@open-everywhere/create 0.1.4

package/template/.env.example

@@ -0,0 +1,58 @@
+# Copy to .env.local (it is gitignored) and fill in. eve loads .env and .env.local.
+#
+# Variable NAMES only. Never commit a value. .env.local never ships: the deployment reads its OWN
+# environment. The full setup path, including which variables the deployment needs and how to copy
+# each one without printing it, is the generated reference page:
+# https://github.com/open-everywhere/open-everywhere/blob/main/docs/deploy/setup-steps.md
+# (README.md § "Set it up" is the one-screen version.) Two routes are supported: Vercel and Docker.
+
+# --- Models: the Vercel AI Gateway ---
+# A deployed VERCEL project authenticates to the gateway with OIDC and needs no key. Everything
+# else does: a local run, and the DOCKER route, where there is no OIDC. Running a different model
+# backend instead is an adapter swap in app code, not an env setting (docs/extending/adapter-model.md).
+# Create a key at: Vercel dashboard -> AI Gateway -> API Keys.
+AI_GATEWAY_API_KEY=
+
+# --- The operational store, memory and the credential store ---
+# A DEPLOYMENT needs ONE value here: DATABASE_URL. On Vercel a function's disk is ephemeral, and a
+# replaced Docker container starts from an empty volume, so without it core throws at the first
+# store or DM-memory use. On the Vercel route add Neon from the Marketplace
+# (`npx vercel install neon`, or project -> Storage -> Neon -> Connect): it sets DATABASE_URL on the
+# project. Copy the same value here so the operator tools (`npx oe secret`, the ops server's
+# `secret_set`) write the store the deployment reads. A local run needs nothing: it uses an embedded
+# database under .open-everywhere-data/.
+DATABASE_URL=
+# 🔴 NOT REQUIRED (OPE-2230). A present DATABASE_URL resolves BOTH stores to postgres on its own, so
+# there is no selector to set and nothing to push to the deployment. These two are an OVERRIDE only
+# — and a selector pointing AWAY from postgres is the one thing that breaks the resolution.
+# OE_OPERATIONAL_PROVIDER=postgres
+# OE_MEMORY_PROVIDER=postgres
+# A base64-encoded 32-byte AES-256 key that encrypts stored credentials. The deployment and the
+# operator tools need the same value. This command appends a fresh one to .env.local without printing it:
+#   node -e "console.log('OE_CREDENTIAL_ENCRYPTION_KEY=' + require('crypto').randomBytes(32).toString('base64'))" >> .env.local
+# OE_CREDENTIAL_ENCRYPTION_KEY=   (append it with the command above; do not type it here)
+# Set this only for a custom domain. On Vercel the deployment reads its production host itself.
+# OE_PUBLIC_BASE_URL=https://agent.example.com
+#
+# After DATABASE_URL and the key are set, `npx oe secret set <NAME>` (value on stdin) stores a secret
+# whose credential names `broker: "db"` in the encrypted store. The Slack variables and
+# GITHUB_WEBHOOK_SECRET below are read from the ENVIRONMENT only, so they stay environment variables.
+
+# --- Slack (https://github.com/open-everywhere/open-everywhere/blob/main/docs/deploy/surfaces/slack.md) ---
+# Slack app -> OAuth & Permissions -> Bot User OAuth Token (xoxb-…).
+SLACK_BOT_TOKEN=
+# Slack app -> Basic Information -> Signing Secret. Verifies every inbound event.
+SLACK_SIGNING_SECRET=
+
+# --- GitHub (https://github.com/open-everywhere/open-everywhere/blob/main/docs/deploy/surfaces/github.md) ---
+# The GitHub App that receives webhooks and replies as the app.
+# GITHUB_APP_ID=
+# GITHUB_APP_PRIVATE_KEY=
+# GITHUB_APP_SLUG=
+# Verifies inbound deliveries. If it is unset, the route refuses every delivery.
+# GITHUB_WEBHOOK_SECRET=
+
+# --- Notion (https://github.com/open-everywhere/open-everywhere/blob/main/docs/deploy/surfaces/notion.md) ---
+# Notion shows the webhook verification token once, at subscription time. Store it here or with
+# `npx oe secret set NOTION_WEBHOOK_SECRET` (the stored value wins over this variable).
+# NOTION_WEBHOOK_SECRET=

package/template/.mcp.json

@@ -0,0 +1,8 @@
+{
+  "mcpServers": {
+    "open-everywhere-ops": {
+      "command": "node",
+      "args": ["--import", "tsx", "scripts/ops-mcp.ts"]
+    }
+  }
+}

