@open-everywhere/create 0.1.4

package/template/agent/agent.ts

@@ -0,0 +1,125 @@
+// The eve agent definition — the root of this Open Everywhere app.
+//
+// eve discovers the agent graph by filesystem convention from this directory. The slot directories
+// (agent/tools/, agent/channels/, agent/hooks/, …) are `oe build` output, generated from
+// roster.config.ts + roster.lock.json, and are not committed.
+//
+// Models run through the Vercel AI Gateway. Auth is to the gateway: Vercel OIDC when deployed,
+// `AI_GATEWAY_API_KEY` (or `vercel env pull`) for local dev. There is no model-provider key in the
+// app. The model per ROLE lives in agent/model/stacks.ts; pick a stack with `models.stack` in
+// agent/settings/settings.ts.
+//
+// Zero data retention and provider allowlists are GATEWAY org policy (AI Gateway → Settings), not
+// app code. This app inherits them.
+
+import { defineAgent } from "eve";
+import { defineDynamic } from "eve/tools";
+// Side effect: register this app's config into core's registry before any handler runs.
+import "./lib/register-config.js";
+import "./lib/register-adapters.js";
+// Side effect: refuse to boot on an eve whose loaded bytes do not carry the Open Everywhere patch.
+// `npm install` applies it (the `postinstall` script runs `oe-eve-patch`).
+import "@open-everywhere/core/agent/access/eve-patch-probe-boot.js";
+import { gatewayModelResolver } from "@open-everywhere/adapters/agent/model/gateway.js";
+import { registerGatewayDreamJudge, registerGatewayFailureFacetJudge } from "@open-everywhere/adapters/agent/model/dream-judge.js";
+import { registerGatewayApprovalJudge } from "@open-everywhere/adapters/agent/model/approval-judge.js";
+import { registerGatewayImageDescriber } from "@open-everywhere/adapters/agent/model/gateway-vision.js";
+import { isModelUsable } from "@open-everywhere/core/agent/model/policy.js";
+import {
+  JUDGE_MODEL,
+  PRIMARY_MODEL,
+  PRIMARY_MODEL_CONTEXT_WINDOW_TOKENS,
+  UTILITY_MODEL,
+  VISION_MODEL,
+} from "./model/models.js";
+import { loadModelPolicy } from "./model/policy.js";
+import { compactionThresholdTokens } from "./model/stacks.js";
+import { registerAppInfo } from "@open-everywhere/core/agent/commands/core.js";
+import { getSettings } from "@open-everywhere/core/agent/settings/settings.js";
+import { EVE_RUNTIME_VERSION } from "@open-everywhere/core/agent/channels/runtime-rotation.js";
+// A static JSON import: the bundler inlines it at build time, so the version survives a bundled
+// deploy that ships no package.json.
+import appPackageJson from "../package.json" with { type: "json" };
+
+/** Gateway options that are a property of the call. `caching: "auto"` injects prompt-cache breakpoints. */
+const GATEWAY_DEFAULTS = { caching: "auto" } as const;
+
+const SESSION_INPUT_TOKEN_BUDGET = getSettings().agent.sessionInputTokenBudget;
+const COMPACTION_THRESHOLD_PERCENT = getSettings().agent.compactionThresholdPercent;
+/** Display only (`/oe status`): eve derives its own copy from the two values the agent states. */
+const COMPACTION_THRESHOLD_TOKENS = compactionThresholdTokens(PRIMARY_MODEL_CONTEXT_WINDOW_TOKENS, COMPACTION_THRESHOLD_PERCENT);
