@open-everywhere/core 0.1.0

package/dist/agent/schedules/routine-dispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routine-dispatch.js","sourceRoot":"","sources":["../../../agent/schedules/routine-dispatch.ts"],"names":[],"mappings":"AAAA,qGAAqG;AACrG,uGAAuG;AACvG,6FAA6F;AAC7F,wGAAwG;AACxG,qGAAqG;AACrG,0EAA0E;AAK1E,OAAO,EAAE,mBAAmB,EAAgB,MAAM,wBAAwB,CAAC;AAE3E,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAsEjE,MAAM,gBAAgB,GAAyC,IAAI,GAAG,EAAE,CAAC;AAEzE,qGAAqG;AACrG,MAAM,UAAU,uBAAuB,CAAC,QAAgB,EAAE,QAAiC;IACzF,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,kBAAkB,CAAC;QAAE,OAAO;IACrE,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,gCAAgC,CAAC,QAAgB;IAC/D,OAAO,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED,kGAAkG;AAClG,kGAAkG;AAClG,kGAAkG;AAClG,8FAA8F;AAC9F,uFAAuF;AACvF,+EAA+E;AAE/E;kFACkF;AAClF,SAAS,YAAY,CAAC,CAAoB,EAAE,GAAW;IACrD,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/D,CAAC;AAED,kFAAkF;AAClF,8FAA8F;AAC9F,8EAA8E;AAC9E,yEAAyE;AACzE,SAAS,kBAAkB,CAAC,CAAU;IACpC,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACtD,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,4FAA4F;IAC5F,6FAA6F;IAC7F,uBAAuB;IACvB,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;IAC1C,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,IAAI,GAAgB,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,OAAO;QACL,OAAO,EAAE,YAAY;QACrB,MAAM,EAAE,EAAE,SAAS,EAAE;QACrB,IAAI;QACJ,kFAAkF;QAClF,gFAAgF;QAChF,wBAAwB;QACxB,UAAU,EAAE;YACV,OAAO,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;YACzC,UAAU,EAAE,SAAS;YACrB,YAAY,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;SAC/C;QACD,gGAAgG;QAChG,8FAA8F;QAC9F,8FAA8F;QAC9F,sDAAsD;QACtD,MAAM,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE;KACzC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,MAAM,CAAC,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,QAAQ,GAAG,gCAAgC,CAAC,QAAQ,CAAC,CAAC;IAC5D,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IAC/C,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,OAAO;YACV,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC;QAC/B;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,OAAO,QAAQ,KAAK,OAAO,IAAI,gCAAgC,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC;AAC1F,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAAkB;IACvD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9G,MAAM,QAAQ,GAAG,gCAAgC,CAAC,QAAQ,CAAC,CAAC;IAC5D,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5F,OAAO,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC"}

package/dist/agent/schedules/tidy.d.ts

@@ -0,0 +1,39 @@
+import { type JudgeStats } from "../memory/dream/tidy.js";
+/** The per-silo judge budget — `memory.dreamCandidateCap` (positive int) or the default (10). */
+export declare function dreamCandidateCap(): number;
+/** The orgs to sweep — `OE_TIDY_ORGS` (comma-separated) or ["default"]. */
+export declare function tidyOrgs(): string[];
+export interface TidyTickReport {
+    readonly orgs: number;
+    readonly silos: number;
+    readonly applied: number;
+    readonly proposed: number;
+    readonly changed: number;
+    /** v2 judge totals across the sweep — all zeros when no judge is registered (v1 path). */
+    readonly judged: JudgeStats;
+    /** Approval pendings this pass expired past their TTL (audit-wedge WS-3 — each audited
+     *  `approval.expired`, cause "ttl"). */
+    readonly expiredApprovals: number;
+    /** Credential-grant asks this pass expired past their TTL, and the two notices each one owes
+     *  (OPE-1112 — each audited `grant.expired`, cause "ttl"). */
+    readonly expiredGrantAsks: number;
+    readonly grantLapseNotices: number;
+    readonly grantCardsExpired: number;
+    /** Credential grants this pass expired past their TTL. A grant owes nobody a notice. */
+    readonly expiredGrants: number;
+}
+/**
+ * One tidy pass over `orgs` × configured writable silos. Reads each silo, applies the safe ops,
+ * records the destructive proposals. Injected `now` drives staleness detection. Best-effort per
+ * silo: a read/write failure is logged and the sweep continues.
+ */
+export declare function tidyTick(opts?: {
+    readonly now?: Date;
+    readonly orgs?: readonly string[];
+}): Promise<TidyTickReport>;
+declare const _default: {
+    cron: string;
+    run(): Promise<void>;
+};
+export default _default;
+//# sourceMappingURL=tidy.d.ts.map

package/dist/agent/schedules/tidy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tidy.d.ts","sourceRoot":"","sources":["../../../agent/schedules/tidy.ts"],"names":[],"mappings":"AA8BA,OAAO,EAA6C,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAcrG,iGAAiG;AACjG,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED,2EAA2E;AAC3E,wBAAgB,QAAQ,IAAI,MAAM,EAAE,CAKnC;AAiBD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,0FAA0F;IAC1F,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B;4CACwC;IACxC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC;kEAC8D;IAC9D,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,wFAAwF;IACxF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;;;GAIG;AACH,wBAAsB,QAAQ,CAAC,IAAI,GAAE;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CAsN7H"}

