@zackbart/connecta 0.36.0 → 0.36.1

package/dist/providers/vercel/api.js

@@ -17,7 +17,7 @@ import { pinAdmission, pinOptions, pinQuery, pinRoute, readPinnedTeam } from "./
 export const MAX_RESPONSE_BYTES = 8 * 1024 * 1024;
 export const READ_CAP_MS = 60_000;
 /** POSTs that only read, admitted by `vercel_api_read`. */
-export const READ_POSTS = [
+const READ_POSTS = [
     ["POST", "/v2/observability/query", "Runs an Observability metrics query; Vercel persists nothing."],
     ["POST", "/v1/registrar/domains/availability", "Checks availability for a list of domains; buys nothing."],
     ["POST", "/v1/registrar/domains/price", "Quotes registrar prices for a list of domains; buys nothing."],
@@ -39,7 +39,7 @@ export function invalid(message) {
 export function compact(value) {
     return Object.fromEntries(Object.entries(value).filter(([, entry]) => entry !== undefined));
 }
-export function truthy(value) {
+function truthy(value) {
     return value === true || value === 1 || (typeof value === "string" && /^(?:1|true)$/i.test(value.trim()));
 }
 /**
@@ -155,34 +155,34 @@ class VercelIndex extends OperationIndex {
     }
 }
 export const vercelIndex = new VercelIndex(discoveryIndex(openapi), { vendor: "vercel", title: "Vercel" });
-export const vercelSafety = valueSafety(VERCEL_VALUE_SAFETY, () => vercelIndex);
+const vercelSafety = valueSafety(VERCEL_VALUE_SAFETY, () => vercelIndex);
 const Query = Schema.Record(Schema.String, Schema.Union([Schema.String, Schema.Array(Schema.String)]));
 const params = (...names) => Schema.Struct(Object.fromEntries(names.map((name) => [name, Schema.String])));
-export const currentUser = get("currentUser", "/v2/user", { success: Schema.Unknown });
-export const teams = get("teams", "/v2/teams", { query: Query, success: Schema.Unknown });
-export const projectEnv = get("projectEnv", "/v10/projects/:idOrName/env", {
+const currentUser = get("currentUser", "/v2/user", { success: Schema.Unknown });
+const teams = get("teams", "/v2/teams", { query: Query, success: Schema.Unknown });
+const projectEnv = get("projectEnv", "/v10/projects/:idOrName/env", {
     params: params("idOrName"),
     query: Query,
     success: Schema.Unknown,
 });
-export const upsertEnv = post("upsertEnv", "/v10/projects/:idOrName/env", {
+const upsertEnv = post("upsertEnv", "/v10/projects/:idOrName/env", {
     params: params("idOrName"),
     query: Query,
     payload: Schema.Unknown,
     success: Schema.Unknown,
 });
-export const updateEnv = patch("updateEnv", "/v9/projects/:idOrName/env/:id", {
+const updateEnv = patch("updateEnv", "/v9/projects/:idOrName/env/:id", {
     params: params("idOrName", "id"),
     query: Query,
     payload: Schema.Unknown,
     success: Schema.Unknown,
 });
-export const buildLogs = get("buildLogs", "/v3/deployments/:idOrUrl/events", {
+const buildLogs = get("buildLogs", "/v3/deployments/:idOrUrl/events", {
     params: params("idOrUrl"),
     query: Query,
     success: Schema.Unknown,
 });
-export const runtimeLogs = get("runtimeLogs", "/v1/projects/:projectId/deployments/:deploymentId/runtime-logs", {
+const runtimeLogs = get("runtimeLogs", "/v1/projects/:projectId/deployments/:deploymentId/runtime-logs", {
     params: params("projectId", "deploymentId"),
     query: Query,
     success: Schema.Unknown,
@@ -294,7 +294,7 @@ export const refuse = (call) => {
     }
     return undefined;
 };
-export function scope(call, teamId, pin) {
+function scope(call, teamId, pin) {
     if (pin)
         return { ...call, query: pinQuery(vercelIndex, call, pin) };
     const query = { ...call.query };
@@ -374,7 +374,7 @@ export function queryOf(call) {
 export function queryPairs(call) {
     return Object.entries(queryOf(call)).flatMap(([key, value]) => (Array.isArray(value) ? value : [value]).map((value) => [key, value]));
 }
-export function sendVercel(connection, call, options, sendOptions) {
+function sendVercel(connection, call, options, sendOptions) {
     return checked(() => {
         const server = checkServer(call.op.server);
         if (server)

package/dist/providers/vercel/lib/pin.js

@@ -34,7 +34,7 @@ const object = (value) => value !== null && typeof value === "object" && !Array.
 const fail = (reason) => {
     throw new ConnectorCallError("provider_permission_denied", `Vercel team pin: ${reason} Not sent to the requested resource.`, { retryable: false });
 };
-export function validatePin(options) {
+function validatePin(options) {
     if (options.pin === undefined)
         return;
     const id = options.pin?.teamId;

package/dist/routes/mcp.js

@@ -268,7 +268,7 @@ function scopedToBody(handler, signal) {
  * The request's admission permit, owned by its Scope.
  *
  * Admission goes through the controller's Promise rather than its Effect
- * program (`acquireScoped`), on purpose. The pool is shared by every request
+ * program, on purpose. The pool is shared by every request
  * in the isolate, and a queued request is handed its permit from inside the
  * request whose body just ended. A fiber resumed there would authorize and
  * serve this request in that one's I/O context, which workerd refuses;

