@open-everywhere/core 0.1.0

package/agent/channels/self-dispatch.ts

@@ -0,0 +1,349 @@
+// self-dispatch — the cross-PROCESS wake-delivery seam. Diverting into the unified window needs eve's cross-channel primitive, which eve hands ONLY to route handlers, so a tool execute running in the durable workflow process structurally could not deliver. A caller that finds no live receive POSTs the full divert payload to the deployment's OWN internal route, and that route re-validates everything and diverts with ITS live primitive.
+// This route can open sessions, so its auth is security-critical: a secret that never leaves the deployment, deliberately NOT the one shared with an external relay, whose acceptance here would widen that relay from "deliver events" to "inject arbitrary wakes"; a fail-closed 404 when unarmed; a constant-time HMAC over the RAW body; a body cap BEFORE the hash; and a signed `issuedAt` freshness bound as the primary anti-replay guard, because a wakeId-keyed dedup cannot be one — the auto-redrive deliberately REUSES a wakeId. The payload is never trusted blindly, and the unified receive re-checks it all again.
+
+import type { RouteHandlerArgs } from "eve/channels";
+import { createHmac } from "node:crypto";
+import { verifyWebhookSignature } from "../webhooks/gate.js";
+import { getConfig } from "../access/config.js";
+import { windowedSupervisorEnabled } from "../memory/domain.js";
+import { isUnifiedSupervisorToken } from "./unified-supervisor.js";
+import { isUnifiedWakeOrigin, type UnifiedWindowWake } from "./unified-window.js";
+import { parseWindowToken, dmAnchorSurfaceForToken } from "./window-key.js";
+import { appendAudit } from "../audit/audit.js";
+import { deploymentOrg, type SurfaceBinding } from "../identity/binding.js";
+import { isFrozenSurfaceBinding } from "../identity/frozen-surface-binding.internal.js";
+import { postOnce, outboundKey } from "../operational/post-once.js";
+import { getOrMintSelfSecret, selfSecretsArmed } from "../credentials/self-secrets.js";
+
+/** The env var this self-shared secret used to require an operator to set — kept as the vault ref's
+ *  suffix and the announced-once on-ramp name (OPE-408 step 3: it now mints on first use). */
+const SPAWN_DISPATCH_SECRET_ENV = "OE_SPAWN_DISPATCH_SECRET";
+
+/** The mounted route path — POST on the unified channel; armed whenever the credential vault is
+ *  armed (OE_CREDENTIAL_ENCRYPTION_KEY) — the secret itself mints on first use, OPE-408 step 3. */
+export const SELF_DISPATCH_PATH = "/eve/v1/unified/dispatch";
+
+/** The HMAC signature header — `sha256=<hex>` over the raw body, same format as every OE ingress. */
+export const SELF_DISPATCH_SIGNATURE_HEADER = "x-oe-dispatch-signature";
+
+/** Body cap, checked BEFORE the HMAC (bounds the cost of an unauthenticated hit). Generous for a
+ *  rendered brief/completion notice + forwarded auth attributes. */
+export const SELF_DISPATCH_MAX_BODY_BYTES = 512 * 1024;
+
+/** Anti-replay skew: a signed body whose `issuedAt` is more than this far from now (either direction)
+ *  is rejected. Generous — the self-call is same-deployment (one clock), so real skew is ~0; this just
+ *  caps a captured-request replay window to minutes instead of "until the secret rotates". */
+const SELF_DISPATCH_MAX_SKEW_MS = 5 * 60 * 1000;
+
+/**
+ * Per-attempt abort timeout for {@link postSelfDispatch}, overridable per call only by the tests.
+ * Raising it still spends wall-clock inside whatever turn dispatches.
+ */
+export const SELF_DISPATCH_TIMEOUT_MS = 15_000;
+
+/** How many times {@link postSelfDispatch} will attempt the POST (initial + one abort-only retry).
+ *  Exported for the same budget reason as {@link SELF_DISPATCH_TIMEOUT_MS}: worst-case hop wall-clock
+ *  is `SELF_DISPATCH_TIMEOUT_MS × SELF_DISPATCH_ATTEMPTS`. */
+export const SELF_DISPATCH_ATTEMPTS = 2;
+
+/**
+ * The full divert payload one dispatch carries — byte for byte the input shape of `divertToUnifiedWindow`, so the HTTP hop is a transparent transport for the exact same delivery.
+ * Every field is HOST-built by the caller, never model-authored, and JSON-safe by construction.
+ */
+export interface UnifiedDispatchPayload {
+  readonly message: string;
+  readonly context?: readonly string[];
+  /** The RAW unified-supervisor/window token (eve prefixes `unified:` on the channel send). */
+  readonly token: string;
+  readonly window: UnifiedWindowWake;
+  readonly surfaceKey: string;
+  readonly auth: { attributes?: Record<string, unknown> };
+  /** Exact host-frozen authority for an internal continuation. Absent on ordinary ingress. */
+  readonly binding?: SurfaceBinding;
+  readonly excludeTaskResultId?: string;
+}
+
+/** The configured shared secret, or undefined (route disarmed / client cannot self-call). */
+export function selfDispatchSecret(env: NodeJS.ProcessEnv = process.env): string | undefined {
+  const v = (env.OE_SPAWN_DISPATCH_SECRET ?? "").trim();
+  return v.length > 0 ? v : undefined;
+}
+
+/**
+ * The deployment's OWN base URL for the self-call, or undefined when undiscoverable. Precedence: an explicit operator override, then the stable production alias, then this deployment's own generated host.
