@open-everywhere/create 0.1.4

package/template/agent/lib/register-config.ts

@@ -0,0 +1,185 @@
+// App → core wiring. Registers the deployer-owned config (bundles, bindings, the plugin
+// registry, skill content, memory domains, role presets, webhook triggers, spend budgets,
+// the model-policy envelope) into core's config registry (access/config.ts)
+// as a startup side effect — so core modules resolve access WITHOUT importing app data
+// (the dependency-inversion seam for the planned core/app split; docs/core-app-separation.md in the Open Everywhere repository).
+//
+// Imported for its side effect by agent.ts (the agent definition, loaded at boot before any
+// hook/tool/connection handler runs) and by tests that exercise the resolver or its consumers.
+// Lives in agent/lib/ — Eve's import-only directory (never mounted, not a discovered primitive).
+// No consumer calls getConfig() at module top level, so this registration always completes
+// before the first resolve.
+
+import { registerConfig } from "@open-everywhere/core/agent/access/config.js";
+import { registerSettings } from "@open-everywhere/core/agent/settings/settings.js";
+import { registerModelPricing } from "@open-everywhere/core/agent/spend/pricing.js";
+import { loadModelPricing } from "../spend/model-pricing.js";
+import { SETTINGS_OVERRIDES } from "../settings/settings.js";
+import { setRegisteredConnectorCredentials } from "@open-everywhere/core/agent/access/connector-credentials.js";
+import { assertRoutesWithinPolicy } from "@open-everywhere/core/agent/model/policy.js";
+import { assertDomainCredentialsResolvable } from "@open-everywhere/core/agent/access/domain-credentials.js";
+import {
+  assertWindowSourcesVouched,
+  assertGovernanceDomains,
+  assertComplianceDomains,
+  assertReportChannels,
+  warnSilentRoomGrainWithoutPublicSignal,
+} from "@open-everywhere/core/agent/memory/domain.js";
+import { isVouchedInternal, declaredTrustForKeys } from "@open-everywhere/core/agent/identity/trust.js";
+import { resolveExternalPolicy } from "@open-everywhere/core/agent/access/external-policy.js";
+import { loadBundles, loadBindings } from "../access/bundles.js";
+import { loadNetworkAccess } from "../access/network-access.js";
+import { loadConnectorCredentials } from "../access/connector-credentials.js";
+import { loadAccessRequests } from "../access/access-requests.js";
+import { PLUGIN_REGISTRY } from "../plugins/registry.js";
+import { SKILL_CONTENT } from "../plugins/skill-content.js";
+import { loadDomains, loadSilos, domainsForSurface } from "../memory/config/domains.js";
+import { loadRoles } from "../roles/roles.js";
+import { loadWebhooks } from "../webhooks/hooks.js";
+import { loadSpendBudgets } from "../spend/budgets.js";
+import { loadSpendCheckpoints } from "../spend/checkpoints.js";
+import { loadModelPolicy } from "../model/policy.js";
+import { loadBlobHosting } from "../blob/hosting.js";
+import { loadPrincipals } from "../identity/principals.js";
+import { loadGroups } from "../identity/groups.js";
+// Side effect: register the operator's per-surface trust registry (identity/trust.ts) at
+// boot, before any binding resolves. Self-registering (calls registerSurfaces on
+// import); nothing to thread through the AppConfig object.
+//
+// 🔴 IT ALSO REGISTERS THIS DEPLOYMENT'S OWN IDENTITY, and that half is silent when it lapses.
+// `surfaces.ts` ends with `registerDeploymentIdentity(deploymentIdentity)`, and OPE-1545 deleted the
+// `OE_ORG`/`OE_WORKSPACE`/`OE_SURFACE` reads that used to mask its absence. Drop or reorder this one
+// import and the org, the ambient workspace and the ambient room all fall back to the shipped
+// defaults — every partition key silently becomes `default`, with nothing raised.
+// No check in this app catches that, so keep this import.
+import "../identity/surfaces.js";
+// Side effect: register this deployment's BROWSER HOST DECLARATION (agent/access/browser-hosts.ts) —
+// which hosts the in-sandbox browser may drive, under which verbs, with whose credential, and where
+// page scripting is armed (OPE-1614/OPE-1624). Same self-registering shape as `surfaces.js` above,
+// and it must land HERE rather than in register-adapters.ts: three readers consult it and only two
+// of them run after the adapter wiring — the adapter's own arming check, the firewall compiler
+// (access/egress.ts), and the SANDBOX TEMPLATE BAKE, which reaches `loadAgentBrowserConfig()` from
+// `agent/sandbox/sandbox.ts` through this module's import and nothing else. Drop this import and the
+// declaration is empty at bake time, so the capability silently refuses to arm.
+import "../access/browser-hosts.js";
+// Side effect: register the operator's per-AUTHOR trust register (identity/author-trust.ts) — the
+// AUTHORITY plane, the sibling of the surfaces AUDIENCE plane above. Self-registering, and it must
+// come AFTER the groups module loads (it expands `{ group: … }` members through loadGroups at
+// register time); `../identity/groups.js` is imported above, so by this line the group registry is
+// validated and up.
+import "../identity/authors.js";
+// Side effect: register this deployment's PRE-RUN COLLECTORS and CONDITION GATES (OPE-151,
+// routines/collector.ts + routines/gate.ts). Self-registering, and it must be up before the FIRST
+// dispatcher tick and before `create_routine` validates a proposal — both resolve a name against
+// these menus, and an unregistered menu refuses every name rather than firing ungated, so a dropped
+// import degrades loudly (a routine that names a collector stops being creatable) rather than
+// silently widening anything.
+import "../routines/collectors.js";
+
+// The BEHAVIOUR half of config-as-code (OPE-371), registered FIRST — before registerConfig, and
+// before the boot-time cross-validations below — because a settings-sensitive gate consulted during
+// that validation must see this deployment's opinion, not the shipped default. Its own validation
+// already ran at import (defineSettings throws on a bad value), so by this line the object is
+// known-good. Absent registration is a valid state (core falls back to the shipped defaults), which
+// is why this is not fail-loud the way registerConfig is.
+registerSettings(SETTINGS_OVERRIDES);
+
+// The PRICING half of config-as-code (OPE-1148), registered beside settings rather than through
