@ouro.bot/cli 0.1.0-alpha.236 → 0.1.0-alpha.238

package/dist/repertoire/tools-user-profile.js

@@ -0,0 +1,144 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.userProfileToolDefinitions = void 0;
+const user_profile_1 = require("./user-profile");
+const credential_access_1 = require("./credential-access");
+const runtime_1 = require("../nerves/runtime");
+function requireFamilyContext(ctx) {
+    if (!ctx?.context?.friend?.id) {
+        return "no friend context — cannot access user profile.";
+    }
+    if (ctx.context.friend.trustLevel !== "family") {
+        return "user profile access requires family trust level.";
+    }
+    return { friendId: ctx.context.friend.id };
+}
+exports.userProfileToolDefinitions = [
+    {
+        tool: {
+            type: "function",
+            function: {
+                name: "user_profile_store",
+                description: "Store or update user profile fields (legal name, DOB, passport, etc.) in the agent's vault. Fields are merged with any existing profile. Requires family trust level.",
+                parameters: {
+                    type: "object",
+                    properties: {
+                        fields: {
+                            type: "string",
+                            description: 'JSON object with profile fields to store/update. Keys: legalName, dateOfBirth, gender, nationality, passport, driverLicense, email, phone, addresses, loyaltyPrograms, preferences, emergencyContact.',
+                        },
+                    },
+                    required: ["fields"],
+                },
+            },
+        },
+        handler: async (args, ctx) => {
+            (0, runtime_1.emitNervesEvent)({
+                component: "repertoire",
+                event: "repertoire.tool_user_profile_store",
+                message: "user_profile_store invoked",
+                meta: { tool: "user_profile_store" },
+            });
+            const guard = requireFamilyContext(ctx);
+            if (typeof guard === "string")
+                return guard;
+            let fields;
+            try {
+                fields = JSON.parse(args.fields);
+            }
+            catch {
+                return "invalid JSON in fields parameter.";
+            }
+            try {
+                const store = (0, credential_access_1.getCredentialStore)();
+                await (0, user_profile_1.updateUserProfileFields)(guard.friendId, fields, store);
+                return `profile fields stored for ${guard.friendId}.`;
+            }
+            catch (err) {
+                /* v8 ignore next -- defensive: updateUserProfileFields errors are always Error instances @preserve */
+                return `failed to store profile: ${err instanceof Error ? err.message : String(err)}`;
+            }
+        },
+        summaryKeys: ["fields"],
+    },
+    {
+        tool: {
+            type: "function",
+            function: {
+                name: "user_profile_get",
+                description: "Retrieve a specific field from a user's profile. Only returns the requested field, never the full profile. Requires family trust level.",
+                parameters: {
+                    type: "object",
+                    properties: {
+                        field: {
+                            type: "string",
+                            description: "The profile field to retrieve: legalName, dateOfBirth, gender, nationality, passport, driverLicense, email, phone, addresses, loyaltyPrograms, preferences, emergencyContact.",
+                        },
+                    },
+                    required: ["field"],
+                },
+            },
+        },
+        handler: async (args, ctx) => {
+            (0, runtime_1.emitNervesEvent)({
+                component: "repertoire",
+                event: "repertoire.tool_user_profile_get",
+                message: "user_profile_get invoked",
+                meta: { tool: "user_profile_get", field: args.field },
+            });
+            const guard = requireFamilyContext(ctx);
+            if (typeof guard === "string")
+                return guard;
+            try {
+                const store = (0, credential_access_1.getCredentialStore)();
+                const value = await (0, user_profile_1.getUserProfileField)(guard.friendId, args.field, store);
+                if (value === undefined) {
+                    return `field "${args.field}" is not set on the profile.`;
+                }
+                /* v8 ignore next -- platform-dependent v8 branch counting on ternary @preserve */
+                return typeof value === "string" ? value : JSON.stringify(value, null, 2);
+            }
+            catch (err) {
+                /* v8 ignore next -- defensive: getUserProfileField errors are always Error instances @preserve */
+                return `failed to get profile field: ${err instanceof Error ? err.message : String(err)}`;
+            }
+        },
+        summaryKeys: ["field"],
+    },
+    {
+        tool: {
+            type: "function",
+            function: {
+                name: "user_profile_delete",
+                description: "Delete a user's entire profile from the vault. This is irreversible. Requires family trust level.",
+                parameters: {
+                    type: "object",
+                    properties: {},
+                },
+            },
+        },
+        handler: async (_args, ctx) => {
+            (0, runtime_1.emitNervesEvent)({
+                component: "repertoire",
+                event: "repertoire.tool_user_profile_delete",
+                message: "user_profile_delete invoked",
+                meta: { tool: "user_profile_delete" },
+            });
+            const guard = requireFamilyContext(ctx);
+            if (typeof guard === "string")
+                return guard;
+            try {
+                const store = (0, credential_access_1.getCredentialStore)();
+                const deleted = await (0, user_profile_1.deleteUserProfile)(guard.friendId, store);
+                return deleted
+                    ? `profile deleted for ${guard.friendId}.`
+                    : `no profile found for ${guard.friendId}.`;
+            }
+            catch (err) {
+                /* v8 ignore next -- defensive: deleteUserProfile errors are always Error instances @preserve */
+                return `failed to delete profile: ${err instanceof Error ? err.message : String(err)}`;
+            }
+        },
+        summaryKeys: [],
+    },
+];

