@things-factory/ai-client-base 10.1.28 → 10.1.31

package/server/service/tool-registry/registry.ts

@@ -32,13 +32,15 @@ const categories: Map<string, ToolCategory> = new Map()
 /** A registration that was accepted but is not yet what the contract requires. Code + params, not prose. */
 export interface ToolRegistryWarning {
   /**
-   * `tool-privilege-undeclared` — nothing said which door this tool reaches.
-   * `tool-door-has-no-privilege` — the door was named and it declares no privilege of its own yet
-   *   (twin's queries, waiting on AUTH stage two). The tool cannot be stricter than its door, so
-   *   this is a different fact from saying nothing, and the report keeps the two apart.
+   * `tool-doors-undeclared` — nothing said which doors this tool reaches, so the gate leaves it out
+   * of every conversation (`resolveToolScope`) and this names it.
+   *
+   * What those doors require is **not** asked here. Registration runs while modules load, before the
+   * schema stands, so AUTH's field table is still empty; `ai-assistant`'s boot report asks the
+   * schema after it is built (`tool-door-not-in-schema` · `tool-door-has-no-privilege`).
    */
-  code: 'tool-privilege-undeclared' | 'tool-door-has-no-privilege'
-  params: { category: string; tool: string; kind: ToolSpec['kind']; doors?: string[] }
+  code: 'tool-doors-undeclared'
+  params: { category: string; tool: string; kind: ToolSpec['kind'] }
   /** For a person reading it; the code and params are what callers act on. */
   message: string
 }
@@ -46,8 +48,8 @@ export interface ToolRegistryWarning {
 const warnings: ToolRegistryWarning[] = []
 
 /**
- * What registration accepted but the contract does not yet allow. Stage one of A1 records these
- * instead of refusing; a host shows them at boot, and when the list is empty the rule becomes a refusal.
+ * What registered without saying which doors it reaches. A host prints this at boot; the gate has
+ * already left each of these tools out of every conversation.
  */
 export function getToolRegistryWarnings(): ReadonlyArray<ToolRegistryWarning> {
   return warnings.slice()
@@ -80,53 +82,40 @@ export function registerToolCategory(category: ToolCategory): void {
   }
 
   /*
-   * A tool that changes something must say which privilege it goes through (A1, 2026-09-17).
+   * A tool says which doors it reaches (ADR-0071 decision 2).
    *
-   * The conversation door checks one privilege — may this person talk to the assistant. Without a
-   * privilege on the tool, that single check opened every tool behind it: a user holding only
-   * `ai-assistant:mutation` could reach board-import's `materializeImportSession` and create a
-   * Board.
+   * The conversation door checks one privilege — may this person talk to the assistant. On its own
+   * that single check opened every tool behind it: a user holding only `ai-assistant:mutation` could
+   * reach board-import's `materializeImportSession` and create a Board.
    *
-   * **This is stage one of two: surface, then refuse** (ADR-0037, "먼저 드러내고, 목록이 비면 막는다").
-   * Refusing now would stop every app whose tools predate the `privilege` field from booting, and
-   * those apps compile against an installed copy that does not have the field yet. So an undeclared
-   * tool still registers, and the omission is recorded as a code (`getToolRegistryWarnings`), not
-   * a log line — a warning only a log carries is not distinguishable from no warning. When the list
-   * is empty across the apps, this becomes a refusal.
+   * Registration does not refuse a tool that says nothing; it records the omission as a code
+   * (`getToolRegistryWarnings`), not a log line — a warning only a log carries is not
+   * distinguishable from no warning. The refusal happens where it costs nothing to be late: the gate
+   * leaves an undeclared tool out of every conversation, so booting stays possible while the list is
+   * worked down, and no undeclared tool is reachable in the meantime.
    */
   warnings.splice(0, warnings.length, ...warnings.filter(w => w.params.category !== category.name))
-  for (const spec of category.specs) {
-    const declared = Boolean(spec.privilege?.category && spec.privilege?.privilege)
-    if (declared) continue
-
-    /*
-     * An empty list says this tool reaches no door — the ones that hand back what the surface sent
-     * are that. Nothing to gate, nothing to report.
-     */
-    if (Array.isArray(spec.doors) && spec.doors.length === 0) continue
 
-    if (spec.doors?.length) {
-      /*
-       * The door is named and carries no privilege yet. The tool cannot be stricter than the door
-       * it reaches, so this is not an omission by whoever wrote the tool — it is the door's turn
-       * (ADR-0071 decision 2). Reported under its own code so the two are not read as one list.
-       */
-      warnings.push({
-        code: 'tool-door-has-no-privilege',
-        params: { category: category.name, tool: spec.name, kind: spec.kind, doors: spec.doors },
-        message:
-          `tool '${spec.name}' reaches ${spec.doors.join(' + ')}, which declare no privilege — ` +
-          'the tool is as open as the doors it reaches until they declare one'
-      })
-      continue
-    }
+  /*
+   * ── 문을 안 적은 도구는 그 답을 **아무도 못 읽게 만든다** ─────────────────
+   *
+   * ADR-0073 뒤로 어시스턴트의 답 행에는 그 답을 만든 도구들이 지난 문이 적힌다. 선언이 없는 도구는
+   * `unresolved:<도구>` 로 적히고 그 이름은 아무도 못 지난다 — **답을 쓴 본인도** 새로 고치면
+   * 「이 답을 볼 권한이 없습니다」를 본다. 2026-09-18 트윈 모델러에서 그렇게 나왔다.
+   *
+   * 2026-09-18 부터 이 선언은 관문이기도 하다(ADR-0071 결정 2 보탬). 문을 안 적은 도구는 어느 대화에도
+   * 나가지 않으므로, 이 목록이 「무엇이 빠져 있나」를 말하는 유일한 자리다.
+   */
+  for (const spec of category.specs) {
+    if (Array.isArray(spec.doors)) continue
 
