@volter/supercode-interchange 0.1.22 → 0.1.24

package/harness-settings.mjs

@@ -0,0 +1,19 @@
+// User-level interoperation evidence. Configuration writes and effective
+// process policy retain their own owners.
+import { resolveHarnessHomes } from './homes.mjs';
+import { readClaudeInteropSettings } from './session-message.mjs';
+
+const invalid = message => { throw Object.assign(new Error(message), { rpcCode: -32602 }); };
+export function loadHarnessSettings(params, { env = process.env, cwd = process.cwd() } = {}) {
+  if (params == null || typeof params !== 'object') invalid('settings params must be a struct');
+  if (Array.isArray(params)) {
+    if (params.length !== 1) invalid('settings params require exactly one harness');
+    params = { harness: params[0] };
+  } else if (Object.keys(params).some(key => key !== 'harness')) invalid('unknown settings parameter');
+  if (typeof params.harness !== 'string') invalid('harness must be a string');
+  if (params.harness !== 'claude-code') return {
+    schema: 'supercode.harness-interop-settings.v1', harness: params.harness,
+    revision: '', controls: [], advisories: [],
+  };
+  return readClaudeInteropSettings(resolveHarnessHomes(env), cwd);
+}

package/hermes-fire-links.mjs

@@ -0,0 +1,135 @@
+// Derived fire/session/obligation links, without writing the source ledgers.
+import { parseNativeJson } from './native-json.mjs';
+import { hermesFireSession, hermesRowText } from './hermes-fires.mjs';
+import { hermesObject, hermesRefuse } from './hermes-read-validation.mjs';
+
+const compare = (left, right) => Buffer.compare(Buffer.from(left), Buffer.from(right));
+const required = (file, key, value) => typeof value === 'string' && value !== '' ? value : hermesRefuse(file, key, 'expected a non-empty string');
+
+export function hermesSessionProfile(key) {
+  if (typeof key !== 'string') return null;
+  const parts = key.split(':');
+  return parts[0] === 'agent' && parts.length >= 4 && !['', 'main', 'default'].includes(parts[1]) ? parts[1] : null;
+}
+
+// serde's tagged Fire source refuses duplicate modeled fields. The ordinary
+// native Value decoder otherwise keeps the last occurrence of an object key.
+function sourceFire(text) {
+  if (text == null) return null;
+  let parsed; try { parsed = parseNativeJson(text); } catch { return null; }
+  if (!hermesObject(parsed) || parsed.kind !== 'fire' || typeof parsed.fire_id !== 'string') return null;
+  const counts = new Map(); let depth = 0;
+  for (let at = 0; at < text.length; at++) {
+    const char = text[at];
+    if (char === '{' || char === '[') { depth++; continue; }
+    if (char === '}' || char === ']') { depth--; continue; }
+    if (char !== '"') continue;
+    const start = at++;
+    for (; at < text.length; at++) { if (text[at] === '\\') at++; else if (text[at] === '"') break; }
+    if (depth !== 1) continue;
+    let after = at + 1; while (/[\x20\t\r\n]/u.test(text[after] ?? '') && after < text.length) after++;
+    if (text[after] !== ':') continue;
+    const key = JSON.parse(text.slice(start, at + 1)); counts.set(key, (counts.get(key) ?? 0) + 1);
+  }
+  return (counts.get('kind') ?? 0) > 1 || (counts.get('fire_id') ?? 0) > 1 ? null : parsed.fire_id;
+}
+
+export function decodeHermesObligation(file, row) {
+  const id = required(file, 'obligation_id', row.obligation_id);
+  if (!['pending', 'delivered', 'sent', 'failed', 'dropped'].includes(row.state)) hermesRefuse(file, `${id}.state`, `unknown obligation state ${JSON.stringify(typeof row.state === 'string' ? row.state : '')}`);
+  const session_key = typeof row.session_key === 'string' && row.session_key !== '' ? row.session_key : null;
+  return { id, session_key, target: { platform: required(file, `${id}.platform`, row.platform), chat_id: hermesRowText(row, 'chat_id') ?? '' },
+    // Kept inside the complete reader for projections of this same obligation.
