@open-everywhere/core 0.1.0

package/dist/agent/tools/grant_tools.js

@@ -0,0 +1,417 @@
+// The per-grant mount: a resolver that projects a chat's live credential grants into `grant__<owner>_<connector>__<tool>_<target>` tools whose `execute` IS the broker. It mounts nothing under its own name — every tool it returns is named by a GRANT ROW, at resolve time.
+// 🔴 IT MOUNTS ON THE CHAT'S WORKERS, NEVER ON THE CHAT'S SEAT (OPE-2023). The seat delegates; the worker holds the lent tool, exactly as it holds the org connector's tools. `sessionScopeKeyInReach` (access/credential-grant-reach.ts) is how a worker proves which conversation it was spawned from.
+// 🔴 Every variant goes through registerDynamicVariant, never a bare inline execute: eve keys a durable dynamic-tool callback on (toolName, phase) alone, so two sessions holding different grants under one mounted name would share one slot and a replayed turn would run the other session's grant, with a credential behind it.
+import { defineDynamic, defineTool } from "eve/tools";
+import { registerDynamicVariant } from "../access/window-gated.js";
+import { GRANT_REFUND_CAP_PER_TURN, runGrantedCall } from "../access/credential-grant-broker.js";
+import { installGrantUseNotices, withGrantRoomContext } from "../access/credential-grant-notice.js";
+import { installGrantBorrowTransports } from "../connections/grant-mcp-transport.js";
+import { hostAuthoredModelOutput, ingestUntrustedModelOutput } from "../access/untrusted.js";
+import { credentialGrantDisclosureLine, grantResourceTargetLabel, grantToolSlug, isGrantToolName, } from "../operational/credential-grant-rows.js";
+import { connectorDisplayName, grantActionIsReviewed, grantActionPhrase, grantOwnerPhrase, grantPinnedTargetSentence, grantSpanPhrase, grantTargetIsPinned, } from "../access/credential-grant-copy.js";
+import { noteBorrowedRecordRead } from "../channels/read-reach.js";
+import { credentialGrantsInReach, domainScopeKeyInReach, sessionScopeKeyInReach } from "../access/credential-grant-reach.js";
+import { conversationGrainOf, grantDomainScopeVerdict } from "../access/credential-grant-scope.js";
+import { grantScopeKeyIsConversationStable } from "../access/credential-grant-key-shape.js";
+import { auditGrant } from "../access/credential-grant-flow.js";
+import { getOperationalStore } from "../operational/provider.js";
+import { requesterThisTurn } from "../access/requester-identity.js";
+import { currentTurnId, isSubagentChildContext } from "../identity/binding.js";
+import { resolvePartition } from "../memory/partition.js";
+import { tryPrincipalKey } from "../identity/principal-key.js";
+// A deployment that mounts granted tools is exactly one that owes the room the `acting as <owner>` line, so the arm is registered here rather than left to each surface bundle. A bundle may NOT replace it: the port is first-write-wins and a second registration throws (OPE-1443).
+installGrantUseNotices();
+// The one generic MCP borrow transport is registered at the same seam and for the same reason, covering every connector `CREDENTIAL_GRANT_ROLES` admits. No provider bundle registers a borrow transport.
+installGrantBorrowTransports();
+/**
+ * A granted call returns VENDOR BYTES fetched under the OWNER'S credential into a seat that also holds consequential tools, so they go through the same untrusted funnel every read tool uses and ALWAYS taint the turn: no reviewed config speaks for a grant verb, and silence must never read as an assurance. The host-authored disclosure rides outside the fence, because inside it the model would read it as data to ignore.
+ * A refusal carries no vendor bytes and is fenced without the taint; any shape this function does not recognise falls to the tainting arm, because over-taint is noise and under-taint is a breach. Module-level factory, never authored inline — eve's build transform stamps a durable callback only for an inline body.
+ */
+function grantModelProjection(grant) {
+    const source = `granted ${grant.verb} as ${grant.ownerSlug} — ${grant.connector} ${grant.resource}`;
+    // The audit row's label must be taint-CLEAN: a connector and a verb NAME, never the resource,
+    // which is request content.
+    const label = `grant:${grant.connector}:${grant.verb}`;
+    return async (output) => {
+        const row = typeof output === "object" && output !== null ? output : undefined;
+        if (row?.ok === false && typeof row.message === "string")
+            return hostAuthoredModelOutput(row.message, { source });
+        const body = row?.ok === true ? row.result : output;
+        const fenced = await ingestUntrustedModelOutput(typeof body === "string" ? body : JSON.stringify(body ?? null), {
+            ingestion: { kind: "connector", label },
+            source,
+        });
+        // The broker composes the line from the FRESH row it re-read this call, so prefer it. The
+        // mount-time row is the fallback, and it is only reachable on an output shape the broker does
+        // not produce.
+        const disclosure = typeof row?.disclosure === "string" ? row.disclosure : credentialGrantDisclosureLine(grant, Date.now());
+        return { type: "text", value: `${fenced.value}\n\n${disclosure}` };
+    };
+}
+/**
+ * The `grant.used` row names TWO principals, the owner and the requester, and both must be joinable under the same grammar — so this composes `requesterThisTurn`'s bare author-id through the same composer the owner half's mint uses, never a second spelling.
+ * `undefined` on a well-formed requester verdict is a REFUSAL, not a fallback: the broker already refuses `unverified_requester` on it, and a bare id would be the exact mismatch this closes.
+ */
+export function requesterKeyForGrantCall(platform, workspace, verdict) {
+    return verdict.kind === "requester" ? tryPrincipalKey(platform, workspace, verdict.principalId) : undefined;
+}
+/**
+ * The schema is the ROW'S SNAPSHOT, captured at approve time and never a live read: re-reading the vendor's catalogue per mount would let the vendor widen a grant the owner had already answered, so a row with no snapshot skips the mount rather than offer a guessed one.
+ * The granted argument is PRESENT and pinned by `const`, not subtracted — the model supplies it and access/mcp-call-fence.ts validates the outgoing bytes against the row, so the fence's comparison is a real check rather than the row against a copy of itself.
