@open-everywhere/core 0.1.0

package/agent/channels/command-registration.ts

@@ -0,0 +1,165 @@
+// THE SURFACE-COMMAND RECONCILE PLANE (OPE-1687) — how a deployment's own slash commands reach the
+// vendor without an operator running anything.
+//
+// WHAT IT HOLDS. A chat platform that carries slash commands keeps its command list on the VENDOR's
+// side, not in the deployment. The code declares a command set; the vendor holds whatever the last
+// write left there. The two drift the moment the code changes, and until this plane existed the only
+// thing that closed the gap was an operator CLI (`scripts/register-discord-commands.ts`) that runs on
+// a box holding the bot token. A deployment holds that token; the operator often does not. So a
+// declared command reached the vendor only by a step nobody could take, and `/oe rate` shipped
+// invisible.
+//
+// THE INVARIANT: the DEPLOYMENT reconciles its own declared command set, once per process start, and
+// a reconcile that changes nothing writes nothing. Two halves meet here:
+//
+//   • the APP declares WHERE (`declareSurfaceCommandScope`) — the rooms this deployment registers
+//     its commands into. A Discord guild id is a TRACKED literal under Tommy's ruling of 2026-09-07
+//     (config lives in Git and changes by PR; env keeps infrastructure only), so the declaration is a
+//     config module, never a variable;
+//   • the PROVIDER BUNDLE declares HOW (`registerSurfaceCommandReconciler`) — the vendor call that
+//     compares and writes. Core names no vendor and holds no command shape.
+//
+// `reconcileSurfaceCommands()` is the app's ONE boot call that joins them, and it is the same posture
+// the other boot-time checks in `agent/lib/register-adapters.ts` carry: AVAILABILITY OVER INTEGRITY,
+// never throws. A deployment must boot and serve turns even when the vendor's command API is down —
+// the worst outcome of a failed reconcile is a stale command list, which is exactly the state the
+// deployment was already in.
+//
+// 🔴 WHY BOOT AND NOT A DEPLOY RUNG. A control route the deploy chain calls would work and costs one
+// more moving part: a route, a token and a rung inside `scripts/deploy/`. Boot needs none of them and
+// lands at the same moment anyway — `deploy:verify` probes the deployment over HTTP right after the
+// alias moves, and that probe IS the cold start this plane rides. The cost is bounded and stated: one
+// vendor read per process start, and a write only on a real difference. A deployment that declares no
+// scope pays nothing at all.
+//
+// 🔴 A DECLARATION THAT REGISTERS NOWHERE IS REFUSED. `declareSurfaceCommandScope` throws on an empty
+// scope list, the same fail-loud posture `registerSurfaces` takes on a line that would grant nothing:
+// a config line that silently does nothing is how a command set stays unregistered for a month.
+
+import { admitProviderRegistration } from "../access/provider-selection.js";
+
+/** Where one platform registers this deployment's commands. */
+export interface SurfaceCommandScope {
+  /**
+   * The platform-native rooms to register into — a Discord GUILD id. At least one entry; each is a
+   * tracked literal from the app's config, never an env value.
+   *
+   * A room-scoped registration appears in that room INSTANTLY. The vendor-wide ("global") scope is
+   * deliberately not expressible here: on Discord it takes up to an hour to propagate, which no
+   * boot-time reconcile can prove, so it stays the operator CLI's job.
+   */
+  readonly scopes: readonly string[];
+}
+
+/** What one platform's reconcile did. `skipped` = it could not run and that is not an error. */
+export type SurfaceCommandStatus = "unchanged" | "updated" | "skipped" | "failed" | "unsupported";
+
+export interface SurfaceCommandOutcome {
+  readonly status: SurfaceCommandStatus;
+  /**
+   * One human-readable line for the boot log. 🔴 NEVER a credential and never a vendor response
+   * body — a bot token and an error payload both reach the log through this field or not at all.