+    row,
+    created_at: hermesRowText(row, 'created_at') ?? 'undefined',
+    source_fire: sourceFire(hermesRowText(row, 'source_json')) };
+}
+
+const signed = value => {
+  if (!/^[+-]?[0-9]+$/u.test(value)) return null;
+  const whole = BigInt(value);
+  return whole >= -(1n << 63n) && whole <= (1n << 63n) - 1n ? whole : null;
+};
+const float = value => {
+  if (typeof value !== 'string') return null;
+  if (/^[+-]?(?:inf|infinity)$/iu.test(value)) return value.startsWith('-') ? -Infinity : Infinity;
+  if (/^[+-]?nan$/iu.test(value)) return NaN;
+  return /^[+-]?(?:[0-9]+(?:\.[0-9]*)?|\.[0-9]+)(?:[eE][+-]?[0-9]+)?$/u.test(value) ? Number(value) : null;
+};
+const wrap = value => BigInt.asIntN(64, value);
+
+/** Native ISO epoch arithmetic, including its signed component parser and
+ * float seconds; this is not Date's calendar normalization. */
+export function hermesIsoEpoch(iso) {
+  if (typeof iso !== 'string') return null;
+  let instant, offset;
+  if (iso.endsWith('Z')) { instant = iso.slice(0, -1); offset = 0; }
+  else {
+    const time = iso.indexOf('T'); if (time < 0) return null;
+    const sign = iso.slice(time).search(/[+-]/u); if (sign < 0) return null;
+    const at = time + sign, raw = iso.slice(at), colon = raw.indexOf(':'); if (colon < 0) return null;
+    const hours = float(raw.slice(1, colon)), minutes = float(raw.slice(colon + 1));
+    if (hours == null || minutes == null) return null;
+    offset = (hours * 3600 + minutes * 60) * (raw.startsWith('-') ? -1 : 1); instant = iso.slice(0, at);
+  }
+  const split = instant.indexOf('T'); if (split < 0) return null;
+  const date = instant.slice(0, split), time = instant.slice(split + 1);
+  const firstDate = date.indexOf('-'), secondDate = date.indexOf('-', firstDate + 1);
+  const firstTime = time.indexOf(':'), secondTime = time.indexOf(':', firstTime + 1);
+  if ([firstDate, secondDate, firstTime, secondTime].some(at => at < 0)) return null;
+  let year = signed(date.slice(0, firstDate));
+  const month = signed(date.slice(firstDate + 1, secondDate)), day = signed(date.slice(secondDate + 1));
+  const hour = signed(time.slice(0, firstTime)), minute = signed(time.slice(firstTime + 1, secondTime)), seconds = float(time.slice(secondTime + 1));
+  if ([year, month, day, hour, minute, seconds].some(value => value == null)) return null;
+  year = wrap(year - (month <= 2n ? 1n : 0n));
+  const era = year < 0n ? (year - 399n) / 400n : year / 400n, yoe = wrap(year - wrap(era * 400n));
+  const adj = wrap(month > 2n ? month - 3n : month + 9n);
+  const doy = wrap(wrap(wrap(153n * adj) + 2n) / 5n + day - 1n);
+  const doe = wrap(wrap(wrap(yoe * 365n) + yoe / 4n) - yoe / 100n + doy);
+  const days = wrap(wrap(era * 146097n) + doe - 719468n);
+  return Number(wrap(wrap(wrap(days * 86400n) + wrap(hour * 3600n)) + wrap(minute * 60n))) + seconds - offset;
+}
+
+function jobSurface(job) {
+  if (job?.deliver.kind === 'origin' && job.origin?.chat_id != null) return [job.origin.platform, job.origin.chat_id];
+  if (job?.deliver.kind === 'explicit' && job.deliver.chat_id != null) return [job.deliver.platform, job.deliver.chat_id];
+  return null;
+}
+
+/** Each profile is linked as a batch, then its derived obligation sources
+ * become visible to the next profile in native profile-key order. */
+export function linkHermesFires(profiles, sessionsFor) {
+  const names = [...profiles.keys()].sort(compare), lenders = profiles.get('default').lenders;
+  for (const name of names) {
+    const profile = profiles.get(name), sessions = sessionsFor(profile);
+    const holders = profile.borrowed || profile.lenders.length ? ['default', ...lenders] : [name];
+    const known = new Map();
+    for (const holder of names) for (const obligation of profiles.get(holder).obligations) {
+      if (obligation.source_fire != null && !known.has(obligation.source_fire)) known.set(obligation.source_fire, [holder, obligation.id]);
+    }
+    const links = profile.fires.map(fire => {
+      if (known.has(fire.id)) return [fire.session_id, known.get(fire.id)];
+      const session = hermesFireSession(sessions, fire) ?? fire.session_id;
+      const rawKey = session == null ? null : sessions.find(row => row.id === session)?.session_key;