package/template/AGENTS.md

@@ -0,0 +1,62 @@
+# AGENTS.md
+
+This is an **Open Everywhere app**: an autonomous teammate for Slack, Notion and GitHub. The runtime
+is the `@open-everywhere/*` npm packages on the `eve` agent framework. This repository holds only
+the app's configuration.
+
+## Setting it up
+
+Setup is yours to drive, with the user's consent at every command. Use the
+`quickstart-open-everywhere` skill (`.claude/skills/`) and the `open-everywhere-ops` MCP server
+(`.mcp.json`).
+
+- **Step 1 is to ask which route**: **Vercel** (the `vercel` CLI plus Marketplace Neon) or
+  **Docker** (self-host against the deployment contract,
+  `https://github.com/open-everywhere/open-everywhere/blob/main/docs/deploy/contract.md`). These
+  are the two supported routes. Do not invent a third, and do not pick one for the user.
+- **Never propose a local run as a setup step.** `npm run dev` is the development loop after the
+  deploy — changing tools and skills, evals, debugging a turn. A local run has no public HTTPS URL
+  for Slack to reach and a different store, so it proves little about the deployment.
+- **Never ask the user to paste a secret into the chat.** They paste it where a tool reads it; you
+  write it with `scaffold_env`, or mint it with `scaffold_credential_key`, which never prints it.
+- `npx @open-everywhere/create --check --json` is the status report: every step, with `satisfied`,
+  `detail` and a `next` command. Add `--route docker` for the Docker route and
+  `--host https://<host>` to probe a deployment. The human-readable version of the same step list is
+  `https://github.com/open-everywhere/open-everywhere/blob/main/docs/deploy/setup-steps.md`.
+
+## Where things live
+
+- `roster.config.ts` — what the agent can do. `roster.lock.json` is the reviewed roll-call of every
+  contribution. Both are committed.
+- `agent/agent.ts` — the eve agent definition.
+- `agent/` — the config: access bundles, identity and trust, memory domains, models, settings, spend
+  caps, webhooks. Each file's header says what it controls.
+- `agent/tools/`, `agent/channels/`, `agent/hooks/`, `agent/schedules/`, `agent/skills/`,
+  `agent/connections/` and `agent/lib/providers.generated.ts` — `oe build` output. Never edit or
+  commit them.
+- `*.generated.ts` — machine-owned overlays that the agent's own approval flows write by pull
+  request. Never edit them by hand.
+- `scripts/ops-mcp.ts` — the ops MCP server. `scripts/env-pipe.mjs` — `npm run -s env:pipe`, which
+  pipes one `.env.local` value into `vercel env add`. Always pipe it; never run it bare.
+
+## The pipeline
+
+- `npm install` runs the `postinstall` script, `oe-eve-patch`. It applies the Open Everywhere patch
+  to the installed `eve` and verifies it. The app refuses to boot on an unpatched `eve`.
+- `npm run build` runs `oe build` (writes the slot tree from the roster), then `eve build`.
+  `npm run dev` and `npm start` run `oe build` first too.
+- `oe build` refuses a contribution the lock has not reviewed. Decide about it in
+  `roster.config.ts`, then run `npx oe build --accept`, and review the lock diff.
+- `npm run typecheck` type-checks the app.
+- Deploy is a separate, explicit step. On the Vercel route that is `npx vercel deploy --prod`; a
+  `git push` does NOT deploy.
+
+## Rules
+
+- Never commit a secret, a token, an `.env` value or a credential. Secrets go in `.env.local`
+  (gitignored), and the deployment reads them from its own environment. A credential whose
+  `broker` is `"db"` goes in the encrypted credential store instead (`npx oe secret set <NAME>`).
+- Upgrade every `@open-everywhere/*` package together, to one version. Keep `eve` at the exact
+  version `@open-everywhere/core` declares as its peer. A `devDependencies` key that still reads
+  `create-open-everywhere` is replaced by `@open-everywhere/create`, not bumped: the unscoped name is
+  retired. `npx oe upgrade` does that rename.

package/template/CLAUDE.md

@@ -0,0 +1 @@
+Read [AGENTS.md](./AGENTS.md): it describes this Open Everywhere app, where its config lives, and the rules.

