@sixb/core 0.1.21 → 0.1.22

package/src/runtime/host.ts

@@ -10,6 +10,10 @@ import { ActionRunExecutor, registerActionRunExecutor } from "../actions/run/exe
 import type { ActionDefinition } from "../actions/types"
 import { type ActivityOptions, ActivityService } from "../activity/service"
 import type { AgentDefinitionsInput, AgentToolDefinition } from "../agents"
+import {
+  createAgentApprovalExecutor,
+  registerAgentApprovalExecutor,
+} from "../agents/approval-executor"
 import {
   AuthRuntime,
   AuthRuntimeError,
@@ -90,6 +94,7 @@ import {
   type DatasetVersionMarkings,
   registerDatasetVersionMarkings,
 } from "../security/dataset-version-markings"
+import { assertViewConditionsReadable } from "../security/view-conditions"
 import type { ParamsConfig } from "../shared/params/types"
 import type { ShareDefinition } from "../shares"
 import type { Storage } from "../storage"
@@ -227,6 +232,12 @@ export class SixbHost<in out TParams extends ParamsConfig = ParamsConfig> {
     this.projectRoot = resolve(options.projectRoot ?? process.cwd())
 
     const definitions = resolveDefinitions(options)
+    assertViewConditionsReadable({
+      projectId: this.projectId,
+      conditions: definitions.security.listViewConditions(),
+      objectStorage: this.storage.objects,
+      getSubTypes: (objectTypeId) => definitions.ontology.listSubTypes(objectTypeId),
+    })
     this.definitions = definitions
     this.sandboxDefinition =
       options.sandboxes?.configuration === undefined
@@ -259,6 +270,7 @@ export class SixbHost<in out TParams extends ParamsConfig = ParamsConfig> {
       storage: this.storage,
       security: definitions.security,
       config: options.auth,
+      events: this.eventService,
     })
     validateAuthStrategySecurityReferences(this.auth.getStrategy(), definitions.security)
     const connectors = definitions.connectors.list()
@@ -325,7 +337,7 @@ export class SixbHost<in out TParams extends ParamsConfig = ParamsConfig> {
       broker: this.broker,
       ontology: definitions.ontology,
       actionRegistry: definitions.actions,
-      events: this.events,
+      events: this.eventService,
       storage: this.storage,
       queues: this.queues,
     }
@@ -335,6 +347,10 @@ export class SixbHost<in out TParams extends ParamsConfig = ParamsConfig> {
     const executor = new ActionRunExecutor(this)
     registerActionRunExecutor(this, executor)
     registerActionRunExecutor(this.hostContext, executor)
+    // Deciding on a held Agent call runs it under another execution than the decider's.
+    const approvals = createAgentApprovalExecutor(this)
+    registerAgentApprovalExecutor(this, approvals)
+    registerAgentApprovalExecutor(this.hostContext, approvals)
     registerVectorIndexingRuntime(
       this,
       createVectorIndexingRuntime(this.hostContext, this.materializer)
@@ -367,6 +383,7 @@ export class SixbHost<in out TParams extends ParamsConfig = ParamsConfig> {
       embeddingModels,
       rerankingModels,
       appliedMarkings: this.appliedMarkings,
+      users: this.storage.auth?.users,
     })
 
     const runtime: SixbRuntimeContext = {

package/src/runtime/index.ts

@@ -61,4 +61,6 @@ export type {
   TelemetryHistoryInput,
   TelemetryPropertyToken,
   TwinObject,
+  UniquePropertyToken,
+  UniquePropertyValue,
 } from "./types"

package/src/runtime/resolve-definitions.ts

@@ -1,6 +1,7 @@
 import { ActionRegistry } from "../actions"
 import type { ActionDefinition } from "../actions/types"
 import type { AgentDefinitionsInput, AgentToolDefinition } from "../agents"
+import { assertTurnModelRouting } from "../agents/model-routing"
 import { assertNoAgentDefinitions } from "../agents/retired-config"
 import { createAgentSkillCatalog } from "../agents/skills"
 import { createAgentToolCatalog } from "../agents/tool-catalog"
@@ -79,6 +80,7 @@ export function resolveDefinitions(options: DefinitionOptions): ResolvedDefiniti
   })
 
