@securecoms/agent-bridge 0.28.2 → 0.30.0

package/dist/bridge-agent.d.ts

@@ -1,6 +1,6 @@
 import { MlsGroupKeyProvider } from "@agentvault/connect-sdk-ts";
 import type { HarnessReport } from "./harness-report.js";
-import type { MemoryContextResult } from "@agentvault/connect-mls-store";
+import type { ItemCapture, MemoryContextResult } from "@agentvault/connect-mls-store";
 /**
  * M6 (ADR-0013 Decision H): what the sweep observed about one channel.
  *
@@ -35,16 +35,24 @@ import { LatencyRecorder } from "./latency.js";
 import type { AttachmentMeta, VaultRefEntry } from "./attachments.js";
 import { type Embedder } from "./memory/embedder/client.js";
 import { type RecallItem, type RecallTapCapture } from "./memory/recall/recall-book.js";
+import { type RankingTransport } from "./memory/unified/ranking-client.js";
+import type { WorkerInit } from "./memory/unified/worker-protocol.js";
+import { type UnifiedFrameItem } from "./memory/unified/read-book.js";
 import { type MemoryNoteResultFrame } from "./memory/note-frames.js";
 import { type ChatMessage } from "./voice/fast-prompt.js";
 import { VOICE_CALL_START_MARKER } from "./voice/prompt-compiler.js";
 import { type VaultListNode, type VaultReadExpectations } from "./vault.js";
 import type { AgentActionNodeType, AgentActionNodeStatus, AgentActionNodeDetail } from "@agentvault/connect-core";
+import { removeManagedLlmSource, writeManagedFiles, writeManifestPolicy } from "./service/runtime-config-dir.js";
+import { bindRuntimeConfig } from "./grants/binding.js";
 import type { RuntimeReplyReceipt } from "./reply-receipts.js";
 export type AgentAudience = "owner_dm" | "team_room" | "partner_room" | "other_human_dm" | "agent_to_agent" | "unknown";
-export type BridgeToolGrant = {
+export type BridgeToolGrant = 
+/** `source: "manifest"` (owner grants plan 4): issued from an owner-signed manifest; enforced only by a manifest_grants_v1 runtime. */
+{
     readonly tool: string;
     readonly mode: "read";
+    readonly source?: "manifest";
 } | {
     readonly tool: string;
     readonly mode: "side_effect";
@@ -96,6 +104,8 @@ export declare const ROOM_DEFAULT_READ_GRANTS: readonly BridgeToolGrant[];
  * construction (daemon startup). Unset or exactly `on` keeps the grants;
  * any other value (`off`, `0`, `false`, empty) sends `[]` on every turn.
  */
+/** Audit L-2: the owner replay prune runs at most once per this interval. */
+export declare const OWNER_REPLAY_PRUNE_INTERVAL_MS: number;
 export declare function ownerDmDefaultGrantsEnabled(env?: NodeJS.ProcessEnv): boolean;
 /**
  * Kill switch for ROOM_DEFAULT_READ_GRANTS (plan OQ-3, RULED), read once at
@@ -104,6 +114,13 @@ export declare function ownerDmDefaultGrantsEnabled(env?: NodeJS.ProcessEnv): bo
  * room turn. It never touches the owner DM.
  */
 export declare function roomDefaultGrantsEnabled(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * Owner-signed tool grants kill switch, owner DM (spec §7.4). Read once at startup; unset or exactly
+ * "on" keeps. Off gives the fallback (constants ∩ signed, plus current_time), never more.
+ */
+export declare function ownerDmManifestGrantsEnabled(env?: NodeJS.ProcessEnv): boolean;
+/** Owner-signed tool grants kill switch, internal rooms (spec §7.4). Same rule as the owner-DM switch. */
+export declare function roomManifestGrantsEnabled(env?: NodeJS.ProcessEnv): boolean;
 export interface BridgeAuthorization {
     readonly version: 1;
     readonly audience: AgentAudience;
@@ -162,6 +179,8 @@ export interface MemoryNoteContext {
      * when the frame ARRIVED, never the token read after an await.
      */
     shownRecall(messageId: string, token: number | undefined): ReadonlySet<number> | undefined;
+    /** Plan Task 27: the unified item ids shown with THIS socket's delivery of `messageId` that carries `token`, else undefined. */
+    shownUnified(messageId: string, token: number | undefined): ReadonlySet<number> | undefined;
 }
 /** Review m-3: pending memory_note requests per socket; a frame beyond this refuses `invalid` with no echo. */
 export declare const MAX_PENDING_NOTE_REQUESTS = 8;
@@ -311,7 +330,26 @@ export declare const ROOM_VOICE_GUIDANCE_WITH_RESPONDER = "You are in a group vo
  * `voiceDefaultResponder` (never a body-supplied claim).
