@ouro.bot/cli 0.1.0-alpha.671 → 0.1.0-alpha.673

package/dist/a2a/server.js

@@ -36,11 +36,19 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.startA2AServer = startA2AServer;
 const http = __importStar(require("node:http"));
 const node_crypto_1 = require("node:crypto");
+const a2a_client_1 = require("@ouro.bot/friends/a2a-client");
+const friends_1 = require("@ouro.bot/friends");
 const identity_1 = require("../heart/identity");
 const runtime_1 = require("../nerves/runtime");
 const shared_turn_1 = require("../senses/shared-turn");
 const card_1 = require("./card");
 const config_1 = require("./config");
+const pin_store_1 = require("./pin-store");
+const seen_ledger_1 = require("./seen-ledger");
+const did_resolution_1 = require("./did-resolution");
+const inbound_share_1 = require("./inbound-share");
+const mission_result_wire_1 = require("./mission-result-wire");
+const delegation_stores_1 = require("./delegation-stores");
 const task_store_1 = require("./task-store");
 const MAX_A2A_REQUEST_BYTES = 128 * 1024;
 const MAX_A2A_MESSAGE_TEXT_CHARS = 16_000;
@@ -160,6 +168,21 @@ function accessTokenScope(accessToken) {
 function untrustedTurnPeerExternalId() {
     return "unauthenticated-a2a-peer";
 }
+/** Whether an inbound message carries a friends sealed DataPart (`kind:"data"`). */
+function messageHasDataPart(message) {
+    /* v8 ignore next -- defensive: callers pass a parsed inbound whose `parts` is always an array; guards malformed direct input @preserve */
+    if (!Array.isArray(message.parts))
+        return false;
+    return message.parts.some((part) => part && part.kind === "data");
+}
+/** Map a friends `receiveShare` rejection reason → a JSON-RPC error code.
+ * Malformed-shape reasons map to invalid-params (-32602); auth/trust/replay
+ * rejections map to a dedicated A2A "rejected" code (-32003). */
+function rejectionErrorCode(reason) {
+    if (reason === "malformed_message" || reason === "malformed_plaintext")
+        return -32602;
+    return -32003;
+}
 function senderHintFromMessage(req, inbound) {
     const idHint = metadataString(inbound, "senderAgentId")
         ?? metadataString(inbound, "senderCardUrl")
@@ -315,9 +338,28 @@ async function startA2AServer(options) {
     const port = options.port ?? (0, config_1.defaultA2APort)(options.agentName);
     const a2aPath = (0, config_1.normalizeA2APath)(options.path);
     /* v8 ignore next -- foreground CLI/default daemon paths own the ambient agent-root fallback; protocol tests inject an isolated root @preserve */
-    const taskStore = new task_store_1.FileA2ATaskStore(options.agentRoot ?? (0, identity_1.getAgentRoot)(options.agentName));
+    const agentRoot = options.agentRoot ?? (0, identity_1.getAgentRoot)(options.agentName);
+    const taskStore = new task_store_1.FileA2ATaskStore(agentRoot);
     /* v8 ignore next -- default runner crosses into the full live agent pipeline; shared-turn covers that pipeline and server tests inject a deterministic runner @preserve */
     const turnRunner = options.turnRunner ?? defaultTurnRunner;
+    // The inbound friends-DataPart bridge is available only when the agent has a
+    // cryptographic identity (its did:key + X25519 unseal keys). Build its durable
+    // stores once at start; without an identity, inbound stays on the text path.
+    let inboundShareDeps;
+    if (options.identity) {
+        const friendsDir = `${agentRoot}/friends`;
+        inboundShareDeps = {
+            sodium: await (0, a2a_client_1.ready)(),
+            store: new friends_1.FileFriendStore(friendsDir),
+            // The SAME canonical mission store the Slice-4 delegation tools use, so an
+            // inbound `importCoordination` write lands where the read/prepare surface reads.
