@open-everywhere/core 0.1.0

package/dist/agent/tools/resume.js

@@ -0,0 +1,137 @@
+// `resume` — the other half of the break-glass pair, and the OPPOSITE posture on purpose.
+//
+// 🔴 IT WIDENS, SO IT IS CARDED. `halt` is `open`-tier and uncarded because a card in front of a
+// brake pedal is a brake that fails when it is needed (tools/halt.ts states that argument in full).
+// `resume` restores every consequential act, so it is `gate:admin` via the `halt.resume` ActionKind
+// and an admin clicks. That is the control plane's own WIDEN-SLOW / NARROW-FAST doctrine
+// (control/writes.ts), applied to the one pair where both directions exist.
+//
+// 🔴 IT CAN NEVER BLOCK ITSELF. Being `gate:admin` means this verb routes through the approver
+// chain — the very place the halt arrow denies — so a naive wiring would leave a halted deployment
+// with no lift but a config edit and a redeploy. The exemption is ONE cell in
+// access/approver-chain.ts's `TRANSFORM_TABLE`: the `mode:HALT` arrow's own `fires` predicate
+// excludes the name `resume` and nothing else. It lives there, in the table, rather than in this
+// file, so a reader of the arrow sees the exemption beside the rule it bends.
+//
+// 🔴 AND NO DOMAIN MODE LIFTS THE CARD. `mode:DANGEROUSLY_BYPASS` turns every `ask` into an `allow`
+// for the domain that set it, and it exempts the name `resume` as well (access/approver-chain.ts) —
+// the same one name, for the opposite reason. WHY: a domain's `approvalMode` is a PER-DOMAIN
+// convenience, chosen in that domain's own config; a halt is an ORG-WIDE operator stop pulled
+// during an incident, and a per-domain convenience must never lift an org-wide stop. Without that
+// second conjunct the two exemptions compose into a hole — the halt arrow lets `resume` past and
+// the bypass arrow auto-approves it, so a model turn inside one bypass domain clears the whole
+// deployment's halt with no admin click. `resume` is carded in EVERY mode; there is no exception.
+//
+// THE SECOND DOOR, for when this one cannot be used at all — nobody with an admin role in the room,
+// no card venue, a chat platform that is itself the incident — is the control MCP's own `resume`
+// (control/writes.ts), which touches neither this tool nor the chain.
+//
+// NO ADDRESS COMES FROM THE MODEL, for the same reason `halt` takes none: `scope` is a two-value
+// enum and the key is derived host-side from this seat's binding.
+import { defineTool } from "eve/tools";
+import { never } from "eve/tools/approval";
+import { z } from "zod";
+import { requestApproval, autoApprovedNote } from "../approvals/flow.js";
+import { checkApprovalVenue, describeVenueRefusal, cardPostedPrefix, cardPostedTail } from "../approvals/card-venue.js";
+import { getConfig } from "../access/config.js";
+import { domainForChannel } from "../memory/domain.js";
+import { bindFrom } from "../identity/binding.js";
+import { principalIdOf, unattendedOf } from "../access/request.js";
+import { resolvePartition } from "../memory/partition.js";
+import { proposalScopeKey } from "../channels/propose-scope.js";
+import { approvalPostDeps } from "./set_spend_limit.js";
+import { chatHaltAddress } from "./halt.js";
+export default defineTool({
+    description: "PROPOSE lifting the break-glass halt — this does NOT lift it. Posts a confirmation card; an org admin must click Approve, because resuming WIDENS what the deployment may do (halting narrows, so `halt` needs no card and takes effect at once). Use it once whatever caused the halt is resolved. The posted card IS the reply to the user — do not add narration after this call. EXCEPT when this surface can't host a card: it then goes to a card-capable channel in the same domain, the `note` field names it, and you MUST relay that.",
+    inputSchema: z.object({
+        scope: z
+            .enum(["org", "surface"])
+            .default("org")
+            .describe('Which halt to lift — the same two addresses `halt` sets. "org" (the default) lifts the deployment-wide halt; "surface" lifts only this conversation\'s own. Lifting one never lifts the other: if both are set, both must be resumed.'),
+    }),
+    outputSchema: z.object({
+        requested: z.boolean(),
+        pendingId: z.string(),
+        expiresAt: z.string().optional().describe("Absent when the chain auto-approved: the row is already decided, so nothing expires."),
+        note: z.string(),
+        autoApproved: z.boolean().optional().describe("The approver chain lowered this verb: no card was posted and it has ALREADY run."),
+    }),
+    approval: never(),
+    async execute(input, ctx) {
+        const binding = bindFrom(ctx);
+        const p = resolvePartition(ctx);
+        // 🔴 THE ROOM THAT ASKED, NOT THE ROOM THAT ARRIVED LAST (OPE-1756). `p` above is the TURN's
+        // partition, and a turn that merged queued deliveries carries only the LAST delivery's auth —
+        // so on a turn answering two rooms it names the wrong one. The GOVERNED scope follows the
+        // ADDRESSED wake instead, through the same road the reply path uses; it falls back to `p` on
+        // every unknown, so a single-wake turn is unchanged.
+        // 🔴 THE MERGE ROAD IS UNREACHABLE ON eve 0.54.3; THIS READ IS STILL LIVE (OPE-2042). eve batches
+        // adjacent queued deliveries only when their full auth contexts match, and OE stamps a fresh
+        // per-delivery `oe_delivery_id` into `auth.attributes`, so two auth-carrying deliveries on one
+        // unified window never compare equal; only the caller-less task COMPLETION COHORT still folds,
+        // and it carries no `auth` at all. But the TURN's ctx names the wrong room WITHOUT any merge
+        // too: a turn woken by an INTERNAL wake — an approval decision, a completion — answers a
+        // conversation whose envelope is in the seat's shared context, through the reply fence's
+        // same-conversation and pending arms (`channels/unified-window.ts` `resolveAnswerableReplyTarget`,
+        // arms 3 and 4). Measured in production on 2026-08-15 (`docs/glossary.md`). So this read is
+        // LOAD-BEARING, not defensive. `scripts/coalesced-delivery-merge-assumption-test.ts` pins only
+        // the merge road's impossibility.
+        // 🔴 WHAT MOVES IS THE GOVERNANCE KEY ONLY. Anything else this tool derives from `p` — the memory
+        // tier, the card's venue walk, and any surface key frozen into the proposal's own `args` — keeps
+        // reading the TURN's partition, deliberately: those name what the act DOES and where this seat
+        // lives, while the scope key names who may approve it and which halt covers it. Moving the act's
+        // own target is a design choice this task does not hold.
+        const proposeScopeKey = await proposalScopeKey(ctx, p);
+        const scope = input.scope ?? "org";
+        // 🔴 THE ACT AND ITS CHAIN NAME ONE ROOM. This verb is the only propose site whose FROZEN ARGS
+        // carry an address the act LIFTS, so a scope key that moved while the address stayed put would let
+        // the asking room's approvers — or its pre-approval rule, which settles with no card at all — lift
+        // a halt on the OTHER room. `proposeScopeKey` is host-derived from a divert-written wake row, never
+        // model-authored, so `tools/halt.ts`'s "no address comes from the model" rule is untouched.
+        const address = chatHaltAddress(scope, proposeScopeKey);
+        // principal-gate: accountability — the card's "asked by" line. Deliberately NOT the acting-sender
+        // refusal `revoke_connector` carries: that verb refuses an unattended turn because break-glass is
+        // a person's decision. This verb is the SAFE direction of the same lever and it is CARDED, so an
+        // admin's click is the decision either way; refusing to let a fire even propose it would remove a
+        // route back from a halt for no gain.
+        const requestedBy = principalIdOf(ctx);
+        if (!requestedBy) {
+            throw new Error("resume needs a verified sender on this turn — the approval card has to name who asked. Ask someone in this conversation to propose it, or lift the halt from the control plane instead.");
+        }
+        // …and the card's DOMAIN axis off the same key, for the same reason: a domain derived from the
+        // turn's room beside a scope key naming another room describes two different places on one card.
+        const domain = domainForChannel(proposeScopeKey, getConfig().loadDomains())?.name ?? null;
+        const venueResult = await checkApprovalVenue(binding, p, () => getConfig().loadDomains());
+        if ("refusal" in venueResult) {
+            throw new Error(describeVenueRefusal(venueResult.refusal, binding.platform, "lift that halt"));
+        }
+        const venue = venueResult.venue;
+        const posted = await requestApproval({
+            org: p.org,
+            kind: "halt.resume",
+            args: {
+                org: p.org,
+                ...(address.orgWide ? { orgWide: true } : { level: address.level, scopeKey: address.scopeKey }),
+                scopeLabel: scope === "org" ? "the whole deployment" : "this conversation",
+            },
+            scopeKey: proposeScopeKey,
+            domain,
+            requestedBy,
+            channelId: venue.channelId,
+            threadTs: venue.sameRoom ? binding.threadTs ?? null : null,
+            postedTo: venue.surfaceKey,
+            chain: { unattended: unattendedOf(ctx) },
+        }, approvalPostDeps(venue.platform, ctx));
+        const subject = scope === "org" ? "lift the deployment-wide halt" : "lift this conversation's halt";
+        if (posted.autoApproved) {
+            return { requested: false, autoApproved: true, pendingId: posted.id, note: autoApprovedNote(subject, posted.autoApproved) };
+        }
+        return {
+            requested: true,
+            pendingId: posted.id,
+            expiresAt: posted.expiresAt,
+            note: `${cardPostedPrefix(venue)} — ${subject} (pending ${posted.id}).` + cardPostedTail(venue, "approve it", posted),
+        };
+    },
+});
+//# sourceMappingURL=resume.js.map