+ * The production alias is canonical and never behind deployment protection; the generated host can be, which is why it is the last resort.
+ */
+export function selfDispatchBaseUrl(env: NodeJS.ProcessEnv = process.env): string | undefined {
+  const explicit = (env.OE_PUBLIC_BASE_URL ?? "").trim();
+  if (explicit.length > 0) {
+    const withScheme = /^https?:\/\//i.test(explicit) ? explicit : `https://${explicit}`;
+    return withScheme.replace(/\/+$/, "");
+  }
+  const host = (env.VERCEL_PROJECT_PRODUCTION_URL ?? "").trim() || (env.VERCEL_URL ?? "").trim();
+  return host.length > 0 ? `https://${host.replace(/\/+$/, "")}` : undefined;
+}
+
+/**
+ * Can this process self-call at all — the vault armed plus a resolvable base URL? That is the CLIENT's precondition; the ROUTE needs only the vault.
+ * Sync, because minting never fails once the vault is armed, so "configured" no longer depends on an operator having set the env var at all.
+ */
+export function selfDispatchConfigured(env: NodeJS.ProcessEnv = process.env): boolean {
+  return selfSecretsArmed() && selfDispatchBaseUrl(env) !== undefined;
+}
+
+/** Sign a raw body — the client half of the route's `verifyWebhookSignature` check. */
+export function signSelfDispatchBody(secret: string, body: string): string {
+  return "sha256=" + createHmac("sha256", secret).update(body, "utf8").digest("hex");
+}
+
+function json(status: number, body: unknown): Response {
+  return new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } });
+}
+
+/**
+ * Structurally validate a decoded body into a {@link UnifiedDispatchPayload}, every field checked fail-closed.
+ * The payload crossed a process boundary, and authenticity is not well-formedness. It returns the typed payload, or an error string for the 400.
+ */
+export function parseSelfDispatchPayload(v: unknown): { payload: UnifiedDispatchPayload } | { error: string } {
+  if (typeof v !== "object" || v === null || Array.isArray(v)) return { error: "body must be a JSON object" };
+  const b = v as Record<string, unknown>;
+  if (typeof b.message !== "string" || b.message.length === 0) return { error: "`message` must be a non-empty string" };
+  if (b.context !== undefined && (!Array.isArray(b.context) || !b.context.every((c) => typeof c === "string"))) {
+    return { error: "`context` must be an array of strings when present" };
+  }
+  if (typeof b.token !== "string" || !isUnifiedSupervisorToken(b.token)) {
+    return { error: "`token` must be a unified-supervisor window token" };
+  }
+  if (typeof b.surfaceKey !== "string" || b.surfaceKey.length === 0) return { error: "`surfaceKey` must be a non-empty string" };
+  const w = b.window as Record<string, unknown> | undefined;
+  if (typeof w !== "object" || w === null) return { error: "`window` must be an object" };
+  if (typeof w.wakeId !== "string" || w.wakeId.length === 0) return { error: "`window.wakeId` must be a non-empty string" };
+  if (!isUnifiedWakeOrigin(w.origin)) return { error: "`window.origin` must be a valid UnifiedWakeOrigin" };
+  if (w.addressing !== undefined && w.addressing !== "direct-mention") {
+    return { error: '`window.addressing` must be "direct-mention" or absent' };
+  }
+  const auth = b.auth as Record<string, unknown> | undefined;
+  if (typeof auth !== "object" || auth === null || Array.isArray(auth)) return { error: "`auth` must be an object" };
+  if (auth.attributes !== undefined && (typeof auth.attributes !== "object" || auth.attributes === null || Array.isArray(auth.attributes))) {
+    return { error: "`auth.attributes` must be a plain object when present" };
+  }
+  if (b.binding !== undefined && !isFrozenSurfaceBinding(b.binding)) {
+    return { error: "`binding` must be a valid frozen surface binding when present" };
+  }
+  if (b.excludeTaskResultId !== undefined && (typeof b.excludeTaskResultId !== "string" || b.excludeTaskResultId.length === 0)) {
+    return { error: "`excludeTaskResultId` must be a non-empty string when present" };
+  }
+  return {
+    payload: {
+      message: b.message,
+      ...(b.context !== undefined ? { context: b.context as string[] } : {}),
+      token: b.token,
+      window: {
+        wakeId: w.wakeId,
+        origin: w.origin,
+        ...(w.addressing === "direct-mention" ? { addressing: "direct-mention" as const } : {}),
+      },
+      surfaceKey: b.surfaceKey,
+      auth: { ...(auth.attributes !== undefined ? { attributes: auth.attributes as Record<string, unknown> } : {}) },
+      ...(b.binding !== undefined ? { binding: b.binding } : {}),
+      ...(b.excludeTaskResultId !== undefined ? { excludeTaskResultId: b.excludeTaskResultId } : {}),
+    },
+  };
+}
+
+/** The divert dependency the route hands the handler — channels/unified.ts passes
+ *  `divertToUnifiedWindow` (injected, not imported, so this module never imports unified.ts —
+ *  no cycle; the test injects a capture). */
+export type SelfDispatchDivert = (to: RouteHandlerArgs["to"], input: UnifiedDispatchPayload) => Promise<void>;
+
+/**
+ * Read the request body with a HARD byte ceiling: a `Content-Length` fast-reject, then a bounded incremental drain that aborts the moment the accumulated byte count crosses the cap — so a self-host with no platform body cap cannot be made to buffer an unbounded body.
