@ouro.bot/cli 0.1.0-alpha.672 → 0.1.0-alpha.674

package/changelog.json

@@ -1,6 +1,19 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.674",
+      "changes": [
+        "Add an inner-dialog auto-start guard so enabled agents can stay online without autonomous model-spending boot turns, including client-side self-message fallback paths and daemon health/status surfaces that respect intentionally parked agents."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.673",
+      "changes": [
+        "A2A connect + delegation layer (friends @ouro.bot/friends alpha.7), on the merged inbound-auth foundation. DID-keyed onboarding: a DID-bearing agent card keys the friend record on its verified did:key (externalId == DID, a2a.did == DID) after verifyCardDidBinding + parseDidKey, so an inbound sealed envelope resolves to that same record (the owner's own agent no longer collapses to stranger); a did-less legacy card stays URL-keyed (backward compatible). New owner-only connect_to tool, gated to the local management sense via authorizeConnect (network/group/internal senses are refused before any card fetch; closed-sense membership fails closed without the roster verifier) and linking at family via connectAgents. Outbound becomes signed+sealed over the direct rung: a new A2ATransport (relay/mailbox are a typed-but-stubbed seam naming ourostack/friends-relay), a2a_send_message seals via sendShare for DID-keyed peers (legacy text send preserved), and a full delegation round-trip — connect_to → coordinate(request, task) (prepareCoordination mints the requestId + first-party delegation, sealed to the peer; the recipient's receiveShare quarantines it under importedDelegations) → list_delegations → send_result (prepareMissionResult over the harness-owned mission_result DataPart wire, which routes to importMissionResult, NOT receiveShare, since mission-result is not a FriendsKind) → importMissionResult lands importedResults[B][requestId], assignee/correlation-gated (assignee_mismatch / no_delegation / no_mission / untrusted_source, fail-closed on a legacy assignee-less delegation). Imported delegations and results land quarantined + attributed, never seed trust, never overwrite first-party; deliver-back is explicit (autonomy is a non-goal).",
+        "Security fix (mission_result forgery): the harness-owned mission_result wire now authenticates the sender exactly like the inbound share path. Previously receiveInboundMissionResult trusted the envelope's self-asserted fromAgentId (openSealedEnvelope does AEAD decryption only — no signature verification) and called importMissionResult with no verifier (falling back to the no-op TOFU verifier), so a result signed with an attacker's own key but claiming a victim assignee's DID was accepted and stored under importedResults[victim][requestId] as if the victim delivered it (the recipient's X25519 pubkey is public, so AEAD is no barrier, and the assignee/correlation gates only checked the claimed plaintext DID). The wire now mirrors receiveShare: replay-dedups on the seal nonce (durable SeenLedger), rejects unless opened.signerDid === opened.fromAgentId (sender_binding_mismatch), resolves+pins the sender DID, and hands importMissionResult a real DidVerifier bound to the pinned key so the Ed25519 signature is verified against the pinned key (a non-matching signature is untrusted_source). All authorization gates remain enforced by the importer."
+      ]
+    },
     {
       "version": "0.1.0-alpha.672",
       "changes": [

package/dist/a2a/client.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.endpointForCard = endpointForCard;
 exports.fetchA2AAgentCard = fetchA2AAgentCard;
 exports.sendA2AMessage = sendA2AMessage;
+exports.postA2AMessageEnvelope = postA2AMessageEnvelope;
 exports.getA2ATask = getA2ATask;
 const node_crypto_1 = require("node:crypto");
 const runtime_1 = require("../nerves/runtime");
@@ -113,6 +114,42 @@ async function sendA2AMessage(input) {
     });
     return task;
 }
+/**
+ * POST a pre-built friends A2A message (a `wrapInDataPart` sealed-envelope message)
+ * to a peer endpoint as a JSON-RPC `message/send`. This is the `direct`-rung wire
+ * the harness `A2ATransport` uses: friends' `sendShare` builds the sealed message and
+ * hands it to the transport, which delivers it here. Unlike `sendA2AMessage` (which
+ * builds a text part), this carries the caller's exact `message` (the sealed DataPart)
+ * untouched. Throws on a non-2xx response (transport failure).
+ */
+async function postA2AMessageEnvelope(input) {
+    const fetchImpl = input.fetchImpl ?? fetch;
+    const request = {
+        jsonrpc: "2.0",
+        id: (0, node_crypto_1.randomUUID)(),
+        method: "message/send",
+        params: { message: input.message },
+    };
+    (0, runtime_1.emitNervesEvent)({
+        component: "channels",
+        event: "channel.a2a_envelope_post_start",
+        message: "posting sealed A2A message envelope (direct rung)",
+        meta: { endpointUrl: input.endpointUrl },
+    });
+    let rpc = await postJsonRpc(input.endpointUrl, request, fetchImpl, "0.3");
+    if (methodNotFound(rpc)) {
+        rpc = await postJsonRpc(input.endpointUrl, { ...request, method: "SendMessage" }, fetchImpl);
+    }
+    if ("error" in rpc) {
+        throw new Error(`A2A error ${rpc.error.code}: ${rpc.error.message}`);
+    }
+    (0, runtime_1.emitNervesEvent)({
+        component: "channels",
+        event: "channel.a2a_envelope_post_end",
+        message: "posted sealed A2A message envelope",
+        meta: { endpointUrl: input.endpointUrl },
+    });
+}
 async function getA2ATask(input) {
     const fetchImpl = input.fetchImpl ?? fetch;
     const metadata = senderMetadata(input);

package/dist/a2a/delegation-stores.js

@@ -0,0 +1,56 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.delegationStoresFor = delegationStoresFor;
+const path = __importStar(require("node:path"));
+const friends_1 = require("@ouro.bot/friends");
+const runtime_1 = require("../nerves/runtime");
+function delegationStoresFor(agentRoot) {
+    const friendsDir = path.join(agentRoot, "friends");
+    const missionsDir = (0, friends_1.missionsDirFor)(friendsDir);
+    const grantsDir = (0, friends_1.grantsDirFor)(friendsDir);
+    (0, runtime_1.emitNervesEvent)({
+        component: "channels",
+        event: "channel.a2a_delegation_stores_init",
+        message: "initialized A2A delegation stores (mission + grant)",
+        meta: { missionsDir, grantsDir },
+    });
+    return {
+        missionStore: new friends_1.FileMissionStore(missionsDir),
+        grantStore: new friends_1.FileGrantStore(grantsDir),
+        missionsDir,
+        grantsDir,
+    };
+}

package/dist/a2a/identity.js

@@ -35,9 +35,13 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.readStoredA2ASeed = readStoredA2ASeed;
 exports.loadOrMintA2AIdentity = loadOrMintA2AIdentity;
+exports.loadSelfA2AIdentity = loadSelfA2AIdentity;
 const crypto = __importStar(require("node:crypto"));
+const os = __importStar(require("node:os"));
 const a2a_client_1 = require("@ouro.bot/friends/a2a-client");
 const runtime_1 = require("../nerves/runtime");
+const runtime_credentials_1 = require("../heart/runtime-credentials");
+const machine_identity_1 = require("../heart/machine-identity");
 /** The number of raw bytes in an Ed25519 seed. */
 const ED25519_SEED_BYTES = 32;
 /** The machine-config key path for the persisted seed: `a2a.identity.ed25519Seed`. */
@@ -135,3 +139,25 @@ async function loadOrMintA2AIdentity(input) {
     });
     return identity;
 }
+/**
+ * Load (or mint-on-first-use) THIS agent's own A2A identity from the machine-local
+ * runtime config — the convenience entry the main-process tools use to obtain the
+ * self identity that signs outbound sealed envelopes. Mirrors the a2a sense
+ * entrypoint's load (read machine config → `loadOrMintA2AIdentity` → persist a fresh
+ * seed under the right machine id). Reads the in-memory machine-config cache (no
+ * remote vault round-trip per call). `sodium` is optional (defaults to `ready()`).
+ */
+async function loadSelfA2AIdentity(input) {
+    const sodium = input.sodium ?? await (0, a2a_client_1.ready)();
+    const machineId = (0, machine_identity_1.loadOrCreateMachineIdentity)({ homeDir: os.homedir() }).machineId;
+    const read = (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(input.agentName);
+    const config = read.ok ? read.config : {};
+    return loadOrMintA2AIdentity({
+        agentName: input.agentName,
+        sodium,
+        config,
+        upsert: async (next) => {
+            await (0, runtime_credentials_1.upsertMachineRuntimeCredentialConfig)(input.agentName, machineId, next);
+        },
+    });
+}