+
+// The background judges: memory distillation, failure facets and the auto-approval judge.
+registerGatewayDreamJudge({ id: UTILITY_MODEL, gateway: GATEWAY_DEFAULTS });
+registerGatewayFailureFacetJudge({ id: UTILITY_MODEL, gateway: GATEWAY_DEFAULTS });
+registerGatewayApprovalJudge({ id: JUDGE_MODEL, gateway: GATEWAY_DEFAULTS });
+
+// The image describer. Fail at boot if the org model policy forbids the vision model, rather than
+// fail every image later.
+if (!isModelUsable(VISION_MODEL, loadModelPolicy())) {
+  throw new Error(
+    `open-everywhere: vision model "${VISION_MODEL}" is not allowed by the org model policy — ` +
+      "check agent/model/policy.ts, or re-point the `vision` role in agent/model/stacks.ts.",
+  );
+}
+registerGatewayImageDescriber({ id: VISION_MODEL });
+
+function readAppVersion(): string {
+  const version = appPackageJson.version;
+  return typeof version === "string" && version.length > 0 ? version : "unknown";
+}
+
+function readDeploymentSha(): string {
+  const sha = (process.env.VERCEL_GIT_COMMIT_SHA ?? "").trim();
+  return sha.length > 0 ? sha : "unknown";
+}
+
+function readEvePin(): string {
+  const version = EVE_RUNTIME_VERSION.trim();
+  return version.length > 0 ? version : "unknown";
+}
+
+// What `/oe status` reports about this deployment.
+registerAppInfo({
+  version: readAppVersion(),
+  primaryModel: PRIMARY_MODEL,
+  utilityModel: UTILITY_MODEL,
+  contextWindowTokens: PRIMARY_MODEL_CONTEXT_WINDOW_TOKENS,
+  compactionThresholdTokens: COMPACTION_THRESHOLD_TOKENS,
+  deploymentSha: readDeploymentSha(),
+  evePin: readEvePin(),
+});
+
+/**
+ * The turn model is DYNAMIC (per-domain routing), so eve takes the context window and the provider
+ * options from the resolver's return, not from the agent definition. Wrap every return at ONE site,
+ * so no routing path can drop the window — a missing window silently costs the compaction rescale.
+ */
+function primaryModelSelection<TModel>(model: TModel): {
+  readonly model: TModel;
+  readonly modelContextWindowTokens: number;
+  readonly modelOptions: { readonly providerOptions: { readonly gateway: typeof GATEWAY_DEFAULTS } };
+} {
+  return {
+    model,
+    modelContextWindowTokens: PRIMARY_MODEL_CONTEXT_WINDOW_TOKENS,
+    modelOptions: { providerOptions: { gateway: GATEWAY_DEFAULTS } },
+  };
+}
+
+export default defineAgent({
+  // just-bash runs in-process for the self-host sandbox tier; keep it out of the bundle.
+  build: { externalDependencies: ["just-bash"] },
+  model: defineDynamic({
+    events: {
+      "step.started": (() => {
+        const resolve = gatewayModelResolver({ id: PRIMARY_MODEL, gateway: GATEWAY_DEFAULTS });
+        return async (event: unknown, ctx: unknown) => primaryModelSelection(await resolve(event, ctx));
+      })(),
+    },
+  }),
+  reasoning: "medium",
+  // Sessions park on a token budget, never on wall-clock time.
+  limits: { maxInputTokensPerSession: SESSION_INPUT_TOKEN_BUDGET, sessionTimeoutMs: false },
+  compaction: { thresholdPercent: COMPACTION_THRESHOLD_PERCENT },
+});