+ * Bytes are accumulated and decoded ONCE at the end, so a multi-byte UTF-8 sequence split across chunk boundaries round-trips exactly; the HMAC is verified over this string.
+ */
+export async function readCappedBody(req: Request, maxBytes: number): Promise<{ body: string } | { tooLarge: true }> {
+  // Fast reject: an honestly-declared oversized Content-Length never needs the stream opened. A missing or
+  // lying header is caught by the streamed cap below, so this is a cheap optimisation, not the security boundary.
+  const declared = req.headers.get("content-length");
+  if (declared !== null) {
+    const n = Number(declared);
+    if (Number.isFinite(n) && n > maxBytes) return { tooLarge: true };
+  }
+  const stream = req.body;
+  if (!stream) {
+    // No readable stream (empty/absent body). text() has nothing unbounded to read; still length-check the result.
+    const body = await req.text();
+    return Buffer.byteLength(body, "utf8") > maxBytes ? { tooLarge: true } : { body };
+  }
+  const reader = stream.getReader();
+  const chunks: Buffer[] = [];
+  let total = 0;
+  try {
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      if (!value) continue;
+      total += value.byteLength;
+      if (total > maxBytes) {
+        await reader.cancel().catch(() => undefined); // stop the peer streaming more; drop what we have
+        return { tooLarge: true };
+      }
+      chunks.push(Buffer.from(value.buffer, value.byteOffset, value.byteLength));
+    }
+  } finally {
+    try {
+      reader.releaseLock();
+    } catch {
+      /* already released */
+    }
+  }
+  return { body: Buffer.concat(chunks).toString("utf8") };
+}
+
+/**
+ * Handle the internal cross-process dispatch ingress. Transport-neutral over a WHATWG Request; `to` is the route's live eve cross-channel primitive.
+ * Statuses: 404 disarmed, 413 oversized, 401 missing, bad or stale signature, 400 malformed payload or a window-disabled surface, 500 divert failure, 200 dispatched.
+ */
+export async function handleSelfDispatch(
+  req: Request,
+  to: RouteHandlerArgs["to"],
+  divert: SelfDispatchDivert,
+  env: NodeJS.ProcessEnv = process.env,
+): Promise<Response> {
+  // Gate 1: armed only when the vault can mint/hold the secret — else the route does not exist (404).
+  // A SYNC check only — no vault round trip here, so an unauthenticated hit still 404s at zero cost
+  // when the vault is off.
+  if (!selfSecretsArmed()) return new Response("not found", { status: 404 });
+
+  // The size cap runs BEFORE anything that costs real work, the vault round trip included: there is no reason to hash, or to mint a secret for, unauthenticated megabytes about to be rejected.
+  // The read itself is bounded, so an oversized body is rejected without ever being buffered — a memory-DoS guard for a self-host with no platform body cap.
+  const read = await readCappedBody(req, SELF_DISPATCH_MAX_BODY_BYTES);
+  if ("tooLarge" in read) {
+    return json(413, { error: `payload exceeds ${SELF_DISPATCH_MAX_BODY_BYTES} bytes` });
+  }
+  const rawBody = read.body;
+
+  // Constant-time HMAC over the raw body. The secret resolves HERE, not at the first gate: the vault round trip is real work an unauthenticated oversized-body request must never trigger, so cheap rejection stays cheap.
+  // The signature and the secret are never logged or echoed.
+  const secret = await getOrMintSelfSecret(SPAWN_DISPATCH_SECRET_ENV, { env });
+  if (!verifyWebhookSignature(secret, rawBody, req.headers.get(SELF_DISPATCH_SIGNATURE_HEADER))) {
+    return json(401, { error: "unauthorized: missing or invalid dispatch signature" });
+  }
+
+  let decoded: unknown;
+  try {
+    decoded = JSON.parse(rawBody);
+  } catch {
+    return json(400, { error: "invalid JSON body" });
+  }
+
+  // FRESHNESS: the signed body carries an epoch-ms `issuedAt`, HMAC-covered and so unforgeable once past the signature gate. Rejecting a stale or future-dated body caps the replay window of a captured signed request.
+  // It is read off the raw decoded object — a transport-envelope field, not part of the divert payload, which the parser strips.