+   */
+  readonly detail: string;
+}
+
+/** A bundle's reconcile: compare the declared set against what the vendor holds, write on a
+ *  difference. MUST NOT throw — the plane logs what it returns. */
+export type SurfaceCommandReconciler = (scope: SurfaceCommandScope) => Promise<SurfaceCommandOutcome>;
+
+const SCOPES = new Map<string, SurfaceCommandScope>();
+const RECONCILERS = new Map<string, SurfaceCommandReconciler>();
+
+/**
+ * Declare the rooms `platform` registers this deployment's commands into. Called from the app's
+ * config-as-code, so every failure here is a fail-LOUD config error: a malformed line is a line
+ * nobody reviewed correctly, and accepting it would register nothing while looking configured.
+ *
+ * Re-declaring a platform REPLACES its scope, matching every other `register*` seam in this tree.
+ */
+export function declareSurfaceCommandScope(platform: string, scope: SurfaceCommandScope): void {
+  const key = typeof platform === "string" ? platform.trim() : "";
+  if (key.length === 0) {
+    throw new Error("declareSurfaceCommandScope: the platform must be a non-empty name (e.g. \"discord\").");
+  }
+  const seen = new Set<string>();
+  for (const raw of scope.scopes) {
+    const entry = typeof raw === "string" ? raw.trim() : "";
+    if (entry.length === 0) {
+      throw new Error(`declareSurfaceCommandScope("${key}"): a scope entry is blank. Every entry names one room (a Discord guild id).`);
+    }
+    if (seen.has(entry)) {
+      throw new Error(`declareSurfaceCommandScope("${key}"): scope "${entry}" is listed twice. A room is registered once.`);
+    }
+    seen.add(entry);
+  }
+  if (seen.size === 0) {
+    throw new Error(
+      `declareSurfaceCommandScope("${key}"): the scope list is empty, so this declaration would register the commands nowhere. Name at least one room, or delete the declaration.`,
+    );
+  }
+  SCOPES.set(key, { scopes: [...seen] });
+}
+
+/**
+ * Register the vendor half for `platform`. A bundle calls this from its own `register*Provider()`.
+ * Refused — and the platform stays absent from this plane — when the provider is not in this
+ * deployment's declared selection.
+ */
+export function registerSurfaceCommandReconciler(platform: string, reconciler: SurfaceCommandReconciler): void {
+  if (!admitProviderRegistration(platform, "surface-command-reconciler")) return;
+  RECONCILERS.set(platform, reconciler);
+}
+
+/** The declared scope for `platform`, or undefined. The reconciler's own tests read it. */
+export function surfaceCommandScopeFor(platform: string): SurfaceCommandScope | undefined {
+  return SCOPES.get(platform);
+}
+
+export interface SurfaceCommandReport {
+  readonly platform: string;
+  readonly outcome: SurfaceCommandOutcome;
+}
+
+/**
+ * THE BOOT CALL. Run every declared platform's reconcile and log ONE line per platform.
+ *
+ * 🔴 NEVER THROWS, and never rejects. A reconciler that throws anyway is reported as `failed` with
+ * its message — the deployment boots either way, because a stale command list is a smaller failure
+ * than a deployment that will not answer.
+ *
+ * A platform with a declared scope and NO reconciler is reported `unsupported` and warned loudly:
+ * that is an operator who named a room on a platform this deployment does not carry, and a silent
+ * skip there is the "configured but doing nothing" state this plane exists to end.
