@suveren/gateway 0.3.17 → 0.4.0

package/profiles/customers/0.4.profile.json

@@ -2,7 +2,7 @@
   "id": "github.com/humanagencyprotocol/hap-profiles/customers@0.4",
   "name": "Customer Management",
   "version": "0.4",
-  "description": "Customer authority \u2014 governs CRM operations: contacts, activities, deals, tasks",
+  "description": "Customer authority — governs CRM operations: contacts, activities, deals, tasks",
   "boundsSchema": {
     "keyOrder": [
       "profile",
@@ -52,8 +52,8 @@
       "contact_type": {
         "type": "string",
         "required": true,
-        "displayName": "Contact types",
-        "description": "Permitted contact types",
+        "displayName": "Contact types the agent may create or modify",
+        "description": "Contact types the agent may create, update or delete. Does NOT restrict reading — reads are governed by read_access.",
         "enum": [
           "customer",
           "lead",
@@ -108,5 +108,8 @@
     "max": 31536000
   },
   "retention_minimum": 7776000,
-  "content_binding": { "version": "1", "kind": "jcs" }
+  "content_binding": {
+    "version": "1",
+    "kind": "jcs"
+  }
 }

package/profiles/customers/0.5.profile.json

@@ -0,0 +1,131 @@
+{
+  "id": "github.com/humanagencyprotocol/hap-profiles/customers@0.5",
+  "name": "Customer Management",
+  "version": "0.5",
+  "description": "Customer authority — governs CRM operations: contacts, activities, deals, tasks",
+  "boundsSchema": {
+    "keyOrder": [
+      "profile",
+      "read_access",
+      "write_daily_max",
+      "delete_daily_max"
+    ],
+    "fields": {
+      "profile": {
+        "type": "string",
+        "required": true
+      },
+      "read_access": {
+        "type": "string",
+        "required": true,
+        "displayName": "Read access",
+        "description": "Allow the agent to browse contacts, timelines, pipeline, tasks, and export CRM data",
+        "boundType": {
+          "kind": "enum",
+          "values": [
+            "unlimited",
+            "none"
+          ]
+        },
+        "toolsDescription": "find_contacts, get_timeline, get_pipeline, list_tasks, export_crm",
+        "default": "unlimited"
+      },
+      "write_daily_max": {
+        "type": "number",
+        "required": true,
+        "displayName": "Daily write limit",
+        "description": "Maximum CRM write operations per day (creates, updates)",
+        "unit": "count",
+        "boundType": {
+          "kind": "cumulative_count",
+          "window": "daily"
+        },
+        "paths": [
+          "customers-write"
+        ]
+      },
+      "delete_daily_max": {
+        "type": "number",
+        "required": true,
+        "displayName": "Daily delete limit",
+        "description": "Maximum CRM delete operations per day",
+        "unit": "count",
+        "boundType": {
+          "kind": "cumulative_count",
+          "window": "daily"
+        },
+        "paths": [
+          "customers-delete"
+        ]
+      }
+    }
+  },
+  "contextSchema": {
+    "keyOrder": [
+      "contact_type"
+    ],
+    "fields": {
+      "contact_type": {
+        "type": "string",
+        "required": true,
+        "displayName": "Contact types the agent may create or modify",
+        "description": "Contact types the agent may create, update or delete. Does NOT restrict reading — reads are governed by read_access.",
+        "enum": [
+          "customer",
+          "lead",
+          "partner",
+          "vendor"
+        ],
+        "constraint": {
+          "type": "string",
+          "enforceable": [
+            "subset"
+          ]
+        }
+      }
+    }
+  },
+  "executionContextSchema": {
+    "fields": {
+      "contact_type": {
+        "source": "declared",
+        "description": "Contact type being accessed",
+        "required": true,
+        "constraint": {
+          "type": "string",
+          "enforceable": [
+            "subset"
+          ]
+        }
+      },
+      "write_count_daily": {
+        "source": "cumulative",
+        "cumulativeField": "_count",
+        "window": "daily",
+        "description": "Running daily write operation count",
+        "required": true,
+        "constraint": {
+          "type": "number",
+          "enforceable": [
+            "max"
+          ]
+        }
+      }
+    }
+  },
+  "requiredGates": [
+    "bounds",
+    "intent",
+    "commitment",
+    "decision_owner"
+  ],
+  "ttl": {
+    "default": 86400,
+    "max": 31536000
+  },
+  "retention_minimum": 7776000,
+  "content_binding": {
+    "version": "1",
+    "kind": "jcs"
+  }
+}