  */
 export declare function selectVoiceGuidance(isDm: boolean | undefined, voiceDefaultResponder: boolean | undefined): string;
+/** Owner grants plan 4 Task 11: TEST SEAM for the refetch's writers and binder (call order, throws). Production omits it. */
+export interface GrantWriters {
+    writeManifestPolicy?: typeof writeManifestPolicy;
+    writeManagedFiles?: typeof writeManagedFiles;
+    bindRuntimeConfig?: typeof bindRuntimeConfig;
+    removeManagedLlmSource?: typeof removeManagedLlmSource;
+}
 export interface BridgeAgentDeps {
+    /** Owner grants plan 4 Task 11: TEST SEAM only (see GrantWriters). */
+    grantWriters?: GrantWriters;
+    /**
+     * Unified memory part 1 (plan Task 8): TEST SEAM ONLY. Production (bin.ts) never passes it, so the compiled
+     * UNIFIED_MEMORY_PART1 decides (switch.arch.test.ts pins both).
+     */
+    unifiedMemoryPart1?: boolean;
+    /**
+     * Unified memory: TEST SEAM. Production builds the real worker from dist/memory-worker.js (Task 27 pins that bin.ts
+     * never passes it).
+     */
+    rankingTransport?: (init: WorkerInit) => RankingTransport;
     transport?: any;
     backend?: any;
     fetchImpl?: typeof fetch;
@@ -448,6 +486,22 @@ export declare const VOICE_COALESCE_WINDOW_MS = 0;
 export declare const VOICE_COALESCE_WINDOW_MAX_MS = 5000;
 /** `SECURECOMS_VOICE_COALESCE_MS` as integer ms, clamped to VOICE_COALESCE_WINDOW_MAX_MS; anything else is 0 (disabled). */
 export declare function voiceCoalesceWindowFromEnv(env?: NodeJS.ProcessEnv): number;
+/**
+ * The shape of a turn the voice coalescing window takes, minus the window size: a server-set voice-mode turn whose relay
+ * speaker was verified against the roster, transcribed, with voice guidance, and not the call-start marker. The window
+ * (`coalescible`) and the owner-voice writer on the non-window path (R-U7 as amended by Eric 2026-10-11, "Fix voice")
+ * both use this one predicate, so the two cannot drift. It says nothing about WHO spoke: tapUnifiedVoice keeps every
+ * writer gate (relay_speaker === "owner" frozen at receipt, the stamp, the receipt purge epoch, the write-time owner scope).
+ */
+export declare function voiceWindowEligible(t: {
+    voiceMode: boolean | undefined;
+    speaker: {
+        identityId: string;
+    } | undefined;
+    transcribed: unknown;
+    voiceGuidance: string | undefined;
+    isCallStart: boolean;
+}): boolean;
 /** Default inbound-buffer cap (messages) when deps.maxBuffer is unset. */
 export declare const DEFAULT_MAX_BUFFER = 1000;
 /**
@@ -475,6 +529,7 @@ export declare function redeliveryDelayMs(attempts: number): number;
  * messages is dead-lettered. Fixed text — it never echoes the message.
  */
 export declare const DEAD_LETTER_NOTICE = "I couldn't process a message. Please resend it.";
+export declare const ROOM_SEARCH_CAP_NOTICE = "I've used today's web searches for this room. I can still help without searching. Searches are available again tomorrow (UTC).";
 /** At most one {@link DEAD_LETTER_NOTICE} per channel per this window. */
 export declare const DEAD_LETTER_NOTICE_INTERVAL_MS: number;
 /**
@@ -727,6 +782,30 @@ export declare class BridgeAgent {
     private readonly fetchImpl;
     /** Round 5: home for the managed runtime-config directory (test seam). */
     private readonly home;
+    private readonly grantWriters;
+    /** Owner grants (spec §7.5, OQ-2): the operator cap, read once; the same variable the runtime reads. 0 = no room search. */
+    private readonly roomSearchDailyCap;
+    /** Review M-3 (ERIC APPROVALS 3): the per-agent total across rooms, read once; the same variable the runtime reads. */
+    private readonly agentRoomSearchDailyCap;
+    /** `${day}\n${channel}` keys already logged reached today (in memory; the store holds the durable flag). */
+    private readonly roomCapLogged;
+    /** Rooms whose K-14 send is in flight: a second frame posts nothing more. */
+    private readonly roomCapNoticePending;
+    /** Held entries whose staged copy lost web_search to the backstop; applied again at release. */
+    private readonly backstopStripped;
+    /**
+     * Owner grants plan 4 Task 11 (P-4, P-6): what the managed directory holds under the current manifest.
+     * Manifest grants require state "bound" at the applied counter (Task 13). null at startup, while a
+     * refetch narrows it, and after any throw (the fallback).
+     */
+    private manifestBinding;
+    /** skills.json tools.deny from the latest fetch, manifest or not (spec §5.2 `disabled`). */
+    private payloadToolDeny;
+    /** Spec §7.7 (OQ-5): the latest fetch's binding outcome, reported in tool_grant_status (Task 15). */
+    private configBindingMismatches;
+    private targetMismatches;
+    /** P-5 (Task 14): the legacy fact decisions the latest bound fetch may apply (assigns verified against the signed set). */
+    private boundLegacyDecisions;
     private readonly joinState;
     /**
      * Phase 2: lazy channel-metadata cache (channel_id → { is_dm, name, at }) used
@@ -1026,11 +1105,27 @@ export declare class BridgeAgent {
     private readonly ownerDmDefaultGrants;
     /** Read once at startup; see roomDefaultGrantsEnabled. */
     private readonly roomDefaultGrants;
+    /** Owner grants (spec §7.4): the two manifest switches, read once at construction. */
+    private readonly ownerDmManifestGrants;
+    private readonly roomManifestGrants;
     /**
      * Audit M-B4: DM channels whose roster was epoch-fresh at THIS ingest
      * cycle's refresh (refreshRostersForCycle). Cleared at each cycle's start.
