@things-factory/ai-client-base 10.1.29 → 10.1.39

package/server/service/assistant/tool-scope.test.ts

@@ -0,0 +1,123 @@
+/**
+ * What this guards: which tools one conversation is offered, now that the **doors** decide it
+ * (ADR-0071 decision 2, added to 2026-09-18).
+ *
+ * The three states of `doors` are three different answers, and the interesting one is the third:
+ * a tool that says nothing is **left out**, not opened. Reading an absent declaration as "nothing
+ * to check" is how the board-import tool reached every conversation once already.
+ */
+import { registerToolCategory, clearToolRegistry } from '../tool-registry/registry'
+import type { ToolCategory, ToolSpec } from '../tool-registry/types'
+import { resolveToolScope, narrowToolScope, EMPTY_TOOL_SCOPE } from './tool-scope'
+
+afterEach(() => clearToolRegistry())
+
+function category(name: string, specs: Partial<ToolSpec>[]): ToolCategory {
+  return {
+    name,
+    guidance: `- fixture guidance for ${name}`,
+    specs: specs.map(s => ({
+      kind: 'read' as const,
+      name: 'unnamed',
+      description: 'desc',
+      schema: {},
+      builder: () => ({}),
+      ...s
+    })) as ToolSpec[]
+  }
+}
+
+const names = (scope: { specs: ReadonlyArray<ToolSpec> }) => scope.specs.map(s => s.name)
+
+/** A caller holding these doors and no others. */
+const holding = (...doors: string[]) => jest.fn(async (door: string) => doors.includes(door))
+
+describe('resolveToolScope — the doors decide', () => {
+  test('★ a tool that names no doors at all is left out, not let through', async () => {
+    registerToolCategory(category('mixed', [{ name: 'undeclared' }, { name: 'declared', doors: ['Query.a'] }]))
+
+    const scope = await resolveToolScope(['mixed'], holding('Query.a'))
+
+    expect(names(scope)).toEqual(['declared'])
+  })
+
+  test('★ `doors: []` passes without asking — it reaches nothing to ask about', async () => {
+    const access = holding()
+    registerToolCategory(category('surface', [{ name: 'getOpenScene', doors: [] }]))
+
+    expect(names(await resolveToolScope(['surface'], access))).toEqual(['getOpenScene'])
+    expect(access).not.toHaveBeenCalled()
+  })
+
+  test('★ several doors are AND — half of them is not enough', async () => {
+    registerToolCategory(
+      category('plant', [
+        { name: 'overview', doors: ['Query.jobOrders', 'Query.productionReports'] },
+        { name: 'findJobOrders', doors: ['Query.jobOrders'] }
+      ])
+    )
+
+    const scope = await resolveToolScope(['plant'], holding('Query.jobOrders'))
+
+    expect(names(scope)).toEqual(['findJobOrders'])
+  })
+
+  test('each door is asked once however many tools reach it', async () => {
+    const access = holding('Query.jobOrders', 'Query.productionReports')
+    registerToolCategory(
+      category('plant', [
+        { name: 'overview', doors: ['Query.jobOrders', 'Query.productionReports'] },
+        { name: 'findJobOrders', doors: ['Query.jobOrders'] },
+        { name: 'attention', doors: ['Query.jobOrders', 'Query.productionReports'] }
+      ])
+    )
+
+    await resolveToolScope(['plant'], access)
+
+    expect(access.mock.calls.map(c => c[0]).sort()).toEqual(['Query.jobOrders', 'Query.productionReports'])
+  })
+
+  test('★ no access check closes every tool that reaches a door', async () => {
+    registerToolCategory(category('plant', [{ name: 'findJobOrders', doors: ['Query.jobOrders'] }, { name: 'getOpenScene', doors: [] }]))
+
+    expect(names(await resolveToolScope(['plant']))).toEqual(['getOpenScene'])
+  })
+
+  test('a door check that throws closes that door', async () => {
+    const access = jest.fn(async () => {
+      throw new Error('auth is down')
+    })
+    registerToolCategory(category('plant', [{ name: 'findJobOrders', doors: ['Query.jobOrders'] }]))
+
+    expect(await resolveToolScope(['plant'], access)).toEqual(EMPTY_TOOL_SCOPE)
+  })
+
+  test('a category left with no usable tool drops out, so its guidance is not read to the model', async () => {
+    registerToolCategory(category('plant', [{ name: 'findJobOrders', doors: ['Query.jobOrders'] }]))
+    registerToolCategory(category('twin', [{ name: 'queryState', doors: ['Query.twinReplay'] }]))
+
+    const scope = await resolveToolScope(['plant', 'twin'], holding('Query.twinReplay'))
+
+    expect(scope.categories.map(c => c.name)).toEqual(['twin'])
+  })
+
+  test('nothing asked for is nothing offered', async () => {
+    registerToolCategory(category('plant', [{ name: 'findJobOrders', doors: [] }]))
+
+    expect(await resolveToolScope([], holding())).toEqual(EMPTY_TOOL_SCOPE)
+    expect(await resolveToolScope(undefined as any, holding())).toEqual(EMPTY_TOOL_SCOPE)
+  })
+
+  test('narrowing keeps the same reading — a surface that runs only reads', async () => {
+    registerToolCategory(
+      category('twin', [
+        { name: 'queryState', doors: ['Query.twinReplay'] },
+        { name: 'bindEntity', kind: 'write', doors: ['Query.twinReplay'] }
+      ])
+    )
+
+    const scope = await resolveToolScope(['twin'], holding('Query.twinReplay'))
+
+    expect(names(narrowToolScope(scope, spec => spec.kind === 'read'))).toEqual(['queryState'])
+  })
+})