+ */
+function borrowOffer(grant, mcpTool, nowMs) {
+    if (grant.inputSchema === undefined)
+        return undefined;
+    // 🔴 HOST COPY, NOT COLUMNS (OPE-1678, answered). Every host-controlled field this description spells goes through `access/credential-grant-copy.ts`, exactly as the person-facing messages do. It used to carry the raw `resource` column, the raw `ownerSlug` — a Discord snowflake, on the platform where the fallback is the native id — and the raw `expiresAt` ISO instant. It reaches the MODEL outside the untrusted fence and sits in the model's own tool list, so a model that quotes it puts those shapes in a room. The answer recorded on `credentialGrantRefusalMessage` applies here for the same reason: the rule is about the HOST's shapes, not about who reads them. The model's actionable identifier is the mounted NAME this description hangs on, which is unchanged.
+    const owner = grantOwnerPhrase(grant.ownerSlug);
+    const vendor = connectorDisplayName(grant.connector);
+    const frozenKeys = Object.keys(grant.frozenArgs ?? {}).sort();
+    // Each fixed argument carries its one allowed value in the schema as a JSON Schema `const`. The description names the KEYS and states the rule, because a `const` alone does not say what happens when the model sends something else.
+    const frozen = frozenKeys.length === 0
+        ? `This grant fixes no arguments — ${owner} lent the tool itself, so you choose every argument.`
+        : `${String(frozenKeys.length)} argument(s) are FIXED by the grant — ${frozenKeys.join(", ")}. Each one's schema shows the single ` +
+            "value it may carry: SEND EXACTLY THAT. A call that sends any other value for a fixed argument, or omits one, is " +
+            `refused before the call reaches ${vendor}` +
+            // The broker burns a once-mode grant BEFORE the call is sent — burning afterwards would let a crashed call be re-spent — and refunds that burn on a refusal that provably sent nothing.
+            // The refund is CAPPED, so the count must appear in the copy: past the cap the grant stays spent, and a model told "a refusal does not spend it" would have planned against a promise the broker no longer keeps.
+            `${grant.mode === "once"
+                ? `, and this is a ONE-SHOT grant: a refusal that never reached ${vendor} gives the grant back, but only for the first ${String(GRANT_REFUND_CAP_PER_TURN)} refusals of this grant in one turn — after that it stays spent and this tool is finished. Each attempt also opens a session under ${owner}'s account, so send the exact value rather than guessing`
+                : ""}.`;
+    // WHICH thing was touched still has to survive, and dropping it would be the worse defect — the same finding the disclosure line's own rewrite hit. The target label is the requester's own words, so it renders as quoted data.
+    const target = grantResourceTargetLabel(grant);
+    const on = target === undefined || target.length === 0 ? "" : ` — "${target}"`;
+    // 🔴 THE PIN IS STATED IN WORDS, NOT LEFT TO THE SCHEMA (OPE-2018). The `const` above says which value the fence admits; it never says that this tool answers about that ONE target alone, and it names no other road. A seat read the pair as a general Notion reader, called it for a page it could not reach, and presented the PINNED page's body as the page it was asked about (leg 023, boards #227 and #228). The sentence is host copy like every other part of this description — see `access/credential-grant-copy.ts`.
+    // 🔴 IT IS GATED ON THE TARGET BEING PINNED, NEVER ON THE KEY COUNT (cold review). A grant that froze some OTHER argument and left the target open still lets the model choose what to read, so a sentence spelled off `frozenKeys.length` would tell the model to present whatever it fetched as the target the grant named. `grantTargetIsPinned` answers only for a REVIEWED (connector, tool) pair whose every target key is frozen; everything else gets no pin sentence, because the host has no true one to write.
+    const pinSentence = grantPinnedTargetSentence(grant.connector, mcpTool, target, frozenKeys);
+    const pin = pinSentence === undefined ? "" : `${pinSentence} `;
+    // The unreviewed-tool marker the owner's card carries, for the same reason it carries it: without it the widest granted call reads exactly like the narrowest.
+    const vague = grantActionIsReviewed(grant.connector, mcpTool) ? "" : ` (this deployment has no reviewed description for the exact ${vendor} tool, so the reach may be wider than that phrase suggests)`;
+    return {
+        description: `Uses ${owner}'s own ${vendor} account to ${grantActionPhrase(grant.connector, mcpTool)}${on}${vague}. ${pin}${frozen} ` +
+            // 🔴 THE SPAN IS READ FROM THE ROW'S OWN KEY, NOT FROM ITS EXPIRY COLUMN ALONE (OPE-2160). A
+            // `standing` row bound to a session id dies at the next seat rotation while the column still
+            // says 30 days, and this description is what the model plans against. `grantSpanPhrase` is the
+            // one spelling of that rule — see `access/credential-grant-copy.ts`.
+            `The grant runs ${grantSpanPhrase({ conversationStable: grantScopeKeyIsConversationStable(grant.scopeKey), expiresAt: grant.expiresAt, mode: grant.mode, nowMs })}. ` +
+            `An error from ${vendor} is the vendor's own answer, not a refusal by this grant.`,
+        inputSchema: grant.inputSchema,
+    };
+}
+/**
+ * The tool entry ONE grant mounts. The description is host-authored and names the owner, what is borrowed and the expiry, so the model can never present a granted call as its own reach.
+ * The input schema is the vendor's own with the granted arguments pinned, so the wider call is EXPRESSIBLE and REFUSED by access/mcp-call-fence.ts. Never write a sentence here implying the schema is the control.
+ * `nowMs` is the mounting caller's clock, which the expiry PHRASE needs (OPE-1678) — a duration is measured from an instant. It DEFAULTS rather than being required, unlike the copy module's own renderers, so a caller that only wants the schema and the execute need not hold a clock; a test that wants a fixed answer passes one. The LIVE mount path always passes one, and it re-renders the phrase into `cachedGrantToolEntry`'s fingerprint, so the entry is rebuilt when the SENTENCE changes rather than on every turn — see that cache for why a relative phrase needs that and the old ISO instant did not.
+ */
+export function grantToolEntry(grant, nowMs = Date.now()) {
+    // 🔴 A ROW THAT NAMES NO VENDOR TOOL MOUNTS NOTHING (OPE-1334). Only a row an older build wrote for
+    // the deleted verb-registry path can carry that shape, and this build has no honest description or
+    // schema to offer for it. It stays a valid row that refuses `no_lent_tool` at the broker.
