CAAC,QAAQ,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACxD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,yBAAyB,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC;QAC9E,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC"}

package/dist/agent/routines/fire-halt.d.ts

@@ -0,0 +1,16 @@
+import { type HaltDeps } from "../access/halt.js";
+import { type RoutineAuditDeps } from "./fire-audit.js";
+import type { Routine } from "./routine.js";
+/**
+ * Is this routine's fire halted? When it is, the `routine.skip` row (reason `halted`) is written
+ * before this returns true — reusing {@link auditRoutineSkip}, and therefore its per-(routine,
+ * reason) hourly throttle, rather than adding a second skip vocabulary.
+ *
+ * `extra` carries each leg's own context onto the row (the trigger kind on the clock leg, the event
+ * on the fan-out leg), exactly as the over-budget skip beside it does.
+ */
+export declare function routineFireHalted(r: Routine, extra?: Readonly<Record<string, unknown>>, deps?: {
+    readonly audit?: RoutineAuditDeps;
+    readonly halt?: HaltDeps;
+}): Promise<boolean>;
+//# sourceMappingURL=fire-halt.d.ts.map

package/dist/agent/routines/fire-halt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fire-halt.d.ts","sourceRoot":"","sources":["../../../agent/routines/fire-halt.ts"],"names":[],"mappings":"AAmBA,OAAO,EAA6B,KAAK,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7E,OAAO,EAAoB,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAE1E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE5C;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,CAAC,EAAE,OAAO,EACV,KAAK,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAM,EAC7C,IAAI,GAAE;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAA;CAAO,GACzE,OAAO,CAAC,OAAO,CAAC,CAoBlB"}

package/dist/agent/routines/fire-halt.js

@@ -0,0 +1,49 @@
+// THE ROUTINE PLANE'S HALT CHECK — one predicate, called from BOTH legs.
+//
+// 🔴 THIS PLANE HAS NO CHOKE POINT, WHICH IS WHY THE PREDICATE IS SHARED. A routine fires down two
+// structurally independent paths: the CLOCK leg (`schedules/dispatch.ts` `dispatchTick`, driven by
+// the eve cron) and the EVENT FAN-OUT leg (`routines/ingress.ts` `admitTrigger` → `fanOut`). Their
+// ladders are asymmetric — creator eligibility is clock-only, the audience floor is event-only — and
+// the nearest thing to a shared point, `resolveRoutineTarget`, is deliberately pure and synchronous,
+// so an async store read cannot go there. Two call sites is the honest answer; ONE predicate behind
+// them is what stops the two from drifting into different answers, which is the exact defect
+// `spend/ingress-gate.ts` records happening twice already (a gate that shipped on one leg only).
+//
+// A HALT SKIPS A FIRE. It does not stop a turn a fire already started: after the send
+// (`dispatch.ts`, `ingress.ts`) the turn belongs to eve, and what catches it then is the tool
+// plane's own arrow at that turn's next consequential act. Do not claim the halt is instantaneous.
+//
+// FAIL-CLOSED, like every other halt arrow: an unreadable halt store skips the fire. It costs
+// nothing a broken store was not already costing — both legs read their routines from that same
+// store, so a store that cannot answer this question has no routines to fire either.
+import { haltScopeFor, resolveHalt } from "../access/halt.js";
+import { auditRoutineSkip } from "./fire-audit.js";
+import { routinePartition } from "./partition.js";
+/**
+ * Is this routine's fire halted? When it is, the `routine.skip` row (reason `halted`) is written
+ * before this returns true — reusing {@link auditRoutineSkip}, and therefore its per-(routine,
+ * reason) hourly throttle, rather than adding a second skip vocabulary.
+ *
+ * `extra` carries each leg's own context onto the row (the trigger kind on the clock leg, the event
+ * on the fan-out leg), exactly as the over-budget skip beside it does.
+ */
+export async function routineFireHalted(r, extra = {}, deps = {}) {
+    const p = routinePartition(r);
+    const state = await resolveHalt(haltScopeFor({
+        org: p.org,
+        // The surface key carries the DOMAIN axis too — `haltScopeFor` resolves it through the one
+        // shared resolver (`haltDomainForSurfaceKey`), so this leg and every other arrow read the
+        // same answer. A private copy of that resolver here is how the axis went missing elsewhere.
+        scopeKey: p.surfaceKey,
+        // The routine's CREATOR is the person axis. A fire has no acting sender, and the creator is
+        // who the fire is attributed to everywhere else in this plane (the ledger, the audit row,
+        // the seat) — so a `level: "user"` halt on them stops their routines, which is what an
+        // operator halting a person means.
+        ...(r.createdBy ? { principalId: r.createdBy } : {}),
+    }), deps.halt ?? {});
+    if (!state.halted)
+        return false;
+    await auditRoutineSkip(r, "halted", extra, deps.audit ?? {}).catch(() => false);
+    return true;
+}
+//# sourceMappingURL=fire-halt.js.map