+      const key = typeof rawKey === 'string' && rawKey !== '' ? rawKey : null;
+      const surface = jobSurface(profile.jobs.get(fire.job_id)), from = hermesIsoEpoch(fire.claimed_at);
+      const to = hermesIsoEpoch(fire.finished_at) ?? Number.MAX_VALUE;
+      if (from == null) return [session, null];
+      const candidates = holders.flatMap(holder => profiles.get(holder).obligations.flatMap(obligation => {
+        const at = float(obligation.created_at);
+        return at != null && at >= from && at <= to ? [{ holder, obligation, at }] : [];
+      }));
+      const latest = predicate => candidates.filter(predicate).sort((left, right) => right.at - left.at)[0];
+      const selected = (key == null ? null : latest(row => row.obligation.session_key === key))
+        ?? (surface == null ? null : latest(row => row.obligation.target.platform === surface[0] && row.obligation.target.chat_id === surface[1]));
+      return [session, selected == null ? null : [selected.holder, selected.obligation.id]];
+    });
+    links.forEach(([session, obligation], index) => {
+      const fire = profile.fires[index]; fire.session_id = session; fire.obligation_id = obligation?.[1] ?? null;
+      if (obligation != null) {
+        const linked = profiles.get(obligation[0]).obligations.find(row => row.id === obligation[1]);
+        if (linked) linked.source_fire = fire.id;
+      }
+    });
+  }
+}

package/hermes-fires.mjs

@@ -0,0 +1,106 @@
+// Fire decoding and session linking used by the complete Hermes home reader.
+// This module reads no files and does not replace the home's validation step.
+import { nativeInteger, nativeNumberKind, parseNativeJson, stringifyNativeJsonMember } from './native-json.mjs';
+import { nativeTrim } from './text.mjs';
+
+const object = value => value != null && typeof value === 'object' && !Array.isArray(value);
+const compare = (left, right) => Buffer.compare(Buffer.from(left), Buffer.from(right));
+const statuses = { claimed: 'claimed', running: 'running', completed: 'succeeded', failed: 'failed', unknown: 'unknown' };
+const mapped = new Set(['id', 'job_id', 'status', 'claimed_at', 'started_at', 'finished_at', 'error', 'residue_json', 'session_id', 'obligation_id']);
+const refuse = (file, key, message) => { throw new Error(`${file}${key ? ` [${key}]` : ''}: ${message}`); };
+const required = (file, key, value) => typeof value === 'string' && value !== '' ? value : refuse(file, key, 'expected a non-empty string');
+const optional = (file, key, value) => value == null ? null : typeof value === 'string' ? value : refuse(file, key, 'expected a string');
+
+/** SQLite rows have already been converted to native JSON values by the
+ * read-only store boundary. Integral REAL values remain floats there. */
+export function hermesRowText(row, key) {
+  const value = row[key];
+  if (typeof value === 'string') return value;
+  if (typeof value !== 'number') return null;
+  if (nativeNumberKind(row, key) === 'float' && Number.isInteger(value) && Math.abs(value) < 1e21) {
+    const whole = BigInt(value), low = -(1n << 63n), high = (1n << 63n) - 1n;
+    return String(whole < low ? low : whole > high ? high : whole);
+  }
+  return stringifyNativeJsonMember(row, key);
+}
+
+export function decodeHermesFire(file, row) {
+  const id = required(file, 'id', row.id), word = typeof row.status === 'string' ? row.status : '';
+  if (!Object.hasOwn(statuses, word)) refuse(file, `${id}.status`, `unknown fire status ${JSON.stringify(word)}`);
+  const members = new Map();
+  for (const key of Object.keys(row)) if (!mapped.has(key) && row[key] != null) members.set(key, stringifyNativeJsonMember(row, key));
+  const extra = hermesRowText(row, 'residue_json');
+  if (extra != null) {
+    let parsed; try { parsed = parseNativeJson(extra); } catch { /* malformed extras are ignored by the native decoder */ }
+    if (object(parsed)) for (const key of Object.keys(parsed)) members.set(key, stringifyNativeJsonMember(parsed, key));
+  }
+  // Reconstruct all member facts together: an extra string/null replacing an
+  // integer must remove that field's previous integer interpretation too.