package/dist/a2a/mission-result-wire.js

@@ -0,0 +1,196 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.wrapMissionResultDataPart = wrapMissionResultDataPart;
+exports.isMissionResultDataPart = isMissionResultDataPart;
+exports.receiveInboundMissionResult = receiveInboundMissionResult;
+const a2a_client_1 = require("@ouro.bot/friends/a2a-client");
+const friends_1 = require("@ouro.bot/friends");
+const runtime_1 = require("../nerves/runtime");
+/**
+ * THE HARNESS-OWNED RESULT WIRE.
+ *
+ * A mission RESULT is NOT a `FriendsKind` (`FriendsKind` = profile_share |
+ * mission_share | coordination) — `prepareMissionResult`/`importMissionResult` are
+ * transport-agnostic + store-only, and the result does NOT ride `sendShare`/
+ * `receiveShare`. So the HARNESS owns the wire: the result envelope is sealed (reusing
+ * the sign-then-seal crypto) and wrapped in a DataPart carrying a distinct `ouroKind:
+ * "mission_result"` discriminator. The inbound bridge recognizes that tag and routes
+ * it to `importMissionResult` — NEVER to `receiveShare`, which would mis-route a
+ * non-`FriendsKind` envelope. This is "a DataPart variant + an inbound route branch"
+ * (the carrier is the friends `unwrapDataPart` shape + one extra tag field — no
+ * structural change beyond that).
+ *
+ * SECURITY — the wire AUTHENTICATES the sender exactly like the share path
+ * (`receiveShare` in friends' `adapter.ts`). `openSealedEnvelope` does AEAD
+ * decryption ONLY — it does NOT verify the signature (its docstring names the
+ * adapter's `DidVerifier` as "the single authentication gate"). The decrypted
+ * `envelope.fromAgentId` is therefore attacker-controlled plaintext: the recipient's
+ * X25519 pubkey is public (derived from the published DID), so any party can SEAL a
+ * forged result to us. Authentication is the ONLY barrier. Before trusting the
+ * claimed sender we therefore replicate `receiveShare`'s gate:
+ *   1. binding check — `opened.signerDid === opened.fromAgentId` (and non-empty),
+ *   2. resolve + pin the sender DID (TOFU pin + signed-rotation evaluation),
+ *   3. hand `importMissionResult` a REAL `DidVerifier` bound to the pinned key, so
+ *      `verifier.verify(fromAgentId, proof)` runs the Ed25519 signature check against
+ *      the pinned key — NOT the no-op `tofuVerifier` the importer defaults to.
+ * Replay is deduped on the seal nonce (durable `SeenLedger`), matching the share path.
+ */
+const OURO_RESULT_KIND = "mission_result";
+/** Wrap a sealed result envelope into the harness-owned `mission_result` DataPart. */
+function wrapMissionResultDataPart(input) {
+    return {
+        messageId: `result-${Math.random().toString(36).slice(2)}`,
+        role: "agent",
+        parts: [{
+                kind: "data",
+                data: {
+                    v: input.sealedEnvelope.v,
+                    sealed: input.sealedEnvelope.sealed,
+                    recipientDid: input.recipientDid,
+                    ouroKind: OURO_RESULT_KIND,
+                },
+            }],
+    };
+}
+/** Whether an inbound message carries the harness-owned `mission_result` DataPart. */
+function isMissionResultDataPart(message) {
+    if (!Array.isArray(message.parts))
+        return false;
+    return message.parts.some((p) => p && p.kind === "data" && typeof p.data === "object" && p.data !== null
+        && p.data.ouroKind === OURO_RESULT_KIND);
+}
+/** Extract the sealed envelope from a `mission_result` DataPart, or null. */
+function unwrapMissionResultDataPart(message) {
+    if (!Array.isArray(message.parts) || message.parts.length !== 1)
+        return null;
+    const part = message.parts[0];
+    if (!part || part.kind !== "data" || !part.data)
+        return null;
+    const data = part.data;
+    if (data.ouroKind !== OURO_RESULT_KIND)
+        return null;
+    if (typeof data.v !== "number" || typeof data.recipientDid !== "string" || !data.sealed)
+        return null;
+    return { sealed: { v: data.v, sealed: data.sealed }, recipientDid: data.recipientDid };
+}
+/**
+ * Route an inbound `mission_result` DataPart to `importMissionResult`, AUTHENTICATING
+ * the sender exactly like `receiveShare` does for every other inbound kind.
+ *
+ * Ordering (mirrors the share bridge's trust trap + authentication gate):
+ *   1. recognize + unwrap the harness `mission_result` carrier (else `not-a-result`).
+ *   2. replay dedup on the seal nonce (durable `SeenLedger`) — before any state change.
+ *   3. `openSealedEnvelope` → AEAD-decrypt only (unseal/recipient failures → reject).
+ *   4. binding check — reject unless `opened.signerDid === opened.fromAgentId` (and
+ *      non-empty): the advisory `signerDid` (outer, unsigned) must match the claimed
+ *      sender. A divergence is a forged/spoofed bundle (`sender_binding_mismatch`).
+ *   5. `resolveAndPin` the sender DID (TOFU pin / signed-rotation) → the pinned key
+ *      (unresolvable/failed-binding/failed-rotation → `resolve_failed`).
+ *   6. build a `DidVerifier` bound to THIS envelope + the pinned key, mark the nonce
+ *      seen, then call `importMissionResult({ envelope, fromAgentId: <signed DID>,
+ *      trustOfSource }, { verifier })`. The verifier runs the REAL signature check
+ *      against the pinned key — a result signed with a key that is not the pinned key
+ *      for the claimed DID is rejected (`untrusted_source`). Every authorization gate
+ *      (no_mission / no_delegation / assignee_mismatch, fail-closed on a legacy
+ *      assignee-less delegation) is still enforced by the importer.
+ */
+async function receiveInboundMissionResult(message, deps) {
+    const payload = unwrapMissionResultDataPart(message);
+    if (!payload)
+        return { outcome: "not-a-result" };
+    // Replay dedup BEFORE any state change, keyed on the seal nonce (matches receiveShare).
+    if (deps.seen.isSeen(payload.sealed.sealed.n)) {
+        (0, runtime_1.emitNervesEvent)({
+            component: "channels",
+            event: "channel.a2a_result_rejected",
+            message: "rejected inbound mission_result (replayed seal nonce)",
+            meta: { reason: "replayed" },
+        });
+        return { outcome: "rejected", reason: "replayed" };
+    }
+    const recipientIdentity = { x25519Priv: deps.identity.x25519Priv, x25519Pub: deps.identity.x25519Pub };
+    const opened = (0, a2a_client_1.openSealedEnvelope)({
+        sodium: deps.sodium,
+        sealedEnvelope: payload.sealed,
+        recipientDid: deps.identity.did,
+        recipientIdentity,
+    });
+    if (!opened.ok) {
+        (0, runtime_1.emitNervesEvent)({
+            component: "channels",
+            event: "channel.a2a_result_rejected",
+            message: "rejected inbound mission_result (unseal/recipient)",
+            meta: { reason: opened.error },
+        });
+        return { outcome: "rejected", reason: opened.error };
+    }
+    // SECURITY (binding): the trustworthy sender identity is the SIGNED `fromAgentId`.
+    // `openSealedEnvelope` does NOT verify the signature, so `fromAgentId` is untrusted
+    // until the DidVerifier confirms the pinned key signed THIS envelope. The advisory
+    // `signerDid` (from the outer, unsigned sealed plaintext) must match the claimed
+    // sender; a divergence is a forged/spoofed bundle (e.g. an attacker signing with its
+    // OWN key while claiming a victim's DID). Reject before resolving or importing.
+    const senderDid = opened.fromAgentId;
+    if (senderDid.length === 0 || opened.signerDid !== senderDid) {
+        (0, runtime_1.emitNervesEvent)({
+            component: "channels",
+            event: "channel.a2a_result_rejected",
+            message: "rejected inbound mission_result (sender binding mismatch — forged sender)",
+            meta: { reason: "sender_binding_mismatch", claimedDid: senderDid, signerDid: opened.signerDid },
+        });
+        return { outcome: "rejected", reason: "sender_binding_mismatch" };
+    }
+    // Read trust from the friend store BY the verified DID — never defaulted, never from
+    // the envelope. Unknown (or empty) DID ⇒ stranger.
+    const record = await (0, friends_1.findFriendByDid)(deps.store, senderDid);
+    const trust = record?.trustLevel ?? "stranger";
+    // Resolve + pin the SENDER's DID (async — BEFORE the sync verifier/importer).
+    const resolved = await deps.didResolution.resolveAndPin({
+        fromAgentId: senderDid,
+        did: senderDid,
+        pinStore: deps.pinStore,
+        trustOfSource: trust,
+    });
+    if (!resolved) {
+        (0, runtime_1.emitNervesEvent)({
+            component: "channels",
+            event: "channel.a2a_result_rejected",
+            message: "rejected inbound mission_result (sender DID resolve/pin failed)",
+            meta: { reason: "resolve_failed", verifiedDid: senderDid, trust },
+        });
+        return { outcome: "rejected", reason: "resolve_failed" };
+    }
+    // Build the sync verifier bound to THIS envelope + the pinned sender key. This is the
+    // single authentication gate (the importer would otherwise default to the no-op TOFU
+    // verifier). `verify` confirms the agentId===did binding AND the Ed25519 signature
+    // over the envelope against the pinned key.
+    const verifier = new a2a_client_1.DidVerifier({
+        sodium: deps.sodium,
+        pinnedEd25519Pub: resolved.ed25519Pub,
+        pinnedDid: senderDid,
+        envelope: opened.envelope,
+    });
+    // Mark seen now (idempotent imports + the replay guard above keep this safe).
+    deps.seen.markSeen(payload.sealed.sealed.n);
+    const result = await (0, friends_1.importMissionResult)(deps.missionStore, {
+        envelope: opened.envelope,
+        fromAgentId: senderDid,
+        trustOfSource: trust,
+    }, { verifier });
+    if (result.ok) {
+        (0, runtime_1.emitNervesEvent)({
+            component: "channels",
+            event: "channel.a2a_result_imported",
+            message: "imported inbound mission_result (authenticated, quarantined, attributed)",
+            meta: { verifiedDid: senderDid, trust, status: result.status },
+        });
+        return { outcome: "imported", verifiedDid: senderDid };
+    }
+    (0, runtime_1.emitNervesEvent)({
+        component: "channels",
+        event: "channel.a2a_result_rejected",
+        message: "rejected inbound mission_result (import gate)",
+        meta: { reason: result.status, verifiedDid: senderDid, trust },
+    });
+    return { outcome: "rejected", reason: result.status };
+}

