@open-everywhere/create 0.4.0 → 0.6.0

package/README.md

@@ -58,7 +58,7 @@ prompts. The directory must be new or empty. A fresh clone of an empty repositor
 and it counts as empty: run `npx @open-everywhere/create .` inside it. The scaffold refuses a
 directory that holds anything else. Run inside an empty clone named `my-agent`,
 `npx @open-everywhere/create my-agent` would make `my-agent/my-agent/`, so it refuses and prints the
-`.` command instead. To nest on purpose, create the inner directory first. The app depends on the eight `@open-everywhere/*` libraries at
+`.` command instead. To nest on purpose, create the inner directory first. The app depends on the nine `@open-everywhere/*` libraries at
 this CLI's own version — plus this package itself, as a dev dependency, for its `check` script — and
 on `eve` at the pin core declares; its `postinstall` applies the eve patch. Its roster mounts the launch surfaces: Slack, Notion and GitHub. The app carries `AGENTS.md`,
 a `.mcp.json` for the `open-everywhere-ops` MCP server and the `quickstart-open-everywhere` skill,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-everywhere/create",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "license": "Apache-2.0",
   "type": "module",
   "description": "npx scaffold and setup check for Open Everywhere — one step engine, reported by --check for an agent-led setup.",
@@ -46,8 +46,8 @@
     "test:env-pipe": "tsx scripts/env-pipe-test.ts"
   },
   "dependencies": {
-    "@open-everywhere/core": "0.4.0",
-    "@open-everywhere/provider-slack": "0.4.0",
+    "@open-everywhere/core": "0.6.0",
+    "@open-everywhere/provider-slack": "0.6.0",
     "tsx": "^4.23.9"
   },
   "devDependencies": {

package/src/scaffold.ts

@@ -1,11 +1,11 @@
 // THE SCAFFOLD — `npx @open-everywhere/create <dir>` copies the quickstart app (this package's
 // `template/` directory) into a new or empty `<dir>`, and then prints the next steps.
 //
-// The template is a minimal npm-consumer app: the eight `@open-everywhere/*` libraries and `eve`,
+// The template is a minimal npm-consumer app: the nine `@open-everywhere/*` libraries and `eve`,
 // a roster of the launch surfaces (Slack, Notion, GitHub), and the agent config. Every
 // `@open-everywhere/*` dependency, `@open-everywhere/create` itself, and the versions in
 // `roster.lock.json` carry the {@link VERSION_PLACEHOLDER}. The scaffold replaces it with this
-// CLI's own version: all nine packages publish in lockstep, so this CLI's version IS the version
+// CLI's own version: all ten packages publish in lockstep, so this CLI's version IS the version
 // of every library it installs.
 //
 // THREE PACKING RULES SHAPE THE TEMPLATE:

package/template/agent/access/a2a-agents.ts

@@ -0,0 +1,44 @@
+// The A2A AGENTS this app declares (OPE-2425) — config-as-code, changed by pull request only.
+//
+// MCP servers (./mcp-servers.ts) give the agent TOOLS AND DATA. A2A agents give it OTHER AGENTS: a
+// focused enterprise agent — an Agentforce, ServiceNow, Workday or Copilot Studio agent — that takes a
+// whole task in plain language and reports back. Each entry here is one such agent:
+//   • The agent reads the entry's published AGENT CARD and reaches ONLY the card URL's origin (scheme,
+//     host and port). A card that names an endpoint anywhere else is refused.
+//   • `delegate_to_agent` sends it a task. Every delegation takes an approval first: a member's click on
+//     a card that shows the agent, its host and the exact task text, or a pre-approval rule or the
+//     approval judge. The task goes out with the asker's identity attached
+//     (platform, workspace and their verified id) in the message metadata, with the person who approved
+//     it, or the rule that lifted it.
+//   • What the agent answers is UNTRUSTED content: it is fenced like any connector result, and it taints
+//     the turn that reads it.
+//
+// Only an INTERNAL room may delegate: a shared (Slack Connect), public or guest room is refused, and so
+// is a request a guest or external account took part in. `domains` narrows it further.
+//
+// A person cannot add an agent: a name that is not in this list is refused. No secret goes in this
+// file — an agent that needs a token names its credential-store REF (`npx oe secret set <ref>`).
+// See docs/extending/a2a-agents.md.
+
+import { defineA2aAgents } from "@open-everywhere/core/agent/a2a/agents.js";
+
+export const A2A_AGENTS = defineA2aAgents([
+  // Example — an agent with a public card and no credential:
+  //
+  // {
+  //   name: "it-helpdesk",
+  //   cardUrl: "https://<the vendor's agent host>/.well-known/agent-card.json",
+  //   description: "The IT helpdesk agent: opens, reads and updates IT tickets for a person.",
+  // },
+  //
+  // Example — an agent that takes a bearer token. Store the token with `npx oe secret set <ref>` and
+  // name the REF here, never the value:
+  //
+  // {
+  //   name: "hr-agent",
+  //   cardUrl: "https://agents.hr.example/.well-known/agent-card.json",
+  //   description: "The HR agent: answers questions about leave, payroll dates and benefits.",
+  //   auth: { scheme: "bearer", secretRef: "db:a2a:hr-agent-token" },
+  //   domains: ["people-ops"], // optional: only conversations in these memory domains may use it
+  // },
+]);

package/template/agent/access/access-requests.ts

@@ -30,6 +30,7 @@ import { emptyAgentsFile } from "@open-everywhere/core/agent/memory/agents-codem
 import { loadBaseBundles, loadBaseBindings } from "./bundles.js";
 import { loadBaseConnectorCredentials } from "./connector-credentials.js";
 import { loadBaseWebhooks } from "../webhooks/hooks.js";
+import { MCP_SERVERS } from "./mcp-servers.js";
 import { loadBaseDomains, loadBaseSilos, loadDomains } from "../memory/config/domains.js";
 import { loadGroups } from "../identity/groups.js";
 
