@openrig/cli 0.5.0 → 0.5.2

package/daemon/dist/routes/require-sender-identity.d.ts

@@ -0,0 +1,113 @@
+import type { Context } from "hono";
+/**
+ * P21 sender-provenance chokepoint — the ONE shared route helper that generalizes P18's inline
+ * `/inbox/drop` form (b2437104) across every caller-identity site. The acting seat's identity is
+ * DERIVED from the authenticated transport header the CLI's DaemonClient stamps once from the seat
+ * env (X-OpenRig-Session), and the row records WHICH ERA that derivation came from.
+ *
+ * P18 DELIVER-AND-LABEL (founder ruling, over-engineering audit — the refusals are deleted). The two
+ * refusals this helper used to raise both asserted "this sender is ILLEGITIMATE" when the only thing
+ * actually known was "I cannot verify this sender at this boundary". Those are different claims and
+ * the system was making the confident one:
+ *   - 401 `unattributable_sender` (header absent) — DELETED. A missing header means the sender cannot be
+ *     certified at this boundary; the honest response is to DELIVER and record the weaker era-stamp
+ *     `claimed:v1`.
+ *   - 409 `identity_mismatch` (body claim ≠ transport identity) — DELETED (PM, 2026-08-11, ruling (A):
+ *     both refusals die, folded into this ONE sweep — the earlier one-atom-each split was retired as
+ *     unnecessary ceremony). A certified wire identity is exactly why refusing was wrong: the wire decides
+ *     the actor and the body never does, so a disagreeing body claim is NOISE TO BE SUPERSEDED, not a
+ *     reason to refuse. Deliver under the wire identity, labelled transport:v1; the discrepancy is NOT
+ *     persisted (no new field/schema). The byte-identical 409 in resolveActorWithDeferral (below) is
+ *     retired the same way so the two sibling helpers agree on the supersede rule.
+ *
+ * With NEITHER a transport header NOR a body actor there is no actor to put on the ledger row at all, so
+ * the caller is asked for the missing parameter (400 `actor_required`) — the same shape PM ruled a
+ * deliberate keep at queue.ts:215. Requiring a present-but-absent parameter is honest help; it is not a
+ * refusal of a named sender.
+ *
+ * The label half is NOT new machinery: `resolveRecordedProvenance` below already degrades down as its
+ * default branch, and `resolveActorWithDeferral` already did deliver-and-label on founder-visible
+ * surfaces. This extends that existing, correctly-degrading pattern to the sites that used to refuse.
+ */
+export declare const SENDER_IDENTITY_HEADER = "x-openrig-session";
+export type SenderIdentity = {
+    ok: true;
+    session: string;
+    provenance: Exclude<IdentityProvenance, "relay:v1">;
+} | {
+    ok: false;
+    response: Response;
+};
+export declare function requireSenderIdentity(c: Context, opts?: {
+    verb?: string;
+    bodyClaim?: string | null;
+}): SenderIdentity;
+/**
+ * P21 — the CLOSED era-provenance union stamped on identity-carrying rows (PM-ratified pin). A shared
+ * type so every producer (this helper, the forwarding re-stamp, the recorded-provenance decider) speaks
+ * the same closed alphabet:
+ *   - `transport:v1` — derived from the transport chokepoint (X-OpenRig-Session on a local request).
+ *   - `relay:v1`     — a forwarding daemon re-stamped from its OWN authenticated context (cross-host).
+ *   - `claimed:v1`   — a founder-visible-surface UI/MCP tap under a not-yet-plumbed principal (the named
+ *                      deferral); honest "pre-verification" of a TODAY actor.
+ * NULL / absent is deliberately NOT a member — it is reserved for pre-sweep-legacy / unstamped rows, so a
+ * legacy row stays distinguishable from a `claimed:v1` tap today (the era boundary). A forward must
+ * PRESERVE `claimed:v1` (never upgrade it to transport:v1/relay:v1 — that would launder unverified→verified).
+ */
+export type IdentityProvenance = "transport:v1" | "relay:v1" | "claimed:v1";
+export type ActorWithDeferral = {
+    ok: true;
+    session: string;
+    provenance: Exclude<IdentityProvenance, "relay:v1">;
+} | {
+    ok: false;
+    response: Response;
+};
+/**
+ * P21 §2 + rail-addendum d00c468d — the FOUNDER-VISIBLE-surface variant of requireSenderIdentity.
+ * Header PRESENT ⇒ identical transport derivation (derive + wire-SUPERSEDES a disagreeing body claim +
+ * `transport:v1`); the former 409-on-mismatch is RETIRED (P18 ruling A) — the wire decides the actor and
+ * the body is superseded, not refused.
+ * Header ABSENT ⇒ the body-supplied actor is recorded as the DECLARED claimed-era variant `claimed:v1`
+ * (a TODAY tap under a not-yet-plumbed principal — honest "pre-verification", distinct from a legacy null
+ * row). This is NEVER silent-accept — the claimed:v1 era-stamp IS the visible gap — and NEVER silent-break.
+ * A body actor is still required (some actor must be on the record); its verification is the named gap
+ * whose owner + plumbing-path are documented per increment. Use ONLY on surfaces PM-ruled founder-
+ * visible-flow-breaking (d00c468d: ui review approve/resolve/refreeze + useFiles write); everything else
+ * uses requireSenderIdentity. Post-P18 the two helpers SHARE the deliver-and-label semantics (both
+ * supersede a mismatched body, both deliver header-absent under claimed:v1); this helper's remaining
+ * distinction is its surface scope, not a different refusal behavior.
+ */
+export declare function resolveActorWithDeferral(c: Context, opts?: {
+    verb?: string;
+    bodyClaim?: string | null;
+}): ActorWithDeferral;
+/**
+ * The wire header a FORWARDING daemon stamps to carry the provenance it resolved for the actor it is
+ * re-stamping, so the origin hop records the TRUTH about that actor's verification instead of inferring
+ * it from the mere presence of a re-stamped X-OpenRig-Session. SAME token alphabet as the store
+ * (IdentityProvenance) — never an ad-hoc string. Its absence is meaningful (see resolveRecordedProvenance).
+ */
+export declare const IDENTITY_PROVENANCE_HEADER = "x-openrig-provenance";
+/** Set by a forwarding daemon to mark "this arrived via a relay hop" (the actor was derived elsewhere). */
+export declare const RELAY_HEADER = "x-openrig-relay";
+/**
+ * P21 §4 — the SOLE decider of the provenance RECORDED on a row (rail 2: exactly one place can ever say
+ * `transport:v1`, and only when the transport actually proved it at THIS hop). `identity` is the local
+ * derivation from resolveActorWithDeferral (transport:v1 = header present; claimed:v1 = the deferral).
+ *
+ * Direct request (no relay hop): record exactly what this hop proved — identity.provenance verbatim.
+ *
+ * Relayed request (a forwarding daemon re-stamped the header): NEVER `transport:v1` — the actor was, at
+ * best, verified ONE HOP AWAY, so the strongest honest claim is `relay:v1`, and ONLY when the forwarder
+ * explicitly carried a `transport:v1` marker. Rail 1 — DEGRADE DOWN AS THE DEFAULT BRANCH: any other
+ * carried value, AND a MISSING marker (an old forwarder that predates this plumbing), records `claimed:v1`.
+ * NB the honesty nuance: a missing marker and a forwarder-declared `claimed:v1` are INDISTINGUISHABLE here
+ * and that is correct — both are "not verified at this boundary". `claimed:v1` on a relayed row therefore
+ * means "unverified", NEVER proof the origin action was a UI tap. Uncertainty weakens the claim; it can
+ * never strengthen it — a claimed-era actor can never be laundered into a verified one across a hop.
+ */
+export declare function resolveRecordedProvenance(c: Context, identity: {
+    provenance: Exclude<IdentityProvenance, "relay:v1">;
+}): IdentityProvenance;
+//# sourceMappingURL=require-sender-identity.d.ts.map