+  const issuedAt = (decoded as { issuedAt?: unknown } | null)?.issuedAt;
+  if (typeof issuedAt !== "number" || !Number.isFinite(issuedAt) || Math.abs(Date.now() - issuedAt) > SELF_DISPATCH_MAX_SKEW_MS) {
+    return json(401, { error: "unauthorized: missing or stale dispatch timestamp" });
+  }
+
+  const parsed = parseSelfDispatchPayload(decoded);
+  if ("error" in parsed) return json(400, { error: parsed.error });
+  const payload = parsed.payload;
+
+  // The single-window gates must hold for the target surface, fail-closed on any config error. The unified receive re-checks and refuses again regardless, so this is the friendly 400.
+  // The DM ANCHOR carve-in is the SAME one the receive gate carries: a DM-anchored session rides a window on a pseudo-domain that is itself a surface key, so admission is a byte-exact self-consistency check rather than a config read, and it admits a DM's own sessions into that DM and nothing else. Both gates read one seam, so the derivation cannot drift — but the DECISION either side of it still has to be kept in step by hand.
+  let windowOk = false;
+  try {
+    const dmAnchorSurface = dmAnchorSurfaceForToken(payload.token);
+    if (dmAnchorSurface !== undefined) {
+      windowOk = dmAnchorSurface === payload.surfaceKey;
+    } else {
+      const domains = getConfig().loadDomains();
+      // Any standing window enables the surface (both `mode: "solo"` and `mode: "unified"` divert through
+      // the synthetic `unified` channel). Gate-off ⇒ false ⇒ byte-identical fail-closed refusal.
+      windowOk = windowedSupervisorEnabled(payload.surfaceKey, domains);
+    }
+  } catch {
+    windowOk = false;
+  }
+  if (!windowOk) {
+    return json(400, { error: `no standing window (mode solo / unified) is enabled for surfaceKey "${payload.surfaceKey}" — refusing (fail-closed)` });
+  }
+
+  // Self-audit BEFORE the divert — ids only, never message text / attributes / the signature.
+  const org = deploymentOrg();
+  await appendAudit({
+    org,
+    platform: "unified",
+    workspace: parseWindowToken(payload.token)?.domain ?? "unknown",
+    action: "unified.self_dispatch",
+    detail: {
+      wakeId: payload.window.wakeId,
+      surfaceKey: payload.surfaceKey,
+      platform: payload.window.origin.platform,
+      addressed: payload.window.addressing === "direct-mention",
+      messageChars: payload.message.length,
+      ...(payload.excludeTaskResultId ? { excludeTaskResultId: payload.excludeTaskResultId } : {}),
+    },
+  }).catch(() => undefined);
+
+  // HTTP-HOP IDEMPOTENCY: the same signed request can arrive more than once. A wakeId dedup would be WRONG, because the auto-redrive deliberately REUSES the original wakeId, so the per-hop identity is the RAW SIGNED BODY — an HTTP retry resends the exact same bytes and dedupes, while a deliberate redrive stamps a fresh `issuedAt` and is never suppressed.
+  // The TTL is the freshness skew window, which covers the entire span in which a replay is even accepted. FAIL-OPEN: a dedupe-store outage proceeds with the divert, because an at-least-once double-spawn is an acceptable cost and a dropped wake is not.
+  const hopKey = outboundKey({ surface: "unified", channel: payload.surfaceKey, action: "self-dispatch", payload: rawBody });
+  try {
+    const outcome = await postOnce<"dispatched" | "deduped">({
+      org,
+      key: hopKey,
+      ttlMs: SELF_DISPATCH_MAX_SKEW_MS,
+      run: async () => {
+        await divert(to, payload);
+        return "dispatched";
+      },
+      skipped: () => "deduped",
+    });
+    return json(200, { ok: true, wakeId: payload.window.wakeId, ...(outcome === "deduped" ? { deduped: true } : {}) });
+  } catch (err) {
+    return json(500, { error: `dispatch failed: ${err instanceof Error ? err.message : String(err)}` });
+  }
+}
+
+/**
+ * The CLIENT half — POST a dispatch payload to this deployment's own dispatch route, called when no live cross-channel receive is available in this process.
+ * It THROWS on any failure with an instructive, secret-free message, and the callers decide loud versus best-effort.
+ */
+export async function postSelfDispatch(
+  payload: UnifiedDispatchPayload,
+  deps: { env?: NodeJS.ProcessEnv; fetchImpl?: typeof fetch; timeoutMs?: number } = {},
+): Promise<void> {
+  const env = deps.env ?? process.env;
+  const base = selfDispatchBaseUrl(env);
+  if (!base || !selfSecretsArmed()) {
+    throw new Error(
+      "self-dispatch is not configured on this deployment — arm OE_CREDENTIAL_ENCRYPTION_KEY (and set OE_PUBLIC_BASE_URL when the deployment URL isn't discoverable from VERCEL_URL/VERCEL_PROJECT_PRODUCTION_URL).",
+    );
+  }
+  const secret = await getOrMintSelfSecret(SPAWN_DISPATCH_SECRET_ENV, { env });
+  // `issuedAt` is stamped INTO the signed body, an envelope field the handler reads raw and strips, so the route can bound the replay window.
+  // Built ONCE: an abort-retry resends these EXACT bytes, so the route's hop-dedupe suppresses it if the aborted first attempt had actually landed, and re-delivers it if it never reached the server.