package/template/agent/blob/hosting.ts

@@ -0,0 +1,42 @@
+// Blob hosting — config-as-code, the org-level opt-in for PUBLISHING HTML artifacts to a
+// world-readable Vercel Blob URL from the post_file tool (packages/core/agent/tools/post_file.ts).
+//
+// OFF BY DEFAULT. With `enabled:
+// false` — the shipped default — post_file NEVER hosts: an HTML artifact is attached to the
+// message as a downloadable `.html` file (workspace-scoped, no world-readable URL). Flip
+// `enabled: true` to opt this org IN; then post_file publishes HTML pages to a public Blob URL,
+// and that public write is APPROVAL-GATED at the tool (an admin approves each publish).
+//
+// TO TURN IT ON, an operator:
+//   1. Connects a Vercel Blob store to this project (Vercel populates VERCEL_OIDC_TOKEN +
+//      BLOB_STORE_ID automatically — the SDK authenticates via OIDC, NO BLOB_READ_WRITE_TOKEN).
+//   2. Sets `enabled: true` here and merges it (reviewed git config, same PR-to-widen posture
+//      as model/policy.ts and spend/budgets.ts).
+// If `enabled: true` ships without the Blob store connected, the first publish FAILS LOUD
+// (missing OIDC env) rather than silently degrading — an opted-in-but-unconfigured deployment
+// is a misconfig we surface, not hide.
+//
+// This file is the seam a DB/dashboard would swap behind. After editing:
+// `npm run typecheck` plus a boot (assertBlobHostingValid runs at import and throws on a malformed
+// `publicPrefix`).
+
+import { defineBlobHosting, type BlobHostingConfig } from "@open-everywhere/core/agent/blob/hosting.js";
+
+const config: BlobHostingConfig = defineBlobHosting({
+  // OFF by default — HTML artifacts are attached as downloadable files, nothing is published.
+  enabled: false,
+
+  // --- EXAMPLE: opt this org in to hosting HTML artifacts on Vercel Blob ---
+  // Requires a connected Blob store (VERCEL_OIDC_TOKEN + BLOB_STORE_ID). Each publish is
+  // approval-gated at the post_file tool.
+  // enabled: true,
+
+  // --- OPTIONAL: override the reserved public-output prefix (namespace isolation) ---
+  // Defaults to "public-artifacts". A plain prefix segment: no leading/trailing slash, no "..".
+  // publicPrefix: "public-artifacts",
+});
+
+/** The seam a DB/dashboard would swap behind. Static config for now. */
+export function loadBlobHosting(): BlobHostingConfig {
+  return config;
+}