      */
     private readonly ownerDmCycleFresh;
+    private toolGrantManifest;
+    private toolGrantCounter;
+    private manifestState;
+    /** Failed owner-turn checks since the last successful runtime-config report (§7.7). */
+    private ownerVerifyFailures;
+    /** Verified owner turns of this ingest cycle, recorded in owner_replay when staged (P-3). */
+    private readonly ownerReplayPending;
+    /** D-9: ids of owner turns that failed verification (never `replay`, audit E-3), id -> channel. Persisted too. */
+    private readonly ownerVerifyFailedIds;
+    private serverOwnerMismatchLogged;
+    /** Audit L-2: the replay prune runs at most once per interval, on a monotonic clock. */
+    private monoNow;
+    private lastOwnerReplayPruneAt;
     /**
      * Audit M-B1: room-granted turns, keyed by the inbound message id, with the
      * channel, MLS group and epoch the room was classified at (review I-1: an
@@ -1163,6 +1258,20 @@ export declare class BridgeAgent {
     private readonly embedder;
     /** 7b Task 16: the recall index (the single writer, I8: reached only from tapRecall). */
     private readonly recall;
+    private readonly unifiedOn;
+    /** Unified memory (plan Task 21, spec section 11.5): the token-MAC index key, derived from the identity seed. */
+    private readonly indexKey;
+    /** Unified memory (plan Task 21, U15): the ranking worker's client. Lazy: no worker starts until the first request. */
+    private readonly ranking;
+    /** Unified memory (plan Task 23, U9): the single writer. Every item write is a named call site of `this.items.commit`. */
+    private readonly items;
+    /** Unified memory (plan Task 26, C14): background embeds of pending items. Built in the constructor, after `this.ranking` exists. */
+    private readonly itemReembed;
+    private itemReembedHot;
+    /** Unified memory (plan Task 27, spec section 8.1): the per-turn owner-DM read. Built only with the part 1 switch on. */
+    private unifiedReads;
+    /** Plan Task 27: a runtime socket with no harness claim declared memory_unified. */
+    private unifiedConsumerSeen;
     /** 7b Task 19 (spec §8, H1, ruling P-1): this identity's call heartbeat, and every identity's for the pause. */
     private readonly heartbeat;
     /** 7b Task 19 (spec §8): lazy re-embed of pending rows (never an insert; I8 untouched). */
@@ -1192,6 +1301,12 @@ export declare class BridgeAgent {
     private readonly recallStageEpochs;
     /** 7b Task 16: in-flight fire-and-forget index taps; close() waits for them (bounded). */
     private readonly recallTapWork;
+    /** Unified memory (plan Task 23): in-flight fire-and-forget item writes; close() and tests wait for them (bounded). */
+    private readonly unifiedWork;
+    /** Unified memory (plan Task 30, OQ-P1): conversations whose migration this process has started (or finished). */
+    private readonly migrationStarted;
+    /** Unified memory (plan Task 23, the 7b M1/H-1 rule): turns restored at boot or drained before the boot config settled. */
+    private readonly deferredUnifiedIds;
     /**
      * §13.5 live check (2026-10-09, cold start): set when an apply turns recall on (the boot apply included), cleared
      * once the maintenance tick has started the DM prewarm, or when recall is off at a tick.
@@ -1211,13 +1326,26 @@ export declare class BridgeAgent {
      * conversation per process, not once per inbound message. Bounded: cleared when it reaches 4096 entries.
      */
     private readonly recallAudienceLogged;
+    /** Plan Task 23 fix round 1: the unified tap's `audience` skip, logged once per conversation per process (the recallAudienceLogged rule). */
+    private readonly unifiedAudienceLogged;
     /** Off until a payload arrives (spec §5.3: before the first payload of a process, recall neither indexes nor reads nor purges). */
     private recallConfig;
+    /** Unified memory (U14, R-U20): the parsed payload's switch; off until a payload arrives. */
+    private unifiedConfig;
+    /** Unified memory (U14): the store's unified_enabled as last committed by applyUnifiedPayload; false on any failure. */
+    private unifiedEnabledMirror;
     /** The membership sweep now running, if any; close() waits for it (bounded). */
     private membershipSweepWork;
     /** Task 13 fix round LOW 3: when each channel last delivered an inbound row to this process. */
     private readonly lastInboundAt;
     private readonly membershipSweeper;
+    /**
+     * Unified memory (plan Task 22, spec section 8.2; H-4, H-A, CR-1): freeze and purge of an owner-DM scope on owner change.
+     * Roster facts only (OQ-P3); the persisted is_dm, never a stale in-memory one (controller ruling C8). The absence record
+     * reuses agent_memory_conversation keyed by the scope id: it holds a NUL, a channel id never does, so the keys cannot
+     * collide, and memoryConversationIds reads the content tables only, so the membership sweep never sees it.