+// registerConfig below, for one concrete reason: `getConfig()` THROWS when nothing has registered,
+// and pricing is read on the spend WRITE path (spend/store.ts usdMicrosAtWrite) — a core-only
+// process with no app config must resolve prices from core's BUILT_IN table, not crash. Its own
+// validation already ran at import (assertModelPricingValid throws on a bad rate), so by this line
+// the table is known-good. Registered EARLY, before the cross-validations below, so nothing that
+// prices during boot sees a half-wired deployment.
+registerModelPricing(loadModelPricing());
+
+registerConfig({
+  loadBundles,
+  loadBindings,
+  loadNetworkAccess,
+  loadConnectorCredentials,
+  pluginRegistry: PLUGIN_REGISTRY,
+  skillContent: SKILL_CONTENT,
+  loadDomains,
+  loadSilos,
+  loadRoles,
+  domainsForSurface,
+  loadWebhooks,
+  loadSpendBudgets,
+  loadSpendCheckpoints,
+  loadAccessRequests,
+  loadModelPolicy,
+  loadBlobHosting,
+  loadPrincipals,
+  loadGroups,
+});
+
+// Also feed the SAME catalogue list into core's lightweight registry (access/connector-credentials.ts).
+// The pure resolver gets the catalogues as an explicit arg, but core-side host paths that run outside
+// a resolveAccess call — the channel/webhook Notion REST reads (channels/notion-api.ts
+// resolveNotionApiKey) — never see it, so they read the notion `channel-key` credential's custody
+// stamp from here instead of a hard-coded env pin. Same array, same wiring point ⇒ one source of
+// truth (register at boot, before any webhook/tool resolves a Notion key).
+setRegisteredConnectorCredentials(loadConnectorCredentials());
+
+// Cross-validate at boot, fail LOUD: every domain/role model route (concrete id or tier)
+// must fit the org model-policy envelope — a reviewed git config naming a disallowed model
+// or an unfulfillable tier is a mistake, caught here before the first turn (no-op when no
+// policy is configured). Domains carry role defaults already (applyRoleDefaults inside
+// loadDomains); roles are validated too since a role rung can carry its own route.
+assertRoutesWithinPolicy(loadDomains(), loadRoles(), loadModelPolicy());
+
+// Multi-source WINDOW vouch (memory/domain.ts assertWindowSourcesVouched, window-tool-gating-design
+// §Q5): any standing WINDOW holding more than one source requires every register-gated source to be
+// operator-vouched. The unit is the window, not the domain (OPE-1167) — a `mode: "solo"` domain
+// whose named `windows` group merges two channels is checked too.
+// This MUST run HERE, not as a domains.ts module-load side-effect alongside
+// assertUnifiedDomainTrust — the vouch register is populated by the `surfaces.js` import
+// ABOVE, and domains.js is imported BEFORE it (this file's import order), so a check reading the
+// register at domains.js load time would see an EMPTY set and false-fail every source. By this line
+// both are up: domains loaded AND the register registered. The vouch is passed as a pure input
+// (`isVouchedInternal`, evaluated by the assertion at THIS call), never read as a singleton inside
+// the assertion (no desync).
+//
+// 🔴 It passes the RESOLVER, not `vouchedSurfaces()` (OPE-489). A flat key list is matched
+// either-grain, so a surface declared `public` UNDER an internal tenant would still find its tenant
+// key in the list and pass — joining a private cross-surface window the operator had just declared
+// open to the world. The resolver applies most-specific-wins and honours the carve-out.
+assertWindowSourcesVouched(loadDomains(), isVouchedInternal);
+
+// Governance venue config lint (OPE-110, memory/domain.ts assertGovernanceDomains / admin-
+// governance-design-2026-07-24.md §4.1): a `governance: true` domain must be an explicit
+// channels domain with a non-empty admins roster, ≤ GOVERNANCE_CHANNEL_MAX channels, all
+// operator-vouched-internal. Runs HERE for the SAME boot-order reason as the window vouch above
+// (the vouch register is populated by the surfaces.js import; by this line both are up), and it
+// takes the same RESOLVER for the same public-carve-out reason.
+assertGovernanceDomains(loadDomains(), isVouchedInternal);
+
+// Routine report-channel config lint (OPE-148, memory/domain.ts assertReportChannels): a
+// `reportChannel` must sit on an explicit channels domain and name one of that domain's OWN
+// channels, so a redirected routine can never post to an audience outside the domain it belongs
+// to. Whether the named surface is POSTABLE is a registry question checked at create time instead
+// (boot order makes it unanswerable here) — see schedules/routine-dispatch.ts.
+assertReportChannels(loadDomains());
+
+// Compliance-mode config lint (OPE-54 leg 2, memory/domain.ts assertComplianceDomains /
+// admin-governance-design-2026-07-24.md §7): `requestorEntitlementChecks` is an ORG-LEVEL opt-in and
+// may appear ONLY on the `org` pseudo-domain — a per-room placement is refused loudly rather than
+// silently ignored (a silently-ignored security opt-in is worse than none). Pure config check, no
+// vouch register needed, but kept alongside its sibling lints for one obvious boot-validation block.
+assertComplianceDomains(loadDomains());
+
+// Per-domain credential override lint (OPE-467, access/domain-credentials.ts): a domain that binds
+// a connector to its OWN credential must name a credential that connector actually declares. Runs
+// HERE because it is the one place both the domain list and the catalogue list are in hand. It must
+// fail LOUD: a bound domain never falls back to the org credential, so an unresolvable binding
+// would otherwise surface as a domain that silently fails every call to that vendor.
+assertDomainCredentialsResolvable(loadDomains(), loadConnectorCredentials());
+
+// Silent room-grain reachability signal (OPE-818, memory/domain.ts warnSilentRoomGrainWithoutPublicSignal's
+// own doc comment for why this WARNS rather than fails boot). Runs HERE, after the surfaces.js
+// import above, for the same boot-order reason as the vouch checks: declaredTrustForKeys reads the
+// live trust register that import populates.
+warnSilentRoomGrainWithoutPublicSignal(loadDomains(), resolveExternalPolicy().roomGrain, (workspaceKey, surfaceKey) =>
+  declaredTrustForKeys(workspaceKey, surfaceKey) === "public",
+);