package/template/agent/identity/authors.ts

@@ -0,0 +1,79 @@
+// Config-as-code: WHOSE requests this operator treats as an org member's, on the platforms that
+// cannot answer that question themselves. The AUTHORITY plane — the sibling of ./surfaces.ts, which
+// is the AUDIENCE plane.
+//
+// THE TWO ARE ADDITIVE, AND YOU NEED BOTH:
+//
+//   surfaces.ts   declares a ROOM.   "Who can SEE what the agent prints here?"  → trust: internal/public
+//   this file     declares an AUTHOR. "Whose bytes may the agent treat as a member's?"
+//
+// Declaring an author internal does NOT make the room safe to print into, and declaring a room
+// internal does NOT vouch for everyone who types in it. A public community guild with three trusted
+// staff is exactly the case that needs both files.
+//
+// WHY IT EXISTS. The taint plane's author leg reads a POSITIVE refutation from the platform: Slack
+// answers with `is_restricted`/`is_ultra_restricted`/`is_stranger`, Teams with Entra's
+// `userType: "guest"`. DISCORD AND NOTION HAVE NO SUCH SIGNAL — Discord has no organisation concept
+// (guild membership IS the boundary, and community guilds admit the world), and Notion exposes no
+// membership fact on a comment author. On those two platforms this file is the only author-grain
+// evidence that exists.
+//
+// 🔴 ARMING IS PER TENANT AND EXPLICIT. A tenant with no entry here is UNDECLARED, and the leg does
+// nothing there — behaviour is byte-identical to not having this file. Adding an entry ARMS that
+// tenant: from then on, an author it does not name is graded EXTERNAL, and their messages mark the
+// turn as carrying non-member content. So an entry is a real commitment, not a hint. List everyone
+// who belongs, or leave the tenant out.
+//
+// SHIPS EMPTY. Never commit real member ids or team names here — they are operator data and this
+// repo is open source. A deployer fills it in their own fork. Validated fail-loud at boot
+// (registerAuthorTrust); a malformed key or a reference to a group that does not exist is a boot
+// error, not a silently-ignored line.
+//
+// THREE WAYS TO NAME A MEMBER:
+//
+//   "discord/000000000000000000"           one ACCOUNT, by qualified principal key. The floor — no
+//                                          database, no IdP, nothing else switched on.
+//   { group: "payments-team" }             one PERSON-GROUP from ./groups.ts, expanded at boot to
+//                                          its principal keys on this platform. Link-set members do
+//                                          NOT count here (expanding one is an async DB read and
+//                                          this resolver runs on the synchronous wake path) — a
+//                                          group with no principal key on this platform is refused
+//                                          loudly rather than accepted and silently inert.
+//   { membership: "discord/<g>/role:<r>" } EVERY author holding that Discord role — the wildcard
+//                                          shape. A single trailing "*" is allowed, so
+//                                          "role:*" admits every author holding ANY role, which is
+//                                          the usual "has been let in properly" test on a community
+//                                          guild. Discord roles ride on the gateway message itself,
+//                                          so this costs no extra API call. Notion has no group
+//                                          concept, so a Notion entry uses principal keys only.
+//
+// 🔴 THE IdP IS A FUTURE SOURCE, AND IT PLUGS IN THROUGH `{ group: … }` — NOT THROUGH A LIVE READ.
+// identity/groups-codemod.ts already emits `directory:<idp-group>` groups into the machine-owned
+// overlay agent/identity/groups.generated.ts from a directory snapshot, on a bot PR that A HUMAN
+// MERGES. Reference one of those groups here and Okta becomes the source with no new plumbing and
+// no new trust: the IdP PROPOSES, a reviewer disposes. A directory that starts lying still cannot
+// widen author trust without a merged diff. Do not replace this with a runtime directory lookup.
+//
+//   defineAuthorTrust({
+//     tenant: "discord/1300000000000000100",        // the guild this declaration ARMS
+//     internal: [
+//       "discord/000000000000000000",               // one account
+//       { group: "payments-team" },                 // a person-group from ./groups.ts
+//       { group: "directory:Engineering" },         // an IdP-synced group (merged overlay)
+//       { membership: "discord/1300000000000000100/role:111111111111111111" },  // one role
+//     ],
+//   }),
+
+import { defineAuthorTrust, registerAuthorTrust, type AuthorTrustEntry } from "@open-everywhere/core/agent/identity/author-trust.js";
+import { loadGroups } from "./groups.js";
+
+// Deliberately empty in the open-source tree (no committed operator ids — see the header).
+// `defineAuthorTrust` is imported so the example above type-checks the moment it is uncommented.
+void defineAuthorTrust;
+
+export const authors: readonly AuthorTrustEntry[] = [];
+
+// Self-registering side effect, matching ./surfaces.ts: agent/lib/register-config.ts imports this
+// file for its effect, so nothing has to be threaded through the AppConfig object. Fail-loud — a
+// malformed tenant key, an unknown group or a dead cross-platform member is a boot error.
+registerAuthorTrust(authors, loadGroups());