package/dist/agent/routines/fire-halt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fire-halt.js","sourceRoot":"","sources":["../../../agent/routines/fire-halt.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,EAAE;AACF,mGAAmG;AACnG,mGAAmG;AACnG,mGAAmG;AACnG,qGAAqG;AACrG,qGAAqG;AACrG,oGAAoG;AACpG,6FAA6F;AAC7F,iGAAiG;AACjG,EAAE;AACF,sFAAsF;AACtF,8FAA8F;AAC9F,mGAAmG;AACnG,EAAE;AACF,8FAA8F;AAC9F,gGAAgG;AAChG,qFAAqF;AAErF,OAAO,EAAE,YAAY,EAAE,WAAW,EAAiB,MAAM,mBAAmB,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAyB,MAAM,iBAAiB,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGlD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,CAAU,EACV,KAAK,GAAsC,EAAE,EAC7C,IAAI,GAAoE,EAAE;IAE1E,MAAM,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,MAAM,WAAW,CAC7B,YAAY,CAAC;QACX,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,2FAA2F;QAC3F,0FAA0F;QAC1F,4FAA4F;QAC5F,QAAQ,EAAE,CAAC,CAAC,UAAU;QACtB,4FAA4F;QAC5F,0FAA0F;QAC1F,uFAAuF;QACvF,mCAAmC;QACnC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrD,CAAC,EACF,IAAI,CAAC,IAAI,IAAI,EAAE,CAChB,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAChC,MAAM,gBAAgB,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;IAChF,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/agent/routines/fire-message.d.ts

@@ -0,0 +1,31 @@
+import { type Routine } from "./routine.js";
+import type { CollectedInput } from "./collector.js";
+/** Exactly the routine fields any of the three renderers reads — so a caller with a PROPOSED
+ *  routine (create_routine's preview, before an id is minted) can render one without inventing
+ *  the run-state fields a stored row would have. */
+export type FireMessageInput = Pick<Routine, "id" | "prompt" | "createdAt" | "lastRunAt" | "report" | "trigger" | "sessionMode" | "lastStateHash" | "jobState" | "jobTainted" | "policy" | "followUps">;
+/**
+ * The message THIS routine's next fire will receive, protocol block and all.
+ *
+ *   • a DURABLE JOB gets the job protocol (temporal preamble + "where you were" ledger + the
+ *     keep-the-ledger / complete-when-done instruction) — checked FIRST, because a job's stored
+ *     trigger is an ordinary cron/interval and the job protocol supersedes the plain one;
+ *   • a `watch` gets the post-on-diff protocol (observe → record_watch_state → silence sentinel);
+ *   • everything else (cron / interval / once / event) gets the temporal preamble + the prompt.
+ *
+ * The silent block (OPE-149) is rendered INSIDE each of those, so it is carried here for free.
+ *
+ * Renders from whatever `r` the caller passes: the dispatcher passes its PRE-advance in-memory copy
+ * (so "previous run" is the run before this one), and the preview passes a proposed routine with no
+ * `lastRunAt` (so it renders as the FIRST run, which is what a preview is describing).
+ *
+ * `collected` (OPE-151) is THIS fire's pre-run collection, which the dispatcher has already run by
+ * the time it renders. It is a per-FIRE input rather than a field of the row, so it is a parameter
+ * rather than part of {@link FireMessageInput} — but it comes through this one selection for the
+ * same reason everything else does: the `create_routine` preview must be able to describe the shape
+ * of the message the dispatcher will send, and a second renderer would let the two drift. It
+ * defaults to empty, so a preview (which collects nothing) and every routine that declares no
+ * collectors render exactly the message they rendered before.
+ */
+export declare function renderFireMessage(r: FireMessageInput, collected?: readonly CollectedInput[]): string;
+//# sourceMappingURL=fire-message.d.ts.map