+            missionStore: (0, delegation_stores_1.delegationStoresFor)(agentRoot).missionStore,
+            pinStore: new pin_store_1.FileA2APinStore(agentRoot),
+            seen: new seen_ledger_1.FileA2ASeenLedger(agentRoot),
+            didResolution: (0, did_resolution_1.makeDidResolution)({ sodium: await (0, a2a_client_1.ready)() }),
+            identity: options.identity,
+        };
+    }
     let publicBaseUrl = options.baseUrl;
     const server = http.createServer(async (req, res) => {
         /* v8 ignore next -- Node always supplies url/host for accepted HTTP requests; fallback keeps malformed local calls safe @preserve */
@@ -325,7 +367,12 @@ async function startA2AServer(options) {
         /* v8 ignore next -- host fallback is defensive for malformed local requests; publicBaseUrl/default host branches are covered @preserve */
         const currentBaseUrl = publicBaseUrl ?? `http://${req.headers.host ?? `${host}:${port}`}`;
         if (req.method === "GET" && (requestUrl.pathname === "/.well-known/agent-card.json" || requestUrl.pathname === "/agent-card.json")) {
-            writeJson(res, 200, (0, card_1.buildA2AAgentCard)({ agentName: options.agentName, baseUrl: currentBaseUrl, path: a2aPath }));
+            writeJson(res, 200, (0, card_1.buildA2AAgentCard)({
+                agentName: options.agentName,
+                baseUrl: currentBaseUrl,
+                path: a2aPath,
+                ...(options.identity ? { did: options.identity.did } : {}),
+            }));
             return;
         }
         if (req.method !== "POST" || requestUrl.pathname !== a2aPath) {
@@ -350,7 +397,64 @@ async function startA2AServer(options) {
                 const responseStyle = rpc.method === "message/send" ? "legacy" : "latest";
                 const parsedInbound = messageFromParams(rpc.params);
                 const inbound = parsedInbound ? { ...parsedInbound, kind: parsedInbound.kind ?? "message" } : null;
-                const text = textFromMessage(inbound);
+                // HARNESS-OWNED RESULT WIRE (runs BEFORE the friends-share branch). A
+                // `mission_result`-tagged DataPart is NOT a FriendsKind — it routes to
+                // `importMissionResult` (assignee/correlation-gated, store-only, NO turn), never
+                // to `receiveShare`. Recognized by the `ouroKind` discriminator.
+                if (inbound && inboundShareDeps && (0, mission_result_wire_1.isMissionResultDataPart)(inbound)) {
+                    const imported = await (0, mission_result_wire_1.receiveInboundMissionResult)(inbound, {
+                        sodium: inboundShareDeps.sodium,
+                        store: inboundShareDeps.store,
+                        missionStore: inboundShareDeps.missionStore,
+                        // The SAME authentication seam the share bridge uses — so a forged-sender
+                        // result is rejected by the DidVerifier exactly like a forged share.
+                        pinStore: inboundShareDeps.pinStore,
+                        seen: inboundShareDeps.seen,
+                        didResolution: inboundShareDeps.didResolution,
+                        identity: inboundShareDeps.identity,
+                    });
+                    if (imported.outcome === "rejected") {
+                        writeJson(res, 200, errorResponse(rpc.id, rejectionErrorCode(imported.reason), `A2A result rejected: ${imported.reason}`));
+                        return;
+                    }
+                    // imported (store-only, no turn): acknowledge with a minimal completed task.
+                    /* v8 ignore next -- "not-a-result" is unreachable here (gated by isMissionResultDataPart) @preserve */
+                    const ackText = imported.outcome === "imported"
+                        ? `[a2a] imported mission result from ${imported.verifiedDid}`
+                        /* v8 ignore next -- defensive: the gate above guarantees imported|rejected @preserve */
+                        : "[a2a] mission result";
+                    const contextId = inbound.contextId ?? "default";
+                    const taskId = (0, node_crypto_1.randomUUID)();
+                    const accessToken = (0, node_crypto_1.randomUUID)();
+                    const ackTask = taskFor({ taskId, accessToken, contextId, inbound, state: "TASK_STATE_COMPLETED", response: ackText });
+                    taskStore.put(ackTask, accessTokenScope(accessToken));
+                    writeJson(res, 200, jsonResponse(rpc.id, publicTask(ackTask, accessToken, responseStyle, true)));
+                    return;
+                }
+                // Inbound friends-DataPart branch (runs BEFORE the legacy text path). A
+                // sealed DataPart is unwrapped + verified through the bridge; the turn is
+                // then keyed on the VERIFIED sender DID (replacing the unauthenticated
+                // sentinel). A non-friends (text) message falls through unchanged.
+                let verifiedPeerAgentId;
+                let verifiedPeerName;
+                let verifiedShareText;
+                if (inbound && inboundShareDeps && messageHasDataPart(inbound)) {
+                    const bridged = await (0, inbound_share_1.receiveInboundShare)(inbound, inboundShareDeps);
+                    if (bridged.outcome === "rejected") {
+                        writeJson(res, 200, errorResponse(rpc.id, rejectionErrorCode(bridged.reason), `A2A share rejected: ${bridged.reason}`));
+                        return;
+                    }
+                    // A message with a data part always resolves to completed|rejected — the
+                    // bridge only returns "not-a-share" when there is NO data part, which the
+                    // `messageHasDataPart` gate above excludes. So this is the completed path.