package/dist/agent/tools/resume.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resume.js","sourceRoot":"","sources":["../../../agent/tools/resume.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,EAAE;AACF,iGAAiG;AACjG,oGAAoG;AACpG,oGAAoG;AACpG,yFAAyF;AACzF,4EAA4E;AAC5E,EAAE;AACF,+FAA+F;AAC/F,mGAAmG;AACnG,8EAA8E;AAC9E,8FAA8F;AAC9F,iGAAiG;AACjG,8EAA8E;AAC9E,EAAE;AACF,oGAAoG;AACpG,oGAAoG;AACpG,6FAA6F;AAC7F,8FAA8F;AAC9F,kGAAkG;AAClG,iGAAiG;AACjG,+FAA+F;AAC/F,kGAAkG;AAClG,EAAE;AACF,oGAAoG;AACpG,iGAAiG;AACjG,sEAAsE;AACtE,EAAE;AACF,iGAAiG;AACjG,kEAAkE;AAElE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACxH,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5C,eAAe,UAAU,CAAC;IACxB,WAAW,EACT,ihBAAihB;IACnhB,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,KAAK,EAAE,CAAC;aACL,IAAI,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;aACxB,OAAO,CAAC,KAAK,CAAC;aACd,QAAQ,CACP,uOAAuO,CACxO;KACJ,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;QACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sFAAsF,CAAC;QACjI,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kFAAkF,CAAC;KAClI,CAAC;IACF,QAAQ,EAAE,KAAK,EAAE;IACjB,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG;QACtB,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAChC,6FAA6F;QAC7F,8FAA8F;QAC9F,0FAA0F;QAC1F,6FAA6F;QAC7F,qDAAqD;QACrD,kGAAkG;QAClG,6FAA6F;QAC7F,+FAA+F;QAC/F,+FAA+F;QAC/F,6FAA6F;QAC7F,yFAAyF;QACzF,yFAAyF;QACzF,mGAAmG;QACnG,4FAA4F;QAC5F,+FAA+F;QAC/F,kCAAkC;QAClC,kGAAkG;QAClG,iGAAiG;QACjG,+FAA+F;QAC/F,iGAAiG;QACjG,yDAAyD;QACzD,MAAM,eAAe,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC;QACnC,+FAA+F;QAC/F,mGAAmG;QACnG,mGAAmG;QACnG,oGAAoG;QACpG,4FAA4F;QAC5F,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QACxD,kGAAkG;QAClG,kGAAkG;QAClG,iGAAiG;QACjG,kGAAkG;QAClG,sCAAsC;QACtC,MAAM,WAAW,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,yLAAyL,CAC1L,CAAC;QACJ,CAAC;QACD,+FAA+F;QAC/F,iGAAiG;QACjG,MAAM,MAAM,GAAG,gBAAgB,CAAC,eAAe,EAAE,SAAS,EAAE,CAAC,WAAW,EAAE,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;QAC1F,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1F,IAAI,SAAS,IAAI,WAAW,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC;QAEhC,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC;YACE,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE;gBACJ,GAAG,EAAE,CAAC,CAAC,GAAG;gBACV,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACxG,UAAU,EAAE,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,mBAAmB;aAC3E;YACD,QAAQ,EAAE,eAAe;YACzB,MAAM;YACN,WAAW;YACX,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI;YAC1D,QAAQ,EAAE,KAAK,CAAC,UAAU;YAC1B,KAAK,EAAE,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE;SACzC,EACD,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CACtC,CAAC;QAEF,MAAM,OAAO,GAAG,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,+BAA+B,CAAC;QACpG,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9H,CAAC;QACD,OAAO;YACL,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,MAAM,CAAC,EAAE;YACpB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,IAAI,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,OAAO,aAAa,MAAM,CAAC,EAAE,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC;SACtH,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/dist/agent/tools/revoke_connector.d.ts