   const models = options.models === undefined ? undefined : createModelCatalog(options.models)
+  assertTurnModelRouting(models)
   for (const type of ontology.listObjectTypes()) {
     for (const [name, profile] of Object.entries(type.search?.vectors ?? {})) {
       const registered = models?.embedding.getByRef({
@@ -186,6 +188,7 @@ export function resolveDefinitions(options: DefinitionOptions): ResolvedDefiniti
     connectorIds: new Set(connectorsById.keys()),
     shareIds: new Set(sharesById.keys()),
     getSubTypes: (objectTypeId) => ontology.listSubTypes(objectTypeId),
+    ontology,
   })
   validateWorkflowAgentStepGroupReferences(workflows, security)
 

package/src/runtime/sixb.ts

@@ -21,10 +21,13 @@ import { createEventsRuntime, type EventsRuntime } from "../events/execution"
 import type { ExecutionContext } from "../execution"
 import { resolveExecutionScopeAuthorization } from "../execution/authorization"
 import { assertAuthorizedObjectReaderBinding } from "../execution/authorized-object-reader"
+import { registerRequestPreparation } from "../execution/preparation"
 import type { LakeStorage } from "../lake-storage/types"
 import { createLogsRuntime, type LogsRuntime } from "../logging/execution"
 import type { LoggingService } from "../logging/service"
+import { createDecisionRuntime } from "../models/decision/runtime"
 import { createModelsRuntime } from "../models/execution"
+import { ModelExecutionSession } from "../models/execution/session"
 import type { ModelsRuntime } from "../models/generation-types"
 import { createObjectsRuntime, type ObjectsRuntime } from "../objects/execution"
 import { createPipelinesRuntime, type PipelinesRuntime } from "../pipelines/execution"
@@ -35,6 +38,7 @@ import { createSchedulesRuntime, type SchedulesRuntime } from "../schedules/exec
 import type { DatasetVersionMarkings } from "../security/dataset-version-markings"
 import { createSharesRuntime, type SharesRuntime } from "../shares/execution"
 import { createSyncsRuntime, type SyncsRuntime } from "../syncs/execution"
+import { createUsersRuntime, type UsersRuntime } from "../users"
 import { createWorkflowsRuntime, type WorkflowsRuntime } from "../workflows/execution"
 import type { SixbDefinitions } from "./definitions"
 import { shareOntologyMutationRuntime } from "./ontology-mutations"
@@ -60,6 +64,7 @@ export interface Sixb<TParams extends Record<string, unknown> = Record<string, u
   readonly activity: ActivityRuntime
   readonly schedules: SchedulesRuntime
   readonly shares: SharesRuntime
+  readonly users: UsersRuntime
   readonly connector: ConnectorRuntime
   readonly blobs: BlobsRuntime
 }
@@ -101,6 +106,7 @@ export function createBoundSixb<TParams extends Record<string, unknown> = Record
   }
   shareOntologyMutationRuntime(runtime, sixb)
   registerActivityCaptureRuntime(sixb, createActivityCaptureRuntime(runtime, dependencies.activity))
+  registerRequestPreparation(sixb, runtime, execution, dependencies.definitions.workflows)
   if (dependencies.connectorConnections) {
     registerConnectorConnectionsRuntime(
       sixb,
@@ -123,9 +129,28 @@ function createExecutionFacades<TParams extends Record<string, unknown>>(
   execution: ExecutionContext,
   dependencies: SixbDependencies
 ): Omit<Sixb<TParams>, "execution"> {
+  const actions = createActionsRuntime(runtime, execution)
+  const workflows = createWorkflowsRuntime(runtime, execution, dependencies.definitions.workflows)
+  // One session per execution: the facade's model calls and the Agent's decisions share its
+  // accounting, AI limits and cancellation.
+  const session = runtime.modelExecution ?? new ModelExecutionSession(runtime, execution)
+  const agent = createAgentRuntime<TParams>(
+    runtime,
+    execution,
+    dependencies.definitions.models,
+    createDecisionRuntime(
+      runtime,
+      execution,
+      dependencies.definitions.models,
+      session,
+      "agent.run"
+    ),
+    dependencies.sandbox,
+    dependencies.definitions.security
+  )
   return {
     objects: createObjectsRuntime(runtime, execution, dependencies.blobStorage),
-    actions: createActionsRuntime(runtime, execution),
+    actions,
     datasets: createDatasetsRuntime(
       runtime,
       execution,
@@ -134,22 +159,23 @@ function createExecutionFacades<TParams extends Record<string, unknown>>(
       dependencies.blobStorage,
       dependencies.datasetVersionMarkings
     ),
-    workflows: createWorkflowsRuntime(runtime, execution, dependencies.definitions.workflows),
+    workflows,
     syncs: createSyncsRuntime(runtime, execution, dependencies.definitions.syncs),
     pipelines: createPipelinesRuntime(runtime, execution, dependencies.definitions.pipelines),
     projections: createProjectionsRuntime(runtime, dependencies.definitions.projections),
     rules: createRulesRuntime(runtime, dependencies.definitions.rules),
-    agent: createAgentRuntime<TParams>(
-      runtime,
-      execution,
-      dependencies.definitions.models,
-      dependencies.sandbox
-    ),
+    agent,
     artifacts: createArtifactsRuntime(runtime, dependencies.blobStorage),
     models: createModelsRuntime(
       runtime,
       execution,
       dependencies.definitions.models,
+      session,
+      {
+        canViewActionRun: async (id) => (await actions.runs.getById(id)) !== null,
+        canViewWorkflowRun: async (id) => (await workflows.runs.getById(id)) !== null,
+        canViewAgentRun: async (id) => (await agent.runs.getById(id)) !== null,
+      },
       dependencies.blobStorage
     ),
     aiUsage: createAiUsageRuntime(runtime, dependencies.definitions.security),
@@ -158,6 +184,7 @@ function createExecutionFacades<TParams extends Record<string, unknown>>(
     activity: createActivityRuntime(runtime, dependencies.activity),
     schedules: createSchedulesRuntime(runtime, dependencies.definitions.schedules),
     shares: createSharesRuntime(runtime, execution, dependencies.definitions.shares),
+    users: createUsersRuntime(runtime),
     connector: createConnectorRuntime(runtime, execution, dependencies.connectorService),
     blobs: createBlobsRuntime(
       runtime,