package/template/README.md

@@ -0,0 +1,87 @@
+# Open Everywhere app
+
+This is an [Open Everywhere](https://github.com/open-everywhere/open-everywhere) app: an
+autonomous teammate you tag in Slack, Notion and GitHub. The runtime comes from the
+`@open-everywhere/*` npm packages; this repository holds only your configuration.
+
+## Set it up
+
+**Open this folder in your coding agent and ask it to set up Open Everywhere.**
+
+It reads `AGENTS.md`, `.mcp.json` gives it the `open-everywhere-ops` MCP server, and
+`.claude/skills/quickstart-open-everywhere/` is the runbook it follows. It will ask you to pick a
+route first:
+
+- **Vercel** — the `vercel` CLI plus Marketplace Neon. The deployment authenticates to the AI
+  Gateway with OIDC, so it needs no gateway key.
+- **Docker** — self-host a container that satisfies the
+  [deployment contract](https://github.com/open-everywhere/open-everywhere/blob/main/docs/deploy/contract.md).
+
+These are the two supported routes. Some steps stay with you: creating the Slack app, approving
+each deploy, and pasting each secret where the agent's tools can read it but the chat cannot.
+
+Want the whole path on one page, or doing a step by hand? Read the
+[setup steps reference](https://github.com/open-everywhere/open-everywhere/blob/main/docs/deploy/setup-steps.md).
+It is generated from the same step list the status check reports, so it cannot drift from it.
+
+## Check where you are
+
+`npx @open-everywhere/create --check` reports every setup step and the next command for each
+unsatisfied one. It changes nothing. Add `--json` for the report as data, `--route docker` to judge
+against the Docker route, and `--host https://<host>` to probe a deployment.
+
+## Develop locally
+
+After the deploy, `npm run dev` runs the agent on this machine and talks to it in a terminal UI.
+That is the loop for changing tools and skills, running evals, and debugging a turn — not a way to
+set the app up. It needs `AI_GATEWAY_API_KEY` in `.env.local` (Vercel → AI Gateway → API Keys), and
+it keeps its state in an embedded database under `.open-everywhere-data/`. Slack cannot reach it
+without a public tunnel.
+
+## What is in this repository
+
+| Path | What it is |
+| --- | --- |
+| `roster.config.ts` | What the agent can do: which packages contribute, and which eve built-ins it takes away. |
+| `roster.lock.json` | The reviewed roll-call of every contribution. `npx oe build --accept` updates it. Review its diff. |
+| `agent/agent.ts` | The eve agent definition. |
+| `agent/access/` | Bundles and bindings (what the agent may reach, and where), connector credentials, browser hosts. |
+| `agent/identity/` | Trusted surfaces, principals and groups. |
+| `agent/memory/config/` | Memory domains and silos. |
+| `agent/model/` | Model stacks and the org model policy. |
+| `agent/settings/settings.ts` | Behaviour settings. Empty means the shipped defaults. |
+| `agent/spend/` | Spend caps and model pricing. |
+| `agent/webhooks/hooks.ts` | Inbound webhook triggers. |
+| `AGENTS.md`, `CLAUDE.md` | The guide a coding agent reads in this repository. |
+| `.mcp.json`, `scripts/ops-mcp.ts` | The `open-everywhere-ops` MCP server: setup status, `.env.local` values and stored secrets, for a coding agent. |
+| `scripts/env-pipe.mjs` | `npm run -s env:pipe`: writes one `.env.local` value to a pipe for `vercel env add`. It refuses a terminal or a file. Never run it bare. |
+| `.claude/skills/quickstart-open-everywhere/` | The setup skill that drives that server. |
+
+`agent/tools/`, `agent/channels/`, `agent/hooks/`, `agent/schedules/`, `agent/skills/`,
+`agent/connections/` and `agent/lib/providers.generated.ts` are `oe build` output. They are not
+committed. The `*.generated.ts` files are machine-owned overlays that the agent's own approval flows
+write by pull request. Do not edit them by hand.
+
+## Add a surface
+
+Notion and GitHub are in the roster. Each one needs its own setup before it answers:
+
+- **Notion** — create an internal integration, subscribe its webhook to
+  `https://<host>/eve/v1/notion`, and put the pages it may act on in a memory domain's `reach`. See the
+  [Notion guide](https://github.com/open-everywhere/open-everywhere/blob/main/docs/deploy/surfaces/notion.md).
+- **GitHub** — create a GitHub App, point its webhook at `https://<host>/eve/v1/github`, and set
+  `GITHUB_WEBHOOK_SECRET`. See the
+  [GitHub guide](https://github.com/open-everywhere/open-everywhere/blob/main/docs/deploy/surfaces/github.md).
+
+Discord, Microsoft Teams and Linear are installed too. To add one, add it under `providers` in
+`roster.config.ts`, then run `npx oe build --accept`.
+
+## Upgrade
+
+Bump every `@open-everywhere/*` package to the same version, run `npm install`, then
+`npx oe build --accept`, and review the `roster.lock.json` diff before you deploy. Keep `eve` at the
+version `@open-everywhere/core` declares as its peer.
+
+If `devDependencies` still names `create-open-everywhere`, replace that key with
+`@open-everywhere/create` at the same version. The unscoped name is retired and publishes no further
+version. `npx oe upgrade` does this rename for you.

