@sigrun/sigrun 0.7.0 → 0.9.0

package/dist/extension.d.ts

@@ -32,11 +32,14 @@
  *   validated candidate shape and a compile-time key assertion, so the
  *   implementation and this contract cannot drift silently.
  */
-import type { AssistantMessage, Provider } from "@earendil-works/pi-ai";
+import type { AssistantMessage, Provider, TSchema } from "@earendil-works/pi-ai";
 import type { ConversationDocToken, ConversationId, Cursor, EntryId, EntryQuery, EntryRecord, Extension, InputSubmissionDraft, JsonObject, ModelRef, Page, SubmissionId } from "@earendil-works/pi-durable";
 import type { Access, Sharing } from "@sigrun/shared/access";
+import type { DecisionAnswers, DecisionLimits, DecisionRequest, DecisionResult } from "@sigrun/shared/decisions";
 import type { AmbientPlace, AmbientRecord } from "@sigrun/shared/ambient";
-import type { Action, DataOps, IconName, Tree } from "@sigrun/shared/blocks";
+import type { Action, CoreTarget, DataOps, IconName, Tree } from "@sigrun/shared/blocks";
+import type { UserNotice, UserNoticeInput } from "@sigrun/shared/notices";
+export type { NoticeActionResponse, NoticesResponse, UserNotice, UserNoticeAction, UserNoticeInput, } from "@sigrun/shared/notices";
 import type { InteractionAnswer, InteractionRecord } from "@sigrun/shared/interactions";
 import type { JobSpec, JobWire } from "@sigrun/shared/jobs";
 import type { AccountLinkWire, ConversationSummary, ConversationViewWire, HealthStatus, ModelEntry, SessionMeta, SlashCommand, SubmissionRecordWire, ThinkingLevelWire, UserWire as DirectoryUserWire } from "@sigrun/shared/views";
@@ -130,6 +133,10 @@ export type ExtensionLifecyclePayload = {
         readonly status: "answered" | "skipped" | "expired" | "cancelled";
         /** The answering user (C5 attribution), when a human answered. */
         readonly answeredByUser?: string;
+        /** How a DECLINE landed (ask-user Task 1/2): "button" via the decline
+         *  route/host method, "message" via an admitted decline message. Set
+         *  only on a declined ("skipped") record. */
+        readonly declinedVia?: "button" | "message";
         /** The STORED (masked-by-construction) answer values — render-safe. */
         readonly answer?: Readonly<Record<string, unknown>>;
         readonly owner?: string;
@@ -272,8 +279,28 @@ export interface CurationTarget {
     readonly name: string;
     /** Tools the review may call to write this target; registered by this extension. */
     readonly tools: readonly string[];
+    /**
+     * Read-only tools the review may call (knowledge C5): model-visible
+     * for serving and allowed inside a review, but NEVER wrapped into a
+     * review hint and never gated — the loader's wrap feed grows from
+     * `tools` only. Registered by this extension; disjoint from `tools`.
+     */
+    readonly readTools?: readonly string[];
     /** Routing guidance for one user; `[]` = unavailable for this user. */
     guidance(user: string): readonly string[] | Promise<readonly string[]>;
+    /**
+     * Whether this target wants the conversation reviewed (the fork path
+     * only — mixed-authorship conversations go to the idle digest). Core
+     * bounds each call at 2 s; a throw or timeout counts as `false`.
+     */
+    wantsReview?(user: string, conversationId: ConversationId): boolean | Promise<boolean>;
+    /**
+     * Called after a fork review of the conversation COMPLETED (after
+     * the result is recorded) — the target's signal that the review
+     * consumed its hints. Not called for any other status. Errors are
+     * caught and logged; a target must not rely on being called.
