@zq-silk/yui 1.1.2 → 2.1.0

package/dist/nativeAgent/validation.js

@@ -0,0 +1,95 @@
+// JSON escaping can expand a 64 KiB text result to almost 384 KiB.
+export const limits = { messageBytes: 512 * 1024, argumentBytes: 64 * 1024, historyBytes: 1024 * 1024, callsPerStep: 8 };
+export class AgentFault extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+    }
+}
+export function snapshot(value) {
+    const copy = structuredClone(value);
+    const freeze = (item) => {
+        if (item && typeof item === 'object') {
+            for (const child of Object.values(item))
+                freeze(child);
+            Object.freeze(item);
+        }
+    };
+    freeze(copy);
+    return copy;
+}
+function object(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function text(value) { return typeof value === 'string'; }
+function id(value) { return text(value) && value.trim().length > 0; }
+function json(value, depth = 0) {
+    if (depth > 32)
+        return false;
+    if (value === null || text(value) || typeof value === 'boolean')
+        return true;
+    if (typeof value === 'number')
+        return Number.isFinite(value);
+    if (Array.isArray(value))
+        return Array.from(value).every(v => json(v, depth + 1));
+    return object(value) && Object.getPrototypeOf(value) === Object.prototype
+        && Object.values(value).every(v => json(v, depth + 1));
+}
+export function size(value) { return Buffer.byteLength(JSON.stringify(value), 'utf8'); }
+function bounded(value) { return json(value) && size(value) <= limits.messageBytes; }
+function calls(value) {
+    return Array.isArray(value) && value.length <= limits.callsPerStep
+        && value.every(c => object(c) && id(c.id) && id(c.name) && bounded(c.arguments)
+            && size(c.arguments) <= limits.argumentBytes)
+        && new Set(value.map(c => c.id)).size === value.length;
+}
+export function validOutcome(value) {
+    return object(value) && bounded(value) && (value.ok === true ? text(value.content)
+        : value.ok === false && object(value.error) && id(value.error.code) && text(value.error.message)
+            && (value.error.effect === 'none' || value.error.effect === 'unknown'));
+}
+export function response(value, usedIds) {
+    if (!object(value) || !bounded(value) || !text(value.content)
+        || !(value.kind === 'final' || (value.kind === 'tool_calls' && calls(value.calls)
+            && value.calls.length > 0 && value.calls.every(c => !usedIds.has(c.id))))) {
+        throw new AgentFault('provider_protocol', 'Invalid, oversized or duplicate model response');
+    }
+    return snapshot(value);
+}
+export function history(value) {
+    const pending = new Map();
+    const used = new Set();
+    if (!Array.isArray(value) || !json(value) || size(value) > limits.historyBytes) {
+        throw new AgentFault('invalid_history', 'History must be bounded JSON messages');
+    }
+    for (const m of value) {
+        if (!object(m) || !bounded(m))
+            throw new AgentFault('invalid_history', 'Invalid history message');
+        if (m.role === 'tool') {
+            if (!id(m.toolCallId) || !id(m.name) || !validOutcome(m.outcome)
+                || pending.get(m.toolCallId) !== m.name || !pending.has(m.toolCallId)) {
+                throw new AgentFault('invalid_history', 'Tool results must match exactly one pending call');
+            }
+            pending.delete(m.toolCallId);
+        }
+        else {
+            if (pending.size || !text(m.content))
+                throw new AgentFault('invalid_history', 'Unsettled calls or invalid content');
+            if (m.role === 'assistant' && calls(m.toolCalls)) {
+                for (const c of m.toolCalls) {
+                    if (used.has(c.id))
+                        throw new AgentFault('invalid_history', 'Duplicate tool call identity');
+                    used.add(c.id);
+                    pending.set(c.id, c.name);
+                }
+            }
+            else if (m.role !== 'system' && m.role !== 'user') {
+                throw new AgentFault('invalid_history', 'Invalid message role or assistant calls');
+            }
+        }
+    }
+    if (pending.size)
+        throw new AgentFault('invalid_history', 'History contains unsettled calls');
+    return snapshot([...value]);
+}