+                    /* v8 ignore next -- "not-a-share" is unreachable here (gated by messageHasDataPart) @preserve */
+                    if (bridged.outcome === "completed") {
+                        verifiedPeerAgentId = bridged.verifiedDid;
+                        verifiedPeerName = bridged.verifiedDid;
+                        verifiedShareText = `[a2a] received ${bridged.friendsKind} (${bridged.status}) from ${bridged.verifiedDid}`;
+                    }
+                }
+                const text = verifiedShareText ?? textFromMessage(inbound);
                 if (!inbound || !text) {
                     writeJson(res, 200, errorResponse(rpc.id, -32602, "SendMessage requires a text message"));
                     return;
@@ -360,8 +464,10 @@ async function startA2AServer(options) {
                     return;
                 }
                 const senderHint = senderHintFromMessage(req, inbound);
-                const peerAgentId = untrustedTurnPeerExternalId();
-                const peerName = senderHint.name;
+                // The verified DID wins as the turn's peer identity; otherwise the legacy
+                // unauthenticated sentinel (text path, behavior-preserved).
+                const peerAgentId = verifiedPeerAgentId ?? untrustedTurnPeerExternalId();
+                const peerName = verifiedPeerName ?? senderHint.name;
                 const continuationToken = accessTokenFromParams(rpc.params);
                 const continuationTask = inbound.taskId && continuationToken
                     ? taskStore.get(inbound.taskId, accessTokenScope(continuationToken))

package/dist/a2a/transport.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.makeA2ATransport = makeA2ATransport;
+const runtime_1 = require("../nerves/runtime");
+const client_1 = require("./client");
+/** The not-wired marker for the relay/mailbox rungs (the stubbed seam). */
+const RELAY_NOT_WIRED = "A2A relay/mailbox transport is not wired — see ourostack/friends-relay";
+/**
+ * Build the harness `A2ATransport` (the outbound delivery seam friends' `sendShare`
+ * calls). Only the `direct` rung is wired in this slice: it HTTP-POSTs the sealed,
+ * `wrapInDataPart`-wrapped message to the peer's `endpointUrl` (the `address`) as a
+ * JSON-RPC `message/send`, reusing the harness `client.ts` plumbing. The `relay` and
+ * `mailbox` rungs are a TYPED-but-STUBBED seam: they throw a clear not-wired error
+ * naming the `ourostack/friends-relay` dependency, so a future relay slice has an
+ * exact insertion point without this slice shipping an untrusted relay.
+ */
+function makeA2ATransport(input = {}) {
+    return {
+        async send(target, message) {
+            if (target.rung === "direct") {
+                (0, runtime_1.emitNervesEvent)({
+                    component: "channels",
+                    event: "channel.a2a_transport_direct_send",
+                    message: "delivering sealed A2A message over the direct rung",
+                    meta: { address: target.address },
+                });
+                await (0, client_1.postA2AMessageEnvelope)({
+                    endpointUrl: target.address,
+                    message,
+                    ...(input.fetchImpl ? { fetchImpl: input.fetchImpl } : {}),
+                });
+                return;
+            }
+            // relay / mailbox: the typed-but-stubbed seam. Loud refusal (security-relevant:
+            // we never silently fall through to an untrusted relay).
+            (0, runtime_1.emitNervesEvent)({
+                component: "channels",
+                event: "channel.a2a_transport_not_wired",
+                message: "refused A2A transport over a non-direct rung (not wired)",
+                meta: { rung: target.rung, address: target.address, dependency: "ourostack/friends-relay" },
+            });
+            throw new Error(`${RELAY_NOT_WIRED} (rung: ${target.rung})`);
+        },
+    };
+}

package/dist/repertoire/tools-a2a.js

@@ -38,8 +38,14 @@ const path = __importStar(require("node:path"));
 const identity_1 = require("../heart/identity");
 const runtime_credentials_1 = require("../heart/runtime-credentials");
 const friends_1 = require("@ouro.bot/friends");
+const a2a_client_1 = require("@ouro.bot/friends/a2a-client");
 const runtime_1 = require("../nerves/runtime");
 const client_1 = require("../a2a/client");
+const onboarding_1 = require("../a2a/onboarding");
+const identity_2 = require("../a2a/identity");
+const transport_1 = require("../a2a/transport");
+const delegation_stores_1 = require("../a2a/delegation-stores");
+const mission_result_wire_1 = require("../a2a/mission-result-wire");
 const outboundTaskTokens = new Map();
 function tokenKey(ctx, friendId, taskId) {
     return `${ctx?.agentRoot ?? "ambient"}\n${friendId}\n${taskId}`;
@@ -138,7 +144,176 @@ async function resolveA2AEndpoint(friend) {
     }
     throw new Error("A2A peer has no endpointUrl or cardUrl in agentMeta.a2a");
 }
+/** The management sense the current turn arrived through, defaulting to a non-`local`
+ * value when unknown so the owner-only gate fails CLOSED on an unexpected origin. */
+function senseTypeOf(ctx) {
+    /* v8 ignore next -- in-turn tool calls always carry a resolved channel context; the open-default fail-closed fallback is defensive @preserve */
+    return ctx?.context?.channel?.senseType ?? "open";
+}
+/** The pinned DID a peer record carries (its durable A2A identity), or undefined for a