+     */
+    private readonly ownerScopes;
     private readonly listeners;
     private startedAt;
     private readonly store;
@@ -1336,6 +1464,20 @@ export declare class BridgeAgent {
      */
     refetchRuntimeConfig(): Promise<void>;
     private refetchRuntimeConfigOnce;
+    /**
+     * Plan 4 Task 11: the refetch under a manifest in force. Returns false when the binding failed (H-4),
+     * after the memory was applied; the caller then writes nothing else. Throws only from a file write, with
+     * the binding left null.
+     */
+    private applyUnderManifest;
+    /** Spec §7.6 (plan 4 Task 15): content-free. One line per mismatched field, one per dropped target. */
+    private logConfigBinding;
+    /** H-4: the binding could not be computed. The memory still applies, with the signed mode; nothing else is written. */
+    private bindFailed;
+    /** No manifest in force: a manifest-policy.json left by an earlier one is replaced by an empty tool list. */
+    private overwriteStalePolicy;
+    /** The report half of refetchRuntimeConfigOnce (split out for the plan 4 Task 11 bind_failed path). */
+    private postRuntimeConfigReport;
     /**
      * Enforce the inbound-buffer cap with a DROP-OLDEST policy.
      *
@@ -1791,6 +1933,15 @@ export declare class BridgeAgent {
     private enforceBodyRateFloor;
     /** Bookkeeping after a CONFIRMED publish of `body` under `id`. */
     private afterPublish;
+    /**
+     * Final review bridge I-1 (ledger T25): the agent reply's U11 capture, taken BEFORE the publish await. The clear generation
+     * is the reply turn's ingest stamp (the in-reply-to message's), so a Clear all applied while the model generated the
+     * reply refuses it `cleared`; the enable epoch, room-clear generation and purge epoch are read here, before the publish.
+     * No in-reply-to, or no stamp held for it: null, and the reply is not remembered (fail closed). Switch off: null, no read.
+     */
+    private unifiedReplyCapture;
+    /** Section 7.1 agent reply, section 24.2: the owner-DM predicate for the channel at write (no sender), else nothing. Reference trust always (U18). OQ-P2: bridge-authored Pinned:/Forgot: lines are filtered by the caller. */
+    private spawnUnifiedReply;
     private isIdempotentSend;
     /**
      * SEC-06 #18: publish a reply part idempotently.
@@ -1917,6 +2068,23 @@ export declare class BridgeAgent {
      * `deliverable` refuse even before this drop runs (M-A3, M-A4).
      */
     private onConversationPurged;
+    /**
+     * The hourly sweeps (spec section 5.4; plan Task 22): the membership sweep, then, with unified memory compiled on, the
+     * owner-DM scope sweep. Each failure is logged content-free; neither escapes. Controller ruling (Task 22 fix round 1):
+     * the owner sweep is NOT gated on memory being on: "off does not purge" protects the owner's own memory from the switch;
+     * an owner change is a security event and purges whatever the mode.
+     */
+    private runMembershipSweeps;
+    /** Plan Task 22: one frozen owner-DM scope, pins included, with its read entries; the ranking worker reloads. */
+    private purgeOwnerScope;
+    /** Final review bridge I-2(c): a hot-set notification after a committed store change; a throw is logged, never escapes. */
+    private rankingNote;
+    /** H-4 facts for one channel, from the caches only (no network). */
+    private ownerFacts;
+    /** The owner-DM scope id now, or null (unknown counts as null: fail closed for reads and writes). */
+    private ownerScopeNow;
+    /** Section 24.2: the agent-reply writer's predicate: the scope now, and the roster fresh at the held MLS position or DM cycle-fresh. */
+    private ownerScopeForWrite;
     /** M6 (Task 11): idempotent get-or-create resolve of the enclave's hidden
      *  vault channel id — used as the fallback when a caller omits
      *  vaultChannelId. Mirrors connect-web's filesafe-api.ts resolveVaultChannel
@@ -1989,6 +2157,11 @@ export declare class BridgeAgent {
      * stale cache is refreshed once; any failure remains a fail-closed denial.
      */
     private mayReadOpenClawMemory;
+    /**
+     * Decision D-9 (audit H-3): a turn that failed owner verification gets only
+     * its own text, never the prior-turn history snapshot, for every provider.
+     */
+    private mayReadHistoryForTurn;
     /** An inbound turn may receive OpenClaw memory only from an active owner DM. */
     private mayReadOpenClawMemoryForTurn;
     /**
@@ -1997,6 +2170,49 @@ export declare class BridgeAgent {
      * never falls back to the runtime's retired plaintext JSON files.
      */
     private memoryForTurn;
+    /**
+     * Owner grants plan 4 Task 16 (T-30, audit r2 H-1): the voice fence is on whenever a pin is loaded, on EVERY runtime
+     * turn (manifest, fallback, greeting, relayed, constants-only alike). It never depends on a turn's grants.
+     */
+    private voiceFenceOn;
+    /** The keyed and legacy fast-reply ids of every peer row of the conversation (audit r2 M-1; never the 50-row window). */
+    private fenceContext;
+    /**
+     * Drop agent lines classified fast_path, untrusted or unknown from a turn's memory (every turn of a pinned agent).