+    const mcpTool = grant.mcpTool;
+    if (mcpTool === undefined)
+        return undefined;
+    const offer = borrowOffer(grant, mcpTool, nowMs);
+    if (offer === undefined)
+        return undefined;
+    return defineTool({
+        description: offer.description,
+        inputSchema: offer.inputSchema,
+        async execute(input, ctx) {
+            const c = ctx;
+            // ONE READ, TWO CONSUMERS: the requester verdict is turn-keyed, and so is the broker's per-turn
+            // refund cap (access/credential-grant-broker.ts, OPE-1240). Reading the turn once is what keeps
+            // the two from ever disagreeing about which turn this call belongs to.
+            const turnId = currentTurnId(c);
+            const requester = requesterThisTurn(turnId);
+            // OPE-1950: the room's domain-shaped seat key, so the broker's execute backstop admits a
+            // STANDING grant bound to it as well as one bound to the root seat's session. Absent in a room
+            // with no windowed domain, which leaves the backstop on the exact-session rule it had before.
+            // OPE-2023: the WORKER's reading of it — this body only ever runs inside a delegated worker now.
+            const domainScopeKey = domainScopeKeyInReach(c);
+            let org = "unknown";
+            let platform = "unknown";
+            let workspace = "unknown";
+            let surface;
+            try {
+                const p = resolvePartition(c);
+                org = p.org;
+                platform = p.platform;
+                workspace = p.workspace;
+                surface = p.surface;
+            }
+            catch {
+                /* an unresolvable partition still reaches the broker, which refuses on the row it cannot
+                   find rather than guessing a permissive answer */
+            }
+            // The room-notice arm fires after the vendor call holding only `(line, grant)`, so this is where the room it ran in and the org it belongs to are put within reach. Wrapping anything wider would make "the room this granted call ran in" untrue; anything narrower would leave the arm with no room.
+            // It carries the same partition stamps the broker call gets, so the owner notice's `grant.notified` row and the broker's `grant.used` row land in one partition.
+            const outcome = await withGrantRoomContext({ ctx: c, org, platform, workspace, ...(surface === undefined ? {} : { surface }) }, () => runGrantedCall(grant.id, (input ?? {}), {
+                nowMs: Date.now(),
+                org,
+                platform,
+                requesterPrincipalId: requesterKeyForGrantCall(platform, workspace, requester),
+                // 🔴 THE ROOT SEAT'S SESSION, NEVER THIS WORKER'S (OPE-2023). The broker's backstop compares
+                // this against the grant's own `scopeKey`, which the ask bound to the CONVERSATION; a worker
+                // that sent its own one-shot id would refuse `out_of_scope` on every live grant, and a worker
+                // of another conversation answers `undefined` here and is refused for the right reason.
+                scopeKey: sessionScopeKeyInReach(c) ?? "",
+                ...(domainScopeKey === undefined ? {} : { domainScopeKey }),
+                ...(surface === undefined ? {} : { surface }),
+                ...(turnId === undefined ? {} : { turnId }),
+                workspace,
+            }));
+            // 🔴 PROVENANCE FOLLOWS THE FETCH (OPE-2018). A borrowed read used to reach no reply footer at
+            // all — `hooks/connector-audit.ts` returns on the reserved `grant__` namespace before it writes
+            // anything — so a reply built on a lent tool's bytes named no source, and a seat that
+            // misattributed those bytes to another page was contradicted by nothing a reader could see.
+            // The label is the grant's own PINNED target, never the fetched page's title, so no vendor byte
+            // rides into the footer — `channels/read-reach.ts` carries the whole disclosure argument.
+            //
+            // 🔴 THREE CONDITIONS, AND EVERY ONE OF THEM UNDER-REPORTS (cold review):
+            //   · `outcome.ok` — a refusal carries no vendor bytes, so nothing was read;
+            //   · the vendor did not answer an ERROR. `ok` means the grant plane SENT the call, not that
+            //     the vendor returned content (`connections/grant-mcp-transport.ts`: "a vendor `isError` is
+            //     vendor bytes, not a refusal"). `hooks/connector-audit.ts` suppresses its own note on the
+            //     same signal, for the same reason: a claim about sources must never name a source a turn
+            //     did not get;
+            //   · the row's TIER is `read`. The ledger is read-verbs-only by contract. `borrowShape` refuses
+            //     every other tier at mint today, so this is latent — and it is the line that keeps a write
+            //     slice from rendering a mutation as a source.
+            // The TARGET LABEL rides only where `grantTargetIsPinned` holds, the same gate the description's
+            // pin sentence uses: a footer naming a target the call did not have to use is a host-vouched
+            // false source.
+            const vendorErrored = outcome.ok && typeof outcome.result === "object" && outcome.result !== null && outcome.result.isError === true;
+            if (outcome.ok && !vendorErrored && grant.tier === "read") {
+                // 🔴 `grant.mcpTool`, NEVER THE `mcpTool` CONST ABOVE. This body is an eve durable dynamic-tool
+                // callback: every name it reads from the enclosing scope is stamped into a closure eve
+                // PERSISTS and JSON-parses at resolve time, and an undeclared capture makes the whole
+                // resolver's result vanish from the seat with no red (OPE-1063). The row is already captured,
+                // so reading the field off it adds nothing. `scripts/dynamic-callback-closure-bundle-test.ts`
+                // caught this on the first build after the cold-review fix.
+                const targetLabel = grantTargetIsPinned(grant.connector, grant.mcpTool, Object.keys(grant.frozenArgs ?? {})) ? grantResourceTargetLabel(grant) : undefined;
+                noteBorrowedRecordRead(c, { connection: grant.connector, grantId: grant.id, ...(targetLabel === undefined ? {} : { targetLabel }) });
+            }
+            return outcome;
+        },
+        toModelOutput: grantModelProjection(grant),
+    });
+}
+/**
+ * One entry object per (grant id, row content, rendered span phrase), reused across resolves. This cache is what keeps the per-turn arm from leaking: every entry handed to `registerDynamicVariant` is held in a Set that never shrinks, so a fresh object per resolve would be bounded by TURNS rather than by sessions.
+ * The value carries a fingerprint of the whole row, so a row that changed — a revoke, an expiry stamp — builds a new entry rather than serving a stale one.