package/server/service/assistant/tool-scope.ts

@@ -4,23 +4,32 @@
  *
  * ── Two questions, one list ───────────────────────────────────────────────────────
  *   Which categories did this surface ask for?     `toolCategories`
- *   Which of their tools may this caller use?      each spec's `privilege`, asked of `access`
+ *   Which of their tools may this caller use?      each spec's `doors`, asked of `access`
  *
  * **Nothing asked means nothing offered.** Omitting the category list used to mean "every
  * registered category"; that default is the one that opened board-import's Board-creating tool to
  * any conversation. An absent answer leans to the closed side (ADR-0047 ② · ADR-0053).
  *
- * **No access check means privileged tools stay closed.** A caller that cannot say who is asking
- * gets only the tools that need no privilege.
+ * **The doors are the gate** (ADR-0071 decision 2). A tool used to declare its own copy of what its
+ * door asks, and this asked that copy. Two declarations of one fact drift, and the looser one wins;
+ * plant's hand-written read check and its `doors` list were that pair. Now a tool names the doors it
+ * reaches and the host resolves each one against the door's own declaration, so what passes here is
+ * what passes at the door.
+ *
+ * **All the doors, not one of them.** A tool that answers from two doors hands back what is behind
+ * both, so the caller holds both (AND, the same reading as AUTH's `requiresAll`).
+ *
+ * **No access check means a tool that reaches a door stays closed.** A caller that cannot say who is
+ * asking gets only the tools that reach nothing.
  *
  * The permission check itself belongs to auth, which this package does not depend on, so the host
- * hands it in (`ai-assistant` builds it from the request state).
+ * hands it in (`ai-assistant` builds it from the request state and AUTH's field table).
  */
 import { getToolCategories, type ToolCategoryFilter } from '../tool-registry/index.js'
-import type { ToolPrivilege, ToolSpec } from '../tool-registry/types.js'
+import type { ToolSpec } from '../tool-registry/types.js'
 
-/** Answers "may this caller use a door guarded by this privilege". */
-export type ToolAccessCheck = (privilege: ToolPrivilege) => Promise<boolean>
+/** Answers "may this caller pass this door" — `'Query.jobOrders'`. */
+export type ToolAccessCheck = (door: string) => Promise<boolean>
 
 export interface ScopedCategory {
   readonly name: string
@@ -38,20 +47,28 @@ export interface ToolScope {
 
 export const EMPTY_TOOL_SCOPE: ToolScope = Object.freeze({ categories: [], specs: [] })
 
-const privilegeKey = (p: ToolPrivilege) => [p.category, p.privilege, !!p.owner, !!p.super].join('|')
-
 export async function resolveToolScope(requested: ToolCategoryFilter, access?: ToolAccessCheck): Promise<ToolScope> {
   if (!requested || requested.length === 0) return EMPTY_TOOL_SCOPE
 