package/daemon/dist/routes/require-sender-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-sender-identity.d.ts","sourceRoot":"","sources":["../../src/routes/require-sender-identity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,sBAAsB,sBAAsB,CAAC;AAE1D,MAAM,MAAM,cAAc,GAItB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAA;CAAE,GAClF;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEtC,wBAAgB,qBAAqB,CACnC,CAAC,EAAE,OAAO,EACV,IAAI,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAClD,cAAc,CA0BhB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,kBAAkB,GAAG,cAAc,GAAG,UAAU,GAAG,YAAY,CAAC;AAE5E,MAAM,MAAM,iBAAiB,GAGzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAA;CAAE,GAClF;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEtC;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CACtC,CAAC,EAAE,OAAO,EACV,IAAI,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAClD,iBAAiB,CAyBnB;AAED;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,yBAAyB,CAAC;AACjE,2GAA2G;AAC3G,eAAO,MAAM,YAAY,oBAAoB,CAAC;AAE9C;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,yBAAyB,CACvC,CAAC,EAAE,OAAO,EACV,QAAQ,EAAE;IAAE,UAAU,EAAE,OAAO,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAA;CAAE,GAChE,kBAAkB,CAKpB"}

package/daemon/dist/routes/require-sender-identity.js

@@ -0,0 +1,131 @@
+/**
+ * P21 sender-provenance chokepoint — the ONE shared route helper that generalizes P18's inline
+ * `/inbox/drop` form (b2437104) across every caller-identity site. The acting seat's identity is
+ * DERIVED from the authenticated transport header the CLI's DaemonClient stamps once from the seat
+ * env (X-OpenRig-Session), and the row records WHICH ERA that derivation came from.
+ *
+ * P18 DELIVER-AND-LABEL (founder ruling, over-engineering audit — the refusals are deleted). The two
+ * refusals this helper used to raise both asserted "this sender is ILLEGITIMATE" when the only thing
+ * actually known was "I cannot verify this sender at this boundary". Those are different claims and
+ * the system was making the confident one:
+ *   - 401 `unattributable_sender` (header absent) — DELETED. A missing header means the sender cannot be
+ *     certified at this boundary; the honest response is to DELIVER and record the weaker era-stamp
+ *     `claimed:v1`.
+ *   - 409 `identity_mismatch` (body claim ≠ transport identity) — DELETED (PM, 2026-08-11, ruling (A):
+ *     both refusals die, folded into this ONE sweep — the earlier one-atom-each split was retired as
+ *     unnecessary ceremony). A certified wire identity is exactly why refusing was wrong: the wire decides
+ *     the actor and the body never does, so a disagreeing body claim is NOISE TO BE SUPERSEDED, not a
+ *     reason to refuse. Deliver under the wire identity, labelled transport:v1; the discrepancy is NOT
+ *     persisted (no new field/schema). The byte-identical 409 in resolveActorWithDeferral (below) is
+ *     retired the same way so the two sibling helpers agree on the supersede rule.
+ *
+ * With NEITHER a transport header NOR a body actor there is no actor to put on the ledger row at all, so
+ * the caller is asked for the missing parameter (400 `actor_required`) — the same shape PM ruled a
+ * deliberate keep at queue.ts:215. Requiring a present-but-absent parameter is honest help; it is not a
+ * refusal of a named sender.
+ *
+ * The label half is NOT new machinery: `resolveRecordedProvenance` below already degrades down as its
+ * default branch, and `resolveActorWithDeferral` already did deliver-and-label on founder-visible
+ * surfaces. This extends that existing, correctly-degrading pattern to the sites that used to refuse.
+ */
+export const SENDER_IDENTITY_HEADER = "x-openrig-session";
+export function requireSenderIdentity(c, opts) {
+    const verb = opts?.verb ?? "this action";
+    const session = c.req.header(SENDER_IDENTITY_HEADER)?.trim();
+    const claim = opts?.bodyClaim?.trim();
+    if (session) {
+        // Transport path — the header PROVED the actor at this hop. P18 SWEEP: the wire SUPERSEDES any body
+        // claim (the 409 identity_mismatch refusal is retired). A disagreeing body actor is noise to be
+        // superseded, not an attack to refuse — the wire decides the actor, the body never does. Deliver
+        // under the certified transport identity, labelled transport:v1 as shipped; the discrepancy is not
+        // persisted (ruling (A) — no new field/schema). `claim` is intentionally ignored on this path.
+        return { ok: true, session, provenance: "transport:v1" };
+    }
+    // No transport identity: deliver under the body-declared actor, labelled honestly as claimed-era.
+    if (claim)
+        return { ok: true, session: claim, provenance: "claimed:v1" };
+    // Neither a derived identity nor a declared one — nothing to attribute the row to. Parameter
+    // completeness, not distrust.
+    return {
+        ok: false,
+        response: c.json({
+            error: "actor_required",
+            message: `Cannot record ${verb}: no authenticated transport identity (X-OpenRig-Session absent) and no ` +
+                "actor named in the request body. The channel of record needs an actor to attribute the row to — " +