+     */
+    reviewed?(user: string, conversationId: ConversationId): void | Promise<void>;
     /** Revert one change this target reported. Required. */
     undo(user: string, changeId: string, ctx: HandlerContext): Promise<void>;
     /** Optional idle maintenance, called by the curator's idle pass. */
@@ -407,6 +434,8 @@ export type CurationEligibility = {
 export type CurationTargetInfo = {
     readonly id: string;
     readonly tools: readonly string[];
+    /** The target's declared read tools (C5; absent when it has none). */
+    readonly readTools?: readonly string[];
     readonly guidance: readonly string[];
     readonly maintain: boolean;
 };
@@ -451,8 +480,15 @@ export type SigrunCurationHost = {
     modelCallsSince(id: ConversationId, entryId?: EntryId): Promise<number>;
     /** Read and clear the conversation's pending review hints (A8's doc). */
     takeHints(id: ConversationId): Promise<readonly CurationHint[]>;
-    /** Targets whose tools are all in the conversation's selection (no id: all). */
+    /** Targets whose tools (and readTools) are all in the conversation's selection (no id: all). */
     targets(user: string, id?: ConversationId): Promise<readonly CurationTargetInfo[]>;
+    /**
+     * Whether any target served for `(user, id)` requests a review (C5):
+     * `true` when at least one served target's `wantsReview` answers
+     * true. Each target's call is bounded (2 s); a throw or timeout
+     * counts as `false`. Fork-path only — the idle digest never asks.
+     */
+    wantsReview(user: string, id: ConversationId): Promise<boolean>;
     /** The conversation's model-visible tool names (for the allow-list). */
     tools(id: ConversationId): Promise<readonly string[]>;
     /** Fork the conversation at its newest entry and drive the review run. */
@@ -518,6 +554,40 @@ export interface ProviderReadiness {
  * three-state source `/v1/auth/check` reports verbatim.
  */
 export type ReadinessTracker = () => ProviderReadiness;
+/** One decision model: a bare id plus optional limits narrower than the built-in caps. */
+export interface DecisionModelInfo {
+    readonly id: string;
+    readonly limits?: DecisionLimits;
+}
+/** The context core stamps on every decision-provider call. */
+export interface DecisionContext {
+    /** The bare model id (the `"<provider>/<model>"` spec's second half). */
+    readonly model: string;
+    /** auth.json[id].apiKey, else the ambient `credentialEnv`; never `"default"`. */
+    readonly credential: string | undefined;
+    readonly signal: AbortSignal;
+    /** The calling extension's slug, core-stamped (`"sigrun"` for the core tool). */
+    readonly caller: string;
+}
+/**
+ * One decision-provider contribution: typed questions (noul / choice /
+ * score) answered over a JSON state. A factory result carrying only
+ * `decisionProviders` is a valid contributor-only result.
+ */
+export interface DecisionProviderContribution {
+    /** `^[a-z][a-z0-9-]*$`; the auth.json key and the model prefix. */
+    readonly id: string;
+    /** Display name. */
+    readonly label?: string;
+    /** Ambient env fallback core reads when auth.json has no key. */
+    readonly credentialEnv?: string;
+    /** The fixed model list (restart-required). */
+    readonly models: readonly DecisionModelInfo[];
+    /** The chat providers' three-state readiness tracker. */
+    readonly readiness?: ReadinessTracker;
+    /** May throw; core maps a throw to `failed`. */
+    evaluate(request: DecisionRequest, ctx: DecisionContext): Promise<DecisionAnswers>;
+}
 /** One provider contribution: a pi-ai `createProvider()` result plus optional boot hints. */
 export interface ProviderContribution {
     readonly provider: Provider;
@@ -632,6 +702,34 @@ export type RunSettledOutcome = {
     readonly status: "unanswered";
     readonly reason: string;
 };
+/**
+ * The context a `noticeActions` handler runs with: who clicked, the notice
+ * as stored (its `owner` is the handler's own slug), and the dispatch
+ * deadline's signal (the 10 s action timeout).
+ */
+export interface UserNoticeActionContext {
+    readonly principal: Principal;
+    readonly notice: UserNotice;
+    readonly signal: AbortSignal;
+}
+/**
+ * What a notice action answers (notices spec §4): `ok` clears the notice
+ * unless `keep: true`; `message` shows in the client, `navigate` moves it
+ * to a core target. A failure keeps the notice and shows the error.