package/src/runtime/types.ts

@@ -10,6 +10,7 @@ import type { AuthorizationContext } from "../authorization"
 import type { OpenedFileRef } from "../blob-storage"
 import type { Broker } from "../broker"
 import type { DomainEventLog } from "../events"
+import type { ObjectEventHistory } from "../events/service"
 import type { RuntimeAuthorization } from "../execution"
 import type { AuthorizedObjectReader } from "../execution/authorized-object-reader"
 import type { EmbeddingModelCatalog, RerankingModelCatalog, RerankingModelRef } from "../models"
@@ -43,8 +44,10 @@ import type {
   ObjectTypeWithPropertyTokens,
   PropertyToken,
 } from "../ontology/tokens"
+import type { CurrentUserRef, UserRef } from "../ontology/user-ref"
 import type { Queues } from "../queues"
 import type { ActionRunRecord, ObjectLinkRow, Redactions, Storage } from "../storage"
+import type { UserProfile } from "../users"
 // ── Shared runtime context ──────────────────────────────────
 
 /**
@@ -60,7 +63,7 @@ export interface SixbHostContext {
   readonly broker: Broker
   readonly ontology: OntologyRegistry
   readonly actionRegistry: ActionDefinitionCatalog
-  readonly events: DomainEventLog
+  readonly events: DomainEventLog & ObjectEventHistory
   readonly storage: Storage
   readonly queues: Queues
 }
@@ -168,6 +171,17 @@ type PropertyWhereValue<
   TPropertyId extends TObjectType["properties"][number]["id"],
 > = InferPropertyValue<PropertyById<TObjectType, TPropertyId>>
 