-  /* One check per distinct privilege — a category of ten read tools asks once. */
+  /* One check per distinct door — five tools behind `Query.jobOrders` ask once. */
   const answers = new Map<string, Promise<boolean>>()
-  const mayUse = (spec: ToolSpec): Promise<boolean> => {
-    const privilege = spec.privilege
-    if (!privilege) return Promise.resolve(true)
-    if (!access) return Promise.resolve(false)
-    const key = privilegeKey(privilege)
-    if (!answers.has(key)) answers.set(key, access(privilege).catch(() => false))
-    return answers.get(key)!
+  const passes = (door: string): Promise<boolean> => {
+    if (!answers.has(door)) answers.set(door, access!(door).catch(() => false))
+    return answers.get(door)!
+  }
+
+  const mayUse = async (spec: ToolSpec): Promise<boolean> => {
+    /*
+     * Said nothing. Not open — left out, and the boot report names it. An answer this tool built
+     * would be readable by no one (ADR-0073), so offering it would only produce dead answers.
+     */
+    if (!Array.isArray(spec.doors)) return false
+    /* Reaches no door: it hands back what the surface itself sent. There is nothing to gate. */
+    if (spec.doors.length === 0) return true
+    if (!access) return false
+
+    const held = await Promise.all(spec.doors.map(passes))
+    return held.every(Boolean)
   }
 
   const categories: ScopedCategory[] = []

package/server/service/tool-registry/index.ts

@@ -23,7 +23,6 @@ export type { ToolCategoryFilter, ToolRegistryWarning } from './registry'
 export type {
   ToolSpec,
   ToolSpecBase,
-  ToolPrivilege,
   ReadToolSpec,
   WriteToolSpec,
   ActionToolSpec,

package/server/service/tool-registry/registry.test.ts

@@ -23,16 +23,6 @@ afterEach(() => {
 })
 
 // 헬퍼 — 카테고리 fixture
-/**
- * 권한 축의 경고만 — 문 축(`tool-doors-undeclared`)은 자기 시험이 따로 본다.
- *
- * 한 시험이 두 축을 함께 세면, 한 축에 코드가 하나 늘 때마다 다른 축의 시험이 빨개진다. 그러면 고치는
- * 사람은 자기가 건드리지 않은 시험을 고치게 되고, 그 손질이 시험을 무디게 만든다.
- */
-function privilegeWarnings() {
-  return getToolRegistryWarnings().filter(w => w.code !== 'tool-doors-undeclared')
-}
-
 function makeCategory(name: string, specs: Partial<ToolSpec>[]): ToolCategory {
   return {
     name,
@@ -44,8 +34,6 @@ function makeCategory(name: string, specs: Partial<ToolSpec>[]): ToolCategory {
       description: 'desc',
       schema: {},
       builder: () => ({}),
-      /* A tool that changes something must name its door (A1). The fixture does, like guidance. */
-      ...(s.kind && s.kind !== 'read' ? { privilege: { category: 'fixture', privilege: 'mutation' } } : {}),
       ...s
     })) as ToolSpec[]
   }
@@ -186,7 +174,7 @@ describe('registry — spec 보존', () => {
           kind: 'write',
           name: 't1',
           description: 'main desc',
-          privilege: { category: 'fixture', privilege: 'mutation' },
+          doors: ['Mutation.t1'],
           themeNote: '⚠ note',
           schema: { type: 'object' },
           builder: () => null
@@ -272,107 +260,48 @@ describe('registry — 지침 없는 카테고리는 등록되지 않는다', ()
   })
 })
 