package/dist/runtime/admission.js

@@ -7,7 +7,6 @@
 // read its private bookkeeping, and one that emits nothing into the `.d.ts`.
 // Promise callers keep `acquire()`, which runs the same program through
 // runEdge; Effect callers come through this module and never see a Promise.
-import { Effect } from "effect";
 let program;
 /**
  * Install the controller's admission program. Called once, by
@@ -32,14 +31,3 @@ export function admit(controller, options = {}) {
     }
     return program(controller, options.signal, options.wait !== false);
 }
-/**
- * A lease owned by the enclosing Scope: released when the scope closes, on
- * success, failure, or interruption alike. The wait itself stays
- * interruptible — a queued request whose caller left must not hold its place
- * in line until the queue timeout.
- */
-export function acquireScoped(controller, options = {}) {
-    return Effect.acquireRelease(admit(controller, options), (lease) => Effect.sync(() => lease.release()), {
-        interruptible: true,
-    });
-}

package/dist/storage/keys.js

@@ -2,9 +2,8 @@
 //
 // A deployment has one KVStorage (D1 on Workers, SQLite on Node, memory in
 // tests), and every subsystem shares it. Sharing is safe because no two
-// families claim overlapping keys, and that is only checkable if every key is
-// built here: `test/storage-keys.node.test.ts` fails when another source file
-// spells one of these prefixes itself.
+// families claim overlapping keys. Build every key here; persistence journeys
+// check actual isolation through the deployment and its physical database.
 //
 // Each family records:
 //

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const CONNECTA_VERSION = "0.36.0";
+export declare const CONNECTA_VERSION = "0.36.1";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Generated from package.json by scripts/generate-version.mjs.
 // Workers-safe: no runtime filesystem read or deployment override.
-export const CONNECTA_VERSION = "0.36.0";
+export const CONNECTA_VERSION = "0.36.1";

package/documentation/architecture.md

@@ -763,9 +763,9 @@ adoption, OAuth handoff ownership, single-use connect links, every downstream
 OAuth grant write and consent claim, the result stash, and initialization of the cursor signing key.
 
 Every key is built in `src/storage/keys.ts`, which lists each family with its
-scope, version, codec, and TTL policy; `test/storage-keys.node.test.ts` fails when
-two families overlap, another source file spells a prefix (constant concatenation
-folded), or a storage call passes a key holding literal text. Core hands
+scope, version, codec, and TTL policy. Deployed-consumer persistence journeys
+check actual owner isolation in the physical database; key probes retain NUL
+refusal. Core hands
 subsystems namespaced views: `conn:<id>:` per connector, `principal:<key>:` per
 personal registry, `results:` and `subject:<key>:` for result paging.
 
@@ -1266,20 +1266,16 @@ removed. Legacy hosted selectors fail at construction with the generic migration
 path. GitHub retains its scope-enforced App identity and exposes a bounded repository-read and release-write hatch plus local scope discovery, scoped data search and guarded merge.
 