+ */
+export type UserNoticeActionResult = {
+    readonly ok: true;
+    readonly keep?: boolean;
+    readonly message?: string;
+    readonly navigate?: CoreTarget;
+} | {
+    readonly ok: false;
+    readonly error: {
+        readonly message: string;
+    };
+};
+/** One declared notice action handler (the `noticeActions` value shape). */
+export type UserNoticeActionHandler = (ctx: UserNoticeActionContext, payload: JsonObject) => Promise<UserNoticeActionResult>;
 /** One explicit notification an extension sends through `host.notify`. */
 export interface ExtensionNoticeInput {
     /** A directory user; `undefined` only when the directory is empty. */
@@ -987,6 +1085,12 @@ export interface SurfaceDef<P extends "view" | "panel" | "settings"> {
     readonly placement: P;
     /** Data is identical for every principal with access (§7.3). */
     readonly sharedData?: boolean;
+    /** Panels only: the channels attach this panel with
+     *  `params: { conversationId }` of the OPEN conversation, so one
+     *  instance follows the conversation the user is in. The id is
+     *  client-supplied — the extension must check the caller's access to
+     *  that conversation before rendering or acting on it. */
+    readonly perConversation?: boolean;
     /** Channels refetch data on this interval while visible (min 5000). */
     readonly refreshMs?: number;
     /** §7.3; default: canonical JSON of params. The principal argument
@@ -1133,6 +1237,15 @@ export interface SigrunHost {
     }): Promise<boolean>;
     /** Mark a pending interaction expired/cancelled/skipped (extension-owned semantics). */
     settleInteraction(conversationId: ConversationId, callId: string, status: "skipped" | "expired" | "cancelled", context: HandlerContext): Promise<boolean>;
+    /**
+     * Decline a pending DECLINABLE interaction as a human (ask-user Task
+     * 1): status "skipped", `declinedVia: "button"`. `opts.user` names
+     * the declining human (the same attribution `answerInteraction`
+     * stamps); false when the record is not pending or not declinable.
+     */
+    declineInteraction(conversationId: ConversationId, callId: string, context: HandlerContext, opts?: {
+        readonly user?: string;
+    }): Promise<boolean>;
     /**
      * Inspect one interaction record WITHOUT consuming anything: returns
      * the same stored projection as {@link SigrunHost.snapshotInteraction}
@@ -1288,6 +1401,33 @@ export interface SigrunHost {
     /** Read-only job lookup; retired and unknown ids resolve to `undefined`. */
     readonly jobs: {
         get(id: string): Promise<HostJobInfo | undefined>;
+        /**
+         * The job whose fire is CURRENTLY running in this conversation:
+         * the job with `lastRun.outcome === "running"` and
+         * `lastRun.conversationId === conversationId` — `undefined` when no
+         * job fire is running there. `owner` is the EFFECTIVE owner (the
+         * same value `get` returns: an ownerless or orphaned job resolves
+         * to the primary admin). Two matching runs resolve to the newest
+         * `startedAt`.
+         */
+        activeRun(conversationId: ConversationId): Promise<{
+            readonly jobId: string;
+            readonly owner: string | undefined;
+        } | undefined>;
+        /**
+         * Whether the conversation's CURRENT run is job-driven (ask-user
+         * Task 3, spec §6): true when the session meta carries a `jobId`
+         * (a `conversation: "new"` run), or any input of the conversation's
+         * current run (`LiveDoc` `run.inputs`, present exactly while busy)
+         * resolves to a submission whose requestId carries the job prefix
+         * (`job:<fireKey>`, the prefix `jobs/fire.ts` stamps on both fire
+         * shapes). Interactive tools call this in execute and refuse with an
+         * error telling the model to escalate instead — the execute-time
+         * guard for the conversations the creation-time filter cannot reach
+         * (a job firing into an existing conversation; defence in depth
+         * should the filter ever miss).
+         */
+        isJobRun(conversationId: ConversationId, context: HandlerContext): Promise<boolean>;
     };
     /**
      * Send one explicit notice through every registered notifier. Validation
@@ -1295,6 +1435,29 @@ export interface SigrunHost {
      * lane and this resolves without awaiting notifier completion.
      */
     notify(input: ExtensionNoticeInput): Promise<void>;
+    /**
+     * The per-user notices channel (notices spec §2): post, clear and list
+     * THIS extension's notices. `post` validates the input (fail-loud — a
+     * rejection throws `Error("<field>: <message>")` naming the offending
+     * field), checks the recipient exists and can see every conversation
+     * the notice names (`conversationId` and any `navigate` conversation
+     * target), and stores it. `clear` is owner-scoped: another extension's
+     * notice is never touched. `list` reads only this extension's notices
+     * for the user.