package/dist/agent/schedules/tidy.js

@@ -0,0 +1,292 @@
+// The Mode-2 "tidy" SCHEDULE — the periodic, corrective maintenance pass over the memory
+// silos. It runs on Eve's own `defineSchedule` cron (a SEPARATE schedule file from the routine
+// dispatcher — it does NOT touch schedules/dispatch.ts or its concurrency cap; it just consumes
+// the scheduler). Once a day it walks each configured, writable silo, runs the pure tidy
+// pass (dream/tidy.ts), AUTO-APPLIES the safe/idempotent ops (writeTier), and records the
+// destructive ops as audited PROPOSALS for human review (dream/proposal.ts). Read-only silos are
+// skipped (never written), and an empty/absent silo is a no-op.
+//
+// v2: when the app has registered a dream judge (dream/judge.ts — the gateway transport rides
+// the silo's domain's `utility` model route), the pass is `tidySiloJudged`: the graph narrows
+// each silo to a BOUNDED candidate set (cap memory.dreamCandidateCap, default 10 per silo per
+// run) and only judge-CONFIRMED candidates become proposals. No judge registered → the v1
+// zero-LLM heuristics run unchanged. The propose-not-apply gate is identical either way.
+//
+// The per-tick work is factored into `tidyTick` (like dispatch.ts's `dispatchTick`) so it can be
+// driven with an injected clock + org list in a unit test.
+//
+// ORG ENUMERATION (judgment call): the memory providers expose no "list every org" API, so the
+// set of orgs to sweep is `OE_TIDY_ORGS` (comma-separated; default "default", the single-operator
+// local case). A multi-tenant deployment sets it explicitly. A provider-level `listOrgs()` — the
+// proper multi-tenant enumeration — is a separate change to the provider interface + both SQL
+// impls, so it's deferred with this note rather than half-built here.
+import { defineSchedule } from "eve/schedules";
+import { getConfig } from "../access/config.js";
+import { providerById } from "../memory/provider.js";
+import { siloAccess } from "../memory/resolve.js";
+import { siloTier, tierId } from "../memory/store.js";
+import { tidySilo, tidySiloJudged } from "../memory/dream/tidy.js";
+import { dreamJudge } from "../memory/dream/judge.js";
+import { recordMemoryOpProposals, DREAM_ACTOR } from "../memory/dream/proposal.js";
+import { guardProvenanceMarks } from "../memory/provenance-mark.js";
+import { writeMemoryTier } from "../memory/write-road.js";
+import { appendAudit } from "../audit/audit.js";
+import { sweepExpiredPendings } from "../approvals/flow.js";
+import { sweepCredentialGrants } from "../access/credential-grant-flow.js";
+import { getSettings } from "../settings/settings.js";
+function log(msg) {
+    console.log(`[open-everywhere:dream/tidy] ${msg}`);
+}
+/** The per-silo judge budget — `memory.dreamCandidateCap` (positive int) or the default (10). */
+export function dreamCandidateCap() {
+    return getSettings().memory.dreamCandidateCap;
+}
+/** The orgs to sweep — `OE_TIDY_ORGS` (comma-separated) or ["default"]. */
+export function tidyOrgs() {
+    const raw = process.env.OE_TIDY_ORGS;
+    if (!raw)
+        return ["default"];
+    const orgs = raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+    return orgs.length > 0 ? orgs : ["default"];
+}
+// A minimal partition carrying only `org` — a silo tier's path is `@silos/<name>`, keyed by org
+// alone (memory/layout.ts tierRelDir), so the platform/workspace/surface fields are unused. We
+// fill them with the org so nothing reads an empty string by surprise.
+function partitionForOrg(org) {
+    return {
+        org,
+        platform: org,
+        workspace: org,
+        surface: org,
+        workspaceKey: org,
+        surfaceKey: org,
+        key: org,
+    };
+}
+/**
+ * One tidy pass over `orgs` × configured writable silos. Reads each silo, applies the safe ops,
+ * records the destructive proposals. Injected `now` drives staleness detection. Best-effort per
+ * silo: a read/write failure is logged and the sweep continues.
+ */
+export async function tidyTick(opts = {}) {
+    const now = opts.now ?? new Date();
+    const orgs = opts.orgs ?? tidyOrgs();
+    let silos;
+    const noJudge = { candidates: 0, confirmed: 0, rejected: 0, failed: 0 };
+    let domains = [];
+    try {
+        silos = getConfig().loadSilos();
+        domains = getConfig().loadDomains();
+    }
+    catch (err) {
+        log(`tick skipped — config not registered: ${String(err)}`);
+        return { orgs: 0, silos: 0, applied: 0, proposed: 0, changed: 0, judged: noJudge, expiredApprovals: 0, expiredGrantAsks: 0, grantLapseNotices: 0, grantCardsExpired: 0, expiredGrants: 0 };
+    }
+    // v2 vs v1 path: judged (bounded LLM confirmation) when a transport is registered,
+    // else the zero-LLM heuristics. Resolved once per tick — registration is boot-time.
+    const judge = dreamJudge();
+    const cap = dreamCandidateCap();
+    let siloCount = 0;
+    let applied = 0;
+    let proposed = 0;
+    let changed = 0;
+    let judged = noJudge;
+    let expiredApprovals = 0;
+    let expiredGrantAsks = 0;
+    let grantLapseNotices = 0;
+    let grantCardsExpired = 0;
+    let expiredGrants = 0;
+    for (const org of orgs) {
+        // Snapshot the tick-wide counters — OPE-635's per-org heartbeat below reports this org's
+        // OWN delta, not the running total across every org swept so far.
+        const orgStart = { siloCount, applied, proposed, changed, expiredApprovals, expiredGrantAsks };
+        const p = partitionForOrg(org);
+        for (const silo of silos) {
+            if (silo.readOnly)
+                continue; // never tidy a read-only projection
+            const tier = siloTier(silo.name);
+            let files;
+            try {
+                files = await providerById(silo.provider).readTier(p, tier, silo, siloAccess(silo.name, domains));
+            }
+            catch (err) {
+                log(`skip ${org}/${silo.name} (${silo.provider}) — read failed: ${String(err)}`);
+                continue;
+            }
+            if (Object.keys(files).length === 0)
+                continue; // nothing materialized yet
+            siloCount++;
+            let result;
+            if (judge) {
+                const r = await tidySiloJudged(files, silo.name, judge, { now, maxCandidates: cap });
+                judged = {
+                    candidates: judged.candidates + r.judged.candidates,
+                    confirmed: judged.confirmed + r.judged.confirmed,
+                    rejected: judged.rejected + r.judged.rejected,
+                    failed: judged.failed + r.judged.failed,
+                };
+                result = r;
+            }
+            else {
+                result = tidySilo(files, { now });
+            }
+            // 🔴 THE PROVENANCE CONSERVATION FENCE (OPE-1222 rider). This pass rewrites memory files with
+            // NO knowledge of the external-provenance marks hooks/memory.ts wrote, so a future op that
+            // rewrote a marked bullet would silently un-say a disclosure. Today's three auto-applied ops
+            // (dedup → link-repair → salience-reorder) all conserve marks, and this fence is what keeps
+            // that a checked fact rather than a claim: a rewrite that ends with fewer DISTINCT marked
+            // bullets in a file is refused for that file, and the file's pre-tidy bytes are written back
+            // instead. See memory/provenance-mark.ts for exactly what it admits and refuses.
+            const guarded = guardProvenanceMarks(files, result.files);
+            if (guarded.reverted.length > 0) {
+                log(`provenance fence: kept pre-tidy bytes for ${org}/${silo.name} — ${guarded.reverted.join(", ")} would have lost an external-provenance mark`);
+            }
+            // A tidy whose every changed file was refused has nothing left to write. Re-derived from the
+            // guarded bytes rather than trusted from `result.changed`, so the skip cannot go stale.
+            const changedAfterGuard = Object.entries(guarded.files).some(([rel, content]) => files[rel] !== content);
+            // 🔴 A FULLY-REFUSED TIDY STILL LEAVES A ROW. Without this the refusal would exist only in the
+            // log line above: no write means no `memory.tidy` row, so the audit trail of a silo whose every