 [Decision 0011](https://github.com/zackbart/connecta/blob/main/decisions/0011-provider-standard.md)
-records the provider standard now implemented by all 15 maintained providers. It fixes
+records the provider standard implemented by every maintained provider. It fixes
 one folder layout per kind and fixed evidence names. `drift.json` gets a
 generated block and the guide a generated Conventions section, and every
-`api()` surface gets one agent-facing shape. Providers completed two migration
-steps: onto the kit with unchanged output, then onto the standard surface.
-Both `PENDING.step1` and `PENDING.step2` in `test/provider-standard.ts` are empty;
-every maintained provider now meets the standard without a migration exemption.
-`test/provider-standard.node.test.ts` holds every maintained provider folder to the
-standard, and `test/provider-conventions.test.ts` checks the surface rules on
-Node. `providers:generate` writes the standard's derived parts and
-refuses a provider past step 1 that breaks the `drift.json` rules, or one past
-step 2 that breaks the guide rules: `drift.json` version 2's `generated` block
-(operations from the kit's `ProviderKitFacts` and evidence digests), and a guide's `## Conventions`, rendered
-from the definition's declarations into `skill.generated.ts`.
+`api()` surface gets one agent-facing shape. Every maintained provider meets the
+standard without a migration exemption. `test/provider-standard.node.test.ts`
+holds every provider folder to it, and `test/provider-conventions.test.ts`
+checks the surface rules on Node. `providers:generate` refuses drift (D) and
+guide (G) violations before writing. It derives `drift.json` version 2's
+`generated` block from kit operations and evidence digests, and the guide's
+`## Conventions` from definition declarations into `skill.generated.ts`.
 The generator requires `fixtures.ts` to export `createAuthored()` with a
 nonempty offline `staticTools` catalog. Its input/output schemas derive one
 paging convention, including `get_*`, hatch search and details, excluding
@@ -1291,8 +1287,9 @@ reports a nonzero explicit refusal count with singular/plural wording and
 points to the actual prefixed details tool with method/path lookup; it never
 embeds the refusal table. Unreviewed operations remain refused.
 `ProviderContext.usageGuide` selects a guide's `<!-- when: <key> -->` blocks
-with the definition's `blocks`. `providers:check` reads both record versions,
-reports a manifest operation no endpoint row records at the provider's level,
+with the definition's `blocks`. Maintained drift records use version 2;
+`providers:check` retains version-1 endpoint/manual record parsing for historical
+reports, while OpenAPI generation and checks use `evidence/openapi.json`. It reports a manifest operation no endpoint row records at the provider's level,
 and lists manual checks last verified more than 180 days ago. Its offline
 record validator, `scripts/drift-validate.mjs`, also gates `providers:generate`
 and the standard suite, so a record they accept is one `providers:check` reads.
@@ -1356,8 +1353,10 @@ acknowledgement, then reconciles vendor state with exactly one physical send.
 `test/provider-privacy-journey.node.test.ts` checks credential echoes over HTTP.
 Focused provider suites retain MIME/draft restrictions, revision conflicts,
 CCB routing, Planning Center product exclusions and deployment pins. Native
-HTTP framing, cursor and request-lifetime fault probes remain in the HTTP suites;
-catalog copies and decoder/adapter parity matrices are retired under #1072.
+HTTP framing, cursor and request-lifetime fault probes remain in the HTTP suites.
+The catalog-wide status sweep and its argument roster, catalog/ranking copies
+and unused paging strategy tests are retired under #1072. Provider workflows
+belong in the existing shared outcomes; a new tool requires no failure-matrix row.
 No legacy REST tool adapter remains.
 Large documents opt into generator options that drop restated operation ids
 and plain path parameters and cap one operation's details (`opBudget`).
@@ -1376,7 +1375,7 @@ schemaless and non-JSON responses declare no fields. Request shrinking and
 endpoint contract digests do not depend on this metadata.
 Fields remain optional additive metadata, so a previously compiled
 index without the source bytes remains usable without inventing a response
-contract. Vercel's step-2 pin review restores response metadata from the reviewed public
+contract. Vercel's pin includes response metadata from the reviewed public
 document; operations without declared response properties still refuse fields. Breeze's pin declares no response
 properties. GitHub's immutable official OpenAPI pin supplies its complete index and response fields; a reviewed repository allowlist controls dispatch. Natural queries with reviewed matches scope discovery to those matches and named-only operations; explicit paths and unmatched queries retain full-pin refusal discovery.
 `check:providers-generated` checks each index header against its source record
@@ -1435,14 +1434,12 @@ every vendor ships one reviewed table through one mechanism
    signing, webhooks, drains, transfer, claim, and invite codes). It is the
    union of the detectors Cloudflare and Vercel shipped first, and
    deliberately over-inclusive. `providers:spec` writes
-   `evidence/value-safety.json` (`value-safety.candidates.json` until the
-   provider's step 1) when the source record sets
+   `evidence/value-safety.json` when the source record sets
    `options.valueSafety` (vendor `operationWords`; Stripe's `expansions: false`
    skips id-or-object expansions, which are their own operations' candidates),
    stamped with the pinned digest, the detector format, and its options. The
    file is test evidence and never ships.
-2. **One reviewed verdict per candidate**, in the vendor's `safety.ts`
-   (`value-safety.ts` until its step 1):
+2. **One reviewed verdict per candidate**, in the vendor's `safety.ts`:
    `refuse` (the generic tools refuse it before transport, naming the
    operation and the reason), `redact` (reviewed field paths), or `safe`, each
    with a reason. Paths are dot paths into the data a tool returns: a list on
@@ -1627,14 +1624,13 @@ response schema can return (through `options.valueSafety.dataRoot` for an
 envelope such as Cloudflare's `result`), and every resource rule path
 something the resource's schema can return. It stamps the paths that resolve
 into the candidates file and fails on the rest, unless the table's `absent`
-field (`value-safety.absent.json` until the provider's step 1) acknowledges
+field acknowledges
 them with a reason (shared verdicts applied to operations whose schema lacks a
 path, or fields a schema leaves undeclared; such paths still apply at
 runtime).
 
 `test/fixtures/value-safety.ts` is the shared harness each vendor's
-`value-safety.node.test.ts` (`provider.safety.node.test.ts` after its step 1)
-runs; `reviewProblems` is pure, and
+`provider.safety.node.test.ts` runs; `reviewProblems` is pure, and
 `test/value-safety-harness.node.test.ts` proves wrong paths fail it. It fails
 on candidates from another pin, format, or option set; an unreviewed
 candidate; a verdict for an operation the index lacks; a table path the stamp
@@ -1672,21 +1668,74 @@ capture determinism. Production invariants remain unchanged.
 Use the existing stateful fixture vendors and published-edge deployment adapters:
 