package/template/agent/access/access-requests.ts

@@ -0,0 +1,69 @@
+// Access-request flow config (docs/how-it-works/access-requests.md in the Open Everywhere repository) — the deployer's
+// knobs for the widen-slow path: request card → deterministic codemod → bot-PR →
+// ADMIN MERGES IN GITHUB (that merge is the approval; there is no admin card).
+//
+// FAIL-CLOSED: with either env var below unset, the `request_access` tool refuses
+// politely and the flow is simply OFF — nothing else changes. Both values are
+// operator-specific (a private channel id, YOUR fork's repo), so they live in env,
+// never in this committed file (AGENTS.md security rules).
+//
+//   OE_ACCESS_ADMIN_CHANNEL  Slack channel id that hears "PR opened — merge to grant".
+//   OE_ACCESS_CONFIG_REPO    "owner/repo" of THIS deployment's config repo (the one
+//                            the grants overlay lives in). The GitHub App needs write on it.
+//   OE_ACCESS_CONFIG_BASE    Base branch (default "main").
+//   OE_ACCESS_GRANTS_PATH    Overlay path (default "agent/access/grants.generated.ts").
+//   OE_WEBHOOK_HOOKS_PATH    Webhook-declaration overlay path (default
+//                            "agent/webhooks/hooks.generated.ts") — the `declare_webhook` flow (OPE-208)
+//                            rides this same repo/branch/credential, only the file differs.
+//   OE_ACCESS_DRY_RUN=1      e2e/test mode: a tap validates + reports, no branch/PR.
+//
+// baseBundles/baseBindings hand core the CODE-ONLY baseline (overlay excluded) so the
+// execute path can re-validate a CANDIDATE grants file merged against it before any PR
+// opens — the runtime resolver keeps using the merged loaders.
+
+import type { AccessRequestsConfig } from "@open-everywhere/core/agent/access/config.js";
+import { emptyAgentsFile } from "@open-everywhere/core/agent/memory/agents-codemod.js";
+import { loadBaseBundles, loadBaseBindings } from "./bundles.js";
+import { loadBaseConnectorCredentials } from "./connector-credentials.js";
+import { loadBaseWebhooks } from "../webhooks/hooks.js";
+import { loadBaseDomains, loadBaseSilos, loadDomains } from "../memory/config/domains.js";
+import { loadGroups } from "../identity/groups.js";
+
+export function loadAccessRequests(): AccessRequestsConfig | null {
+  return {
+    adminChannel: process.env.OE_ACCESS_ADMIN_CHANNEL,
+    configRepo: process.env.OE_ACCESS_CONFIG_REPO,
+    configBase: process.env.OE_ACCESS_CONFIG_BASE || undefined,
+    grantsPath: process.env.OE_ACCESS_GRANTS_PATH || undefined,
+    dryRun: process.env.OE_ACCESS_DRY_RUN === "1",
+    baseBundles: loadBaseBundles,
+    baseBindings: loadBaseBindings,
+    // The MEMORY-DOMAIN registry — the MERGED one (code config ∪ generated agents), because a
+    // domain-scoped request freezes the domain name at proposal and must prove that exact name
+    // still resolves when a member taps. Never retarget a stale request to a different domain.
+    domainRegistry: loadDomains,
+    // The PERSON-GROUP registry (C.1) — the MERGED one (hand-written ∪ the IdP-group overlay),
+    // deliberately not a code-only baseline: this flow never writes agent/identity/groups*.ts, so
+    // the honest thing to validate a `group`-scoped candidate binding against is what the
+    // deployment actually resolves. It is what makes a self-serve DM/group grant naming an unknown
+    // group refuse BEFORE a PR opens instead of at the next config load.
+    groupRegistry: loadGroups,
+    // The stage-5 credential-binding PR path re-validates the merged catalogue set (base ⊕ candidate
+    // override) before opening a PR against this SAME config repo.
+    baseConnectorCredentials: loadBaseConnectorCredentials,
+    // The `declare_webhook` PR path (OPE-208) rides this SAME config repo, branch and bot
+    // credential — only the machine-written file differs. `baseWebhooks` is the code-declared
+    // baseline a candidate overlay is validated against before any PR opens.
+    hooksPath: process.env.OE_WEBHOOK_HOOKS_PATH || undefined,
+    baseWebhooks: loadBaseWebhooks,
+    // The `create_agent` PR path (create_agent flow, increment 2) rides this SAME config repo, branch
+    // and bot credential — only the machine-written file differs (the agents overlay). `baseAgents` is
+    // the code-declared agents baseline (empty — agents live only in the overlay); `baseDomains` /
+    // `baseSilos` are the code-only memory baseline a candidate overlay is validated against (ring ②)
+    // before any PR opens. `agentsPath` defaults to "agent/memory/config/agents.generated.ts".
+    agentsPath: process.env.OE_AGENTS_PATH || undefined,
+    baseAgents: emptyAgentsFile,
+    baseDomains: loadBaseDomains,
+    baseSilos: loadBaseSilos,
+  };
+}