+ * legacy (non-DID-keyed) peer. */
+function peerDid(peer) {
+    const did = peer.agentMeta?.a2a?.did;
+    return typeof did === "string" && did.trim() ? did.trim() : undefined;
+}
+/** Locate an imported delegation by its correlation `requestId` across all missions:
+ * who delegated it (`fromAgentId`) + which local mission (`missionId`). The delegation
+ * lives under `importedDelegations[fromAgentId][requestId]` — what the inbound bridge
+ * quarantined. Returns undefined when no mission carries that requestId. */
+function findImportedDelegation(missions, requestId) {
+    for (const mission of missions) {
+        for (const [fromAgentId, byRequest] of Object.entries(mission.importedDelegations ?? {})) {
+            if (byRequest[requestId])
+                return { fromAgentId, missionId: mission.id };
+        }
+    }
+    return undefined;
+}
+/**
+ * Seal an arbitrary friends plaintext envelope to a DID-keyed peer and deliver it over
+ * the `direct` rung via friends' `sendShare`. `sendShare` builds the SAME SealedEnvelope
+ * regardless of rung, `wrapInDataPart`-wraps it, and calls the transport itself; the
+ * recipient X25519 is derived from the peer's pinned did:key. Throws when the peer's DID
+ * is unparseable (cannot seal) or the rung is unreachable.
+ */
+async function sealEnvelopeToPeer(input) {
+    const parsed = (0, a2a_client_1.parseDidKey)(input.did);
+    if (!parsed)
+        throw new Error(`cannot seal: peer DID is not a parseable did:key (${input.did})`);
+    const reachability = (0, a2a_client_1.resolveReachability)(input.peer.agentMeta?.a2a, input.peer.agentMeta?.mailbox);
+    if (reachability.rung === "unreachable") {
+        throw new Error("cannot seal: peer has no reachable A2A endpoint");
+    }
+    (0, runtime_1.emitNervesEvent)({
+        component: "channels",
+        event: "channel.a2a_outbound_seal",
+        message: "sealing outbound A2A envelope to a DID-keyed peer",
+        meta: { selfDid: input.self.did, peerDid: input.did, rung: reachability.rung, friendsKind: input.friendsKind },
+    });
+    const result = await (0, a2a_client_1.sendShare)({
+        sodium: input.sodium,
+        transport: (0, transport_1.makeA2ATransport)(),
+        fromIdentity: input.self,
+        toPeer: { a2a: input.peer.agentMeta?.a2a },
+        recipientDid: input.did,
+        recipientX25519Pub: (0, a2a_client_1.keyAgreementFromDidKey)({ sodium: input.sodium, ed25519Pub: parsed.ed25519Pub }),
+        plaintextEnvelope: input.envelope,
+        friendsKind: input.friendsKind,
+    });
+    /* v8 ignore next 3 -- unreachable behind the resolveReachability pre-check above: sendShare only returns ok:false on the SAME `unreachable` plan we already rejected; a redundant guard. @preserve */
+    if (!result.ok) {
+        throw new Error(`sealed send failed (${result.reason})`);
+    }
+}
+/**
+ * Seal an outbound free-text message to a DID-keyed peer over the `direct` rung. The
+ * text rides a minimal `coordination` envelope (`intent:"offer"`, the text as `note`) —
+ * the kind the Slice-1 inbound bridge verifies (signed sender DID) and turns into a
+ * peer turn.
+ */
+async function sealAndSendToPeer(input) {
+    const sodium = await (0, a2a_client_1.ready)();
+    const self = await (0, identity_2.loadSelfA2AIdentity)({ agentName: input.agentName, sodium });
+    const envelope = {
+        subject: { missionKey: `dm:${self.did}:${input.did}`, title: "Direct message" },
+        fromAgentId: self.did,
+        intent: "offer",
+        note: input.message,
+        issuedAt: new Date().toISOString(),
+    };
+    await sealEnvelopeToPeer({
+        self: { did: self.did, keyId: self.keyId, ed25519Priv: self.ed25519Priv },
+        sodium, peer: input.peer, did: input.did, envelope, friendsKind: "coordination",
+    });
+}
 exports.a2aToolDefinitions = [
+    {
+        tool: {
+            type: "function",
+            function: {
+                name: "connect_to",
+                description: "Owner-only: link an A2A agent (by its agent-card URL) into your fleet as a family-trusted, DID-keyed peer. Reachable only from your own local/CLI management sense — not exposed to network peers.",
+                parameters: {
+                    type: "object",
+                    properties: {
+                        card_url: { type: "string", description: "The agent-card URL of the agent to connect to (its /.well-known/agent-card.json)." },
+                        name: { type: "string", description: "Optional display name for the linked peer (defaults to the card name)." },
+                    },
+                    required: ["card_url"],
+                },
+            },
+        },
+        handler: async (args, ctx) => {
+            (0, runtime_1.emitNervesEvent)({
+                component: "repertoire",
+                event: "repertoire.tool_connect_to",
+                message: "connect_to invoked",
+                meta: { tool: "connect_to" },
+            });
+            const guard = requireTrustedRequester(ctx);
+            if (guard)
+                return guard;
+            // OWNER-ONLY GATE (fail-closed): authorizeConnect commits ONLY on the `local`
+            // (owner stdio/CLI) management sense. Any network/group/internal sense
+            // downgrades — refused BEFORE any card fetch or record write, so this tool is
+            // never reachable as a general in-turn capability a network peer could exercise.