@@ -61,6 +62,8 @@ export function loadAccessRequests(): AccessRequestsConfig | null {
     // baseline a candidate overlay is validated against before any PR opens.
     hooksPath: process.env.OE_WEBHOOK_HOOKS_PATH || undefined,
     baseWebhooks: loadBaseWebhooks,
+    // The declared MCP servers, so `propose_mcp_server` validates a candidate entry against them (OPE-2420).
+    baseMcpServers: () => MCP_SERVERS,
     // The `create_agent` PR path (create_agent flow, increment 2) rides this SAME config repo, branch
     // and bot credential — only the machine-written file differs (the agents overlay). `baseAgents` is
     // the code-declared agents baseline (empty — agents live only in the overlay); `baseDomains` /

package/template/agent/access/bundles.ts

@@ -17,8 +17,10 @@ import {
   type Bundle,
 } from "@open-everywhere/core/agent/access/bundle.js";
 import { mcpServerBindings, mcpServerBundles } from "@open-everywhere/core/agent/connections/mcp-servers.js";
+import { domainRuleBindings, domainRuleBundles } from "@open-everywhere/core/agent/access/domain-rules.js";
 import { loadGrantsOverlay } from "./grants.js";
 import { MCP_SERVERS } from "./mcp-servers.js";
+import { DOMAIN_RULES } from "./domain-rules.js";
 import { PRE_APPROVAL_RULES } from "./pre-approval-rules.js";
 import { loadAgentsOverlay } from "../memory/config/agents-overlay.js";
 import { loadGroups } from "../identity/groups.js";
@@ -66,6 +68,10 @@ const bindings: Binding[] = [
 // every person's OWN DM (the built-in `oe:everyone` group, or the groups the entry names). Never a channel.
 bundles.push(...mcpServerBundles(MCP_SERVERS));
 bindings.push(...mcpServerBindings(MCP_SERVERS));
+// The domain rules people asked for from approval cards and an admin merged (./domain-rules.ts, OPE-2456): each
+// domain's rules in one bundle, bound at that domain's scope only.
+bundles.push(...domainRuleBundles(DOMAIN_RULES));
+bindings.push(...domainRuleBindings(DOMAIN_RULES));
 
 const overlay = loadGrantsOverlay();
 const agentsOverlay = loadAgentsOverlay();

package/template/agent/access/domain-rules.ts

@@ -0,0 +1,18 @@
+// Domain rules — the acts one domain's people asked to allow without a card, merged by an admin.
+//
+// A person in a domain room can choose "Approve, and allow things like this" on an approval card. After they confirm
+// the rule in plain words, the agent opens a pull request that adds one line here (or widens the line for the same
+// tool and kind of action). Nothing applies until an admin merges it. The pull request names who asked, from which
+// card, and quotes the act.
+//
+// Each line is ONE JSON entry: the domain, a stable id, the rule the approval judge reads, and the structured policy
+// the rule was written from. A rule states policy — the tool, the kind of action, the kind of object — and never one
+// object: config load refuses a rule that names a URL, an id or a numbered item. Delete a line to remove its rule.
+// Keep one entry per line, with a trailing comma: the agent's pull requests edit this file line by line.
+//
+// The full reference is docs/how-it-works/pre-approval-rules.md in the Open Everywhere repository.
+
+import { defineDomainRules } from "@open-everywhere/core/agent/access/domain-rules.js";
+
+export const DOMAIN_RULES = defineDomainRules([
+]);

package/template/agent/access/mcp-servers.ts

@@ -16,10 +16,23 @@
 // which needs no client id and no secret. Only a vendor WITHOUT dynamic registration takes a static
 // client, and then this file names the secret's credential-store REF, never its value.
 // See docs/extending/connectors.md#declare-an-mcp-server-in-your-app.
+//
+// "SEARCH SLACK AS YOU" (OPE-2421) is a built-in entry: `slackAsYou({ clientId })` mounts Slack's own MCP
+// server on each person's own Slack sign-in, in their Slack DM only. The agent answers with the bot first and
+// offers the person's connection only when the bot cannot see what was asked; every post as the person takes a
+// card. It reuses the org's own Slack app: name its public Client ID here, and store its Client Secret with
+// `npx oe secret set db:slack:oauth-client-secret`. The Slack app also needs the MCP toggle (its Agents section)
+// and the scopes in the manifest `surface_manifest` returns once this entry is declared.
+// See docs/deploy/surfaces/slack.md#search-slack-as-you.
 
 import { defineMcpServers } from "@open-everywhere/core/agent/connections/mcp-servers.js";
 
 export const MCP_SERVERS = defineMcpServers([
+  // Example — "search Slack as you" on your own Slack app. Import it first:
+  //   import { slackAsYou } from "@open-everywhere/provider-slack/agent/slack-as-you.js";
+  //
+  // slackAsYou({ clientId: "<your Slack app's Client ID>" }),
+  //
   // Example — a vendor with dynamic client registration (the common case). Take the URL from the
   // vendor's own MCP documentation:
   //
@@ -27,6 +40,9 @@ export const MCP_SERVERS = defineMcpServers([
   //   name: "fullstory",
   //   url: "https://<the vendor's hosted MCP endpoint>",
   //   description: "FullStory: search sessions, read session summaries and product analytics.",
+  //   // Optional. The OAuth scopes the sign-in asks for; absent ⇒ no scope parameter is sent and the
+  //   // vendor's default applies. Name the read scopes first: a person's token holds only these.
+  //   signIn: { scopes: ["read:sessions"] },
   // },
   //
   // Example — a vendor WITHOUT dynamic registration. Create the client in the vendor's developer
@@ -43,6 +59,7 @@ export const MCP_SERVERS = defineMcpServers([
   //     clientId: "public-client-id",
   //     clientSecretRef: "db:acme:oauth-client-secret",
   //     bodyEncoding: "form",
+  //     scopes: ["accounts.read", "deals.read"], // optional: the scopes the authorize URL asks for
   //   },
   // },
 ]);

