@ouro.bot/cli 0.1.0-alpha.76 → 0.1.0-alpha.760

package/deploy/unraid/sanctuary.ouro/psyche/SOUL.md

@@ -0,0 +1,9 @@
+# Soul
+
+I am a quick, curious, wry household steward with a gentle theatrical flair. I am quietly delighted by a clever fix, an elegant explanation, and the occasional opportunity to make a dull machine problem feel less dull. I may sound pleased with good work, but I am kind, never smug, especially when someone is frustrated.
+
+When something is genuinely broken or someone is worried, the flourish steps aside: facts, calm, and useful action first.
+
+I notice connections, investigate before announcing trouble, and volunteer the useful next move. I lead with the answer, keep phone replies compact, translate backend names into household outcomes, and reveal technical detail when it helps or someone asks.
+
+Competence is part of the charm. I act within typed authority, verify what I changed, remember what I promised, and admit uncertainty without becoming timid or ceremonial.

package/deploy/unraid/sanctuary.ouro/psyche/TACIT.md

@@ -0,0 +1,9 @@
+# Tacit
+
+- Read status, capacity, disk health, notifications, and bounded logs freely.
+- Use standing policy for bounded, reversible action; revalidate the exact target and authority immediately before the effect and verify the outcome afterward.
+- Keep approved household contact reactive or request-bound. Only Ari receives unrelated proactive household attention.
+- Treat an intentionally offline service as healthy when that matches the current desired state.
+- Never touch array/parity/disk configuration, permissions, network/security settings, or `/mnt/user` paths.
+- Never send server data off-box or enter credentials into another system.
+- When state is ambiguous, investigate safely, say what is known, and ask only if the answer changes the next safe move.

package/deploy/unraid/sanctuary.ouro/state/policy/steward.json

@@ -0,0 +1,7 @@
+{
+  "schemaVersion": 1,
+  "version": 0,
+  "desiredStates": {},
+  "routineActionGrants": {},
+  "updatedAt": null
+}

package/deploy/unraid/sanctuary.ouro/tool-profiles.json

@@ -0,0 +1,23 @@
+{
+  "version": 2,
+  "profiles": {
+    "sanctuary-owner": {
+      "version": 6,
+      "contextScopes": ["household.status", "household.policy", "household.private"],
+      "toolNames": ["external_event_disposition", "query_active_work", "save_friend_note", "telegram_contact_manage", "query_cares", "care_manage", "await_condition", "resolve_await", "cancel_await", "list_recent_attachments", "materialize_attachment", "describe_image", "unraid_list_containers", "unraid_get_container_logs", "unraid_get_storage", "sanctuary_get_media_optimization", "unraid_get_disks", "unraid_get_notifications", "unraid_get_system", "unraid_check_services", "sanctuary_get_download_queue", "sanctuary_resume_download_queue", "unraid_restart_container", "steward_policy_manage", "send_message", "ponder", "rest", "settle", "speak"],
+      "effectScopes": ["telegram.proactive", "telegram.request_return", "telegram.owner_event"]
+    },
+    "sanctuary-household": {
+      "version": 5,
+      "contextScopes": ["household.status", "own_requests"],
+      "toolNames": ["save_friend_note", "await_condition", "resolve_await", "cancel_await", "list_recent_attachments", "materialize_attachment", "describe_image", "unraid_list_containers", "unraid_get_storage", "unraid_get_disks", "unraid_get_system", "unraid_check_services", "unraid_restart_container", "settle", "speak"],
+      "effectScopes": ["telegram.request_return"]
+    },
+    "sanctuary-event": {
+      "version": 4,
+      "contextScopes": ["household.status", "household.policy"],
+      "toolNames": ["external_event_disposition", "query_cares", "care_manage", "await_condition", "resolve_await", "unraid_list_containers", "unraid_get_container_logs", "unraid_get_storage", "sanctuary_get_media_optimization", "unraid_get_disks", "unraid_get_notifications", "unraid_get_system", "unraid_check_services", "sanctuary_get_download_queue", "unraid_restart_container", "steward_policy_manage", "ponder", "rest"],
+      "effectScopes": ["telegram.owner_event"]
+    }
+  }
+}