+            // change was refused reads identically to a silo that needed no tidying. That is the same
+            // absence-reads-as-safety failure the taint posture stamp exists to prevent.
+            if (guarded.reverted.length > 0 && !changedAfterGuard) {
+                await appendAudit({
+                    org,
+                    platform: "memory",
+                    workspace: silo.name,
+                    principalId: DREAM_ACTOR,
+                    action: "memory.tidy",
+                    detail: {
+                        silo: silo.name,
+                        provider: silo.provider,
+                        // NO ops landed, so `applied` is empty by construction — the proposals this pass would
+                        // have written are named under `provenanceReverted` instead.
+                        applied: [],
+                        provenanceReverted: [...guarded.reverted],
+                        version: null,
+                    },
+                });
+            }
+            if (result.changed && changedAfterGuard) {
+                try {
+                    // THE ONE ROAD (OPE-1873). A tidy rewrites a silo's bullets, so it is a durable memory
+                    // write and now leaves a `memory.write` row beside its own `memory.tidy` row: the two
+                    // answer different questions — WHICH ops the tidy applied, and THAT the silo changed —
+                    // and only the second is what a reader joining "did anything write this silo" can use.
+                    const { version: sha } = await writeMemoryTier({
+                        provider: providerById(silo.provider),
+                        partition: p,
+                        tier,
+                        files: guarded.files,
+                        message: `dream:tidy [${tierId(tier)}] ${result.applied.length} safe op(s)`,
+                        silo,
+                        access: siloAccess(silo.name, domains),
+                        road: "dream-tidy",
+                        platform: "memory",
+                        workspace: silo.name,
+                        principalId: DREAM_ACTOR,
+                        extra: { ops: result.applied.length },
+                    });
+                    changed++;
+                    await appendAudit({
+                        org,
+                        platform: "memory",
+                        workspace: silo.name,
+                        principalId: DREAM_ACTOR,
+                        action: "memory.tidy",
+                        detail: {
+                            silo: silo.name,
+                            provider: silo.provider,
+                            applied: result.applied.map((o) => ({ kind: o.kind, file: o.file, summary: o.summary })),
+                            // OPE-1222: names only, never a line. A non-empty list means the fence kept a file's
+                            // pre-tidy bytes because the rewrite would have dropped a disclosure — so `applied`
+                            // above names ops that did NOT all land, and the row says which files they missed.
+                            ...(guarded.reverted.length > 0 ? { provenanceReverted: [...guarded.reverted] } : {}),
+                            version: sha,
+                        },
+                    });
+                }
+                catch (err) {
+                    log(`skip write ${org}/${silo.name} — ${String(err)}`);
+                    continue;
+                }
+            }
+            // OPE-1222: ops on a REFUSED file never landed, so they are not counted as applied. The audit
+            // row above names the files instead, which is the only place the count could otherwise lie.
+            const refused = new Set(guarded.reverted);
+            applied += result.applied.filter((o) => !refused.has(o.file)).length;
+            proposed += await recordMemoryOpProposals(org, silo.name, result.proposals);
+        }
+        // Approval sweep (audit-wedge WS-3): expire this org's past-TTL pendings and audit each
+        // (approval.expired, cause "ttl") — an unclicked pending otherwise never gets a terminal row.
+        // Since OPE-1339 the same call runs a second pass over the pendings that carry NO clock (a
+        // routine permission card), expiring the ones whose routine generation moved on with cause
+        // "routine-superseded"/"routine-deleted". Both passes are counted here: the field and the log
+        // line below both say "approval(s) expired", which is true of either.
+        // Best-effort (never aborts the tick); rides the daily pass so it adds no extra DB wakes.
+        try {
+            expiredApprovals += await sweepExpiredPendings(org, now);
+        }
+        catch (err) {
+            log(`skip approval-sweep ${org} — ${String(err)}`);
+        }
+        // Credential-grant TTL sweep (OPE-1112): expire this org's past-TTL asks and grants. The ask
+        // half also tells BOTH SIDES — a lapse notice into the requester's pinned conversation, and the
+        // owner's DM card rewritten to `expired` — which is the whole reason the sweep had to be
+        // scheduled at all. It is NOT a control: both CAS statements on that plane read `expires_at`
+        // off the row, so an unswept row is already unspendable. Best-effort, and it rides this daily
+        // pass for the same reason the approval sweep does — no extra DB wakes.
+        try {
+            const grants = await sweepCredentialGrants(org, now.toISOString());
+            expiredGrantAsks += grants.asks;
+            grantLapseNotices += grants.requesterNotices;
+            grantCardsExpired += grants.cardsUpdated;
+            expiredGrants += grants.grants;
+        }
+        catch (err) {
+            log(`skip credential-grant-sweep ${org} — ${String(err)}`);
+        }
+        // OPE-635: the per-silo `memory.tidy` row above fires only when a silo actually CHANGED, so a
+        // no-op day (the common case) left no trace at all — indistinguishable from a cron that never
+        // fired. This heartbeat fires every tick, for every org, whatever happened, so `deploy:census`'s
+        // liveness read has a row to measure the age of even on a day nothing needed tidying.
+        const orgSilos = siloCount - orgStart.siloCount;
+        const orgApplied = applied - orgStart.applied;
+        const orgProposed = proposed - orgStart.proposed;
+        const orgChanged = changed - orgStart.changed;
+        const orgExpired = expiredApprovals - orgStart.expiredApprovals;
+        const orgExpiredGrantAsks = expiredGrantAsks - orgStart.expiredGrantAsks;
+        await appendAudit({
+            org,
+            platform: "memory",
+            workspace: "tidy",
+            principalId: DREAM_ACTOR,
+            action: "memory.tidy_tick",
+            detail: {
+                outcome: orgChanged > 0 ? "changed" : "no-op: nothing to tidy",
+                silos: orgSilos,
+                applied: orgApplied,
+                proposed: orgProposed,
+                changed: orgChanged,
+                expiredApprovals: orgExpired,
+                expiredGrantAsks: orgExpiredGrantAsks,
+            },
+        });
+    }
+    const judgeNote = judge
+        ? ` (judge: ${judged.candidates} candidate(s), ${judged.confirmed} confirmed, ${judged.rejected} rejected, ${judged.failed} failed-quiet)`
+        : " (no judge registered — zero-LLM heuristics)";
+    log(`tick: ${orgs.length} org(s), ${siloCount} silo(s) — ${applied} safe op(s) applied, ${changed} silo(s) written, ` +
+        `${proposed} proposal(s) recorded, ${expiredApprovals} approval(s) expired, ` +
+        `${expiredGrantAsks} grant ask(s) lapsed (${grantLapseNotices} notice(s), ${grantCardsExpired} card(s) updated), ` +
+        `${expiredGrants} grant(s) expired${judgeNote}`);
+    return { orgs: orgs.length, silos: siloCount, applied, proposed, changed, judged, expiredApprovals, expiredGrantAsks, grantLapseNotices, grantCardsExpired, expiredGrants };
+}
+export default defineSchedule({
+    // Daily at 04:00 UTC — a quiet maintenance window. Cadence-independent: the pass is
+    // idempotent (safe ops re-apply to a fixed point; proposals are additive audit records).
+    cron: "0 4 * * *",
+    async run() {
+        await tidyTick();
+    },
+});
+//# sourceMappingURL=tidy.js.map