@@ -0,0 +1,52 @@
+import { type SurfaceBinding } from "../identity/binding.js";
+export interface RevokeConnectorInput {
+    readonly connector: string;
+    readonly reason: string;
+    readonly scopeKey?: string;
+}
+export interface ConnectorRevokePlan {
+    readonly kind: "connector.revoke";
+    readonly args: {
+        readonly org: string;
+        readonly scopeKey: string;
+        readonly connector: string;
+        readonly reason: string;
+    };
+    readonly scopeKey: string;
+    readonly domain: string | null;
+}
+/** Pure input -> frozen-args mapping: card-path refusal, ACTING-sender refusal,
+ *  scopeKey defaulting to this surface's own surfaceKey (connector overrides are
+ *  surface-scoped only — no workspace level, unlike spend limits). */
+export declare function planRevokeConnector(binding: SurfaceBinding, input: RevokeConnectorInput, domain: string | null): ConnectorRevokePlan;
+declare const _default: import("eve/tools").ToolDefinition<{
+    connector: string;
+    reason: string;
+    scopeKey?: string | undefined;
+}, {
+    requested: boolean;
+    pendingId: string;
+    expiresAt?: string | undefined;
+    note: string;
+    autoApproved?: boolean | undefined;
+}> & {
+    execute(input: {
+        connector: string;
+        reason: string;
+        scopeKey?: string | undefined;
+    }, ctx: import("eve/tools").ToolContext): Promise<{
+        expiresAt?: undefined;
+        requested: boolean;
+        autoApproved: boolean;
+        pendingId: string;
+        note: string;
+    } | {
+        autoApproved?: undefined;
+        requested: boolean;
+        pendingId: string;
+        expiresAt: string;
+        note: string;
+    }>;
+};
+export default _default;
+//# sourceMappingURL=revoke_connector.d.ts.map

package/dist/agent/tools/revoke_connector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revoke_connector.d.ts","sourceRoot":"","sources":["../../../agent/tools/revoke_connector.ts"],"names":[],"mappings":"AAMA,OAAO,EAA+B,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAS1F,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,CAAC;IACF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED;;sEAEsE;AACtE,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,mBAAmB,CAmCpI"}