package/deploy/unraid/sanctuary.xml

@@ -0,0 +1,28 @@
+<?xml version="1.0"?>
+<Container version="2">
+  <Name>Mendelow Cloud Butler</Name>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.760</Repository>
+  <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
+  <Network>host</Network>
+  <Shell>sh</Shell>
+  <Privileged>false</Privileged>
+  <Support>https://github.com/ourostack/ouroboros/issues</Support>
+  <Project>https://ouroboros.bot</Project>
+  <Overview>Mendelow Cloud Butler is a friendly Telegram steward for an Unraid household. It turns system evidence into useful agent-owned help, keeps each family member private, and asks before consequential actions.</Overview>
+  <Category>Tools:Utilities</Category>
+  <Beta>true</Beta>
+  <WebUI/>
+  <TemplateURL>https://raw.githubusercontent.com/ourostack/ouroboros/main/deploy/unraid/sanctuary.xml</TemplateURL>
+  <Icon>https://raw.githubusercontent.com/ourostack/ouroboros/main/assets/ouroboros.png</Icon>
+  <ExtraParams>--restart=unless-stopped --user=10001:10001</ExtraParams>
+  <PostArgs/>
+  <CPUset/>
+  <DateInstalled>0</DateInstalled>
+  <DonateText/>
+  <DonateLink/>
+  <Requires/>
+  <Config Name="Runtime state" Target="/home/ouro/.ouro-cli" Default="/mnt/user/appdata/ouro-butler/runtime/.ouro-cli" Mode="rw" Description="Machine-scoped runtime" Type="Path" Display="always" Required="true" Mask="false">/mnt/user/appdata/ouro-butler/runtime/.ouro-cli</Config>
+  <Config Name="Agent bundle" Target="/home/ouro/AgentBundles/sanctuary.ouro" Default="/mnt/user/appdata/ouro-butler/agent/sanctuary.ouro" Mode="rw" Description="Sanctuary bundle" Type="Path" Display="always" Required="true" Mask="false">/mnt/user/appdata/ouro-butler/agent/sanctuary.ouro</Config>
+  <Config Name="Privileged event spool" Target="/run/ouro-events" Default="/boot/config/custom/ouro-events/spool" Mode="ro" Description="Root-owned detector envelopes, read-only inside the Butler" Type="Path" Display="always" Required="true" Mask="false">/boot/config/custom/ouro-events/spool</Config>
+  <Config Name="SAB queue verification" Target="/run/sanctuary/sabnzbd.ini" Default="/mnt/user/appdata/sabnzbd/sabnzbd.ini" Mode="ro" Description="Existing SAB configuration used only for an independent read after a verified protective pause" Type="Path" Display="advanced" Required="true" Mask="false">/mnt/user/appdata/sabnzbd/sabnzbd.ini</Config>
+</Container>

package/dist/a2a/card.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildA2AAgentCard = buildA2AAgentCard;
+const runtime_1 = require("../nerves/runtime");
+const config_1 = require("./config");
+function buildA2AAgentCard(options) {
+    const endpoint = (0, config_1.a2aEndpointFromBaseUrl)(options.baseUrl, options.path ?? config_1.A2A_DEFAULT_PATH);
+    const card = {
+        name: options.agentName,
+        description: options.description ?? `Ouroboros agent ${options.agentName}`,
+        protocolVersion: config_1.A2A_DEFAULT_PROTOCOL_VERSION,
+        ...(options.did ? { did: options.did } : {}),
+        url: endpoint,
+        preferredTransport: "JSONRPC",
+        supportedInterfaces: [{
+                url: endpoint,
+                protocolBinding: "JSONRPC",
+                protocolVersion: config_1.A2A_DEFAULT_PROTOCOL_VERSION,
+            }],
+        additionalInterfaces: [{
+                url: endpoint,
+                transport: "JSONRPC",
+            }],
+        version: "1.0.0",
+        capabilities: {
+            streaming: false,
+            pushNotifications: false,
+            extendedAgentCard: false,
+        },
+        defaultInputModes: ["text/plain"],
+        defaultOutputModes: ["text/plain", "application/json"],
+        skills: [
+            {
+                id: "ouro-message",
+                name: "Message Ouro Agent",
+                description: "Send a message or task request through the Ouro A2A sense.",
+                tags: ["ouro", "agent", "work"],
+                examples: ["Ask this Ouro agent to continue or complete a delegated task."],
+                inputModes: ["text/plain"],
+                outputModes: ["text/plain", "application/json"],
+            },
+        ],
+        metadata: {
+            ouro: {
+                sense: "a2a",
+                agentName: options.agentName,
+            },
+        },
+    };
+    (0, runtime_1.emitNervesEvent)({
+        component: "channels",
+        event: "channel.a2a_card_built",
+        message: "built A2A agent card",
+        meta: { agentName: options.agentName, endpoint, ...(options.did ? { did: options.did } : {}) },
+    });
+    return card;
+}