package/template/agent/identity/groups-overlay.ts

@@ -0,0 +1,24 @@
+// The PERSON-GROUPS OVERLAY loader — the runtime half of the IdP-group sync's review path (phase G.4).
+// `groups.generated.ts` (next to this file) is a MACHINE-OWNED, DATA-ONLY overlay of `directory:`-
+// namespaced person-groups whose members are link-set references, merged into the config-as-code
+// baseline in groups.ts at load. Nothing edits it by hand in the normal flow: the deterministic
+// codemod (core identity/groups-codemod.ts) emits it from a plan diffed against a fresh directory
+// snapshot, and a human merges the diff — merge IS the approval, exactly like the grants overlay
+// (agent/access/grants.ts).
+//
+// WHY a static import (not an fs read): Eve's bundler inlines the module into the deploy artifact, so
+// the overlay can never be silently absent at runtime — a membership that merged is a membership
+// that ships. Parsing is STRICT + fail-loud (parseGroupsFile): a malformed overlay refuses to boot
+// rather than loading as "roughly right", and Vercel keeps the previous deployment live on a failed
+// build/boot. This loader does not prove the `.ts` module is data. In this app the person who
+// merges the codemod's PR is the only gate on that — see agent/access/grants.ts.
+
+import { parseGroupsFile, type GroupsFile } from "@open-everywhere/core/agent/identity/groups-codemod.js";
+import groupsOverlay from "./groups.generated.js";
+
+const overlay: GroupsFile = parseGroupsFile(groupsOverlay);
+
+/** The parsed person-groups overlay — merged into loadGroups() by groups.ts. */
+export function loadGroupsOverlay(): GroupsFile {
+  return overlay;
+}

package/template/agent/identity/groups.generated.ts

@@ -0,0 +1,17 @@
+// GENERATED + MACHINE-OWNED — DO NOT HAND-EDIT.
+//
+// The person-groups overlay: DATA ONLY. Written exclusively by the deterministic codemod
+// (packages/core/agent/identity/groups-codemod.ts) on a bot-PR branch; the PR merge is the approval gate.
+//
+// The codemod re-emits this file from its own parsed content and refuses to rewrite it when the
+// bytes differ, so a hand-edit stops the next machine PR. Before a merge, nothing checks that the
+// file is still data only unless the repository runs its own check: the person who merges the PR
+// is the gate. Read a PR to this file as code, because it is code.
+//
+// To change it by hand, edit only the data below and keep the layout exactly as emitted.
+
+import type { GroupsFile } from "@open-everywhere/core/agent/identity/groups-codemod.js";
+
+export default {
+  "groups": []
+} satisfies GroupsFile;