package/dist/agent/tools/revoke_connector.js

@@ -0,0 +1,129 @@
+// revoke_connector PROPOSES a break-glass connector revoke for this surface; it does NOT cut access itself. It posts a confirmation card, and an admin's Approve click runs the SAME store fn the control-plane write already calls.
+// A revoke is STICKY once approved, with no auto-expiry — revert deliberately with clear_connector_override, or a PR removing the grant. There is deliberately no runtime GRANT tool: access only ever widens through a reviewed PR, so this lane is narrow-only.
+import { defineTool } from "eve/tools";
+import { never } from "eve/tools/approval";
+import { z } from "zod";
+import { actingPrincipalId, bindFrom } from "../identity/binding.js";
+import { principalIdOf, unattendedOf } from "../access/request.js";
+import { resolvePartition } from "../memory/partition.js";
+import { domainForChannel } from "../memory/domain.js";
+import { getConfig } from "../access/config.js";
+import { requestApproval, autoApprovedNote } from "../approvals/flow.js";
+import { checkApprovalVenue, describeVenueRefusal, cardPostedPrefix, cardPostedTail } from "../approvals/card-venue.js";
+import { approvalPostDeps } from "./set_spend_limit.js";
+/** Pure input -> frozen-args mapping: card-path refusal, ACTING-sender refusal,
+ *  scopeKey defaulting to this surface's own surfaceKey (connector overrides are
+ *  surface-scoped only — no workspace level, unlike spend limits). */
+export function planRevokeConnector(binding, input, domain) {
+    // NO CARD-PATH REFUSAL HERE ANY MORE (OPE-303). It was a `slack` literal, then (OPE-295 item 3)
+    // `hasApprovalCardPath`, and both asked the question one step too early: a room that cannot host
+    // a card gets its card ROUTED to a card-capable channel in the same domain
+    // (approvals/card-venue.ts), resolved in execute() where the config read belongs. Break-glass is
+    // the verb where that matters most, and for the same reason the previous widening cited: an
+    // incident does not wait for the responder to move to a different chat app — and it does not wait
+    // for them to move to a different chat app they may not even be in.
+    // principal-gate: presence — break-glass is a HUMAN's verb. Its whole justification is "the change
+    // needs to happen NOW, not after a PR review", and the thing that earns skipping the review is
+    // that a person is standing there having decided it. A schedule is not an incident.
+    //
+    // 🔴 THE ACTING principal, never the bound one (OPE-273). `binding.principalId` was answered by a
+    // triggered fire's ATTESTED creator, so a fire could propose cutting a connector — and STICKY is
+    // what makes that sharp here: an approved revoke has no auto-expiry, so one wrong click off an
+    // injected fire is a denial of service that persists until somebody notices and reverses it.
+    if (!actingPrincipalId(binding)) {
+        throw new Error("revoke_connector needs a verified sender on this turn — a triggered routine fire has no acting sender (only the creator it is attributed to), and break-glass is a person's decision, not a schedule's. Ask someone in this conversation to propose the revoke.");
+    }
+    const connector = input.connector.trim();
+    if (!connector) {
+        throw new Error("revoke_connector needs a non-empty connector name.");
+    }
+    const reason = input.reason.trim();
+    if (!reason) {
+        throw new Error("revoke_connector needs a non-empty reason — it's shown on the approval card.");
+    }
+    // The domain-grain default (`domainSurface ?? surface`) is LOAD-BEARING rather than defensive: a proposal from a Discord THREAD must target the PARENT channel — the key the connector gate checks — not the thread's own ephemeral channel id.
+    const scopeKey = input.scopeKey?.trim() || `${binding.platform}/${binding.workspace}/${binding.domainSurface ?? binding.surface}`;
+    return {
+        kind: "connector.revoke",
+        args: { org: binding.org, scopeKey, connector, reason },
+        scopeKey,
+        domain,
+    };
+}
+export default defineTool({
+    description: "Break-glass PROPOSE: cut an Eve connector (by name, e.g. \"notion\") from this surface at runtime — this does NOT revoke anything itself. Posts a confirmation card; an org admin, or a domain admin whose domain covers this scope, must click Approve before the hard gate blocks it (no redeploy needed once approved). Use for incidents (leaked token, abuse) where the change needs to happen NOW, not after a PR review. A revoke is STICKY once approved (no auto-expiry) — revert with clear_connector_override or a PR removing the grant. The posted card IS the reply to the user — do not add any narration, summary, or confirmation text after this call; the channel already sees everything the card says. EXCEPT when this surface can't host a card: it then goes to a card-capable channel in the same domain, the `note` field names it, and you MUST relay that.",
+    inputSchema: z.object({
+        connector: z.string().min(1).describe('Connector name to revoke, e.g. "notion".'),
+        reason: z.string().min(1).describe("Why — shown on the approval card (e.g. \"suspected leaked token\")."),
+        scopeKey: z
+            .string()
+            .optional()
+            .describe('Override the scope key, e.g. "slack/T123/C456". Defaults to this surface\'s own scope.'),
+    }),
+    outputSchema: z.object({
+        requested: z.boolean(),
+        pendingId: z.string(),
+        expiresAt: z.string().optional().describe("Absent when the chain auto-approved: the row is already decided, so nothing expires."),
+        note: z.string(),
+        autoApproved: z.boolean().optional().describe("The approver chain lowered this verb: no card was posted and it has ALREADY run."),
+    }),
+    approval: never(),
+    async execute(input, ctx) {
+        const binding = bindFrom(ctx);
+        // Approver domain = the TARGET scope's explicit domain (see set_spend_limit.ts for
+        // why) — same defaulting expression the plan uses (domain grain — see the plan's
+        // comment), evaluated here because the domain is an input to the plan.
+        const scopeKey = input.scopeKey?.trim() || `${binding.platform}/${binding.workspace}/${binding.domainSurface ?? binding.surface}`;
+        const domain = domainForChannel(scopeKey, getConfig().loadDomains())?.name ?? null;
+        const plan = planRevokeConnector(binding, input, domain);
+        // Where the card goes: this room when it can host one, otherwise a card-capable channel in the SAME domain.
+        // The `channelId` guard that stood here went with it: it refused a surface whose binding carries no channel id, which on a card-less surface is exactly the case the venue walk exists to answer.
+        const venueResult = await checkApprovalVenue(binding, resolvePartition(ctx), () => getConfig().loadDomains());
+        if ("refusal" in venueResult) {
+            throw new Error(describeVenueRefusal(venueResult.refusal, binding.platform, "revoke that connector"));
+        }
+        const venue = venueResult.venue;
+        const posted = await requestApproval({
+            org: plan.args.org,
+            kind: plan.kind,
+            args: plan.args,
+            scopeKey: plan.scopeKey,
+            domain: plan.domain,
+            // The PROVENANCE read on purpose — the card's "asked by" label, guaranteed present by
+            // planRevokeConnector's acting-sender refusal above (see set_spend_limit.ts's execute).
+            requestedBy: principalIdOf(ctx),
+            channelId: venue.channelId,
+            // Thread the card under the asking conversation (see set_spend_limit.ts) — only when the
+            // card IS in that conversation; a cross-venue card posts top-level.
+            threadTs: venue.sameRoom ? binding.threadTs ?? null : null,
+            // Mint-frozen proposing-surface identity (task #105) — the TTL sweep's feedback target,
+            // and the VENUE's key because that is where the card actually is.
+            postedTo: venue.surfaceKey,
+            chain: { unattended: unattendedOf(ctx) },
+        }, 
+        // The VENUE's own CardPoster (OPE-295 item 3, re-anchored by OPE-303) — passing none used to
+        // be safe only because the `slack` literal guaranteed Slack, whose renderer IS
+        // requestApproval's built-in; on a redirect the renderer is the DESTINATION's.
+        approvalPostDeps(venue.platform, ctx));
+        const subject = `revoke "${plan.args.connector}" from "${plan.args.scopeKey}"`;
+        // Chain-lowered (OPE-296) ⇒ no card, the connector is already revoked. NOT internal-only:
+        // with nothing posted, this note is the only report the asker can get (see autoApprovedNote).
+        if (posted.autoApproved) {
+            return {
+                requested: false,
+                autoApproved: true,
+                pendingId: posted.id,
+                note: autoApprovedNote(subject, posted.autoApproved),
+            };
+        }
+        return {
+            requested: true,
+            pendingId: posted.id,
+            expiresAt: posted.expiresAt,
+            // Internal-only WHEN THE CARD IS HERE (it is then the user-facing reply). On a REDIRECT it is
+            // the only report the asker gets — same reason as the auto-approved branch above.
+            note: `${cardPostedPrefix(venue)} — ${subject} (pending ${posted.id}).` + cardPostedTail(venue, "approve it", posted),
+        };
+    },
+});
+//# sourceMappingURL=revoke_connector.js.map