+                "name one, or run from a managed seat so the identity is derived for you.",
+        }, 400),
+    };
+}
+/**
+ * P21 §2 + rail-addendum d00c468d — the FOUNDER-VISIBLE-surface variant of requireSenderIdentity.
+ * Header PRESENT ⇒ identical transport derivation (derive + wire-SUPERSEDES a disagreeing body claim +
+ * `transport:v1`); the former 409-on-mismatch is RETIRED (P18 ruling A) — the wire decides the actor and
+ * the body is superseded, not refused.
+ * Header ABSENT ⇒ the body-supplied actor is recorded as the DECLARED claimed-era variant `claimed:v1`
+ * (a TODAY tap under a not-yet-plumbed principal — honest "pre-verification", distinct from a legacy null
+ * row). This is NEVER silent-accept — the claimed:v1 era-stamp IS the visible gap — and NEVER silent-break.
+ * A body actor is still required (some actor must be on the record); its verification is the named gap
+ * whose owner + plumbing-path are documented per increment. Use ONLY on surfaces PM-ruled founder-
+ * visible-flow-breaking (d00c468d: ui review approve/resolve/refreeze + useFiles write); everything else
+ * uses requireSenderIdentity. Post-P18 the two helpers SHARE the deliver-and-label semantics (both
+ * supersede a mismatched body, both deliver header-absent under claimed:v1); this helper's remaining
+ * distinction is its surface scope, not a different refusal behavior.
+ */
+export function resolveActorWithDeferral(c, opts) {
+    const verb = opts?.verb ?? "this action";
+    const session = c.req.header(SENDER_IDENTITY_HEADER)?.trim();
+    const claim = opts?.bodyClaim?.trim();
+    if (session) {
+        // Transport path (CLI/DaemonClient stamped the header). P18 SWEEP: the wire SUPERSEDES any body
+        // claim — the 409 identity_mismatch is retired here too, so the two sibling helpers agree that a
+        // disagreeing body actor is noise to be superseded, never an attack to refuse. Deliver under the
+        // certified transport identity, labelled transport:v1 as shipped; the discrepancy is not persisted.
+        return { ok: true, session, provenance: "transport:v1" };
+    }
+    // Header absent = the browser UI / MCP path → NAMED DEFERRAL (never-break): record the body actor as
+    // the DECLARED claimed-era variant `claimed:v1` (not null). A claimed-era actor is still required.
+    if (!claim) {
+        return {
+            ok: false,
+            response: c.json({
+                error: "actor_required",
+                message: `Refusing ${verb}: no authenticated transport identity (X-OpenRig-Session absent) and no body ` +
+                    "actor to record. The channel of record needs at least a claimed-era actor.",
+            }, 400),
+        };
+    }
+    return { ok: true, session: claim, provenance: "claimed:v1" };
+}
+/**
+ * The wire header a FORWARDING daemon stamps to carry the provenance it resolved for the actor it is
+ * re-stamping, so the origin hop records the TRUTH about that actor's verification instead of inferring
+ * it from the mere presence of a re-stamped X-OpenRig-Session. SAME token alphabet as the store
+ * (IdentityProvenance) — never an ad-hoc string. Its absence is meaningful (see resolveRecordedProvenance).
+ */
+export const IDENTITY_PROVENANCE_HEADER = "x-openrig-provenance";
+/** Set by a forwarding daemon to mark "this arrived via a relay hop" (the actor was derived elsewhere). */
+export const RELAY_HEADER = "x-openrig-relay";
+/**
+ * P21 §4 — the SOLE decider of the provenance RECORDED on a row (rail 2: exactly one place can ever say
+ * `transport:v1`, and only when the transport actually proved it at THIS hop). `identity` is the local
+ * derivation from resolveActorWithDeferral (transport:v1 = header present; claimed:v1 = the deferral).
+ *
+ * Direct request (no relay hop): record exactly what this hop proved — identity.provenance verbatim.
+ *
+ * Relayed request (a forwarding daemon re-stamped the header): NEVER `transport:v1` — the actor was, at
+ * best, verified ONE HOP AWAY, so the strongest honest claim is `relay:v1`, and ONLY when the forwarder
+ * explicitly carried a `transport:v1` marker. Rail 1 — DEGRADE DOWN AS THE DEFAULT BRANCH: any other
+ * carried value, AND a MISSING marker (an old forwarder that predates this plumbing), records `claimed:v1`.
+ * NB the honesty nuance: a missing marker and a forwarder-declared `claimed:v1` are INDISTINGUISHABLE here
+ * and that is correct — both are "not verified at this boundary". `claimed:v1` on a relayed row therefore
+ * means "unverified", NEVER proof the origin action was a UI tap. Uncertainty weakens the claim; it can
+ * never strengthen it — a claimed-era actor can never be laundered into a verified one across a hop.
+ */
+export function resolveRecordedProvenance(c, identity) {
+    const relayed = !!c.req.header(RELAY_HEADER)?.trim();
+    if (!relayed)
+        return identity.provenance; // transport:v1 (proven here) | claimed:v1 (the deferral)
+    const carried = c.req.header(IDENTITY_PROVENANCE_HEADER)?.trim();
+    return carried === "transport:v1" ? "relay:v1" : "claimed:v1";
+}
+//# sourceMappingURL=require-sender-identity.js.map