+ */
+export async function reconcileSurfaceCommands(deps: { readonly log?: (line: string) => void } = {}): Promise<readonly SurfaceCommandReport[]> {
+  const log = deps.log ?? ((line: string): void => console.info(line));
+  const reports: SurfaceCommandReport[] = [];
+  for (const [platform, scope] of [...SCOPES.entries()].sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))) {
+    const reconciler = RECONCILERS.get(platform);
+    let outcome: SurfaceCommandOutcome;
+    if (reconciler === undefined) {
+      outcome = {
+        status: "unsupported",
+        detail: `no command reconciler is registered for "${platform}" — the declaration in the app's config names a platform this deployment does not carry, so nothing was registered.`,
+      };
+    } else {
+      try {
+        outcome = await reconciler(scope);
+      } catch (err) {
+        outcome = { status: "failed", detail: `the reconciler threw: ${err instanceof Error ? err.message : String(err)}` };
+      }
+    }
+    reports.push({ platform, outcome });
+    const line = `[open-everywhere:command-registration] ${platform}: ${outcome.status} — ${outcome.detail}`;
+    if (outcome.status === "failed" || outcome.status === "unsupported") console.warn(line);
+    else log(line);
+  }
+  return reports;
+}
+
+/** Test-only: drop every declaration and reconciler so a suite can start from an empty plane. */
+export function resetSurfaceCommandRegistryForTest(): void {
+  SCOPES.clear();
+  RECONCILERS.clear();
+}

package/agent/channels/context-render.ts

@@ -0,0 +1,206 @@
+// context-render — the platform-neutral core behind every surface's "give the model the surrounding conversation" enrichment: the ContextLine shape and speaker attribution, the count and char caps, the oldest-first render, the untrusted wrap, and the "since the agent last spoke" slice. The raw-message mapping and the read-more hint's tool names stay with their platform and are fed in.
+// UNTRUSTED BY PROVENANCE: every rendered line was written by arbitrary channel members, so the whole block is wrapped and the model must treat it as DATA, never instructions. That is a SECURITY invariant, and it lives here so every surface that renders context is fenced identically. Any read-more hint is OUR trusted instruction, so it is appended OUTSIDE the wrap.
+
+import { ingestUntrusted } from "../access/untrusted.js";
+import { noteIngestionVerdict } from "../access/taint-enforcement.js";
+import { taintMarkLands } from "../access/taint-signal.js";
+import { UNAUTH_SYSTEM_NOTE, type WakeMessageInput, type WakeTrust } from "./wake-envelope.js";
+import type { AuthorTrustQuery } from "../identity/author-trust.js";
+import { redactMachineLinkCodes } from "../identity/link-challenge.js";
+
+// Bounds on what we INJECT (the full history stays reachable on demand via per-surface read
+// tools where they exist). Caps both count and characters so a long channel can't blow the
+// turn's context budget. 10 auto-loaded messages orients the model without dumping a backscroll.
+export const MAX_MESSAGES = 10;
+export const MAX_CHARS = 12_000;
+
+// The count cap the WAKE and backscroll fetchers request from the platform API.
+// A separate named constant from MAX_MESSAGES so it can be tuned independently — a wake fires far more often than a mention — even though the two currently agree. renderContext still applies MAX_MESSAGES and MAX_CHARS on top as a second bound.
+export const WAKE_BACKSCROLL_MAX = 10;
+
+/** Structured speaker attribution — kept explicit (never flattened to a bare id) so a
+ * multi-party transcript can't drift speakers, and the model can tell the agent's own voice
+ * from humans and other bots. */
+export type SenderType = "user" | "bot" | "agent" | "unknown";
+
+export interface ContextLine {
+  readonly senderType: SenderType;
+  /** Platform user id (for `user`) or bot id (for `bot`); omitted for `agent`/`unknown`. */
+  readonly senderId?: string;
+  /** A per-line identifier (Slack ts / Discord message id) — opaque here, used for ordering upstream. */
+  readonly ts: string;
+  readonly text: string;
+  /**
+   * Per-line wake-trust tier. Absent means UNGRADED, which is still legal: a surface's regrade step is a caller-side ADDITION, never a required one.
+   * A line resolved `"unauth"` renders its reference-only teaching note and is a candidate for the taint join via {@link contextLineIngestion}.
+   */
+  readonly trust?: WakeTrust;
+  /**
+   * The surface POSITIVELY refuted this author's membership — a separate field from `trust` rather than something re-derived from it.
+   * The RENDER never reads it: a refuted line's attribution prefix is byte-identical to any other `unauth` line's. Two readers do — the taint join, and {@link contextLinesNotInEnvelope}, which exempts a refuted line from the once-only render because the envelope's copy of that message may be graded by a different leg, or by none.