package/dist/agent/tools/revoke_connector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revoke_connector.js","sourceRoot":"","sources":["../../../agent/tools/revoke_connector.ts"],"names":[],"mappings":"AAAA,qOAAqO;AACrO,kQAAkQ;AAElQ,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAuB,MAAM,wBAAwB,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACxH,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAoBxD;;sEAEsE;AACtE,MAAM,UAAU,mBAAmB,CAAC,OAAuB,EAAE,KAA2B,EAAE,MAAqB;IAC7G,gGAAgG;IAChG,iGAAiG;IACjG,2EAA2E;IAC3E,iGAAiG;IACjG,4FAA4F;IAC5F,kGAAkG;IAClG,oEAAoE;IACpE,mGAAmG;IACnG,+FAA+F;IAC/F,oFAAoF;IACpF,EAAE;IACF,kGAAkG;IAClG,iGAAiG;IACjG,+FAA+F;IAC/F,6FAA6F;IAC7F,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,iQAAiQ,CAAC,CAAC;IACrR,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;IACD,gPAAgP;IAChP,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAClI,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE;QACvD,QAAQ;QACR,MAAM;KACP,CAAC;AACJ,CAAC;AAED,eAAe,UAAU,CAAC;IACxB,WAAW,EACT,w1BAAw1B;IAC11B,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,0CAA0C,CAAC;QACjF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,qEAAqE,CAAC;QACzG,QAAQ,EAAE,CAAC;aACR,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CAAC,wFAAwF,CAAC;KACtG,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;QACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sFAAsF,CAAC;QACjI,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kFAAkF,CAAC;KAClI,CAAC;IACF,QAAQ,EAAE,KAAK,EAAE;IACjB,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG;QACtB,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC9B,mFAAmF;QACnF,iFAAiF;QACjF,uEAAuE;QACvE,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QAClI,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,WAAW,EAAE,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;QACnF,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAEzD,4GAA4G;QAC5G,kMAAkM;QAClM,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC9G,IAAI,SAAS,IAAI,WAAW,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC,CAAC;QACxG,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC;QAEhC,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC;YACE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG;YAClB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,sFAAsF;YACtF,wFAAwF;YACxF,WAAW,EAAE,aAAa,CAAC,GAAG,CAAE;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,yFAAyF;YACzF,oEAAoE;YACpE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI;YAC1D,wFAAwF;YACxF,kEAAkE;YAClE,QAAQ,EAAE,KAAK,CAAC,UAAU;YAC1B,KAAK,EAAE,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE;SACzC;QACD,6FAA6F;QAC7F,+EAA+E;QAC/E,+EAA+E;QAC/E,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CACtC,CAAC;QAEF,MAAM,OAAO,GAAG,WAAW,IAAI,CAAC,IAAI,CAAC,SAAS,WAAW,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC;QAC/E,0FAA0F;QAC1F,8FAA8F;QAC9F,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,OAAO;gBACL,SAAS,EAAE,KAAK;gBAChB,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,MAAM,CAAC,EAAE;gBACpB,IAAI,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;aACrD,CAAC;QACJ,CAAC;QACD,OAAO;YACL,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,MAAM,CAAC,EAAE;YACpB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,8FAA8F;YAC9F,kFAAkF;YAClF,IAAI,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,OAAO,aAAa,MAAM,CAAC,EAAE,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC;SACtH,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/dist/agent/tools/revoke_credential_grant.d.ts

@@ -0,0 +1,12 @@
+declare const _default: import("eve/tools").ToolDefinition<{
+    action: "end" | "list";
+    all?: boolean | undefined;
+    grants?: string[] | undefined;
+}, {
+    ended: number;
+    grants: readonly import("../access/credential-grant-revoke.js").OwnerGrantHandle[];
+    live: number;
+    message: string;
+}>;
+export default _default;
+//# sourceMappingURL=revoke_credential_grant.d.ts.map

package/dist/agent/tools/revoke_credential_grant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revoke_credential_grant.d.ts","sourceRoot":"","sources":["../../../agent/tools/revoke_credential_grant.ts"],"names":[],"mappings":""}