package/dist/agent/schedules/tidy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tidy.js","sourceRoot":"","sources":["../../../agent/schedules/tidy.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,+FAA+F;AAC/F,gGAAgG;AAChG,yFAAyF;AACzF,0FAA0F;AAC1F,iGAAiG;AACjG,gEAAgE;AAChE,EAAE;AACF,8FAA8F;AAC9F,8FAA8F;AAC9F,8FAA8F;AAC9F,0FAA0F;AAC1F,yFAAyF;AACzF,EAAE;AACF,iGAAiG;AACjG,2DAA2D;AAC3D,EAAE;AACF,+FAA+F;AAC/F,kGAAkG;AAClG,iGAAiG;AACjG,8FAA8F;AAC9F,sEAAsE;AAEtE,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAa,MAAM,oBAAoB,CAAC;AAGjE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAoC,MAAM,yBAAyB,CAAC;AACrG,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAEtD,SAAS,GAAG,CAAC,GAAW;IACtB,OAAO,CAAC,GAAG,CAAC,gCAAgC,GAAG,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,iBAAiB;IAC/B,OAAO,WAAW,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC;AAChD,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,QAAQ;IACtB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IACrC,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7E,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAC9C,CAAC;AAED,gGAAgG;AAChG,+FAA+F;AAC/F,uEAAuE;AACvE,SAAS,eAAe,CAAC,GAAW;IAClC,OAAO;QACL,GAAG;QACH,QAAQ,EAAE,GAAG;QACb,SAAS,EAAE,GAAG;QACd,OAAO,EAAE,GAAG;QACZ,YAAY,EAAE,GAAG;QACjB,UAAU,EAAE,GAAG;QACf,GAAG,EAAE,GAAG;KACT,CAAC;AACJ,CAAC;AAsBD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAI,GAA+D,EAAE;IAClG,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,QAAQ,EAAE,CAAC;IACrC,IAAI,KAAwE,CAAC;IAC7E,MAAM,OAAO,GAAe,EAAE,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACpF,IAAI,OAAO,GAAsB,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,KAAK,GAAG,SAAS,EAAE,CAAC,SAAS,EAAE,CAAC;QAChC,OAAO,GAAG,SAAS,EAAE,CAAC,WAAW,EAAE,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,yCAAyC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5D,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;IAC7L,CAAC;IAED,mFAAmF;IACnF,oFAAoF;IACpF,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;IAEhC,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,MAAM,GAAG,OAAO,CAAC;IACrB,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,yFAAyF;QACzF,kEAAkE;QAClE,MAAM,QAAQ,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,CAAC;QAC/F,MAAM,CAAC,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,QAAQ;gBAAE,SAAS,CAAC,oCAAoC;YACjE,MAAM,IAAI,GAAS,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,KAAK,CAAC;YACV,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;YACpG,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,QAAQ,GAAG,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,QAAQ,oBAAoB,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACjF,SAAS;YACX,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS,CAAC,2BAA2B;YAC1E,SAAS,EAAE,CAAC;YAEZ,IAAI,MAAkB,CAAC;YACvB,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,CAAC,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;gBACrF,MAAM,GAAG;oBACP,UAAU,EAAE,MAAM,CAAC,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,UAAU;oBACnD,SAAS,EAAE,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,SAAS;oBAChD,QAAQ,EAAE,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ;oBAC7C,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM;iBACxC,CAAC;gBACF,MAAM,GAAG,CAAC,CAAC;YACb,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YACpC,CAAC;YAED,8FAA8F;YAC9F,2FAA2F;YAC3F,6FAA6F;YAC7F,4FAA4F;YAC5F,0FAA0F;YAC1F,6FAA6F;YAC7F,iFAAiF;YACjF,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1D,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChC,GAAG,CAAC,6CAA6C,GAAG,IAAI,IAAI,CAAC,IAAI,MAAM,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;YACpJ,CAAC;YACD,6FAA6F;YAC7F,wFAAwF;YACxF,MAAM,iBAAiB,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,CAAC;YACzG,+FAA+F;YAC/F,gGAAgG;YAChG,0FAA0F;YAC1F,6EAA6E;YAC7E,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACtD,MAAM,WAAW,CAAC;oBAChB,GAAG;oBACH,QAAQ,EAAE,QAAQ;oBAClB,SAAS,EAAE,IAAI,CAAC,IAAI;oBACpB,WAAW,EAAE,WAAW;oBACxB,MAAM,EAAE,aAAa;oBACrB,MAAM,EAAE;wBACN,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,uFAAuF;wBACvF,6DAA6D;wBAC7D,OAAO,EAAE,EAAE;wBACX,kBAAkB,EAAE,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;wBACzC,OAAO,EAAE,IAAI;qBACd;iBACF,CAAC,CAAC;YACL,CAAC;YACD,IAAI,MAAM,CAAC,OAAO,IAAI,iBAAiB,EAAE,CAAC;gBACxC,IAAI,CAAC;oBACH,uFAAuF;oBACvF,sFAAsF;oBACtF,uFAAuF;oBACvF,uFAAuF;oBACvF,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,eAAe,CAAC;wBAC7C,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC;wBACrC,SAAS,EAAE,CAAC;wBACZ,IAAI;wBACJ,KAAK,EAAE,OAAO,CAAC,KAAK;wBACpB,OAAO,EAAE,eAAe,MAAM,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM,aAAa;wBAC3E,IAAI;wBACJ,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;wBACtC,IAAI,EAAE,YAAY;wBAClB,QAAQ,EAAE,QAAQ;wBAClB,SAAS,EAAE,IAAI,CAAC,IAAI;wBACpB,WAAW,EAAE,WAAW;wBACxB,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE;qBACtC,CAAC,CAAC;oBACH,OAAO,EAAE,CAAC;oBACV,MAAM,WAAW,CAAC;wBAChB,GAAG;wBACH,QAAQ,EAAE,QAAQ;wBAClB,SAAS,EAAE,IAAI,CAAC,IAAI;wBACpB,WAAW,EAAE,WAAW;wBACxB,MAAM,EAAE,aAAa;wBACrB,MAAM,EAAE;4BACN,IAAI,EAAE,IAAI,CAAC,IAAI;4BACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;4BACvB,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;4BACxF,qFAAqF;4BACrF,oFAAoF;4BACpF,mFAAmF;4BACnF,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;4BACrF,OAAO,EAAE,GAAG;yBACb;qBACF,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,GAAG,CAAC,cAAc,GAAG,IAAI,IAAI,CAAC,IAAI,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACvD,SAAS;gBACX,CAAC;YACH,CAAC;YACD,8FAA8F;YAC9F,4FAA4F;YAC5F,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC1C,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;YACrE,QAAQ,IAAI,MAAM,uBAAuB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAC9E,CAAC;QACD,wFAAwF;QACxF,8FAA8F;QAC9F,2FAA2F;QAC3F,2FAA2F;QAC3F,8FAA8F;QAC9F,sEAAsE;QACtE,0FAA0F;QAC1F,IAAI,CAAC;YACH,gBAAgB,IAAI,MAAM,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,uBAAuB,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrD,CAAC;QAED,6FAA6F;QAC7F,gGAAgG;QAChG,yFAAyF;QACzF,6FAA6F;QAC7F,8FAA8F;QAC9F,wEAAwE;QACxE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;YACnE,gBAAgB,IAAI,MAAM,CAAC,IAAI,CAAC;YAChC,iBAAiB,IAAI,MAAM,CAAC,gBAAgB,CAAC;YAC7C,iBAAiB,IAAI,MAAM,CAAC,YAAY,CAAC;YACzC,aAAa,IAAI,MAAM,CAAC,MAAM,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,+BAA+B,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,8FAA8F;QAC9F,8FAA8F;QAC9F,iGAAiG;QACjG,sFAAsF;QACtF,MAAM,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;QAChD,MAAM,UAAU,GAAG,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;QAC9C,MAAM,WAAW,GAAG,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;QACjD,MAAM,UAAU,GAAG,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;QAC9C,MAAM,UAAU,GAAG,gBAAgB,GAAG,QAAQ,CAAC,gBAAgB,CAAC;QAChE,MAAM,mBAAmB,GAAG,gBAAgB,GAAG,QAAQ,CAAC,gBAAgB,CAAC;QACzE,MAAM,WAAW,CAAC;YAChB,GAAG;YACH,QAAQ,EAAE,QAAQ;YAClB,SAAS,EAAE,MAAM;YACjB,WAAW,EAAE,WAAW;YACxB,MAAM,EAAE,kBAAkB;YAC1B,MAAM,EAAE;gBACN,OAAO,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,wBAAwB;gBAC9D,KAAK,EAAE,QAAQ;gBACf,OAAO,EAAE,UAAU;gBACnB,QAAQ,EAAE,WAAW;gBACrB,OAAO,EAAE,UAAU;gBACnB,gBAAgB,EAAE,UAAU;gBAC5B,gBAAgB,EAAE,mBAAmB;aACtC;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAAG,KAAK;QACrB,CAAC,CAAC,YAAY,MAAM,CAAC,UAAU,kBAAkB,MAAM,CAAC,SAAS,eAAe,MAAM,CAAC,QAAQ,cAAc,MAAM,CAAC,MAAM,gBAAgB;QAC1I,CAAC,CAAC,8CAA8C,CAAC;IACnD,GAAG,CACD,SAAS,IAAI,CAAC,MAAM,YAAY,SAAS,cAAc,OAAO,wBAAwB,OAAO,oBAAoB;QAC/G,GAAG,QAAQ,0BAA0B,gBAAgB,wBAAwB;QAC7E,GAAG,gBAAgB,yBAAyB,iBAAiB,eAAe,iBAAiB,qBAAqB;QAClH,GAAG,aAAa,oBAAoB,SAAS,EAAE,CAClD,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,aAAa,EAAE,CAAC;AAC9K,CAAC;AAED,eAAe,cAAc,CAAC;IAC5B,oFAAoF;IACpF,yFAAyF;IACzF,IAAI,EAAE,WAAW;IACjB,KAAK,CAAC,GAAG;QACP,MAAM,QAAQ,EAAE,CAAC;IACnB,CAAC;CACF,CAAC,CAAC"}