package/dist/a2a/onboarding.js

@@ -38,6 +38,7 @@ const path = __importStar(require("node:path"));
 const identity_1 = require("../heart/identity");
 const runtime_1 = require("../nerves/runtime");
 const friends_1 = require("@ouro.bot/friends");
+const a2a_client_1 = require("@ouro.bot/friends/a2a-client");
 const client_1 = require("./client");
 function storeFor(options) {
     if (options.store)
@@ -45,23 +46,53 @@ function storeFor(options) {
     /* v8 ignore next -- default bundle root fallback is owned by identity path tests; CLI and onboarding tests inject explicit roots @preserve */
     return new friends_1.FileFriendStore(path.join(options.bundlesRoot ?? (0, identity_1.getAgentBundlesRoot)(), `${options.agentName}.ouro`, "friends"));
 }
-function agentIdFor(_card, cardUrl) {
+/** The normalized card URL (legacy URL-keyed identity for did-less cards). */
+function urlAgentId(cardUrl) {
     const parsed = new URL(cardUrl);
     parsed.hash = "";
     return parsed.toString();
 }
+/** The trimmed `did:key` a card serves, or undefined when the card is did-less. */
+function cardDid(card) {
+    const did = card.did;
+    return typeof did === "string" && did.trim() ? did.trim() : undefined;
+}
 async function onboardA2APeer(options) {
     // HTTP/URL glue stays harness-side: fetch the agent card, resolve its JSON-RPC
     // endpoint, and derive the stable agentId. The record-shaping (mint/update the
     // agent-peer friend) is delegated to @ouro.bot/friends' upsertAgentPeer.
     const card = await (0, client_1.fetchA2AAgentCard)(options.cardUrl, options.fetchImpl);
     const store = storeFor(options);
-    const externalId = agentIdFor(card, options.cardUrl);
     /* v8 ignore next -- fetchA2AAgentCard validates a usable endpoint or legacy url before returning a card @preserve */
     const endpointUrl = (0, client_1.endpointForCard)(card) ?? options.cardUrl;
     const protocolVersion = card.supportedInterfaces?.find((entry) => entry.url === endpointUrl)?.protocolVersion
         ?? card.protocolVersion;
     const name = options.name ?? card.name;
+    // THE FOOTGUN FIX: a DID-bearing card keys the record on its VERIFIED did:key
+    // (so an inbound sealed envelope — keyed on the signed DID — resolves to THIS
+    // record, not a stranger). A did-less (legacy) card keeps the URL-keyed identity
+    // unchanged (backward compatible). For did:key the binding is self-contained
+    // (`card.did === did`, `didDoc: null`); we ALSO require the served did:key to be a
+    // well-formed, parseable Ed25519 key (a malformed did:key could never key/verify
+    // an inbound envelope, so onboarding it would silently break the resolve later). A
+    // card whose DID is unparseable or fails the binding is REFUSED (no record
+    // written) — never TOFU-trust a mis-bound or malformed card.
+    const did = cardDid(card);
+    if (did) {
+        const parsed = (0, a2a_client_1.parseDidKey)(did);
+        const bound = parsed !== null && (0, a2a_client_1.verifyCardDidBinding)({ card: { did, url: options.cardUrl }, did, didDoc: null });
+        if (!bound) {
+            (0, runtime_1.emitNervesEvent)({
+                component: "friends",
+                event: "friends.a2a_card_binding_rejected",
+                message: "refused A2A onboarding: card↔DID binding failed",
+                meta: { agentName: options.agentName, cardUrl: options.cardUrl, did, parseable: parsed !== null },
+            });
+            throw new Error(`A2A card↔DID binding failed for ${did}`);
+        }
+    }
+    // DID-keyed when present (externalId === did, a2a.did === did), else URL-keyed.
+    const externalId = did ?? urlAgentId(options.cardUrl);
     const record = await (0, friends_1.upsertAgentPeer)(store, {
         name,
         agentId: externalId,
@@ -71,13 +102,14 @@ async function onboardA2APeer(options) {
             endpointUrl,
             agentId: externalId,
             protocolVersion,
+            ...(did ? { did } : {}),
         },
     });
     (0, runtime_1.emitNervesEvent)({
         component: "friends",
         event: "friends.a2a_peer_onboarded",
         message: "onboarded A2A peer into friend model",
-        meta: { agentName: options.agentName, friendId: record.id, peerName: record.name, trustLevel: record.trustLevel },
+        meta: { agentName: options.agentName, friendId: record.id, peerName: record.name, trustLevel: record.trustLevel, ...(did ? { did } : {}) },
     });
     return record;
 }