package/template/agent/memory/config/agents-overlay.ts

@@ -0,0 +1,26 @@
+// The AGENTS OVERLAY loader — the runtime half of the create_agent flow's config foundation
+// (increment 1). `agents.generated.ts` (next to this file) is a MACHINE-OWNED, DATA-ONLY overlay of
+// extra memory domains + silos + access bundles/bindings (and the frozen AgentSpec side-table that
+// derived them) that merges into the config-as-code baseline — domains.ts (domains + silos) and
+// bundles.ts (bundles + bindings) — at load. Nothing edits it by hand in the normal flow: the
+// deterministic codemod (core memory/agents-codemod.ts) writes it on a create-agent branch, a bot-PR
+// carries the diff, and GitHub's merge button is the approval gate — exactly like the grants overlay
+// (agent/access/grants.ts).
+//
+// WHY a static import (not an fs read): Eve's bundler inlines the module into the deploy artifact, so
+// the overlay can never be silently absent at runtime. Parsing is STRICT + fail-loud (parseAgentsFile):
+// a malformed overlay refuses to boot rather than loading as "roughly right", and Vercel keeps the
+// previous deployment live on a failed build/boot. This loader does not prove the `.ts` module is
+// data. In this app the person who merges the codemod's PR is the only gate on that — see
+// agent/access/grants.ts.
+
+import { parseAgentsFile, type AgentsFile } from "@open-everywhere/core/agent/memory/agents-codemod.js";
+import agentsOverlay from "./agents.generated.js";
+
+const overlay: AgentsFile = parseAgentsFile(agentsOverlay);
+
+/** The parsed agents overlay — merged into loadDomains()/loadSilos() (domains.ts) and
+ *  loadBundles()/loadBindings() (bundles.ts). */
+export function loadAgentsOverlay(): AgentsFile {
+  return overlay;
+}