+ *
+ * 🔴 THE FINGERPRINT CARRIES THE RENDERED SPAN PHRASE, NOT THE CLOCK (cold review, 2026-09-10). Since OPE-1678 the description says how long is LEFT ("for the next 12 hours") instead of the row's ISO instant, and a relative phrase goes stale where an instant could not: the row does not change as time passes, so a row-only fingerprint served a 09:00 sentence to a 20:55 mount and told the model a dead grant was live. Fingerprinting the PHRASE rebuilds the entry exactly when the sentence changes — a handful of times per session, as the span crosses a unit — rather than on every turn, which is what the leak this cache exists to stop would cost.
+ */
+const GRANT_ENTRIES = new Map();
+function cachedGrantToolEntry(grant) {
+    const nowMs = Date.now();
+    // 🔴 THE FINGERPRINT CARRIES THE SENTENCE THE DESCRIPTION ACTUALLY PRINTS, which since OPE-2160 is
+    // `grantSpanPhrase` and not the expiry phrase. Fingerprinting the old one would rebuild the entry as
+    // the expiry column's span crossed a unit even on a row whose sentence can never change, which is
+    // churn rather than a defect — but it would also stop tracking the sentence the moment the two
+    // diverge again, and tracking the sentence is the whole contract of this cache.
+    const fingerprint = `${JSON.stringify(grant)}|${grantSpanPhrase({ conversationStable: grantScopeKeyIsConversationStable(grant.scopeKey), expiresAt: grant.expiresAt, mode: grant.mode, nowMs })}`;
+    const held = GRANT_ENTRIES.get(grant.id);
+    if (held !== undefined && held.fingerprint === fingerprint)
+        return held.entry;
+    const entry = grantToolEntry(grant, nowMs);
+    if (entry === undefined)
+        return undefined;
+    GRANT_ENTRIES.set(grant.id, { entry, fingerprint });
+    return entry;
+}
+/**
+ * A borrow row's mounted name is READ, not composed: it was pinned when the ask was raised and the card the owner read showed it, so re-composing here could put the chat's tool under a name the owner never saw.
+ * Read is not trusted. The name must be one `isGrantToolName` admits AND one this row could have spelled, and either failure SKIPS the row — the mounted name is what the room reads as whose credential is being spent, so a row pinning somebody else's owner segment would mislabel a live credential.
+ */
+export function mountedGrantName(grant) {
+    if (grant.toolName === undefined)
+        return undefined;
+    if (!isGrantToolName(grant.toolName))
+        return undefined;
+    // A pinned name with no vendor tool beside it is a row the store's own shape check refuses to
+    // write (`grantBorrowColumnsProblem`). It cannot be checked against anything, so it is skipped.
+    return grant.mcpTool !== undefined && borrowNameFitsRow(grant, grant.mcpTool, grant.toolName) ? grant.toolName : undefined;
+}
+/**
+ * Checks the two halves the row can vouch for: the middle segment must be exactly this row's owner slug and connector, and the verb segment must begin with the slug of this row's own vendor tool. The tail is not verified and cannot be — it carries a requester-written label the row does not keep.
+ * 🔴 What keeps an unverified tail safe is `borrowShape`'s read-only bound, not the classifier: the tier scan is NOT monotone, so a read token can LOWER an otherwise-unrecognised verb segment (measured). Because every borrowable tool already classifies `read`, the tail can only raise from that floor — admitting a write borrow on any other basis would reopen this.
+ */
+function borrowNameFitsRow(grant, mcpTool, name) {
+    const segments = name.split("__");
+    if (segments[1] !== `${grant.ownerSlug}_${grant.connector}`)
+        return false;
+    const toolSlug = grantToolSlug(mcpTool);
+    const verb = segments[2] ?? "";
+    return toolSlug !== undefined && (verb === toolSlug || verb.startsWith(`${toolSlug}_`));
+}
+/** Which of two rows claiming ONE name keeps it: the FIRST minted. `createdAt` is an ISO instant, so
+ *  it compares as a string; the id breaks a tie, so the answer never depends on store order. */
+function firstMinted(a, b) {
+    if (a.createdAt !== b.createdAt)
+        return a.createdAt < b.createdAt ? a : b;
+    return a.id <= b.id ? a : b;
+}
+/**
+ * Idempotent, because eve re-runs this resolver on the cold-heal path and on every turn: re-registering a variant under the same grant id replaces it, so a healed session and a later turn mount a byte-identical tool set. A grant this build cannot describe honestly is skipped rather than mounted with a guessed schema.
+ * The same-scope duplicate-name dedupe is a CORRECTNESS control: without it, which of two grants the chat can reach would depend on store order with a person's credential behind the difference, and the losing row would still be registered permanently. The first-minted row keeps the name, and the winner is decided before anything is registered.
+ */
+export function mountGrantEntries(grants) {
+    const claims = new Map();
+    const skipped = [];
+    for (const grant of grants) {
+        const name = mountedGrantName(grant);
+        if (name === undefined)
+            continue;
+        const entry = cachedGrantToolEntry(grant);
+        if (entry === undefined)
+            continue;
+        const held = claims.get(name);
+        if (held === undefined) {
+            claims.set(name, { entry, grant });
+            continue;
+        }
+        const winner = firstMinted(held.grant, grant);
+        if (winner === grant)
+            claims.set(name, { entry, grant });
+        skipped.push({ loser: winner === grant ? held.grant : grant, name });
+    }
+    // LOGGED AFTER THE LOOP, reading the FINAL claim. With three rows on one name the winner can be
+    // displaced mid-loop, and a line naming the row that led at the time would be a wrong sentence.
+    for (const s of skipped) {
+        const winner = claims.get(s.name)?.grant;
+        console.warn(`[open-everywhere:credential-grant] two or more grants claim the mounted name "${s.name}" in one chat. ` +
+            `Keeping grant ${winner?.id ?? "none"} (minted ${winner?.createdAt ?? "unknown"}); grant ${s.loser.id} (minted ${s.loser.createdAt}) is not mounted. ` +
+            "The skipped grant stays valid — its owner can end it from their own direct messages (`revoke_credential_grant`), and a fresh ask mints a name of its own.");
+    }
+    const mounted = {};
+    for (const [name, claim] of claims) {
+        registerDynamicVariant(name, claim.grant.id, claim.entry);
+        mounted[name] = claim.entry;
+    }
+    return mounted;
+}
+/**
+ * Both resolver events answer here. eve re-runs `session.started` resolvers only when the runtime revision changes or on the cold-heal path, so without the `turn.started` arm a grant the owner approved mid-session stayed uncallable until a deploy.