package/dist/agent/tools/revoke_credential_grant.js

@@ -0,0 +1,97 @@
+// The owner's route to END a credential grant early (OPE-1637). A grant lends the OWNER's own connector account to one conversation; until this verb shipped, nothing could stop one before its TTL, and three shipped messages told owners otherwise.
+// 🔴 DM-ONLY, AND THE CALLER'S OWN GRANTS ONLY. It takes no owner argument: the acting principal IS the query key, so a person reads and ends what their own account pays for and nothing else. The same standing the approve button earns (access/credential-grant-click.ts), composed through the same composer. The DM wall is the privacy half — a list of the conversations somebody lends their credential to is not a thing to render in a room of their colleagues, which is the §6.2 argument the owner-DM venue already rests on.
+// 🔴 NOT A ROOM-WIDE BUTTON, DELIBERATELY. The borrowing room must never be able to end, or be asked to end, a grant: the decision is the owner's alone, and a control in the room that spends it would put their credential in front of the people spending it.
+import { defineTool } from "eve/tools";
+import { never } from "eve/tools/approval";
+import { z } from "zod";
+import { actingPrincipalIdOf } from "../access/request.js";
+import { ownerGrantHandles, ownerGrantListText, ownerLiveGrants, revokeOwnerGrants } from "../access/credential-grant-revoke.js";
+import { bindFrom } from "../identity/binding.js";
+import { tryPrincipalKey } from "../identity/principal-key.js";
+import { resolvePartition } from "../memory/partition.js";
+export default defineTool({
+    description: "List, or END, the credential grants the person you are talking to is lending — the grants that let another conversation spend THEIR own connector account. " +
+        "DM only, and it only ever reaches that person's own grants. Call it with `list` first: `message` is a numbered list for the person to read, and `grants` pairs each of those numbers with the grant id `end` takes. " +
+        "Ending a grant is immediate and cannot be undone, and its next call on the borrowed tool is refused. I also try to tell the conversation that held it — my answer says when I could not reach one, so relay that too. " +
+        "Relay `message` as it comes back — it is written for the person to read. Never show or repeat a grant id: it is for your next call, and it means nothing to them.",
+    inputSchema: z.object({
+        action: z.enum(["list", "end"]).describe("`list` reads what they are lending and changes nothing. `end` revokes."),
+        all: z
+            .boolean()
+            .optional()
+            .describe("For `end` only: end EVERY grant they are lending. Use it only when they said to end all of them, never as a shortcut for one."),
+        grants: z
+            .array(z.string().min(1))
+            .optional()
+            .describe("For `end` only: the grant ids to end, copied from the `grants` field of a `list` you ran in THIS turn. " +
+            "The person says a NUMBER; you look that number up in `grants` and send its `id`. " +
+            "🔴 NEVER SEND A NUMBER HERE, and never an id you remember from an earlier turn — read the list again first. " +
+            "An id that names nothing live ends nothing and the answer says so, so a repeat of this call is safe."),
+    }),
+    outputSchema: z.object({
+        ended: z.number(),
+        live: z.number(),
+        message: z.string(),
+        // 🔴 THE MACHINE HALF, AND IT IS NOT FOR THE ROOM. `message` is the person's copy and is id-free
+        // by construction; this is the number→id map the next `end` reads. It is returned on `end` too,
+        // rebuilt from what is LEFT, because ending one grant renumbers the rest.
+        grants: z.array(z.object({ id: z.string(), number: z.number().int() })),
+    }),
+    approval: never(),
+    async execute(input, ctx) {
+        const c = ctx;
+        const binding = bindFrom(c);
+        // 🔴 THE DM WALL IS A HARD REFUSAL, in the tool, exactly as the identity trio's is. Grain is not
+        // the control: a DM root is `standing`, so a grain test would admit every channel seat too.
+        if (binding.mode !== "dm") {
+            throw new Error(`revoke_credential_grant is DM-only (this conversation is "${binding.mode}") — which conversations somebody lends their credential to is theirs, ` +
+                "and only in a 1:1 can this deployment be sure it is talking to them. Ask them to send me a direct message.");
+        }
+        // principal-gate: presence — a HUMAN must be here, acting. Their identity IS the authorisation:
+        // there is no other check, because the query only ever reaches their own rows. The read has to be
+        // the one that is undefined on an unattended fire, or a routine could quietly end its creator's
+        // grants.
+        const actor = actingPrincipalIdOf(c);
+        if (actor === undefined) {
+            throw new Error("revoke_credential_grant needs a verified person on this turn — only the person whose credential a grant spends can end it.");
+        }
+        const p = resolvePartition(c);
+        // Composed through the SAME composer the ask and the approve click use. `undefined` is
+        // fail-CLOSED: a deployment that cannot name this person's workspace matches no row, and the copy
+        // says so rather than reporting an empty list as "you lend nothing".
+        const ownerKey = tryPrincipalKey(p.platform, p.workspace, actor);
+        if (ownerKey === undefined) {
+            throw new Error("I cannot tell which workspace this account belongs to, so I cannot look up what you are lending. Nothing was changed. Ask whoever runs this deployment to check the surface configuration.");
+        }
+        const nowMs = Date.now();
+        const stamps = { org: p.org, platform: p.platform, workspace: p.workspace, ...(p.surface === undefined ? {} : { surface: p.surface }) };
+        if (input.action === "list") {
+            const holdings = await ownerLiveGrants(p.org, ownerKey, nowMs);
+            return { ended: 0, grants: ownerGrantHandles(holdings), live: holdings.length, message: ownerGrantListText(holdings) };
+        }
+        // 🔴 `end` NAMES ITS TARGETS EXPLICITLY OR SAYS `all`. An omitted `grants` read as "all" is the one
+        // mistake this schema must not make cheap: a model that meant one grant would end every one of
+        // them, and a revoke cannot be undone.
+        const wantsAll = input.all === true;
+        const named = input.grants ?? [];
+        if (wantsAll === (named.length > 0)) {
+            throw new Error("To end a grant, give either the grant ids from the list (`grants`) or `all: true` — one of the two, never both and never neither. Read the list first.");
+        }
+        // 🔴 IDS, NOT POSITIONS (OPE-1649). `end` used to take the LIST'S NUMBERS and re-resolve them
+        // against a list re-read inside the plane. An eve `execute()` is a plain call inside `turnStep`,
+        // so a step that throws after this line re-runs it and a transport retry does the same — and
+        // "end number 1" run twice ends two different grants. An id re-run matches an already-revoked
+        // row, which is not in the live list, so the repeat ends nothing.
+        //
+        // 🔴 THE `all` ARM IS NOT ID-NAMED, SO IT IS NOT A NO-OP ON REDELIVERY, and this line carries
+        // both arms (cold review, 2026-09-09). `all` passes `undefined`, which the plane reads as "every
+        // row the live list holds NOW" — so a grant approved between the two deliveries is ended by the
+        // second, and nobody named it. The residual is accepted rather than missed: `all` is the owner
+        // saying "everything", the window is one failed step wide, and the only closure is a mandatory
+        // `list` before every `end all`, which is a design choice this ticket does not hold.
+        // 🔴 NEVER REACH FOR `all` AS A SHORTCUT FOR ONE GRANT — the schema says so, and this is why.
+        const outcome = await revokeOwnerGrants(stamps, ownerKey, wantsAll ? undefined : named, nowMs);
+        return { ended: outcome.ended.length, grants: ownerGrantHandles(outcome.remaining), live: outcome.remaining.length, message: outcome.text };
+    },
+});
+//# sourceMappingURL=revoke_credential_grant.js.map