package/template/agent/memory/config/agents.generated.ts

@@ -0,0 +1,21 @@
+// GENERATED + MACHINE-OWNED — DO NOT HAND-EDIT.
+//
+// The agents overlay: DATA ONLY. Written exclusively by the deterministic codemod
+// (packages/core/agent/memory/agents-codemod.ts) on a bot-PR branch; the PR merge is the approval gate.
+//
+// The codemod re-emits this file from its own parsed content and refuses to rewrite it when the
+// bytes differ, so a hand-edit stops the next machine PR. Before a merge, nothing checks that the
+// file is still data only unless the repository runs its own check: the person who merges the PR
+// is the gate. Read a PR to this file as code, because it is code.
+//
+// To change it by hand, edit only the data below and keep the layout exactly as emitted.
+
+import type { AgentsFile } from "@open-everywhere/core/agent/memory/agents-codemod.js";
+
+export default {
+  "domains": [],
+  "silos": [],
+  "bundles": [],
+  "bindings": [],
+  "specs": []
+} satisfies AgentsFile;

package/template/agent/memory/config/domains/dm.ts

@@ -0,0 +1,10 @@
+// DM — an internal DM partner keeps a personal per-user silo, and reads the org brain on top
+// (read-only), so the agent can recall shared facts in a 1:1. Delete this file's entry in
+// domains/index.ts to keep DMs personal-only.
+//
+// `models.primary` routes every internal DM session to the cheaper utility model.
+
+import { defineDomain } from "@open-everywhere/core/agent/memory/domain.js";
+import { UTILITY_MODEL } from "../../../model/models.js";
+
+export const domain = defineDomain({ name: "dm", match: "dm", includeOrg: "readonly", models: { primary: { id: UTILITY_MODEL } } });