package/profiles/customers/0.6.profile.json

@@ -0,0 +1,153 @@
+{
+  "id": "github.com/humanagencyprotocol/hap-profiles/customers@0.6",
+  "name": "Customer Management",
+  "version": "0.6",
+  "description": "Customer authority — governs CRM operations: contacts, activities, deals, tasks",
+  "boundsSchema": {
+    "keyOrder": [
+      "profile",
+      "read_access",
+      "export_access",
+      "write_daily_max",
+      "delete_daily_max"
+    ],
+    "fields": {
+      "profile": {
+        "type": "string",
+        "required": true
+      },
+      "read_access": {
+        "type": "string",
+        "required": true,
+        "displayName": "Read access",
+        "description": "Allow the agent to browse contacts, timelines, pipeline and tasks. Bulk export is governed separately by Export access.",
+        "boundType": {
+          "kind": "enum",
+          "values": [
+            "unlimited",
+            "none"
+          ]
+        },
+        "toolsDescription": "find_contacts, get_timeline, get_pipeline, list_tasks",
+        "default": "unlimited"
+      },
+      "export_access": {
+        "type": "string",
+        "required": true,
+        "displayName": "Export access",
+        "description": "Allow the agent to export the ENTIRE CRM in one call. Separate from read access because the risk is different in kind: reading one contact and extracting the whole customer database are not the same decision.",
+        "boundType": {
+          "kind": "enum",
+          "values": [
+            "allowed",
+            "none"
+          ]
+        },
+        "toolsDescription": "export_crm",
+        "default": "none"
+      },
+      "write_daily_max": {
+        "type": "number",
+        "required": true,
+        "displayName": "Daily write limit",
+        "description": "Maximum CRM write operations per day (creates, updates)",
+        "unit": "count",
+        "boundType": {
+          "kind": "cumulative_count",
+          "window": "daily"
+        },
+        "paths": [
+          "customers-write"
+        ],
+        "appliesTo": [
+          "write"
+        ]
+      },
+      "delete_daily_max": {
+        "type": "number",
+        "required": true,
+        "displayName": "Daily delete limit",
+        "description": "Maximum CRM delete operations per day",
+        "unit": "count",
+        "boundType": {
+          "kind": "cumulative_count",
+          "window": "daily"
+        },
+        "paths": [
+          "customers-delete"
+        ],
+        "appliesTo": [
+          "delete"
+        ]
+      }
+    }
+  },
+  "contextSchema": {
+    "keyOrder": [
+      "contact_type"
+    ],
+    "fields": {
+      "contact_type": {
+        "type": "string",
+        "required": true,
+        "displayName": "Contact types the agent may create or modify",
+        "description": "Contact types the agent may create, update or delete. Does NOT restrict reading — reads are governed by read_access.",
+        "enum": [
+          "customer",
+          "lead",
+          "partner",
+          "vendor"
+        ],
+        "constraint": {
+          "type": "string",
+          "enforceable": [
+            "subset"
+          ]
+        }
+      }
+    }
+  },
+  "executionContextSchema": {
+    "fields": {
+      "contact_type": {
+        "source": "declared",
+        "description": "Contact type being accessed",
+        "required": true,
+        "constraint": {
+          "type": "string",
+          "enforceable": [
+            "subset"
+          ]
+        }
+      },
+      "write_count_daily": {
+        "source": "cumulative",
+        "cumulativeField": "_count",
+        "window": "daily",
+        "description": "Running daily write operation count",
+        "required": true,
+        "constraint": {
+          "type": "number",
+          "enforceable": [
+            "max"
+          ]
+        }
+      }
+    }
+  },
+  "requiredGates": [
+    "bounds",
+    "intent",
+    "commitment",
+    "decision_owner"
+  ],
+  "ttl": {
+    "default": 86400,
+    "max": 31536000
+  },
+  "retention_minimum": 7776000,
+  "content_binding": {
+    "version": "1",
+    "kind": "jcs"
+  }
+}