-describe('registry — a tool that changes something names its door (A1, stage one: surface)', () => {
-  test.each(['write', 'action', 'external'] as const)(
-    '★ a %s tool without a privilege registers, and the omission is recorded as a code',
-    kind => {
-      registerToolCategory({
-        name: 'no-door',
-        guidance: '- fixture guidance for no-door',
-        specs: [{ kind, name: 'changesThings', description: 'd', schema: {}, builder: () => null } as any]
-      })
-      expect(getToolKind('changesThings')).toBe(kind)
-      expect(privilegeWarnings()).toEqual([
-        expect.objectContaining({
-          code: 'tool-privilege-undeclared',
-          params: { category: 'no-door', tool: 'changesThings', kind }
-        })
-      ])
-    }
-  )
-
-  test('a privilege with no privilege name is recorded the same way', () => {
-    registerToolCategory({
-      name: 'half-door',
-      guidance: '- fixture guidance for half-door',
-      specs: [
-        { kind: 'external', name: 'halfDoor', description: 'd', schema: {}, builder: () => null, privilege: { category: 'board' } } as any
-      ]
-    })
-    expect(privilegeWarnings().map(w => w.params.tool)).toEqual(['halfDoor'])
-  })
-
-  test('a declared tool leaves no warning', () => {
-    registerToolCategory(makeCategory('declared', [{ name: 'w1', kind: 'write' }]))
-    expect(privilegeWarnings()).toEqual([])
-  })
-
+describe('registry — a tool names the doors it reaches (ADR-0071 decision 2)', () => {
   /*
-   * 읽는 도구도 자기가 닿는 문을 말한다(ADR-0071 결정 2). 그전까지 업무 권한을 스스로 확인하는 것은
-   * plant 뿐이었고, twin · figure 의 읽는 도구는 테넌트만 봤다 — 대화 문 권한만 있으면 그 자료를 읽었다.
+   * A tool that names no doors makes its answers **unreadable to everyone** — its author included.
+   *
+   * Since ADR-0073 an answer row carries the doors its tools passed, and an undeclared tool is written
+   * as `unresolved:<tool>`, which nobody passes. On 2026-09-18 in the twin modeller, an authoring
+   * answer showed its own author "you do not have permission to see this answer" after a refresh.
+   * From 2026-09-18 the gate also leaves such a tool out — this list is the only place that says what
+   * is missing.
    */
-  test('★ a read tool that says nothing about its door is recorded too', () => {
-    registerToolCategory(makeCategory('reads', [{ name: 'r1', kind: 'read' }]))
-
-    expect(privilegeWarnings()).toEqual([
-      expect.objectContaining({ code: 'tool-privilege-undeclared', params: { category: 'reads', tool: 'r1', kind: 'read' } })
-    ])
-  })
-
-  test('★ `doors: []` is an answer — a tool that reaches no door has nothing to gate', () => {
+  test.each(['read', 'write', 'action', 'external'] as const)('★ a %s tool that declares no doors is reported by name', kind => {
     registerToolCategory({
-      name: 'surface-only',
-      guidance: '- fixture guidance for surface-only',
-      specs: [
-        { kind: 'read', name: 'getOpenScene', description: 'd', schema: {}, builder: () => null, doors: [] } as any
-      ]
+      name: 'no-door',
+      guidance: '- fixture guidance for no-door',
+      specs: [{ kind, name: 'reachesSomething', description: 'd', schema: {}, builder: () => null } as any]
     })
 
-    expect(privilegeWarnings()).toEqual([])
-  })
-
-  test('★ a named door with no privilege of its own is its own fact, not an omission', () => {
-    registerToolCategory({
-      name: 'waiting',
-      guidance: '- fixture guidance for waiting',
-      specs: [
-        { kind: 'read', name: 'twinNowTool', description: 'd', schema: {}, builder: () => null, doors: ['Query.twinNow'] } as any
-      ]
-    })
-
-    expect(privilegeWarnings()).toEqual([
+    expect(getToolKind('reachesSomething')).toBe(kind)
+    expect(getToolRegistryWarnings()).toEqual([
       expect.objectContaining({
-        code: 'tool-door-has-no-privilege',
-        params: { category: 'waiting', tool: 'twinNowTool', kind: 'read', doors: ['Query.twinNow'] }
+        code: 'tool-doors-undeclared',
+        params: { category: 'no-door', tool: 'reachesSomething', kind }
       })
     ])
   })
 
-  /*
-   * 문을 안 적은 도구는 그 답을 **아무도 못 읽게 만든다** — 쓴 사람 본인까지.
-   *
-   * ADR-0073 뒤로 답 행에 도구가 지난 문이 적히고, 선언이 없는 도구는 `unresolved:<도구>` 로 적혀
-   * 아무도 못 지난다. 2026-09-18 트윈 모델러에서 저작 대화의 답이 새로 고친 뒤 작성자에게
-   * 「이 답을 볼 권한이 없습니다」로 보였다.
-   *
-   * 부팅은 그때 아무 말도 안 했다. 권한 검사가 `privilege` 가 있으면 건너뛰는 자리에서 문 검사까지
-   * 함께 건너뛰었기 때문이다 — 트윈의 저작 도구 넷이 정확히 그 모양이었다(권한 있음, 문 없음).
-   */
-  test('★ a tool that declares no doors is reported even when it declares a privilege', () => {
-    registerToolCategory(
-      makeCategory('authoring', [
-        { name: 'proposeSceneEdit', kind: 'write', privilege: { category: 'board', privilege: 'mutation' } }
-      ])
-    )
+  test('★ `doors: []` is a declaration — it says this tool reaches none', () => {
+    registerToolCategory(makeCategory('surface', [{ name: 'getOpenScene', kind: 'read', doors: [] }]))
 