package/template/agent/identity/groups.ts

@@ -0,0 +1,84 @@
+// PERSON-GROUPS — config-as-code (the app-owned instance of the core identity/groups.ts model).
+// Declare named sets of HUMANS, then bind a capability bundle to one at `group` scope in
+// agent/access/bundles.ts: "everybody on the payments team gets this MCP, these skills and this
+// connection in their DM", without one binding per person per platform.
+//
+// A GROUP GRANTS PEOPLE, NOT ROOMS. A `group` binding applies ONLY in each member's own DM (the
+// personal-credential universe — access/resolver.ts's "two connector universes" rule). Channels keep
+// surface/domain scoping; there is deliberately no way to say "this channel's bundle applies only to
+// members of group X".
+//
+// TWO WAYS TO NAME A MEMBER:
+//   "slack/<team-id>/<member-id>"  one ACCOUNT, by QUALIFIED principal key — platform, then the
+//                         WORKSPACE on a tenant-scoped platform (Slack member ids are issued per
+//                         workspace — OPE-309), then the id. Needs no database, no IdP and nothing
+//                         else switched on — the route a 5-person team uses, on every code path.
+//   { linkSet: "<id>" }   one HUMAN, by link-set id — expands at resolve time to every account they
+//                         have CONFIRMED (link_sets_list in the control plane shows the ids). A
+//                         `suggested` account never counts, so an IdP proposal can never widen a
+//                         grant. NB: link-set membership is resolved on the AWAITABLE access path
+//                         (core access/group-request.ts); prefer principal keys for anything that
+//                         must be effective on every path.
+//
+// A bare unqualified id ("<member-id>") is REFUSED at load — it has no platform namespace and could
+// never match; so is a Slack key missing its workspace ("slack/<member-id>"), for the same reason one
+// rung down. So is an empty group, a duplicate member, and a duplicate group name. Being in
+// SEVERAL groups is fine and expected.
+//
+// OPEN-SOURCE / SECURITY: never commit real member ids or team names here (they're operator data) —
+// this ships EMPTY; a deployer fills it in their own fork. Validated fail-loud at config load
+// (assertGroupsValid), and a binding naming a group that doesn't exist fails at load too
+// (agent/access/bundles.ts).
+//
+//   defineGroup({
+//     name: "payments-team",                       // the id every binding references — immutable
+//     title: "Payments",                           // display only
+//     members: [
+//       "slack/<team-id>/<member-id>",               // one account (Slack: workspace-qualified)
+//       "discord/000000000000000000",              // another account (same or different human)
+//       { linkSet: "1f0c…" },                      // one human, all their confirmed accounts
+//     ],
+//   }),
+//
+// …then in agent/access/bundles.ts:
+//
+//   defineBinding({ bundle: "payments-tools", scope: { level: "group", group: "payments-team" } }),
+
+import {
+  assertGroupsValid,
+  assertReservedGroupNamespace,
+  defineGroup,
+  type Group,
+} from "@open-everywhere/core/agent/identity/groups.js";
+import { loadGroupsOverlay } from "./groups-overlay.js";
+
+// Deliberately empty in the open-source tree (no committed operator ids — see the header). A
+// deployer adds their teams here; `defineGroup` is imported so the example above type-checks the
+// moment it's uncommented.
+void defineGroup;
+
+const groups: Group[] = [];
+
+// The `directory:` namespace belongs to the machine-owned overlay below — a hand-written group may
+// not use it, or the next sync plan would silently replace a diff a human approved.
+assertReservedGroupNamespace(groups);
+
+// --- The IdP-GROUP OVERLAY (directory sync, review mode) ---------------------
+// agent/identity/groups.generated.ts is a MACHINE-OWNED, DATA-ONLY overlay of `directory:<idp-group>`
+// groups whose members are link-set refs, emitted by the deterministic codemod from a directory
+// snapshot and merged by a human (the `directory_groups_plan` control verb returns the file content;
+// merging the diff IS the approval). It merges ADDITIVELY here: overlay names are namespaced so they
+// can never collide with the hand-written groups above, and the SAME assertGroupsValid below covers
+// overlay-derived config. Empty overlay ⇒ no-op.
+const overlay = loadGroupsOverlay();
+const mergedGroups: readonly Group[] = [...groups, ...overlay.groups];
+
+// Validate once, at module load (fail loud): unique non-empty names, non-empty membership, every
+// string member a QUALIFIED principal key (workspace rung and all on Slack), every link-set member a real id, no duplicate
+// members. Runs on the MERGED result, so a bad overlay can never load half-checked.
+assertGroupsValid(mergedGroups);
+
+/** The seam a DB/dashboard would swap behind. Currently static config + the IdP-group overlay. */
+export function loadGroups(): readonly Group[] {
+  return mergedGroups;
+}

package/template/agent/identity/principals.ts

@@ -0,0 +1,37 @@
+// Cross-surface principals — the people on your team and their account id on each surface, so the
+// agent knows that one person in Slack is the same person on GitHub.
+//
+// FAIL-CLOSED: an account joins a person ONLY by an explicit id below, never by a matching display
+// name. An unlisted account stays a separate per-surface identity, and everything still works.
+// Validated at config load (assertPrincipalsValid).
+//
+//   definePrincipal({
+//     name: "Ada Lovelace",
+//     handle: "ada",
+//     ids: { slack: "<member-id>", github: "ada-gh", notion: "<uuid>" },
+//     email: "ada@example.com",
+//   }),
+//
+// A Slack member id is issued PER WORKSPACE. To serve two workspaces, name the workspace on each id:
+//
+//   ids: { slack: [{ tenant: "<first-team-id>", id: "<member-id>" }, { tenant: "<second-team-id>", id: "<member-id>" }] }
+//
+// Do not mix bare and workspace-qualified ids for one platform — config load refuses it.
+
+import { definePrincipal, assertPrincipalsValid, type Principal } from "@open-everywhere/core/agent/identity/principals.js";
+
+// Deliberately empty in the open-source tree (no committed operator ids — see the header). A
+// deployer adds their team here; `definePrincipal` is imported so the example above type-checks the
+// moment it's uncommented.
+void definePrincipal;
+
+const principals: Principal[] = [];
+
+// Validate once at module load (fail loud): no (platform, id) claimed by two people (the merge
+// conflict), no empty names/ids, no duplicate emails (identity/principals.ts assertPrincipalsValid).
+assertPrincipalsValid(principals);
+
+/** The seam a DB/dashboard would swap behind. Static config for now. */
+export function loadPrincipals(): readonly Principal[] {
+  return principals;
+}