 - `pnpm run eval:outcomes` drives representative joins, retained paging, endpoint
-  refusal, auth handoff, value safety and refund recovery. Graders inspect
+  refusal, auth handoff, value safety and recovery after committed refunds,
+  cancellations, DNS and environment updates, plus a single GitHub draft release
+  and Google document partial creation and shared-drive permissions. Graders inspect
   independent downstream state and the physical mutation ledger, and reject
   wrong targets, duplicate writes, missing completion and interrupted trials.
+  Every reference also rejects a fabricated correct answer without the work.
+  Promoted read journeys reject erased MCP data even with the vendor ledger intact.
 - `pnpm run eval:smoke` boots the Node template, Node eval deployments and native
-  Workers deployments, including the actual QuickBooks provider, then exercises
+  Workers deployments, including the actual QuickBooks and Granola providers, then exercises
   MCP and the operator page.
+- The shared `granola-workspace-journey` outcome uses actual provider reads,
+  independent fake meeting state and physical cursor/filter requests on both
+  Node/SQLite/QuickJS and native Workers/D1. It covers transcript-too-large
+  recovery, empty intermediate pages, selected fields, withheld photo/credential
+  values and shared-vault reuse after application reconstruction. No-op,
+  fabricated-read and erased-delivery controls must fail.
+- `test/identity-write-journey.node.test.ts` uses the existing Node deployment
+  adapter, stateful MCP fake, SQLite vault and QuickJS to grade admitted human
+  and machine identities, pool isolation, fail-closed discovery, endpoint and
+  connector policy, physical mutation counts, ambiguous-write reconciliation,
+  credential ownership and payload-free activity. Independent decoding checks
+  returned private values and credential echoes; positive record facts must
+  still arrive. An explicitly writable pool also exercises reopening a
+  read-only deployment without bypassing connector policy.
+- `test/cancellation-journey.node.test.ts` observes a queued client's departure
+  without another vendor send, and an active client's departure after the
+  vendor commits. The vendor must see its held response socket close before
+  releasing it; a later MCP read recovers the committed intent exactly once.
+  `test/cancellation-faults.test.ts` keeps signal-less token-resolution,
+  warmed-credential digest, stalled body-cleanup and abort/grant races on Node
+  and workerd. These replace the universal Promise-method/seam/owner matrix
+  and its enrollment self-test, plus migration-only runtime wrapper checks.
+- `test/browser/operator-flows.spec.ts` serves the actual operator shell and
+  routes over TCP with file-backed SQLite. Sign-in, Settings provenance, OAuth
+  connect/disconnect and credential save/test/replace/remove survive closing and
+  reopening the app, database and vault. An independent SQL connection reads
+  trigger counts: one save, one replacement, one removal, and no credential
+  writes from reads or a rejected replacement. A real SQL trigger failure leaves the old
+  credential usable after restart. MCP calls verify that those edits preserve
+  the reader pool's actual read access and write refusal. Activity renders
+  successful calls recorded before restart without either credential value.
+- The existing Node-template `eval:smoke` target constructs invalid config from
+  published imports before any I/O and reuses a stored token after restarting
+  the consumer process. Its Worker-fakes target saves a personal credential in
+  Chromium, refuses another owner's use, saves that owner's invalid credential,
+  then restarts workerd on the same D1 directory. Actual downstream records
+  remain readable only to the correct owner. Direct SQL inspection finds two
+  distinct durable encrypted rows and exactly one committed save for each.
+- Keep focused SQL batch/schema/retention rollback, clock-skew and absolute
+  expiry, NUL/UTF-8 and literal-prefix, cross-connection claims, cancellation,
+  corrupt-row and tracing-secrecy probes. Keep operator identity/slot fences,
+  deadlines, CSRF, restricted-view projection and sink secrecy probes. These
+  cover faults that a successful browser journey cannot reproduce. Retired
+  evidence includes the key-prefix source scanner, config expected-object
+  matrices, operator structure snapshots and native-composition sentinels.
 - `test/provider-privacy-journey.node.test.ts` sends credentials through real
   HTTP MCP and a maintained API provider. Unknown vendor fields and keys carry
   raw, escaped, percent-encoded, base64 and Basic echoes through direct calls,
   QuickJS programs, failure and recovery. The independent decoder in
   `test/helpers/secret-echoes.ts` checks the wire responses for secret fragments;
   it does not normalize them to placeholders or compare saved output.
-- `test/provider-failure-sweep.test.ts` checks retained catalog examples for
-  dispatched failure, classification, auxiliary and composite write outcomes.
-  New providers use the required deployment outcomes above. Existing
+- `test/provider-hostile-response.node.test.ts` reconciles real HTTP mutations
+  after HTML, malformed JSON and oversized acknowledgements with one physical
+  send. It distinguishes Stripe's reviewed pre-execution 401 refusal, and checks
+  read failure facts, secrecy and recovery through direct and QuickJS calls.
+  `test/provider-failure-sweep.test.ts` retains only concrete auxiliary, composite,
+  in-flight and untracked-call fault probes; no provider/tool argument roster or
+  catalog/finalizer agreement sweep remains. Existing
   `test/sent-secrets.test.ts`, `test/sent-secret-output-boundary.test.ts`,
   `test/request-secret-redaction.test.ts` and `test/catalog-secret-redaction.test.ts`
   cover secrecy before projection, truncation, caching, paging and diagnostics.
@@ -1695,11 +1744,24 @@ Use the existing stateful fixture vendors and published-edge deployment adapters
   Native transport parity, OAuth and write-provenance suites retain their
   workerd coverage. The shared throwaway RSA key in `test/fixtures/rsa.ts` is
   used by write-provenance and unknown-write-advice fixtures.
-- The request, catalog, auxiliary-call, renewal and Promise-boundary lifetime
+- The request, catalog, auxiliary-call and renewal lifetime
   suites, plus `test/auth-admission-binding.test.ts`, exercise cancellation,
   held native work and garbage collection. These test actual request ownership;
   the retired capture scheduler's source guards were only harness constraints.
 