package/daemon/dist/routes/require-sender-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-sender-identity.js","sourceRoot":"","sources":["../../src/routes/require-sender-identity.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAS1D,MAAM,UAAU,qBAAqB,CACnC,CAAU,EACV,IAAmD;IAEnD,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,aAAa,CAAC;IACzC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC;IAC7D,MAAM,KAAK,GAAG,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACtC,IAAI,OAAO,EAAE,CAAC;QACZ,oGAAoG;QACpG,gGAAgG;QAChG,iGAAiG;QACjG,mGAAmG;QACnG,+FAA+F;QAC/F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC;IAC3D,CAAC;IACD,kGAAkG;IAClG,IAAI,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;IACzE,6FAA6F;IAC7F,8BAA8B;IAC9B,OAAO;QACL,EAAE,EAAE,KAAK;QACT,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC;YACf,KAAK,EAAE,gBAAgB;YACvB,OAAO,EACL,iBAAiB,IAAI,0EAA0E;gBAC/F,kGAAkG;gBAClG,0EAA0E;SAC7E,EAAE,GAAG,CAAC;KACR,CAAC;AACJ,CAAC;AAsBD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,wBAAwB,CACtC,CAAU,EACV,IAAmD;IAEnD,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,aAAa,CAAC;IACzC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC;IAC7D,MAAM,KAAK,GAAG,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACtC,IAAI,OAAO,EAAE,CAAC;QACZ,gGAAgG;QAChG,iGAAiG;QACjG,iGAAiG;QACjG,oGAAoG;QACpG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC;IAC3D,CAAC;IACD,qGAAqG;IACrG,mGAAmG;IACnG,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,EAAE,EAAE,KAAK;YACT,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC;gBACf,KAAK,EAAE,gBAAgB;gBACvB,OAAO,EACL,YAAY,IAAI,+EAA+E;oBAC/F,4EAA4E;aAC/E,EAAE,GAAG,CAAC;SACR,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;AAChE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,sBAAsB,CAAC;AACjE,2GAA2G;AAC3G,MAAM,CAAC,MAAM,YAAY,GAAG,iBAAiB,CAAC;AAE9C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,yBAAyB,CACvC,CAAU,EACV,QAAiE;IAEjE,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC;IACrD,IAAI,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAC,UAAU,CAAC,CAAC,yDAAyD;IACnG,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,0BAA0B,CAAC,EAAE,IAAI,EAAE,CAAC;IACjE,OAAO,OAAO,KAAK,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC;AAChE,CAAC"}

package/daemon/dist/routes/review.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"review.d.ts","sourceRoot":"","sources":["../../src/routes/review.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAyB5B,wBAAgB,YAAY,IAAI,IAAI,CA8JnC"}
+{"version":3,"file":"review.d.ts","sourceRoot":"","sources":["../../src/routes/review.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AA0B5B,wBAAgB,YAAY,IAAI,IAAI,CAqKnC"}

package/daemon/dist/routes/review.js

@@ -15,6 +15,7 @@ import { Hono } from "hono";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { sha256Hex } from "../domain/files/file-write-service.js";
+import { resolveActorWithDeferral } from "./require-sender-identity.js";
 import { freezeSliceExport, resolveAllowlisted } from "../domain/review/freeze.js";
 import { applyBriefSpine } from "../domain/review/brief-spine.js";
 import { composeFleet } from "../domain/review/fleet-compose.js";
@@ -127,11 +128,17 @@ export function reviewRoutes() {
         catch {
             return c.json({ error: "body_invalid", hint: 'POST JSON {"scope":"slice","name":"<slice>","actor":"<session>"}' }, 400);
         }
-        if (body.scope !== "slice" || !body.name || !body.actor) {
+        if (body.scope !== "slice" || !body.name) {
             // Mission-tier freeze rides the same path once mission approval ships
             // end-to-end (Packet 1 FR-9 mission semantics); slice is the v1 surface.
             return c.json({ error: "freeze_request_invalid", hint: 'required: {"scope":"slice","name":"<slice>","actor":"<session>"}' }, 400);
         }
+        // P21 I5: review freeze is a founder-visible surface — resolveActorWithDeferral, P18 deliver-and-label:
+        // header present ⇒ derive + transport:v1, the wire SUPERSEDES a mismatched body (409 retired, ruling A);
+        // header absent (browser UI) ⇒ claimed:v1, never-break.
+        const identity = resolveActorWithDeferral(c, { verb: "review freeze", bodyClaim: body.actor });
+        if (!identity.ok)
+            return identity.response;
         const ctx = gatherer.composeSliceWithContext(body.name);
         if (!ctx)
             return c.json({ error: "slice_not_found", name: body.name }, 404);
@@ -141,7 +148,8 @@ export function reviewRoutes() {
             mediaRefs: ctx.mediaRefs,
             allowlist,
             writeService,
-            actor: body.actor,
+            actor: identity.session,
+            identityProvenance: identity.provenance,
         });
         if (!outcome.ok) {
             const status = outcome.error === "stamp_missing" ? 409 : outcome.error === "allowlist_missing" ? 403 : 500;
@@ -174,7 +182,8 @@ export function reviewRoutes() {
                                 content: applied,
                                 expectedMtime: stat.mtime.toISOString(),
                                 expectedContentHash: sha256Hex(target.content),
-                                actor: body.actor,
+                                actor: identity.session,
+                                identityProvenance: identity.provenance,
                             });
                             briefWrite = "spine updated";
                         }