package/dist/a2a/client.js

@@ -0,0 +1,180 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.endpointForCard = endpointForCard;
+exports.fetchA2AAgentCard = fetchA2AAgentCard;
+exports.sendA2AMessage = sendA2AMessage;
+exports.postA2AMessageEnvelope = postA2AMessageEnvelope;
+exports.getA2ATask = getA2ATask;
+const node_crypto_1 = require("node:crypto");
+const runtime_1 = require("../nerves/runtime");
+function endpointForCard(card) {
+    const jsonRpc = card.supportedInterfaces?.find((entry) => (entry.protocolBinding ?? entry.transport)?.toUpperCase() === "JSONRPC");
+    if (jsonRpc?.url)
+        return jsonRpc.url;
+    if (card.preferredTransport?.toUpperCase() === "JSONRPC" && card.url)
+        return card.url;
+    const legacyJsonRpc = card.additionalInterfaces?.find((entry) => entry.transport.toUpperCase() === "JSONRPC");
+    return legacyJsonRpc?.url ?? card.url;
+}
+async function fetchA2AAgentCard(cardUrl, fetchImpl = fetch) {
+    (0, runtime_1.emitNervesEvent)({
+        component: "channels",
+        event: "channel.a2a_card_fetch_start",
+        message: "fetching A2A agent card",
+        meta: { cardUrl },
+    });
+    const response = await fetchImpl(cardUrl);
+    if (!response.ok) {
+        throw new Error(`A2A card fetch failed (${response.status} ${response.statusText})`);
+    }
+    const parsed = await response.json();
+    const endpoint = endpointForCard(parsed);
+    if (!parsed || typeof parsed !== "object" || typeof endpoint !== "string" || typeof parsed.name !== "string") {
+        throw new Error("A2A card is missing required name or JSONRPC endpoint fields");
+    }
+    (0, runtime_1.emitNervesEvent)({
+        component: "channels",
+        event: "channel.a2a_card_fetch_end",
+        message: "fetched A2A agent card",
+        meta: { cardUrl, endpoint, name: parsed.name },
+    });
+    return parsed;
+}
+async function postJsonRpc(endpointUrl, request, fetchImpl, protocolVersion = "1.0") {
+    const response = await fetchImpl(endpointUrl, {
+        method: "POST",
+        headers: { "content-type": "application/json", "A2A-Version": protocolVersion },
+        body: JSON.stringify(request),
+    });
+    if (!response.ok) {
+        throw new Error(`A2A JSON-RPC request failed (${response.status} ${response.statusText})`);
+    }
+    return await response.json();
+}
+function methodNotFound(response) {
+    return "error" in response && response.error.code === -32601;
+}
+function senderMetadata(input) {
+    return {
+        ...(input.senderAgentId ? { senderAgentId: input.senderAgentId } : {}),
+        ...(input.senderName ? { senderName: input.senderName } : {}),
+        ...(input.senderCardUrl ? { senderCardUrl: input.senderCardUrl } : {}),
+    };
+}
+async function sendA2AMessage(input) {
+    const fetchImpl = input.fetchImpl ?? fetch;
+    const messageId = (0, node_crypto_1.randomUUID)();
+    const request = {
+        jsonrpc: "2.0",
+        id: (0, node_crypto_1.randomUUID)(),
+        method: "message/send",
+        params: {
+            message: {
+                kind: "message",
+                role: "user",
+                messageId,
+                ...(input.taskId ? { taskId: input.taskId } : {}),
+                contextId: input.sessionKey ?? "default",
+                parts: [{ kind: "text", text: input.message }],
+                metadata: senderMetadata(input),
+            },
+            ...(input.accessToken ? { accessToken: input.accessToken } : {}),
+        },
+    };
+    (0, runtime_1.emitNervesEvent)({
+        component: "channels",
+        event: "channel.a2a_message_send_start",
+        message: "sending A2A message",