     warnings.push({
-      code: 'tool-privilege-undeclared',
+      code: 'tool-doors-undeclared',
       params: { category: category.name, tool: spec.name, kind: spec.kind },
       message:
-        `tool '${spec.name}' in category '${category.name}' says nothing about the doors it reaches — ` +
-        "declare `doors` with the same { category, privilege } those doors use, or `doors: []` when it reaches none"
+        `tool '${spec.name}' in category '${category.name}' declares no doors, so it is offered to no ` +
+        'conversation and answers built with it would be hidden from every reader including their ' +
+        'author — declare `doors`, or `doors: []` when it reaches none'
     })
   }
 

package/server/service/tool-registry/types.ts

@@ -119,23 +119,6 @@ export interface ExternalToolContext {
 }
 // ── ToolSpec — 카테고리별 변형 ──────────────────────────────────────
 
-/**
- * The privilege a tool requires — the same `category`/`privilege` the tool's GraphQL door declares
- * (`@privilege(category, privilege, owner?, super?)`), so the fields mirror `PrivilegeObject`.
- *
- * A tool is not a new door; it is another way into a door that already exists. A tool that creates
- * a Board goes through the privilege that creating a Board already needs. Minting an AI-only
- * privilege name would put two doors on one effect, and one of them would end up looser.
- */
-export interface ToolPrivilege {
-  category: string
-  privilege: string
-  /** Domain owners pass without the privilege — mirror the door's `domainOwnerGranted`. */
-  owner?: boolean
-  /** Super users pass without the privilege — mirror the door's `superUserGranted`. */
-  super?: boolean
-}
-
 /**
  * 모든 ToolSpec 공통 메타데이터.
  */
@@ -151,14 +134,6 @@ export interface ToolSpecBase {
   themeNote?: string
   /** JSON Schema for parameters — LLM tool schema 에 그대로 노출. */
   schema: any
-  /**
-   * The privilege a caller needs before this tool is offered or run. See `ToolPrivilege`.
-   *
-   * Expected for `write`, `action` and `external` — registration records a
-   * `tool-privilege-undeclared` warning for one without it (A1 stage one).
-   */
-  privilege?: ToolPrivilege
-
   /**
    * Which GraphQL doors this tool reaches — `['Query.twinNow']`,
    * `['Query.productionSummary', 'Query.pendingSummary']`.
@@ -173,15 +148,23 @@ export interface ToolSpecBase {
    * plant's factory overview answers from two, and asking for only one of them would hand back
    * half of what the caller may not see.
    *
-   * Three states, and the boot report keeps them apart:
-   *   - doors and a privilege — the gate checks it
-   *   - `doors: []` — this tool reaches no door at all. The ones that hand back what the surface
-   *     sent (`getOpenScene`, `getStationScreen`) are this: there is nothing behind them to gate.
-   *   - doors with no privilege — the doors themselves declare none yet (twin's queries, waiting
-   *     on AUTH stage two). A tool cannot be stricter than the door it reaches.
+   * **This list is the gate** (ADR-0071 decision 2, added to 2026-09-18). A tool used to carry its
+   * own copy of what its door asks; the copy went stale the day a door changed its declaration, and
+   * the looser of the two won. Now the gate reads the door's own declaration from AUTH's field
+   * table (`privilegeOfField`) and asks `checkPermission` with it — the same question, the same
+   * answer, one declaration.
+   *
+   * Three states, and they are not the same thing:
+   *   - **doors named** — the caller passes each of them, or the tool is neither offered nor run.
+   *   - **`doors: []`** — this tool reaches no door at all. The ones that hand back what the surface
+   *     sent (`getOpenScene`) are this: there is nothing behind them to gate.
+   *   - **no `doors` key** — nothing was said. This is **not** an open tool: it is left out of every
+   *     conversation and reported by name at boot (`tool-doors-undeclared`). An answer built with it
+   *     would be hidden from every reader including its author (ADR-0073), so opening it would
+   *     produce a tool whose answers no one can read.
    *
-   * The privilege is **the door's**, copied, and a test in each app compares the copy with the
-   * directive on that field. When the schema can be read at boot, the copy goes away.
+   * A door that declares nothing of its own opens as far as that door opens — a tool is never
+   * stricter than the door it reaches, and never softer.
    */
   doors?: string[]
 }