package/dist/agent/scm/app.d.ts

@@ -0,0 +1,55 @@
+import { type FetchFn } from "./mint.js";
+import type { GitHubAppConfig, InstallationToken, MintPermissions, RepoRef } from "./types.js";
+export interface MintOutcome {
+    /** owner → the token covering that owner's requested repos. */
+    readonly tokens: Map<string, InstallationToken>;
+    /** repos whose owner has no linked installation — skipped, surfaced to the caller. */
+    readonly ungranted: RepoRef[];
+}
+export declare class GitHubApp {
+    private readonly config;
+    private readonly deps;
+    private readonly key;
+    constructor(config: GitHubAppConfig, deps?: {
+        fetchFn?: FetchFn;
+        now?: () => number;
+        /** Webhook-DISCOVERED installations (scm/installations.ts), consulted only for owners the
+         *  configured map has no entry for — env stays authoritative. Absent in tests//unconfigured
+         *  deploys, which is exactly today's behaviour. */
+        discovered?: (owner: string) => string | undefined;
+        /** Best-effort pull of the durable discovered map into scope before a mint (serverless: the
+         *  instance that handled the install webhook usually isn't this one). Never throws. */
+        hydrate?: () => Promise<void>;
+    });
+    private nowSeconds;
+    private issuer;
+    /** The installation id linked for an owner, if any. Configured (env) map FIRST — it is
+     *  authoritative — then the webhook-discovered map, which only fills gaps. */
+    installationFor(owner: string): string | undefined;
+    /**
+     * Mint scoped tokens for a set of "owner/repo" refs: group by owner, one token each,
+     * scoped to that owner's repo names. Owners with no installation are returned as
+     * `ungranted` (the caller decides how to surface that) — never silently widened.
+     * `permissions` narrows what the tokens can do (default = the write set; checkout
+     * passes READ_PERMISSIONS so the persisted credential can't push).
+     */
+    tokensForRepos(repos: readonly RepoRef[], permissions?: MintPermissions): Promise<MintOutcome>;
+    /**
+     * The permission families an owner's installation actually grants (OPE-1024) — `GET
+     * /app/installations/{id}` with an app JWT, whose installation object carries `permissions`.
+     * Feeds the ASK-TIME check only (scm/capability-fit.ts); nothing gates on it.
+     *
+     * 🔴 FAIL-SOFT, AND NEVER A CEILING. `undefined` means "could not tell" — no installation linked,
+     * a non-2xx, an unparsable body, a network error. It never means "grants nothing", and no mint
+     * body is ever derived from what this returns: the mint stays (closed in-code job set) ∪ (named
+     * capability sets), and GitHub enforces the installation bound itself. "Mint whatever the
+     * installation has" is forbidden — the mint body is THE security boundary for a delegated worker.
+     */
+    installationPermissions(owner: string): Promise<Readonly<Record<string, string>> | undefined>;
+    /** The bot commit identity (requires a configured bot user id for correct attribution). */
+    committer(): {
+        name: string;
+        email: string;
+    };
+}
+//# sourceMappingURL=app.d.ts.map