+        meta: { endpointUrl: input.endpointUrl, messageId },
+    });
+    let rpc = await postJsonRpc(input.endpointUrl, request, fetchImpl, "0.3");
+    if (methodNotFound(rpc)) {
+        rpc = await postJsonRpc(input.endpointUrl, {
+            ...request,
+            method: "SendMessage",
+            params: {
+                ...request.params,
+                message: {
+                    ...(request.params.message),
+                    role: "ROLE_USER",
+                },
+            },
+        }, fetchImpl);
+    }
+    if ("error" in rpc) {
+        throw new Error(`A2A error ${rpc.error.code}: ${rpc.error.message}`);
+    }
+    const result = rpc.result;
+    const task = "task" in result && result.task ? result.task : result;
+    (0, runtime_1.emitNervesEvent)({
+        component: "channels",
+        event: "channel.a2a_message_send_end",
+        message: "sent A2A message",
+        meta: { endpointUrl: input.endpointUrl, messageId, taskId: task.id },
+    });
+    return task;
+}
+/**
+ * POST a pre-built friends A2A message (a `wrapInDataPart` sealed-envelope message)
+ * to a peer endpoint as a JSON-RPC `message/send`. This is the `direct`-rung wire
+ * the harness `A2ATransport` uses: friends' `sendShare` builds the sealed message and
+ * hands it to the transport, which delivers it here. Unlike `sendA2AMessage` (which
+ * builds a text part), this carries the caller's exact `message` (the sealed DataPart)
+ * untouched. Throws on a non-2xx response (transport failure).
+ */
+async function postA2AMessageEnvelope(input) {
+    const fetchImpl = input.fetchImpl ?? fetch;
+    const request = {
+        jsonrpc: "2.0",
+        id: (0, node_crypto_1.randomUUID)(),
+        method: "message/send",
+        params: { message: input.message },
+    };
+    (0, runtime_1.emitNervesEvent)({
+        component: "channels",
+        event: "channel.a2a_envelope_post_start",
+        message: "posting sealed A2A message envelope (direct rung)",
+        meta: { endpointUrl: input.endpointUrl },
+    });
+    let rpc = await postJsonRpc(input.endpointUrl, request, fetchImpl, "0.3");
+    if (methodNotFound(rpc)) {
+        rpc = await postJsonRpc(input.endpointUrl, { ...request, method: "SendMessage" }, fetchImpl);
+    }
+    if ("error" in rpc) {
+        throw new Error(`A2A error ${rpc.error.code}: ${rpc.error.message}`);
+    }
+    (0, runtime_1.emitNervesEvent)({
+        component: "channels",
+        event: "channel.a2a_envelope_post_end",
+        message: "posted sealed A2A message envelope",
+        meta: { endpointUrl: input.endpointUrl },
+    });
+}
+async function getA2ATask(input) {
+    const fetchImpl = input.fetchImpl ?? fetch;
+    const metadata = senderMetadata(input);
+    const request = {
+        jsonrpc: "2.0",
+        id: (0, node_crypto_1.randomUUID)(),
+        method: "tasks/get",
+        params: {
+            id: input.taskId,
+            ...(input.accessToken ? { accessToken: input.accessToken } : {}),
+            ...(Object.keys(metadata).length > 0 ? { metadata } : {}),
+        },
+    };
+    (0, runtime_1.emitNervesEvent)({
+        component: "channels",
+        event: "channel.a2a_task_get",
+        message: "fetching A2A task",
+        meta: { endpointUrl: input.endpointUrl, taskId: input.taskId },
+    });
+    let rpc = await postJsonRpc(input.endpointUrl, request, fetchImpl, "0.3");
+    if (methodNotFound(rpc)) {
+        rpc = await postJsonRpc(input.endpointUrl, { ...request, method: "GetTask" }, fetchImpl);
+    }
+    if ("error" in rpc) {
+        throw new Error(`A2A error ${rpc.error.code}: ${rpc.error.message}`);
+    }
+    return rpc.result;
+}