package/template/agent/memory/config/domains/index.ts

@@ -0,0 +1,125 @@
+// THE DOMAIN LOADER — one file per domain, assembled here (OPE-254).
+//
+// Each `domains/<name>.ts` exports ONE `defineDomain(...)` as `domain`, plus an optional
+// `enabled()` predicate for a fixture that is only registered under a flag. This file lists them,
+// and the list is the only reason to edit it: adding a domain is a new file plus one line here.
+//
+// WHY A LIST AND NOT A DIRECTORY SCAN. The deployment builds to a bundle, where a directory read at
+// runtime finds nothing. An explicit list also makes the domain set a reviewable diff: a new domain
+// shows up as a line in this file, never as a file that appeared.
+//
+// WHAT A DOMAIN FILE SAYS. `reach` is the one membership list — an exact key
+// `platform/<tenant>/<surface>`, a whole tenant `platform/<tenant>`, or a same-level glob
+// `platform/<tenant>/<prefix>*` — and `exclude` carves keys back out. MOST SPECIFIC WINS across
+// domains, so an exact key beats a glob and a longer glob beats a shorter one; handing a slice of
+// one domain's tenant to another is written by writing the narrower entry, nothing more.
+// Anything needing a concrete list (approval-card venue, `reportChannel`, a `governance` venue)
+// reads the EXACT entries only. A container hands its domain's MEMORY and sandbox preset to
+// surfaces nobody typed — and, because a domain-scoped binding matches by domain membership,
+// whatever bundles are bound to that domain travel with it. That is a deliberate capability grant,
+// and it is why this lives in code behind a PR: widen a domain's reach and you have widened an
+// access scope.
+//
+// `role` (optional): adopt a named ROLE preset from agent/roles/roles.ts — a reusable set of
+// instructions/persona + themed statusVerbs (+ optionally models/memory/sandbox). A role presets no
+// access knob at all, so it can never widen what a domain reaches. The domain's own fields win,
+// field by field; verbs merge framework ← org ← role ← domain like any other layer.
+//   defineDomain({ name: "qa", reach: ["slack/T…/C…"], role: "qa-engineer" })
+//   defineDomain({ name: "org", match: "org", role: "butler" })   // workspace-wide voice
+//   // explicit fields still win over the role's preset, knob by knob:
+//   defineDomain({ name: "qa", reach: ["slack/T…/C…"], role: "qa-engineer",
+//     statusVerbs: ["Kicking the tyres"],              // EXTENDS the role's themed verbs
+//     models: { primary: { reasoning: "high" } } })    // overlays the role's route, field-by-field
+//
+
+// --- EXAMPLE: a team domain spanning a couple of channels, with memory + tools ---
+// defineDomain({
+//   name: "transactions",
+//   reach: ["slack/T_ENG/C_TXN", "slack/T_ENG/C_TXN_EMEA"], // fully-qualified surface keys
+//   memory: "transactions-silo",   // → a silo above (omit for a grouping with no memory)
+// }),
+//
+// A domain declares memory, not capability — there is no `bundle:` field to set here. To give
+// this domain's channels a bundle, BIND it in agent/access/bundles.ts:
+//   defineBinding({ bundle: "transactions-tools", scope: { level: "domain", domain: "transactions" } })
+// The binding names the domain; `bindings` stays the one list resolveAccess reads and the
+// config-diff gate audits.
+//
+// --- EXAMPLE: multi-source — the team's own writable brain PLUS a shared, read-only
+//     baseline. Each silo materialises into its own dir (memory/transactions-silo/,
+//     memory/org-baseline/); the agent writes to the writable one, reads both. ---
+// defineDomain({
+//   name: "transactions",
+//   reach: ["slack/T_ENG/C_TXN"],
+//   memory: "transactions-silo",   // the domain's OWN brain…
+//   includeOrg: "readonly",        // …PLUS the `org` pseudo-domain's silos as one unit
+// }),                              // (auto-tracks org; change org once, every domain follows)
+//
+// --- CRITERIA PSEUDO-DOMAINS (optional) — selected by trust/mode, not a channel list.
+//     Each is a singleton (at most one per match) with the full domain toolkit.
+//
+// ORG — internal channels in NO explicit domain fall through here (the old "org default";
+// omit this domain to give unassigned channels no shared memory). Per-silo read/write —
+// keep a curated baseline read-only; nothing is forced.
+// defineDomain({ name: "org", match: "org", memory: "org-baseline" }),
+//
+// PUBLIC — externally-shared / guest channels AND external DM partners route here (the
+// trust gate's destination). Read-only by construction (external sessions never write
+// shared memory). Leave it out (or give it no silos) and external surfaces get no memory.
+// defineDomain({ name: "public", match: "public", memory: "external-faq" }),
+//
+// DM — the shared READ layer an INTERNAL DM partner gets on top of their always-present
+// per-user DB silo. Commonly just the org baseline; omit to keep DMs personal-only.
+// defineDomain({ name: "dm", match: "dm", includeOrg: "readonly" }),
+
+import type { Domain } from "@open-everywhere/core/agent/memory/domain.js";
+
+import * as org from "./org.js";
+import * as dm from "./dm.js";
+
+/** One domain module: its `domain`, and the flag that decides whether it is registered at all. */
+export interface DomainModule {
+  readonly domain: Domain;
+  readonly enabled?: () => boolean;
+}
+
+/**
+ * Every domain module, in registration order. The order is not a tiebreak — most-specific-wins
+ * decides ownership and config load refuses any pair it cannot order — but it IS the order a
+ * deployer reads, and a few callers take a domain's first exact key as its anchor surface.
+ */
+const MODULES: readonly DomainModule[] = [org, dm];
+
+/**
+ * The declared domain set — every module whose `enabled()` holds (absent = always).
+ *
+ * 🔴 REFUSES A DUPLICATE NAME, here rather than downstream. A domain name is an IDENTIFIER: it keys
+ * the operational store's domain rows, the synthetic session-registry key `oe-domain::<name>` and
+ * the supervisor token. Two modules exporting one name would put two configurations on one set of
+ * rows, and whichever loaded last would silently win. Every other cross-domain invariant — at most
+ * one domain per key, no unorderable overlap, every named room routed — is a single assertion over
+ * the assembled set in domains.ts, because none of them can be decided one file at a time.
+ */
+export function loadDomainModules(): Domain[] {
+  return assembleDomains(MODULES);
+}
+
+/** {@link loadDomainModules} over an INJECTED module list — pure, so the refusal above can be tested
+ *  without a second copy of the deployment's own config. */
+export function assembleDomains(modules: readonly DomainModule[]): Domain[] {
+  const out: Domain[] = [];
+  const seen = new Map<string, number>();
+  for (const [index, m] of modules.entries()) {
+    if (m.enabled !== undefined && !m.enabled()) continue;
+    const previous = seen.get(m.domain.name);
+    if (previous !== undefined) {
+      throw new Error(
+        `open-everywhere: two domain modules declare the name "${m.domain.name}" (entries ${previous} and ${index} of memory/config/domains/index.ts) — ` +
+          "a domain name keys the store's domain rows and the session registry, so one name is one domain. Rename one, or delete the duplicate file.",
+      );
+    }
+    seen.set(m.domain.name, index);
+    out.push(m.domain);
+  }
+  return out;
+}

package/template/agent/memory/config/domains/org.ts

@@ -0,0 +1,27 @@
+// ORG — every internal room that no explicit domain claims shares this one writable brain. Without
+// it, a room resolves to "no domain" and has nowhere durable to save. Start with one shared brain,
+// and carve rooms into their own domains later if you want separate brains.
+//
+// `nameDropWake` lets the agent give a judged reply to a top-level message that says its name
+// without an @mention. The framework default is off.
+//
+// `admins` grants org-admin standing: the control plane's org-wide tools, approval cards and the
+// spend-cap bypass. Entries are QUALIFIED principal keys. A Slack member id is issued per
+// workspace, so a Slack entry carries the workspace: `slack/<T… team id>/<U… member id>`.
+//   admins: ["slack/<team-id>/<member-id>"],
+//
+// `models` routes the model per room group. It inherits org → explicit domain, field by field.
+// `models.supervisor` routes the always-on ambient channel supervisor (opt-in per domain with
+// `ambientSupervisor`) to a cheap tier, without changing the engaged thread sessions.
+
+import { defineDomain } from "@open-everywhere/core/agent/memory/domain.js";
+import { SUPERVISOR_MODEL } from "../../../model/models.js";
+
+export const domain = defineDomain({
+  name: "org",
+  match: "org",
+  memory: "org-brain",
+  nameDropWake: true,
+  admins: [],
+  models: { supervisor: { id: SUPERVISOR_MODEL, reasoning: "low" } },
+});