package/template/agent/agent.ts

@@ -22,6 +22,7 @@ import "./lib/register-adapters.js";
 import "@open-everywhere/core/agent/access/eve-patch-probe-boot.js";
 import { gatewayModelResolver } from "@open-everywhere/adapters/agent/model/gateway.js";
 import { registerGatewayDreamJudge, registerGatewayFailureFacetJudge } from "@open-everywhere/adapters/agent/model/dream-judge.js";
+import { registerGatewayMeetingModels } from "@open-everywhere/adapters/agent/model/meeting-gateway.js";
 import { registerGatewayApprovalJudge } from "@open-everywhere/adapters/agent/model/approval-judge.js";
 import { registerGatewayImageDescriber } from "@open-everywhere/adapters/agent/model/gateway-vision.js";
 import { isModelUsable } from "@open-everywhere/core/agent/model/policy.js";
@@ -29,6 +30,7 @@ import {
   JUDGE_MODEL,
   PRIMARY_MODEL,
   PRIMARY_MODEL_CONTEXT_WINDOW_TOKENS,
+  TRANSCRIPTION_ROLE,
   UTILITY_MODEL,
   VISION_MODEL,
 } from "./model/models.js";
@@ -52,6 +54,11 @@ const COMPACTION_THRESHOLD_TOKENS = compactionThresholdTokens(PRIMARY_MODEL_CONT
 // The background judges: memory distillation, failure facets and the auto-approval judge.
 registerGatewayDreamJudge({ id: UTILITY_MODEL, gateway: GATEWAY_DEFAULTS });
 registerGatewayFailureFacetJudge({ id: UTILITY_MODEL, gateway: GATEWAY_DEFAULTS });
+
+// The meeting bot's model calls (OPE-2459): the `gateway` transcription route, and the tool-less recap
+// completion on the same `utility` route as the dream judge. Inert until agent/meetings/policy.ts enables
+// meetings; without this line the `gateway` route is unregistered and `meeting_join` refuses before its card.
+registerGatewayMeetingModels({ id: UTILITY_MODEL, gateway: GATEWAY_DEFAULTS }, TRANSCRIPTION_ROLE);
 registerGatewayApprovalJudge({ id: JUDGE_MODEL, gateway: GATEWAY_DEFAULTS });
 
 // The image describer. Fail at boot if the org model policy forbids the vision model, rather than

package/template/agent/email/policy.ts

@@ -0,0 +1,40 @@
+// THIS DEPLOYMENT'S EMAIL POLICY — the agent's own email address (OPE-2440). Config-as-code: a change here is a
+// reviewed pull request. The schema and its validation are `@open-everywhere/core/agent/email/policy.js`; the
+// operator guide is the "Email" surface page of the manual (`read_docs`).
+//
+// Each field is a decision about who may write to the agent:
+//   enabled        — the master switch. Off refuses every inbound mail.
+//   transport      — the registered transport that carries the mail ("agentmail" or "agentmail-eu" ship).
+//   orgDomains     — the mail domains this org controls. Every inbox must sit on one of them (white-label: OE
+//                    never hands out an address on a domain it runs), and an authenticated sender on one of
+//                    them binds internal. Everyone else binds external.
+//   inboxes        — `room`: mail wakes the domain whose `reach` lists `email/<domain>/<local part>`.
+//                    `personal`: mail from a person declared in agent/identity/principals.ts (ids.email) wakes
+//                    that person's own DM seat.
+//   allowedSenders — who may write to a room inbox: exact addresses or "*@domain". Add one by asking the agent
+//                    (an approval card opens a pull request to agent/email/senders.ts) or by hand here.
+//   maxRecipients  — the most addresses one reply may go to (a reply-all is limited to people allowed anyway).
+//
+// 🔴 NOTHING HERE IS A SECRET. The transport's API key and webhook secret live in the secret store
+// (`oe secret set AGENTMAIL_API_KEY`, `oe secret set AGENTMAIL_WEBHOOK_SECRET`), never in this file.
+
+import { DEFAULT_EMAIL_POLICY, registerEmailPolicy, type EmailPolicy } from "@open-everywhere/core/agent/email/policy.js";
+import { EMAIL_SENDERS } from "./senders.js";
+
+const emailPolicy: EmailPolicy = {
+  ...DEFAULT_EMAIL_POLICY,
+  enabled: false,
+  transport: "agentmail",
+  orgDomains: [
+    // Your own mail domain(s). Example, inert while `enabled` is false:
+    // "acme.com",
+  ],
+  inboxes: [
+    // Example inboxes, inert while `enabled` is false. Put the room inbox's surface key
+    // ("email/agent.acme.com/launch") in the launch domain's `reach`.
+    // { address: "launch@agent.acme.com", kind: "room", allowedSenders: ["*@acme.com"], why: "The launch team's shared inbox." },
+    // { address: "oe@agent.acme.com", kind: "personal", allowedSenders: [], why: "Each person's own chief of staff by email." },
+  ],
+};
+
+registerEmailPolicy(emailPolicy, EMAIL_SENDERS);

package/template/agent/email/senders.ts

@@ -0,0 +1,14 @@
+// Email senders — the allowed senders people asked to add to a room inbox, merged by an admin (OPE-2440).
+//
+// A person asks the agent to let someone email a room inbox. The agent posts an approval card; a tap opens a pull
+// request that adds one line here. Nothing applies until an admin merges it. The pull request names who asked and
+// who approved.
+//
+// Each line is ONE JSON entry: the room inbox, the sender (an exact address or "*@domain"), why, and the
+// provenance. Delete a line to remove the sender. Keep one entry per line, with a trailing comma: the agent's pull
+// requests edit this file line by line. The inbox must be a room inbox declared in ./policy.ts, or the boot fails.
+
+import { defineEmailSenders } from "@open-everywhere/core/agent/email/policy.js";
+
+export const EMAIL_SENDERS = defineEmailSenders([
+]);

package/template/agent/instructions.md

@@ -72,6 +72,10 @@ set up, they just ask. Pick the move that fits the shape of the ask:
   offer to set it up with `create_routine` so it just happens without anyone asking.
 - **Make it a skill.** A multi-step way-of-doing-things recurs: capture it with
   `create_skill` so next time it's one named move.
+- **Set up a new connector.** "Set up FullStory" or "connect <vendor>" asks for a NEW connector, and that is
+  a pull request, not a grant. A worker researches the vendor's hosted MCP server (`web_search`,
+  `web_fetch`) and proposes it with `propose_mcp_server`: one entry in `agent/access/mcp-servers.ts`
+  on the deployment's config repo, for an admin to merge. It is not set up until the merge.
 