package/dist/agent/scm/app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../../agent/scm/app.ts"],"names":[],"mappings":"AAMA,OAAO,EAIL,KAAK,OAAO,EACb,MAAM,WAAW,CAAC;AAEnB,OAAO,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE/F,MAAM,WAAW,WAAW;IAC1B,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAChD,sFAAsF;IACtF,QAAQ,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC;CAC/B;AAED,qBAAa,SAAS;IAIlB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAJvB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAY;IAEhC,YACmB,MAAM,EAAE,eAAe,EACvB,IAAI,GAAE;QACrB,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;QACnB;;2DAEmD;QACnD,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;QACnD;+FACuF;QACvF,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;KAC1B,EAGP;IAED,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,MAAM;IAId;kFAC8E;IAC9E,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEjD;IAED;;;;;;OAMG;IACG,cAAc,CAAC,KAAK,EAAE,SAAS,OAAO,EAAE,EAAE,WAAW,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC,CAqCnG;IAED;;;;;;;;;;OAUG;IACG,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC,CA8BlG;IAED,2FAA2F;IAC3F,SAAS,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAE3C;CACF"}

package/dist/agent/scm/app.js

@@ -0,0 +1,120 @@
+// The GitHubApp orchestrator — ties config + JWT signing + minting into the operations
+// the rest of OpenEverywhere calls. One scoped token per owner-installation, covering exactly
+// that owner's in-scope repos (a single token can span up to 500 repos, so we mint per
+// OWNER, not per repo). fetch + clock are injectable for deterministic tests.
+import { parsePrivateKey, signAppJwt, mintInstallationToken, } from "./mint.js";
+import { botCommitter } from "./git.js";
+export class GitHubApp {
+    config;
+    deps;
+    key;
+    constructor(config, deps = {}) {
+        this.config = config;
+        this.deps = deps;
+        this.key = parsePrivateKey(config.privateKeyPem);
+    }
+    nowSeconds() {
+        return Math.floor((this.deps.now?.() ?? Date.now()) / 1000);
+    }
+    issuer() {
+        return this.config.clientId ?? this.config.appId;
+    }
+    /** The installation id linked for an owner, if any. Configured (env) map FIRST — it is
+     *  authoritative — then the webhook-discovered map, which only fills gaps. */
+    installationFor(owner) {
+        return this.config.installations[owner] ?? this.deps.discovered?.(owner);
+    }
+    /**
+     * Mint scoped tokens for a set of "owner/repo" refs: group by owner, one token each,
+     * scoped to that owner's repo names. Owners with no installation are returned as
+     * `ungranted` (the caller decides how to surface that) — never silently widened.
+     * `permissions` narrows what the tokens can do (default = the write set; checkout
+     * passes READ_PERMISSIONS so the persisted credential can't push).
+     */
+    async tokensForRepos(repos, permissions) {
+        // Pull any webhook-discovered installations into scope BEFORE the ungranted verdict, so an org
+        // that self-installed doesn't get reported as ungranted just because this instance never saw
+        // the webhook. Best-effort by contract (the hydrator swallows store errors) — an unreachable
+        // store degrades to the configured map, never fails the mint.
+        await this.deps.hydrate?.();
+        const byOwner = new Map();
+        const ungranted = [];
+        for (const ref of repos) {
+            const slash = ref.indexOf("/");
+            if (slash <= 0 || slash === ref.length - 1)
+                continue; // malformed
+            const owner = ref.slice(0, slash);
+            const name = ref.slice(slash + 1);
+            if (!this.installationFor(owner)) {
+                ungranted.push(ref);
+                continue;
+            }
+            const list = byOwner.get(owner);
+            if (list)
+                list.push(name);
+            else
+                byOwner.set(owner, [name]);
+        }
+        const tokens = new Map();
+        for (const [owner, names] of byOwner) {
+            const jwt = await signAppJwt(this.key, this.issuer(), this.nowSeconds());
+            tokens.set(owner, await mintInstallationToken({
+                jwt,
+                installationId: this.installationFor(owner),
+                repoNames: names,
+                permissions,
+                fetchFn: this.deps.fetchFn,
+            }));
+        }
+        return { tokens, ungranted };
+    }
+    /**
+     * The permission families an owner's installation actually grants (OPE-1024) — `GET
+     * /app/installations/{id}` with an app JWT, whose installation object carries `permissions`.
+     * Feeds the ASK-TIME check only (scm/capability-fit.ts); nothing gates on it.
+     *
+     * 🔴 FAIL-SOFT, AND NEVER A CEILING. `undefined` means "could not tell" — no installation linked,
+     * a non-2xx, an unparsable body, a network error. It never means "grants nothing", and no mint
+     * body is ever derived from what this returns: the mint stays (closed in-code job set) ∪ (named
+     * capability sets), and GitHub enforces the installation bound itself. "Mint whatever the
+     * installation has" is forbidden — the mint body is THE security boundary for a delegated worker.
+     */
+    async installationPermissions(owner) {
+        await this.deps.hydrate?.();
+        const installationId = this.installationFor(owner);
+        if (!installationId)
+            return undefined;
+        const fetchFn = (this.deps.fetchFn ?? globalThis.fetch);
+        try {
+            const jwt = await signAppJwt(this.key, this.issuer(), this.nowSeconds());
+            const res = await fetchFn(`https://api.github.com/app/installations/${installationId}`, {
+                method: "GET",
+                headers: {
+                    authorization: `Bearer ${jwt}`,
+                    accept: "application/vnd.github+json",
+                    "x-github-api-version": "2022-11-28",
+                },
+            });
+            if (!res.ok)
+                return undefined;
+            const body = (await res.json());
+            const perms = body?.permissions;
+            if (perms === null || typeof perms !== "object" || Array.isArray(perms))
+                return undefined;
+            const out = {};
+            for (const [family, grade] of Object.entries(perms)) {
+                if (typeof grade === "string")
+                    out[family] = grade;
+            }
+            return out;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    /** The bot commit identity (requires a configured bot user id for correct attribution). */
+    committer() {
+        return botCommitter(this.config.appSlug, this.config.botUserId ?? this.config.appId);
+    }
+}
+//# sourceMappingURL=app.js.map