package/dist/agent/routines/fire-message.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fire-message.d.ts","sourceRoot":"","sources":["../../../agent/routines/fire-message.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAgB,KAAK,OAAO,EAAE,MAAM,cAAc,CAAC;AAG1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAErD;;oDAEoD;AACpD,MAAM,MAAM,gBAAgB,GAAG,IAAI,CACjC,OAAO,EACL,IAAI,GACJ,QAAQ,GACR,WAAW,GACX,WAAW,GACX,QAAQ,GACR,SAAS,GACT,aAAa,GACb,eAAe,GACf,UAAU,GACV,YAAY,GAIZ,QAAQ,GAGR,WAAW,CACd,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,gBAAgB,EAAE,SAAS,GAAE,SAAS,cAAc,EAAO,GAAG,MAAM,CAGxG"}

package/dist/agent/routines/fire-message.js

@@ -0,0 +1,51 @@
+// THE FIRE MESSAGE — the one function that decides which protocol a routine's fire is rendered
+// with, and therefore the one definition of "what this routine will actually be told" (OPE-147).
+//
+// WHY IT EXISTS. The selection used to be an inline ternary in schedules/dispatch.ts:
+//
+//     const message = isJobRoutine(r) ? renderJobMessage(r) : r.trigger.kind === "watch" ? renderWatchMessage(r) : renderScheduledMessage(r);
+//
+// That was fine while the dispatcher was the only caller. It stopped being fine the moment
+// `create_routine` gained a PREVIEW: a preview that re-derives the same choice from the same three
+// renderers is a SECOND copy of a rule, and the whole value of a preview is that it cannot lie
+// about what the fire will say. A fourth trigger kind, or a second protocol block, would have to be
+// added in two places and would silently be added in one.
+//
+// So the ternary moved here, the dispatcher calls it, and the preview calls it. There is exactly one
+// answer to "what message does this routine's fire receive", and both the thing that fires it and
+// the thing that describes it read that answer from the same line of code.
+//
+// Framework-free (no eve imports), matching routine.ts / watch.ts / job.ts, so the dispatcher, the
+// tools and the tests all share it without pulling the runtime.
+import { isJobRoutine } from "./routine.js";
+import { renderScheduledMessage, renderWatchMessage } from "./watch.js";
+import { renderJobMessage } from "./job.js";
+/**
+ * The message THIS routine's next fire will receive, protocol block and all.
+ *
+ *   • a DURABLE JOB gets the job protocol (temporal preamble + "where you were" ledger + the
+ *     keep-the-ledger / complete-when-done instruction) — checked FIRST, because a job's stored
+ *     trigger is an ordinary cron/interval and the job protocol supersedes the plain one;
+ *   • a `watch` gets the post-on-diff protocol (observe → record_watch_state → silence sentinel);
+ *   • everything else (cron / interval / once / event) gets the temporal preamble + the prompt.
+ *
+ * The silent block (OPE-149) is rendered INSIDE each of those, so it is carried here for free.
+ *
+ * Renders from whatever `r` the caller passes: the dispatcher passes its PRE-advance in-memory copy
+ * (so "previous run" is the run before this one), and the preview passes a proposed routine with no
+ * `lastRunAt` (so it renders as the FIRST run, which is what a preview is describing).
+ *
+ * `collected` (OPE-151) is THIS fire's pre-run collection, which the dispatcher has already run by
+ * the time it renders. It is a per-FIRE input rather than a field of the row, so it is a parameter
+ * rather than part of {@link FireMessageInput} — but it comes through this one selection for the
+ * same reason everything else does: the `create_routine` preview must be able to describe the shape
+ * of the message the dispatcher will send, and a second renderer would let the two drift. It
+ * defaults to empty, so a preview (which collects nothing) and every routine that declares no
+ * collectors render exactly the message they rendered before.
+ */
+export function renderFireMessage(r, collected = []) {
+    if (isJobRoutine(r))
+        return renderJobMessage(r, collected);
+    return r.trigger.kind === "watch" ? renderWatchMessage(r, collected) : renderScheduledMessage(r, collected);
+}
+//# sourceMappingURL=fire-message.js.map