-    const doors = getToolRegistryWarnings().filter(w => w.code === 'tool-doors-undeclared')
-    expect(doors.map(w => w.params.tool)).toEqual(['proposeSceneEdit'])
+    expect(getToolRegistryWarnings()).toEqual([])
   })
 
-  test('★ `doors: []` is a declaration — it says this tool reaches none', () => {
-    registerToolCategory(makeCategory('surface', [{ name: 'getOpenScene', kind: 'read', doors: [] }]))
+  test('a named door leaves no warning — what that door requires is asked at boot, not here', () => {
+    registerToolCategory(makeCategory('waiting', [{ name: 'twinNowTool', kind: 'read', doors: ['Query.twinNow'] }]))
+
+    expect(getToolRegistryWarnings()).toEqual([])
+  })
+
+  test('the message says what to write, so the person reading it does not have to look it up', () => {
+    registerToolCategory(makeCategory('no-door', [{ name: 'silent', kind: 'read' }]))
 
-    expect(getToolRegistryWarnings().filter(w => w.code === 'tool-doors-undeclared')).toEqual([])
+    expect(getToolRegistryWarnings()[0].message).toMatch(/doors: \[\]/)
   })
 
   test('re-registering a category replaces its warnings instead of piling them up', () => {
@@ -384,7 +313,7 @@ describe('registry — a tool that changes something names its door (A1, stage o
     /* 두 번 등록해도 한 번 등록한 것과 같아야 한다 — 축이 몇이든. */
     expect(getToolRegistryWarnings().map(w => w.code).sort()).toEqual(once)
 
-    registerToolCategory({ name: 'again', guidance: '- g', specs: [{ ...undeclared, privilege: { category: 'c', privilege: 'mutation' } }] })
-    expect(privilegeWarnings()).toEqual([])
+    registerToolCategory({ name: 'again', guidance: '- g', specs: [{ ...undeclared, doors: [] }] })
+    expect(getToolRegistryWarnings()).toEqual([])
   })
 })

package/server/service/tool-registry/registry.ts

@@ -32,13 +32,15 @@ const categories: Map<string, ToolCategory> = new Map()
 /** A registration that was accepted but is not yet what the contract requires. Code + params, not prose. */
 export interface ToolRegistryWarning {
   /**
-   * `tool-privilege-undeclared` — nothing said which door this tool reaches.
-   * `tool-door-has-no-privilege` — the door was named and it declares no privilege of its own yet
-   *   (twin's queries, waiting on AUTH stage two). The tool cannot be stricter than its door, so
-   *   this is a different fact from saying nothing, and the report keeps the two apart.
+   * `tool-doors-undeclared` — nothing said which doors this tool reaches, so the gate leaves it out
+   * of every conversation (`resolveToolScope`) and this names it.
+   *
+   * What those doors require is **not** asked here. Registration runs while modules load, before the
+   * schema stands, so AUTH's field table is still empty; `ai-assistant`'s boot report asks the
+   * schema after it is built (`tool-door-not-in-schema` · `tool-door-has-no-privilege`).
    */
-  code: 'tool-privilege-undeclared' | 'tool-door-has-no-privilege' | 'tool-doors-undeclared'
-  params: { category: string; tool: string; kind: ToolSpec['kind']; doors?: string[] }
+  code: 'tool-doors-undeclared'
+  params: { category: string; tool: string; kind: ToolSpec['kind'] }
   /** For a person reading it; the code and params are what callers act on. */
   message: string
 }
@@ -46,8 +48,8 @@ export interface ToolRegistryWarning {
 const warnings: ToolRegistryWarning[] = []
 
 /**
- * What registration accepted but the contract does not yet allow. Stage one of A1 records these
- * instead of refusing; a host shows them at boot, and when the list is empty the rule becomes a refusal.
+ * What registered without saying which doors it reaches. A host prints this at boot; the gate has
+ * already left each of these tools out of every conversation.
  */
 export function getToolRegistryWarnings(): ReadonlyArray<ToolRegistryWarning> {
   return warnings.slice()
@@ -80,19 +82,17 @@ export function registerToolCategory(category: ToolCategory): void {
   }
 