package/dist/a2a/server.js

@@ -47,6 +47,8 @@ const pin_store_1 = require("./pin-store");
 const seen_ledger_1 = require("./seen-ledger");
 const did_resolution_1 = require("./did-resolution");
 const inbound_share_1 = require("./inbound-share");
+const mission_result_wire_1 = require("./mission-result-wire");
+const delegation_stores_1 = require("./delegation-stores");
 const task_store_1 = require("./task-store");
 const MAX_A2A_REQUEST_BYTES = 128 * 1024;
 const MAX_A2A_MESSAGE_TEXT_CHARS = 16_000;
@@ -349,7 +351,9 @@ async function startA2AServer(options) {
         inboundShareDeps = {
             sodium: await (0, a2a_client_1.ready)(),
             store: new friends_1.FileFriendStore(friendsDir),
-            missionStore: new friends_1.FileMissionStore((0, friends_1.missionsDirFor)(friendsDir)),
+            // The SAME canonical mission store the Slice-4 delegation tools use, so an
+            // inbound `importCoordination` write lands where the read/prepare surface reads.
+            missionStore: (0, delegation_stores_1.delegationStoresFor)(agentRoot).missionStore,
             pinStore: new pin_store_1.FileA2APinStore(agentRoot),
             seen: new seen_ledger_1.FileA2ASeenLedger(agentRoot),
             didResolution: (0, did_resolution_1.makeDidResolution)({ sodium: await (0, a2a_client_1.ready)() }),
@@ -393,6 +397,40 @@ async function startA2AServer(options) {
                 const responseStyle = rpc.method === "message/send" ? "legacy" : "latest";
                 const parsedInbound = messageFromParams(rpc.params);
                 const inbound = parsedInbound ? { ...parsedInbound, kind: parsedInbound.kind ?? "message" } : null;
+                // HARNESS-OWNED RESULT WIRE (runs BEFORE the friends-share branch). A
+                // `mission_result`-tagged DataPart is NOT a FriendsKind — it routes to
+                // `importMissionResult` (assignee/correlation-gated, store-only, NO turn), never
+                // to `receiveShare`. Recognized by the `ouroKind` discriminator.
+                if (inbound && inboundShareDeps && (0, mission_result_wire_1.isMissionResultDataPart)(inbound)) {
+                    const imported = await (0, mission_result_wire_1.receiveInboundMissionResult)(inbound, {
+                        sodium: inboundShareDeps.sodium,
+                        store: inboundShareDeps.store,
+                        missionStore: inboundShareDeps.missionStore,
+                        // The SAME authentication seam the share bridge uses — so a forged-sender
+                        // result is rejected by the DidVerifier exactly like a forged share.
+                        pinStore: inboundShareDeps.pinStore,
+                        seen: inboundShareDeps.seen,
+                        didResolution: inboundShareDeps.didResolution,
+                        identity: inboundShareDeps.identity,
+                    });
+                    if (imported.outcome === "rejected") {
+                        writeJson(res, 200, errorResponse(rpc.id, rejectionErrorCode(imported.reason), `A2A result rejected: ${imported.reason}`));
+                        return;
+                    }
+                    // imported (store-only, no turn): acknowledge with a minimal completed task.
+                    /* v8 ignore next -- "not-a-result" is unreachable here (gated by isMissionResultDataPart) @preserve */
+                    const ackText = imported.outcome === "imported"
+                        ? `[a2a] imported mission result from ${imported.verifiedDid}`
+                        /* v8 ignore next -- defensive: the gate above guarantees imported|rejected @preserve */
+                        : "[a2a] mission result";
+                    const contextId = inbound.contextId ?? "default";
+                    const taskId = (0, node_crypto_1.randomUUID)();
+                    const accessToken = (0, node_crypto_1.randomUUID)();
+                    const ackTask = taskFor({ taskId, accessToken, contextId, inbound, state: "TASK_STATE_COMPLETED", response: ackText });
+                    taskStore.put(ackTask, accessTokenScope(accessToken));
+                    writeJson(res, 200, jsonResponse(rpc.id, publicTask(ackTask, accessToken, responseStyle, true)));
+                    return;
+                }
                 // Inbound friends-DataPart branch (runs BEFORE the legacy text path). A
                 // sealed DataPart is unwrapped + verified through the bridge; the turn is
                 // then keyed on the VERIFIED sender DID (replacing the unauthenticated

package/dist/a2a/transport.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.makeA2ATransport = makeA2ATransport;
+const runtime_1 = require("../nerves/runtime");
+const client_1 = require("./client");
+/** The not-wired marker for the relay/mailbox rungs (the stubbed seam). */
+const RELAY_NOT_WIRED = "A2A relay/mailbox transport is not wired — see ourostack/friends-relay";
+/**
+ * Build the harness `A2ATransport` (the outbound delivery seam friends' `sendShare`
+ * calls). Only the `direct` rung is wired in this slice: it HTTP-POSTs the sealed,
+ * `wrapInDataPart`-wrapped message to the peer's `endpointUrl` (the `address`) as a
+ * JSON-RPC `message/send`, reusing the harness `client.ts` plumbing. The `relay` and
+ * `mailbox` rungs are a TYPED-but-STUBBED seam: they throw a clear not-wired error
+ * naming the `ourostack/friends-relay` dependency, so a future relay slice has an
+ * exact insertion point without this slice shipping an untrusted relay.
+ */
+function makeA2ATransport(input = {}) {
+    return {
+        async send(target, message) {
+            if (target.rung === "direct") {
+                (0, runtime_1.emitNervesEvent)({
+                    component: "channels",
+                    event: "channel.a2a_transport_direct_send",
+                    message: "delivering sealed A2A message over the direct rung",
+                    meta: { address: target.address },
+                });
+                await (0, client_1.postA2AMessageEnvelope)({
+                    endpointUrl: target.address,
+                    message,
+                    ...(input.fetchImpl ? { fetchImpl: input.fetchImpl } : {}),
+                });
+                return;
+            }
+            // relay / mailbox: the typed-but-stubbed seam. Loud refusal (security-relevant:
+            // we never silently fall through to an untrusted relay).
+            (0, runtime_1.emitNervesEvent)({
+                component: "channels",
+                event: "channel.a2a_transport_not_wired",
+                message: "refused A2A transport over a non-direct rung (not wired)",
+                meta: { rung: target.rung, address: target.address, dependency: "ourostack/friends-relay" },
+            });
+            throw new Error(`${RELAY_NOT_WIRED} (rung: ${target.rung})`);
+        },
+    };
+}