package/template/agent/access/browser-hosts.ts

@@ -0,0 +1,28 @@
+// The in-sandbox browser's whole reach. A host reaches this list by pull request, and the diff is
+// the review. Each row is a security decision:
+//   host        — where the browser may go.
+//   methods     — which HTTP verbs the sandbox firewall admits there. `["GET", "HEAD"]` cannot
+//                 submit a form. Adding `POST` permits one, with no per-call approval card.
+//   credential  — optional: the egress connection (agent/access/bundles.ts) whose secret the
+//                 firewall stamps on requests to this host. The browser never holds it.
+//   evaluate    — optional: arm `browser_evaluate` (model-written JavaScript) for this host.
+//
+// The browser is OFF until `browser.enabled` is true in agent/settings/settings.ts. Nothing in this
+// file is a secret, and nothing in it may be.
+
+import { registerBrowserHosts, type BrowserHostDeclaration } from "@open-everywhere/core/agent/access/browser-hosts.js";
+
+const browserHosts: BrowserHostDeclaration[] = [
+  {
+    host: "localhost",
+    methods: ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE"],
+    why: "The in-sandbox dev server a worker boots to see its own UI change.",
+  },
+  {
+    host: "127.0.0.1",
+    methods: ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE"],
+    why: "The same in-sandbox dev server, reached by loopback address instead of by name.",
+  },
+];
+
+registerBrowserHosts(browserHosts);

package/template/agent/access/bundles.ts

@@ -0,0 +1,78 @@
+// Access bundles and bindings — WHAT the agent may reach, and WHERE.
+//
+// A bundle is a named set of capabilities: egress hosts (`domains`), repositories (`repos`),
+// connectors, egress connections and plugins, plus instructions the model reads when the bundle
+// applies. A binding attaches a bundle to a scope: the whole org, one domain, one surface, or one
+// principal. Nothing is reachable until a binding grants it.
+//
+// Start small. Add a bundle when a room needs a capability, and bind it as narrowly as you can.
+// The configuration reference is docs/deploy/configuration-reference.md in the Open Everywhere repository.
+
+import {
+  assertBindingsValid,
+  assertBundlesValid,
+  defineBinding,
+  defineBundle,
+  type Binding,
+  type Bundle,
+} from "@open-everywhere/core/agent/access/bundle.js";
+import { loadGrantsOverlay } from "./grants.js";
+import { loadAgentsOverlay } from "../memory/config/agents-overlay.js";
+import { loadGroups } from "../identity/groups.js";
+
+const bundles: Bundle[] = [
+  defineBundle({
+    name: "org-default",
+    // Credential-less egress that is safe org-wide.
+    domains: ["raw.githubusercontent.com"],
+    instructions: "Never act outside the access granted to this room.",
+  }),
+  // Example — let one domain open pull requests on one repository:
+  //
+  // defineBundle({
+  //   name: "coding",
+  //   repos: ["your-org/your-repo"],
+  //   domains: [...PACKAGE_REGISTRY_HOSTS], // import it from "@open-everywhere/core/agent/access/bundle.js"
+  //   instructions: "Changes go via branch + open_pull_request; never push to main.",
+  // }),
+  //
+  // Example — the Notion MCP connector on the shared workspace credential:
+  //
+  // defineBundle({
+  //   name: "notion",
+  //   connectors: [{ name: "notion", credential: "workspace-oauth", contentOrigin: "internal" }],
+  // }),
+];
+
+const bindings: Binding[] = [
+  defineBinding({ bundle: "org-default", scope: { level: "org" } }),
+  // defineBinding({ bundle: "coding", scope: { level: "domain", domain: "org" } }),
+];
+
+// The machine-owned overlays: access requests the agent raised and an admin approved by merging a
+// pull request (grants.generated.ts), and agent-authored domains (agents.generated.ts).
+const overlay = loadGrantsOverlay();
+const agentsOverlay = loadAgentsOverlay();
+const mergedBundles: readonly Bundle[] = [...bundles, ...overlay.bundles, ...agentsOverlay.bundles];
+const mergedBindings: readonly Binding[] = [...bindings, ...overlay.bindings, ...agentsOverlay.bindings];
+
+assertBundlesValid(mergedBundles);
+assertBindingsValid(mergedBindings, mergedBundles, loadGroups());
+
+/** Code config plus the overlays. */
+export function loadBundles(): readonly Bundle[] {
+  return mergedBundles;
+}
+
+export function loadBindings(): readonly Binding[] {
+  return mergedBindings;
+}
+
+/** Code config only — the base the access-request codemod writes its overlay against. */
+export function loadBaseBundles(): readonly Bundle[] {
+  return bundles;
+}
+
+export function loadBaseBindings(): readonly Binding[] {
+  return bindings;
+}