   /*
-   * A tool that changes something must say which privilege it goes through (A1, 2026-09-17).
+   * A tool says which doors it reaches (ADR-0071 decision 2).
    *
-   * The conversation door checks one privilege — may this person talk to the assistant. Without a
-   * privilege on the tool, that single check opened every tool behind it: a user holding only
-   * `ai-assistant:mutation` could reach board-import's `materializeImportSession` and create a
-   * Board.
+   * The conversation door checks one privilege — may this person talk to the assistant. On its own
+   * that single check opened every tool behind it: a user holding only `ai-assistant:mutation` could
+   * reach board-import's `materializeImportSession` and create a Board.
    *
-   * **This is stage one of two: surface, then refuse** (ADR-0037, "먼저 드러내고, 목록이 비면 막는다").
-   * Refusing now would stop every app whose tools predate the `privilege` field from booting, and
-   * those apps compile against an installed copy that does not have the field yet. So an undeclared
-   * tool still registers, and the omission is recorded as a code (`getToolRegistryWarnings`), not
-   * a log line — a warning only a log carries is not distinguishable from no warning. When the list
-   * is empty across the apps, this becomes a refusal.
+   * Registration does not refuse a tool that says nothing; it records the omission as a code
+   * (`getToolRegistryWarnings`), not a log line — a warning only a log carries is not
+   * distinguishable from no warning. The refusal happens where it costs nothing to be late: the gate
+   * leaves an undeclared tool out of every conversation, so booting stays possible while the list is
+   * worked down, and no undeclared tool is reachable in the meantime.
    */
   warnings.splice(0, warnings.length, ...warnings.filter(w => w.params.category !== category.name))
 
@@ -103,9 +103,8 @@ export function registerToolCategory(category: ToolCategory): void {
    * `unresolved:<도구>` 로 적히고 그 이름은 아무도 못 지난다 — **답을 쓴 본인도** 새로 고치면
    * 「이 답을 볼 권한이 없습니다」를 본다. 2026-09-18 트윈 모델러에서 그렇게 나왔다.
    *
-   * 이 검사를 권한 검사와 따로 도는 이유가 그것이다. 아래 고리는 `privilege` 가 있으면 건너뛰는데,
-   * 문을 안 적은 해는 권한을 적었는지와 상관이 없다. 트윈의 저작 도구 넷이 정확히 그 자리였다 —
-   * 권한은 있고 문은 없어서 부팅이 아무 말도 안 했다.
+   * From 2026-09-18 this declaration is also the gate (ADR-0071 decision 2, addendum). A tool that names
+   * no doors is offered to no conversation, so this list is the only place that says what is missing.
    */
   for (const spec of category.specs) {
     if (Array.isArray(spec.doors)) continue
@@ -114,45 +113,9 @@ export function registerToolCategory(category: ToolCategory): void {
       code: 'tool-doors-undeclared',
       params: { category: category.name, tool: spec.name, kind: spec.kind },
       message:
-        `tool '${spec.name}' in category '${category.name}' declares no doors, so answers built with it ` +
-        'are hidden from every reader including their author — declare `doors`, or `doors: []` when it reaches none'
-    })
-  }
-
-  for (const spec of category.specs) {
-    const declared = Boolean(spec.privilege?.category && spec.privilege?.privilege)
-    if (declared) continue
-
-    /*
-     * An empty list says this tool reaches no door — the ones that hand back what the surface sent
-     * are that. Nothing to gate, nothing to report.
-     */
-    if (Array.isArray(spec.doors) && spec.doors.length === 0) continue
-
-    if (spec.doors?.length) {
-      /*
-       * The door is named and carries no privilege yet. The tool cannot be stricter than the door
-       * it reaches, so this is not an omission by whoever wrote the tool — it is the door's turn
-       * (ADR-0071 decision 2). Reported under its own code so the two are not read as one list.
-       */
-      warnings.push({
-        code: 'tool-door-has-no-privilege',
-        params: { category: category.name, tool: spec.name, kind: spec.kind, doors: spec.doors },
-        message:
-          `tool '${spec.name}' reaches ${spec.doors.join(' + ')} and declares no privilege of its own — ` +
-          'whether those doors require anything is asked at boot, against the schema, not copied here ' +
-          '(ADR-0072 decision 5)'
-      })
-      continue
-    }
-
-    warnings.push({
-      code: 'tool-privilege-undeclared',
-      params: { category: category.name, tool: spec.name, kind: spec.kind },
-      message:
-        `tool '${spec.name}' in category '${category.name}' declares no privilege of its own — ` +
-        'a tool that changes something says who may run it. What the doors it reaches require is a ' +
-        "separate question, answered at boot against the schema (`tool-door-not-in-schema`)."
+        `tool '${spec.name}' in category '${category.name}' declares no doors, so it is offered to no ` +
+        'conversation and answers built with it would be hidden from every reader including their ' +
+        'author — declare `doors`, or `doors: []` when it reaches none'
     })
   }
 