package/profiles/email/0.4.profile.json

@@ -2,7 +2,7 @@
   "id": "github.com/humanagencyprotocol/hap-profiles/email@0.4",
   "name": "Email",
   "version": "0.4",
-  "description": "Email authority \u2014 governs sending, drafting, and reading email via Gmail",
+  "description": "Email authority — governs sending, drafting, and reading email via Gmail",
   "boundsSchema": {
     "keyOrder": [
       "profile",
@@ -64,7 +64,7 @@
         "type": "number",
         "required": false,
         "displayName": "Daily read limit",
-        "description": "Maximum emails read per day",
+        "description": "Not currently enforced: reads carry no receipt, so no component counts them. Hidden from the authorization editor until enforcement exists.",
         "unit": "count",
         "boundType": {
           "kind": "cumulative_count",
@@ -72,7 +72,8 @@
         },
         "paths": [
           "email-read"
-        ]
+        ],
+        "enforced": false
       }
     }
   },
@@ -171,5 +172,8 @@
     "max": 31536000
   },
   "retention_minimum": 7776000,
-  "content_binding": { "version": "1", "kind": "text" }
+  "content_binding": {
+    "version": "1",
+    "kind": "text"
+  }
 }

package/profiles/index.json

@@ -5,6 +5,8 @@
     "github.com/humanagencyprotocol/hap-profiles/purchase@0.4": "purchase/0.4.profile.json",
     "github.com/humanagencyprotocol/hap-profiles/email@0.4": "email/0.4.profile.json",
     "github.com/humanagencyprotocol/hap-profiles/customers@0.4": "customers/0.4.profile.json",
+    "github.com/humanagencyprotocol/hap-profiles/customers@0.5": "customers/0.5.profile.json",
+    "github.com/humanagencyprotocol/hap-profiles/customers@0.6": "customers/0.6.profile.json",
     "github.com/humanagencyprotocol/hap-profiles/calendar@0.4": "calendar/0.4.profile.json",
     "github.com/humanagencyprotocol/hap-profiles/publish@0.4": "publish/0.4.profile.json",
     "github.com/humanagencyprotocol/hap-profiles/records@0.4": "records/0.4.profile.json"

package/server.js

@@ -28,11 +28,21 @@ const env = {
   NODE_ENV: 'production',
   SUVEREN_CP_PORT: CP_PORT,
   SUVEREN_MCP_PORT: MCP_PORT,
+  // The control plane talks to the MCP server over this URL. It defaults to
+  // 127.0.0.1:3430 in mcp-bridge.ts, so if the user overrode SUVEREN_MCP_PORT
+  // without also setting this, every CP→MCP internal call hit the wrong port
+  // and failed — surfacing as "Couldn't load integrations". Derive it here so
+  // the two can never drift. An explicit override still wins (e.g. Docker).
+  SUVEREN_MCP_INTERNAL_URL: process.env.SUVEREN_MCP_INTERNAL_URL ?? `http://127.0.0.1:${MCP_PORT}`,
   HAP_UI_DIST: UI_DIST,
   SUVEREN_MANIFESTS_DIR: MANIFESTS_DIR,
   SUVEREN_PROFILES_DIR: PROFILES_DIR,
   // Single shared internal secret so CP↔MCP authenticate the bridge.
   SUVEREN_INTERNAL_SECRET: process.env.SUVEREN_INTERNAL_SECRET ?? randomHex(32),
+  // Passed by the login service (see bundle/lib/autostart-templates.mjs) so the
+  // control-plane knows a human is NOT sitting in front of a terminal watching
+  // it start — that is when a locked gateway needs to announce itself.
+  ...(process.argv.includes('--autostart') ? { SUVEREN_AUTOSTART: '1' } : {}),
 };
 
 const cp = spawn(