package/dist/output/boundedRead.js

@@ -0,0 +1,118 @@
+import { createHash } from "node:crypto";
+import { usageError } from "../errors/cliError.js";
+export const READ_PAGE_BYTES = 32 * 1024;
+export const INLINE_DOCUMENT_BYTES = 16 * 1024;
+function assertSource(source) {
+    if (Buffer.byteLength(source) > 1024)
+        throw usageError("Read source identity exceeds its 1024-byte budget.");
+}
+export function readDigest(value) {
+    return createHash("sha256").update(JSON.stringify(value)).digest("hex");
+}
+/** A save receipt is not another read of the submitted body. Keep the exact
+ * delivery/control facts and identity; body/history are read on demand.
+ */
+export function messageReceipt(message) {
+    const { body: _body, ...facts } = message;
+    return { ...facts, digest: readDigest(message), bodyBytes: Buffer.byteLength(message.body) };
+}
+export function encodeReadCursor(cursor) {
+    return Buffer.from(JSON.stringify(cursor)).toString("base64url");
+}
+export function decodeReadCursor(raw, source, digest) {
+    let cursor;
+    try {
+        if (raw.length > 4096)
+            throw new Error();
+        cursor = JSON.parse(Buffer.from(raw, "base64url").toString("utf8"));
+        if (cursor.source !== source || !Number.isSafeInteger(cursor.offset) || cursor.offset < 0
+            || typeof cursor.digest !== "string")
+            throw new Error();
+    }
+    catch {
+        throw usageError("Invalid read cursor for this source/scope.");
+    }
+    if (cursor.digest !== digest)
+        throw usageError("Read source changed; restart the read instead of mixing versions.");
+    return cursor.offset;
+}
+export function readLimit(value) {
+    const limit = value ?? 20;
+    if (!Number.isSafeInteger(limit) || limit < 1 || limit > 100) {
+        throw usageError("Read limit must be between 1 and 100.");
+    }
+    return limit;
+}
+/** For small in-memory authorized collections. Authorize/filter BEFORE calling.
+ * Cursors bind the selected collection, never grant access, and store no state.
+ */
+export function recordPage(records, source, options = {}) {
+    assertSource(source);
+    const limit = readLimit(options.limit);
+    const digest = readDigest(records);
+    const offset = options.cursor === undefined ? 0 : decodeReadCursor(options.cursor, source, digest);
+    if (offset > records.length)
+        throw usageError("Read cursor exceeds this collection.");
+    const items = [];
+    // Reserve room for identities, counts and continuation. Oversized individual
+    // records belong in a document read, not silently truncated list metadata.
+    let bytes = 0;
+    for (const record of records.slice(offset, offset + limit)) {
+        const size = Buffer.byteLength(JSON.stringify(record)) + 1;
+        if (size > READ_PAGE_BYTES / 2)
+            throw usageError("List entry exceeds its summary budget; read the exact record.");
+        if (bytes + size > READ_PAGE_BYTES - 4096)
+            break;
+        items.push(record);
+        bytes += size;
+    }
+    const end = offset + items.length;
+    return {
+        source, digest, items, total: records.length, complete: end === records.length,
+        nextCursor: end < records.length ? encodeReadCursor({ source, digest, offset: end }) : null,
+        limits: { items: limit, bytes: READ_PAGE_BYTES }
+    };
+}
+/** Small exact details stay native JSON. Large details explicitly become a
+ * contentPage. Concatenate text in order, then JSON.parse once, never each chunk.
+ * JSON character offsets (not bytes) preserve Unicode and escaped controls.
+ * The source is an exact authorized read identity; reauthorize every page.
+ */
+export function boundedDocument(value, source, cursor) {
+    assertSource(source);
+    const text = JSON.stringify(value);
+    const totalBytes = Buffer.byteLength(text);
+    if (cursor === undefined && totalBytes <= INLINE_DOCUMENT_BYTES)
+        return value;
+    const digest = readDigest(value);
+    const offset = cursor === undefined ? 0 : decodeReadCursor(cursor, source, digest);
+    if (offset >= text.length && offset !== 0)
+        throw usageError("Read cursor exceeds this document.");
+    let end = Math.min(offset + 4096, text.length);
+    // Never cut between UTF-16 surrogate halves.
+    if (end < text.length && /[\uD800-\uDBFF]/u.test(text[end - 1]))
+        end--;
+    return { contentPage: {
+            source, digest, encoding: "json", offset, totalCharacters: text.length,
+            totalBytes, text: text.slice(offset, end), complete: end === text.length,
+            nextCursor: end < text.length ? encodeReadCursor({ source, digest, offset: end }) : null
+        } };
+}
+/** Shared parser for list/detail command tails; no options reach mutations. */
+export function readOptions(args, flags = ["--cursor", "--limit"]) {
+    const positionals = [];
+    const values = new Map();
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (!arg.startsWith("--")) {
+            positionals.push(arg);
+            continue;
+        }
+        if (!flags.includes(arg) || values.has(arg) || args[i + 1] === undefined || args[i + 1].startsWith("--")) {
+            throw usageError(`Invalid read option: ${arg}.`);
+        }
+        values.set(arg, args[++i]);
+    }
+    return { positionals, values, cursor: values.get("--cursor"),
+        ...(values.has("--limit") ? { limit: Number(values.get("--limit")) } : {}) };
+}