+The remaining probes defend distinct reachable failures: auth admission and
+native scheduler ownership, grant/callback fencing and refresh coordination,
+SDK replay/redirect/SSE attempts, nested write provenance and refusal evidence,
+unawaited program drain and failed-program accounting, catalog drift and paging
+revocation, and hostile serializers, structural echoes, truncation and persisted
+pages. Broad scripted-executor policy/privacy cross-products and repeated
+post-401 result/error-shape tables are retired. Protocol claims link executable
+evidence files in `spec/coverage.json`; the invariant contracts above are defended
+by the actual behavior assertions in these journeys and focused probes.
+The required CI gate includes build/declarations, Node and Workers probes,
+outcomes, browser flows, installed consumers and Docker, audits and real Eve
+compatibility. Further contributor cleanup is tracked in #1072.
+
 Add a compact fault journey only for a meaningful outcome those suites cannot
 observe. Reuse their fixtures and adapters; do not reintroduce a snapshot
 format, module loader or virtual scheduler. Workerd enrollment is for native
@@ -1822,9 +1884,9 @@ declarations; elsewhere it lives in an unexported function or in
 (`ConnectorCallError`, `ExecutorAdmissionError`, `CallAdmissionError`) because
 callers and tests check `instanceof`, `name`, and `message`.
 
-Effect callers skip the Promise and take the program: `admit` and
-`acquireScoped` for request admission (`src/runtime/admission.ts`), `admitCall`
-and `acquireCallScoped` for call admission, `closeScope` and `closeScopeOnExit`
+Effect callers skip the Promise and take the program: `admit` for executor
+admission (`src/runtime/admission.ts`), `admitCall` and `acquireCallScoped` for
+call admission, `closeScope` and `closeScopeOnExit`
 for a connector scope, `withDeadlineEffect` where Promise code has
 `withDeadline`. The build prunes every declaration no `exports` target reaches,
 and `pnpm run check:declarations` fails if what remains names an Effect type.
@@ -2044,8 +2106,8 @@ published storage interfaces.
 The synchronous state-file parser, validation, file read, and one atomic
 SQLite import remain native synchronous leaves because `importStateFile` is a
 published synchronous API. `openSqlite` retains file modes, WAL, busy timeout,
-and database ownership. `test/sql-effect-contract.ts` runs native-path,
-affected-row, 50-claim, cancellation, and tracing checks on SQLite and native
+and database ownership. `test/sql-effect-contract.ts` retains affected-row,
+50-claim, typed-failure, cancellation, and tracing probes on SQLite and native
 D1. `test/kv-to-d1.test.ts` also reuses stores across separate workerd requests;
 the existing SQL contracts prove rollback, database-clock TTL, encodings,
 activity upgrades, and copy recovery.
@@ -2198,8 +2260,7 @@ ordinary Promise-based Connector factory. The kit stays outside the root
 graph and its Effect types are internal. In each provider, `api.ts` declares
 the vendor and `tools.ts` the tools.
 
-Decision 0011's standard surface (Tithe.ly's step 2) adds four kit pieces.
-A `list` without the legacy `key` returns `{ items, page }`, with
+The standard `list` builder returns `{ items, page }`, with
 `page.nextCursor` only while `hasMore`, and the kit appends `limit` (the
 declared default and maximum), `cursor` and `fields` to the tool's filters;
 `read` and `get` take `fields: true`. `src/http/fields.ts` narrows after every
@@ -2441,8 +2502,8 @@ after repairing/deleting a corrupt key, restart every process/isolate to clear
 cached keys. Pre-upgrade cursors require a new first page.
 
 The helper derives connection metadata and probe messages from
-validated options and still accepts complete legacy usage guides for compatibility.
-All maintained providers have completed the standard-surface migration.
+validated options and renders every maintained guide through
+`ProviderContext.usageGuide`.
 Candidate checks can refuse before authentication while
 preserving the provider's exact diagnostic. Its optional `authScope(options)`
 selector fixes OAuth grant ownership from deployment mode at construction;
@@ -2544,7 +2605,7 @@ dispatch.
 
 The generator's `allSuccessResponses: true` option unions JSON response fields
 from every 2xx. Existing providers keep the first JSON success contract until
-their own reviewed regeneration; no committed provider index changes here.
+their own reviewed regeneration.
 
 `src/providers/_shared/google/hatch.ts` supplies JSON framing over the existing
 confined `Connection.sendPath`. It retains the hatch's origin/media guards,
@@ -2571,8 +2632,7 @@ For example, a direct value-mode result has outer `result.data`, the hatch's
 `result.data.page.nextCursor`, and vendor JSON at `result.data.data`:
 `call_tool({ address: "crm.forms_api_read", args: { path:
 "/forms/form_1/responses", cursor: previous.data.page.nextCursor },
-resultMode: "value" })`. This is an envelope illustration for an opted-in
-provider, not a claim that the Forms migration has shipped.
+resultMode: "value" })`. Google Forms uses this continuation envelope.
 