package/dist/agent/scm/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../../../agent/scm/app.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,8FAA8F;AAC9F,uFAAuF;AACvF,8EAA8E;AAG9E,OAAO,EACL,eAAe,EACf,UAAU,EACV,qBAAqB,GAEtB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAUxC,MAAM,OAAO,SAAS;IAID,MAAM;IACN,IAAI;IAJN,GAAG,CAAY;IAEhC,YACmB,MAAuB,EACvB,IAAI,GAUjB,EAAE;sBAXW,MAAM;oBACN,IAAI;QAYrB,IAAI,CAAC,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IACnD,CAAC;IAEO,UAAU;QAChB,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAC9D,CAAC;IAEO,MAAM;QACZ,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;IACnD,CAAC;IAED;kFAC8E;IAC9E,eAAe,CAAC,KAAa;QAC3B,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC;IAC3E,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,cAAc,CAAC,KAAyB,EAAE,WAA6B;QAC3E,+FAA+F;QAC/F,6FAA6F;QAC7F,6FAA6F;QAC7F,8DAA8D;QAC9D,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC5C,MAAM,SAAS,GAAc,EAAE,CAAC;QAChC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;YACxB,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC;gBAAE,SAAS,CAAC,YAAY;YAClE,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAClC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAClC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACpB,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,IAAI;gBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;gBACrB,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAClC,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAA6B,CAAC;QACpD,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,GAAG,CACR,KAAK,EACL,MAAM,qBAAqB,CAAC;gBAC1B,GAAG;gBACH,cAAc,EAAE,IAAI,CAAC,eAAe,CAAC,KAAK,CAAE;gBAC5C,SAAS,EAAE,KAAK;gBAChB,WAAW;gBACX,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO;aAC3B,CAAC,CACH,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC/B,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,uBAAuB,CAAC,KAAa;QACzC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5B,MAAM,cAAc,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,cAAc;YAAE,OAAO,SAAS,CAAC;QACtC,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAK,UAAU,CAAC,KAA4B,CAGP,CAAC;QACxE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;YACzE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,4CAA4C,cAAc,EAAE,EAAE;gBACtF,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,GAAG,EAAE;oBAC9B,MAAM,EAAE,6BAA6B;oBACrC,sBAAsB,EAAE,YAAY;iBACrC;aACF,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,SAAS,CAAC;YAC9B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA8B,CAAC;YAC7D,MAAM,KAAK,GAAG,IAAI,EAAE,WAAW,CAAC;YAChC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC1F,MAAM,GAAG,GAA2B,EAAE,CAAC;YACvC,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;gBAC/E,IAAI,OAAO,KAAK,KAAK,QAAQ;oBAAE,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;YACrD,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,2FAA2F;IAC3F,SAAS;QACP,OAAO,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvF,CAAC;CACF"}

package/dist/agent/scm/broker-audit.d.ts

@@ -0,0 +1,35 @@
+import type { SandboxNetworkPolicy } from "eve/sandbox";
+import type { BindableContext } from "../identity/binding.js";
+import type { EffectiveAccess, ReachableHost } from "../access/resolver.js";
+/**
+ * The attribution list to hand `openWriteHosts` for a BROKERED policy: `reachableHosts` with the
+ * git hosts removed.
+ *
+ * 🔴 WHY THE FILTER IS REQUIRED, NOT TIDYING. `openWriteHosts` attributes a stamped host by NAME,
+ * looking the host string up in the list it is given. `mergeGitReadBroker` REPLACES both git hosts'
+ * rules wholesale with the installation-token rule, so any `reachableHosts` entry for those hosts
+ * describes a rule that is no longer in the policy. Left in, a bundle that declares a `Connection`
+ * over `github.com` would make the row read `credential: "<that-connection>", credentialed: true` while the
+ * credential the firewall actually stamps is the broker's token — and if that connection had been
+ * revoked by break-glass, the row would print the REVOKED id as the stamp. That is the exact defect
+ * OPE-1448 exists to remove, reproduced on this path.
+ *
+ * Dropping them is what makes the git hosts report `{credentialed: true, credential: null}` — a credential
+ * rides, and no bundle connection names it — which is the truth about a brokered rule.
+ */
+export declare function brokerAttributionHosts(reachableHosts: readonly ReachableHost[]): readonly ReachableHost[];
+/** Which SCM call re-applied the policy — the `reason` field of the row, matching the hook's use of
+ *  that field to say WHY this generation was applied. */
+export type BrokerApplyReason = "checkout_repo" | "open_pull_request.push" | "open_pull_request.restore";
+/**
+ * Append the `egress.policy` row for one brokered firewall (re)apply.
+ *
+ * Call it AFTER the apply returns, never before: both apply paths (`pushEgressPolicy` and
+ * `sandbox.setNetworkPolicy`) throw on failure, so reaching this line is what makes `enforced: true`
+ * an honest claim rather than an intention.
+ *
+ * Best-effort by contract — `auditToolAction` swallows its own failures — for the reason the hook's
+ * audit is: a row that could not be written must never undo the firewall that was just applied.
+ */
+export declare function auditBrokeredEgressPolicy(ctx: BindableContext, access: EffectiveAccess, policy: SandboxNetworkPolicy, reason: BrokerApplyReason): Promise<void>;
+//# sourceMappingURL=broker-audit.d.ts.map

package/dist/agent/scm/broker-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker-audit.d.ts","sourceRoot":"","sources":["../../../agent/scm/broker-audit.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAO5E;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CAAC,cAAc,EAAE,SAAS,aAAa,EAAE,GAAG,SAAS,aAAa,EAAE,CAEzG;AAED;yDACyD;AACzD,MAAM,MAAM,iBAAiB,GAAG,eAAe,GAAG,wBAAwB,GAAG,2BAA2B,CAAC;AAEzG;;;;;;;;;GASG;AACH,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,eAAe,EACvB,MAAM,EAAE,oBAAoB,EAC5B,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,IAAI,CAAC,CA8Bf"}