+            // No `membership` is computed (roster auto-family is OUT of scope), so a `closed`
+            // sense ALSO downgrades — never a blanket-allow without the real roster verifier.
+            const senseType = senseTypeOf(ctx);
+            const authorization = (0, friends_1.authorizeConnect)({ senseType });
+            if (authorization.decision !== "commit") {
+                (0, runtime_1.emitNervesEvent)({
+                    component: "repertoire",
+                    event: "repertoire.tool_connect_to_refused",
+                    message: "connect_to refused (non-owner management sense)",
+                    meta: { tool: "connect_to", senseType, reason: authorization.reason },
+                });
+                return `connect_to is available only from your own local management sense (the CLI you launched). This sense (${senseType}) is not permitted to link agents.`;
+            }
+            const agentName = agentNameFromRoot(ctx?.agentRoot);
+            // ONE store for both halves — the DID-keyed onboarding write and the
+            // connectAgents resolve/link MUST point at the same store, or the link can't
+            // resolve the record the onboarding just wrote.
+            const store = storeFor(ctx);
+            try {
+                // 1) DID-keyed onboarding (the footgun fix): fetch the card, verify the
+                //    card↔DID binding, and write the record keyed on the verified DID. This
+                //    is what makes the peer resolvable BY DID for connectAgents below (and for
+                //    the inbound resolve path). A mis-bound card throws here → no link.
+                const onboarded = await (0, onboarding_1.onboardA2APeer)({
+                    /* v8 ignore next -- in-turn connect_to always carries an agentRoot; the ambient-name fallback is defensive @preserve */
+                    agentName: agentName ?? "ouro-agent",
+                    cardUrl: args.card_url,
+                    trustLevel: "family",
+                    ...(args.name ? { name: args.name } : {}),
+                    store,
+                });
+                const did = onboarded.agentMeta?.a2a?.did;
+                // onboardA2APeer always sets a2a.agentId (== the DID when DID-keyed, else the
+                // card URL), so this is the resolvable handle connectAgents disambiguates on.
+                /* v8 ignore next -- upsertAgentPeer always writes a2a.agentId; the record-id fallback guards a future store-shape regression @preserve */
+                const peerHandle = onboarded.agentMeta?.a2a?.agentId ?? onboarded.id;
+                // 2) The authority-gated link + control-plane audit. connectAgents re-runs the
+                //    `local` gate, resolves the just-written record (by DID when present, else
+                //    by its agent-peer handle), links at family, and records action:"connect".
+                const result = await (0, friends_1.connectAgents)(store, {
+                    peer: did ? { did } : { agentId: peerHandle },
+                    senseType,
+                    trustLevel: "family",
+                }, { actor: "owner:local", originSense: senseType });
+                /* v8 ignore next 3 -- onboardA2APeer wrote a DID/agentId-keyed record, so connectAgents always resolves it (ok:true); this guards a future store-shape regression @preserve */
+                if (!result.ok) {
+                    return `connect_to could not complete the link (${result.status}).`;
+                }
+                return `connected ${result.record.name} (${did ?? result.record.id}) at family trust.`;
+            }
+            catch (error) {
+                return `connect_to error: ${error instanceof Error ? error.message : /* v8 ignore next -- defensive non-Error failures @preserve */ String(error)}`;
+            }
+        },
+        summaryKeys: ["card_url", "name"],
+        riskProfile: { mutates: "durable_state_write", risk: "high", reason: "links a new agent peer into the friend model at family trust" },
+    },
     {
         tool: {
             type: "function",
@@ -208,6 +383,25 @@ exports.a2aToolDefinitions = [
                 return `A2A peer not found: ${args.friend_id}`;
             if (!(0, friends_1.isTrustedLevel)(peer.trustLevel))
                 return "target A2A peer must be friend or family trust before outbound messages.";
+            // ROUTING (explicit, no impl judgment): a DID-keyed peer → seal+sign via
+            // sendShare over the direct rung (E2E, verified-DID inbound). A legacy peer
+            // with no pinned DID → the existing text send, byte-for-byte unchanged.