 `googleErrors(product, { standard: true })` declares the product's 404 meaning
 and uses common status fallbacks; revision-conflict meanings require a
@@ -2602,7 +2662,7 @@ Sheets declares its seven API methods in `src/providers/sheets/api.ts`; its
 kit tools retain the private digest-bound cell cursor, legacy A1 path encoding,
 and create/append recovery advice. Its projections and the Google failure
 classifier read fields by the names Google gave them, which the kit's parse pass
-keeps. Its catalog and guide stay unchanged in step 1.
+keeps.
 
 Google's request adapter also offers a reviewed binary send. It marks the
 operation `googleBytes` for the product's `binaryBodies` selector and forwards
@@ -2814,8 +2874,8 @@ result handling, reviewed value safety and the deployment privacy projection
 before paging or provider projections can read it. Read methods beyond GET
 and HEAD require a review. Construction fixes each write step's capacity;
 the guarded transport reserves it before preparation and the shared core
-decides the whole call's write outcome. Dedicated upload builders wait for
-the Google Drive migration in C.7.
+decides the whole call's write outcome. Drive uploads use write builders over
+reviewed raw-body sends.
 
 Reviewed path calls resolve their actual method and path through an indexed
 safety adapter; a provider-supplied template cannot bypass the policy.
@@ -3026,7 +3086,8 @@ compiling and configuring the real thing.
   rejections are observed; dispatch and lease guards still contain detached
   work. Per-await I/O cancellation remains useful for releasing resources,
   while prompt refusal is enforced at the boundary
-  (`test/promise-boundary-lifetime.test.ts`). Invocation owns
+  (`test/cancellation-faults.test.ts`, `test/operation-cancellation.test.ts`
+  and `test/cancellation-journey.node.test.ts`). Invocation owns
   the recovery and logical-call records it reads after teardown. Closing an
   outer call also revokes nested calls paused in preparation. Request-owned
   MCP sessions and token flights outlive individual calls and close with the
@@ -3119,8 +3180,9 @@ compiling and configuring the real thing.
   at construction) and the predicate matched, which the ledger records on the
   request. Only Stripe declares it (`src/providers/stripe/api.ts`, reviewed
   as a `manual` check in its `drift.json`): an API v1 answer carrying Stripe's
-  `Request-Id`. `test/provider-failure-sweep.test.ts` holds that list to the
-  sources. Q8 is decided in one place, `settleWrite` in
+  `Request-Id`. The real HTTP hostile-response journey checks this refusal
+  against an ambiguous committed write; there is no copied declaration list.
+  Q8 is decided in one place, `settleWrite` in
   `src/write-outcome.ts`, once per logical call and over every request it
   recorded. The invocation calls it for every failure of a served write: a
   thrown or mapped error, a custom connector's, a program's call, and its
@@ -3369,29 +3431,17 @@ compiling and configuring the real thing.
   `write_outcome_unknown`. The caller's own abort reason still passes by
   identity for a read and for a served call, whose timeout passes through
   unchanged for the invocation to report.
-  The catalog-driven `test/provider-failure-sweep.test.ts` checks every API
-  provider/tool on Node, fails on missing provider/tool examples or a
-  dispatched failure bypassing the helper, and covers served write/read
-  overrides with HTTP 503 for every tool and a connection reset after send
-  for each provider/verdict representative. HTTP 401 recovery uses those
-  representatives plus the distinct composite, auxiliary, owner-lookup and
-  POST-as-read paths.
-  Shared sender and real-socket evidence below own status/reset permutations.
-  Local metadata
-  tools prove zero sends; composite calls prove each distinct request leaves
-  once. The round-5 cases additionally cover Docs creation with initial text,
-  composite success followed by refusal, GitHub preflight failures, typed
-  handler errors after successful sends, Forms cursor conflicts after 200,
-  generic-code vendor refusals, auxiliary failures after resource dispatch,
-  redaction of refusal errors, and concurrent direct-call ledger isolation.
-  The round-6 cases cover a composite write's early refusal while siblings
-  await credentials or are in flight, requests started after the call ended,
-  connect-phase errnos with each body kind (all unknown for a write, and a
-  direct read stays retryable), a request aborted with a refusal-shaped
-  reason, an errno outside fetch's network error, and
-  undeclared handlers whose untracked send precedes a typed failure. Each
-  catalog case also checks that the ledger recorded every resource request
-  the network saw, and the inventory that every API connector declares it.
+  Shared provider outcomes and the real HTTP hostile-response journey check
+  returned data, failure/recovery, privacy and physical writes without a
+  catalog-wide status matrix. `test/provider-failure-sweep.test.ts` retains
+  fault probes for Docs creation with initial text, composite success followed
+  by refusal, GitHub preflight failures, typed handler errors after successful
+  sends, Forms cursor conflicts after 200, generic-code vendor refusals,
+  auxiliary failures after resource dispatch and concurrent direct-call isolation.
+  It also holds siblings awaiting credentials or already in flight when another
+  write fails, refuses requests after call closure, and probes network errors,
+  refusal-shaped abort reasons and untracked sends. Native transport and
+  request-lifetime suites retain their platform-specific evidence.
   `test/write-evidence.test.ts` uses real refused, reset, and held sockets on
   both runtimes: a refused write is unknown and a refused read retryable,
   including a write aborted with another fetch's real refusal as its reason