package/template/agent/memory/config/domains.ts

@@ -0,0 +1,165 @@
+// Memory configuration — config-as-code, the admin console for the opt-in memory model
+// (docs/capabilities/memory.md in the Open Everywhere repository). This file ASSEMBLES and VALIDATES; it declares no domain.
+//   - DOMAINS    — one file each, in memory/config/domains/, listed by that directory's index.ts.
+//                  A domain is the anchor: which channels share one brain and where it lives (a
+//                  silo). A channel belongs to AT MOST ONE domain (enforced at load by
+//                  assertChannelExclusivity). What those channels can DO is NOT set there:
+//                  capability comes from a domain-scoped BINDING in agent/access/bundles.ts
+//                  (`{ level: "domain", domain: "<name>" }`), which names the domain rather
+//                  than being named by it — one grant path, one audited list.
+//   - SILOS      — reusable backings (where memory physically lives). Referenced by name. Declared
+//                  here, because a silo is shared BETWEEN domains and belongs to no one of them.
+//
+// ONE LIST SAYS WHAT A DOMAIN REACHES (OPE-254), and domains/index.ts documents it in full:
+//   reach:   ["github/acme/api", "slack/T_CO/C_ENG"]  // exact keys — the enumerable half
+//   reach:   ["github/acme"]                          // a whole tenant, incl. repos made tomorrow
+//   reach:   ["github/acme/payments-*"]               // …or a same-level glob, strictly narrower
+//   exclude: ["github/acme/payments-secrets"]         // …minus these; exclude ALWAYS wins
+// MOST SPECIFIC WINS: an exact key beats a container, a longer container beats a shorter one. So a
+// room named outright can never be annexed by a broader pattern, and two domains splitting one
+// tenant just write the narrower entry. Reach for the glob before the tenant: same ergonomics,
+// strictly less reach.
+//
+// Memory is OPT-IN: with nothing declared, channels have no shared memory (the agent still
+// responds; DMs still get personal memory). Give a channel memory by putting it in a domain.
+// This file is the seam a DB/dashboard would swap behind.
+//
+// ─────────────────────────────────────────────────────────────────────────────
+// SAFETY: an externally-shared / guest-bearing channel never reaches an internal domain,
+// even if listed in one — the trust gate (memory/resolve.ts) routes it to the read-only
+// `public` pseudo-domain (empty unless you curate it); config can't override this. External
+// sessions never WRITE shared memory. DM/personal memory is always DB-pinned, never git/Notion.
+// ─────────────────────────────────────────────────────────────────────────────
+
+import {
+  domainForChannel,
+  assertChannelExclusivity,
+  assertDomainsValid,
+  assertUnifiedDomainTrust,
+  assertWindowGroupExclusivity,
+  type Domain,
+} from "@open-everywhere/core/agent/memory/domain.js";
+import { assertSingleTenantPerTenantScopedPlatform } from "@open-everywhere/core/agent/access/tenant-admission.js";
+import { defineMemorySilo, assertSilosValid, type MemorySilo } from "@open-everywhere/core/agent/memory/silo.js";
+import { assertExposedAgentsCurated } from "@open-everywhere/core/agent/memory/agents-codemod.js";
+import { applyRoleDefaults } from "@open-everywhere/core/agent/roles/role.js";
+import { loadRoles } from "../../roles/roles.js";
+import { loadAgentsOverlay } from "./agents-overlay.js";
+import { loadDomainModules } from "./domains/index.js";
+
+const silos: MemorySilo[] = [
+  // The workspace's shared brain. Postgres-backed (matches the deploy:
+  // OE_MEMORY_PROVIDER=postgres + Neon DATABASE_URL). Referenced by the `org`
+  // domain below, so every internal channel writes to / reads from one brain.
+  defineMemorySilo({ name: "org-brain", provider: "postgres" }),
+
+  // --- EXAMPLE: a DB-backed silo (the default substrate; works out of the box) ---
+  // defineMemorySilo({ name: "transactions-silo", provider: "postgres" }),
+  //
+  // --- EXAMPLE: a git-repo-backed silo (Phase B) ---
+  // defineMemorySilo({ name: "transactions-silo", provider: "github", container: "acme/brain", path: "transactions" }),
+  //
+  // --- EXAMPLE: Notion memory = a read-only MATERIALISED HOT-CACHE on disk (THE Notion form) ---
+  // Notion has ONE memory mode: the page subtree is pulled to MD files on disk (the read path —
+  // context-light, offline, grep-able), kept READ-ONLY (edits are blocked fail-loud so the agent
+  // can't lose updates). To UPDATE, the agent uses the Notion tools (named by `skill`) — never by
+  // editing the cache; the cache then refreshes from Notion. `description` + `skill` surface in the
+  // top-level memory index. (docs/capabilities/memory.md in the Open Everywhere repository "Notion hot-cache".)
+  // defineMemorySilo({ name: "org-baseline", description: "company handbook", provider: "notion",
+  //   container: "<root-page-id>", readOnly: true, skill: "notion" }),
+  //
+  // --- EXAMPLE: a CURATED SUBSET of one source in a single silo (memory/selection.ts) ---
+  // Take the root page + the "Handbook" subtree, but NOT the noisy "Archive" sibling. `default`
+  // is "include" (take only the root + ticked nodes) or "recurse" (take all, prune with excludes);
+  // rule paths are relative to the root (or a Notion page id). Also works for github folders.
+  // defineMemorySilo({ name: "curated", provider: "notion", container: "<root-page-id>", readOnly: true,