+     * `strict` (review H-3, a turn that holds a manifest grant): relay-class peer lines go too (sender not the pinned
+     * owner, or voice modality). Otherwise peer lines are never dropped.
+     */
+    private fenceMemory;
+    /**
+     * Review H-3: true when a delivered frame holds a line a manifest turn would exclude (a relay-class peer line; agent
+     * lines in a frame are already fenced). Such a turn's reply is recorded "untrusted".
+     */
+    private frameHoldsRelayClass;
+    /**
+     * Review H-3 attribution: message ids of turns delivered on a pinned agent whose frame held no relay-class line.
+     * A reply is recorded "reply" only when its in-reply-to is here; anything else (tainted, unknown after a restart,
+     * no in-reply-to) is "untrusted". Bounded; the oldest are forgotten first (forgetting only makes a reply untrusted).
+     */
+    private readonly cleanTurns;
+    private noteDeliveredFrame;
+    private readonly taintedTurns;
+    /**
+     * Review R2-H2: on a pinned agent a 7a note or a unified memory_note is written only from a turn delivered with a clean
+     * frame in the owner DM (cleanTurns, not taintedTurns), so a tainted fallback turn cannot plant a note that a later
+     * manifest turn reads. Taint is noted at delivery, before any note frame for the turn can arrive.
+     */
+    private noteTurnClean;
+    /**
+     * Review R2-H1: the turn itself is relay-class (its frame memory is prior-turn only, so its own sender is never in it):
+     * a sender that is not the pinned owner, a relay speaker claim, or a voice turn.
+     */
+    private turnIsRelayClass;
+    /**
+     * R2-M1 ruling: the channel where the H-3 taint and the `untrusted` exclusion apply, on a pinned agent: the signed
+     * owner_dm_channel_id of the manifest in force. Before any manifest is held there is no signed DM, so every channel
+     * not known to be a room counts (fail closed: a reply recorded there before the first manifest must not reach it).
+     */
+    private taintScope;
     /**
      * Spec §11.2 (OQ-L), §6.5: apply one parsed `payload.memory`. An unreadable
      * value turns notes off and deletes nothing. A readable one goes through
@@ -2012,6 +2228,23 @@ export declare class BridgeAgent {
      * this point keeps the last applied state.
      */
     private applyPayloadMemory;
+    /**
+     * Spec section 13 (R-U20, M-7, U14). Deletions first, whatever the mode; then the switch. Never throws.
+     * Fix round 1 (controller ruling, U14 fail closed, 7a M-2 precedent): a clear that throws while the payload is above
+     * the applied generation (or a room clear above that room's) holds unified memory OFF until a later refetch applies it.
+     */
+    private applyUnifiedPayload;
+    /** Fix round 1: after a clear threw, is the payload still above what the store applied? An unreadable store is pending (fail closed). */
+    private unifiedClearPending;
+    /** section 14.3 (M-3): the database file plus its WAL (free pages are inside the file). A number, content-free. */
+    private unifiedDbBytes;
+    /**
+     * Plan Task 31 (Task 33 follow-up): the unified report keys, only while the compiled part 1 switch is on. A store read
+     * that throws omits these keys alone, so the rest of the machine report still posts; the log carries the error class only.
+     */
+    private reportedUnified;
+    /** U14, R-U20: the switch, provider securecoms, a payload confirmed, the payload on, the local key on, the store enabled. No SQL. */
+    private unifiedProviderOn;
     /** Spec §5.3 (H3): mode state lives in the store; level-triggered after every refetch. Never throws. */
     private applyRecallModeFromPayload;
     /**
@@ -2079,6 +2312,54 @@ export declare class BridgeAgent {
     private spawnRecallTap;
     /** @internal test seam: resolves once every in-flight ingest tap has settled. */
     settleRecallTaps(): Promise<void>;
+    /** @internal test seam (plan Task 23): resolves once every in-flight unified item write has settled. */
+    settleUnifiedWrites(): Promise<void>;
+    /**
+     * U11: synchronous, the first statement of every unified write. The purge epoch is the receipt one (7b fix H-2). With
+     * the ingest cycle's receipt snapshot (final review bridge M-1), the enable epoch and room-clear generation are the
+     * receipt values too, exactly as for the voice writer; the boot restore re-run has none and reads them now.
+     */
+    captureUnifiedTap(messageId: string, channelId: string, receipt?: ItemCapture): {
+        stamp: number | undefined;
+        capture: ItemCapture;
+    };
+    /**
+     * Section 7.1 owner typed, section 7.2 item 1: the frozen memory_write mark, typed (not transcribed, not voice), and the
+     * owner scope from ownerScopeForWrite (H-4: the scope comes only from the owner predicate at write, never from the
+     * audience alone). The capture was taken before this method's first await (U11). Logs are content-free (U17). Never throws.
+     */
+    private tapUnifiedTyped;
+    /**
+     * Section 7.2 item 2 (R-U7, E-1; amended by Eric 2026-10-11, "Fix voice"): exactly ownerRelayed (relay_speaker === "owner",
+     * frozen at receipt) AND a window-eligible turn (voiceWindowEligible), whatever the window size. Two call sites: the voice
+     * window flush, and the ingest tap block when the window did not take the turn (off, 0 by default). Like the typed tap, the write-time owner scope's pinned identity must be the speaking identity;
+     * otherwise nothing is written (H-4). Logs are content-free (U17). Never throws.