package/dist/repertoire/tools.js

@@ -3,8 +3,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.surfaceToolDef = exports.restTool = exports.ponderTool = exports.observeTool = exports.settleTool = exports.tools = void 0;
 exports.resetMcpDefinitions = resetMcpDefinitions;
 exports.getToolsForChannel = getToolsForChannel;
-exports.isConfirmationRequired = isConfirmationRequired;
-exports.isConfirmationAlwaysRequired = isConfirmationAlwaysRequired;
 exports.execTool = execTool;
 exports.summarizeArgs = summarizeArgs;
 exports.buildToolResultSummary = buildToolResultSummary;
@@ -39,7 +37,7 @@ Object.defineProperty(exports, "surfaceToolDef", { enumerable: true, get: functi
 // All tool definitions in a single registry
 const allDefinitions = [...tools_base_1.baseToolDefinitions, ...tools_bluebubbles_1.bluebubblesToolDefinitions, ...tools_teams_1.teamsToolDefinitions, ...ado_semantic_1.adoSemanticToolDefinitions, ...tools_github_1.githubToolDefinitions, tools_surface_1.surfaceToolDefinition];
 // MCP tool definitions — populated each time getToolsForChannel() is called with an mcpManager.
-// Kept separate from allDefinitions so execTool/isConfirmation* can find them.
+// Kept separate from allDefinitions so execTool can find them.
 let mcpDefinitions = [];
 /** Exported for testing — reset the MCP definitions cache. */
 function resetMcpDefinitions() {
@@ -120,18 +118,6 @@ function findDefinition(toolName) {
     return allDefinitions.find((d) => d.tool.function.name === toolName)
         ?? mcpDefinitions.find((d) => d.tool.function.name === toolName);
 }
-// Check whether a tool requires user confirmation before execution.
-// Reads from ToolDefinition.confirmationRequired instead of a separate Set.
-function isConfirmationRequired(toolName) {
-    const def = findDefinition(toolName);
-    return def?.confirmationRequired === true;
-}
-// Check whether a tool's confirmation is non-bypassable (cannot be skipped by skipConfirmation).
-// Used for T2 config proposals that must always require operator approval.
-function isConfirmationAlwaysRequired(toolName) {
-    const def = findDefinition(toolName);
-    return def?.confirmationAlwaysRequired === true;
-}
 function normalizeGuardArgs(_name, args) {
     return args;
 }