package/server/service/tool-registry/types.ts

@@ -119,23 +119,6 @@ export interface ExternalToolContext {
 }
 // ── ToolSpec — 카테고리별 변형 ──────────────────────────────────────
 
-/**
- * The privilege a tool requires — the same `category`/`privilege` the tool's GraphQL door declares
- * (`@privilege(category, privilege, owner?, super?)`), so the fields mirror `PrivilegeObject`.
- *
- * A tool is not a new door; it is another way into a door that already exists. A tool that creates
- * a Board goes through the privilege that creating a Board already needs. Minting an AI-only
- * privilege name would put two doors on one effect, and one of them would end up looser.
- */
-export interface ToolPrivilege {
-  category: string
-  privilege: string
-  /** Domain owners pass without the privilege — mirror the door's `domainOwnerGranted`. */
-  owner?: boolean
-  /** Super users pass without the privilege — mirror the door's `superUserGranted`. */
-  super?: boolean
-}
-
 /**
  * 모든 ToolSpec 공통 메타데이터.
  */
@@ -151,14 +134,6 @@ export interface ToolSpecBase {
   themeNote?: string
   /** JSON Schema for parameters — LLM tool schema 에 그대로 노출. */
   schema: any
-  /**
-   * The privilege a caller needs before this tool is offered or run. See `ToolPrivilege`.
-   *
-   * Expected for `write`, `action` and `external` — registration records a
-   * `tool-privilege-undeclared` warning for one without it (A1 stage one).
-   */
-  privilege?: ToolPrivilege
-
   /**
    * Which GraphQL doors this tool reaches — `['Query.twinNow']`,
    * `['Query.productionSummary', 'Query.pendingSummary']`.
@@ -173,15 +148,23 @@ export interface ToolSpecBase {
    * plant's factory overview answers from two, and asking for only one of them would hand back
    * half of what the caller may not see.
    *
-   * Three states, and the boot report keeps them apart:
-   *   - doors and a privilege — the gate checks it
-   *   - `doors: []` — this tool reaches no door at all. The ones that hand back what the surface
-   *     sent (`getOpenScene`, `getStationScreen`) are this: there is nothing behind them to gate.
-   *   - doors with no privilege — the doors themselves declare none yet (twin's queries, waiting
-   *     on AUTH stage two). A tool cannot be stricter than the door it reaches.
+   * **This list is the gate** (ADR-0071 decision 2, added to 2026-09-18). A tool used to carry its
+   * own copy of what its door asks; the copy went stale the day a door changed its declaration, and
+   * the looser of the two won. Now the gate reads the door's own declaration from AUTH's field
+   * table (`privilegeOfField`) and asks `checkPermission` with it — the same question, the same
+   * answer, one declaration.
+   *
+   * Three states, and they are not the same thing:
+   *   - **doors named** — the caller passes each of them, or the tool is neither offered nor run.
+   *   - **`doors: []`** — this tool reaches no door at all. The ones that hand back what the surface
+   *     sent (`getOpenScene`) are this: there is nothing behind them to gate.
+   *   - **no `doors` key** — nothing was said. This is **not** an open tool: it is left out of every
+   *     conversation and reported by name at boot (`tool-doors-undeclared`). An answer built with it
+   *     would be hidden from every reader including its author (ADR-0073), so opening it would
+   *     produce a tool whose answers no one can read.
    *
-   * The privilege is **the door's**, copied, and a test in each app compares the copy with the
-   * directive on that field. When the schema can be read at boot, the copy goes away.
+   * A door that declares nothing of its own opens as far as that door opens — a tool is never
+   * stricter than the door it reaches, and never softer.
    */
   doors?: string[]
 }