package/daemon/dist/routes/review.js.map

@@ -1 +1 @@
-{"version":3,"file":"review.js","sourceRoot":"","sources":["../../src/routes/review.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,EAAE;AACF,8EAA8E;AAC9E,iCAAiC;AACjC,6DAA6D;AAC7D,+DAA+D;AAC/D,+EAA+E;AAC/E,mFAAmF;AACnF,iFAAiF;AACjF,EAAE;AACF,4EAA4E;AAC5E,6EAA6E;AAC7E,+DAA+D;AAE/D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EAAoB,SAAS,EAAE,MAAM,uCAAuC,CAAC;AAEpF,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAGrG,SAAS,WAAW,CAAC,CAAgC;IACnD,OAAQ,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAgC,IAAI,IAAI,CAAC;AACzE,CAAC;AAED,SAAS,UAAU,CAAC,GAAuB;IACzC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,GAAG,KAAK,KAAK;QAAE,OAAO,GAAG,CAAC;IAC9B,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM;QAAE,OAAO,GAAkB,CAAC;IACxF,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM;QAAE,OAAO,GAAkB,CAAC;IAC5F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE;QACvB,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,eAAe;gBACtB,IAAI,EAAE,uDAAuD;aAC9D,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;QACnE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,sEAAsE;IACtE,sEAAsE;IACtE,0EAA0E;IAC1E,wEAAwE;IACxE,yDAAyD;IACzD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE;QACpB,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC5E,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,yEAAyE;IACzE,uEAAuE;IACvE,yEAAyE;IACzE,yEAAyE;IACzE,sEAAsE;IACtE,uEAAuE;IACvE,0EAA0E;IAC1E,mEAAmE;IACnE,gEAAgE;IAChE,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5B,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC5E,MAAM,cAAc,GAAI,CAAC,CAAC,GAAG,CAAC,oBAA6B,CAAgD,IAAI,gBAAgB,CAAC;QAChI,MAAM,aAAa,GAAI,CAAC,CAAC,GAAG,CAAC,oBAA6B,CAAiC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC;QAChJ,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC;YAC/B,eAAe,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE;YAC5C,YAAY,EAAE,cAAc;YAC5B,cAAc,EAAE,aAAa;YAC7B,yEAAyE;YACzE,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACjC,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE;QAC5B,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC5E,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3F,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE;QAC9B,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC5E,MAAM,QAAQ,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7F,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,oEAAoE;IACpE,uEAAuE;IACvE,qEAAqE;IACrE,uEAAuE;IACvE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9B,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC5E,MAAM,YAAY,GAAI,CAAC,CAAC,GAAG,CAAC,kBAA2B,CAAkC,IAAI,IAAI,CAAC;QAClG,MAAM,SAAS,GAAI,CAAC,CAAC,GAAG,CAAC,gBAAyB,CAAiC,IAAI,EAAE,CAAC;QAC1F,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,gCAAgC;gBACvC,IAAI,EAAE,gHAAgH;aACvH,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,IAAI,IAAuD,CAAC;QAC5D,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,kEAAkE,EAAE,EAAE,GAAG,CAAC,CAAC;QAC1H,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACxD,sEAAsE;YACtE,yEAAyE;YACzE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,IAAI,EAAE,kEAAkE,EAAE,EAAE,GAAG,CAAC,CAAC;QACpI,CAAC;QACD,MAAM,GAAG,GAAG,QAAQ,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG,iBAAiB,CAAC;YAChC,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,SAAS;YACT,YAAY;YACZ,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,KAAK,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAC3G,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;QAChG,CAAC;QAED,sEAAsE;QACtE,yEAAyE;QACzE,oEAAoE;QACpE,2EAA2E;QAC3E,IAAI,UAAU,GAAkB,IAAI,CAAC;QACrC,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;YACrD,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;gBAChE,MAAM,MAAM,GAAG,QAAQ,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;gBACnE,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;oBACtB,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;oBACpE,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;wBACrB,UAAU,GAAG,4HAA4H,CAAC;oBAC5I,CAAC;yBAAM,IAAI,OAAO,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;wBACtC,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;wBAC3C,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;wBAC7E,IAAI,CAAC,MAAM,EAAE,CAAC;4BACZ,UAAU,GAAG,2DAA2D,CAAC;wBAC3E,CAAC;6BAAM,CAAC;4BACN,YAAY,CAAC,WAAW,CAAC;gCACvB,QAAQ,EAAE,MAAM,CAAC,IAAI;gCACrB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,kBAAkB,CAAC;gCAC/C,OAAO,EAAE,OAAO;gCAChB,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;gCACvC,mBAAmB,EAAE,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC;gCAC9C,KAAK,EAAE,IAAI,CAAC,KAAK;6BAClB,CAAC,CAAC;4BACH,UAAU,GAAG,eAAe,CAAC;wBAC/B,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,UAAU,GAAG,iBAAiB,CAAC;oBACjC,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,UAAU,GAAG,+BAA+B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACjG,CAAC;QACH,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,UAAU,EAAE,CAAC,CAAC;IACpG,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"review.js","sourceRoot":"","sources":["../../src/routes/review.