package/dist/heart/daemon/agent-discovery.js

@@ -36,6 +36,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.isLibraryKind = isLibraryKind;
 exports.listAllBundleAgents = listAllBundleAgents;
 exports.listEnabledBundleAgents = listEnabledBundleAgents;
+exports.isInnerDialogAutoStartEnabled = isInnerDialogAutoStartEnabled;
 exports.listBundleSyncRows = listBundleSyncRows;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
@@ -116,6 +117,44 @@ function listEnabledBundleAgents(options = {}) {
         .filter((row) => row.enabled && !isLibraryKind(row.kind))
         .map((row) => row.name);
 }
+/**
+ * Per-agent runtime policy for the always-on inner-dialog worker. Agents
+ * default to the historic behavior (auto-start on daemon boot), but a bundle
+ * can opt out with:
+ *
+ *   "innerDialog": { "autoStart": false }
+ *
+ * This keeps the agent enabled for sync/status/senses while preventing an
+ * autonomous boot turn from spending model credits.
+ */
+function isInnerDialogAutoStartEnabled(agent, options = {}) {
+    const bundlesRoot = options.bundlesRoot ?? (0, identity_1.getAgentBundlesRoot)();
+    const readFileSync = options.readFileSync ?? fs.readFileSync;
+    const configPath = path.join(bundlesRoot, `${agent}.ouro`, "agent.json");
+    try {
+        const raw = readFileSync(configPath, "utf-8");
+        const parsed = JSON.parse(raw);
+        const innerDialog = parsed.innerDialog;
+        if (innerDialog && typeof innerDialog === "object" && !Array.isArray(innerDialog)) {
+            return innerDialog.autoStart !== false;
+        }
+        return true;
+    }
+    catch (error) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            component: "daemon",
+            event: "daemon.inner_dialog_policy_read_failed",
+            message: "failed to read inner-dialog auto-start policy; refusing autonomous worker start",
+            meta: {
+                agent,
+                configPath,
+                error: error instanceof Error ? error.message : String(error),
+            },
+        });
+        return false;
+    }
+}
 /**
  * Read the per-agent sync block from each enabled bundle's agent.json.
  * Used by the daemon (and stopped-state status renderer) to build per-agent

package/dist/heart/daemon/daemon-entry.js

@@ -123,11 +123,19 @@ const processManager = new process_manager_1.DaemonProcessManager({
         name: agent,
         entry: "heart/agent-entry.js",
         channel: "inner-dialog",
-        autoStart: true,
+        autoStart: (0, agent_discovery_1.isInnerDialogAutoStartEnabled)(agent),
     })),
     existsSync: fs.existsSync,
     /* v8 ignore next 4 -- wiring: delegates to checkAgentConfigWithProviderHealth which has full unit tests @preserve */
     configCheck: async (agent) => {
+        if (!(0, agent_discovery_1.isInnerDialogAutoStartEnabled)(agent)) {
+            return {
+                ok: true,
+                skip: true,
+                error: "inner-dialog auto-start is disabled in agent.json",
+                fix: "Set innerDialog.autoStart to true and rerun `ouro up` to resume autonomous inner-dialog turns.",
+            };
+        }
         const bundlesRoot = (0, identity_1.getAgentBundlesRoot)();
         return (0, agent_config_check_1.checkAgentConfigWithProviderHealth)(agent, bundlesRoot);
     },
@@ -266,7 +274,7 @@ const degradedComponents = [];
 function buildDaemonHealthState() {
     const snapshots = processManager.listAgentSnapshots();
     const agentDegradedComponents = snapshots
-        .filter((snapshot) => snapshot.status !== "running")
+        .filter((snapshot) => snapshot.status !== "running" && snapshot.autoStart !== false)
         .map((snapshot) => {
         const reasonParts = [
             snapshot.errorReason ?? `${snapshot.channel} is ${snapshot.status}`,
@@ -305,7 +313,9 @@ function buildDaemonHealthState() {
     const rollupStatus = (0, daemon_rollup_1.computeDaemonRollup)({
         enabledAgents: snapshots.map((snapshot) => ({
             name: snapshot.name,
-            status: snapshot.status,
+            // A parked non-autostart worker is intentionally not serving; it should
+            // remain visible in worker status but should not degrade daemon health.
+            status: snapshot.autoStart === false ? "running" : snapshot.status,
         })),
         bootstrapDegraded: degradedComponents,
         safeMode: false,

package/dist/heart/daemon/health-monitor.js

@@ -69,7 +69,8 @@ class HealthMonitor {
     async runChecks() {
         const results = [];
         const snapshots = this.processManager.listAgentSnapshots();
-        const unhealthy = snapshots.filter((snapshot) => snapshot.status !== "running");
+        const unhealthy = snapshots.filter((snapshot) => snapshot.status !== "running" && snapshot.autoStart !== false);
+        const parked = snapshots.filter((snapshot) => snapshot.status !== "running" && snapshot.autoStart === false);
         if (unhealthy.length > 0) {
             const unhealthySummary = unhealthy.map((item) => {
                 const detail = [
@@ -105,7 +106,10 @@ class HealthMonitor {
             }
         }
         else {
-            results.push({ name: "agent-processes", status: "ok", message: "all managed agents running" });
+            const message = parked.length > 0
+                ? `all auto-start managed agents running; parked agents: ${parked.map((item) => item.name).join(", ")}`
+                : "all managed agents running";
+            results.push({ name: "agent-processes", status: "ok", message });
         }
         const jobs = this.scheduler.listJobs();
         const neverRan = jobs.filter((job) => !job.lastRun);

package/dist/heart/daemon/process-manager.js

@@ -172,6 +172,7 @@ class DaemonProcessManager {
                 snapshot: {
                     name: agent.name,
                     channel: agent.channel,
+                    autoStart: agent.autoStart,
                     status: "stopped",
                     pid: null,
                     restartCount: 0,