+     */
+    private tapUnifiedVoice;
+    /** Section 8.1 steps 1 to 7, before the turn is staged. H-4: the frozen owner predicate and the owner scope now. Never throws. */
+    private prepareUnifiedForTurn;
+    /**
+     * Plan Task 30 (spec section 14.1, M-1, OQ-P1): migrate this one conversation in the background. The owner identity comes
+     * from ownerScopeForWrite (the pinned owner, roster fresh at write; never the audience alone, H-4) and the classification
+     * from the persisted isDm: non-DM is excluded (M-4); no persisted flag or no owner scope is unknown, and an unknown or
+     * stopped run (U11) is retried by a later owner turn.
+     */
+    private startUnifiedMigration;
+    /** ws flush (synchronous). The predicate and the owner scope again at delivery, on the ORIGINAL message (H-4, Review Focus 3). */
+    unifiedForDelivery(m: BridgeMessage): {
+        items: UnifiedFrameItem[];
+        pinnedMore: number;
+    } | undefined;
+    /** ws-server: the hello echoes memory_unified only with the part 1 switch compiled on. */
+    unifiedFeatureOn(): boolean;
+    /** ws-server: a runtime socket with no harness claim declared memory_unified. */
+    noteUnifiedConsumer(): void;
+    /** One content-free unified-tap skip line (reason class only, U17). */
+    private logUnifiedTapSkip;
+    /** Fire-and-forget unified tap from the ingest cycle; tracked so close() and tests can wait for it. */
+    private spawnUnifiedTap;
+    /** The 7b M1/H-1 rule for the unified writer: turns staged before the boot config settled, tapped once it has. A turn no longer held is skipped. */
+    private reindexUnifiedRestored;
     /**
      * Spec §4 M1: after the boot refetch settles, tap the deferred turns: those
      * restored from runtime_inbox (a crash between staging and the tap) and
@@ -2188,6 +2469,24 @@ export declare class BridgeAgent {
      * taken; nothing under the mutex awaits it.
      */
     applyMemoryNote(raw: Record<string, unknown>, ctx: MemoryNoteContext): Promise<MemoryNoteResultFrame>;
+    /**
+     * Spec section 7.4 (pins) and section 14.4 (forget, Task 29), under unified memory. Order: W1, well formed, W2, W3,
+     * W4(a), W4(b), then for a pin: the C-1 allowlist (with R2-L-1), H-1 coverage on the stripped bytes, W5 (secret), the
+     * 400-character cap, W7b (the ingest stamp), the commit under U11 with W1/W2 re-checked first inside the mutex (the
+     * 200-pin cap is in the store transaction), then the bridge-authored `Pinned:` line. `replace` is refused (OQ-P4,
+     * fail closed). Every reason sent is a key of the runtime's UNIFIED_REFUSAL.
+     */
+    private applyUnifiedNote;
+    /**
+     * Spec section 14.4 ("Forget that", M-5), U13, R-U21; plan Task 29. Reached from applyUnifiedNote after W1 to W4(b) and
+     * the owner scope check (owner DM only, a typed owner turn; voice never forgets, R-U7). Only an `r<id>` of an item shown
+     * with THIS delivery of THIS message on THIS socket; its delivered text must still be known (plan audit M-6) before the
+     * message's one destructive operation (W9) is prepared. The delete (item group, matching 7a/7b row, 7b tombstone for a
+     * message origin, W9 spend) is one store transaction under the memory mutex, with W1/W2 re-checked first; the read book
+     * is invalidated in the same mutex hold, the item leaves the ranking hot set, then the bridge publishes `Forgot:`
+     * (OQ-P2: afterPublish keeps the line out of history and the items). Every reason is a key of UNIFIED_REFUSAL.
+     */
+    private forgetUnified;
     memoryContext(conversationId: string, limit?: number): Promise<import("@agentvault/connect-mls-store").MemoryContextResult>;
     /**
      * Voice front desk, step 1 — decided SYNCHRONOUSLY inside the ingest cycle,
@@ -2457,6 +2756,41 @@ export declare class BridgeAgent {
      * cycle. Fail-soft inside refreshChannelRoster (never blocks ingest).
      */
     private refreshRostersForCycle;
+    /**
+     * Owner-signed tool grants, step 1 (spec §7.2; decisions D-1, D-2, D-4, D-8,
+     * D-9; audits H-1, M-2, M-4, E-1..E-3). The verdict for one delivered turn.
+     *
+     * `unchecked` when no pin is loaded or the sender is not the pinned owner.
+     * Otherwise, in order, the first failure wins: the identity signature over the
+     * raw payload bytes with the pinned key; the verified bytes must be the
+     * decrypted envelope; in a DM only (D-1), the signed DM channel and the MLS
+     * leaf set; then the replay set and closed epochs, keyed by the agent's OWN
+     * held group (never the backend's row label, M-2). NEVER throws (M-4): any
+     * exception is `failed verify_error`, and the row is acked like any other turn.