package/dist/agent/tools/revoke_credential_grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revoke_credential_grant.js","sourceRoot":"","sources":["../../../agent/tools/revoke_credential_grant.ts"],"names":[],"mappings":"AAAA,uPAAuP;AACvP,4gBAA4gB;AAC5gB,iQAAiQ;AAEjQ,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AACjI,OAAO,EAAE,QAAQ,EAAwB,MAAM,wBAAwB,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D,eAAe,UAAU,CAAC;IACxB,WAAW,EACT,6JAA6J;QAC7J,sNAAsN;QACtN,wNAAwN;QACxN,mKAAmK;IACrK,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,wEAAwE,CAAC;QAClH,GAAG,EAAE,CAAC;aACH,OAAO,EAAE;aACT,QAAQ,EAAE;aACV,QAAQ,CAAC,+HAA+H,CAAC;QAC5I,MAAM,EAAE,CAAC;aACN,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;aACxB,QAAQ,EAAE;aACV,QAAQ,CACP,yGAAyG;YACvG,mFAAmF;YACnF,8GAA8G;YAC9G,sGAAsG,CACzG;KACJ,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,iGAAiG;QACjG,gGAAgG;QAChG,0EAA0E;QAC1E,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;KACxE,CAAC;IACF,QAAQ,EAAE,KAAK,EAAE;IACjB,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG;QACtB,MAAM,CAAC,GAAG,GAAsB,CAAC;QACjC,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC5B,iGAAiG;QACjG,4FAA4F;QAC5F,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,6DAA6D,OAAO,CAAC,IAAI,yEAAyE;gBAChJ,4GAA4G,CAC/G,CAAC;QACJ,CAAC;QACD,gGAAgG;QAChG,kGAAkG;QAClG,gGAAgG;QAChG,UAAU;QACV,MAAM,KAAK,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC;QACrC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,4HAA4H,CAAC,CAAC;QAChJ,CAAC;QACD,MAAM,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;QAC9B,uFAAuF;QACvF,kGAAkG;QAClG,qEAAqE;QACrE,MAAM,QAAQ,GAAG,eAAe,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACjE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,4LAA4L,CAC7L,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAExI,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC/D,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,iBAAiB,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzH,CAAC;QACD,oGAAoG;QACpG,+FAA+F;QAC/F,uCAAuC;QACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC;QACpC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;QACjC,IAAI,QAAQ,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,wJAAwJ,CACzJ,CAAC;QACJ,CAAC;QACD,8FAA8F;QAC9F,iGAAiG;QACjG,6FAA6F;QAC7F,8FAA8F;QAC9F,kEAAkE;QAClE,EAAE;QACF,8FAA8F;QAC9F,iGAAiG;QACjG,gGAAgG;QAChG,+FAA+F;QAC/F,+FAA+F;QAC/F,qFAAqF;QACrF,8FAA8F;QAC9F,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC/F,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,iBAAiB,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAC9I,CAAC;CACF,CAAC,CAAC"}

package/dist/agent/tools/revoke_routine_permissions.d.ts

@@ -0,0 +1,21 @@
+declare const _default: import("eve/tools").ToolDefinition<{
+    id: string;
+}, {
+    revoked: number;
+    id: string;
+    trigger: string;
+    permissions: string[];
+    message: string;
+}> & {
+    execute(input: {
+        id: string;
+    }, ctx: import("eve/tools").ToolContext): Promise<{
+        revoked: number;
+        id: string;
+        trigger: string;
+        permissions: string[];
+        message: string;
+    }>;
+};
+export default _default;
+//# sourceMappingURL=revoke_routine_permissions.d.ts.map

package/dist/agent/tools/revoke_routine_permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revoke_routine_permissions.d.ts","sourceRoot":"","sources":["../../../agent/tools/revoke_routine_permissions.ts"],"names":[],"mappings":""}

package/dist/agent/tools/revoke_routine_permissions.js

@@ -0,0 +1,72 @@
+// revoke_routine_permissions withdraws a routine's DECLARED permissions from the channel without cancelling the routine. It has to exist because a declared permission is standing AND fires unattended: the only other ways to stop it are rewriting the instruction, which invalidates the set only as a side effect, and cancelling the routine, which stops the work too. Neither is an off switch for the AUTHORITY ALONE.
+// OPEN tier, and structurally so: it only ever REMOVES authority, so afterwards the routine does strictly less on its own and there is no configuration in which running it widens anything — gating it would put a confirmation step in front of the brake pedal. It still requires a verified ACTING principal, for attribution rather than authorization, and that matters more than it sounds: this tool posts NO card, so its effect lands immediately and unattended, and a fire reaching it could quietly put a guarding routine's actions back behind a card nobody is waiting on, then answer "who disarmed it?" with a real person's name. Revocation is by DELETE, never a generation bump, which would also rotate a durable job's seat and re-key it as if its instruction had changed.
+import { defineTool } from "eve/tools";
+import { never } from "eve/tools/approval";
+import { z } from "zod";
+import { resolvePartition } from "../memory/partition.js";
+import { actingPrincipalIdOf } from "../access/request.js";
+import { getRoutine } from "../routines/store.js";
+import { describeTrigger } from "../routines/routine.js";
+import { ROUTINE_PERMISSIONS_REVOKED_ACTION, listRoutinePermissions, revokeRoutinePermissions } from "../routines/declared-permissions.js";
+import { appendAudit } from "../audit/audit.js";
+export default defineTool({
+    description: "Withdraw a routine's STANDING permissions — the things it was allowed to do unattended without asking — while leaving the routine itself running on its schedule. Get the id and see what it currently holds with list_routines. Use when someone wants a routine to go back to asking before it acts ('stop letting the nightly job open PRs'), or is unhappy with what a routine can do on its own. To stop the routine entirely instead, use cancel_routine.",
+    inputSchema: z.object({
+        id: z.string().min(1).describe("The routine id, e.g. 'r-1a2b3c4d' (from list_routines)."),
+    }),
+    outputSchema: z.object({
+        revoked: z.number().describe("How many standing permissions were withdrawn (0 = it already asked for everything)."),
+        id: z.string(),
+        trigger: z.string(),
+        permissions: z.array(z.string()).describe("What it held, in plain language, before this call."),
+        message: z.string(),
+    }),
+    approval: never(),
+    async execute(input, ctx) {
+        const p = resolvePartition(ctx);
+        const id = input.id.trim();
+        // principal-gate: presence — 🔴 this tool posts NO card at all (open tier), so this refusal is the ONLY
+        // control: a fire reaching it disarms a routine silently and blames the creator in the audit row (OPE-272).
+        const requestedBy = actingPrincipalIdOf(ctx);
+        if (!requestedBy) {
+            throw new Error("revoke_routine_permissions needs a verified sender so the audit log can name who withdrew the permissions — a triggered routine fire has no acting sender (only the creator it is attributed to). Ask a person in this conversation to run it.");
+        }
+        // Terminal routines (`disabled` / `done`) are deliberately REVOCABLE: they can be re-armed with
+        // enable_routine, which does NOT bump the generation, so a stopped routine still holds its
+        // standing set and would resume with it. Refusing here would leave exactly that set unreachable.
+        const routine = await getRoutine(p.org, p.surfaceKey, id);
+        if (!routine) {
+            throw new Error(`No routine '${id}' on this surface — check the id with list_routines.`);
+        }
+        // Read BEFORE the delete: the answer a human wants is what they just took away, and after the
+        // delete there is nothing left to describe.
+        const held = await listRoutinePermissions(p.org, routine, new Date().toISOString());
+        // Two counts. `permissions` is the authority withdrawn — what the human is told. `rows` is what the delete actually removed, which also takes the permission card's asked and declined markers.
+        // The AUDIT gates on `rows`: a call that removed only a marker withdrew no authority, but it did destroy a human's durable "never ask me again for this", and a call that leaves no trace of that is the one shape this row exists to prevent.
+        const { permissions: revoked, rows } = await revokeRoutinePermissions(p.org, routine);
+        if (rows > 0) {
+            await appendAudit({
+                org: p.org,
+                platform: p.platform,
+                workspace: p.workspace,
+                surface: p.surface,
+                principalId: requestedBy,
+                action: ROUTINE_PERMISSIONS_REVOKED_ACTION,
+                detail: { id, revokedBy: requestedBy, count: revoked, rows, permissions: held },
+            });
+        }
+        const trigger = describeTrigger(routine.trigger, routine.report);
+        return {
+            revoked,
+            id,
+            trigger,
+            permissions: held,
+            message: revoked > 0
+                ? `routine ${id} no longer has standing permission to ${held.join(" · ")} — it keeps running (${trigger}) and will post an approval card for each of those from now on.`
+                : rows > 0
+                    ? `routine ${id} had no standing permissions — it already asks a human before every gated action. This did clear its permission-card record, so it may ask again on its next fire. It keeps running (${trigger}).`
+                    : `routine ${id} had no standing permissions — it already asks a human before every gated action. It keeps running (${trigger}).`,
+        };
+    },
+});
+//# sourceMappingURL=revoke_routine_permissions.js.map