package/dist/repertoire/user-profile.js

@@ -0,0 +1,118 @@
+"use strict";
+/**
+ * User profile model and vault storage.
+ *
+ * Profiles are stored as secure notes in the agent's Vaultwarden vault,
+ * keyed by friend ID: `user-profile/{friendId}`.
+ *
+ * The storage layer uses the existing CredentialStore interface — the profile
+ * JSON is stored in the `password` field of a login item (the vault's most
+ * reliable field for arbitrary data). Field-level access ensures the full
+ * profile is never dumped to model context unnecessarily.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.storeUserProfile = storeUserProfile;
+exports.getUserProfile = getUserProfile;
+exports.getUserProfileField = getUserProfileField;
+exports.deleteUserProfile = deleteUserProfile;
+exports.updateUserProfileFields = updateUserProfileFields;
+const runtime_1 = require("../nerves/runtime");
+// ---------------------------------------------------------------------------
+// Storage key
+// ---------------------------------------------------------------------------
+function profileKey(friendId) {
+    return `user-profile/${friendId}`;
+}
+// ---------------------------------------------------------------------------
+// CRUD operations
+// ---------------------------------------------------------------------------
+/**
+ * Store a complete user profile in the vault.
+ * Overwrites any existing profile for the given friend ID.
+ */
+async function storeUserProfile(friendId, profile, store) {
+    (0, runtime_1.emitNervesEvent)({
+        event: "repertoire.user_profile_store",
+        component: "repertoire",
+        message: `storing user profile for ${friendId}`,
+        meta: { friendId },
+    });
+    const key = profileKey(friendId);
+    /* v8 ignore start -- platform-dependent v8 branch counting on await @preserve */
+    await store.store(key, {
+        password: JSON.stringify(profile),
+        notes: "user-profile",
+    });
+    /* v8 ignore stop */
+}
+/**
+ * Retrieve the full user profile for a friend.
+ * Returns null if no profile exists or if the stored data is invalid.
+ */
+async function getUserProfile(friendId, store) {
+    (0, runtime_1.emitNervesEvent)({
+        event: "repertoire.user_profile_get",
+        component: "repertoire",
+        message: `getting user profile for ${friendId}`,
+        meta: { friendId },
+    });
+    try {
+        const raw = await store.getRawSecret(profileKey(friendId), "password");
+        const parsed = JSON.parse(raw);
+        return parsed;
+        /* v8 ignore next 2 -- platform-dependent v8 branch counting on catch @preserve */
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Retrieve a specific field from a user profile.
+ * Returns undefined if the profile doesn't exist or the field is not set.
+ */
+async function getUserProfileField(friendId, field, store) {
+    const profile = await getUserProfile(friendId, store);
+    if (!profile)
+        return undefined;
+    return profile[field];
+}
+/**
+ * Delete a user profile from the vault.
+ * Returns true if the profile was deleted, false if it didn't exist.
+ */
+async function deleteUserProfile(friendId, store) {
+    (0, runtime_1.emitNervesEvent)({
+        event: "repertoire.user_profile_delete",
+        component: "repertoire",
+        message: `deleting user profile for ${friendId}`,
+        meta: { friendId },
+    });
+    return store.delete(profileKey(friendId));
+}
+/**
+ * Update specific fields on a user profile, merging with existing data.
+ * Creates the profile if it doesn't exist.
+ * Preferences are merged (not replaced) at the key level.
+ */
+async function updateUserProfileFields(friendId, fields, store) {
+    (0, runtime_1.emitNervesEvent)({
+        event: "repertoire.user_profile_update",
+        component: "repertoire",
+        message: `updating user profile fields for ${friendId}`,
+        meta: { friendId, fieldCount: Object.keys(fields).length },
+    });
+    const existing = await getUserProfile(friendId, store);
+    let merged;
+    if (existing) {
+        // Merge preferences at key level
+        const mergedPreferences = {
+            ...existing.preferences,
+            ...(fields.preferences ?? {}),
+        };
+        merged = { ...existing, ...fields, preferences: mergedPreferences };
+    }
+    else {
+        merged = fields;
+    }
+    await storeUserProfile(friendId, merged, store);
+}

package/dist/senses/inner-dialog.js

@@ -693,7 +693,6 @@ async function runInnerDialogTurn(options) {
             runAgentOptions: {
                 traceId,
                 toolChoiceRequired: true,
-                skipConfirmation: true,
                 mcpManager,
                 toolContext: {
                     signin: async () => undefined,