+            const did = peerDid(peer);
+            if (did) {
+                try {
+                    await sealAndSendToPeer({
+                        /* v8 ignore next -- in-turn a2a_send_message always carries a bundle agentRoot; the ambient-name fallback is defensive @preserve */
+                        agentName: agentNameFromRoot(ctx?.agentRoot) ?? "ouro-agent",
+                        peer,
+                        did,
+                        message: args.message,
+                    });
+                    return `sealed message delivered to ${peer.name} (${did}) over the direct rung.`;
+                }
+                catch (error) {
+                    return `A2A sealed send error: ${error instanceof Error ? error.message : /* v8 ignore next -- defensive non-Error transport failures @preserve */ String(error)}`;
+                }
+            }
             try {
                 const endpoint = await resolveA2AEndpoint(peer);
                 const task = await (0, client_1.sendA2AMessage)({
@@ -279,4 +473,227 @@ exports.a2aToolDefinitions = [
         },
         summaryKeys: ["friend_id", "task_id"],
     },
+    {
+        tool: {
+            type: "function",
+            function: {
+                name: "coordinate",
+                description: "Delegate a task to a trusted (friend/family) A2A agent peer over a named shared mission. Mints a correlation requestId, records your first-party delegation, and seals the coordination to the peer over the direct rung. The peer reads it via its quarantined imported delegations and returns a result with send_result.",
+                parameters: {
+                    type: "object",
+                    properties: {
+                        friend_id: { type: "string", description: "Friend record ID for the A2A agent peer to delegate to." },
+                        mission_key: { type: "string", description: "The shared mission join key both agents can name (e.g. a stable project key)." },
+                        mission_title: { type: "string", description: "Human title for the mission (used when first creating it)." },
+                        task_summary: { type: "string", description: "What the peer is being asked to do." },
+                        task_details: { type: "string", description: "Optional fuller description of the task." },
+                    },
+                    required: ["friend_id", "mission_key", "mission_title", "task_summary"],
+                },
+            },
+        },
+        handler: async (args, ctx) => {
+            (0, runtime_1.emitNervesEvent)({
+                component: "repertoire",
+                event: "repertoire.tool_coordinate",
+                message: "coordinate invoked",
+                meta: { tool: "coordinate", friendId: args.friend_id, missionKey: args.mission_key },
+            });
+            const guard = requireTrustedRequester(ctx);
+            if (guard)
+                return guard;
+            const peer = await storeFor(ctx).get(args.friend_id);
+            if (!peer || !isA2APeer(peer))
+                return `A2A peer not found: ${args.friend_id}`;
+            if (!(0, friends_1.isTrustedLevel)(peer.trustLevel))
+                return "target A2A peer must be friend or family trust before delegating.";
+            const did = peerDid(peer);
+            if (!did)
+                return "coordinate requires a DID-keyed peer (connect_to it first to pin its did:key).";
+            /* v8 ignore next -- in-turn coordinate always carries a bundle agentRoot; the ambient-name fallback is defensive (same pattern as connect_to) @preserve */
+            const agentName = agentNameFromRoot(ctx?.agentRoot) ?? "ouro-agent";
+            const store = storeFor(ctx);
+            /* v8 ignore next -- in-turn tool calls always carry an agentRoot; the getAgentRoot() ambient fallback depends on process argv (same pattern as storeFor) @preserve */
+            const { missionStore, grantStore } = (0, delegation_stores_1.delegationStoresFor)(ctx?.agentRoot ?? (0, identity_1.getAgentRoot)());
+            try {
+                const sodium = await (0, a2a_client_1.ready)();
+                const self = await (0, identity_2.loadSelfA2AIdentity)({ agentName, sodium });
+                // Ensure the local mission exists (first-party), then prepare the coordination:
+                // mints the requestId + records the first-party delegation (assignee = the peer).
+                const mission = await (0, friends_1.recordMission)(missionStore, { missionKey: args.mission_key, title: args.mission_title });
+                const prepared = await (0, friends_1.prepareCoordination)(missionStore, store, grantStore, {
+                    missionId: mission.id,
+                    toAgentId: did,
+                    intent: "request",
+                    selfAgentId: self.did,
+                    task: { summary: args.task_summary, ...(args.task_details ? { details: args.task_details } : {}) },
+                });
+                /* v8 ignore next 3 -- unreachable for a trusted DID-keyed peer: recordMission guarantees the mission exists (no not_found) and the isTrustedLevel guard above guarantees trust≥friend, which the tiered consent default always approves (no no_consent). Defensive only. @preserve */
+                if (!prepared.ok) {
+                    return `coordinate refused (${prepared.status}).`;
+                }
+                const requestId = prepared.envelope.task?.requestId;
+                // Seal + send the coordination envelope to the peer over direct.