+  const residue = parseNativeJson(`{${[...members].map(([key, value]) => `${JSON.stringify(key)}:${value}`).join(',')}}`);
+  return { id, job_id: required(file, `${id}.job_id`, row.job_id),
+    session_id: hermesRowText(row, 'session_id') || null,
+    status: statuses[word], claimed_at: required(file, `${id}.claimed_at`, row.claimed_at),
+    started_at: optional(file, `${id}.started_at`, row.started_at),
+    finished_at: optional(file, `${id}.finished_at`, row.finished_at),
+    error: optional(file, `${id}.error`, row.error),
+    obligation_id: hermesRowText(row, 'obligation_id') || null, residue };
+}
+
+function instantKey(iso) {
+  const digits = iso.split(/[+Z]/u, 1)[0].replace(/[^0-9]/gu, '');
+  return digits.length >= 14 ? BigInt(digits.slice(0, 14)) : null;
+}
+function cronInstant(id, job) {
+  if (typeof id !== 'string') return null;
+  const match = /^cron_(.+)_([0-9]{8})_([0-9]{6})$/su.exec(id);
+  return match?.[0].length === id.length && match[1] === job ? BigInt(match[2] + match[3]) : null;
+}
+
+/** The native join uses the first claim-window session for an unfinished
+ * fire, the last for a finished fire, then follows at most 32 compressions. */
+export function hermesFireSession(sessions, fire) {
+  const claimed = instantKey(fire.claimed_at), finished = fire.finished_at == null ? null : instantKey(fire.finished_at);
+  if (claimed == null) return null;
+  let chosen = null;
+  for (const row of sessions) {
+    const key = cronInstant(row.id, fire.job_id);
+    if (key == null || key < claimed || finished != null && key > finished) continue;
+    if (chosen == null || (finished == null ? key < chosen.key : key >= chosen.key)) chosen = { key, id: row.id };
+  }
+  if (chosen == null) return null;
+  let current = chosen.id;
+  for (let depth = 0; depth < 32; depth++) {
+    if (sessions.find(row => row.id === current)?.end_reason !== 'compression') return current;
+    let next = null;
+    for (const row of sessions) {
+      if (row.parent_session_id !== current) continue;
+      const time = typeof row.started_at === 'number' ? row.started_at : 0;
+      const id = typeof row.id === 'string' ? row.id : '';
+      if (next == null || time > next.time || time === next.time && compare(id, next.id) >= 0) next = { row, time, id };
+    }
+    if (typeof next?.row.id !== 'string') return current;
+    current = next.row.id;
+  }
+  return current;
+}
+
+export function hermesFirePid(fire) {
+  let pid = nativeInteger(fire.residue, 'pid');
+  if (pid == null && typeof fire.residue.pid === 'string') {
+    const text = nativeTrim(fire.residue.pid);
+    if (/^\+?[0-9]+$/u.test(text)) pid = BigInt(text);
+  }
+  return pid != null && pid <= 0xffffffffn ? Number(pid) : null;
+}
+
+/** Profiles arrive from the whole validated home. Later fires replace earlier
+ * fires for the same session, in profile-key and ledger order. */
+export function hermesActivityFires(profiles) {
+  const fires = new Map();
+  for (const [, profile] of [...profiles].sort(([left], [right]) => compare(left, right))) {
+    for (const fire of profile.fires) if (fire.session_id != null) fires.set(fire.session_id, {
+      status: fire.status, pid: hermesFirePid(fire),
+    });
+  }
+  return fires;
+}

package/hermes-read-home.d.ts

@@ -0,0 +1,3 @@
+/** Read the Hermes home dependencies and its derived session/fire links.
+ * Failure establishes no activity evidence; no file is written. */
+export function readHermesActivityHome(root: string): Map<string, { status: 'claimed' | 'running' | 'succeeded' | 'failed' | 'unknown'; pid: number | null }>;

package/hermes-read-home.mjs

@@ -0,0 +1,235 @@
+// The complete Hermes home validity boundary behind an activity reading.
+// The projection keeps fire links, while reading and validating every file
+// dependency of the native home codec. It neither exports nor writes a home.