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,EAAE;AACF,8EAA8E;AAC9E,iCAAiC;AACjC,6DAA6D;AAC7D,+DAA+D;AAC/D,+EAA+E;AAC/E,mFAAmF;AACnF,iFAAiF;AACjF,EAAE;AACF,4EAA4E;AAC5E,6EAA6E;AAC7E,+DAA+D;AAE/D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EAAoB,SAAS,EAAE,MAAM,uCAAuC,CAAC;AACpF,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAExE,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAGrG,SAAS,WAAW,CAAC,CAAgC;IACnD,OAAQ,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAgC,IAAI,IAAI,CAAC;AACzE,CAAC;AAED,SAAS,UAAU,CAAC,GAAuB;IACzC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,GAAG,KAAK,KAAK;QAAE,OAAO,GAAG,CAAC;IAC9B,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM;QAAE,OAAO,GAAkB,CAAC;IACxF,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM;QAAE,OAAO,GAAkB,CAAC;IAC5F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE;QACvB,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,eAAe;gBACtB,IAAI,EAAE,uDAAuD;aAC9D,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;QACnE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,sEAAsE;IACtE,sEAAsE;IACtE,0EAA0E;IAC1E,wEAAwE;IACxE,yDAAyD;IACzD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE;QACpB,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC5E,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,yEAAyE;IACzE,uEAAuE;IACvE,yEAAyE;IACzE,yEAAyE;IACzE,sEAAsE;IACtE,uEAAuE;IACvE,0EAA0E;IAC1E,mEAAmE;IACnE,gEAAgE;IAChE,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5B,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC5E,MAAM,cAAc,GAAI,CAAC,CAAC,GAAG,CAAC,oBAA6B,CAAgD,IAAI,gBAAgB,CAAC;QAChI,MAAM,aAAa,GAAI,CAAC,CAAC,GAAG,CAAC,oBAA6B,CAAiC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC;QAChJ,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC;YAC/B,eAAe,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE;YAC5C,YAAY,EAAE,cAAc;YAC5B,cAAc,EAAE,aAAa;YAC7B,yEAAyE;YACzE,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACjC,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE;QAC5B,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC5E,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3F,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE;QAC9B,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC5E,MAAM,QAAQ,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7F,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,oEAAoE;IACpE,uEAAuE;IACvE,qEAAqE;IACrE,uEAAuE;IACvE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9B,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC5E,MAAM,YAAY,GAAI,CAAC,CAAC,GAAG,CAAC,kBAA2B,CAAkC,IAAI,IAAI,CAAC;QAClG,MAAM,SAAS,GAAI,CAAC,CAAC,GAAG,CAAC,gBAAyB,CAAiC,IAAI,EAAE,CAAC;QAC1F,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,gCAAgC;gBACvC,IAAI,EAAE,gHAAgH;aACvH,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,IAAI,IAAuD,CAAC;QAC5D,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,kEAAkE,EAAE,EAAE,GAAG,CAAC,CAAC;QAC1H,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACzC,sEAAsE;YACtE,yEAAyE;YACzE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,IAAI,EAAE,kEAAkE,EAAE,EAAE,GAAG,CAAC,CAAC;QACpI,CAAC;QACD,wGAAwG;QACxG,yGAAyG;QACzG,wDAAwD;QACxD,MAAM,QAAQ,GAAG,wBAAwB,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/F,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC;QAC3C,MAAM,GAAG,GAAG,QAAQ,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG,iBAAiB,CAAC;YAChC,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,SAAS;YACT,YAAY;YACZ,KAAK,EAAE,QAAQ,CAAC,OAAO;YACvB,kBAAkB,EAAE,QAAQ,CAAC,UAAU;SACxC,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,KAAK,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAC3G,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;QAChG,CAAC;QAED,sEAAsE;QACtE,yEAAyE;QACzE,oEAAoE;QACpE,2EAA2E;QAC3E,IAAI,UAAU,GAAkB,IAAI,CAAC;QACrC,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;YACrD,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;gBAChE,MAAM,MAAM,GAAG,QAAQ,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;gBACnE,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;oBACtB,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;oBACpE,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;wBACrB,UAAU,GAAG,4HAA4H,CAAC;oBAC5I,CAAC;yBAAM,IAAI,OAAO,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;wBACtC,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;wBAC3C,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;wBAC7E,IAAI,CAAC,MAAM,EAAE,CAAC;4BACZ,UAAU,GAAG,2DAA2D,CAAC;wBAC3E,CAAC;6BAAM,CAAC;4BACN,YAAY,CAAC,WAAW,CAAC;gCACvB,QAAQ,EAAE,MAAM,CAAC,IAAI;gCACrB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,kBAAkB,CAAC;gCAC/C,OAAO,EAAE,OAAO;gCAChB,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;gCACvC,mBAAmB,EAAE,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC;gCAC9C,KAAK,EAAE,QAAQ,CAAC,OAAO;gCACvB,kBAAkB,EAAE,QAAQ,CAAC,UAAU;6BACxC,CAAC,CAAC;4BACH,UAAU,GAAG,eAAe,CAAC;wBAC/B,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,UAAU,GAAG,iBAAiB,CAAC;oBACjC,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,UAAU,GAAG,+BAA+B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACjG,CAAC;QACH,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,UAAU,EAAE,CAAC,CAAC;IACpG,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/daemon/dist/routes/{rig-policy.d.ts → rig-mode.d.ts}