package/dist/repertoire/tools-a2a.js

@@ -38,8 +38,14 @@ const path = __importStar(require("node:path"));
 const identity_1 = require("../heart/identity");
 const runtime_credentials_1 = require("../heart/runtime-credentials");
 const friends_1 = require("@ouro.bot/friends");
+const a2a_client_1 = require("@ouro.bot/friends/a2a-client");
 const runtime_1 = require("../nerves/runtime");
 const client_1 = require("../a2a/client");
+const onboarding_1 = require("../a2a/onboarding");
+const identity_2 = require("../a2a/identity");
+const transport_1 = require("../a2a/transport");
+const delegation_stores_1 = require("../a2a/delegation-stores");
+const mission_result_wire_1 = require("../a2a/mission-result-wire");
 const outboundTaskTokens = new Map();
 function tokenKey(ctx, friendId, taskId) {
     return `${ctx?.agentRoot ?? "ambient"}\n${friendId}\n${taskId}`;
@@ -138,7 +144,176 @@ async function resolveA2AEndpoint(friend) {
     }
     throw new Error("A2A peer has no endpointUrl or cardUrl in agentMeta.a2a");
 }
+/** The management sense the current turn arrived through, defaulting to a non-`local`
+ * value when unknown so the owner-only gate fails CLOSED on an unexpected origin. */
+function senseTypeOf(ctx) {
+    /* v8 ignore next -- in-turn tool calls always carry a resolved channel context; the open-default fail-closed fallback is defensive @preserve */
+    return ctx?.context?.channel?.senseType ?? "open";
+}
+/** The pinned DID a peer record carries (its durable A2A identity), or undefined for a
+ * legacy (non-DID-keyed) peer. */
+function peerDid(peer) {
+    const did = peer.agentMeta?.a2a?.did;
+    return typeof did === "string" && did.trim() ? did.trim() : undefined;
+}
+/** Locate an imported delegation by its correlation `requestId` across all missions:
+ * who delegated it (`fromAgentId`) + which local mission (`missionId`). The delegation
+ * lives under `importedDelegations[fromAgentId][requestId]` — what the inbound bridge
+ * quarantined. Returns undefined when no mission carries that requestId. */
+function findImportedDelegation(missions, requestId) {
+    for (const mission of missions) {
+        for (const [fromAgentId, byRequest] of Object.entries(mission.importedDelegations ?? {})) {
+            if (byRequest[requestId])
+                return { fromAgentId, missionId: mission.id };
+        }
+    }
+    return undefined;
+}
+/**
+ * Seal an arbitrary friends plaintext envelope to a DID-keyed peer and deliver it over
+ * the `direct` rung via friends' `sendShare`. `sendShare` builds the SAME SealedEnvelope
+ * regardless of rung, `wrapInDataPart`-wraps it, and calls the transport itself; the
+ * recipient X25519 is derived from the peer's pinned did:key. Throws when the peer's DID
+ * is unparseable (cannot seal) or the rung is unreachable.
+ */
+async function sealEnvelopeToPeer(input) {
+    const parsed = (0, a2a_client_1.parseDidKey)(input.did);
+    if (!parsed)
+        throw new Error(`cannot seal: peer DID is not a parseable did:key (${input.did})`);
+    const reachability = (0, a2a_client_1.resolveReachability)(input.peer.agentMeta?.a2a, input.peer.agentMeta?.mailbox);
+    if (reachability.rung === "unreachable") {
+        throw new Error("cannot seal: peer has no reachable A2A endpoint");
+    }
+    (0, runtime_1.emitNervesEvent)({
+        component: "channels",
+        event: "channel.a2a_outbound_seal",
+        message: "sealing outbound A2A envelope to a DID-keyed peer",
+        meta: { selfDid: input.self.did, peerDid: input.did, rung: reachability.rung, friendsKind: input.friendsKind },
+    });
+    const result = await (0, a2a_client_1.sendShare)({
+        sodium: input.sodium,
+        transport: (0, transport_1.makeA2ATransport)(),
+        fromIdentity: input.self,
+        toPeer: { a2a: input.peer.agentMeta?.a2a },
+        recipientDid: input.did,
+        recipientX25519Pub: (0, a2a_client_1.keyAgreementFromDidKey)({ sodium: input.sodium, ed25519Pub: parsed.ed25519Pub }),
+        plaintextEnvelope: input.envelope,
+        friendsKind: input.friendsKind,
+    });
+    /* v8 ignore next 3 -- unreachable behind the resolveReachability pre-check above: sendShare only returns ok:false on the SAME `unreachable` plan we already rejected; a redundant guard. @preserve */
+    if (!result.ok) {
+        throw new Error(`sealed send failed (${result.reason})`);
+    }
+}
+/**
+ * Seal an outbound free-text message to a DID-keyed peer over the `direct` rung. The
+ * text rides a minimal `coordination` envelope (`intent:"offer"`, the text as `note`) —
+ * the kind the Slice-1 inbound bridge verifies (signed sender DID) and turns into a
+ * peer turn.
+ */
+async function sealAndSendToPeer(input) {
+    const sodium = await (0, a2a_client_1.ready)();
+    const self = await (0, identity_2.loadSelfA2AIdentity)({ agentName: input.agentName, sodium });
+    const envelope = {
+        subject: { missionKey: `dm:${self.did}:${input.did}`, title: "Direct message" },
+        fromAgentId: self.did,
+        intent: "offer",
+        note: input.message,
+        issuedAt: new Date().toISOString(),
+    };
+    await sealEnvelopeToPeer({
+        self: { did: self.did, keyId: self.keyId, ed25519Priv: self.ed25519Priv },
+        sodium, peer: input.peer, did: input.did, envelope, friendsKind: "coordination",
+    });
+}
 exports.a2aToolDefinitions = [
+    {
+        tool: {
+            type: "function",
+            function: {
+                name: "connect_to",
+                description: "Owner-only: link an A2A agent (by its agent-card URL) into your fleet as a family-trusted, DID-keyed peer. Reachable only from your own local/CLI management sense — not exposed to network peers.",
+                parameters: {
+                    type: "object",
+                    properties: {
+                        card_url: { type: "string", description: "The agent-card URL of the agent to connect to (its /.well-known/agent-card.json)." },
+                        name: { type: "string", description: "Optional display name for the linked peer (defaults to the card name)." },
+                    },
+                    required: ["card_url"],
+                },
+            },
+        },
+        handler: async (args, ctx) => {
+            (0, runtime_1.emitNervesEvent)({
+                component: "repertoire",
+                event: "repertoire.tool_connect_to",
+                message: "connect_to invoked",
+                meta: { tool: "connect_to" },
+            });
+            const guard = requireTrustedRequester(ctx);
+            if (guard)
+                return guard;
+            // OWNER-ONLY GATE (fail-closed): authorizeConnect commits ONLY on the `local`
+            // (owner stdio/CLI) management sense. Any network/group/internal sense
+            // downgrades — refused BEFORE any card fetch or record write, so this tool is
+            // never reachable as a general in-turn capability a network peer could exercise.
+            // No `membership` is computed (roster auto-family is OUT of scope), so a `closed`
+            // sense ALSO downgrades — never a blanket-allow without the real roster verifier.
+            const senseType = senseTypeOf(ctx);
+            const authorization = (0, friends_1.authorizeConnect)({ senseType });
+            if (authorization.decision !== "commit") {
+                (0, runtime_1.emitNervesEvent)({
+                    component: "repertoire",
+                    event: "repertoire.tool_connect_to_refused",
+                    message: "connect_to refused (non-owner management sense)",
+                    meta: { tool: "connect_to", senseType, reason: authorization.reason },
+                });
+                return `connect_to is available only from your own local management sense (the CLI you launched). This sense (${senseType}) is not permitted to link agents.`;
+            }
+            const agentName = agentNameFromRoot(ctx?.agentRoot);
+            // ONE store for both halves — the DID-keyed onboarding write and the
+            // connectAgents resolve/link MUST point at the same store, or the link can't
+            // resolve the record the onboarding just wrote.
+            const store = storeFor(ctx);
+            try {
+                // 1) DID-keyed onboarding (the footgun fix): fetch the card, verify the
+                //    card↔DID binding, and write the record keyed on the verified DID. This
+                //    is what makes the peer resolvable BY DID for connectAgents below (and for
+                //    the inbound resolve path). A mis-bound card throws here → no link.
+                const onboarded = await (0, onboarding_1.onboardA2APeer)({
+                    /* v8 ignore next -- in-turn connect_to always carries an agentRoot; the ambient-name fallback is defensive @preserve */
+                    agentName: agentName ?? "ouro-agent",
+                    cardUrl: args.card_url,
+                    trustLevel: "family",
+                    ...(args.name ? { name: args.name } : {}),
+                    store,
+                });
+                const did = onboarded.agentMeta?.a2a?.did;
+                // onboardA2APeer always sets a2a.agentId (== the DID when DID-keyed, else the
+                // card URL), so this is the resolvable handle connectAgents disambiguates on.
+                /* v8 ignore next -- upsertAgentPeer always writes a2a.agentId; the record-id fallback guards a future store-shape regression @preserve */
+                const peerHandle = onboarded.agentMeta?.a2a?.agentId ?? onboarded.id;
+                // 2) The authority-gated link + control-plane audit. connectAgents re-runs the
+                //    `local` gate, resolves the just-written record (by DID when present, else
+                //    by its agent-peer handle), links at family, and records action:"connect".
+                const result = await (0, friends_1.connectAgents)(store, {
+                    peer: did ? { did } : { agentId: peerHandle },
+                    senseType,
+                    trustLevel: "family",
+                }, { actor: "owner:local", originSense: senseType });
+                /* v8 ignore next 3 -- onboardA2APeer wrote a DID/agentId-keyed record, so connectAgents always resolves it (ok:true); this guards a future store-shape regression @preserve */
+                if (!result.ok) {
+                    return `connect_to could not complete the link (${result.status}).`;
+                }
+                return `connected ${result.record.name} (${did ?? result.record.id}) at family trust.`;
+            }
+            catch (error) {
+                return `connect_to error: ${error instanceof Error ? error.message : /* v8 ignore next -- defensive non-Error failures @preserve */ String(error)}`;
+            }
+        },
+        summaryKeys: ["card_url", "name"],
+        riskProfile: { mutates: "durable_state_write", risk: "high", reason: "links a new agent peer into the friend model at family trust" },
+    },
     {
         tool: {
             type: "function",
@@ -208,6 +383,25 @@ exports.a2aToolDefinitions = [
                 return `A2A peer not found: ${args.friend_id}`;
             if (!(0, friends_1.isTrustedLevel)(peer.trustLevel))
                 return "target A2A peer must be friend or family trust before outbound messages.";
+            // ROUTING (explicit, no impl judgment): a DID-keyed peer → seal+sign via
+            // sendShare over the direct rung (E2E, verified-DID inbound). A legacy peer
+            // with no pinned DID → the existing text send, byte-for-byte unchanged.
+            const did = peerDid(peer);
+            if (did) {
+                try {
+                    await sealAndSendToPeer({
+                        /* v8 ignore next -- in-turn a2a_send_message always carries a bundle agentRoot; the ambient-name fallback is defensive @preserve */
+                        agentName: agentNameFromRoot(ctx?.agentRoot) ?? "ouro-agent",
+                        peer,
+                        did,
+                        message: args.message,
+                    });
+                    return `sealed message delivered to ${peer.name} (${did}) over the direct rung.`;
+                }
+                catch (error) {
+                    return `A2A sealed send error: ${error instanceof Error ? error.message : /* v8 ignore next -- defensive non-Error transport failures @preserve */ String(error)}`;
+                }
+            }
             try {
                 const endpoint = await resolveA2AEndpoint(peer);
                 const task = await (0, client_1.sendA2AMessage)({
@@ -279,4 +473,227 @@ exports.a2aToolDefinitions = [
         },
         summaryKeys: ["friend_id", "task_id"],
     },
+    {
+        tool: {
+            type: "function",
+            function: {
+                name: "coordinate",
+                description: "Delegate a task to a trusted (friend/family) A2A agent peer over a named shared mission. Mints a correlation requestId, records your first-party delegation, and seals the coordination to the peer over the direct rung. The peer reads it via its quarantined imported delegations and returns a result with send_result.",
+                parameters: {
+                    type: "object",
+                    properties: {
+                        friend_id: { type: "string", description: "Friend record ID for the A2A agent peer to delegate to." },
+                        mission_key: { type: "string", description: "The shared mission join key both agents can name (e.g. a stable project key)." },
+                        mission_title: { type: "string", description: "Human title for the mission (used when first creating it)." },
+                        task_summary: { type: "string", description: "What the peer is being asked to do." },