 Some of these verbs live on workers rather than on a conversational seat. If a move above
 names a tool you don't hold, that is not a "can't" — delegate it (`agent`) with a brief

package/template/agent/lib/register-config.ts

@@ -40,6 +40,8 @@ import { loadSpendCheckpoints } from "../spend/checkpoints.js";
 import { loadModelPolicy } from "../model/policy.js";
 import { loadPrincipals } from "../identity/principals.js";
 import { loadGroups } from "../identity/groups.js";
+import { registerA2aAgents } from "@open-everywhere/core/agent/a2a/agents.js";
+import { A2A_AGENTS } from "../access/a2a-agents.js";
 // Side effect: register the operator's per-surface trust registry (identity/trust.ts) at
 // boot, before any binding resolves. Self-registering (calls registerSurfaces on
 // import); nothing to thread through the AppConfig object.
@@ -60,6 +62,18 @@ import "../identity/surfaces.js";
 // `agent/sandbox/sandbox.ts` through this module's import and nothing else. Drop this import and the
 // declaration is empty at bake time, so the capability silently refuses to arm.
 import "../access/browser-hosts.js";
+// Side effect: register this deployment's MEETING POLICY (agent/meetings/policy.ts, OPE-2459) — which
+// meeting hosts the bot may join, the retention windows, the bot's box and the transcription route. Off
+// unless the file enables it; a bad policy fails the boot rather than arming a bot nobody reviewed.
+import "../meetings/policy.js";
+// Side effect: register this deployment's EMAIL POLICY (agent/email/policy.ts, OPE-2440) — the agent's own
+// inboxes, who may write to each, and how wide a reply may go. Off unless the file enables it; a bad policy
+// (an inbox off the org's domains, a bare wildcard sender, a sender line naming no room inbox) fails the boot.
+import "../email/policy.js";
+// Side effect: register this deployment's PERSONAL BROWSER POLICY (agent/personal-browser/policy.ts, OPE-2441) —
+// whether a person may have their own browser that keeps their logins, its box, and how long its sessions,
+// logins, take-overs and act approvals last. Off unless the file enables it; a bad policy fails the boot.
+import "../personal-browser/policy.js";
 // Side effect: register the operator's per-AUTHOR trust register (identity/author-trust.ts) — the
 // AUTHORITY plane, the sibling of the surfaces AUDIENCE plane above. Self-registering, and it must
 // come AFTER the groups module loads (it expands `{ group: … }` members through loadGroups at
@@ -96,6 +110,12 @@ registerSettings(SETTINGS_OVERRIDES);
 // prices during boot sees a half-wired deployment.
 registerModelPricing(loadModelPricing());
 
+// The A2A AGENTS this app declares (OPE-2425, agent/access/a2a-agents.ts) — the only agents
+// `delegate_to_agent` can reach. Registered on core's own slot rather than carried on AppConfig: the
+// list is validated at import (defineA2aAgents throws on a bad entry), and an unregistered list is
+// empty, so a core-only process delegates to nobody.
+registerA2aAgents(A2A_AGENTS);
+
 registerConfig({
   loadBundles,
   loadBindings,

package/template/agent/meetings/policy.ts

@@ -0,0 +1,44 @@
+// THIS DEPLOYMENT'S MEETING POLICY — OE's own meeting bot (OPE-2459). Config-as-code: a change here is a
+// reviewed pull request. The schema and its validation are `@open-everywhere/core/agent/meetings/policy.js`;
+// the operator guide is the "Meetings" page of the manual (`read_docs`).
+//
+// Each field is a decision about other people's meetings:
+//   enabled     — the master switch. Off refuses every "join this meeting" ask.
+//   hosts       — the meeting hosts the bot may join. A Teams rule lists the organiser tenants OE may
+//                 join; the tenant id is read from the link and is not verified with Microsoft, so it
+//                 refuses an outside link pasted as it is, not an edited one. A Meet link names no
+//                 organiser, so a Meet rule must accept that in writing (`owner: "unverifiable"`).
+//   retention   — how long OE keeps audio (0 = never stored) and the transcript.
+//   box         — the bot image and its size. It runs on this deployment's own sandbox backend.
+//   transcription — `gateway` (audio through this deployment's AI Gateway) or `box` (text only).
+//   native      — recaps from the platform's OWN transcript (Teams, Meet, Zoom), no bot (OPE-2471). Each
+//                 platform block names the ORGANISATION's credential: identifiers here, the secret's value
+//                 in the db credential store (`oe secret set <name>`). Off until OPE-2461 and OPE-2464 land.
+//
+// 🔴 NOTHING HERE IS A SECRET. A tenant id, a client id and a secret's NAME are identifiers, not credentials.
+//
+// To turn meetings on: build and publish the bot image (the manual's Meetings page says how), set
+// `box.image`, add your host rules, and set `enabled: true`. Until OPE-2461 (per-row expiry for the shared
+// store) and OPE-2464 (untrusted provenance for the recap post) land, `enabled: true` is REFUSED: the boot
+// fails and names both tickets.
+
+import { DEFAULT_MEETING_POLICY, registerMeetingPolicy, type MeetingPolicy } from "@open-everywhere/core/agent/meetings/policy.js";
+
+const meetingPolicy: MeetingPolicy = {
+  ...DEFAULT_MEETING_POLICY,
+  enabled: false,
+  hosts: [
+    // Example rules, inert while `enabled` is false. Replace the tenant id with your own.
+    // { platform: "meet", host: "meet.google.com", owner: "unverifiable", why: "Our team meets on Google Meet." },
+    // { platform: "teams", host: "teams.microsoft.com", tenants: ["00000000-0000-0000-0000-000000000000"], why: "Our own Teams tenant only." },
+  ],
+  native: {
+    ...DEFAULT_MEETING_POLICY.native,
+    // Example blocks, inert while `native.enabled` is false. See the manual's Meetings page for what each admin grants.
+    // teams: { tenants: ["00000000-0000-0000-0000-000000000000"], clientId: "00000000-0000-0000-0000-000000000000", clientSecretRef: "TEAMS_TRANSCRIPT_SECRET", why: "Our own Teams meetings." },
+    // meet: { domains: ["example.org"], serviceAccountKeyRef: "MEET_TRANSCRIPT_KEY", why: "Our own Workspace meetings." },
+    // zoom: { accountId: "<Zoom account id>", clientId: "<S2S app client id>", clientSecretRef: "ZOOM_TRANSCRIPT_SECRET", why: "Our own Zoom account." },
+  },
+};
+
+registerMeetingPolicy(meetingPolicy);