+   */
+  readonly refuted?: boolean;
+  /**
+   * The OPERATOR's author-trust register query for this line's author — Discord's and Notion's only per-author refutation, since neither surface can answer the membership question itself.
+   * Read ONLY by the taint join's register leg. It never demotes `trust`: the register is a JOIN-only fact.
+   */
+  readonly authorTrust?: AuthorTrustQuery;
+}
+
+/**
+ * Map one {@link ContextLine} onto the taint join's per-message input shape. All three fields are read from the SAME line the render reads, so the render and the join can never disagree about one line.
+ * The return is structural rather than typed, to avoid a core-to-core import cycle: access/taint-signal.ts already imports this module.
+ */
+export function contextLineIngestion(l: ContextLine): { readonly trust?: WakeTrust; readonly refuted?: boolean; readonly authorTrust?: AuthorTrustQuery } {
+  return { trust: l.trust, refuted: l.refuted, authorTrust: l.authorTrust };
+}
+
+/**
+ * ONE WAKE RENDERS EACH ROOM MESSAGE ONCE (OPE-1743). A seated name-drop wake reads the room TWICE — the seat's own since-last-wake catch-up, rendered as envelope SIBLINGS, and the name-drop hydration, rendered inside the untrusted CONTEXT block — and for a seat that woke minutes ago but last replied an hour ago the first set sits INSIDE the second. Left alone the model is served each overlapping message twice, under two different attributions.
+ * This drops the hydration's copy of every message the envelope already carries, matched on the message id. 🔴 THE CALLER OWES ONE NAMESPACE: it must pass an envelope whose `id`s and lines whose `ts` are the same kind of value. That holds where both are the platform's own message id — a Slack `ts`, a Discord message id — and NOT everywhere: GitHub's and Linear's supervisors build a context line's `ts` from an issue label (`#123`, `OPE-1`), which no sibling id ever equals, so a match there would never fire. THE ENVELOPE WINS where both copies are policed the same way: its siblings carry per-message author, trust tier and send time, while a context line carries an attribution prefix alone, so keeping the envelope copy loses no framing.
+ * Order is kept, and a message the envelope does NOT carry stays — the hydration's whole point is the older conversation the catch-up window never reached.
+ *
+ * 🔴 A POSITIVELY REFUTED AUTHOR'S LINE IS EXEMPT (OPE-1742), AND THE REASON IS ATTRIBUTION, NOT CONTAINMENT — DO NOT READ IT AS A SECURITY CONTROL. "The envelope copy loses no framing" is what licenses the drop, and for a refuted author that premise fails: the two slots are withheld by DIFFERENT legs — the envelope's siblings by `withholdsBody` over each message's own resolved facts (access/external-policy.ts), this slot by the hydration's per-author probe (`withholdWakeBodies`, `excludedAuthorId`) — and the two can disagree. The two Slack envelope arms disagree differently, and both were measured:
+ *  • the FETCHED arm carries the refutation. `regradeSlackBackscrollTrust` sets `refuted: true` on the sibling, so `withholdsBody` withholds the envelope copy as well. Here the exemption changes the COUNT and nothing else.
+ *  • the TAIL arm carries the refutation TOO, since OPE-1747: a tail row records `refuted` and `authorTrust` through `tailAuthorGrain`, and `tailEntryToWakeMessage` copies both, so `withholdsBody` withholds a tail-borne copy exactly as it withholds a fetched one. A row persisted BEFORE that field existed carries no `refuted` at all and rides as `ungraded: true`, which the withhold grain reads as the fail-closed answer — so it is withheld rather than shown, never graded "not refuted". WHAT STILL LICENSES THE EXEMPTION on those facts: the hydrated copy is the only one carrying THIS route's own regrade, and the two slots are still withheld by different legs — the envelope's by `withholdsBody` over each message's resolved facts, this slot by the hydration's per-author probe — so the two can still disagree about one message.
+ * THE COST, STATED: one duplicated line per positively-refuted author per wake, capped like every other line by {@link MAX_MESSAGES} — and on the SHIPPED `taint` grain both copies are VERBATIM, which is the double render OPE-1743 exists to remove. The exemption is a deliberate carve-out from that rule for the one author class whose two copies are not interchangeable.