@@ -1,9 +1,9 @@
 import { Hono } from "hono";
-export interface RigPolicyRoutesOpts {
+export interface RigModeRoutesOpts {
     /** Operator bearer token (same one Mission Control uses). When null,
      * the daemon's listen layer is loopback-only and write verbs pass
      * through; non-null requires `Authorization: Bearer <token>`. */
     bearerToken?: string | null;
 }
-export declare function rigPolicyRoutes(opts?: RigPolicyRoutesOpts): Hono;
-//# sourceMappingURL=rig-policy.d.ts.map
+export declare function rigModeRoutes(opts?: RigModeRoutesOpts): Hono;
+//# sourceMappingURL=rig-mode.d.ts.map

package/daemon/dist/routes/rig-mode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rig-mode.d.ts","sourceRoot":"","sources":["../../src/routes/rig-mode.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAa5B,MAAM,WAAW,iBAAiB;IAChC;;qEAEiE;IACjE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAsED,wBAAgB,aAAa,CAAC,IAAI,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAyF5D"}

package/daemon/dist/routes/{rig-policy.js → rig-mode.js}

@@ -1,13 +1,13 @@
 // Slice 09 — Rig Policy (operator context mode) HTTP routes.
 //
 // Surface (binding-related ONLY — HG-SAFE):
-//   GET    /api/rig-policy/bindings                      — list bindings
-//   GET    /api/rig-policy/bindings/:scope/:qualifier?   — read one binding
-//   PUT    /api/rig-policy/bindings/:scope/:qualifier?   — upsert (operator)
-//   DELETE /api/rig-policy/bindings/:scope/:qualifier?   — unset (operator)
-//   GET    /api/rig-policy/effective                     — resolve effective
+//   GET    /api/rig-mode/bindings                      — list bindings
+//   GET    /api/rig-mode/bindings/:scope/:qualifier?   — read one binding
+//   PUT    /api/rig-mode/bindings/:scope/:qualifier?   — upsert (operator)
+//   DELETE /api/rig-mode/bindings/:scope/:qualifier?   — unset (operator)
+//   GET    /api/rig-mode/effective                     — resolve effective
 //                                                          (?rig=&workstream=&qitem=)
-//   GET    /api/rig-policy/defaults                      — recommended
+//   GET    /api/rig-mode/defaults                      — recommended
 //                                                          per-mode 6×7
 //                                                          + default scope
 //                                                          + DEFAULT_STALE_RULE
@@ -21,11 +21,11 @@
 //
 // HG-SAFE preserved: this router NEVER touches permission allowlists /
 // runtime configs / auth tokens / tmux / lifecycle. It calls a single
-// store (RigPolicyStore) whose surface area is itself binding-limited.
+// store (RigModeStore) whose surface area is itself binding-limited.
 import { Hono } from "hono";
 import { authBearerTokenMiddleware } from "../middleware/auth-bearer-token.js";
-import { OPERATOR_CONTEXT_SCOPES, } from "../domain/rig-policy/rig-policy-types.js";
-import { DEFAULT_STALE_RULE, RECOMMENDED_DEFAULT_SCOPE, RECOMMENDED_MODE_DEFAULTS, } from "../domain/rig-policy/rig-policy-defaults.js";
+import { OPERATOR_CONTEXT_SCOPES, } from "../domain/rig-mode/rig-mode-types.js";
+import { DEFAULT_STALE_RULE, RECOMMENDED_DEFAULT_SCOPE, RECOMMENDED_MODE_DEFAULTS, } from "../domain/rig-mode/rig-mode-defaults.js";
 const VALID_SCOPES = new Set(OPERATOR_CONTEXT_SCOPES);
 function parseScope(raw) {
     return VALID_SCOPES.has(raw) ? raw : null;
@@ -57,7 +57,7 @@ function parseScopeAndQualifier(scopeRaw, qualifierRaw) {
                 status: 400,
                 body: {
                     error: "qualifier_forbidden",
-                    hint: "Global-host bindings cannot carry a qualifier. Use /api/rig-policy/bindings/global_host with no trailing path segment.",
+                    hint: "Global-host bindings cannot carry a qualifier. Use /api/rig-mode/bindings/global_host with no trailing path segment.",
                 },
             };
         }
@@ -76,10 +76,10 @@ function parseScopeAndQualifier(scopeRaw, qualifierRaw) {
     return { ok: true, scope, qualifier: qualifierRaw };
 }
 function getStore(c) {
-    const store = c.get("rigPolicyStore");
+    const store = c.get("rigModeStore");
     return store ?? null;
 }
-export function rigPolicyRoutes(opts) {
+export function rigModeRoutes(opts) {
     const router = new Hono();
     const bearer = opts?.bearerToken ?? null;
     const requireOperator = authBearerTokenMiddleware({ expectedToken: bearer });
@@ -171,4 +171,4 @@ export function rigPolicyRoutes(opts) {
     });
     return router;
 }
-//# sourceMappingURL=rig-policy.js.map
+//# sourceMappingURL=rig-mode.js.map