package/template/agent/memory/config/domains/index.ts

@@ -70,6 +70,12 @@
 // Every member outside Slack must be declared internal in agent/identity/surfaces.ts, or the boot
 // refuses the window (memory/domain.ts assertWindowSourcesVouched).
 //
+// 🔴 THE DEFAULT IS UNIFIED. A declared domain that omits `mode` shares ONE window across its
+// rooms (OPE-2412). It falls back to solo, and the boot logs why, when its reach holds a tenant or
+// glob entry or a room outside Slack is not declared internal. A one-room domain stays solo. To
+// keep each room in its own seat, write `mode: "solo"` on the domain. `org`, `public` and `dm`
+// below are always solo.
+//
 // --- CRITERIA PSEUDO-DOMAINS (optional) — selected by trust/mode, not a channel list.
 //     Each is a singleton (at most one per match) with the full domain toolkit.
 //

package/template/agent/model/models.ts

@@ -8,7 +8,7 @@ import {
 } from "@open-everywhere/core/agent/model/default-model.js";
 import { getSettings } from "@open-everywhere/core/agent/settings/settings.js";
 import { SETTINGS_OVERRIDES } from "../settings/settings.js";
-import { resolveStack, type ModelRole, type ModelRoleSpec, type ModelStack } from "./stacks.js";
+import { resolveStack, resolveTranscription, type ModelRole, type ModelRoleSpec, type ModelStack } from "./stacks.js";
 
 export type { ModelRoleSpec, ModelStack } from "./stacks.js";
 
@@ -31,6 +31,8 @@ export const MODELS = {
 
 /** The alias of the stack this process resolved — for `/oe status`. */
 export const MODEL_STACK = STACK_ALIAS;
+/** The meeting bot's speech-to-text role: a primary and a fallback route (stacks.ts TRANSCRIPTION). */
+export const TRANSCRIPTION_ROLE = resolveTranscription(STACK_ALIAS);
 
 export const PRIMARY_MODEL = MODELS.primary.id;
 export const UTILITY_MODEL = MODELS.utility.id;

package/template/agent/model/stacks.ts

@@ -12,6 +12,7 @@
 // agent/spend/model-pricing.ts, or a USD spend cap cannot see its cost.
 
 import type { ModelTier } from "@open-everywhere/core/agent/memory/domain.js";
+import type { TranscriptionRoleSpec } from "@open-everywhere/adapters/agent/model/transcription-routes.js";
 
 export type ModelRole = "primary" | "utility" | "vision" | "supervisor" | "judge";
 
@@ -35,7 +36,7 @@ export const STACKS = {
   "american-closed": {
     primary: { id: "openai/gpt-6-luna", tier: "high", contextWindowTokens: 1_050_000 },
     utility: { id: "openai/gpt-6-luna", tier: "low", contextWindowTokens: 1_050_000 },
-    vision: { id: "google/gemini-3.7-flash", tier: "low", contextWindowTokens: 1_000_000 },
+    vision: { id: "google/gemini-3.8-flash", tier: "low", contextWindowTokens: 1_000_000 },
     supervisor: { id: "openai/gpt-6-luna", tier: "low", contextWindowTokens: 1_050_000 },
     judge: { id: "openai/gpt-6-luna", tier: "low", contextWindowTokens: 1_050_000 },
   },
@@ -73,3 +74,33 @@ export function resolveStack(alias: string, overrides: StackOverrides = {}): Mod
   }
   return out;
 }
+
+// Speech to text for the meeting bot: a primary and a fallback route per stack, on two different providers, so
+// one provider outage falls through to the other. A route names its transport too: the AI Gateway, DeepInfra
+// (key: `oe secret set DEEPINFRA_API_KEY`), or your own OpenAI-compatible speech server. These defaults are
+// pending a bake-off (`npm run bakeoff:stt` in the Open Everywhere repository).
+export const TRANSCRIPTION = {
+  "chinese-open-weights": {
+    primary: { via: "deepinfra", id: "Qwen/Qwen3-ASR-1.7B" },
+    fallback: { via: "self-hosted", id: "Qwen/Qwen3-ASR-1.7B", baseUrl: "http://qwen3-asr:8000/v1" },
+  },
+  "american-closed": {
+    primary: { via: "gateway", id: "microsoft/mai-transcribe-2" },
+    fallback: { via: "gateway", id: "spacexai/grok-stt" },
+  },
+} as const satisfies Record<StackAlias, TranscriptionRoleSpec>;
+
+/** Fully local: your own speech server only. For a Docker deployment with no cloud model. */
+export const LOCAL_TRANSCRIPTION = {
+  primary: { via: "self-hosted", id: "Qwen/Qwen3-ASR-1.7B", baseUrl: "http://qwen3-asr:8000/v1" },
+} as const satisfies TranscriptionRoleSpec;
+
+/** `stack` follows `models.stack`; `local` uses LOCAL_TRANSCRIPTION. */
+export const TRANSCRIPTION_PLACEMENT: "stack" | "local" = "stack";
+
+/** The transcription role for `alias`. Throws on an unknown alias. */
+export function resolveTranscription(alias: string, placement: "stack" | "local" = TRANSCRIPTION_PLACEMENT): TranscriptionRoleSpec {
+  if (placement === "local") return LOCAL_TRANSCRIPTION;
+  if (!isStackAlias(alias)) throw new Error(`open-everywhere: unknown model stack "${alias}" — no transcription role`);
+  return TRANSCRIPTION[alias];
+}