+ */
+export function contextLinesNotInEnvelope(lines: readonly ContextLine[], envelope: readonly WakeMessageInput[]): ContextLine[] {
+  if (lines.length === 0 || envelope.length === 0) return [...lines];
+  const rendered = new Set(envelope.map((m) => m.id));
+  return lines.filter((l) => l.refuted === true || !rendered.has(l.ts));
+}
+
+/**
+ * THE TWO SLICES ONE HYDRATION PRODUCES, and the ORDER that produces them (OPE-1749).
+ * The order is the whole point: DE-DUPLICATE against the envelope FIRST, cap SECOND. Capping first
+ * spends the count budget on lines the de-duplication then drops, so a wake whose envelope overlaps
+ * the hydration renders a SHALLOW block — ten lines fetched, five dropped, five rendered — while five
+ * older messages the envelope never carried sit just outside the cap.
+ */
+export interface HydrationSlices {
+  /** WHAT RENDERS: the lines not already in the envelope, capped to the count and char budget. */
+  readonly rendered: ContextLine[];
+  /**
+   * WHAT INGESTED, for the taint join — the rendered lines PLUS the lines the de-duplication dropped, in the caller's original order.
+   * The two differ for a reason on each side. A DE-DUPLICATED line's bytes DID enter, through the envelope sibling that replaced it, and only the hydrated copy carries the regrade's `refuted` fact — so it stays in the join. A CAP-DROPPED line's bytes entered NOWHERE, so it must not: a join over a message that did not ingest would claim an exposure that did not happen.
+   */
+  readonly ingested: ContextLine[];
+}
+
+/**
+ * Resolve a hydration's two slices in the ONE order that is correct (OPE-1749). Pure.
+ *
+ * 🔴 THE ORDER LIVES HERE, IN CORE, AND NOWHERE ELSE. Every surface hydrates through this module and
+ * through {@link renderContext}, so an order decided inside one provider's route is an order the other
+ * five drift from — which is exactly what happened: Slack's name-drop road capped inside its hydrator
+ * and de-duplicated in its route, two files apart. {@link renderWake} applies this road for every
+ * surface, and the call is IDEMPOTENT, so a surface that resolved its own slices first loses nothing.
+ *
+ * 🔴 THE READ-MORE HINT IS KEYED TO {@link HydrationSlices.rendered}, AND THIS ORDER IS WHAT MAKES THAT
+ * HONEST. `renderContext` appends the hint only when the kept slice FILLS the count cap — a claim that
+ * there is more history to fetch. Under cap-then-de-duplicate the rendered slice fell short of the cap
+ * whenever the envelope overlapped, so the one wake that had MOST history to point at was the wake
+ * that suppressed the hint. De-duplicating first fills the cap whenever enough non-duplicate lines
+ * exist, so the hint now fires on exactly the wakes that have more to read. Driving the hint off the
+ * PRE-de-duplication length would have claimed a cap the render did not hit, so the hint stays keyed to
+ * what rendered and the ORDER is what was wrong.
+ */
+export function hydrationSlices(
+  lines: readonly ContextLine[],
+  envelope: readonly WakeMessageInput[],
+  opts: { readonly maxMessages?: number; readonly maxChars?: number } = {},
+): HydrationSlices {
+  const deduped = contextLinesNotInEnvelope(lines, envelope);
+  const rendered = capLines(deduped, opts);
+  const kept = new Set<ContextLine>(rendered);
+  // Only the lines the CAP dropped leave the join. `capLines` also drops an empty-text line, which
+  // belongs on this side too: a line that rendered nothing ingested nothing.
+  const droppedByCap = new Set<ContextLine>(deduped.filter((l) => !kept.has(l)));
+  return { rendered, ingested: lines.filter((l) => !droppedByCap.has(l)) };
+}
+
+// Structured, unambiguous attribution prefix for one line.