+  const body = JSON.stringify({ ...payload, issuedAt: Date.now() });
+  const url = `${base}${SELF_DISPATCH_PATH}`;
+  const headers = { "content-type": "application/json", [SELF_DISPATCH_SIGNATURE_HEADER]: signSelfDispatchBody(secret, body) };
+  const doFetch = deps.fetchImpl ?? fetch;
+  const timeoutMs = deps.timeoutMs ?? SELF_DISPATCH_TIMEOUT_MS;
+
+  // Retry ONCE, and ONLY on an abort or network error, where the outcome is INDETERMINATE and the divert may or may not have landed.
+  // A non-2xx is a DEFINITE server verdict, so resending identical bytes would be pointless or, on a 500 whose key the route already marked, wrongly deduped — those throw immediately.
+  let lastErr: unknown;
+  for (let attempt = 0; attempt < SELF_DISPATCH_ATTEMPTS; attempt++) {
+    let res: Response;
+    try {
+      res = await doFetch(url, { method: "POST", headers, body, signal: AbortSignal.timeout(timeoutMs) });
+    } catch (err) {
+      lastErr = err;
+      continue; // indeterminate — retry once with the identical signed body (the route dedupes a landed dispatch)
+    }
+    if (!res.ok) {
+      const text = await res.text().catch(() => "");
+      throw new Error(`self-dispatch POST to ${url} returned ${res.status}: ${text.slice(0, 200)}`);
+    }
+    return; // 2xx — done
+  }
+  throw new Error(`self-dispatch POST to ${url} failed: ${lastErr instanceof Error ? lastErr.message : String(lastErr)}`);
+}

package/agent/channels/session-park.ts

@@ -0,0 +1,252 @@
+// session-park — the LIVENESS remedy for a standing seat that reaches eve's session-token bound. eve does not FAIL there, and that is verified rather than assumed: OE satisfies BOTH of the park arm's disjuncts, because it never passes a non-default `mode` and the send path sets the request-input capability, so the FAIL arm — the sole producer of the session-token-limit code and message — is UNREACHABLE from every OE surface, which is why the send-rejection classifier that used to exist never fired. `scripts/session-park-test.ts` pins the dist fragments structurally. eve instead emits a harness-authored continuation prompt and PARKS the workflow. Nothing answers that prompt, so the parked seat NEVER SPEAKS AGAIN — with no audit row, no notice and no rotation, silence is the failure mode, which is exactly why nothing surfaced it.
+// The remedy RETIRES THE GENERATION rather than inventing a mechanism: it saturates the rotation counter every surface's front already consults before it delivers the next wake, so the seat rotates through its own established path. It never answers the prompt with `continue`, which would grant a fresh budget on the same session and re-park forever, and it does not redeliver the parked message. A session with no `channel_session` row cannot be rotated and gets the audit row with `remedy: "none"`, so the event is visible instead of silent.
+
+import { appendAudit, type AuditInput } from "../audit/audit.js";
+import { getOperationalStore } from "../operational/provider.js";
+import type { OperationalStore } from "../operational/store.js";
+import { supervisorRotateTokenBudget } from "./turn-delivery.js";
+import { DM_SEAT_ROTATE_TOKEN_BUDGET } from "./dm-seat.js";
+import { standingSeatRegistryKey } from "./unified-supervisor.js";
+
+/** eve's synthetic tool name on a harness-authored session-limit continuation prompt
+ *  (harness/session-limit-continuation.js SESSION_LIMIT_CONTINUATION_TOOL_NAME). A STABLE STRING
+ *  CONSTANT, not a minified local — safe to match on, and pinned in session-park-test.ts. */
+export const SESSION_LIMIT_CONTINUATION_TOOL_NAME = "session_limit_continuation";
+
+/** eve's request-id grammar for the TOKEN-COUNT bounds (`<sessionId>:limit:input|output:<total>`).
+ *
+ *  🔴 NOTHING IN THE DETECTOR CALLS THIS. `detectSessionLimitPark` discriminates on the TOOL NAME
+ *  alone, deliberately, so a future eve that keeps the name and re-shapes the id still detects the
+ *  park. This constant is a PINNED MIRROR of eve's grammar, and `session-park-test.ts` is its only
+ *  consumer: the test asserts OE's source is byte-identical to eve's, so a drift in eve's id shape
+ *  reds there instead of silently rotting a comment. Read it as a drift tripwire, not a live guard —
+ *  an earlier version of this doc called it a "corroborating signal", which implied a runtime read
+ *  that has never existed.