+import { readFileSync, readdirSync, statSync, lstatSync, realpathSync } from 'node:fs';
+import { toNamespacedPath } from 'node:path';
+import { childPath } from './session-spend-files.mjs';
+import { nativeInteger, parseNativeJson } from './native-json.mjs';
+import { folderTriggerRecords } from './trigger-records.mjs';
+import { folderChannelRecords } from './channel-records.mjs';
+import { nativeTrim } from './text.mjs';
+import { decodeHermesFire, hermesActivityFires } from './hermes-fires.mjs';
+import { decodeHermesObligation, hermesSessionProfile, linkHermesFires } from './hermes-fire-links.mjs';
+import { hermesTableExists, readHermesRows } from './hermes-read-store.mjs';
+import { readHermesYaml } from './hermes-read-yaml.mjs';
+import { validateHermesWorkflow } from './hermes-read-workflow.mjs';
+import { hermesObject, hermesRefuse, hermesJobRecords, validateHermesWorker, validateHermesBudgets, validateHermesRoutes, validateHermesChannels, validateHermesSubscriptions } from './hermes-read-validation.mjs';
+import { validateOrchestratorAgentLayer, orchestratorRoutingSlot } from './orchestrator-read-records.mjs';
+
+const utf8 = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true });
+const nameUtf8 = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true });
+const compare = (left, right) => Buffer.compare(Buffer.from(left), Buffer.from(right));
+const selected = (root, path) => childPath(root, path);
+const isFile = path => { try { return statSync(path).isFile(); } catch { return false; } };
+const isDirectory = path => { try { return statSync(path).isDirectory(); } catch { return false; } };
+const display = path => Buffer.isBuffer(path) ? path.toString('utf8') : path;
+function readText(root, name) {
+  const path = selected(root, name);
+  return isFile(path) ? utf8.decode(readFileSync(path)) : null;
+}
+function dotenv(text) {
+  const values = new Map();
+  for (const line of (text ?? '').split('\n')) {
+    const trimmed = nativeTrim(line); if (!trimmed || trimmed.startsWith('#')) continue;
+    const equal = trimmed.indexOf('='); if (equal < 0) continue;
+    const key = nativeTrim(trimmed.slice(0, equal)); let value = nativeTrim(trimmed.slice(equal + 1));
+    if (value.length >= 2 && (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'"))) value = value.slice(1, -1);
+    values.set(key, value);
+  }
+  return values;
+}
+
+// Access files deliberately ignore unread/malformed entries, as the codec
+// does. Their values remain internal to this read and confer no caller grant.
+function readAccess(root, env, platforms) {
+  const allow = new Map(), admins = new Map(), policy = new Map();
+  const truthy = value => ['1', 'true', 'yes', 'on'].includes(nativeTrim(value).replace(/[A-Z]/gu, c => c.toLowerCase()));
+  const split = value => value.split(',').map(nativeTrim).filter(Boolean);
+  const append = (map, key, values) => map.set(key, [...map.get(key) ?? [], ...values]);
+  for (const [key, value] of env) {
+    if (key.endsWith('_ALLOWED_USERS')) append(allow, key.slice(0, -14).replace(/[A-Z]/gu, c => c.toLowerCase()), split(value));
+    else if (key.endsWith('_ALLOW_ALL_USERS') && truthy(value)) policy.set(key.slice(0, -16).replace(/[A-Z]/gu, c => c.toLowerCase()), 'open');
+  }
+  for (const name of ['platforms/pairing', 'pairing']) {
+    let entries; try { entries = readdirSync(selected(root, name), { encoding: 'buffer' }); } catch { continue; }
+    for (const entry of entries) {
+      const file = entry.toString('utf8'); if (!file.endsWith('-approved.json')) continue;
+      try {
+        const value = parseNativeJson(utf8.decode(readFileSync(childPath(selected(root, name), entry))));
+        if (hermesObject(value)) append(allow, file.slice(0, -14), Object.keys(value));
+      } catch { /* unread access metadata establishes no allowlist member */ }
+    }
+  }
+  const global = truthy(env.get('GATEWAY_ALLOW_ALL_USERS') ?? '');
+  if (hermesObject(platforms)) for (const [platform, block] of Object.entries(platforms)) {
+    if (global) policy.set(platform, 'open');
+    for (const key of ['allow_admin_from', 'group_allow_admin_from']) {