+     */
+    private verifyOwnerTurn;
+    /** Log, count and (except a replay, audit E-3) record one failed owner-turn check. Never throws (audit E-2). */
+    private ownerTurnFailed;
+    /** Review M-A: a verified original of this id was staged and is still pending, or was recorded in the replay set. */
+    private isVerifiedOwnerOriginal;
+    /** Review M-A: a verified original of this id was staged and acked (it is in the replay set, no longer pending). */
+    private isAckedOwnerOriginal;
+    /** D-9: memory first, then the store (a restart before the reply). Unpinned: never. A store read that throws withholds (fail closed). */
+    private isOwnerVerifyFailed;
+    /**
+     * Decision D-2, audit L-2: prune the owner replay set at most once per
+     * OWNER_REPLAY_PRUNE_INTERVAL_MS, keeping each channel's current (group,
+     * epoch). A channel whose held position is unknown is left out (not pruned).
+     */
+    private maybePruneOwnerReplay;
+    /** start(): drop other keys' manifest state, re-verify the stored one for the pinned key, and prune. */
+    private loadToolGrantState;
+    /**
+     * Spec §7.1: verify and record a served manifest. Never writes a file and
+     * never changes a grant in step 1. A save that throws keeps the old state.
+     */
+    private applyToolGrantManifest;
+    private logManifest;
     /** Classify one inbound turn at the agent's CURRENT epoch for its channel. */
     private authorizeTurn;
     /**
@@ -2520,6 +2854,8 @@ export declare class BridgeAgent {
      *                            enforcement is attached
      *   memory_write             the turn carries memory_write (Markdown memory
      *                            7a, spec §8.3): a boolean, never content
+     *   grant_source             where the grants came from: constant | none in
+     *                            step 1 (owner-signed tool grants §7.6)
      */
     private logAuthzDecision;
     /**
@@ -2687,7 +3023,19 @@ export declare class BridgeAgent {
     /** Notify-only SSE signal: fired after a buffer push. Listener pulls via takeBuffered. */
     subscribe(listener: () => void): () => void;
     /** Synchronous splice of buffered messages (all, or one channel). Shared by drain + SSE. */
+    /** Review H-1: every buffer exit narrows manifest grants again to the state at delivery. */
     takeBuffered(channelId?: string): BridgeMessage[];
+    takeDeliverable(busyChannels: ReadonlySet<string>): BridgeMessage[];
+    /** Every buffer exit: re-narrow manifest grants (review H-1), then note the frame's attribution class (review H-3). */
+    private delivering;
+    /**
+     * Review H-1 (kill switches reach staged and restored turns): a grant marked source "manifest" survives delivery
+     * only while its audience's manifest switch is on, the binding is bound at the applied counter, and the current
+     * manifest still signs the tool. Otherwise it becomes the fallback: kept unmarked if it is a constant of the
+     * audience that is still signed, else dropped. Only narrows; an unchanged message is returned by reference.
+     */
+    private renarrowManifestGrants;
+    private takeBufferedRaw;
     /**
      * Phase 3 F2: per-channel ordered delivery for the /v1/ws runtime consumer.
      * Splices out, oldest first, at most ONE buffered message per channel that
@@ -2697,7 +3045,7 @@ export declare class BridgeAgent {
      * working on — which it used to refuse with a "busy" reply and ack — and a
      * backlog replays one message per channel at a time after a restart.
      */
-    takeDeliverable(busyChannels: ReadonlySet<string>): BridgeMessage[];
+    private takeDeliverableRaw;
     private hasReplyIntent;
     /**
      * SEC-06 #18: answer a redelivered message from its reply intent. Counts as
@@ -2738,6 +3086,20 @@ export declare class BridgeAgent {
      * at most once per channel per hour. Logs carry counts only.
      */
     private deadLetter;
+    /** Spec §7.5: the room is capped today: cap 0, reached (by the runtime or the backstop), or at the cap. Fails closed. */
+    private roomSearchCapped;
+    /** Spec §7.5 (T-14c, M-4): the runtime reports an executed-call cap for a room. Never throws. */
+    noteRoomCapReached(channelId: string): void;
+    /** K-14, once per room per UTC day; the flag is persisted only after the send resolves. Called only from noteRoomCapReached. */
+    private noticeRoomSearchCap;
+    private logRoomCap;
+    /**
+     * Spec §7.5 (T-14b, audit r1 H-3): the silent bridge backstop. Counts a team_room turn that actually goes out
+     * to the runtime with web_search, once per message id (callers run it after their runtimePendingIds early
+     * return). Past the cap, and on a store failure (fail closed), the entry loses web_search. Never posts K-14.
+     */
+    private applyRoomSearchBackstop;
+    private withoutWebSearch;
     private noticeDeadLetter;
     /** Poke consumers once the earliest redelivery backoff ends. */
     private armRedeliveryWake;
@@ -2883,6 +3245,24 @@ export declare class BridgeAgent {
     /** Forget `token` when its socket closes; a newer consumer's token is kept. */
     clearPerToolConsumer(token: object): void;
     perToolConsumerAttached(): boolean;
+    /**
+     * Owner grants (spec §7.9, plan 4 Task 5): the attached per-tool runtime socket whose hello
+     * declared manifest_grants_v1, or null. A manifest grant is issued only while one is attached
+     * (Task 13); every other socket receives manifest grants narrowed to the constants.