package/template/agent/personal-browser/policy.ts

@@ -0,0 +1,33 @@
+// THIS DEPLOYMENT'S PERSONAL BROWSER POLICY — each person's own browser, which keeps their logins (OPE-2441).
+// Config-as-code: a change here is a reviewed pull request. The schema and its validation are
+// `@open-everywhere/core/agent/personal-browser/policy.js`; the operator guide is the "Personal browser" page
+// of the manual (`read_docs`).
+//
+// Each field is a decision about a person's signed-in accounts:
+//   enabled          — the master switch. Off refuses every use.
+//   box              — the browser image and its size. It runs on this deployment's own sandbox backend: a
+//                      persistent Vercel Sandbox per person, or a docker container on a named volume.
+//                      `dockerNetwork` (docker only) is the network the app and the box share.
+//   sessionMinutes   — the hard cap on one live session of the box.
+//   idleMinutes      — the box stops after this long with nobody using or watching it. Logins stay.
+//   keepLoginsDays   — how long the profile (the logins) survives with no use.
+//   takeoverMinutes  — the longest a person holds the controls before they return to the agent.
+//   actGrantMinutes  — how long one "let the agent click and type on this site" approval lasts.
+//
+// WHERE THE BROWSER MAY GO is not declared here: it reaches exactly the hosts the person's DM's egress
+// declaration admits (agent/access — bundles and network access), the same firewall every other call uses.
+//
+// 🔴 NOTHING HERE IS A SECRET.
+//
+// To turn it on: build and publish the browser image (the manual's Personal browser page says how), set
+// `box.image`, and set `enabled: true`. The watch page also needs the page signing key
+// (OE_INTAKE_PAGE_SIGNING_KEY) and a public URL, which the credential intake page already uses.
+
+import { DEFAULT_PERSONAL_BROWSER_POLICY, registerPersonalBrowserPolicy, type PersonalBrowserPolicy } from "@open-everywhere/core/agent/personal-browser/policy.js";
+
+const personalBrowserPolicy: PersonalBrowserPolicy = {
+  ...DEFAULT_PERSONAL_BROWSER_POLICY,
+  enabled: false,
+};
+
+registerPersonalBrowserPolicy(personalBrowserPolicy);

package/template/agent/spend/model-pricing.ts

@@ -15,7 +15,7 @@ const pricing: ModelPricingTable = defineModelPricing({
   // chinese-open-weights: vision.
   "alibaba/qwen3-vl-instruct": { inPerMtok: 0.2, outPerMtok: 0.88 },
   // american-closed: vision.
-  "google/gemini-3.7-flash": { inPerMtok: 0.75, outPerMtok: 3.75 },
+  "google/gemini-3.8-flash": { inPerMtok: 0.75, outPerMtok: 3.75 },
 });
 
 assertModelPricingValid(pricing);

package/template/agent/webhooks/hooks.ts

@@ -2,8 +2,8 @@
 // inbound-webhook surface (docs/capabilities/proactivity-and-routines.md in the Open Everywhere repository "Inbound
 // webhook triggers"). Declare a hook: which signature scheme its sender uses (`source`),
 // where its shared secret lives (`secretRef` + the `broker` that ref resolves through),
-// which `slack/TEAM/CHANNEL` surface it fires into, and what the agent should do when it
-// fires. Point the provider at `POST /webhooks/<id>` (channels/webhooks.ts).
+// where it fires (a room on Slack, Discord or Teams, or a person's DM), and what the agent
+// should do when it fires. Point the provider at `POST /webhooks/<id>` (channels/webhooks.ts).
 //
 // SIGNATURE SCHEME: `source` names the registered verifier. `"oe-standard-webhook"` is
 // OUR own contract — the public standard-webhooks spec (`webhook-id` + `webhook-timestamp`
@@ -50,8 +50,8 @@
 // the seam a DB/dashboard would swap behind, same as memory/config/domains.ts and access/
 // bundles.ts. After adding a hook: `npm run typecheck` plus a boot (assertWebhooksValid runs
 // at import time and throws on a malformed entry — id collisions, a missing source, a
-// blank/empty secretRef, a missing broker, a target that isn't a well-formed
-// slack/TEAM/CHANNEL triple).
+// blank/empty secretRef, a missing broker, a target that is neither a room
+// "<platform>/<workspace>/<surface>" nor a person "dm:<principal key>").
 
 import { defineWebhook, assertWebhooksValid, type WebhookHook } from "@open-everywhere/core/agent/webhooks/config.js";
 import { loadHooksOverlay } from "./hooks-overlay.js";
@@ -64,7 +64,7 @@ const hooks: WebhookHook[] = [
   //   source: "oe-standard-webhook",               // OUR contract — a sender you control signs it
   //   secretRef: "DEPLOY_STATUS_WEBHOOK_SECRET",   // shared secret REF (env var NAME here, not the value)
   //   broker: "env",                               // the home that ref resolves through ("env" | "db" | ...)
-  //   target: "slack/<team-id>/<channel-id>",         // fully-qualified slack/TEAM/CHANNEL surface
+  //   target: "slack/<team-id>/<channel-id>",         // a room on any surface, or "dm:<principal key>" for a person
   //   readableBy: [{ level: "domain", domain: "engineering" }],  // WHO may read its events — REQUIRED, no default
   //   posture: "projection",                       // HOW MUCH of the payload reaches the model
   //   project: ["status", "branch"],               // …under "projection": exactly these normalizer field keys

package/template/claude/skills/upgrade-open-everywhere/SKILL.md

@@ -37,7 +37,7 @@ npm view @open-everywhere/core version
 **Read the installed one, not the pin.** `oe upgrade` writes the pins before it installs, so an
 upgrade that stopped part way leaves a manifest that names a version the app is not running.
 
-The nine packages publish in lockstep, so one version answers for all of them. Agree the target
+The ten packages publish in lockstep, so one version answers for all of them. Agree the target
 with the user before you go on. Taking the latest is the normal choice.
 