+      const parent = hermesObject(block.extra) && Object.hasOwn(block.extra, key) ? block.extra : block;
+      const value = parent[key];
+      const ids = typeof value === 'string' ? split(value) : Array.isArray(value)
+        ? value.flatMap((item, index) => typeof item === 'string' ? [item]
+          : nativeInteger(value, String(index), { signed: true }) != null ? [String(nativeInteger(value, String(index), { signed: true }))] : []) : [];
+      append(admins, platform, ids);
+    }
+  }
+  for (const map of [allow, admins]) for (const [key, values] of map) {
+    if (!values.length) map.delete(key); else map.set(key, [...new Set(values)].sort(compare));
+  }
+  return { allow, admins, policy };
+}
+
+const credentialName = (platform, key) => `${platform}_${key}`.replace(/[^A-Za-z0-9]/gu, '_').toUpperCase();
+function channelCredentialNames(platforms, vault) {
+  const walk = (platform, block, prefix = '') => {
+    for (const [key, value] of Object.entries(block)) {
+      if (key === 'enabled' && !prefix) continue;
+      if (typeof value === 'string' && /^\$\{[A-Za-z_][A-Za-z0-9_]*\}$/u.test(value)) continue;
+      if (key === 'extra' && !prefix && hermesObject(value)) walk(platform, value, 'extra.');
+      else if (typeof value === 'string' && /token|secret|key|password|passwd|api_key|app_secret|signing|webhook_url|private/u.test(key.replace(/[A-Z]/gu, char => char.toLowerCase()))) vault.add(credentialName(platform, `${prefix}${key}`));
+    }
+  };
+  if (hermesObject(platforms)) for (const [platform, block] of Object.entries(platforms)) walk(platform, block);
+}
+function profile(name, dir, flavor, vault) {
+  const env = dotenv(readText(dir, '.env')), configText = readText(dir, 'config.yaml'), configFile = display(selected(dir, 'config.yaml'));
+  const config = configText == null ? Object.create(null) : readHermesYaml(configFile, configText);
+  if (!hermesObject(config)) hermesRefuse(configFile, '', 'expected a mapping');
+  validateHermesWorker(configFile, config.worker); validateHermesBudgets(configFile, config.budgets);
+  const routes = Array.isArray(config.profile_routes) ? config.profile_routes : hermesObject(config.gateway) && Array.isArray(config.gateway.profile_routes) ? config.gateway.profile_routes : [];
+  validateHermesRoutes(configFile, routes);
+  validateHermesChannels(configFile, config.platforms);
+  for (const key of env.keys()) vault.add(key);
+  const known = new Set(vault); channelCredentialNames(config.platforms, vault);
+  const configPresent = configText != null && !(flavor === 'orchestrator' && [...vault].some(key => !known.has(key)));
+  readText(dir, flavor === 'hermes' ? 'SOUL.md' : 'AGENTS.md');
+  const jobsText = readText(dir, 'cron/jobs.json'), jobsFile = display(selected(dir, 'cron/jobs.json'));
+  const jobs = jobsText == null ? new Map() : hermesJobRecords(jobsFile, parseNativeJson(jobsText));
+  const executionFile = selected(dir, 'cron/executions.db');
+  const fires = hermesTableExists(executionFile, 'executions')
+    ? (readHermesRows(executionFile, 'select * from executions order by claimed_at, id') ?? []).map(row => decodeHermesFire(display(executionFile), row)) : [];
+  const subscriptionsText = readText(dir, 'webhook_subscriptions.json');
+  const subscriptions = subscriptionsText == null ? Object.create(null) : parseNativeJson(subscriptionsText);
+  if (subscriptionsText != null) {
+    validateHermesSubscriptions(display(selected(dir, 'webhook_subscriptions.json')), subscriptions);
+    for (const [name, subscription] of Object.entries(subscriptions)) if (typeof subscription.secret === 'string' && !/^\$\{[A-Za-z_][A-Za-z0-9_]*\}$/u.test(subscription.secret)) vault.add(credentialName('webhook', `${name}_secret`));
+  }
+  readAccess(dir, env, config.platforms);
+  const store = selected(dir, 'state.db');
+  const obligations = hermesTableExists(store, 'delivery_obligations')
+    ? (readHermesRows(store, 'select * from delivery_obligations order by created_at, obligation_id') ?? []).map(row => decodeHermesObligation(display(store), row)) : [];
+  // The native binding fold never refuses individual rows, but the query's
+  // columns/order and read failure remain dependencies of the full load.