package/dist/agent/tools/revoke_routine_permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revoke_routine_permissions.js","sourceRoot":"","sources":["../../../agent/tools/revoke_routine_permissions.ts"],"names":[],"mappings":"AAAA,gaAAga;AACha,qwBAAqwB;AAErwB,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,kCAAkC,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAC3I,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,eAAe,UAAU,CAAC;IACxB,WAAW,EACT,icAAic;IACnc,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,yDAAyD,CAAC;KAC1F,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qFAAqF,CAAC;QACnH,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,oDAAoD,CAAC;QAC/F,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;KACpB,CAAC;IACF,QAAQ,EAAE,KAAK,EAAE;IACjB,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG;QACtB,MAAM,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAE3B,wGAAwG;QACxG,4GAA4G;QAC5G,MAAM,WAAW,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,gPAAgP,CACjP,CAAC;QACJ,CAAC;QAED,gGAAgG;QAChG,2FAA2F;QAC3F,iGAAiG;QACjG,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,eAAe,EAAE,sDAAsD,CAAC,CAAC;QAC3F,CAAC;QAED,8FAA8F;QAC9F,4CAA4C;QAC5C,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACpF,gMAAgM;QAChM,+OAA+O;QAC/O,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACtF,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;YACb,MAAM,WAAW,CAAC;gBAChB,GAAG,EAAE,CAAC,CAAC,GAAG;gBACV,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,WAAW,EAAE,WAAW;gBACxB,MAAM,EAAE,kCAAkC;gBAC1C,MAAM,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE;aAChF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACjE,OAAO;YACL,OAAO;YACP,EAAE;YACF,OAAO;YACP,WAAW,EAAE,IAAI;YACjB,OAAO,EACL,OAAO,GAAG,CAAC;gBACT,CAAC,CAAC,WAAW,EAAE,yCAAyC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,wBAAwB,OAAO,iEAAiE;gBACxK,CAAC,CAAC,IAAI,GAAG,CAAC;oBACR,CAAC,CAAC,WAAW,EAAE,wLAAwL,OAAO,IAAI;oBAClN,CAAC,CAAC,WAAW,EAAE,uGAAuG,OAAO,IAAI;SACxI,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/dist/agent/tools/rotate_webhook.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Can a secret be handed to ONE person privately on this platform? Slack only, honestly: its ephemeral post addresses one member in-channel, while Discord's equivalent needs an interaction token that exists only inside the provider's own click handler and is unreachable from a core action's execute.
+ * So Discord is REFUSED here rather than claimed and silently degraded to a channel post that every member — including, on a shared surface, people outside the org — could read.
+ *
+ * 🔴 THIS PREDICATE IS STRICTLY NARROWER THAN `hasApprovalCardPath`, and the gap is load-bearing: it is what makes this tool's card-less refusal unredirectable, and therefore what carves it out of the OPE-325/326 venue sweep. `webhook-provisioning-test.ts` § PRIVATE DELIVERY predicate pins the implication over every known platform. A second private-delivery arm breaks it, and at that moment the card-less redirect becomes reachable and has to be designed rather than assumed away.
+ */
+export declare function hasPrivateDeliveryPath(platform: string): boolean;
+declare const _default: import("eve/tools").ToolDefinition<{
+    source: string;
+}, {
+    rotated: boolean;
+    pending: boolean;
+    pendingId?: string | undefined;
+    source: string;
+    message: string;
+    autoApproved?: boolean | undefined;
+}> & {
+    execute(input: {
+        source: string;
+    }, ctx: import("eve/tools").ToolContext): Promise<{
+        rotated: boolean;
+        pending: boolean;
+        autoApproved: boolean;
+        pendingId: string;
+        source: string;
+        message: string;
+    } | {
+        autoApproved?: undefined;
+        rotated: boolean;
+        pending: boolean;
+        pendingId: string;
+        source: string;
+        message: string;
+    }>;
+};
+export default _default;
+//# sourceMappingURL=rotate_webhook.d.ts.map

package/dist/agent/tools/rotate_webhook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotate_webhook.d.ts","sourceRoot":"","sources":["../../../agent/tools/rotate_webhook.ts"],"names":[],"mappings":"AAgBA;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEhE"}