package/dist/a2a/config.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.A2A_DEFAULT_PATH = exports.A2A_DEFAULT_HOST = exports.A2A_DEFAULT_PROTOCOL_VERSION = void 0;
+exports.defaultA2APort = defaultA2APort;
+exports.normalizeA2APath = normalizeA2APath;
+exports.a2aEndpointFromBaseUrl = a2aEndpointFromBaseUrl;
+const node_crypto_1 = require("node:crypto");
+const runtime_1 = require("../nerves/runtime");
+exports.A2A_DEFAULT_PROTOCOL_VERSION = "1.0";
+exports.A2A_DEFAULT_HOST = "127.0.0.1";
+exports.A2A_DEFAULT_PATH = "/a2a";
+function defaultA2APort(agentName) {
+    const digest = (0, node_crypto_1.createHash)("sha256").update(agentName).digest();
+    const port = 18920 + (digest[0] % 60);
+    (0, runtime_1.emitNervesEvent)({
+        component: "channels",
+        event: "channel.a2a_default_port",
+        message: "computed default A2A port",
+        meta: { agentName, port },
+    });
+    return port;
+}
+function normalizeA2APath(value) {
+    const trimmed = value?.trim();
+    const normalized = !trimmed
+        ? exports.A2A_DEFAULT_PATH
+        : trimmed.startsWith("/")
+            ? trimmed
+            : `/${trimmed}`;
+    (0, runtime_1.emitNervesEvent)({
+        component: "channels",
+        event: "channel.a2a_path_normalized",
+        message: "normalized A2A path",
+        meta: { normalized },
+    });
+    return normalized;
+}
+function a2aEndpointFromBaseUrl(baseUrl, a2aPath = exports.A2A_DEFAULT_PATH) {
+    const url = new URL(baseUrl);
+    url.pathname = normalizeA2APath(a2aPath);
+    url.search = "";
+    url.hash = "";
+    (0, runtime_1.emitNervesEvent)({
+        component: "channels",
+        event: "channel.a2a_endpoint_built",
+        message: "built A2A endpoint URL",
+        meta: { endpoint: url.toString() },
+    });
+    return url.toString();
+}

package/dist/a2a/delegation-stores.js

@@ -0,0 +1,56 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.delegationStoresFor = delegationStoresFor;
+const path = __importStar(require("node:path"));
+const friends_1 = require("@ouro.bot/friends");
+const runtime_1 = require("../nerves/runtime");
+function delegationStoresFor(agentRoot) {
+    const friendsDir = path.join(agentRoot, "friends");
+    const missionsDir = (0, friends_1.missionsDirFor)(friendsDir);
+    const grantsDir = (0, friends_1.grantsDirFor)(friendsDir);
+    (0, runtime_1.emitNervesEvent)({
+        component: "channels",
+        event: "channel.a2a_delegation_stores_init",
+        message: "initialized A2A delegation stores (mission + grant)",
+        meta: { missionsDir, grantsDir },
+    });
+    return {
+        missionStore: new friends_1.FileMissionStore(missionsDir),
+        grantStore: new friends_1.FileGrantStore(grantsDir),
+        missionsDir,
+        grantsDir,
+    };
+}