+ * 🔴 THE STATUS RULE IS DIFFERENT FOR THE TWO HALVES OF THE READ (OPE-1950). Every grant issued to the ROOT SEAT's session is mounted whatever its STATUS — a status-filtered mount would drop a tool whose description is already in the persisted transcript, so a revoked one's tool stays mounted and refuses. A grant bound to the room's DOMAIN mounts only while it is live, because it is read by sessions that never saw it and a dead row must not be offered to a brand-new conversation; so a domain-keyed standing grant's tool STOPS mounting when its owner revokes it or it expires, rather than refusing. See `operational/store.ts` `liveStandingCredentialGrantsForScope` for the whole argument.
+ * 🔴 The `session.started` line is LOAD-BEARING AND UNWITNESSED: deleting it leaves the whole tree green while the cold-heal path silently loses the grant.
+ * 🔴 WORKERS ONLY (OPE-2023, Tommy's ruling of 2026-09-20). A lent tool mounts on the workers spawned from the conversation it was lent to, never on the conversational seat: the seat reaches a lent Notion page exactly as it reaches the org connector — it delegates. The credential itself never moves either way (the broker spends it host-side and the transport is the only holder), so what a worker gains is the RESULT of one pinned, frozen-argument call on one vendor tool — the same shape the org connector already hands it.
+ */
+async function resolveGrantMount(ctx) {
+    const c = ctx;
+    // 🔴 THE WORKERS-ONLY GATE, AND IT RUNS FIRST. `sessionScopeKeyInReach` answers for a SEAT too — it
+    // is the shared reader the own-account gate uses — so without this line a conversational seat would
+    // resolve its own session id and mount the lent tool straight back onto itself. It is a POSITIVE
+    // test, so a session this host cannot classify is not a worker and mounts nothing.
+    if (!isSubagentChildContext(c))
+        return null;
+    // Fail CLOSED on a delegated child this host cannot place: a worker that cannot name the conversation
+    // it was spawned from gets no granted credential at all, rather than its own dead-scope session id.
+    const scopeKey = sessionScopeKeyInReach(c);
+    if (scopeKey === undefined)
+        return null;
+    let org;
+    try {
+        org = resolvePartition(c).org;
+    }
+    catch {
+        return null;
+    }
+    // OPE-1950: the root seat's own rows UNION the domain's live STANDING rows. The union is what makes
+    // a 30-day tap mean 30 days — the seat that asked rotates out, and the standing grant the owner
+    // approved still mounts for the workers of the generation that replaces it.
+    // OPE-1972: the domain half is admitted only on an ATTENDED delivery whose ROOT SEAT is the domain's
+    // STANDING conversation. A worker the verdict refuses reads exactly as a worker whose domain holds no
+    // grant, so the refusal is written to the audit log rather than left as an absence.
+    const nowIso = new Date().toISOString();
+    // ONE verdict read, two consumers: the KEY the grants are looked up by, and the verdict the audit
+    // row names. Reading it twice would let one resolve answer two different questions about one session.
+    const verdict = grantDomainScopeVerdict(c);
+    const grants = await credentialGrantsInReach(org, scopeKey, verdict.admitted ? verdict.scopeKey : undefined, nowIso);
+    await noteStandingGrantsWithheld(c, { nowIso, org, sessionId: scopeKey, verdict });
+    const mounted = mountGrantEntries(grants);
+    return Object.keys(mounted).length > 0 ? mounted : null;
+}
+/**
+ * One `grant.mount_withheld` row per session per gate, naming the live standing grants this seat was
+ * refused and why.
+ *
+ * 🔴 IT IS THE NEGATIVE OBSERVABLE ON THE BORROW MOUNT (OPE-1972), and it is the twin of
+ * `tools/request_credential_grant.ts` `noteMountRefused` — the same per-session dedupe, the same
+ * best-effort contract. Without it a withheld grant reads exactly like a domain that never held one,
+ * and the two need different answers: the first is the control working, the second is a missing
+ * declaration. The row is what lets an operator, and a board leg, tell them apart.
+ *
+ * 🔴 IT COSTS ONE EXTRA READ, AND ONLY WHERE A KEY WAS REFUSED — which is net zero against the tree
+ * before OPE-1972. A verdict that minted no key at all (a DM, a room in no domain) returns before any
+ * store call, so an ordinary ungranted room pays nothing. A seat that IS refused used to run two
+ * reads (its own rows plus the domain's) and now runs one, so this read puts it back at two rather
+ * than adding a third. The empty answer is deliberately NOT memoised: a grant the owner approves
+ * mid-session must still produce a row, and memoising "none yet" would answer for the whole session.
+ * Best-effort throughout: a store that cannot be read leaves NO row, because evidence must never turn
+ * a withholding into a mount.
+ */
+async function noteStandingGrantsWithheld(ctx, seat) {
+    const { nowIso, org, sessionId, verdict } = seat;
+    if (verdict.admitted || verdict.scopeKey === undefined)
+        return;
+    const { gate, scopeKey } = verdict;
+    try {
+        // The CONVERSATION's session id the caller already read, never a second read with a fallback: a memo
+        // key that fell back to the domain key would collapse every conversation of that domain onto one row.
+        // Since OPE-2023 this key is the ROOT SEAT's, so the conversation's workers share one row rather than
+        // filing one each — which is the grain the fact has, because the withholding is about the room.
+        const key = `${sessionId}|${gate}`;
+        if (auditedWithholdings.has(key))
+            return;
+        // ADDED BEFORE THE READ, so two resolvers racing one turn write one row rather than two. A read
+        // that then throws costs this session its row, which is the direction a best-effort trail fails in.
+        if (auditedWithholdings.size >= WITHHELD_AUDIT_MEMO_MAX)
+            auditedWithholdings.clear();
+        auditedWithholdings.add(key);
+        const withheld = await getOperationalStore().liveStandingCredentialGrantsForScope(org, scopeKey, nowIso);
+        // NOTHING TO WITHHOLD IS NOT A REFUSAL. A row here would fire on every turn of every domain-declared
+        // room that holds no grant, which is most of them, and would drown the rows that mean something.
+        if (withheld.length === 0) {
+            auditedWithholdings.delete(key);
+            return;
+        }
+        const p = resolvePartition(ctx);
+        let grain = "unknown";
+        try {
+            // 🔴 THE CONVERSATION'S GRAIN, NEVER THIS SESSION'S. Every row this function writes comes from a
+            // delegated worker now, and `windowGrainOf` answers `task` for all of them — so the field an
+            // operator greps to tell a thread seat from a standing one would carry no information at all.