+// `trust=unauth` is appended ONLY where the regrade step demoted this line, so an ungraded or member-authored line's attribution is byte-identical to before the field existed.
+function attribution(l: ContextLine): string {
+  const trustPart = l.trust === "unauth" ? " trust=unauth" : "";
+  if (l.senderType === "agent") return "[sender_type=agent]";
+  if (l.senderId) return `[sender_type=${l.senderType} sender_id=${l.senderId}${trustPart}]`;
+  return `[sender_type=${l.senderType}${trustPart}]`;
+}
+
+/**
+ * Render the gathered lines into ONE untrusted-wrapped context entry, or null when empty. `lines` must be oldest-first, and the MOST RECENT are kept when over the count or char budget.
+ * `opts.readMoreHint` is appended AFTER the untrusted block, and only when the rendered slice fills MAX_MESSAGES exactly: it is OUR trusted instruction and must never sit inside the wrap where channel content lives. A surface with no read tools passes no hint.
+ */
+export function renderContext(
+  lines: readonly ContextLine[],
+  source: string,
+  opts: { readonly readMoreHint?: string } = {},
+): string | null {
+  const kept: string[] = [];
+  let chars = 0;
+  let hasUnauth = false;
+  // Keep the MOST RECENT messages when over budget (drop from the top), then restore order.
+  for (let i = lines.length - 1; i >= 0 && kept.length < MAX_MESSAGES; i--) {
+    const l = lines[i];
+    // A user's claim must remain intact for the link-claim hook. Every other sender class is a
+    // machine/unknown history projection, never evidence for a claim, so a host-posted bearer code
+    // is removed before this side-channel context reaches the model.
+    const text = (l.senderType === "user" ? l.text : redactMachineLinkCodes(l.text)).trim();
+    if (!text) continue;
+    const rendered = `${attribution(l)} ${text}`;
+    if (chars + rendered.length > MAX_CHARS && kept.length > 0) break;
+    chars += rendered.length;
+    kept.unshift(rendered);
+    if (l.trust === "unauth") hasUnauth = true;
+  }
+  if (kept.length === 0) return null;
+  const body = `Recent conversation (oldest first), for context:\n${kept.join("\n")}`;
+  // RENDER-TIME INGESTION FENCES, NEVER TAINTS, BY DESIGN. Backscroll is composed in the ingress process, outside any turn context, so the taint half no-ops here every time — which is the wanted behaviour: chat-message content is TRUSTED by the ratified source-tier table, and tainting the conversation the agent is sitting in is the always-on bit that was removed.
+  // The verdict is DECLARED as a separate call and reports `taintsToday` from the RUNTIME rather than from a hardcoded claim: no context means silent agreement with the trusted row, a context means an over-taint row saying this render has started running in-turn. The wrap below carries no `ingestion:` opt on purpose, because the table would then SILENCE that alarm instead of raising it.
+  noteIngestionVerdict({ kind: "chat-message", label: "context-render" }, taintMarkLands());
+  const wrapped = ingestUntrusted(body, { source });
+  // The hint sits after the untrusted block's own trailing notice — unambiguously ours, not part of the channel transcript it describes — and only when the slice hit the cap and a hint was given.
+  // The trusted unauth teaching note rides BEFORE it, driven by the STRUCTURED `trust` field on a rendered line, so a hostile body cannot fake it.
+  const withNote = hasUnauth ? `${wrapped}\n\n${UNAUTH_SYSTEM_NOTE}` : wrapped;
+  return kept.length === MAX_MESSAGES && opts.readMoreHint ? `${withNote}\n\n${opts.readMoreHint}` : withNote;
+}
+
+/**
+ * Cap a line list to a count and total-chars budget, keeping the MOST RECENT lines — the same trim-and-restore-order algorithm {@link renderContext} runs internally.
+ * For a caller that needs the CAPPED LINES themselves rather than a rendered, wrapped string — Slack's name-drop hydration caps its thread leg with this AFTER the domain's admission policy has run (OPE-1744). `renderContext` keeps its own copy so its live paths carry no regression risk.