+ *
+ *  🔴 TWO CONSTANTS, NOT ONE ALTERNATION, AND THE FLAGS ARE PART OF THE MIRROR. eve keeps these as
+ *  two separate regexes with DIFFERENT flags — the count arm is `/u`, the cost arm is `/iu`. Folding
+ *  them into one `/…|…/iu` would make OE accept `:LIMIT:INPUT:5`, which eve's own predicate rejects,
+ *  so the tripwire would no longer be a mirror. Keep each arm byte-identical to its eve counterpart
+ *  and OR them in {@link isSessionLimitRequestId}, exactly as eve's predicate does. */
+export const SESSION_LIMIT_REQUEST_ID_RE = /:limit:(?:input|output):\d+$/u;
+
+/** eve's request-id grammar for the TOKEN-COST bound (eve 0.51.1). A dollar figure, so it may carry
+ *  a decimal point or an exponent — and `i` because eve's own cost pattern carries `i`. */
+export const SESSION_LIMIT_COST_REQUEST_ID_RE = /:limit:token-cost:\d+(?:\.\d+)?(?:e[+-]?\d+)?$/iu;
+
+/** eve's `isSessionLimitContinuationRequestId`, mirrored: either bound's grammar. */
+export function isSessionLimitRequestId(requestId: string): boolean {
+  return SESSION_LIMIT_REQUEST_ID_RE.test(requestId) || SESSION_LIMIT_COST_REQUEST_ID_RE.test(requestId);
+}
+
+/** The durable audit action for "a session parked on eve's token bound". Actions-only log: this is
+ *  the ONE record that a standing seat stopped being able to answer, and (when it applies) that OE
+ *  retired the generation in response — there is no conversation to reconstruct it from. */
+export const SESSION_PARK_AUDIT_ACTION = "session.token_limit_park";
+
+/**
+ * At most one park row per (org, registry key or token) per window. A seat that CAN rotate parks at most once more before its front re-keys it.
+ * A seat that cannot rotate would otherwise write a row on every subsequent wake.
+ */
+export const PARK_AUDIT_WINDOW_MS = 60 * 60_000;
+
+/**
+ * The counter delta that RETIRES a standing seat's current generation on the spot. DERIVED, not a magic number: the bump adds to a non-negative total, so adding the LARGEST token budget in the tree guarantees the sum reaches whichever threshold `shouldRotate` is called with. Read at call time, so it tracks any env override.
+ * This is the one place the cumulative-token counter is not a measurement at all: it is a deliberate signal, written by us, meaning "this generation is spent".
+ */
+export function parkRotateDelta(): number {
+  return Math.max(supervisorRotateTokenBudget(), DM_SEAT_ROTATE_TOKEN_BUDGET);
+}
+
+/** What eve told us about the violation, off the continuation prompt's `action.input`. Ids and
+ *  counts only — the prompt TEXT is never carried into an audit row. */
+export interface SessionLimitPark {
+  /** Which bound was hit. `"unknown"` when a future eve stops carrying `kind`.
+   *  `"token-cost"` is eve 0.51.1's per-session model SPEND bound, in dollars — a third bound that
+   *  parks through this same path, and the one the numbers below are shaped differently for. */
+  readonly kind: "input" | "output" | "token-cost" | "unknown";
+  /** The configured TOKEN limit, when eve carried a numeric one. A token-count bound only. */
+  readonly limit?: number;
+  /** Window-relative tokens used at the violation, when eve carried a numeric one. Token-count only. */
+  readonly usedTokens?: number;
+  /** The configured COST limit in USD, when eve carried a numeric one. A `"token-cost"` bound only.
+   *  🔴 A SEPARATE FIELD, never folded into `limit`. Dollars and tokens differ by six orders of
+   *  magnitude, so one field would make an audit row's number unreadable without its `kind`. */
+  readonly limitUsd?: number;
+  /** Model spend in USD at the violation, when eve carried a numeric one. `"token-cost"` only. */
+  readonly usedCostUsd?: number;
+  /** eve's request id for the prompt (`<sessionId>:limit:<kind>:<total>`) — the stable handle. */
+  readonly requestId: string;
+}
+
+function numberOrUndefined(v: unknown): number | undefined {
+  return typeof v === "number" && Number.isFinite(v) ? v : undefined;
+}
+
+/**
+ * Is ONE entry of an `input.requested` batch eve's harness-authored session-limit continuation prompt? THE discrimination between eve's PARK and every other kind of input request, in one place.
+ * TWO CONSUMERS, ONE PREDICATE: the park detector selects the requests this module owns and channels/question-bridge.ts selects the complement, so no request is ever handled twice — or, the failure this closes, by neither. Defensive by design, because it runs on a turn that has already parked, where a shape drift must degrade to a verdict rather than throw.
+ */
+export function isSessionLimitContinuationRequest(request: unknown): boolean {
+  if (request === null || typeof request !== "object") return false;
+  return (request as { action?: { toolName?: unknown } }).action?.toolName === SESSION_LIMIT_CONTINUATION_TOOL_NAME;
+}
+
+/**
+ * Is this `input.requested` batch eve's session-token-limit park? It returns the violation when it is, and `undefined` for every other input request.
+ * Those are NOT this module's to remedy — the question bridge posts them to the originating surface — and the detector must never claim one.
+ */
+export function detectSessionLimitPark(requests: unknown): SessionLimitPark | undefined {
+  if (!Array.isArray(requests)) return undefined;
+  for (const r of requests as readonly unknown[]) {
+    if (!isSessionLimitContinuationRequest(r)) continue;
+    const req = r as { requestId?: unknown; action?: { toolName?: unknown; input?: unknown } };
+    const requestId = typeof req.requestId === "string" ? req.requestId : "";
+    // TWO ACTION-INPUT SHAPES, because eve mints two. A token-COUNT violation carries
+    // `{kind, limit, usedTokens}`; a token-COST violation carries `{kind, limitUsd, usedCostUsd}`
+    // (harness/session-limit-continuation.js, pinned structurally in session-park-test.ts §4).