package/documentation/auth.md

@@ -412,6 +412,11 @@ agent. Enabling `preview` lets code on any pushed preview branch act as the agen
 Treat the project's OIDC token as a bearer credential for all of this agent's
 pools. Its default audience, `https://vercel.com/<team-slug>`, is shared by every
 service accepting Vercel's default OIDC tokens; it is not specific to Connecta.
+Connecta accepts only that default audience. Vercel's custom-audience token
+exchange can produce a validly signed token for another service; Connecta
+refuses it. For example, a token exchanged for `https://tickets.example.com`
+cannot authenticate to `/agent/assistant`. Resolve the ordinary workload token
+with `getVercelOidcToken()` without an `audience` option.
 Anything holding the project's token can act as the agent:
 project code, builds (including build steps and dependency install scripts with
 access to `VERCEL_OIDC_TOKEN`), and services the project sends the token to,
@@ -2698,8 +2703,10 @@ The encoding lattice is exactly this, and anything outside it is out of scope:
 
 [Decision 0007](https://github.com/zackbart/connecta/blob/main/decisions/0007-agent-pool-layout.md)
 explains the pool layout; [decision 0006](https://github.com/zackbart/connecta/blob/main/decisions/0006-pools-are-the-access-model.md)
-explains pools as the access model. `test/identity-scope.test.ts` checks identity
-boundaries, and `src/storage/keys.ts` owns credential key families.
+explains pools as the access model. `test/identity-write-journey.node.test.ts`
+checks real HTTP identity, pool and personal credential isolation;
+`test/identity-scope.test.ts` retains handoff, callback and admission-revocation
+fault probes. `src/storage/keys.ts` owns credential key families.
 
 Inbound adapters live in [src/auth](https://github.com/zackbart/connecta/tree/main/src/auth);
 [auth routes](https://github.com/zackbart/connecta/blob/main/src/routes/oauth.ts)