+     */
+    readonly notices: {
+        post(input: UserNoticeInput): Promise<{
+            id: string;
+        }>;
+        clear(selector: {
+            user: string;
+            key: string;
+        } | {
+            user: string;
+            id: string;
+        }): Promise<void>;
+        list(user: string): Promise<readonly UserNotice[]>;
+    };
     /** The user directory (admin wire form; emails are admin material). */
     readonly users: {
         list(): Promise<readonly DirectoryUserWire[]>;
@@ -1338,10 +1501,54 @@ export interface SigrunHost {
     };
     /**
      * The served model catalog (gateway C4b): the SAME list `GET
-     * /v1/models` serves (picker entries — no provider internals).
+     * /v1/models` serves (picker entries — no provider internals), plus
+     * one-shot completions with NO conversation (warden Task 4 —
+     * skill-card generation is the first consumer).
      */
     readonly models: {
         list(): Promise<readonly ModelEntry[]>;
+        /**
+         * Run ONE one-shot completion and return its concatenated text
+         * parts (non-text parts skipped) plus the `provider/id` of the
+         * model actually used. Model resolution: `input.model` wins;
+         * else the live settings' `namingModel` when it is a string
+         * (`false` counts as unset — the utility role's binding); else
+         * the boot default model. THROWS (never resolves silently) on an
+         * unserved model (naming it), a timeout (default 60 000 ms), or
+         * a `stopReason` of `error`/`aborted`.
+         */
+        complete(input: {
+            readonly model?: string;
+            readonly role?: "utility";
+            readonly systemPrompt?: string;
+            readonly prompt: string;
+            readonly timeoutMs?: number;
+            readonly signal?: AbortSignal;
+        }): Promise<{
+            readonly text: string;
+            readonly model: string;
+        }>;
+    };
+    /**
+     * Decision providers (warden Task 5 — the decision-providers spec):
+     * typed questions (noul / choice / score) answered over a JSON state.
+     * `evaluate` NEVER throws; failures arrive as the `ok: false` half of
+     * {@link DecisionResult}. Model resolution: `opts.model` wins; else
+     * the live `decisionModel` setting; else the first model of the
+     * first-registered decision provider.
+     */
+    readonly decisions: {
+        evaluate(request: DecisionRequest, opts?: {
+            model?: string;
+            signal?: AbortSignal;
+            timeoutMs?: number;
+        }): Promise<DecisionResult>;
+        /** Every decision model, with its provider's readiness status. */
+        list(): Promise<readonly {
+            model: string;
+            provider: string;
+            status: ProviderReadiness["status"];
+        }[]>;
     };
     /**
      * The slash-command surface (gateway C4b): the merged catalog for
@@ -1373,6 +1580,28 @@ export interface SigrunHost {
      * for the bridge, never a silent drop.
      */
     readonly curation: SigrunCurationHost;
+    /**
+     * The published-hook surface (knowledge C7): look up a hook another
+     * extension published (`get` returns `undefined` while loading is
+     * still running and for unowned names) or call it through the core
+     * registry. `call` NEVER throws: an unowned name is `absent`, a
+     * payload the owner's schema rejects is `rejected`, and a provider
+     * failure is `failed` with a reason. A call issued before loading
+     * finishes waits for it — never `await` one inside a factory body
+     * (stash the host; call from a tool, handler, worker, or job).
+     */
+    readonly publishedHooks: {
+        get(name: string): {
+            provider: string;
+            input: TSchema;
+            output?: TSchema;
+        } | undefined;
+        call(name: string, payload: unknown, opts?: {
+            user?: string;
+            conversationId?: ConversationId;
+            abortSignal?: AbortSignal;
+        }): Promise<PublishedHookResult>;
+    };
 }
 /**
  * The documented factory-result contract: EVERY field an extension may
@@ -1396,6 +1625,8 @@ export interface SigrunExtensionResult extends SigrunLifecycleHandlers {
     readonly name?: string;
     /** Provider contributions, merged into the boot model catalog (last-registered-wins, collisions recorded). */
     readonly providers?: readonly ProviderContribution[];
+    /** Decision-provider contributions (warden Task 5); last-registered wins per id. */
+    readonly decisionProviders?: readonly DecisionProviderContribution[];
     /** External identity providers; core qualifies ids as `login:<slug>:<id>`. */
     readonly loginProviders?: readonly LoginProviderContribution[];
     /** Webui-bundle contributions; each `dir` anchors at the extension ENTRY's directory. */
@@ -1406,6 +1637,17 @@ export interface SigrunExtensionResult extends SigrunLifecycleHandlers {
     readonly runSettled?: ExtensionRunSettledHandler;
     /** Declared interaction kinds (the seam's write gate + capability inventory). */
     readonly interactionKinds?: readonly string[];
+    /**
+     * Tool names this extension registers that need a human present
+     * (ask-user Task 3, spec §6). Validated at load like
+     * `interactionKinds` (each name must name a tool this extension's
+     * `extension.tools` registers; a bad declaration quarantines). Core
+     * hides the named tools in every non-interactive run (job run
+     * conversations, curator runs); in a job-fired EXISTING conversation
+     * the tool stays listed and must refuse at execute time — guard with
+     * `host.jobs.isJobRun`.