package/dist/agent/routines/fire-message.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fire-message.js","sourceRoot":"","sources":["../../../agent/routines/fire-message.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,iGAAiG;AACjG,EAAE;AACF,sFAAsF;AACtF,EAAE;AACF,8IAA8I;AAC9I,EAAE;AACF,2FAA2F;AAC3F,mGAAmG;AACnG,+FAA+F;AAC/F,oGAAoG;AACpG,0DAA0D;AAC1D,EAAE;AACF,qGAAqG;AACrG,kGAAkG;AAClG,2EAA2E;AAC3E,EAAE;AACF,mGAAmG;AACnG,gEAAgE;AAEhE,OAAO,EAAE,YAAY,EAAgB,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AA2B5C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAmB,EAAE,SAAS,GAA8B,EAAE;IAC9F,IAAI,YAAY,CAAC,CAAC,CAAC;QAAE,OAAO,gBAAgB,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAC3D,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AAC9G,CAAC"}

package/dist/agent/routines/fire-toolset.d.ts

@@ -0,0 +1,94 @@
+/**
+ * One discovered connector operation, in the SAME shape eve's `connection_search` writes into its
+ * own result slot (`execution/tools/connection-search.js` CONNECTION_SEARCH_RESULT_ITEM_SCHEMA).
+ * eve's resolver reads that slot and builds one dynamic tool per row, so a row this module writes
+ * and a row a real search wrote are indistinguishable by the time the model sees a tool.
+ */
+export interface ProjectedConnectorOp {
+    /** The connection's registered name (eve's `connectionName`). */
+    readonly connection: string;
+    /** The operation's own description, as the connection advertises it. */
+    readonly description: string;
+    /** `<connection>__<op>` — the name the model calls and the name the declaration spelled. */
+    readonly qualifiedName: string;
+    /** The operation's own name inside its connection. */
+    readonly tool: string;
+    /** The operation's advertised input schema, passed through verbatim. */
+    readonly inputSchema?: unknown;
+    /** The operation's advertised output schema, passed through verbatim. */
+    readonly outputSchema?: unknown;
+}
+/** One operation a connection advertises, as its client's tool metadata answers. */
+export interface ConnectionOperation {
+    readonly name: string;
+    readonly description: string;
+    readonly inputSchema?: unknown;
+    readonly outputSchema?: unknown;
+}
+/** One connection's advertised catalogue. `ops` is empty when the catalogue could not be read — the
+ *  projection then resolves nothing for that connection, which is the fail direction this whole
+ *  plane takes (the model rediscovers through `connection_search`, exactly as it does today). */
+export interface ConnectionCatalogue {
+    readonly connection: string;
+    readonly ops: readonly ConnectionOperation[];
+}
+/** What {@link projectDeclaredConnectorOps} decided. */
+export interface DeclaredOpProjection {
+    /** The rows to add to the fire session's projected toolset, in the declaration's own order. */
+    readonly mount: readonly ProjectedConnectorOp[];
+    /**
+     * Declared qualified names this pass did NOT mount, with the reason folded into the name alone —
+     * no connection advertises the operation, its catalogue could not be read, or two connections
+     * compose the same name. They are not a failure: `connection_search` still finds whatever really