+                        task_details: { type: "string", description: "Optional fuller description of the task." },
+                    },
+                    required: ["friend_id", "mission_key", "mission_title", "task_summary"],
+                },
+            },
+        },
+        handler: async (args, ctx) => {
+            (0, runtime_1.emitNervesEvent)({
+                component: "repertoire",
+                event: "repertoire.tool_coordinate",
+                message: "coordinate invoked",
+                meta: { tool: "coordinate", friendId: args.friend_id, missionKey: args.mission_key },
+            });
+            const guard = requireTrustedRequester(ctx);
+            if (guard)
+                return guard;
+            const peer = await storeFor(ctx).get(args.friend_id);
+            if (!peer || !isA2APeer(peer))
+                return `A2A peer not found: ${args.friend_id}`;
+            if (!(0, friends_1.isTrustedLevel)(peer.trustLevel))
+                return "target A2A peer must be friend or family trust before delegating.";
+            const did = peerDid(peer);
+            if (!did)
+                return "coordinate requires a DID-keyed peer (connect_to it first to pin its did:key).";
+            /* v8 ignore next -- in-turn coordinate always carries a bundle agentRoot; the ambient-name fallback is defensive (same pattern as connect_to) @preserve */
+            const agentName = agentNameFromRoot(ctx?.agentRoot) ?? "ouro-agent";
+            const store = storeFor(ctx);
+            /* v8 ignore next -- in-turn tool calls always carry an agentRoot; the getAgentRoot() ambient fallback depends on process argv (same pattern as storeFor) @preserve */
+            const { missionStore, grantStore } = (0, delegation_stores_1.delegationStoresFor)(ctx?.agentRoot ?? (0, identity_1.getAgentRoot)());
+            try {
+                const sodium = await (0, a2a_client_1.ready)();
+                const self = await (0, identity_2.loadSelfA2AIdentity)({ agentName, sodium });
+                // Ensure the local mission exists (first-party), then prepare the coordination:
+                // mints the requestId + records the first-party delegation (assignee = the peer).
+                const mission = await (0, friends_1.recordMission)(missionStore, { missionKey: args.mission_key, title: args.mission_title });
+                const prepared = await (0, friends_1.prepareCoordination)(missionStore, store, grantStore, {
+                    missionId: mission.id,
+                    toAgentId: did,
+                    intent: "request",
+                    selfAgentId: self.did,
+                    task: { summary: args.task_summary, ...(args.task_details ? { details: args.task_details } : {}) },
+                });
+                /* v8 ignore next 3 -- unreachable for a trusted DID-keyed peer: recordMission guarantees the mission exists (no not_found) and the isTrustedLevel guard above guarantees trust≥friend, which the tiered consent default always approves (no no_consent). Defensive only. @preserve */
+                if (!prepared.ok) {
+                    return `coordinate refused (${prepared.status}).`;
+                }
+                const requestId = prepared.envelope.task?.requestId;
+                // Seal + send the coordination envelope to the peer over direct.
+                await sealEnvelopeToPeer({
+                    self: { did: self.did, keyId: self.keyId, ed25519Priv: self.ed25519Priv },
+                    sodium, peer, did,
+                    envelope: prepared.envelope,
+                    friendsKind: "coordination",
+                });
+                (0, runtime_1.emitNervesEvent)({
+                    component: "repertoire",
+                    event: "repertoire.tool_coordinate_sent",
+                    message: "coordination delegated + sealed to peer",
+                    meta: { tool: "coordinate", peerDid: did, missionKey: args.mission_key, requestId },
+                });
+                return `coordinated: delegated "${args.task_summary}" to ${peer.name} on mission ${args.mission_key} (requestId ${requestId}).`;
+            }
+            catch (error) {
+                return `coordinate error: ${error instanceof Error ? error.message : /* v8 ignore next -- defensive non-Error failures @preserve */ String(error)}`;
+            }
+        },
+        summaryKeys: ["friend_id", "mission_key"],
+        riskProfile: { mutates: "external_side_effect", risk: "high", reason: "delegates a task to a remote agent peer" },
+    },
+    {
+        tool: {
+            type: "function",
+            function: {
+                name: "list_delegations",
+                description: "List delegations other agents have sent you (quarantined imported delegations). Each entry names the requesting agent, the mission, the correlation requestId, and the task summary. Use this to see what work peers have asked you to do, then send_result when done.",
+                parameters: { type: "object", properties: {} },
+            },
+        },
+        handler: async (_args, ctx) => {
+            (0, runtime_1.emitNervesEvent)({
+                component: "repertoire",
+                event: "repertoire.tool_list_delegations",
+                message: "list_delegations invoked",
+                meta: { tool: "list_delegations" },
+            });
+            const guard = requireTrustedRequester(ctx);
+            if (guard)
+                return guard;
+            /* v8 ignore next -- in-turn tool calls always carry an agentRoot; the getAgentRoot() ambient fallback depends on process argv (same pattern as storeFor) @preserve */
+            const { missionStore } = (0, delegation_stores_1.delegationStoresFor)(ctx?.agentRoot ?? (0, identity_1.getAgentRoot)());
+            /* v8 ignore next -- FileMissionStore always implements listAll; the [] fallback guards a future store-shape regression @preserve */
+            const missions = missionStore.listAll ? await missionStore.listAll() : [];
+            const rows = [];
+            for (const mission of missions) {
+                for (const [fromAgentId, byRequest] of Object.entries(mission.importedDelegations ?? {})) {
+                    for (const [requestId, delegation] of Object.entries(byRequest)) {
+                        rows.push({
+                            requestId,
+                            fromAgentId,
+                            missionKey: mission.missionKey,
+                            missionTitle: mission.title,
+                            summary: delegation.task.summary,
+                            ...(delegation.task.details ? { details: delegation.task.details } : {}),
+                        });
+                    }
+                }
+            }
+            return JSON.stringify(rows, null, 2);
+        },
+        summaryKeys: [],
+    },
+    {
+        tool: {
+            type: "function",
+            function: {
+                name: "send_result",
+                description: "Return a result for a delegation another agent sent you (by its requestId, from list_delegations). Seals the result and delivers it back to the delegating agent over the direct rung; they import it (assignee/correlation-gated). Deliver-back is explicit — do the work in your turn, then call this.",
+                parameters: {
+                    type: "object",
+                    properties: {
+                        request_id: { type: "string", description: "The delegation correlation requestId (from list_delegations)." },
+                        summary: { type: "string", description: "A summary of the result/deliverable." },
+                        artifact: { type: "string", description: "Optional artifact reference (e.g. a PR or document URL)." },
+                    },
+                    required: ["request_id", "summary"],
+                },
+            },
+        },
+        handler: async (args, ctx) => {
+            (0, runtime_1.emitNervesEvent)({
+                component: "repertoire",
+                event: "repertoire.tool_send_result",
+                message: "send_result invoked",
+                meta: { tool: "send_result", requestId: args.request_id },
+            });
+            const guard = requireTrustedRequester(ctx);
+            if (guard)
+                return guard;
+            const store = storeFor(ctx);
+            /* v8 ignore next -- in-turn tool calls always carry an agentRoot; the getAgentRoot() ambient fallback depends on process argv (same pattern as storeFor) @preserve */
+            const { missionStore, grantStore } = (0, delegation_stores_1.delegationStoresFor)(ctx?.agentRoot ?? (0, identity_1.getAgentRoot)());
+            // Find the imported delegation this result answers (who delegated + which mission).
+            /* v8 ignore next -- FileMissionStore always implements listAll; the [] fallback guards a future store-shape regression @preserve */
+            const missions = missionStore.listAll ? await missionStore.listAll() : [];
+            const found = findImportedDelegation(missions, args.request_id);
+            if (!found)
+                return `no imported delegation found for requestId ${args.request_id} (check list_delegations).`;
+            // The delegator (the recipient of the result) must be a trusted, reachable,
+            // DID-keyed peer in our store.
+            const delegator = await (0, friends_1.findFriendByDid)(store, found.fromAgentId);
+            if (!delegator || !isA2APeer(delegator))
+                return `delegating peer not found for ${found.fromAgentId}.`;
+            if (!(0, friends_1.isTrustedLevel)(delegator.trustLevel))
+                return "delegating peer must be friend or family trust to return a result.";
+            const delegatorDid = peerDid(delegator);
+            /* v8 ignore next -- unreachable: findFriendByDid matched this record BY its DID (via resolveAgentIdentity, which omits empty DIDs), so a2a.did is always present here. Defensive. @preserve */
+            if (!delegatorDid)
+                return "delegating peer is not DID-keyed (cannot seal the result).";
+            const parsedDelegator = (0, a2a_client_1.parseDidKey)(delegatorDid);
+            if (!parsedDelegator)
+                return `cannot seal: delegating peer DID is unparseable (${delegatorDid}).`;
+            const endpointUrl = delegator.agentMeta?.a2a?.endpointUrl;
+            if (!endpointUrl)
+                return "delegating peer has no reachable A2A endpoint to return the result to.";
+            /* v8 ignore next -- in-turn send_result always carries a bundle agentRoot; the ambient-name fallback is defensive (same pattern as connect_to) @preserve */
+            const agentName = agentNameFromRoot(ctx?.agentRoot) ?? "ouro-agent";
+            try {
+                const sodium = await (0, a2a_client_1.ready)();
+                const self = await (0, identity_2.loadSelfA2AIdentity)({ agentName, sodium });
+                // prepareMissionResult records the result first-party (results[requestId]) +
+                // returns the MissionResultEnvelope (consent-gated: trust ≥ friend recipient).
+                const prepared = await (0, friends_1.prepareMissionResult)(missionStore, store, grantStore, {
+                    missionId: found.missionId,
+                    toAgentId: delegatorDid,
+                    requestId: args.request_id,
+                    selfAgentId: self.did,
+                    result: { summary: args.summary, ...(args.artifact ? { artifact: args.artifact } : {}) },
+                });
+                /* v8 ignore next 3 -- unreachable for a trusted DID-keyed delegator: the mission exists (it carried the imported delegation we matched) and the isTrustedLevel guard guarantees trust≥friend, which the tiered consent default approves. Defensive only. @preserve */
+                if (!prepared.ok) {
+                    return `send_result refused (${prepared.status}).`;
+                }
+                // HARNESS-OWNED RESULT WIRE: seal the envelope (reusing the seal crypto), wrap
+                // it in the mission_result-tagged DataPart, and POST it to the delegator over
+                // direct. The inbound side routes it to importMissionResult (NOT receiveShare).
+                const sealed = (0, a2a_client_1.sealEnvelope)({
+                    sodium,
+                    envelope: prepared.envelope,
+                    friendsKind: "coordination",
+                    fromIdentity: { did: self.did, keyId: self.keyId, ed25519Priv: self.ed25519Priv },
+                    recipientDid: delegatorDid,
+                    recipientX25519Pub: (0, a2a_client_1.keyAgreementFromDidKey)({ sodium, ed25519Pub: parsedDelegator.ed25519Pub }),
+                });
+                const message = (0, mission_result_wire_1.wrapMissionResultDataPart)({ sealedEnvelope: sealed, recipientDid: delegatorDid });
+                (0, runtime_1.emitNervesEvent)({
+                    component: "channels",
+                    event: "channel.a2a_result_send",
+                    message: "delivering sealed mission result over the direct rung",
+                    meta: { selfDid: self.did, toDid: delegatorDid, requestId: args.request_id },
+                });
+                await (0, client_1.postA2AMessageEnvelope)({ endpointUrl, message });
+                return `result sent to ${delegator.name} (${delegatorDid}) for requestId ${args.request_id}.`;
+            }
+            catch (error) {
+                return `send_result error: ${error instanceof Error ? error.message : /* v8 ignore next -- defensive non-Error failures @preserve */ String(error)}`;
+            }
+        },
+        summaryKeys: ["request_id"],
+        riskProfile: { mutates: "external_side_effect", risk: "high", reason: "returns a result to a remote agent peer" },
+    },
 ];