+     */
+    readonly interactiveTools?: readonly string[];
     /** Declared ambient surface keys (the seam's write gate + capability inventory). */
     readonly ambientKinds?: readonly string[];
     /** Idle workers (the curator contract — `wakeOn` only, `every` retired). */
@@ -1417,6 +1659,15 @@ export interface SigrunExtensionResult extends SigrunLifecycleHandlers {
      * target without `undo` fails the load.
      */
     readonly curationTargets?: readonly CurationTarget[];
+    /**
+     * Declared notice action handlers (notices Task 3): the names a posted
+     * notice's `extension` actions may name, keyed by handler name
+     * (`/^[A-Za-z][A-Za-z0-9-]{0,31}$/`). A malformed entry quarantines the
+     * extension at load.
+     */
+    readonly noticeActions?: {
+        readonly [name: string]: UserNoticeActionHandler;
+    };
     /** Declared jobs (the only time-based scheduler); read-only through the API under `ext:<slug>:<name>` ids. */
     readonly jobs?: readonly JobSpec[];
     /** HTTP routes mounted at `/v1/ext/<slug>/<path>` (lands in Task 2). */
@@ -1444,6 +1695,82 @@ export interface SigrunExtensionResult extends SigrunLifecycleHandlers {
     readonly gateway?: GatewayEngine;
     /** Declared surfaces — views and panels (UI-blocks U3, spec §7.1; the service lands in Task 2). */
     readonly surfaces?: SurfacesContribution;
+    /**
+     * Published hooks (knowledge C7): named, schema-validated calls this
+     * extension offers OTHER extensions through `host.publishedHooks`.
+     * Core compiles each schema once at load; a malformed declaration
+     * (bad name, duplicate within the extension, non-object input,
+     * non-function `run`, a schema that fails to compile) quarantines
+     * the extension. The first configured provider of a name owns it;
+     * configured providers beat built-ins.
+     */
+    readonly publishedHooks?: readonly PublishedHook[];
+}
+/**
+ * A published hook (knowledge plan, Task 1): a named, schema-validated
+ * call one extension publishes for OTHER extensions to invoke through
+ * the core registry (the extension-to-extension seam). `name` must
+ * match `/^[a-z][a-z0-9-]*(\.[a-z][a-z0-9-]*)+$/` (at least one dot,
+ * at most 128 chars). `run` receives the validated payload plus the
+ * {@link PublishedHookCall} context and resolves with the result.
+ */
+export interface PublishedHook {
+    readonly name: string;
+    readonly description?: string;
+    readonly input: TSchema;
+    readonly output?: TSchema;
+    run(payload: unknown, call: PublishedHookCall): Promise<unknown>;
+}
+/**
+ * The call context a published hook's `run` sees: the calling extension's
+ * name plus the resolved identity. `user` comes from the conversation's
+ * acting user when a `conversationId` is given, else the caller's
+ * declared user; a caller-declared user that disagrees with the
+ * conversation owner is rejected before the provider ever runs.
+ */
+export interface PublishedHookCall {
+    readonly caller: string;
+    readonly user: string | undefined;
+    readonly conversationId: ConversationId | undefined;
+    readonly abortSignal: AbortSignal | undefined;
+}
+/**
+ * The outcome of one registry call. `absent` — no provider owns the
+ * name. `ok` — the provider ran and produced a valid result. `rejected`
+ * — the call never ran (oversize/unstringifiable payload, schema
+ * mismatch, or identity disagreement). `failed` — the provider ran (or
+ * was interrupted) and could not deliver: `threw`, `timeout`, `aborted`,
+ * `bad-output`, `too-large`, or `too-deep` (depth bound).