+    // Read BOTH pairs unconditionally: each is absent on the other kind, so a shape drift that
+    // moved a number degrades to "no number" rather than to a wrong one.
+    const input = (req.action?.input ?? {}) as {
+      kind?: unknown;
+      limit?: unknown;
+      usedTokens?: unknown;
+      limitUsd?: unknown;
+      usedCostUsd?: unknown;
+    };
+    const kind =
+      input.kind === "input" || input.kind === "output" || input.kind === "token-cost" ? input.kind : "unknown";
+    const limit = numberOrUndefined(input.limit);
+    const usedTokens = numberOrUndefined(input.usedTokens);
+    const limitUsd = numberOrUndefined(input.limitUsd);
+    const usedCostUsd = numberOrUndefined(input.usedCostUsd);
+    return {
+      kind,
+      ...(limit !== undefined ? { limit } : {}),
+      ...(usedTokens !== undefined ? { usedTokens } : {}),
+      ...(limitUsd !== undefined ? { limitUsd } : {}),
+      ...(usedCostUsd !== undefined ? { usedCostUsd } : {}),
+      requestId,
+    };
+  }
+  return undefined;
+}
+
+/** What the handler did, so the hook can log it and a test can assert it without a live store. */
+export type ParkRemedy =
+  /** A standing seat's generation was retired — the next wake rotates through the surface's front. */
+  | "rotate_on_next_wake"
+  /** A standing seat's registry row did not match the token (a rotation-boundary straggler, or the
+   *  row is already gone) — nothing to retire, and nothing to fix: the live generation is not this
+   *  parked one. Audited so a SYSTEMATIC miss is visible rather than silent. */
+  | "already_rotated"
+  /** No registry row exists for this session kind (thread seat / task / native) — audit only. */
+  | "none";
+
+export interface ParkOutcome {
+  readonly remedy: ParkRemedy;
+  /** The `channel_session` key the remedy targeted, when there was one. */
+  readonly registryKey?: string;
+  /** False when the audit row was suppressed by the throttle (the event still happened). */
+  readonly audited: boolean;
+}
+
+/** The partition + session identity a park is recorded against — exactly what a hook already holds. */
+export interface ParkScope {
+  readonly org: string;
+  readonly platform: string;
+  readonly workspace: string;
+  readonly surface: string;
+  /** The domain-grain key a per-container supervisor's registry row lives under (memory/partition.ts
+   *  domainKeyOf) — the same grain hooks/spend.ts bumps. */
+  readonly domainKey: string;
+  /** The BARE OE-minted continuation token (window-key.ts bareTokenFromEveContext), or the raw
+   *  context token for a native/foreign session. */
+  readonly token: unknown;
+  /** eve's session id, for the audit row (→ the transcript route). */
+  readonly sessionId?: string;
+}
+
+/** Injectable edges — live defaults are the operational store + appendAudit + the wall clock. */
+export interface ParkDeps {
+  readonly store?: Pick<OperationalStore, "bumpChannelSessionUsage" | "markEventSeen">;
+  readonly audit?: (entry: AuditInput) => Promise<void>;
+  readonly now?: () => Date;
+}
+
+/**
+ * The throttle identity. Both parts are OE-derived: the org, and either a derived registry key or an OE- or eve-minted token.
+ * Never a model- or vendor-supplied string, so a hostile stream cannot mint fresh keys to defeat the throttle.
+ */
+export function parkThrottleKey(registryKey: string | undefined, token: unknown): string {
+  return `sessionpark:${registryKey ?? `token:${typeof token === "string" ? token : "unknown"}`}`;
+}
+
+/**
+ * Handle ONE detected session-limit park: retire the standing seat's generation, so the next wake rotates, and write the durable row.
+ * Best-effort throughout, in the house posture: a store or audit failure is logged and swallowed, because this runs inside a hook on a turn that has already parked. The remedy is attempted BEFORE the audit, so the row can report what actually happened.
+ */
+export async function handleSessionLimitPark(scope: ParkScope, park: SessionLimitPark, deps: ParkDeps = {}): Promise<ParkOutcome> {
+  const store = deps.store ?? getOperationalStore();
+  const registryKey = standingSeatRegistryKey(scope.token, scope.domainKey);
+  const token = typeof scope.token === "string" ? scope.token : undefined;
+
+  let remedy: ParkRemedy = "none";
+  if (registryKey !== undefined && token !== undefined) {
+    try {
+      const matched = await store.bumpChannelSessionUsage(scope.org, registryKey, token, parkRotateDelta());
+      remedy = matched > 0 ? "rotate_on_next_wake" : "already_rotated";
+    } catch (err) {
+      // The remedy failed, but the row below still records the park — a park we know about and
+      // could not remedy is exactly the case an operator must be able to see.