+  const bindings = new Set();
+  if (flavor === 'orchestrator') {
+    if (hermesTableExists(store, 'gateway_routing')) {
+      const sessions = selected(dir, 'sessions'); let scope;
+      const canonical = path => {
+        const resolved = realpathSync(path);
+        return process.platform === 'win32' ? toNamespacedPath(resolved) : resolved;
+      };
+      try { scope = canonical(sessions); }
+      catch { try { scope = display(selected(canonical(dir), 'sessions')); } catch { scope = display(sessions); } }
+      for (const row of readHermesRows(store, 'select session_key, entry_json from gateway_routing where scope = ? order by updated_at', [scope]) ?? []) {
+        const slot = orchestratorRoutingSlot(row); if (slot != null) bindings.add(slot);
+      }
+    }
+  } else if (hermesTableExists(store, 'sessions')) readHermesRows(store, 'select * from sessions order by started_at, id');
+  return { name, dir, store, fires, jobs, obligations, lenders: [], borrowed: false, config, configPresent, routes, bindings, subscriptions, channelRecords: folderChannelRecords(config, env) };
+}
+
+function partitionSharedStore(profiles, root) {
+  const store = selected(root, 'state.db'); if (!isFile(store)) return;
+  const primary = profiles.get('default');
+  for (const name of [...profiles.keys()].filter(name => name !== 'default').sort(compare)) {
+    const profile = profiles.get(name); if (isFile(profile.store)) continue;
+    profile.borrowed = true; primary.lenders.push(name);
+    if (hermesTableExists(store, 'sessions')) readHermesRows(store, 'select * from sessions where profile_name = ? order by started_at, id', [name]);
+    profile.obligations = primary.obligations.filter(row => hermesSessionProfile(row.session_key) === name);
+    primary.obligations = primary.obligations.filter(row => hermesSessionProfile(row.session_key) !== name);
+  }
+}
+
+function inventory(root) {
+  const owned = new Set(['config.yaml', '.env', 'cron/jobs.json', 'cron/executions.db', 'webhook_subscriptions.json', 'state.db', 'agents.json', 'SOUL.md']);
+  const runtime = new Set(['orchestrator.lock', 'orchestrator.sock', 'board.lock', 'board.sock', 'board.epoch', 'service']);
+  const walk = (dir, prefix = '') => {
+    let entries;
+    try { entries = readdirSync(dir, { encoding: 'buffer' }); }
+    catch (error) { if (prefix && error.code === 'ENOENT') return; throw error; }
+    entries.sort(Buffer.compare);
+    for (const entry of entries) {
+      const name = entry.toString('utf8'), rel = `${prefix}${name}`, path = childPath(dir, entry);
+      if (rel === 'profiles' || ['node_modules', '.git'].includes(name) || rel.startsWith('state.db') || rel.startsWith('cron/executions.db') || runtime.has(rel) || /\.tmp-[0-9]+$/u.test(name)) continue;
+      let info; try { info = lstatSync(path); } catch (error) { if (error.code === 'ENOENT') continue; throw error; }
+      if (info.isDirectory()) walk(path, `${rel}/`);
+      else if (info.isFile() && !owned.has(rel)) { /* the projection carries no file inventory on its wire */ }
+    }
+  };
+  walk(root);
+}
+
+function readFolderHome(root, flavor = 'hermes') {
+  if (!isDirectory(root)) hermesRefuse(display(root), '', 'not a directory');
+  const vault = new Set(), profiles = new Map([['default', profile('default', root, flavor, vault)]]), named = selected(root, 'profiles');
+  if (isDirectory(named)) {
+    const names = readdirSync(named, { encoding: 'buffer' }).flatMap(entry => {
+      let name; try { name = nameUtf8.decode(entry); } catch { return []; }
+      return name !== 'node_modules' && !name.startsWith('.') && isDirectory(childPath(named, entry)) ? [name] : [];
+    }).sort(compare);
+    for (const name of names) {
+      if (name === 'default') hermesRefuse(display(selected(named, name)), '', '"default" is the root folder, not a named profile');
+      profiles.set(name, profile(name, selected(named, name), flavor, vault));
+    }
+  }
+  const workflow = readText(root, 'workflow.yaml');
+  if (workflow != null) validateHermesWorkflow(display(selected(root, 'workflow.yaml')), readHermesYaml(display(selected(root, 'workflow.yaml')), workflow));
+  const agents = readText(root, 'agents.json'); // Hermes ignores its contents after the strict UTF-8 file read.