+ */
+export type PublishedHookResult = {
+    status: "absent";
+} | {
+    status: "ok";
+    provider: string;
+    value: unknown;
+} | {
+    status: "rejected";
+    provider: string;
+    errors: {
+        path: string;
+        message: string;
+    }[];
+} | {
+    status: "failed";
+    provider: string;
+    reason: "threw" | "timeout" | "aborted" | "bad-output" | "too-large" | "too-deep";
+    error: string;
+};
+/**
+ * One extension's declaration of a published hook, in loader order.
+ * `builtin` marks core-bundled extensions: when a configured extension
+ * shadows a built-in the warning names replacing the built-in instead
+ * of reordering the extension list.
+ */
+export interface PublishedHookDeclaration {
+    readonly extension: string;
+    readonly builtin: boolean;
+    readonly hook: PublishedHook;
 }
 /**
  * The extension factory: sigrun calls it at load, passing the host

package/dist/harness/boot.js

@@ -11,7 +11,7 @@ import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
 import { join } from "node:path";
 import { Harness, } from "@earendil-works/pi-durable";
 import { openNodeSqliteStorage } from "@earendil-works/pi-durable/storage/sqlite/node";
-import { effectiveMethods } from "../config.js";
+import { DECISION_TIMEOUT_ENV, effectiveMethods } from "../config.js";
 import { requiresProxyVouch } from "../server/auth/proxy-only.js";
 import { wireActivity } from "./activity.js";
 import { snapshotBeforeMigration } from "./migration-snapshot.js";
@@ -29,6 +29,9 @@ import { AuthStore } from "./auth.js";
 import { openIdentityStores, ensureSetupCode, } from "./identity/index.js";
 import { MEMORY_SECTION_KEY, noopMemoryExtension } from "./memory-default.js";
 import { createSeamHost, } from "./seam-host.js";
+import { buildPublishedHookRegistry, } from "./published-hooks.js";
+import { buildDecisionRegistry, } from "./decisions.js";
+import { buildDecisionEvaluateTool, createDecisionsExtension, } from "./decision-tool.js";
 import { contextFilesExtension } from "./sections/context-files.js";
 import { createJobStateExtension } from "./sections/job-state.js";
 import { modelGuidanceExtension } from "./sections/model-guidance.js";
@@ -653,6 +656,15 @@ export async function openHarness(config, options = {}) {
     // can show and update interactive block surfaces in chat — the same
     // core-owned slot as the coding/search tools, never quarantined.
     registry.install(blocksToolsExtension);
+    // The decision tool (warden Task 7): installed HERE with an empty
+    // tool list — the placeholder holding the core `sigrun.decisions`
+    // name — because the decision declarations are only known AFTER the
+    // loader runs. Once the registry is built (below), boot RE-INSTALLS
+    // the extension with `decision_evaluate` when the registry lists ≥ 1
+    // decision model (`registry.install` replaces a same-name extension
+    // in place); a no-provider boot keeps the placeholder and the tool
+    // is never offered.
+    registry.install(createDecisionsExtension());
     // Extension packages load before `Harness.open` reads the registry
     // (spec §3 boot order). Failures quarantine and boot continues. §3
     // factory-result producers are retained alongside the outcomes (Task 9e).
@@ -732,6 +744,31 @@ export async function openHarness(config, options = {}) {
     });
     const bindHarness = (harness) => release(harness);
     const harnessOf = () => harnessPromise;
+    // The published-hook registry slot (knowledge C7): the deferred MUST
+    // exist before `loadExtensions` runs — seam hosts are built inside the
+    // loader's hostContextFactory and close over this slot. Boot builds
+    // the registry from the loader's declarations right after
+    // `loadExtensions` returns and resolves the deferred; a
+    // `host.publishedHooks.call` issued during loading waits on it
+    // (the harnessPromise pattern), a `get` before then reads
+    // `undefined`.
+    let publishRegistryReady;
+    const publishedHooksReady = new Promise((resolve) => {
+        publishRegistryReady = resolve;
+    });
+    const publishedHooksSlot = { registry: undefined };
+    // The decision-registry slot (warden Task 6): the SAME deferred
+    // discipline as the published-hook slot above — seam hosts are built
+    // inside the loader's hostContextFactory (before the registry can
+    // exist) and close over this slot. Boot builds the registry from the
+    // loader's declarations right after `loadExtensions` returns and
+    // resolves the deferred; a `host.decisions.evaluate` issued from a
+    // factory body waits on it.