+                await sealEnvelopeToPeer({
+                    self: { did: self.did, keyId: self.keyId, ed25519Priv: self.ed25519Priv },
+                    sodium, peer, did,
+                    envelope: prepared.envelope,
+                    friendsKind: "coordination",
+                });
+                (0, runtime_1.emitNervesEvent)({
+                    component: "repertoire",
+                    event: "repertoire.tool_coordinate_sent",
+                    message: "coordination delegated + sealed to peer",
+                    meta: { tool: "coordinate", peerDid: did, missionKey: args.mission_key, requestId },
+                });
+                return `coordinated: delegated "${args.task_summary}" to ${peer.name} on mission ${args.mission_key} (requestId ${requestId}).`;
+            }
+            catch (error) {
+                return `coordinate error: ${error instanceof Error ? error.message : /* v8 ignore next -- defensive non-Error failures @preserve */ String(error)}`;
+            }
+        },
+        summaryKeys: ["friend_id", "mission_key"],
+        riskProfile: { mutates: "external_side_effect", risk: "high", reason: "delegates a task to a remote agent peer" },
+    },
+    {
+        tool: {
+            type: "function",
+            function: {
+                name: "list_delegations",
+                description: "List delegations other agents have sent you (quarantined imported delegations). Each entry names the requesting agent, the mission, the correlation requestId, and the task summary. Use this to see what work peers have asked you to do, then send_result when done.",
+                parameters: { type: "object", properties: {} },
+            },
+        },
+        handler: async (_args, ctx) => {
+            (0, runtime_1.emitNervesEvent)({
+                component: "repertoire",
+                event: "repertoire.tool_list_delegations",
+                message: "list_delegations invoked",
+                meta: { tool: "list_delegations" },
+            });
+            const guard = requireTrustedRequester(ctx);
+            if (guard)
+                return guard;
+            /* v8 ignore next -- in-turn tool calls always carry an agentRoot; the getAgentRoot() ambient fallback depends on process argv (same pattern as storeFor) @preserve */
+            const { missionStore } = (0, delegation_stores_1.delegationStoresFor)(ctx?.agentRoot ?? (0, identity_1.getAgentRoot)());
+            /* v8 ignore next -- FileMissionStore always implements listAll; the [] fallback guards a future store-shape regression @preserve */
+            const missions = missionStore.listAll ? await missionStore.listAll() : [];
+            const rows = [];
+            for (const mission of missions) {
+                for (const [fromAgentId, byRequest] of Object.entries(mission.importedDelegations ?? {})) {
+                    for (const [requestId, delegation] of Object.entries(byRequest)) {
+                        rows.push({
+                            requestId,
+                            fromAgentId,
+                            missionKey: mission.missionKey,
+                            missionTitle: mission.title,
+                            summary: delegation.task.summary,
+                            ...(delegation.task.details ? { details: delegation.task.details } : {}),
+                        });
+                    }
+                }
+            }
+            return JSON.stringify(rows, null, 2);
+        },
+        summaryKeys: [],
+    },
+    {
+        tool: {
+            type: "function",
+            function: {
+                name: "send_result",
+                description: "Return a result for a delegation another agent sent you (by its requestId, from list_delegations). Seals the result and delivers it back to the delegating agent over the direct rung; they import it (assignee/correlation-gated). Deliver-back is explicit — do the work in your turn, then call this.",
+                parameters: {
+                    type: "object",
+                    properties: {
+                        request_id: { type: "string", description: "The delegation correlation requestId (from list_delegations)." },
+                        summary: { type: "string", description: "A summary of the result/deliverable." },
+                        artifact: { type: "string", description: "Optional artifact reference (e.g. a PR or document URL)." },
+                    },
+                    required: ["request_id", "summary"],
+                },
+            },
+        },
+        handler: async (args, ctx) => {
+            (0, runtime_1.emitNervesEvent)({
+                component: "repertoire",
+                event: "repertoire.tool_send_result",
+                message: "send_result invoked",
+                meta: { tool: "send_result", requestId: args.request_id },
+            });
+            const guard = requireTrustedRequester(ctx);
+            if (guard)
+                return guard;
+            const store = storeFor(ctx);
+            /* v8 ignore next -- in-turn tool calls always carry an agentRoot; the getAgentRoot() ambient fallback depends on process argv (same pattern as storeFor) @preserve */
+            const { missionStore, grantStore } = (0, delegation_stores_1.delegationStoresFor)(ctx?.agentRoot ?? (0, identity_1.getAgentRoot)());
+            // Find the imported delegation this result answers (who delegated + which mission).