 ## 2. Read the notes between the two versions

package/template/gitignore

@@ -33,6 +33,7 @@ node_modules/
 /agent/skills/
 /agent/connections/
 /agent/lib/providers.generated.ts
+/agent/lib/app-code-fingerprint.generated.ts
 
 # Misc
 *.log
@@ -40,3 +41,6 @@ node_modules/
 *.tsbuildinfo
 *.pem
 *.key
+
+# A built Teams app package (`surface_app_package`): rebuilt from config, never committed.
+teams-app/*.zip

package/template/package.json

@@ -26,6 +26,7 @@
     "@open-everywhere/adapters": "{{OE_VERSION}}",
     "@open-everywhere/core": "{{OE_VERSION}}",
     "@open-everywhere/provider-discord": "{{OE_VERSION}}",
+    "@open-everywhere/provider-email": "{{OE_VERSION}}",
     "@open-everywhere/provider-github": "{{OE_VERSION}}",
     "@open-everywhere/provider-linear": "{{OE_VERSION}}",
     "@open-everywhere/provider-notion": "{{OE_VERSION}}",

package/template/roster.config.ts

@@ -29,8 +29,8 @@ export default defineRoster({
   core: true,
   adapters: true,
 
-  // One provider bundle per surface. Add a line to add a surface (`discord`, `teams` and `linear`
-  // are installed too), then `npx oe build --accept`.
+  // One provider bundle per surface. Add a line to add a surface (`discord`, `teams`, `linear` and
+  // `email` are installed too), then `npx oe build --accept`.
   providers: {
     slack: true,
     notion: true,

package/template/roster.lock.json

@@ -22,8 +22,10 @@
         "channel/control-mcp": "mounted",
         "channel/control-read": "mounted",
         "channel/credential-intake-page": "mounted",
+        "channel/meeting-callback": "mounted",
         "channel/oe-oauth-callback": "mounted",
         "channel/oe-status": "mounted",
+        "channel/personal-browser": "mounted",
         "channel/policy-pages": "mounted",
         "channel/test-wake": "mounted",
         "channel/transcript-relay": "mounted",
@@ -58,18 +60,24 @@
         "hook/spend": "mounted",
         "hook/stall-guard": "mounted",
         "hook/telemetry": "mounted",
+        "hook/tool-usage": "mounted",
         "hook/turn-anchor": "mounted",
         "hook/wake-accounting-turn": "mounted",
         "hook/wake-turn-start": "mounted",
         "hook/window-routing": "mounted",
+        "schedule/audit-export": "mounted",
         "schedule/directory-sync": "mounted",
         "schedule/dispatch": "mounted",
         "schedule/dream-mode3": "mounted",
+        "schedule/meeting-sweep": "mounted",
+        "schedule/personal-browser-sweep": "mounted",
         "schedule/tidy": "mounted",
         "skill/scoped": "mounted",
         "tool/add_label": "mounted",
         "tool/add_routine_rule": "mounted",
         "tool/agent_version": "mounted",
+        "tool/answer_domain_question": "mounted",
+        "tool/ask_domain": "mounted",
         "tool/ask_question": "mounted",
         "tool/ask_room": "mounted",
         "tool/assign": "mounted",
@@ -78,6 +86,7 @@
         "tool/cancel_routine": "mounted",
         "tool/cancel_work": "mounted",
         "tool/capture_events": "mounted",
+        "tool/check_agent_task": "mounted",
         "tool/check_pr_status": "mounted",
         "tool/checkout_repo": "mounted",
         "tool/clear_connector_override": "mounted",
@@ -91,6 +100,7 @@
         "tool/create_skill": "mounted",
         "tool/create_ticket": "mounted",
         "tool/declare_webhook": "mounted",
+        "tool/delegate_to_agent": "mounted",
         "tool/delete_skill": "mounted",
         "tool/describe_image": "mounted",
         "tool/dm_person": "mounted",
@@ -107,15 +117,22 @@
         "tool/list_routines": "mounted",
         "tool/list_skills": "mounted",
         "tool/list_webhooks": "mounted",
+        "tool/meeting_join": "mounted",
+        "tool/meeting_leave": "mounted",
+        "tool/meeting_recap": "mounted",
         "tool/memory_admin_list": "mounted",
         "tool/memory_admin_read": "mounted",
         "tool/message_thread_seat": "mounted",
+        "tool/my_browser": "mounted",
+        "tool/my_browser_handoff": "mounted",
         "tool/no_reply": "mounted",
         "tool/open_pull_request": "mounted",
         "tool/permission_fit_report": "mounted",
         "tool/post_file": "mounted",
         "tool/post_message": "mounted",
         "tool/post_pr_walkthrough": "mounted",
+        "tool/propose_email_sender": "mounted",
+        "tool/propose_mcp_server": "mounted",
         "tool/purge_memory": "mounted",
         "tool/query_analytics": "mounted",
         "tool/react": "mounted",
@@ -156,6 +173,7 @@
         "tool/unlink_identity": "mounted",
         "tool/update_status": "mounted",
         "tool/usage_report": "mounted",
+        "tool/waiting_on_me": "mounted",
         "tool/walk_pr": "mounted",
         "tool/work": "mounted"
       }