+    let decisionRegistryReady;
+    const decisionsReady = new Promise((resolve) => {
+        decisionRegistryReady = resolve;
+    });
+    const decisionsSlot = { registry: undefined };
     // The boot-shared store trio (Task 5): one SecretsStore + one
     // ExtensionSettingsStore over the roots resolved at the top of boot;
     // each seam host scopes it to its extension's slug (cheap, no I/O —
@@ -741,7 +778,7 @@ export async function openHarness(config, options = {}) {
     const sharedStores = sharedExtensionStores(roots, env, identity.users);
     const seamHosts = new Map();
     const seamKinds = new Map();
-    const { outcomes: extensionOutcomes, healthProducers: extensionHealth, runSettledBindings, settingsChangedBindings, lifecycleBindings, workerBindings, curationBindings, userServices: userServiceBindings, providerContributors, loginProviders, webuiBundles: extensionWebuiBundles, skillRoots: extensionSkillRoots, jobBindings, routeBindings, commandBindings, notifierBindings, channelBindings, gatewayEngine, surfaces: surfaceBindings, settingsSections: settingsSectionBindings, perUserSlugs: loadedPerUserSlugs, } = await loadExtensions(loaderInputs, registry, {
+    const { outcomes: extensionOutcomes, healthProducers: extensionHealth, runSettledBindings, settingsChangedBindings, lifecycleBindings, workerBindings, curationBindings, noticeActionBindings, publishedHookDeclarations, decisionProviderDeclarations, userServices: userServiceBindings, providerContributors, loginProviders, webuiBundles: extensionWebuiBundles, skillRoots: extensionSkillRoots, jobBindings, interactiveTools: loadedInteractiveTools, routeBindings, commandBindings, notifierBindings, channelBindings, gatewayEngine, surfaces: surfaceBindings, settingsSections: settingsSectionBindings, perUserSlugs: loadedPerUserSlugs, } = await loadExtensions(loaderInputs, registry, {
         packagesDir,
         // Curator A8 (P9): the wrap feed — the loader grows it with each
         // validated target tool and wraps those tools at their install.
@@ -764,7 +801,10 @@ export async function openHarness(config, options = {}) {
                 }, sharedStores, {
                     declared: (slug) => perUserSlugs.includes(slug),
                     set: (slug, user, tools) => userTools.set(slug, user, tools),
-                }, userServices);
+                }, userServices, {
+                    publishedHooks: { current: publishedHooksSlot, ready: publishedHooksReady },
+                    decisions: { current: decisionsSlot, ready: decisionsReady },
+                });
             host.rekey({ name: extensionName }, kinds);
             // File under the final name only, and only once the load
             // resolved: the PRE-import call must NOT file (its identity is
@@ -797,6 +837,65 @@ export async function openHarness(config, options = {}) {
     // wrapping feed (isCurationTool) and the A9 host.curation surface
     // read it. An empty fold is the no-declarer deploy.
     const curation = buildCurationRegistry(curationBindings);
+    // The published-hook registry (knowledge C7): built from the loader's
+    // collected declarations the moment `loadExtensions` returns, then the
+    // deferred resolves — a `host.publishedHooks.call` issued from a
+    // factory body (still in flight) proceeds from here. `actingUser`
+    // reads through the harness deferred: a call whose conversation
+    // identity resolves during the load window waits for `Harness.open`
+    // exactly like the other bridged members. Load order between caller
+    // and provider never matters — lookup is at call time.
+    publishedHooksSlot.registry = buildPublishedHookRegistry(publishedHookDeclarations, {
+        actingUser: async (id) => {
+            const h = await harnessPromise;
+            return (await h.snapshot(SessionMetaDoc, id, BACKGROUND_CONTEXT))
+                ?.owner;
+        },
+        deadlineMs: config.publishedHookDeadlineMs,
+        warn: (message) => console.warn(message),
+    });
+    // The decision registry (warden Task 6): built from the loader's
+    // collected declarations the moment `loadExtensions` returns (the
+    // published-hook pattern above), then the deferred resolves — a
+    // `host.decisions.evaluate` issued from a factory body (still in
+    // flight) proceeds from here. The credential resolves PER CALL:
+    // `auth.json[id].apiKey` (a live read, so a key written through the
+    // providers route applies without a restart) wins over the ambient
+    // `credentialEnv` with the auth bridge's `""`-means-unset rule; the
+    // magic `"default"` key never applies (it names the default CHAT
+    // provider). The settings read is live too: `decisionModel` and
+    // `server.decisions.timeoutMs` apply without a restart.