+            // This is the same reader the RULE itself uses, so the row names the grain that decided it.
+            grain = conversationGrainOf(ctx);
+        }
+        catch {
+            // The grain is a LABEL on this row, never its trigger — an unreadable grain must not drop it.
+        }
+        await auditGrant({ org: p.org, platform: p.platform, workspace: p.workspace, ...(p.surface === undefined ? {} : { surface: p.surface }) }, "grant.mount_withheld", undefined, {
+            // The connectors and grant ids are host-side row identifiers, never request content — the same
+            // fields `grant.used` already carries. No owner slug and no resource: a withholding is not a use.
+            connectors: [...new Set(withheld.map((g) => g.connector))].sort(),
+            gate,
+            grain,
+            grantIds: withheld.map((g) => g.id).sort(),
+            scopeKey,
+            surfaceKey: p.surfaceKey,
+        });
+    }
+    catch {
+        // Best-effort by contract: a lost row never throws into the mount it was recording.
+    }
+}
+/** One row per session per gate — the dedupe shape `request_credential_grant.ts` uses, for the same
+ *  reason: this resolver runs on every turn, and an operator wants the fact, not a repeat per turn.
+ *  It needs no test-reset seam: every integration fork is a fresh process, and the tier-1 suite drives
+ *  the RULE rather than this resolver. */
+const auditedWithholdings = new Set();
+const WITHHELD_AUDIT_MEMO_MAX = 512;
+export default defineDynamic({
+    events: {
+        "session.started": async (_event, ctx) => await resolveGrantMount(ctx),
+        "turn.started": async (_event, ctx) => await resolveGrantMount(ctx),
+    },
+});
+//# sourceMappingURL=grant_tools.js.map

package/dist/agent/tools/grant_tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant_tools.js","sourceRoot":"","sources":["../../../agent/tools/grant_tools.ts"],"names":[],"mappings":"AAAA,+QAA+Q;AAC/Q,ySAAyS;AACzS,qUAAqU;AAErU,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAA4B,MAAM,2BAA2B,CAAC;AAC7F,OAAO,EAAE,yBAAyB,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AACjG,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AACpG,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAC7F,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,EACxB,aAAa,EACb,eAAe,GAGhB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,EACjB,gBAAgB,EAChB,yBAAyB,EACzB,eAAe,EACf,mBAAmB,GACpB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAC7H,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAgC,MAAM,qCAAqC,CAAC;AACjI,OAAO,EAAE,iCAAiC,EAAE,MAAM,yCAAyC,CAAC;AAC5F,OAAO,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAyB,MAAM,iCAAiC,CAAC;AAC3F,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAwB,MAAM,wBAAwB,CAAC;AACrG,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAE/D,uRAAuR;AACvR,sBAAsB,EAAE,CAAC;AAEzB,0MAA0M;AAC1M,4BAA4B,EAAE,CAAC;AAE/B;;;GAGG;AACH,SAAS,oBAAoB,CAAC,KAAyB;IACrD,MAAM,MAAM,GAAG,WAAW,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,SAAS,MAAM,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;IACpG,8FAA8F;IAC9F,4BAA4B;IAC5B,MAAM,KAAK,GAAG,SAAS,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;IACvD,OAAO,KAAK,EAAE,MAAe,EAAE,EAAE;QAC/B,MAAM,GAAG,GAAG,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5G,IAAI,GAAG,EAAE,EAAE,KAAK,KAAK,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,uBAAuB,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAClH,MAAM,IAAI,GAAG,GAAG,EAAE,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QACpD,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE;YAC9G,SAAS,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;YACvC,MAAM;SACP,CAAC,CAAC;QACH,0FAA0F;QAC1F,8FAA8F;QAC9F,eAAe;QACf,MAAM,UAAU,GAAG,OAAO,GAAG,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,6BAA6B,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3H,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,KAAK,OAAO,UAAU,EAAE,EAAE,CAAC;IACrE,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAAgB,EAAE,SAAiB,EAAE,OAAyB;IACrG,OAAO,OAAO,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9G,CAAC;AAQD;;;GAGG;AACH,SAAS,WAAW,CAAC,KAAyB,EAAE,OAAe,EAAE,KAAa;IAC5E,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtD,8vBAA8vB;IAC9vB,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9D,uOAAuO;IACvO,MAAM,MAAM,GACV,UAAU,CAAC,MAAM,KAAK,CAAC;QACrB,CAAC,CAAC,mCAAmC,KAAK,sDAAsD;QAChG,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,yCAAyC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,uCAAuC;YACjI,kHAAkH;YAClH,mCAAmC,MAAM,EAAE;YAC3C,wLAAwL;YACxL,kNAAkN;YAClN,GACE,KAAK,CAAC,IAAI,KAAK,MAAM;gBACnB,CAAC,CAAC,gEAAgE,MAAM,iDAAiD,MAAM,CAAC,yBAAyB,CAAC,sIAAsI,KAAK,0DAA0D;gBAC/V,CAAC,CAAC,EACN,GAAG,CAAC;IACV,iOAAiO;IACjO,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,EAAE,GAAG,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,MAAM,GAAG,CAAC;IAC/E,mgBAAmgB;IACngB,0fAA0f;IAC1f,MAAM,WAAW,GAAG,yBAAyB,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IAC5F,MAAM,GAAG,GAAG,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,WAAW,GAAG,CAAC;IAC/D,+JAA+J;IAC/J,MAAM,KAAK,GAAG,qBAAqB,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,+DAA+D,MAAM,6DAA6D,CAAC;IACxM,OAAO;QACL,WAAW,EACT,QAAQ,KAAK,UAAU,MAAM,eAAe,iBAAiB,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,KAAK,KAAK,GAAG,GAAG,MAAM,GAAG;YACxH,6FAA6F;YAC7F,6FAA6F;YAC7F,+FAA+F;YAC/F,qEAAqE;YACrE,kBAAkB,eAAe,CAAC,EAAE,kBAAkB,EAAE,iCAAiC,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,IAAI;YACrK,iBAAiB,MAAM,2DAA2D;QACpF,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAyB,EAAE,KAAK,GAAW,IAAI,CAAC,GAAG,EAAE;IAClF,oGAAoG;IACpG,mGAAmG;IACnG,0FAA0F;IAC1F,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACjD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,UAAU,CAAC;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,KAAK,CAAC,OAAO,CAAC,KAAc,EAAE,GAAY;YACxC,MAAM,CAAC,GAAG,GAAsB,CAAC;YACjC,gGAAgG;YAChG,gGAAgG;YAChG,uEAAuE;YACvE,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;YAChC,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;YAC5C,yFAAyF;YACzF,+FAA+F;YAC/F,8FAA8F;YAC9F,iGAAiG;YACjG,MAAM,cAAc,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAC;YAChD,IAAI,GAAG,GAAG,SAAS,CAAC;YACpB,IAAI,QAAQ,GAAG,SAAS,CAAC;YACzB,IAAI,SAAS,GAAG,SAAS,CAAC;YAC1B,IAAI,OAA2B,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;gBAC9B,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;gBACZ,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;gBACtB,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;gBACxB,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP;mEACmD;YACrD,CAAC;YACD,uSAAuS;YACvS,iKAAiK;YACjK,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CACnI,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAA4B,EAAE;gBACjE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE;gBACjB,GAAG;gBACH,QAAQ;gBACR,oBAAoB,EAAE,wBAAwB,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC;gBAC9E,6FAA6F;gBAC7F,6FAA6F;gBAC7F,8FAA8F;gBAC9F,wFAAwF;gBACxF,QAAQ,EAAE,sBAAsB,CAAC,CAAC,CAAC,IAAI,EAAE;gBACzC,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC;gBAC3D,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;gBAC7C,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;gBAC3C,SAAS;aACV,CAAC,CACH,CAAC;YACF,+FAA+F;YAC/F,gGAAgG;YAChG,sFAAsF;YACtF,4FAA4F;YAC5F,gGAAgG;YAChG,0FAA0F;YAC1F,EAAE;YACF,0EAA0E;YAC1E,6EAA6E;YAC7E,6FAA6F;YAC7F,gGAAgG;YAChG,+FAA+F;YAC/F,8FAA8F;YAC9F,mBAAmB;YACnB,iGAAiG;YACjG,gGAAgG;YAChG,mDAAmD;YACnD,iGAAiG;YACjG,6FAA6F;YAC7F,gBAAgB;YAChB,MAAM,aAAa,GAAG,OAAO,CAAC,EAAE,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,IAAK,OAAO,CAAC,MAAgC,CAAC,OAAO,KAAK,IAAI,CAAC;YAChK,IAAI,OAAO,CAAC,EAAE,IAAI,CAAC,aAAa,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC1D,gGAAgG;gBAChG,uFAAuF;gBACvF,sFAAsF;gBACtF,8FAA8F;gBAC9F,8FAA8F;gBAC9F,4DAA4D;gBAC5D,MAAM,WAAW,GAAG,mBAAmB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC3J,sBAAsB,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC;YACvI,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,aAAa,EAAE,oBAAoB,CAAC,KAAK,CAAC;KAClC,CAAmC,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,EAAiF,CAAC;AAE/G,SAAS,oBAAoB,CAAC,KAAyB;IACrD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,mGAAmG;IACnG,qGAAqG;IACrG,kGAAkG;IAClG,+FAA+F;IAC/F,gFAAgF;IAChF,MAAM,WAAW,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,eAAe,CAAC,EAAE,kBAAkB,EAAE,iCAAiC,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAClM,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IAC9E,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC3C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IACpD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAyB;IACxD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACnD,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IACvD,8FAA8F;IAC9F,gGAAgG;IAChG,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7H,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,KAAyB,EAAE,OAAe,EAAE,IAAY;IACjF,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,EAAE;QAAE,OAAO,KAAK,CAAC;IAC1E,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/B,OAAO,QAAQ,KAAK,SAAS,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED;gGACgG;AAChG,SAAS,WAAW,CAAC,CAAqB,EAAE,CAAqB;IAC/D,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS;QAAE,OAAO,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAqC;IACrE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuF,CAAC;IAC9G,MAAM,OAAO,GAAoE,EAAE,CAAC;IACpF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS;QACjC,MAAM,KAAK,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACnC,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC9C,IAAI,MAAM,KAAK,KAAK;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,gGAAgG;IAChG,gGAAgG;IAChG,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;QACzC,OAAO,CAAC,IAAI,CACV,iFAAiF,CAAC,CAAC,IAAI,iBAAiB;YACtG,iBAAiB,MAAM,EAAE,EAAE,IAAI,MAAM,YAAY,MAAM,EAAE,SAAS,IAAI,SAAS,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC,SAAS,oBAAoB;YACtJ,2JAA2J,CAC9J,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAwC,EAAE,CAAC;IACxD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,sBAAsB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;IAC9B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,iBAAiB,CAAC,GAAY;IAC3C,MAAM,CAAC,GAAG,GAAsB,CAAC;IACjC,oGAAoG;IACpG,oGAAoG;IACpG,iGAAiG;IACjG,mFAAmF;IACnF,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,sGAAsG;IACtG,oGAAoG;IACpG,MAAM,QAAQ,GAAG,sBAAsB,CAAC,CAAC,CAAC,CAAC;IAC3C,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,oGAAoG;IACpG,gGAAgG;IAChG,4EAA4E;IAC5E,qGAAqG;IACrG,sGAAsG;IACtG,oFAAoF;IACpF,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxC,kGAAkG;IAClG,sGAAsG;IACtG,MAAM,OAAO,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACrH,MAAM,0BAA0B,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACnF,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,KAAK,UAAU,0BAA0B,CACvC,GAAoB,EACpB,IAA8H;IAE9H,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACjD,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO;IAC/D,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IACnC,IAAI,CAAC;QACH,qGAAqG;QACrG,sGAAsG;QACtG,sGAAsG;QACtG,gGAAgG;QAChG,MAAM,GAAG,GAAG,GAAG,SAAS,IAAI,IAAI,EAAE,CAAC;QACnC,IAAI,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO;QACzC,gGAAgG;QAChG,oGAAoG;QACpG,IAAI,mBAAmB,CAAC,IAAI,IAAI,uBAAuB;YAAE,mBAAmB,CAAC,KAAK,EAAE,CAAC;QACrF,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,mBAAmB,EAAE,CAAC,oCAAoC,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACzG,qGAAqG;QACrG,iGAAiG;QACjG,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,mBAAmB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChC,OAAO;QACT,CAAC;QACD,MAAM,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,GAAG,SAAS,CAAC;QACtB,IAAI,CAAC;YACH,iGAAiG;YACjG,6FAA6F;YAC7F,8FAA8F;YAC9F,4FAA4F;YAC5F,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,8FAA8F;QAChG,CAAC;QACD,MAAM,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,sBAAsB,EAAE,SAAS,EAAE;YAC5K,+FAA+F;YAC/F,kGAAkG;YAClG,UAAU,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;YACjE,IAAI;YACJ,KAAK;YACL,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE;YAC1C,QAAQ;YACR,UAAU,EAAE,CAAC,CAAC,UAAU;SACzB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,oFAAoF;IACtF,CAAC;AACH,CAAC;AAED;;;0CAG0C;AAC1C,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;AAC9C,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAEpC,eAAe,aAAa,CAAC;IAC3B,MAAM,EAAE;QACN,iBAAiB,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,iBAAiB,CAAC,GAAG,CAAC;QACtE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,iBAAiB,CAAC,GAAG,CAAC;KACpE;CACF,CAAC,CAAC"}

package/dist/agent/tools/halt.d.ts

@@ -0,0 +1,71 @@
+import { type ReplyTarget } from "../channels/reply-post.js";
+import { type BindableContext } from "../identity/binding.js";
+import type { HaltAddress } from "../operational/store.js";
+/** The address the two chat verbs share. HOST-DERIVED from the binding — see the header. */
+export declare function chatHaltAddress(scope: "org" | "surface", surfaceKey: string): HaltAddress;
+/**
+ * What the room is told, host-authored. Says what stopped, what did not, and how it ends.