package/template/agent/identity/surfaces.ts

@@ -0,0 +1,48 @@
+// The surfaces this deployment vouches as INTERNAL — allowed to read and write the shared org
+// brain. Fail-closed: a surface with no entry stays `external`, and an external room routes to the
+// read-only `public` pseudo-domain whatever domain lists it.
+//
+// A key is a workspace key (`<platform>/<workspace>`, every room in it) or a full surface key
+// (`<platform>/<workspace>/<room>`, one room). Being in a memory domain never makes a surface
+// internal: trust is decided here, and domains (agent/memory/config/domains/) only group rooms that
+// are already trusted.
+//
+// Vouch your own Slack workspace first. Its id is the `T…` value in the workspace URL, or
+// `team_id` in the Slack app settings:
+//
+//   defineSurface({ key: "slack/<team-id>", trust: "internal" }),
+//
+// A Notion key names one page. Add `subtree: true` to vouch that page and every page under it:
+//
+//   defineSurface({ key: "notion/<workspaceId>/<pageId>", trust: "internal", subtree: true }),
+//
+// A GitHub key names an owner, or one repository:
+//
+//   defineSurface({ key: "github/your-org", trust: "internal" }),
+//
+// The full rules (Enterprise Grid, subtrees, public carve-outs) are in the header of
+// `@open-everywhere/core/agent/identity/trust.ts` and in docs/security/ in the Open Everywhere
+// repository.
+
+import { defineSurface, registerSurfaces, type Surface } from "@open-everywhere/core/agent/identity/trust.js";
+import {
+  registerDeploymentIdentity,
+  type DeploymentIdentity,
+} from "@open-everywhere/core/agent/identity/deployment-identity.js";
+
+// The deployment's own identity. `org` is the outermost partition key that every binding, usage row
+// and audit row carries — change it and the deployment answers for a different tenant. `workspace`
+// and `surface` only fill a delivery that carries no platform identity (an `eve dev` HTTP call).
+export const deploymentIdentity: DeploymentIdentity = {
+  org: "default",
+  workspace: "dev",
+  surface: "default",
+};
+
+export const surfaces: readonly Surface[] = [
+  // defineSurface({ key: "slack/<team-id>", trust: "internal" }),
+];
+void defineSurface;
+
+registerSurfaces(surfaces);
+registerDeploymentIdentity(deploymentIdentity);

package/template/agent/instructions/access.ts

@@ -0,0 +1,11 @@
+// Dynamic per-scope instructions (identity, surface, ROLE prompt block, access summary,
+// memory index, channel scope) — resolved at session/turn start by the core module.
+//
+// LOAD-BEARING re-export: Eve only discovers instruction sources under the APP's
+// `agent/` root (`instructions.md` + this `instructions/` directory — the flat markdown
+// is prepended before directory modules). This file went missing in the Stage-2
+// monorepo split (01c3e43 moved the module into core without leaving a stub, unlike
+// channels/hooks/tools), which silently unmounted ALL dynamic instructions — the
+// compiled manifest carried `dynamicInstructions: []`. Restored with the roles work
+// (item 26), whose per-turn `instructions` slot injects through this same resolver.
+export { default } from "@open-everywhere/core/agent/instructions/access.js";