package/template/agent/access/connector-credentials.ts

@@ -0,0 +1,74 @@
+// Connector credential catalogues — HOW each connector authenticates.
+//
+// One catalogue per connector. Each credential names its type, where its secret lives
+// (`secretRef` + `broker`: `env` reads an environment variable by NAME, `db` reads the encrypted
+// credential store), and the endpoints it may be presented to. A bundle grant
+// (agent/access/bundles.ts) picks a credential by `id`. A credential nobody grants is inert.
+//
+// The secret VALUES never live in this file — only the names they are stored under.
+
+import {
+  assertConnectorCredentialsValid,
+  defineConnectorCredentials,
+  vercelConnectorHome,
+  type ConnectorCredentials,
+} from "@open-everywhere/core/agent/access/connector-credentials.js";
+import { applyOverridesToConnectorCredentials } from "@open-everywhere/core/agent/access/credential-bindings-codemod.js";
+import { loadCredentialBindingsOverlay } from "./credential-bindings.js";
+
+const catalogues: ConnectorCredentials[] = [
+  defineConnectorCredentials({
+    description: "Notion workspace (host-side MCP) — read and write the team knowledge base.",
+    connector: "notion",
+    allows: ["api-key", "service-oauth", "user-oauth"],
+    credentials: [
+      { id: "team-key", type: "api-key", secretRef: "db:notion:team-key", broker: "db", endpoints: { hosts: ["api.notion.com"], pathPrefixes: ["/v1/"], methods: ["GET", "POST"] } },
+      // The Notion CHAT surface posts its replies with this credential.
+      {
+        id: "channel-key",
+        type: "api-key",
+        secretRef: "db:notion:channel-key",
+        broker: "db",
+        intake: false,
+        endpoints: { hosts: ["api.notion.com"], pathPrefixes: ["/v1/"], methods: ["GET", "POST"] },
+      },
+      {
+        id: "memory",
+        type: "api-key",
+        secretRef: "db:notion:memory",
+        broker: "db",
+        intake: false,
+        endpoints: { hosts: ["api.notion.com"], pathPrefixes: ["/v1/blocks/"], methods: ["GET"] },
+      },
+      { id: "user-oauth", type: "user-oauth", home: vercelConnectorHome("mcp.notion.com/notion-mcp"), endpoints: { hosts: ["mcp.notion.com"] } },
+      { id: "workspace-oauth", type: "service-oauth", home: vercelConnectorHome("mcp.notion.com/notion-mcp"), endpoints: { hosts: ["mcp.notion.com"] } },
+    ],
+  }),
+  defineConnectorCredentials({
+    description: "Slack workspace — the WORK surface a granted domain's delegated workers read conversations on.",
+    connector: "slack",
+    allows: ["api-key"],
+    credentials: [
+      { id: "work-token", type: "api-key", secretRef: "SLACK_BOT_TOKEN", broker: "env", intake: false },
+      { id: "chat-token", type: "api-key", secretRef: "SLACK_BOT_TOKEN", broker: "env", intake: false },
+    ],
+  }),
+];
+
+assertConnectorCredentialsValid(catalogues);
+
+// Custody moves (env → db) land as a machine-owned overlay (credential-bindings.generated.ts).
+const merged: readonly ConnectorCredentials[] = applyOverridesToConnectorCredentials(
+  catalogues,
+  loadCredentialBindingsOverlay().overrides,
+);
+assertConnectorCredentialsValid(merged);
+
+export function loadConnectorCredentials(): readonly ConnectorCredentials[] {
+  return merged;
+}
+
+/** The code catalogues only — the base the credential-bindings codemod writes against. */
+export function loadBaseConnectorCredentials(): readonly ConnectorCredentials[] {
+  return catalogues;
+}