package/dist/senses/teams.js

@@ -41,7 +41,6 @@ exports.sanitizeFeedbackComment = sanitizeFeedbackComment;
 exports.buildFeedbackSyntheticText = buildFeedbackSyntheticText;
 exports.buildWelcomeCard = buildWelcomeCard;
 exports.createTeamsCallbacks = createTeamsCallbacks;
-exports.resolvePendingConfirmation = resolvePendingConfirmation;
 exports.withConversationLock = withConversationLock;
 exports.handleTeamsMessage = handleTeamsMessage;
 exports.sendProactiveTeamsMessageToSession = sendProactiveTeamsMessageToSession;
@@ -479,24 +478,6 @@ function createTeamsCallbacks(stream, controller, sendMessage, options) {
                 safeSend(msg);
             }
         },
-        onConfirmAction: options?.conversationId
-            ? async (name, args) => {
-                const convId = options.conversationId;
-                const argsDesc = Object.entries(args).map(([k, v]) => `${k}: ${v}`).join(", ");
-                safeUpdate(`Confirm action: ${name} (${argsDesc}) -- reply "yes" to confirm or "no" to cancel`);
-                return new Promise((resolve) => {
-                    _pendingConfirmations.set(convId, resolve);
-                    // Auto-deny after 2 minutes to prevent indefinite blocking
-                    // (e.g. when the stream dies and the user never sees the prompt).
-                    setTimeout(() => {
-                        if (_pendingConfirmations.has(convId)) {
-                            _pendingConfirmations.delete(convId);
-                            resolve("denied");
-                        }
-                    }, 120_000);
-                });
-            }
-            : undefined,
         flush: async () => {
             stopFlushTimer();
             stopPhraseRotation();
@@ -534,26 +515,6 @@ function createTeamsCallbacks(stream, controller, sendMessage, options) {
         },
     };
 }
-// Per-conversation pending confirmation resolvers.
-// When a mutate tool needs confirmation, the resolver is stored here.
-// The next message from the same conversation resolves it.
-const _pendingConfirmations = new Map();
-// Confirmation response words (case-insensitive)
-const CONFIRM_WORDS = new Set(["yes", "confirm", "go", "y", "ok", "approve", "proceed"]);
-function resolvePendingConfirmation(convId, text) {
-    const resolver = _pendingConfirmations.get(convId);
-    if (!resolver)
-        return false;
-    _pendingConfirmations.delete(convId);
-    const word = text.trim().toLowerCase();
-    if (CONFIRM_WORDS.has(word)) {
-        resolver("confirmed");
-    }
-    else {
-        resolver("denied");
-    }
-    return true;
-}
 const _turnCoordinator = (0, turn_coordinator_1.createTurnCoordinator)();
 function teamsTurnKey(conversationId) {
     return `teams:${conversationId}`;
@@ -659,8 +620,6 @@ async function handleTeamsMessage(text, stream, conversationId, teamsContext, se
             },
             ...(reactionOverrides?.isReactionSignal ? { isReactionSignal: true } : {}),
         };
-        if (channelConfig.skipConfirmation)
-            agentOptions.skipConfirmation = true;
         // ── Call shared pipeline ──────────────────────────────────────────
         // Capture terminal errors — failover message replaces the error card if it triggers
         let capturedTerminalError = null;
@@ -961,13 +920,6 @@ function registerBotHandlers(app, label) {
         const userId = activity.from?.id || "";
         const channelId = activity.channelId || "msteams";
         (0, runtime_1.emitNervesEvent)({ level: "info", event: "channel.message_received", component: "channels", message: `[${label}] incoming teams message`, meta: { userId: userId.slice(0, 12), conversationId: convId.slice(0, 20) } });
-        // Resolve pending confirmations IMMEDIATELY — before token fetches or
-        // the conversation lock.  The original message holds the lock while
-        // awaiting confirmation, so acquiring it here would deadlock.  Token
-        // fetches are also unnecessary (and slow) for a simple yes/no reply.
-        if (resolvePendingConfirmation(convId, text)) {
-            return;
-        }
         const commandRegistry = createTeamsCommandRegistry();
         const parsedSlashCommand = (0, commands_1.parseSlashCommand)(text);
         if (parsedSlashCommand) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.236",
+  "version": "0.1.0-alpha.238",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",
@@ -42,7 +42,8 @@
     "ink": "^3.2.0",
     "openai": "^6.27.0",
     "react": "^17.0.2",
-    "semver": "^7.7.4"
+    "semver": "^7.7.4",
+    "stripe": "^22.0.0"
   },
   "repository": {
     "type": "git",