+  //   select: { default: "include", rules: [{ path: "Handbook", mode: "recurse" }] } }),
+  //
+  // NB: every silo is materialised (files on disk) — there is no "live, not-on-disk" memory mode.
+  // A live external source the agent reads/writes is a connector + a bundle instruction (access
+  // plane), not a memory silo. Notion memory = the materialised read-only hot-cache above.
+
+];
+
+// The AGENTS OVERLAY (create_agent flow, increment 1) — a MACHINE-OWNED, DATA-ONLY overlay of extra
+// domains + silos (and the frozen AgentSpec side-table), written by the deterministic create_agent
+// codemod and approved via GitHub's merge button, exactly like the grants overlay in bundles.ts. It
+// merges ADDITIVELY here BEFORE the asserts, so the same load-time validation covers overlay-derived
+// domains/silos, and the empty overlay is a byte-for-byte no-op.
+const agentsOverlay = loadAgentsOverlay();
+const rawDomains: Domain[] = loadDomainModules();
+const mergedRawDomains: Domain[] = [...rawDomains, ...agentsOverlay.domains];
+const mergedSilos: MemorySilo[] = [...silos, ...agentsOverlay.silos];
+
+// Resolve role presets at config load: each domain's `role` overlays its single-valued
+// defaults (memory/sandbox; the domain's own field wins) so every downstream consumer sees
+// a plain Domain — a role is sugar, and presets no access knob at all. THROWS on
+// an unknown role name (the typo'd-`role:` bug class fails loud, like the asserts below).
+const domains: Domain[] = applyRoleDefaults(mergedRawDomains, loadRoles());
+
+// Validate once, at module load (fail loud on a misconfiguration) — and over the WHOLE assembled
+// set, because none of these is decidable one domain file at a time: a channel is in ≤1 domain and
+// every room a domain names outright still routes to it; domains are reach-XOR-match with singleton
+// pseudo-domains + valid includeOrg; every silo is materialised (has a provider).
+assertChannelExclusivity(domains);
+assertDomainsValid(domains);
+// TENANT FENCE (OPE-309 phase 0c): on a tenant-scoped platform (Slack today) a person id is issued
+// PER TENANT, while a principal key is only `platform/<id>` — so declaring two workspaces of one
+// vendor makes two different humans share one key, and every matcher over it (admin rosters, wake
+// trust, approval clickers, a DM's personal credentials) can hand one person the other's standing.
+// Refused at boot unless OE_ALLOW_MULTI_TENANT_PRINCIPALS=1 says the operator accepts it.
+assertSingleTenantPerTenantScopedPlatform(domains);
+// Unified cross-surface supervisor (research preview) structural safety: a unified domain must be
+// an explicit team-section with ambientSupervisor on, never a pseudo-domain; the org gate lives
+// only on the org domain (memory/domain.ts assertUnifiedDomainTrust). Inert unless a domain opts in.
+assertUnifiedDomainTrust(domains);
+// NAMED WINDOW GROUPS (OPE-1167): a group name IS the window id, and a window id keys the
+// `channel_session` registry row GLOBALLY — so a name two domains share, or a name that is also a
+// domain name, would put two domains' standing conversations on one row. Refused here, with the
+// within-domain overlap that would make "which window owns this channel" depend on declaration
+// order. Inert unless a domain declares `windows`.
+assertWindowGroupExclusivity(domains);
+assertSilosValid(mergedSilos);
+// create_agent EXPOSURE INVARIANT (memory/agents-codemod.ts): every overlay agent whose frozen spec
+// is `exposed` must stay curated read-only — its domain never inherits the org brain or becomes a
+// criteria pseudo-domain, and every silo it reads is readOnly. Keyed off the overlay's own `specs`
+// side-table (a Domain carries no `exposed` field in the MVP). Inert while the overlay is empty.
+assertExposedAgentsCurated(domains, mergedSilos, agentsOverlay.specs);
+
+/** The seam a DB/dashboard would swap behind. Static config + agents overlay. */
+export function loadDomains(): readonly Domain[] {
+  return domains;
+}
+
+/** Reusable memory silos (code config + agents overlay). */
+export function loadSilos(): readonly MemorySilo[] {
+  return mergedSilos;
+}
+
+// --- The CODE-ONLY baselines (agents overlay EXCLUDED) — the create_agent PR path
+// (approvals/agent-create.ts) merges a CANDIDATE agents overlay into these for ring-② pre-PR
+// re-validation of the MEMORY half, the domain/silo analogue of loadBaseBundles/loadBaseBindings.
+// Role presets are applied (same shape boot validates) so an overlay agent's channel colliding with a
+// code domain is caught at execute time, not only at boot. NOT for resolver use — runtime memory
+// resolves against the merged loaders above.
+const baseDomains: Domain[] = applyRoleDefaults(rawDomains, loadRoles());
+export function loadBaseDomains(): readonly Domain[] {
+  return baseDomains;
+}
+export function loadBaseSilos(): readonly MemorySilo[] {
+  return silos;
+}
+
+/**
+ * Domain names a surface belongs to (≤1 under exclusivity) — consumed by the access
+ * layer for `domain`-scoped capability bindings. Derived from the domain registry so
+ * memory grouping and access grouping never drift.
+ */
+export function domainsForSurface(
+  p: { workspaceKey: string; surface: string },
+  list: readonly Domain[] = domains,
+): string[] {
+  const channelKey = `${p.workspaceKey}/${p.surface}`;
+  const d = domainForChannel(channelKey, list);
+  return d ? [d.name] : [];
+}