+     * exists, so an unresolved declaration costs the fire the hop it had before this ticket.
+     */
+    readonly unresolved: readonly string[];
+}
+/**
+ * The qualified connector-op tool names a routine's LIVE permission kinds name, in the rows' own
+ * order and deduplicated.
+ *
+ * 🔴 IT READS THE LIVE KINDS, NEVER THE CREATION CARD'S STRINGS. A declaration a human never armed,
+ * one a later deploy's vocabulary stopped accepting, one this deployment's bundles raise out of
+ * reach, and one a human REVOKED all read alike on the frozen card and differently in the rows —
+ * and the rows are what lift a gate. So the projection is driven by
+ * `routines/declared-permissions.ts routinePermissionKinds`, whose reader already filters the
+ * permission card's own bookkeeping markers and the inert legacy per-connector rows.
+ * {@link declarationForPermissionKind} is what turns a kind back into its declaration, and it
+ * answers `undefined` for every kind no declaration maps onto — including `pr.open`, which names no
+ * connector tool.
+ */
+export declare function declaredConnectorToolNames(kinds: readonly string[]): string[];
+/**
+ * Resolve each declared qualified tool name against the connections' catalogues, skipping the ones
+ * a search already put in the slot.
+ *
+ * PURE, and the whole decision lives here: the caller reads the catalogues, writes the slot and
+ * audits the outcome, and none of that can change which rows are mounted.
+ *
+ * `alreadyProjected` is the slot's current contents. A name already in it is skipped rather than
+ * duplicated — eve's own slot write dedupes by `qualifiedName` too, so a duplicate would be
+ * harmless, but reporting one as newly mounted would make the audit row claim a mount that changed
+ * nothing.
+ */
+export declare function projectDeclaredConnectorOps(input: {
+    readonly declared: readonly string[];
+    readonly catalogues: readonly ConnectionCatalogue[];
+    readonly alreadyProjected?: readonly string[];
+}): DeclaredOpProjection;
+/**
+ * Which connections a declared set could possibly name — every connection whose own name, plus the
+ * `__` separator, opens one of the declared qualified names.
+ *
+ * It exists so the caller reads ONE catalogue per candidate connection instead of one per connected
+ * connection: a catalogue read is a live call to the connection, and a fire holding six declarations
+ * must not pay a round trip for a connector no declaration mentions. It is a PREFILTER and never a
+ * control — a connection it admits still has to compose the whole name in
+ * {@link projectDeclaredConnectorOps}.
+ */
+export declare function candidateConnectionsForDeclarations(declared: readonly string[], connections: readonly string[]): string[];
+/** The audit action the mount writes: one row per fire turn that mounted at least one declared
+ *  operation, or that resolved none of the ones it was asked for. Operational — it records the
+ *  host's own projection, and no member's standing, access, money or record moves with it. */
+export declare const ROUTINE_DECLARED_OPS_MOUNTED_ACTION = "routine.declared_ops_mounted";
+//# sourceMappingURL=fire-toolset.d.ts.map