package/template/scripts/goldens/roster-plan.txt

@@ -3,9 +3,11 @@ agent/channels/control-mcp.ts	mounted @open-everywhere/core
 agent/channels/control-read.ts	mounted @open-everywhere/core
 agent/channels/credential-intake-page.ts	mounted @open-everywhere/core
 agent/channels/github.ts	mounted @open-everywhere/provider-github
+agent/channels/meeting-callback.ts	mounted @open-everywhere/core
 agent/channels/notion.ts	mounted @open-everywhere/provider-notion
 agent/channels/oe-oauth-callback.ts	mounted @open-everywhere/core
 agent/channels/oe-status.ts	mounted @open-everywhere/core
+agent/channels/personal-browser.ts	mounted @open-everywhere/core
 agent/channels/policy-pages.ts	mounted @open-everywhere/core
 agent/channels/slack-commands.ts	mounted @open-everywhere/provider-slack
 agent/channels/slack-setup-page.ts	mounted @open-everywhere/provider-slack
@@ -44,20 +46,26 @@ agent/hooks/spawn-taint.ts	mounted @open-everywhere/core
 agent/hooks/spend.ts	mounted @open-everywhere/core
 agent/hooks/stall-guard.ts	mounted @open-everywhere/core
 agent/hooks/telemetry.ts	mounted @open-everywhere/core
+agent/hooks/tool-usage.ts	mounted @open-everywhere/core
 agent/hooks/turn-anchor.ts	mounted @open-everywhere/core
 agent/hooks/wake-accounting-turn.ts	mounted @open-everywhere/core
 agent/hooks/wake-turn-start.ts	mounted @open-everywhere/core
 agent/hooks/window-routing.ts	mounted @open-everywhere/core
 agent/lib/providers.generated.ts	providers slack,notion,github
+agent/schedules/audit-export.ts	mounted @open-everywhere/core
 agent/schedules/directory-sync.ts	mounted @open-everywhere/core
 agent/schedules/dispatch.ts	mounted @open-everywhere/core
 agent/schedules/dream-mode3.ts	mounted @open-everywhere/core
+agent/schedules/meeting-sweep.ts	mounted @open-everywhere/core
 agent/schedules/notion-ingress.ts	mounted @open-everywhere/provider-notion
+agent/schedules/personal-browser-sweep.ts	mounted @open-everywhere/core
 agent/schedules/tidy.ts	mounted @open-everywhere/core
 agent/skills/scoped.ts	mounted @open-everywhere/core
 agent/tools/add_label.ts	mounted @open-everywhere/core
 agent/tools/add_routine_rule.ts	mounted @open-everywhere/core
 agent/tools/agent_version.ts	mounted @open-everywhere/core
+agent/tools/answer_domain_question.ts	mounted @open-everywhere/core
+agent/tools/ask_domain.ts	mounted @open-everywhere/core
 agent/tools/ask_question.ts	mounted @open-everywhere/core
 agent/tools/ask_room.ts	mounted @open-everywhere/core
 agent/tools/assign.ts	mounted @open-everywhere/core
@@ -67,6 +75,7 @@ agent/tools/browser_tools.ts	mounted @open-everywhere/core
 agent/tools/cancel_routine.ts	mounted @open-everywhere/core
 agent/tools/cancel_work.ts	mounted @open-everywhere/core
 agent/tools/capture_events.ts	mounted @open-everywhere/core
+agent/tools/check_agent_task.ts	mounted @open-everywhere/core
 agent/tools/check_pr_status.ts	mounted @open-everywhere/core
 agent/tools/checkout_repo.ts	mounted @open-everywhere/core
 agent/tools/clear_connector_override.ts	mounted @open-everywhere/core
@@ -80,6 +89,7 @@ agent/tools/create_routine.ts	mounted @open-everywhere/core
 agent/tools/create_skill.ts	mounted @open-everywhere/core
 agent/tools/create_ticket.ts	mounted @open-everywhere/core
 agent/tools/declare_webhook.ts	mounted @open-everywhere/core
+agent/tools/delegate_to_agent.ts	mounted @open-everywhere/core
 agent/tools/delete_skill.ts	mounted @open-everywhere/core
 agent/tools/describe_image.ts	mounted @open-everywhere/core
 agent/tools/dm_person.ts	mounted @open-everywhere/core
@@ -97,9 +107,14 @@ agent/tools/list_repos.ts	mounted @open-everywhere/core
 agent/tools/list_routines.ts	mounted @open-everywhere/core
 agent/tools/list_skills.ts	mounted @open-everywhere/core
 agent/tools/list_webhooks.ts	mounted @open-everywhere/core
+agent/tools/meeting_join.ts	mounted @open-everywhere/core
+agent/tools/meeting_leave.ts	mounted @open-everywhere/core
+agent/tools/meeting_recap.ts	mounted @open-everywhere/core
 agent/tools/memory_admin_list.ts	mounted @open-everywhere/core
 agent/tools/memory_admin_read.ts	mounted @open-everywhere/core
 agent/tools/message_thread_seat.ts	mounted @open-everywhere/core
+agent/tools/my_browser_handoff.ts	mounted @open-everywhere/core
+agent/tools/my_browser.ts	mounted @open-everywhere/core
 agent/tools/no_reply.ts	mounted @open-everywhere/core
 agent/tools/notion_search.ts	mounted @open-everywhere/provider-notion
 agent/tools/open_pull_request.ts	mounted @open-everywhere/core
@@ -107,6 +122,8 @@ agent/tools/permission_fit_report.ts	mounted @open-everywhere/core
 agent/tools/post_file.ts	mounted @open-everywhere/core
 agent/tools/post_message.ts	mounted @open-everywhere/core
 agent/tools/post_pr_walkthrough.ts	mounted @open-everywhere/core
+agent/tools/propose_email_sender.ts	mounted @open-everywhere/core
+agent/tools/propose_mcp_server.ts	mounted @open-everywhere/core
 agent/tools/purge_memory.ts	mounted @open-everywhere/core
 agent/tools/query_analytics.ts	mounted @open-everywhere/core
 agent/tools/react.ts	mounted @open-everywhere/core
@@ -150,6 +167,7 @@ agent/tools/subscribe_pr.ts	mounted @open-everywhere/core
 agent/tools/unlink_identity.ts	mounted @open-everywhere/core
 agent/tools/update_status.ts	mounted @open-everywhere/core
 agent/tools/usage_report.ts	mounted @open-everywhere/core
+agent/tools/waiting_on_me.ts	mounted @open-everywhere/core
 agent/tools/walk_pr.ts	mounted @open-everywhere/core
 agent/tools/web_fetch.ts	framework-disabled
 agent/tools/work.ts	mounted @open-everywhere/core

package/template/scripts/ops-mcp.ts

@@ -47,5 +47,5 @@ registerSurfaceTrustPreflight();
 const server = buildOpsServer();
 await server.connect(new StdioServerTransport());
 process.stderr.write(
-  "open-everywhere-ops MCP server ready on stdio (preflight · surface_manifest · scaffold_env · scaffold_credential_key · secret_set/list/rm)\n",
+  "open-everywhere-ops MCP server ready on stdio (preflight · surface_manifest · surface_app_package · scaffold_env · scaffold_credential_key · secret_set/list/rm)\n",
 );