package/template/agent/model/models.ts

@@ -0,0 +1,60 @@
+// The model per ROLE, resolved from the active stack (agent/model/stacks.ts). Import a role's id
+// from here. Do not write a model id literal anywhere else.
+
+import type { ModelPolicyAllowEntry } from "@open-everywhere/core/agent/model/policy.js";
+import {
+  defaultAgentModelId,
+  registerDefaultAgentModelId,
+} from "@open-everywhere/core/agent/model/default-model.js";
+import { getSettings } from "@open-everywhere/core/agent/settings/settings.js";
+import { SETTINGS_OVERRIDES } from "../settings/settings.js";
+import { resolveStack, type ModelRole, type ModelRoleSpec, type ModelStack } from "./stacks.js";
+
+export type { ModelRoleSpec, ModelStack } from "./stacks.js";
+
+const STACK_ALIAS = getSettings(process.env, SETTINGS_OVERRIDES).models.stack;
+const STACK: ModelStack = resolveStack(STACK_ALIAS, {});
+
+// A deploy can retarget the primary (OE_FORCE_MODEL / OE_PRIMARY_MODEL). Core owns that
+// precedence, so read the primary back from it.
+registerDefaultAgentModelId(STACK.primary.id);
+
+export const MODELS = {
+  primary: { ...STACK.primary, id: defaultAgentModelId() },
+  utility: STACK.utility,
+  vision: STACK.vision,
+  supervisor: STACK.supervisor,
+  judge: STACK.judge,
+} as const satisfies Record<string, ModelRoleSpec>;
+
+/** The alias of the stack this process resolved — for `/oe status`. */
+export const MODEL_STACK = STACK_ALIAS;
+
+export const PRIMARY_MODEL = MODELS.primary.id;
+export const UTILITY_MODEL = MODELS.utility.id;
+export const VISION_MODEL = MODELS.vision.id;
+export const SUPERVISOR_MODEL = MODELS.supervisor.id;
+export const JUDGE_MODEL = MODELS.judge.id;
+export const PRIMARY_MODEL_CONTEXT_WINDOW_TOKENS = MODELS.primary.contextWindowTokens;
+
+/** One allow-list entry per distinct id in `stack`. The vision model is not selectable as a turn model. */
+export function allowListForStack(stack: ModelStack, extra: readonly ModelPolicyAllowEntry[] = []): ModelPolicyAllowEntry[] {
+  const out: ModelPolicyAllowEntry[] = [];
+  const seen = new Set<string>();
+  for (const [role, spec] of Object.entries(stack) as [ModelRole, ModelRoleSpec][]) {
+    if (seen.has(spec.id)) continue;
+    seen.add(spec.id);
+    out.push(role === "vision" ? { id: spec.id, tier: spec.tier, selectable: false } : { id: spec.id, tier: spec.tier });
+  }
+  for (const entry of extra) {
+    if (seen.has(entry.id)) continue;
+    seen.add(entry.id);
+    out.push(entry);
+  }
+  return out;
+}
+
+/** The active stack's allow-list, plus `extra`. */
+export function modelAllowList(extra: readonly ModelPolicyAllowEntry[] = []): ModelPolicyAllowEntry[] {
+  return allowListForStack(MODELS, extra);
+}