package/dist/agent/routines/fire-toolset.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fire-toolset.d.ts","sourceRoot":"","sources":["../../../agent/routines/fire-toolset.ts"],"names":[],"mappings":"AAoCA;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,iEAAiE;IACjE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,wEAAwE;IACxE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,4FAA4F;IAC5F,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,sDAAsD;IACtD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,yEAAyE;IACzE,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,oFAAoF;AACpF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC;AAED;;iGAEiG;AACjG,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAC9C;AAED,wDAAwD;AACxD,MAAM,WAAW,oBAAoB;IACnC,+FAA+F;IAC/F,QAAQ,CAAC,KAAK,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAChD;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAS7E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,UAAU,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACpD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/C,GAAG,oBAAoB,CA2BvB;AAED;;;;;;;;;GASG;AACH,wBAAgB,mCAAmC,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAOzH;AAED;;8FAE8F;AAC9F,eAAO,MAAM,mCAAmC,iCAAiC,CAAC"}

package/dist/agent/routines/fire-toolset.js

@@ -0,0 +1,128 @@
+// THE FIRE'S DECLARED CONNECTOR OPERATIONS (OPE-2135) — the projection that puts the operation a
+// routine DECLARED into the fire session's opening tool list.
+//
+// WHY IT EXISTS. A connector operation is not a static tool. eve mounts `connection_search` always
+// and mounts the `<connection>__<op>` tools only after that search has FOUND them, so the operation
+// a routine exists to call is absent from the fire's opening list and present one call later. The
+// `[reach]` block (routines/watch.ts) tells the fire to search first — and every extra hop is a
+// place a model stops. On ship #243 one did: the fire searched, the result named
+// `notion__notion-create-pages` with its full description, and the next call was
+// `report_run_failed` saying the tool "was discovered, but the create-pages tool call was not made".
+// The routine had DECLARED that exact tool on its creation card.
+//
+// 🔴 IT WIDENS NOTHING, AND THAT IS THE WHOLE LICENCE. The declaration IS the permission: a human
+// read `tool:notion__notion-create-pages` on the arming card and clicked it, and the same search one
+// call later hands the model the same operation. This projection only removes the hop. Every gate an
+// attempt then meets — the connector hard gate, the unattended connector fence, the effective-tier
+// read, the egress firewall — decides exactly as it did before, because the tool eve mounts from a
+// seeded result is eve's own discovered tool, built by eve's own resolver with eve's own approval
+// wiring. `connection_search` stays mounted for everything the routine did not declare.
+//
+// 🔴 THE MATCH NEVER SPLITS ON `__`. A connection slug may itself contain a double underscore, so
+// splitting `a__b__c` guesses which side the boundary falls on. Instead each candidate connection
+// COMPOSES `${connection}__${op}` and the declared name is compared whole — the same rule
+// approvals/session-grant.ts states for the memo key ("THE WHOLE TOOL NAME IS THE KEY and nothing
+// splits it"). Where two connections compose the same qualified name the projection mounts NEITHER
+// and reports the name unresolved: an ambiguous declaration must never be resolved to a guess.
+//
+// Framework-free (no eve imports), like routine.ts and watch.ts, so the projection is testable
+// without the runtime. The eve-side seam — reading the connection catalogue and seeding the slot
+// eve's own search writes — lives in hooks/fire-toolset.ts.
+import { declarationForPermissionKind } from "../approvals/session-grant.js";
+/** The `tool:` declaration prefix, read back off a live permission kind. */
+const TOOL_DECLARATION_PREFIX = "tool:";
+/**
+ * The qualified connector-op tool names a routine's LIVE permission kinds name, in the rows' own
+ * order and deduplicated.
+ *
+ * 🔴 IT READS THE LIVE KINDS, NEVER THE CREATION CARD'S STRINGS. A declaration a human never armed,
+ * one a later deploy's vocabulary stopped accepting, one this deployment's bundles raise out of
+ * reach, and one a human REVOKED all read alike on the frozen card and differently in the rows —