+ */
+export function capLines(
+  lines: readonly ContextLine[],
+  opts: { readonly maxMessages?: number; readonly maxChars?: number } = {},
+): ContextLine[] {
+  const maxMessages = opts.maxMessages ?? MAX_MESSAGES;
+  const maxChars = opts.maxChars ?? MAX_CHARS;
+  const kept: ContextLine[] = [];
+  let chars = 0;
+  for (let i = lines.length - 1; i >= 0 && kept.length < maxMessages; i--) {
+    const l = lines[i];
+    const text = l.text.trim();
+    if (!text) continue;
+    if (chars + text.length > maxChars && kept.length > 0) break;
+    chars += text.length;
+    kept.unshift(l);
+  }
+  return kept;
+}
+
+/**
+ * Keep only what a warm conversation would have shown SINCE the agent last spoke: a resumed session already holds everything up to and including its own last reply, and re-injecting it is waste that can confuse the model about what is new.
+ * When the agent never spoke here there is no boundary, so it keeps everything and the caller's count cap trims to the recent tail. Pure over ContextLine[], so every surface's fetcher shares it.
+ */
+export function sinceLastAgentReply(lines: readonly ContextLine[]): ContextLine[] {
+  let lastAgent = -1;
+  for (let i = lines.length - 1; i >= 0; i--) {
+    if (lines[i].senderType === "agent") {
+      lastAgent = i;
+      break;
+    }
+  }
+  return lastAgent >= 0 ? lines.slice(lastAgent + 1) : [...lines];
+}

package/agent/channels/control-mcp.ts

@@ -0,0 +1,44 @@
+// Deployment mount for the control plane's MCP WRITE transport and the small OAuth 2.1
+// authorization server that guards it (OPE-72). All behaviour lives in control/mcp-route.ts,
+// control/oauth-route.ts and control/oauth-resource.ts.
+//
+// FAIL-CLOSED AS A WHOLE, AT TWO CONDITIONS AND THEN A THIRD. Every route here answers 404 unless
+// BOTH OE_CONTROL_OAUTH_SIGNING_SECRET is set (and at least 32 characters) AND CONTROL_OAUTH_ISSUER
+// is declared in tracked config (control/oauth-clients.ts) — until then the plane is off and does
+// not disclose that the seam exists. With both set, the routes exist: the discovery documents are
+// published and the mount answers 401. A caller still needs an access token this deployment's own
+// authorization server minted for a registered client, and that registry is EMPTY until a pull
+// request adds one — so arming the secret and the issuer alone issues nothing.
+//
+// This mount is the WRITE side. The read side (channels/control-read.ts) keeps its own disjoint
+// service-token family and is untouched by this plane — neither credential opens the other's door.
+
+import { defineChannel, DELETE, GET, POST } from "eve/channels";
+import { CONTROL_MCP_PATH, handleControlMcpRequest } from "../control/mcp-route.js";
+import { CONTROL_PROTECTED_RESOURCE_METADATA_PATH } from "../control/oauth-resource.js";
+import {
+  CONTROL_OAUTH_AUTHORIZE_PATH,
+  CONTROL_OAUTH_SERVER_METADATA_PATH,
+  CONTROL_OAUTH_TOKEN_PATH,
+  handleAuthorize,
+  handleAuthorizationServerMetadata,
+  handleProtectedResourceMetadata,
+  handleToken,
+} from "../control/oauth-route.js";
+
+export default defineChannel({
+  routes: [
+    // RFC 8414 / RFC 9728 discovery — unauthenticated by design (both documents are public
+    // metadata), but still 404 while the plane is unarmed.
+    GET(CONTROL_OAUTH_SERVER_METADATA_PATH, async (req) => handleAuthorizationServerMetadata(req)),
+    GET(CONTROL_PROTECTED_RESOURCE_METADATA_PATH, async (req) => handleProtectedResourceMetadata(req)),
+    // The authorization server.
+    GET(CONTROL_OAUTH_AUTHORIZE_PATH, async (req) => handleAuthorize(req)),
+    POST(CONTROL_OAUTH_TOKEN_PATH, async (req) => handleToken(req)),
+    // The resource server. GET and DELETE are part of the MCP Streamable HTTP contract (stream
+    // re-attach and session teardown); both pass the same token gate as POST.