+      console.warn(`[open-everywhere:session-park] generation retire failed for ${registryKey}: ${String(err)}`);
+      remedy = "already_rotated";
+    }
+  }
+
+  const nowIso = (deps.now?.() ?? new Date()).toISOString();
+  const throttleKey = parkThrottleKey(registryKey, scope.token);
+  // FAIL-OPEN on a throttle-store error — emit the row (routines/fire-audit.ts's rationale: the
+  // throttle and the append hit the same store, so failing closed would silence a genuine event).
+  let first = true;
+  try {
+    first = await store.markEventSeen(scope.org, throttleKey, nowIso, PARK_AUDIT_WINDOW_MS);
+  } catch {
+    first = true;
+  }
+  if (!first) return { remedy, ...(registryKey !== undefined ? { registryKey } : {}), audited: false };
+
+  await (deps.audit ?? appendAudit)({
+    org: scope.org,
+    platform: scope.platform,
+    workspace: scope.workspace,
+    surface: scope.surface,
+    // No acting human — eve's harness parked the turn — so a synthetic, low-cardinality service
+    // identity, the same posture routines/fire-audit.ts takes for an autonomous fire.
+    principalId: "eve:harness",
+    action: SESSION_PARK_AUDIT_ACTION,
+    detail: {
+      // Ids, counts and OE-controlled enums only. eve's `prompt` text is NOT carried.
+      remedy,
+      kind: park.kind,
+      requestId: park.requestId,
+      ...(park.limit !== undefined ? { limit: park.limit } : {}),
+      ...(park.usedTokens !== undefined ? { usedTokens: park.usedTokens } : {}),
+      // The COST bound's own pair. The action name stays `session.token_limit_park` for all three
+      // bounds — one action, one query — and `kind` is what tells a spend park from a token park.
+      ...(park.limitUsd !== undefined ? { limitUsd: park.limitUsd } : {}),
+      ...(park.usedCostUsd !== undefined ? { usedCostUsd: park.usedCostUsd } : {}),
+      ...(scope.sessionId !== undefined ? { sessionId: scope.sessionId } : {}),
+      ...(registryKey !== undefined ? { registryKey } : {}),
+      ...(token !== undefined ? { token } : {}),
+      note:
+        remedy === "rotate_on_next_wake"
+          ? "the seat's generation was retired — the next wake rotates to a fresh session; the parked message was NOT redelivered"
+          : remedy === "already_rotated"
+            ? "no live registry row matched this token — the generation had already been retired/rotated"
+            : "this session has no channel_session row (thread seat / task / native) — it cannot be rotated and will not answer again; start a fresh thread",
+    },
+  }).catch(() => undefined);
+
+  return { remedy, ...(registryKey !== undefined ? { registryKey } : {}), audited: true };
+}

package/agent/channels/session-resume.ts

@@ -0,0 +1,36 @@
+// session-resume — the classifier for a durable session the current eve runtime can NEVER resume, as opposed to one that failed once and would succeed on a retry. The condition is permanent, so it wants a new generation, not a retry.
+// This seam never sees the failure itself: it throws in the queue-triggered turn, below eve's harness, and emits no userland event. The remedy is pre-dispatch rotation in channels/runtime-rotation.ts.
+
+/** eve's message for a run whose event ids the current runtime cannot read positions out of. The
+ *  ONE such string in the installed eve dist (0.38.3, compiled/_chunks/workflow) — matched as a
+ *  substring so the variable event id in the middle of the sentence does not defeat it. */
+export const UNREADABLE_WORLD_MESSAGE = "This World allocates event positions the runtime cannot read";
+
+/** The narrower half of the same sentence. Kept as a SECOND required marker rather than a second
+ *  accepted alternative: both must appear, so a future message that merely mentions a slot number in
+ *  another context cannot trip the classifier on its own. */
+export const SLOT_NUMBERED_MARKER = "not slot-numbered";
+
+/**
+ * eve's stable error CODE for a fatal break of the World contract the runtime needs.
+ * eve redelivers a RECOVERABLE world blip down a different path, so this code denotes the non-retryable half of the world-error family.
+ */
+export const WORLD_CONTRACT_ERROR_CODE = "WORLD_CONTRACT_ERROR";
+
+/**
+ * Is this failure the UNRESUMABLE class — a session no retry can resume? Pure, total and fail-soft: a non-string message classifies FALSE, because a true verdict throws away a window's accumulated context.
+ * Two independent positives: the message carries BOTH markers of the unreadable-World sentence, or the code is eve's `WORLD_CONTRACT_ERROR`. Nothing else matches.
+ */
+export function isUnresumableSessionError(message: unknown, code?: unknown): boolean {
+  if (typeof code === "string" && code === WORLD_CONTRACT_ERROR_CODE) return true;
+  if (typeof message !== "string" || message.length === 0) return false;
+  return message.includes(UNREADABLE_WORLD_MESSAGE) && message.includes(SLOT_NUMBERED_MARKER);
+}
+
+/**
+ * The audit `detail` fragment that LABELS a failure row with this verdict, spread into the existing supervisor failure rows so the class is queryable without a new action.
+ * Always present, never conditional: `unresumable: false` states that OE looked and said no, where an absent field would read as "not measured".
+ */
+export function unresumableAuditDetail(message: unknown, code?: unknown): { unresumable: boolean } {
+  return { unresumable: isUnresumableSessionError(message, code) };
+}