package/template/agent/access/credential-bindings.generated.ts

@@ -0,0 +1,17 @@
+// GENERATED + MACHINE-OWNED — DO NOT HAND-EDIT.
+//
+// The credential-bindings overlay: DATA ONLY. Written exclusively by the deterministic codemod
+// (packages/core/agent/access/credential-bindings-codemod.ts) on a bot-PR branch; the PR merge is the approval gate.
+//
+// The codemod re-emits this file from its own parsed content and refuses to rewrite it when the
+// bytes differ, so a hand-edit stops the next machine PR. Before a merge, nothing checks that the
+// file is still data only unless the repository runs its own check: the person who merges the PR
+// is the gate. Read a PR to this file as code, because it is code.
+//
+// To change it by hand, edit only the data below and keep the layout exactly as emitted.
+
+import type { CredentialBindingsFile } from "@open-everywhere/core/agent/access/credential-bindings-codemod.js";
+
+export default {
+  "overrides": []
+} satisfies CredentialBindingsFile;

package/template/agent/access/credential-bindings.ts

@@ -0,0 +1,28 @@
+// The credential-bindings OVERLAY loader — the runtime half of the stage-5 credential-binding flow
+// (task #113; docs/security/credentials-and-planes.md in the Open Everywhere repository). `credential-bindings.generated.ts` (next to
+// this file) is a MACHINE-OWNED, DATA-ONLY overlay of custody re-stamps (connector credential → new
+// broker + secretRef) that merges over the config-as-code catalogue set in connector-credentials.ts
+// at load. Each override names its `connector` and `credential` (the codemod refuses the old
+// `provider` spelling at load — OPE-598). Nothing edits it by hand in the normal flow: the deterministic codemod (core
+// access/credential-bindings-codemod.ts) writes it on a `credential-binding/<connector>-<credential>`
+// branch, a bot-PR carries the diff, and GitHub's merge button — with CODEOWNERS on this path +
+// branch protection — is the approval gate.
+//
+// WHY a static import (not an fs read): Eve's bundler inlines the module into the deploy artifact,
+// so the overlay can never be silently absent at runtime. Parsing is STRICT + fail-loud
+// (parseCredentialBindingsFile): a malformed overlay refuses to boot rather than loading half-right,
+// and Vercel keeps the previous deployment live on a failed build/boot (the build-then-promote
+// backstop) — worst case a red pipeline, never a downed agent. Mirrors grants.ts exactly, including
+// the reason the DATA lives in a `.ts` module (OPE-256): one authoring language. Nothing in this
+// app checks that the file stays data only: the person who merges the codemod's PR is the gate.
+
+import { parseCredentialBindingsFile, type CredentialBindingsFile } from "@open-everywhere/core/agent/access/credential-bindings-codemod.js";
+import bindingsOverlay from "./credential-bindings.generated.js";
+
+const overlay: CredentialBindingsFile = parseCredentialBindingsFile(bindingsOverlay);
+
+/** The parsed credential-bindings overlay — merged over loadConnectorCredentials() by
+ *  connector-credentials.ts. */
+export function loadCredentialBindingsOverlay(): CredentialBindingsFile {
+  return overlay;
+}

package/template/agent/access/grants.generated.ts

@@ -0,0 +1,18 @@
+// GENERATED + MACHINE-OWNED — DO NOT HAND-EDIT.
+//
+// The grants overlay: DATA ONLY. Written exclusively by the deterministic codemod
+// (packages/core/agent/access/grants-codemod.ts) on a bot-PR branch; the PR merge is the approval gate.
+//
+// The codemod re-emits this file from its own parsed content and refuses to rewrite it when the
+// bytes differ, so a hand-edit stops the next machine PR. Before a merge, nothing checks that the
+// file is still data only unless the repository runs its own check: the person who merges the PR
+// is the gate. Read a PR to this file as code, because it is code.
+//
+// To change it by hand, edit only the data below and keep the layout exactly as emitted.
+
+import type { GrantsFile } from "@open-everywhere/core/agent/access/grants-codemod.js";
+
+export default {
+  "bundles": [],
+  "bindings": []
+} satisfies GrantsFile;