+/** A value a predicate compares with a user reference may be `currentUser()` instead. */
+type WithCurrentUser<TValue> = [Extract<NonNullable<TValue>, UserRef>] extends [never]
+  ? TValue
+  : TValue | CurrentUserRef
+
+/** The value `eq`, `neq` and `in` compare: the property's, or the reading user's. */
+type PropertyWhereEqualityValue<
+  TObjectType extends ObjectTypeWithPropertyTokens,
+  TPropertyId extends TObjectType["properties"][number]["id"],
+> = WithCurrentUser<PropertyWhereValue<TObjectType, TPropertyId>>
+
 type PropertyWhereContainsValue<
   TObjectType extends ObjectTypeWithPropertyTokens,
   TPropertyId extends TObjectType["properties"][number]["id"],
@@ -175,15 +189,25 @@ type PropertyWhereContainsValue<
   NonNullable<PropertyWhereValue<TObjectType, TPropertyId>> extends string
     ? string
     : NonNullable<PropertyWhereValue<TObjectType, TPropertyId>> extends readonly (infer TItem)[]
-      ? TItem
+      ? WithCurrentUser<TItem>
       : NonNullable<PropertyWhereValue<TObjectType, TPropertyId>> extends Record<string, unknown>
         ? string
         : never
 
+type PropertyWhereEqualityClause<
+  TObjectType extends ObjectTypeWithPropertyTokens,
+  TPropertyId extends TObjectType["properties"][number]["id"],
+> = Omit<ObjectQueryPredicateComparison, "op" | "propertyId" | "value"> & {
+  op: "eq" | "neq"
+  propertyId: TPropertyId
+  value: PropertyWhereEqualityValue<TObjectType, TPropertyId>
+}
+
 type PropertyWhereComparisonClause<
   TObjectType extends ObjectTypeWithPropertyTokens,
   TPropertyId extends TObjectType["properties"][number]["id"],
-> = Omit<ObjectQueryPredicateComparison, "propertyId" | "value"> & {
+> = Omit<ObjectQueryPredicateComparison, "op" | "propertyId" | "value"> & {
+  op: "lt" | "lte" | "gt" | "gte"
   propertyId: TPropertyId
   value: PropertyWhereValue<TObjectType, TPropertyId>
 }
@@ -193,7 +217,7 @@ type PropertyWhereInClause<
   TPropertyId extends TObjectType["properties"][number]["id"],
 > = Omit<ObjectQueryPredicateIn, "propertyId" | "values"> & {
   propertyId: TPropertyId
-  values: readonly PropertyWhereValue<TObjectType, TPropertyId>[]
+  values: readonly PropertyWhereEqualityValue<TObjectType, TPropertyId>[]
 }
 
 type PropertyWhereExistsClause<
@@ -217,11 +241,11 @@ type PropertyPredicate<
   TPropertyId extends TObjectType["properties"][number]["id"],
 > = {
   eq(
-    value: PropertyWhereValue<TObjectType, TPropertyId>
-  ): PropertyWhereComparisonClause<TObjectType, TPropertyId> & { op: "eq" }
+    value: PropertyWhereEqualityValue<TObjectType, TPropertyId>
+  ): PropertyWhereEqualityClause<TObjectType, TPropertyId> & { op: "eq" }
   neq(
-    value: PropertyWhereValue<TObjectType, TPropertyId>
-  ): PropertyWhereComparisonClause<TObjectType, TPropertyId> & { op: "neq" }
+    value: PropertyWhereEqualityValue<TObjectType, TPropertyId>
+  ): PropertyWhereEqualityClause<TObjectType, TPropertyId> & { op: "neq" }
   lt(
     value: PropertyWhereValue<TObjectType, TPropertyId>
   ): PropertyWhereComparisonClause<TObjectType, TPropertyId> & { op: "lt" }
@@ -235,7 +259,7 @@ type PropertyPredicate<
     value: PropertyWhereValue<TObjectType, TPropertyId>
   ): PropertyWhereComparisonClause<TObjectType, TPropertyId> & { op: "gte" }
   in(
-    values: readonly PropertyWhereValue<TObjectType, TPropertyId>[]
+    values: readonly PropertyWhereEqualityValue<TObjectType, TPropertyId>[]
   ): PropertyWhereInClause<TObjectType, TPropertyId>
   exists(value?: boolean): PropertyWhereExistsClause<TObjectType, TPropertyId>
   contains(
@@ -252,6 +276,7 @@ type PropertyWhereClause<TObjectType extends ObjectTypeWithPropertyTokens> =
         | ObjectQueryPredicateContains
     : {
         [TPropertyId in TObjectType["properties"][number]["id"]]:
+          | PropertyWhereEqualityClause<TObjectType, TPropertyId>
           | PropertyWhereComparisonClause<TObjectType, TPropertyId>
           | PropertyWhereInClause<TObjectType, TPropertyId>
           | PropertyWhereExistsClause<TObjectType, TPropertyId>
@@ -628,6 +653,32 @@ type WithExpansion<
     : TRow
   : TRow
 