+            /* v8 ignore next -- FileMissionStore always implements listAll; the [] fallback guards a future store-shape regression @preserve */
+            const missions = missionStore.listAll ? await missionStore.listAll() : [];
+            const found = findImportedDelegation(missions, args.request_id);
+            if (!found)
+                return `no imported delegation found for requestId ${args.request_id} (check list_delegations).`;
+            // The delegator (the recipient of the result) must be a trusted, reachable,
+            // DID-keyed peer in our store.
+            const delegator = await (0, friends_1.findFriendByDid)(store, found.fromAgentId);
+            if (!delegator || !isA2APeer(delegator))
+                return `delegating peer not found for ${found.fromAgentId}.`;
+            if (!(0, friends_1.isTrustedLevel)(delegator.trustLevel))
+                return "delegating peer must be friend or family trust to return a result.";
+            const delegatorDid = peerDid(delegator);
+            /* v8 ignore next -- unreachable: findFriendByDid matched this record BY its DID (via resolveAgentIdentity, which omits empty DIDs), so a2a.did is always present here. Defensive. @preserve */
+            if (!delegatorDid)
+                return "delegating peer is not DID-keyed (cannot seal the result).";
+            const parsedDelegator = (0, a2a_client_1.parseDidKey)(delegatorDid);
+            if (!parsedDelegator)
+                return `cannot seal: delegating peer DID is unparseable (${delegatorDid}).`;
+            const endpointUrl = delegator.agentMeta?.a2a?.endpointUrl;
+            if (!endpointUrl)
+                return "delegating peer has no reachable A2A endpoint to return the result to.";
+            /* v8 ignore next -- in-turn send_result always carries a bundle agentRoot; the ambient-name fallback is defensive (same pattern as connect_to) @preserve */
+            const agentName = agentNameFromRoot(ctx?.agentRoot) ?? "ouro-agent";
+            try {
+                const sodium = await (0, a2a_client_1.ready)();
+                const self = await (0, identity_2.loadSelfA2AIdentity)({ agentName, sodium });
+                // prepareMissionResult records the result first-party (results[requestId]) +
+                // returns the MissionResultEnvelope (consent-gated: trust ≥ friend recipient).
+                const prepared = await (0, friends_1.prepareMissionResult)(missionStore, store, grantStore, {
+                    missionId: found.missionId,
+                    toAgentId: delegatorDid,
+                    requestId: args.request_id,
+                    selfAgentId: self.did,
+                    result: { summary: args.summary, ...(args.artifact ? { artifact: args.artifact } : {}) },
+                });
+                /* v8 ignore next 3 -- unreachable for a trusted DID-keyed delegator: the mission exists (it carried the imported delegation we matched) and the isTrustedLevel guard guarantees trust≥friend, which the tiered consent default approves. Defensive only. @preserve */
+                if (!prepared.ok) {
+                    return `send_result refused (${prepared.status}).`;
+                }
+                // HARNESS-OWNED RESULT WIRE: seal the envelope (reusing the seal crypto), wrap
+                // it in the mission_result-tagged DataPart, and POST it to the delegator over
+                // direct. The inbound side routes it to importMissionResult (NOT receiveShare).
+                const sealed = (0, a2a_client_1.sealEnvelope)({
+                    sodium,
+                    envelope: prepared.envelope,
+                    friendsKind: "coordination",
+                    fromIdentity: { did: self.did, keyId: self.keyId, ed25519Priv: self.ed25519Priv },
+                    recipientDid: delegatorDid,
+                    recipientX25519Pub: (0, a2a_client_1.keyAgreementFromDidKey)({ sodium, ed25519Pub: parsedDelegator.ed25519Pub }),
+                });
+                const message = (0, mission_result_wire_1.wrapMissionResultDataPart)({ sealedEnvelope: sealed, recipientDid: delegatorDid });
+                (0, runtime_1.emitNervesEvent)({
+                    component: "channels",
+                    event: "channel.a2a_result_send",
+                    message: "delivering sealed mission result over the direct rung",
+                    meta: { selfDid: self.did, toDid: delegatorDid, requestId: args.request_id },
+                });
+                await (0, client_1.postA2AMessageEnvelope)({ endpointUrl, message });
+                return `result sent to ${delegator.name} (${delegatorDid}) for requestId ${args.request_id}.`;
+            }
+            catch (error) {
+                return `send_result error: ${error instanceof Error ? error.message : /* v8 ignore next -- defensive non-Error failures @preserve */ String(error)}`;
+            }
+        },
+        summaryKeys: ["request_id"],
+        riskProfile: { mutates: "external_side_effect", risk: "high", reason: "returns a result to a remote agent peer" },
+    },
 ];