package/template/agent/access/grants.ts

@@ -0,0 +1,30 @@
+// The grants OVERLAY loader — the runtime half of the access-request flow's widen path
+// (docs/how-it-works/access-requests.md in the Open Everywhere repository). `grants.generated.ts` (next to this file) is a
+// MACHINE-OWNED, DATA-ONLY overlay of extra bundles + channel-scoped bindings that merges
+// into the config-as-code baseline in bundles.ts at load. Nothing edits it by hand in the
+// normal flow: the deterministic codemod (core access/grants-codemod.ts) writes it on an
+// `access-request/<id>` branch, a bot-PR carries the diff, and GitHub's merge button is
+// the approval gate.
+//
+// WHY a static import (not an fs read): Eve's bundler inlines the module into the deploy
+// artifact, so the overlay can never be silently absent at runtime the way a stripped file
+// path could be — a grant that merged is a grant that ships. Parsing is STRICT + fail-loud
+// (parseGrantsFile): a malformed overlay (a bad merge) refuses to boot rather than loading
+// as "roughly right" — and Vercel keeps the previous deployment live on a failed build/boot,
+// so the worst case is a red pipeline, never a downed agent (the build-then-promote backstop).
+//
+// WHY THE DATA LIVES IN A `.ts` MODULE AND NOT JSON (OPE-256): one authoring language for the
+// whole deployer config. The split that is load-bearing is not JSON-vs-TS but MACHINE-OWNED vs
+// human-authored. A module IS executable at load, and this parse only sees the value, so this
+// loader does not prove the file is data. In this app no check before the merge does: whoever merges the
+// codemod's PR is the only gate on the file staying data only. Review that PR as code.
+
+import { parseGrantsFile, type GrantsFile } from "@open-everywhere/core/agent/access/grants-codemod.js";
+import grantsOverlay from "./grants.generated.js";
+
+const overlay: GrantsFile = parseGrantsFile(grantsOverlay);
+
+/** The parsed grants overlay — merged into loadBundles()/loadBindings() by bundles.ts. */
+export function loadGrantsOverlay(): GrantsFile {
+  return overlay;
+}

package/template/agent/access/network-access.ts

@@ -0,0 +1,32 @@
+// Network-access LEVEL configuration — config-as-code (OPE-509), the "environment" axis
+// alongside bundles.ts's capability axis. Declare a named level ("trusted" | "none" | "full")
+// per scope on the container ladder (org < tenant < domain < surface); an unpinned scope
+// inherits the nearest wider pin, and a scope no pin reaches at all resolves "none" — the same
+// egress posture every scope already has today. See docs/how-it-works/access-and-scoping.md in the Open Everywhere repository
+// (§ Network-access levels) and packages/core/agent/access/network-access.ts for the resolution
+// doctrine and exactly what "trusted" opens.
+//
+// LEFT EMPTY, DELIBERATELY. This ticket adds the CONFIG SHAPE — it does not widen this
+// deployment's live egress by default. The commented example below shows the intended usage:
+// it would let the "coding" bundle in agent/access/bundles.ts drop its hand-copied
+// `domains: [...PACKAGE_REGISTRY_HOSTS]` line in favour of a reviewable, named level, but
+// switching that bundle over is a separate, deliberate config change — not a side effect of
+// shipping the mechanism.
+
+import { assertNetworkAccessValid, defineNetworkAccess, type NetworkAccessBinding } from "@open-everywhere/core/agent/access/network-access.js";
+
+const networkAccess: NetworkAccessBinding[] = [
+  // Example: give the coding channel the curated "trusted" set (package registries +
+  // developer hosts) instead of the hand-copied PACKAGE_REGISTRY_HOSTS domains grant on the
+  // "coding" bundle in ../access/bundles.ts — same effective egress, named and reviewable at
+  // the scope instead of buried in a bundle's host list.
+  // defineNetworkAccess({ scope: { level: "surface", surface: "slack/<team-id>/<channel-id>" }, level: "trusted" }),
+];
+
+// Validate at module load (fail loud), same doctrine as bundles.ts's assertBundlesValid.
+assertNetworkAccessValid(networkAccess);
+
+/** The seam a DB/dashboard would swap behind, same shape as bundles.ts's loadBundles(). */
+export function loadNetworkAccess(): readonly NetworkAccessBinding[] {
+  return networkAccess;
+}