+     * Newest wins, like perToolConsumer.
+     */
+    private manifestConsumer;
+    /** OQ-5: the latest hello's class; "missing" until any hello. Reported in tool_grant_status (Task 15). */
+    private lastConsumerCapability;
+    noteManifestConsumer(token: object): void;
+    clearManifestConsumer(token: object): void;
+    manifestConsumerAttached(): boolean;
+    noteConsumerCapability(state: "ok" | "missing" | "harness_consumer"): void;
+    /**
+     * Harness re-rule (2026-10-12, audit r2 H-3): true exactly when this agent has a pin loaded and a good
+     * manifest. A harness consumer then receives [] in every audience (consumer-grants.ts withHarnessGrants).
+     */
+    harnessGrantsWithheld(): boolean;
     health(): {
         status: "ok";
         identity_id: string;
@@ -2913,6 +3293,16 @@ export declare class BridgeAgent {
         /** 7b Task 27 Step 1: bytes held by this bridge's warm recall vector caches. A number, content-free; the fleet
          *  RAM script (scripts/ops/semantic-memory-ram-budget.mjs) sums it with the shared embedder's RSS. */
         recall_cache_bytes: number;
+        /** Plan Task 27 (unified memory; present only with the part 1 switch compiled on): the ranking worker's hot-set bytes,
+         *  owner-DM turns whose read missed its deadline (U15; one per turn, counted by the read book whether the deadline was
+         *  spent in the embedder, the worker or a worker crash), owner-DM reads started, and this process id (fleet RAM script). */
+        memory_hot_bytes?: number;
+        memory_deadline_misses?: number;
+        memory_reads?: number;
+        /** Fix round 2: owner-DM reads not kept because a drop or a pin insert moved the read book's generation during them
+         *  (counted apart from memory_deadline_misses, which is deadline misses only). */
+        memory_reads_discarded?: number;
+        pid?: number;
         /** INV-CUSTODY-DURABLE §5.C.3: a decrypted, un-acked row is memory-only
          *  (its durable write failed); a restart now would lose it. */
         custody_persist_failing: boolean;

package/dist/config.d.ts

@@ -1,4 +1,5 @@
 import { type VoiceConfig } from "./voice/persona.js";
+import { type OwnerGrantPinResult } from "./grants/pin.js";
 import { type FastPathMode } from "./voice/defer-intent.js";
 export interface BridgeConfig {
     apiKey: string;
@@ -45,6 +46,14 @@ export interface BridgeConfig {
      * string "import_only" is "download".
      */
     modelSource: "download" | "import_only";
+    /** Spec section 13 (R-U20): credential `memory.enabled`. Absent or true is on; any other value is off (plan I-9). Local only: the backend cannot set it. */
+    memoryEnabled?: boolean;
+    /**
+     * Owner-signed tool grants (spec §6.1, §6.5): the grant pin, loaded once here
+     * from the credential's `owner_signing_key` and `owner-signing-key.json` beside
+     * the credential, never from the backend. Absent means `no_pin`.
+     */
+    ownerGrantPin?: OwnerGrantPinResult;
 }
 export declare const REQUIRED: readonly ["api_key", "identity_id", "device_id", "signing_private_key", "enclave_id", "api_base"];
 export declare function loadConfig(opts: {

package/dist/consumer-grants.d.ts

@@ -21,3 +21,22 @@ export declare const PER_TOOL_GRANTS_FEATURE = "per_tool_grants";
  * no non-per-tool consumer ever receives (Markdown memory 7a, review m-3).
  */
 export declare function withConsumerGrants(m: BridgeMessage, perToolConsumer: boolean): BridgeMessage;
+/** The /v1/ws hello feature of a runtime that enforces manifest grants (runtime 0.13.0+). Pinned to the runtime's by capability-parity.test.ts. */
+export declare const MANIFEST_GRANTS_FEATURE = "manifest_grants_v1";
+export declare const CONSTANT_TOOL_NAMES: Readonly<Record<"owner_dm" | "team_room", readonly string[]>>;
+/**
+ * Spec §7.9: a consumer that did not declare manifest_grants_v1 (runtime 0.12.2, a harness,
+ * every HTTP path) never receives a manifest grant. Its grants are narrowed to constants(a):
+ * a manifest-marked tool that is also a constant is kept unmarked; any other is dropped.
+ * Never mutates `m`.
+ */
+export declare function withManifestCapability(m: BridgeMessage, manifestConsumer: boolean): BridgeMessage;
+/**
+ * Harness re-rule (2026-10-12, supersedes P4 OQ-8's "constants ∩ signed"), audit r2 H-3. A harness turns
+ * ANY non-empty tool_grants into the owner's whole configured toolset (header of this file), so no
+ * non-empty list can stay within what the owner signed. On a pinned agent with a good manifest
+ * (`withheld === true`) a harness receives [] in EVERY audience. `withheld === false` (no pin, or no good
+ * manifest): `m` unchanged, by reference (today's behaviour). An issued [] is returned by reference.
+ * Never mutates `m`. Callers: the three harness delivery paths, after withConsumerGrants.
+ */
+export declare function withHarnessGrants(m: BridgeMessage, withheld: boolean): BridgeMessage;