+    decisionsSlot.registry = buildDecisionRegistry(decisionProviderDeclarations, {
+        credential: (id, credentialEnv) => {
+            const stored = authStore.read()[id]?.apiKey;
+            if (stored !== undefined)
+                return stored;
+            return credentialEnv === undefined
+                ? undefined
+                : env[credentialEnv]?.trim() || undefined;
+        },
+        readSettings: () => settingsStore.read(),
+        timeoutCapMs: config.decisions.timeoutMs,
+        // The env tier of the timeout knob: env always wins over a live
+        // file edit (the config's env-over-file precedence, per call).
+        ...(env[DECISION_TIMEOUT_ENV] === undefined || env[DECISION_TIMEOUT_ENV] === ""
+            ? {}
+            : { timeoutMs: config.decisions.timeoutMs }),
+        now: () => Date.now(),
+        warn: (message) => console.warn(message),
+    });
+    decisionRegistryReady();
+    // Warden Task 7: the late fill — swap the placeholder extension for
+    // the tool-bearing one when any decision model exists at boot.
+    if (decisionsSlot.registry !== undefined && decisionsSlot.registry.list().length > 0) {
+        registry.install(createDecisionsExtension([
+            buildDecisionEvaluateTool({
+                decisions: decisionsSlot.registry,
+                settings: settingsStore,
+            }),
+        ]));
+    }
+    publishRegistryReady();
     for (const binding of userServiceBindings) {
         userServices.register(binding.extension, binding.services, binding.packageDir);
     }
@@ -925,6 +1024,12 @@ export async function openHarness(config, options = {}) {
         // `typed` entry — there is no user turn to attribute).
         commandExpansion,
         envBuilder: undefined,
+        // Ask-user Task 3: job fires hide interactive tools (assigned with
+        // the rest of the late-bound deps after the load completes).
+        // SAFETY: the placeholder is assigned below, before any fireJob
+        // caller can run (the same late-binding pattern as `harness`/
+        // `storage`/`envBuilder` on this deps object).
+        interactiveTools: undefined,
         // Gateway C7: a deliver-carrying fire warns once per run when no
         // engine loaded (core ships none — `gatewayEngine` is undefined
         // unless an extension declared one).
@@ -1176,6 +1281,7 @@ export async function openHarness(config, options = {}) {
     // JobsService — happens after this point.
     jobRuntimeDeps.harness = harness;
     jobRuntimeDeps.storage = storage;
+    jobRuntimeDeps.interactiveTools = new Set(loadedInteractiveTools);
     // Drain the restart-limit parks reported during open before scheduling
     // resumes. A failed status patch is logged and dropped by applyParkedJobs.
     await applyParkedJobs(harness, reports.takeParked(), BACKGROUND_CONTEXT);
@@ -1252,6 +1358,7 @@ export async function openHarness(config, options = {}) {
         storage,
         curation,
         defaultModel,
+        interactiveTools: new Set(loadedInteractiveTools),
         stores: curationOf,
         skillsOptions: {
             userDir: join(roots.configDir, "skills"),
@@ -1496,6 +1603,7 @@ export async function openHarness(config, options = {}) {
         reports,
         jobRunTotals: () => jobRunTotals,
         defaultModel,
+        interactiveTools: new Set(loadedInteractiveTools),
         providerCollisions: sink.collisions,
         webuiBundles,
         webuiBundleCollisions,
@@ -1511,6 +1619,7 @@ export async function openHarness(config, options = {}) {
         identity,
         memoryHealth,
         settings: settingsStore,
+        decisions: decisionsSlot.registry,
         extensionStores: sharedStores,
         packagesDir,
         seamHosts,
@@ -1525,6 +1634,7 @@ export async function openHarness(config, options = {}) {
         },
         extensionRoutes: routeBindings,
         extensionCommands: commandBindings,
+        noticeActionBindings,
         extensionSurfaces: surfaceBindings,
         extensionSettingsSections: settingsSectionBindings,
         notifierBindings,
@@ -1534,6 +1644,7 @@ export async function openHarness(config, options = {}) {
         curation,
         curationHost,
         curationOf,
+        publishedHooks: () => publishedHooksSlot.registry?.listing() ?? [],
         workspaceRootOf: (owner) => workspaceService?.workspaceRoot(owner),
         history: { workspace: workspaceHistoryOf },
         commandExpansion,