+/** A `ref.user()` property, or an array of them: the properties `.expand()` resolves to profiles. */
+type UserPropertyToken<TObjectTypeId extends string> = PropertyToken<
+  TObjectTypeId,
+  string,
+  Property & {
+    readonly schema: "userRef" | { readonly type: "array"; readonly items: "userRef" }
+  }
+>
+
+/** One profile, or `null` when empty or no member has the id; the members found for an array. */
+type UserExpansionValue<TToken extends UserPropertyToken<string>> =
+  TToken["property"]["schema"] extends "userRef" ? UserProfile | null : UserProfile[]
+
+/**
+ * Add the `users` entry of one expanded user property to `TRow`, distributing over a polymorphic
+ * row like {@link WithExpansion}. The entry is optional: it is absent when the reader may not view
+ * the member directory or cannot read the property.
+ */
+type WithUserExpansion<TRow, TToken extends UserPropertyToken<string>> = TRow extends {
+  objectTypeId: infer TObjectTypeId
+}
+  ? TToken["objectTypeId"] extends TObjectTypeId
+    ? TRow & { users: { [K in TToken["id"]]?: UserExpansionValue<TToken> } }
+    : TRow
+  : TRow
+
 /**
  * The nested-expansion callback for a link token's resolved target type. `TChildRow`
  * is inferred from the returned builder, recovering the nested `.links` shape.
@@ -652,6 +703,10 @@ export interface ObjectExpandBuilder<
   in out TObjectType extends ObjectTypeWithPropertyTokens,
   out TRow = ExpandedTargetRow<TObjectType>,
 > {
+  /** Attach the profiles of the members a `ref.user()` property names, under `users`. */
+  expand<TToken extends UserPropertyToken<TObjectType["id"]>>(
+    property: TToken
+  ): ObjectExpandBuilder<TObjectType, WithUserExpansion<TRow, TToken>>
   expand<
     TLinkToken extends LinkToken<TObjectType["id"], string, LinkTargetObjectTypeIdValue>,
     TChildRow = ExpandedTargetRow<ObjectTypeForLinkTarget<TObjectType, TLinkToken>>,
@@ -727,7 +782,15 @@ export interface ObjectQueryBuilder<
    * optional `linkProperties` and its own nested `.links`). Targets are precise
    * when they are registered or linked directly, and otherwise degrade to the
    * loose base.
+   *
+   * Given a `ref.user()` property, or an array of them, it attaches the members' profiles
+   * under `users` instead (`row.users.assignee`): a profile or `null` for one reference, the
+   * members found for an array. The entry is absent unless the reader has
+   * `can.view(project.users)`, and for a value the reader cannot read.
    */
+  expand<TToken extends UserPropertyToken<TObjectType["id"]>>(
+    property: TToken
+  ): ObjectQueryBuilder<TObjectType, WithUserExpansion<TRow, TToken>>
   expand<
     TLinkToken extends LinkToken<TObjectType["id"], string, LinkTargetObjectTypeIdValue>,
     TChildRow = ExpandedTargetRow<ObjectTypeForLinkTarget<TObjectType, TLinkToken>>,
@@ -806,6 +869,24 @@ export interface ObjectReadByIdHandle<out TObjectType extends ObjectTypeWithProp
   file(property: FileListPropertyToken<TObjectType>, index: number): ObjectFileHandle
 }
 