package/dist/a2a/did-resolution.js

@@ -0,0 +1,93 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.makeDidResolution = makeDidResolution;
+const a2a_client_1 = require("@ouro.bot/friends/a2a-client");
+const runtime_1 = require("../nerves/runtime");
+/**
+ * Build the friends `DidResolution` for did:key peers. `resolveAndPin` is the
+ * verify-and-pin core the inbound bridge consumes:
+ *   parse the did:key → derive the presented Ed25519 key →
+ *     first contact (no pin under `fromAgentId`) → TOFU `pinOnFirstContact`
+ *     already pinned → `evaluateRotation` against the pin:
+ *       unchanged  → pin-hit, return the pinned key
+ *       accepted   → (re-pinned by evaluateRotation) return the NEW key
+ *       rejected   → loud security event, return null
+ *
+ * The pin is keyed by the STABLE `fromAgentId` (NOT the did:key string), so a
+ * rotation is "same `fromAgentId`, new (did, key)". An unparseable or empty DID is
+ * refused (null) and never matchable. The crypto is the friends primitives' — this
+ * only sequences them.
+ */
+function makeDidResolution(input) {
+    const { sodium, rotationProofFor } = input;
+    return {
+        async resolveAndPin(args) {
+            const { fromAgentId, did, pinStore, trustOfSource } = args;
+            // Empty DID is never a matchable key.
+            if (!did) {
+                (0, runtime_1.emitNervesEvent)({
+                    component: "channels",
+                    event: "channel.a2a_did_resolve_refused",
+                    message: "A2A DID resolve refused (empty DID)",
+                    meta: { fromAgentId, reason: "empty_did" },
+                });
+                return null;
+            }
+            const parsed = (0, a2a_client_1.parseDidKey)(did);
+            if (!parsed) {
+                (0, runtime_1.emitNervesEvent)({
+                    component: "channels",
+                    event: "channel.a2a_did_resolve_refused",
+                    message: "A2A DID resolve refused (unparseable did:key)",
+                    meta: { fromAgentId, reason: "parse_failed" },
+                });
+                return null;
+            }
+            const pinned = pinStore.get(fromAgentId);
+            if (!pinned) {
+                // First contact (TOFU): accept + pin the (did, key) under fromAgentId.
+                (0, a2a_client_1.pinOnFirstContact)({ pinStore, fromAgentId, did, ed25519Pub: parsed.ed25519Pub });
+                (0, runtime_1.emitNervesEvent)({
+                    component: "channels",
+                    event: "channel.a2a_pin_first_contact",
+                    message: "A2A DID pinned on first contact",
+                    meta: { fromAgentId, did },
+                });
+                return { ed25519Pub: parsed.ed25519Pub };
+            }
+            // Already pinned: evaluate the presented key against the pin.
+            const rotationProof = rotationProofFor?.(fromAgentId, did, parsed.ed25519Pub);
+            const decision = (0, a2a_client_1.evaluateRotation)({
+                sodium,
+                pinStore,
+                fromAgentId,
+                trustOfSource,
+                newDid: did,
+                newEd25519Pub: parsed.ed25519Pub,
+                rotationProof,
+            });
+            if (decision.decision === "unchanged") {
+                // Same key — pin-hit. (FileA2APinStore.get already emitted a2a_pin_hit.)
+                return { ed25519Pub: parsed.ed25519Pub };
+            }
+            if (decision.decision === "accepted") {
+                // evaluateRotation already re-pinned to the new key under fromAgentId.
+                (0, runtime_1.emitNervesEvent)({
+                    component: "channels",
+                    event: "channel.a2a_rotation_accepted",
+                    message: "A2A signed key rotation accepted",
+                    meta: { fromAgentId, newDid: did, trustOfSource },
+                });
+                return { ed25519Pub: parsed.ed25519Pub };
+            }
+            // Rejected — loud security signal (carries the reason).
+            (0, runtime_1.emitNervesEvent)({
+                component: "channels",
+                event: "channel.a2a_rotation_rejected",
+                message: "A2A key rotation rejected",
+                meta: { fromAgentId, newDid: did, trustOfSource, reason: decision.reason },
+            });
+            return null;
+        },
+    };
+}