+  if (flavor === 'orchestrator' && agents != null) validateOrchestratorAgentLayer(agents);
+  if (flavor === 'hermes') partitionSharedStore(profiles, root);
+  const rootStore = selected(root, 'state.db');
+  linkHermesFires(profiles, profile => {
+    const store = isFile(profile.store) ? profile.store : rootStore;
+    return hermesTableExists(store, 'sessions') ? readHermesRows(store, 'select id, started_at, end_reason, parent_session_id, session_key from sessions') ?? [] : [];
+  });
+  if (flavor === 'hermes') for (const profile of profiles.values()) inventory(profile.dir);
+  return profiles;
+}
+
+export function readHermesActivityHome(root) { return hermesActivityFires(readFolderHome(root)); }
+
+export function readChannelFolderHome(root, flavor = 'hermes') {
+  return new Map([...readFolderHome(root, flavor)].map(([name, profile]) => [name, profile.channelRecords]));
+}
+
+// Only recorded run facts leave this projection; configuration and credentials
+// remain internal to the same complete home validity and linking boundary.
+export function readRunFolderHome(root, flavor = 'hermes') {
+  return new Map([...readFolderHome(root, flavor)].map(([name, profile]) => [name, {
+    fires: profile.fires, obligations: profile.obligations,
+  }]));
+}
+
+// Route fields leave only after the complete folder codec has admitted the
+// home. No other configuration or credential value crosses this projection.
+export function readTriggerFolderHome(root, flavor = 'hermes') {
+  return new Map([...readFolderHome(root, flavor)].map(([name, profile]) => [name, folderTriggerRecords(profile.subscriptions, profile.config)]));
+}
+
+export function readRouteFolderHome(root, flavor = 'hermes') {
+  return new Map([...readFolderHome(root, flavor)].map(([name, profile]) => [name, profile.routes]));
+}
+
+// Keep credential/configuration values internal to the complete home read.
+// Only the fields of the profile noun cross this projection boundary.
+export function readProfileFolderHome(root, flavor = 'hermes') {
+  return new Map([...readFolderHome(root, flavor)].map(([name, profile]) => {
+    const rawModel = profile.config.model;
+    const text = value => typeof value === 'string' ? value : null;
+    const model = flavor === 'hermes' ? text(rawModel) ?? (hermesObject(rawModel) ? text(Object.hasOwn(rawModel, 'default') ? rawModel.default : rawModel.model) : null) : text(profile.config.worker?.model);
+    return [name, {
+      dir: profile.dir, store: profile.store, configPresent: profile.configPresent,
+      routes: profile.routes.map(route => ({ agent: route.agent ?? route.profile })),
+      bindings: profile.bindings.size, model, worker: text(profile.config.worker?.harness),
+    }];
+  }));
+}

package/hermes-read-store.mjs

@@ -0,0 +1,49 @@
+// The orchestration codec's read-only SQLite row contract. Opening a ledger
+// establishes no owner, and a missing/unopenable table establishes no rows.
+import { DatabaseSync } from 'node:sqlite';
+import { statSync } from 'node:fs';
+import { setNativeInteger, setNativeFloat } from './native-json.mjs';
+
+const file = path => { try { return statSync(path).isFile(); } catch { return false; } };
+const text = new TextDecoder('utf-8', { ignoreBOM: true });
+const pathText = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true });
+function databasePath(path) {
+  if (!Buffer.isBuffer(path)) return path;
+  // The supported Node 22/23 SQLite constructor takes a string path.
+  // Decode only byte-exact UTF-8; newer runtimes keep other byte paths.
+  try { return pathText.decode(path); } catch { return path; }
+}
+function open(path) {
+  const db = new DatabaseSync(databasePath(path), { readOnly: true, allowExtension: false });
+  try { db.exec('PRAGMA busy_timeout=0'); return db; }
+  catch (error) { db.close(); throw error; }
+}
+
+export function hermesTableExists(path, table) {
+  if (!file(path)) return false;
+  let db;
+  try {
+    db = open(path);
+    return db.prepare("select name from sqlite_master where type='table' and name=?").get(table) != null;
+  } catch { return false; }
+  finally { db?.close(); }
+}
+
+export function readHermesRows(path, sql, params = []) {
+  if (!file(path)) return null;
+  let db;
+  try {
+    db = open(path);
+    const statement = db.prepare(sql); statement.setReadBigInts(true);
+    return statement.all(...params).map(row => {
+      const result = Object.create(null);
+      for (const [key, value] of Object.entries(row)) {
+        if (typeof value === 'bigint') setNativeInteger(result, key, value);
+        else if (typeof value === 'number') setNativeFloat(result, key, value);
+        else result[key] = value instanceof Uint8Array ? text.decode(value) : value;
+      }
+      return result;
+    });
+  } catch (error) { throw new Error(`${path}: ${error.message}`, { cause: error }); }
+  finally { db?.close(); }
+}