+ * and the rows are what lift a gate. So the projection is driven by
+ * `routines/declared-permissions.ts routinePermissionKinds`, whose reader already filters the
+ * permission card's own bookkeeping markers and the inert legacy per-connector rows.
+ * {@link declarationForPermissionKind} is what turns a kind back into its declaration, and it
+ * answers `undefined` for every kind no declaration maps onto — including `pr.open`, which names no
+ * connector tool.
+ */
+export function declaredConnectorToolNames(kinds) {
+    const out = [];
+    for (const kind of kinds) {
+        const declaration = declarationForPermissionKind(kind);
+        if (declaration === undefined || !declaration.startsWith(TOOL_DECLARATION_PREFIX))
+            continue;
+        const tool = declaration.slice(TOOL_DECLARATION_PREFIX.length);
+        if (tool.length > 0 && !out.includes(tool))
+            out.push(tool);
+    }
+    return out;
+}
+/**
+ * Resolve each declared qualified tool name against the connections' catalogues, skipping the ones
+ * a search already put in the slot.
+ *
+ * PURE, and the whole decision lives here: the caller reads the catalogues, writes the slot and
+ * audits the outcome, and none of that can change which rows are mounted.
+ *
+ * `alreadyProjected` is the slot's current contents. A name already in it is skipped rather than
+ * duplicated — eve's own slot write dedupes by `qualifiedName` too, so a duplicate would be
+ * harmless, but reporting one as newly mounted would make the audit row claim a mount that changed
+ * nothing.
+ */
+export function projectDeclaredConnectorOps(input) {
+    const already = new Set(input.alreadyProjected ?? []);
+    const mount = [];
+    const unresolved = [];
+    for (const qualifiedName of input.declared) {
+        if (already.has(qualifiedName))
+            continue;
+        const matches = [];
+        for (const catalogue of input.catalogues) {
+            for (const op of catalogue.ops) {
+                if (`${catalogue.connection}__${op.name}` !== qualifiedName)
+                    continue;
+                matches.push({
+                    connection: catalogue.connection,
+                    description: op.description,
+                    qualifiedName,
+                    tool: op.name,
+                    ...(op.inputSchema !== undefined ? { inputSchema: op.inputSchema } : {}),
+                    ...(op.outputSchema !== undefined ? { outputSchema: op.outputSchema } : {}),
+                });
+            }
+        }
+        // Exactly one match mounts. Zero means no connection advertises it; more than one means two
+        // connections compose the same qualified name, and mounting either would pick a connection the
+        // declaration never named.
+        if (matches.length === 1)
+            mount.push(matches[0]);
+        else
+            unresolved.push(qualifiedName);
+    }
+    return { mount, unresolved };
+}
+/**
+ * Which connections a declared set could possibly name — every connection whose own name, plus the
+ * `__` separator, opens one of the declared qualified names.
+ *
+ * It exists so the caller reads ONE catalogue per candidate connection instead of one per connected
+ * connection: a catalogue read is a live call to the connection, and a fire holding six declarations
+ * must not pay a round trip for a connector no declaration mentions. It is a PREFILTER and never a
+ * control — a connection it admits still has to compose the whole name in
+ * {@link projectDeclaredConnectorOps}.
+ */
+export function candidateConnectionsForDeclarations(declared, connections) {
+    const out = [];
+    for (const connection of connections) {
+        if (connection.length === 0 || out.includes(connection))
+            continue;
+        if (declared.some((name) => name.startsWith(`${connection}__`)))
+            out.push(connection);
+    }
+    return out;
+}
+/** The audit action the mount writes: one row per fire turn that mounted at least one declared
+ *  operation, or that resolved none of the ones it was asked for. Operational — it records the
+ *  host's own projection, and no member's standing, access, money or record moves with it. */
+export const ROUTINE_DECLARED_OPS_MOUNTED_ACTION = "routine.declared_ops_mounted";
+//# sourceMappingURL=fire-toolset.js.map