+/**
+ * The token of a property declared `unique: true`. A type whose id is only `string` accepts any of
+ * its tokens: the property is then checked when the lookup runs.
+ */
+export type UniquePropertyToken<TObjectType extends ObjectTypeWithPropertyTokens> =
+  string extends TObjectType["id"]
+    ? TObjectType["p"][keyof TObjectType["p"]]
+    : Extract<
+        TObjectType["p"][keyof TObjectType["p"]],
+        { readonly property: { readonly unique: true } }
+      >
+
+/** The value `getBy` takes for a unique property: the value a write gives it, never `null`. */
+export type UniquePropertyValue<
+  TObjectType extends ObjectTypeWithPropertyTokens,
+  TToken extends UniquePropertyToken<TObjectType>,
+> = NonNullable<ObjectTypeProperties<TObjectType>[TToken["id"]]>
+
 /**
  * The reads of an object set, declared once: `sixb.objects(Type)`, a Workflow step's
  * `sixb.objects(Type)` and an Action's `read.objects(Type)` add only their own writes on top.
@@ -814,6 +895,15 @@ export interface ObjectReadSet<in out TObjectType extends ObjectTypeWithProperty
   /** Get an object by id, or null if it doesn't exist. */
   get(id: string): Promise<TwinObject<TObjectType> | null>
 
+  /**
+   * Get the object of exactly this type holding a value of a unique property, or null. Values
+   * compare as writes store them, exactly; `null` belongs to no object.
+   */
+  getBy<TToken extends UniquePropertyToken<TObjectType>>(
+    property: TToken,
+    value: UniquePropertyValue<TObjectType, TToken>
+  ): Promise<TwinObject<TObjectType> | null>
+
   /** Build an executable provider-neutral object query rooted at this object type. */
   query(): ObjectQueryBuilder<TObjectType>
 

package/src/schedules/builders.ts

@@ -178,9 +178,11 @@ function assertEventSource(source: EventSelectorSpec): void {
     case "pipelines":
       assertNonEmpty(source.pipelineId ?? "", "event source pipelineId")
       return
+    case "users":
+      return
     default:
       throw new ScheduleValidationError(
-        "Schedule event source must select object, link, rule, dataset, sync, or pipeline events."
+        "Schedule event source must select object, link, rule, dataset, sync, pipeline, or member events."
       )
   }
 }

package/src/schedules/runtime.ts

@@ -106,6 +106,12 @@ export function buildEventScheduleContext(event: DomainEvent): RuntimeEventSched
       return { ...event.payload }
     case "pipeline.run.finished":
       return { ...event.payload }
+    case "user.joined":
+    case "user.suspended":
+    case "user.reactivated":
+    case "user.invited":
+    case "user.profile.updated":
+      return { ...event.payload }
     default:
       return null
   }

package/src/schedules/validation.ts

@@ -11,6 +11,13 @@ const ruleEventTypes = new Set(["rule.triggered", "rule.resolved"])
 const datasetEventTypes = new Set(["dataset.version.committed"])
 const syncEventTypes = new Set(["sync.run.finished"])
 const pipelineEventTypes = new Set(["pipeline.run.finished"])
+const userEventTypes = new Set([
+  "user.joined",
+  "user.suspended",
+  "user.reactivated",
+  "user.invited",
+  "user.profile.updated",
+])
 const runStatuses = new Set(["succeeded", "failed", "cancelled"])
 const linkIdentityFields = new Set(["target.objectTypeId", "target.primaryId"])
 
@@ -147,9 +154,11 @@ function assertEventSourceShape(
       assertNonEmptyString(value.pipelineId, `${path} pipelineId`, createError)
       assertRunStatus(value.runStatus, path, createError)
       return
+    case "users":
+      return
     default:
       throw createError(
-        `${path} must select object, link, rule, dataset, sync, or pipeline events.`
+        `${path} must select object, link, rule, dataset, sync, pipeline, or member events.`
       )
   }
 }
@@ -234,6 +243,9 @@ function validateEventSchedule(
         "pipeline"
       )
       return
+    case "users":
+      validateMemberSource(schedule)
+      return
   }
 }
 