package/documentation/code-mode.md

@@ -1274,7 +1274,7 @@ rejection, and branded adapter acceptance across module copies.
 | `S9`                   | `test/result-shapes.test.ts` (value exclusion, bounds, merging, LRU and time expiry, runtime isolation, read-only admission, declared precedence, definition invalidation, unwrapped MCP results, discovery provenance, copy isolation, failure isolation)                                                                                                                                                                                                                                                                      |
 | `S10`                  | `test/resource-read.test.ts` (qualified routing, whole-connector grants, personal credentials, redaction, admission, timeout, cancellation and downstream MCP reads), both guest-contract executors (successful resource reads and caught/uncaught typed failures)                                                                                                                                                                                                                                                              |
 | `E2`, `E8`             | `test/guest-api-contract.test.ts` (code → `retryable`, caught, parallel, and uncaught validation recovery, a conflict's bounded `current`), `test/meta-tools-call.test.ts` (direct, destructive, provider fallback), `test/validate.test.ts` (bounded payload-free findings), `test/errors.test.ts`                                                                                                                                                                                                                             |
-| `E3`, `E4`             | `test/guest-api-contract.test.ts`, `test/execute.test.ts` (`auth_required`, destructive reroute), `test/program-writes.test.ts` (the refusal's `nextAction`, nothing sent, a caught refusal)                                                                                                                                                                                                                                                                                                                                    |
+| `E3`, `E4`             | `test/guest-api-contract.test.ts`, `test/execute.test.ts` (`auth_required`, destructive reroute), `test/identity-write-journey.node.test.ts` (read-only refusals before validation or dispatch, actual QuickJS)                                                                                                                                                                                                                                                                                                                 |
 | `E5`                   | `test/guest-api-contract.test.ts` (execution-failure channel, in-flight `cancelled`), `test/execute.test.ts` (admission), `test/executor-admission.test.ts`, `test/quickjs-executor.node.test.ts` (mid-run shutdown)                                                                                                                                                                                                                                                                                                            |
 | `E6`, `X8`             | `test/guest-api-contract.test.ts` (unknown and inherited members, retained error identities), `test/quickjs-executor.node.test.ts`                                                                                                                                                                                                                                                                                                                                                                                              |
 | `E7`                   | `test/guest-api-contract.test.ts` (refusals about a `503`-named connector), `test/errors.test.ts`                                                                                                                                                                                                                                                                                                                                                                                                                               |
@@ -1288,10 +1288,10 @@ rejection, and branded adapter acceptance across module copies.
 | `L3`, `X1`             | `test/guest-api-contract.test.ts` (short-deadline executors), `test/execute.test.ts` (the watchdog ends a never-settling executor, frees the default pool, spares a slow run, and falls back from an unusable value)                                                                                                                                                                                                                                                                                                            |
 | `L4`, `L8`             | `test/guest-api-contract.test.ts`, `test/execute.test.ts` (shared discovery/call budgets and terminal catch-and-continue loops and queued-write cancellation on both executors), `test/worker-budget-response.node.test.ts` (native handle disposal and admission recovery across completed HTTP responses)                                                                                                                                                                                                                     |
 | `L5`, `L7`, `X2`       | `test/quickjs-executor.node.test.ts` (CPU, heap), `test/execute.test.ts` and `test/executor-admission.test.ts` (bounded admission and queue)                                                                                                                                                                                                                                                                                                                                                                                    |
-| `L6`, `X10`            | `test/guest-api-contract-quickjs.node.test.ts` and `test/guest-api-contract.test.ts` (whole oversized reads and one-write pageable handles), `test/sqlite-storage.node.test.ts` and `test/d1-storage.node.test.ts` (shared stash transfers), `test/quickjs-executor.node.test.ts` (bridge and IPC bounds for arguments and result; the address in the over-bound message), `test/quickjs-child-stderr.node.test.ts` (outer reply serialization failure settles the call)                                                        |
-| `V1`–`V4`              | `test/guest-api-contract.test.ts` (dispatched calls, every refusal class including an address no connector owns, the friction each derives, no event for the execution itself), `test/activity.test.ts` (the shared code → friction table, the identity clamp, the one-attempt floor), `test/operator-view.test.ts`, `test/sql-storage-contract.ts`, run by `test/d1-storage.node.test.ts` and `test/sqlite-storage.node.test.ts` (historical pause and approval rows still render and round-trip)                              |
-| `V5`, `W9`             | `test/program-writes.test.ts` (an unawaited program write finished and recorded, its unknown outcome reported, counts on a failed program, the classification table), `test/invocation-pipeline.test.ts` (the gate after validation, an unrecorded refusal)                                                                                                                                                                                                                                                                     |
-| `W10`, `W12`           | `test/program-writes.test.ts` (a writable endpoint's program write runs, a read-only endpoint omits writes from search and describe and refuses every write call on every path, including a write its guide names, a required deployment `readOnly`, the write budget, `readOnly` inheritance and overrides, `call_tool` still refusing, search and describe verdicts, construction refusals including retired `trust`), `test/operator-ui-model.test.ts`, `test/browser/operator-ui.spec.ts` (the badge)                       |
+| `L6`, `X10`            | `test/guest-api-contract-quickjs.node.test.ts` and `test/guest-api-contract.test.ts` (whole oversized reads and one-write pageable handles), `test/sqlite-storage.node.test.ts` and `test/kv-to-d1.test.ts` (SQL stash and native D1 fault probes), `test/quickjs-executor.node.test.ts` (bridge and IPC bounds for arguments and result; the address in the over-bound message), `test/quickjs-child-stderr.node.test.ts` (outer reply serialization failure settles the call)                                                 |
+| `V1`–`V4`              | `test/guest-api-contract.test.ts` (dispatched calls, every refusal class including an address no connector owns, the friction each derives, no event for the execution itself), `test/activity.test.ts` (the shared code → friction table, the identity clamp, the one-attempt floor), `test/browser/operator-ui.spec.ts` (identity changes), `test/sql-storage-contract.ts`, run by `test/sqlite-storage.node.test.ts` (historical activity rows still round-trip)                                                             |
+| `V5`, `W9`             | `test/program-writes.test.ts` (unawaited program drain, failed-program accounting), `test/identity-write-journey.node.test.ts` (committed ambiguity, reconciliation and physical writes), `test/invocation-pipeline.test.ts` (the gate after validation, an unrecorded refusal)                                                                                                                                                                                                                                                 |
+| `W10`, `W12`           | `test/identity-write-journey.node.test.ts` (real HTTP/MCP and QuickJS: write budget, read-only discovery and refusal, named guide, pool inheritance/reopening and connector policy), `test/program-writes.test.ts` (construction refusals and classification drift), `test/operator-ui-model.test.ts`, `test/browser/operator-ui.spec.ts` (the badge)                                                                                                                                                                           |
 | `M1`                   | `test/guest-api-contract.test.ts` (invalid emits throw catchably, accept nothing), `test/execute-emit.test.ts` (rejected shapes, bounded native snapshots, paging before metadata traversal, and cyclic presentation refusal)                                                                                                                                                                                                                                                                                                   |
 | `M2`, `M3`             | `test/guest-api-contract.test.ts` (delivery order, truncated return plus delivered blocks), `test/execute-emit.test.ts` (envelope, `structuredContent`, byte-for-byte no-emit path)                                                                                                                                                                                                                                                                                                                                             |
 | `M4`                   | `test/guest-api-contract.test.ts` (discard is visible), `test/execute-emit.test.ts` (structured and plain paths), `test/quickjs-executor.node.test.ts` (mid-run shutdown)                                                                                                                                                                                                                                                                                                                                                       |
@@ -1304,4 +1304,4 @@ rejection, and branded adapter acceptance across module copies.
 
 The surface itself is checked by `test/server.test.ts` (the exact six-tool list),
 `test/code-first-surface.test.ts` (construction, executor, removed tools, copy, and size),
-and `test/program-writes.test.ts` (the retired pause options refused at construction).
+and `test/program-writes.test.ts` (deployment policy and classification construction refusals).

package/documentation/meta-tools.md

@@ -1334,8 +1334,11 @@ Connector ids already appear in native tool names. The
 operator UI and `describeConfig()` show every pool's effective `surface` and
 `executeCode` as facts from deployment code. Change these settings in code.
 
-Keep native pools bounded. Comparisons so far used 40 synthetic tools;
-large production catalogs near the cap have not been evaluated.
+Keep native pools bounded. Local real-Eve validation uses seeded catalogs from
+40 through 1,000 downstream tools across meta, native and native-plus-code
+surfaces, with a deterministic model transport and no paid model calls. These
+checks establish local runtime contracts; model task quality and large
+production catalogs near the cap remain unmeasured.
 
 ### Eve agents