+ *
+ * 🔴 IT NAMES WHAT KEEPS RUNNING AS PLAINLY AS WHAT STOPS (OPE-1758), because the room reads this
+ * line and the seat is told the same thing by `haltSeatParagraph`. The doctrine is that a
+ * consequential act is one whose effect ESCAPES the conversation (access/consequence.ts), so a READ
+ * does not stop, a REPLY does not stop, a file into THIS room does not stop (`post_file` is `open` —
+ * the consequence table calls it "same class as reply"), and the host's record of this conversation
+ * in memory does not stop. None of the four leaves the conversation the halt still admits.
+ * In soak-2026-09-12-a all of them ran under a halt whose text implied otherwise; the seat then
+ * refused a read-only pull-request question and refused to rewrite a file it had already posted,
+ * citing a pause that had never covered either. A line that overclaims is a line that stops work
+ * nobody stopped.
+ *
+ * 🔴 AND IT DOES NOT SAY "NO OUTBOUND NETWORK ACCESS". What a halt denies is the sandbox's reach and
+ * the open web (`web_fetch`, `web_search`, `assertEgressReach`). OE's own first-party transports are
+ * not egress arrows (docs/security/control-plane.md), so the very file post this line offers in its
+ * next breath is an outbound call. Name the fence, never the whole network.
+ */
+export declare function haltConfirmation(scope: "org" | "surface"): string;
+/**
+ * What the TOOL RESULT tells the model, which is never a second copy of the room's line when the
+ * host has already posted it. The `false` arm carries the confirmation VERBATIM, because a post that
+ * failed leaves the model as the only voice in the room — that arm is the recovery from a silent
+ * brake, and it is the arm the 50-minute soak failure needed.
+ */
+export declare function haltModelMessage(announced: boolean, scope: "org" | "surface"): string;
+/** The two edges {@link announceHalt} touches, injected so a suite can drive the post with no host. */
+export interface HaltAnnounceDeps {
+    readonly resolveTarget?: (ctx: BindableContext) => ReplyTarget | null;
+    readonly post?: (target: ReplyTarget, text: string) => Promise<string>;
+}
+/**
+ * Tell the room the halt is on. NEVER THROWS — a brake that failed to announce itself must still be
+ * a brake, so every failure resolves `false` and the caller's audit row carries it.
+ *
+ * A SKIPPED post is not a delivered one: `postReply` answers a dedupe refusal with a sentinel id
+ * rather than a throw, so reading only "it did not throw" would record a delivery the room never got
+ * (the trap `connections/consent-resume.ts` names). 🔴 THAT BRANCH IS DEFENSIVE, NOT LOAD-BEARING
+ * HERE, and the difference is worth stating because the sentinel looks like idempotency evidence:
+ * `postHostNotice` is `postReply` with NO audit struct, so it passes `org: undefined` into
+ * `postOnce`, which fails OPEN on a missing org and claims no dedupe key. The confirmation is
+ * therefore NOT deduped — a re-run of this step posts a second identical line into the room. That is
+ * the loud direction and it is accepted: a brake that announces itself twice is a brake the room
+ * heard. The branch stays so an audited poster later cannot silently record a delivery that skipped.
+ */
+export declare function announceHalt(ctx: BindableContext, scope: "org" | "surface", deps?: HaltAnnounceDeps): Promise<boolean>;
+declare const _default: import("eve/tools").ToolDefinition<{
+    scope: "org" | "surface";
+}, {
+    halted: boolean;
+    scope: "org" | "surface";
+    announced: boolean;
+    message: string;
+}> & {
+    execute(input: {
+        scope: "org" | "surface";
+    }, ctx: import("eve/tools").ToolContext): Promise<{
+        halted: boolean;
+        scope: "org" | "surface";
+        announced: boolean;
+        message: string;
+    }>;
+};
+export default _default;
+//# sourceMappingURL=halt.d.ts.map

package/dist/agent/tools/halt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"halt.d.ts","sourceRoot":"","sources":["../../../agent/tools/halt.ts"],"names":[],"mappings":"AAkCA,OAAO,EAA+D,KAAK,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC1H,OAAO,EAA6C,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAIzG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D,4FAA4F;AAC5F,wBAAgB,eAAe,CAAC,KAAK,EAAE,KAAK,GAAG,SAAS,EAAE,UAAU,EAAE,MAAM,GAAG,WAAW,CAEzF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,KAAK,GAAG,SAAS,GAAG,MAAM,CAQjE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,GAAG,SAAS,GAAG,MAAM,CAIrF;AAED,uGAAuG;AACvG,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,WAAW,GAAG,IAAI,CAAC;IACtE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACxE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,GAAG,SAAS,EAAE,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAShI"}