package/skills/agent-commerce.md

@@ -0,0 +1,106 @@
+# Agent Commerce Skill
+
+How to book, purchase, and pay for things on behalf of humans.
+
+## Three Patterns
+
+### Pattern A: API (Structured, Preferred)
+
+For services with direct API access: Duffel flights, LiteAPI hotels.
+
+1. Search using the API tool (`flight_search`, LiteAPI MCP)
+2. Present options to the human with prices and details
+3. Human approves a specific option and price
+4. Book using the API tool with passenger data from `user_profile_get`
+5. Create a single-use virtual card via `stripe_create_card`
+6. Complete payment through the API
+7. Deactivate the card via `stripe_deactivate_card`
+8. Confirm booking to the human
+
+**Key tools**: `flight_search`, `flight_book`, `flight_cancel`, `user_profile_get`, `user_profile_store`, `stripe_create_card`, `stripe_deactivate_card`, `stripe_list_cards`
+
+### Pattern B: Browser (Best-Effort)
+
+For sites without API access, use browser automation via Playwright MCP.
+
+1. Navigate to the booking site
+2. Search for the requested service
+3. Fill forms using data from `user_profile_get`
+4. Use a virtual card from `stripe_create_card` for payment
+5. If blocked by anti-bot measures, fall back to Pattern C
+6. Complete and confirm the booking
+
+**Limitations**: Browser automation is fragile. Sites may block, layouts change, CAPTCHAs appear. Always have Pattern C as fallback.
+
+### Pattern C: Link-Only (Primary for Hostile Sites)
+
+For sites that block automation or require complex human interaction.
+
+1. Research the best options using browser tools or API tools
+2. Prepare a curated link with pre-filled parameters where possible
+3. Send the link to the human with a summary of what to book
+4. Human completes the booking in their own browser
+
+**When to use**: Always use Pattern C as the primary approach for sites known to block automation (most airline direct sites, hotel chains, rental car sites). Pattern B is best-effort, not reliable.
+
+## Payment autonomy Levels
+
+- **Level 0**: No autonomous payments. Agent researches, human pays manually.
+- **Level 1**: Agent creates virtual cards, human approves each transaction explicitly.
+- **Level 2**: Agent can book pre-approved items (within budget, approved categories) without per-transaction approval.
+- **Level 3**: Full delegation with spending limits. Agent manages a budget and books as needed.
+
+Default is Level 1. Level changes require explicit human approval.
+
+## Error Handling
+
+### Price Change Guard
+Before completing a booking, verify the final price matches the approved price within 5%. If the price changed more than 5%, stop and report to the human. Never pay a price the human didn't approve.
+
+### Partial Failure Reporting
+When booking involves multiple services (e.g., flight + hotel), each service may succeed or fail independently — this is a partial failure scenario. Report the status of each service separately. **Never auto-cancel a successful booking because a related booking failed.** Let the human decide.
+
+Example: "Flight SFO-JFK booked (confirmation: ABC123). Hotel booking failed: no availability for those dates. Would you like me to search for alternative hotels?"
+
+### Refund Flow
+If a booking fails after card creation:
+1. Deactivate the virtual card immediately
+2. Report the failure to the human
+3. If a charge was made, note it for the human to follow up with the provider
+
+## CAPTCHA Handling
+
+When a CAPTCHA appears during browser automation (Pattern B):
+1. Take a screenshot and send it to the human
+2. Explain what page you're on and what you were trying to do
+3. Ask the human to solve the CAPTCHA in their own browser
+4. Switch to Pattern C (link-only) for this transaction
+
+Never attempt to solve CAPTCHAs programmatically.
+
+## Card Number Isolation
+
+Card numbers must NEVER appear in:
+- Tool return values shown to the model
+- Nerves events or logs
+- Chat messages to the human
+- Any stored state or memory
+
+The only place card numbers exist is inside the Stripe client's internal payment flow functions, scoped to a single function call. The model only ever sees card IDs and last-4 digits.
+
+## Profile Data Usage
+
+Access profile data only when needed for the current transaction:
+- `user_profile_get` to retrieve specific fields (never dump full profile)
+- Passport data only for international bookings
+- Loyalty program numbers only when booking with that program
+- Emergency contact only when the booking service requires it
+
+## Self-Test
+
+Before first use, run the commerce self-test to verify all services are configured:
+- Stripe: creates and deactivates a test virtual card
+- Duffel: runs a test flight search
+- LiteAPI: verifies API key in vault
+
+Report results to the human with actionable next steps for any failures.