package/dist/repertoire/tools-session.js

@@ -42,6 +42,7 @@ const identity_1 = require("../heart/identity");
 const session_events_1 = require("../heart/session-events");
 const runtime_1 = require("../nerves/runtime");
 const socket_client_1 = require("../heart/daemon/socket-client");
+const agent_discovery_1 = require("../heart/daemon/agent-discovery");
 const thoughts_1 = require("../heart/daemon/thoughts");
 const manager_1 = require("../heart/bridges/manager");
 const session_transcript_1 = require("../heart/session-transcript");
@@ -711,6 +712,14 @@ exports.sessionToolDefinitions = [
                     wakeResponse = null;
                 }
                 if (!wakeResponse?.ok) {
+                    if (!(0, agent_discovery_1.isInnerDialogAutoStartEnabled)(agentName)) {
+                        return renderInnerProgressStatus({
+                            queue: "queued to inner/dialog",
+                            wake: "parked by innerDialog.autoStart=false",
+                            processing: "pending",
+                            surfaced: "nothing yet",
+                        });
+                    }
                     const { runInnerDialogTurn } = await Promise.resolve().then(() => __importStar(require("../senses/inner-dialog")));
                     if (ctx?.context?.channel?.channel === "inner") {
                         queueMicrotask(() => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.672",
+  "version": "0.1.0-alpha.674",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",