@@ -295,6 +307,16 @@ function validateRegisteredSource(
   }
 }
 
+// The project has one member directory, so a member event source names nothing to look up.
+function validateMemberSource(schedule: EventScheduleDefinition): void {
+  validateEventTypes(schedule, userEventTypes, "member")
+  if (schedule.trigger.condition) {
+    throw new ScheduleValidationError(
+      `Schedule "${schedule.id}": member event sources do not support .where() conditions.`
+    )
+  }
+}
+
 function validateEventTypes(
   schedule: EventScheduleDefinition,
   supportedTypes: ReadonlySet<string>,

package/src/security/README.md

@@ -0,0 +1,62 @@
+# View conditions
+
+`can.view(Type).where(...)` grants a principal only the objects of `Type` its condition matches.
+This note follows a condition from the role that declares it to every surface that names an
+object. The public contract is in `docs/auth/authorization.md`.
+
+## Startup
+
+1. `view-conditions.ts` validates each condition as a filter over the type and the subtypes the
+   grant covers. It refuses marked properties and ordered text comparisons, and keeps the
+   validated predicate, scalar kinds resolved and frozen.
+2. `registry.ts` resolves them per role with `resolveRoleViewConditions`
+   (`authorization/resolve.ts`): one predicate per concrete type, subtypes included, `or` across
+   the role's conditions. A type the role also views whole drops them.
+3. The `SixbHost` constructor compiles each one through the object storage's conditional scope
+   (`assertViewConditionsReadable`), so a predicate the provider cannot read fails startup and
+   not every read of its type.
+
+## Resolution: closed by default
+
+`resolveAuthorizationContext` (`authorization/resolve.ts`) unions roles. A conditional grant never
+reaches `view:object`: its types land in `viewConditions`, one predicate per role, and a type any
+role views whole leaves `viewConditions`.
+
+Every check that decides on `view:object` therefore denies a conditioned type. That is the safe
+default: a surface that does not know about conditions shows nothing, never everything.
+
+## Reading through the reader
+
+`ObjectReaderSecurity` (`execution/object-reader-security.ts`) turns the context's conditions into
+one compiled conditional scope, `or` across roles. `currentUser()` binds to the context's principal
+when it is a user, and to no one otherwise: never to `execution.requestedBy`, the user an agent's
+service account may run for. Queries keep binding it to the requester.
+
+`AuthorizedObjectReader` reads through `createConditionalReadScope` for that scope, so get, list,
+query, count, facets, search, links and traversals see only matching objects, before `LIMIT` and
+totals. A condition reading a property the reader's clearance hides (a marking a
+dataset version applied) hides the whole type.
+
+`viewsThroughCondition(type)` tells the other surfaces when to read through the reader instead of
+deciding on the type:
+
+| Surface | Where | How |
+| --- | --- | --- |
+| Events | `events/view-conditions.ts` | Object events match the state they carry with `matchesPredicate`; an update that reveals an object loses the values it replaced. Link, telemetry and rule events read their objects through the reader, one batch per call (`visibleObjects`). One of them since deleted is decided on what it held when the event happened: storage tells which unseen objects still exist, and the log's last event of each other one gives its state then (`ObjectEventHistory`). |
+| Telemetry reads | `execution/authorized-object-reader.ts` | Property checks by id read the objects through the reader. |
+| Action runs | `actions/run-authorization.ts`, `actions/execution.ts` | A run shows while its subject reads. Run storage cannot filter by a condition: a listing that names the subject reads it first; any other listing leaves the type out. |
+| Rule matches | `rules/execution.ts` | Same rule as runs: listed per object. |
+| Actions | `actions/request.ts`, `actions/run/context.ts`, `actions/execution.ts` | The subject and `ref()` params must read, or the request fails as not found. Each attempt of the run confirms its requester sees the subject at the version it loaded, so handlers never run on a hidden state. Actions on the type are listed as the reader's ontology lists it. |
+| Writes | `objects/conditional-writes.ts` | Each named object is read first; the commit expects it as read, so one hidden meanwhile is never written. A hidden id reports as taken. |
+| Share issuance | `shares/execution.ts` | The target is read through the issuer's reader; a hidden one is not found. Each type the share's links reach needs `view:object`: a link keeps showing whatever it reaches. The issued link holds its own grants, so it keeps the target after the target stops matching. |
+
+Restores, telemetry appends and projection runs keep deciding on `view:object`, so they stay
+closed to a conditioned type.
+
+## Adding a surface
+
+A surface that names an object must never treat a conditioned type as viewable by its type alone:
+neither `isAllowed(..., { kind: "object.view" })` nor a type list built from `view:object` can
+answer for one object of it. Read the object through the principal's `AuthorizedObjectReader`, as
+the surfaces above do, or leave the type closed. Readers that view a type whole should keep
+answering without a read.