package/skills/commerce-setup-guide.md

@@ -0,0 +1,116 @@
+# Commerce Setup Guide
+
+Human-facing guide for configuring the agent's commerce capabilities.
+
+## Architecture Overview
+
+The agent's commerce system has three pillars:
+
+1. **User Profile**: Secure storage of personal data (name, passport, payment preferences) in Vaultwarden, accessed only when needed for specific transactions.
+
+2. **Booking Delegation**: Direct API access to flight (Duffel) and hotel (LiteAPI) booking systems, plus browser automation fallback for sites without APIs.
+
+3. **Payment**: Stripe Issuing virtual cards created per-transaction, with spend limits and merchant category restrictions. Card numbers never enter the model's context.
+
+## Setup Steps
+
+### 1. Stripe Issuing (Required for Payments)
+
+- Create a Stripe account: https://dashboard.stripe.com
+- Enable Stripe Issuing (requires business verification)
+- Create a restricted API key: https://dashboard.stripe.com/apikeys
+  - Permissions needed: `issuing_cards:write`, `issuing_cards:read`
+- Store in vault: `credential_store stripe.com --password <key>`
+
+### 2. Duffel (Flights)
+
+- Create a Duffel account: https://app.duffel.com
+- Generate a sandbox token: https://app.duffel.com/tokens
+- Store in vault: `credential_store duffel.com --password <token>`
+
+### 3. LiteAPI (Hotels)
+
+- Create a LiteAPI account: https://dashboard.liteapi.travel
+- Get your sandbox API key
+- Store in vault: `credential_store liteapi.travel --password <key>`
+- Configure MCP server in agent.json (see commerce-setup.md skill for details)
+
+### 4. User Profile
+
+Store your travel profile with the agent:
+```
+user_profile_store '{"legalName":{"first":"...","last":"..."},"email":"...","phone":"...","preferences":{}}'
+```
+
+## Tool Reference
+
+### User Profile Tools
+| Tool | Description | Trust Level |
+|------|-------------|-------------|
+| `user_profile_store` | Store/update profile fields | Family |
+| `user_profile_get` | Retrieve a specific profile field | Family |
+| `user_profile_delete` | Delete entire profile | Family |
+
+### Payment Tools
+| Tool | Description | Trust Level |
+|------|-------------|-------------|
+| `stripe_create_card` | Create a virtual card | Family |
+| `stripe_deactivate_card` | Deactivate a card | Family |
+| `stripe_list_cards` | List active cards | Family |
+
+### Flight Tools
+| Tool | Description | Trust Level |
+|------|-------------|-------------|
+| `flight_search` | Search for flights | Friend |
+| `flight_hold` | Hold a flight offer | Family |
+| `flight_book` | Book a flight | Family |
+| `flight_cancel` | Cancel a booking | Family |
+
+### Hotel Tools
+Hotels are accessed through the LiteAPI MCP server. Tools are dynamically registered when the MCP server connects. Common tools include search, get rates, and book.
+
+## Security Model
+
+### Credential Gateway
+All API keys are stored in the agent's Vaultwarden vault. They are never exposed as environment variables or stored in config files. MCP servers receive credentials at startup via `vault:` env resolution.
+
+### Card Number Isolation
+Virtual card numbers exist only within the Stripe client's internal functions during a payment flow. They are never:
+- Returned to the model in tool outputs
+- Included in nerves events or logs
+- Stored in any persistent state
+- Shown in chat messages
+
+The model only sees card IDs (e.g., `ic_...`) and last-4 digits.
+
+### Trust Gating
+- **Family trust required**: All profile, payment, and booking tools
+- **Friend trust sufficient**: Flight search (read-only, no payment)
+- **Stranger/acquaintance**: No commerce access
+
+### Vault Resolution Failures
+When a `vault:` reference cannot be resolved for an MCP server:
+- The specific server is skipped (not crashed)
+- Other servers continue to start normally
+- An error event is emitted with the specific resolution failure
+- Error messages are actionable (e.g., "item not found", "field empty")
+
+## Verification Tiers
+
+### Tier 1: Real-Tested
+- User profile vault CRUD (tested against live Vaultwarden)
+- MCP credential injection (tested with real `vault:` env resolution)
+- Tool registration and guardrail enforcement
+
+### Tier 2: Mocked
+- Stripe Issuing API calls (mocked SDK)
+- Duffel flight API calls (mocked HTTP)
+- LiteAPI hotel API calls (MCP config only)
+- Full booking flow (profile -> search -> card -> book -> confirm -> deactivate)
+- Card number leakage verification
+
+### Post-Handoff
+- Real Stripe Issuing card creation (requires live Stripe account with Issuing)
+- Real Duffel booking (requires live API key)
+- Real LiteAPI hotel search (requires live MCP server)
+- Browser automation for Pattern B sites