package/daemon/dist/routes/rig-mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rig-mode.js","sourceRoot":"","sources":["../../src/routes/rig-mode.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAC7D,EAAE;AACF,4CAA4C;AAC5C,uEAAuE;AACvE,0EAA0E;AAC1E,2EAA2E;AAC3E,0EAA0E;AAC1E,2EAA2E;AAC3E,sFAAsF;AACtF,qEAAqE;AACrE,wEAAwE;AACxE,2EAA2E;AAC3E,gFAAgF;AAChF,EAAE;AACF,oEAAoE;AACpE,oEAAoE;AACpE,sEAAsE;AACtE,qEAAqE;AACrE,uEAAuE;AACvE,wDAAwD;AACxD,EAAE;AACF,uEAAuE;AACvE,sEAAsE;AACtE,qEAAqE;AAErE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAE/E,OAAO,EACL,uBAAuB,GAExB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,yCAAyC,CAAC;AASjD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAS,uBAAuB,CAAC,CAAC;AAE9D,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAA4B,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC;AAaD;;;;;;;;;;GAUG;AACH,SAAS,sBAAsB,CAAC,QAAgB,EAAE,YAAgC;IAChF,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,2BAA2B,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;SACzG,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;QAC5B,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1D,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE;oBACJ,KAAK,EAAE,qBAAqB;oBAC5B,IAAI,EAAE,sHAAsH;iBAC7H;aACF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC9C,CAAC;IACD,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,IAAI,EAAE;gBACJ,KAAK,EAAE,oBAAoB;gBAC3B,IAAI,EAAE,SAAS,KAAK,yDAAyD;aAC9E;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;AACtD,CAAC;AAED,SAAS,QAAQ,CAAC,CAAoC;IACpD,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,cAAuB,CAA6B,CAAC;IACzE,OAAO,KAAK,IAAI,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAwB;IACpD,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,IAAI,EAAE,WAAW,IAAI,IAAI,CAAC;IACzC,MAAM,eAAe,GAAG,yBAAyB,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC;IAE7E,uEAAuE;IACvE,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE;QAC5B,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,uBAAuB,EAAE,yBAAyB;YAClD,uBAAuB,EAAE,yBAAyB;YAClD,gBAAgB,EAAE,kBAAkB;SACrC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,uEAAuE;IACvE,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC1E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,uEAAuE;IACvE,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC1E,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC;QAC9C,MAAM,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC;QAC5D,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;QAClD,MAAM,QAAQ,GAAG,KAAK,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1E,2EAA2E;QAC3E,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,SAAS,EAAE,IAAI;gBACf,OAAO,EAAE,iBAAiB;gBAC1B,IAAI,EAAE,+HAA+H;aACtI,CAAC,CAAC;QACL,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,mFAAmF;IACnF,MAAM,CAAC,GAAG,CAAC,8BAA8B,EAAE,CAAC,CAAC,EAAE,EAAE;QAC/C,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,sBAAsB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;QACtF,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACjE,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,uEAAuE;IACvE,MAAM,CAAC,GAAG,CAAC,8BAA8B,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtE,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,sBAAsB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;QACtF,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,eAAe;gBACtB,IAAI,EAAE,wFAAwF;aAC/F,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAA4C,CAAC;QACtE,IAAI,IAAI,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/C,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,oBAAoB;gBAC3B,IAAI,EAAE,wFAAwF;aAC/F,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,uEAAuE;IACvE,MAAM,CAAC,MAAM,CAAC,8BAA8B,EAAE,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE;QACnE,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,sBAAsB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;QACtF,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACpE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/daemon/dist/routes/rigs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rigs.d.ts","sourceRoot":"","sources":["../../src/routes/rigs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAO3C,OAAO,EAA4C,KAAK,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AA4BnH,eAAO,MAAM,UAAU,4EAAa,CAAC;AAUrC,wBAAgB,4BAA4B,CAC1C,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,YAAY,EAAE,MAAM,EAAE,GACrB,GAAG,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAwBpC"}
+{"version":3,"file":"rigs.d.ts","sourceRoot":"","sources":["../../src/routes/rigs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAO3C,OAAO,EAA4C,KAAK,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AA6BnH,eAAO,MAAM,UAAU,4EAAa,CAAC;AAUrC,wBAAgB,4BAA4B,CAC1C,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,YAAY,EAAE,MAAM,EAAE,GACrB,GAAG,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAwBpC"}

package/daemon/dist/routes/rigs.js

@@ -267,10 +267,19 @@ rigsRoutes.get("/:id/graph", async (c) => {
     // capture) — the 30s topology poll colors dots from the snapshot (running/idle) +
     // hook activity; ?full=true opts into the per-node needs_input capture.
     const graphFull = c.req.query("full") === "true";
+    const seatStructuralActivityService = c.get("seatStructuralActivityService");
+    // ACTIVITY D1+D2 — resolved BEFORE attachAgentActivity now, because the ACTIVITY ladder reads the
+    // same motion observation the TERMINAL column reads. Order matters only for this declaration.
+    //
+    // Sharing that observation does NOT collapse the slice-15 non-inference contract, which is between
+    // `terminalActive` and `hasAssignedWork` — ACTIVITY still reads no queue/assignment state. And the
+    // two surfaces can legitimately disagree: ACTIVITY re-ages the raw timestamp at read time while
+    // TERMINAL projects the poll-time boolean (see the sessions route for why that gap is the
+    // stale-cache protection rather than an inconsistency).
+    const seatActivityService = c.get("seatActivityService");
     const inventoryWithActivityOnly = tmuxAdapter
-        ? await attachAgentActivity(inventory, { tmuxAdapter, activityStore: agentActivityStore, captureFallback: graphFull })
+        ? await attachAgentActivity(inventory, { tmuxAdapter, activityStore: agentActivityStore, structuralActivity: seatStructuralActivityService, seatActivity: seatActivityService, captureFallback: graphFull })
         : inventory;
-    const seatActivityService = c.get("seatActivityService");
     const inventoryWithActivity = attachTerminalActivityAndWork(inventoryWithActivityOnly, {
         db: getRepo(c).db,
         seatActivity: seatActivityService,