+    POST(CONTROL_MCP_PATH, async (req) => handleControlMcpRequest(req)),
+    GET(CONTROL_MCP_PATH, async (req) => handleControlMcpRequest(req)),
+    DELETE(CONTROL_MCP_PATH, async (req) => handleControlMcpRequest(req)),
+  ],
+});

package/agent/channels/control-read.ts

@@ -0,0 +1,37 @@
+// Deployment mount for the control plane's READ side; all behaviour lives in control/read-route.ts.
+// Every route is service-token-authed (OE_CONTROL_READ_TOKENS) and fails closed with a 404 when no token is configured. GET only, and read-route.ts imports no write tool, so the write side is structurally unreachable from this mount.
+
+import { defineChannel, GET } from "eve/channels";
+import {
+  CONTROL_READ_AUDIT_PATH,
+  CONTROL_READ_USAGE_PATH,
+  CONTROL_READ_UNIFIED_AUDIT_PATH,
+  CONTROL_READ_TRANSCRIPT_PATH,
+  CONTROL_READ_RUNTIME_SIGNAL_PATH,
+  CONTROL_READ_MODEL_CALLS_PATH,
+  CONTROL_READ_MODEL_CALL_SESSIONS_PATH,
+  handleAuditWindowRead,
+  handleUsageWindowRead,
+  handleUnifiedAuditRead,
+  handleSessionTranscriptRead,
+  handleRuntimeSignalRead,
+  handleSessionModelCallsRead,
+  handleModelCallSessionsRead,
+} from "../control/read-route.js";
+
+export default defineChannel({
+  routes: [
+    GET(CONTROL_READ_USAGE_PATH, async (req) => handleUsageWindowRead(req)),
+    GET(CONTROL_READ_AUDIT_PATH, async (req) => handleAuditWindowRead(req)),
+    GET(CONTROL_READ_UNIFIED_AUDIT_PATH, async (req) => handleUnifiedAuditRead(req)),
+    // `:sessionId` matches into `args.params` (routes.d.ts); `args.attachSession` is eve's public
+    // read-only session API (eve/channels). Read-only, self-audited, fail-closed like the siblings.
+    GET(CONTROL_READ_TRANSCRIPT_PATH, async (req, { attachSession, params }) => handleSessionTranscriptRead(req, attachSession, params)),
+    // The deploy-time signal `deploy:census` reads for the dynamic-tool-roster refresh.
+    GET(CONTROL_READ_RUNTIME_SIGNAL_PATH, async (req) => handleRuntimeSignalRead(req)),
+    // The soak lane's prefix-replay harvest — empty unless `soak.capture` was armed for the run, transcript-grade when it was, and gated identically to its siblings.
+    GET(CONTROL_READ_MODEL_CALLS_PATH, async (req, { params }) => handleSessionModelCallsRead(req, params)),
+    // The retention operator's session-discovery read: it lists which sessions hold captures, and returns no body byte.
+    GET(CONTROL_READ_MODEL_CALL_SESSIONS_PATH, async (req) => handleModelCallSessionsRead(req)),
+  ],
+});

package/agent/channels/credential-intake-page.ts

@@ -0,0 +1,12 @@
+// Deployment mount for the credential-intake page; the behaviour lives in credentials/intake-page.ts.
+// Both routes fail closed (404) until the credential vault is armed, and the signing key is memoised per process — a rotation reaches a warm process only at restart.
+
+import { defineChannel, GET, POST } from "eve/channels";
+import { INTAKE_PAGE_PATH, handleIntakePageGet, handleIntakePagePost } from "../credentials/intake-page.js";
+
+export default defineChannel({
+  routes: [
+    GET(INTAKE_PAGE_PATH, async (req) => handleIntakePageGet(req)),
+    POST(INTAKE_PAGE_PATH, async (req) => handleIntakePagePost(req)),
+  ],
+});