package/dist/plugins/pluginService.js

@@ -98,24 +98,39 @@ export function createPluginService(store, host, registry) {
         source: `plugin:${pkg.manifest.id}@${pkg.digest}`, required: pkg.manifest.required
     }));
     const refFor = (taskId, pkg) => ({ id: keyFor(taskId, pkg.manifest.id), generation: randomUUID() });
+    const executionParams = (taskId, preparationId, pkg, phase) => ({
+        pluginId: pkg.manifest.id, digest: pkg.digest,
+        environmentRef: `${taskId}/${preparationId}`, trust: "trusted-local", phase
+    });
+    const executionGrant = (taskId, params, path, plannedUses = new Map()) => store.listCapabilityGrants(taskId).find(candidate => Object.entries(params).every(([key, value]) => candidate.parameterBounds[key]?.includes(value))
+        && (candidate.scope.taskId === undefined || candidate.scope.taskId === taskId)
+        && candidate.scope.projectIds === undefined && candidate.scope.repositories === undefined
+        && candidate.scope.packages === undefined
+        && (candidate.scope.homePath === undefined || candidate.scope.homePath === path)
+        && checkGrant({ ...candidate, usesUsed: candidate.usesUsed + (plannedUses.get(candidate.id) ?? 0) }, { action: "plugin.execute", params, irreversibility: "irreversible" }, new Date()).allowed);
+    const environmentAccess = (taskId, preparationId, via) => {
+        const prepared = store.getEnvironmentPreparation(taskId, preparationId);
+        if (!prepared)
+            throw new Error("Plugin environment preparation is missing.");
+        for (const resourceId of prepared.resourceRefs) {
+            const access = resources.assessLocalAccess(taskId, resourceId, prepared.access, via, prepared.id, true);
+            if (access.state !== "authorized")
+                return access;
+        }
+        return { state: "authorized" };
+    };
     /** Each execution consumes one use. A live call's bound closure carries its
      * admission; it is never resumed from a durable reservation or sent to code.
      * Subsequent actions still check current authority, not cached permission. */
     const execution = (taskId, preparationId, pkg, phase) => {
-        const params = { pluginId: pkg.manifest.id, digest: pkg.digest,
-            environmentRef: `${taskId}/${preparationId}`, trust: "trusted-local", phase };
+        const params = executionParams(taskId, preparationId, pkg, phase);
         // This grants the capability to run code without OS effect confinement;
         // it does not claim that every invocation actually has irreversible effects.
         const request = { action: "plugin.execute", params, irreversibility: "irreversible" };
         const reservation = phase === "call" ? undefined : `plugin/${randomUUID()}`;
         const grantId = store.transaction((tx) => {
             const env = environment(taskId, preparationId);
-            const grant = tx.listCapabilityGrants(taskId).find((candidate) => Object.entries(params).every(([key, value]) => candidate.parameterBounds[key]?.includes(value))
-                && (candidate.scope.taskId === undefined || candidate.scope.taskId === taskId)
-                && candidate.scope.projectIds === undefined && candidate.scope.repositories === undefined
-                && candidate.scope.packages === undefined
-                && (candidate.scope.homePath === undefined || candidate.scope.homePath === env.directory.path)
-                && checkGrant(candidate, request, new Date()).allowed);
+            const grant = executionGrant(taskId, params, env.directory.path);
             if (!grant)
                 throw new Error(`Explicit trusted-local execution grant unavailable (${phase}); pluginId=${params.pluginId}, digest=${params.digest}, environmentRef=${params.environmentRef}.`);
             tx.saveCapabilityGrant(taskId, recordGrantUse(grant, new Date(), reservation));
@@ -173,6 +188,81 @@ export function createPluginService(store, host, registry) {
         }
     };
     return {
+        assess(taskId, descriptor, input, via) {
+            let validationId;
+            let phase;
+            let pkg;
+            let preparationId;
+            let path;
+            if (descriptor.name === "plugin.validate") {
+                if (input === undefined)
+                    return undefined;
+                const params = input;
+                const prepared = store.getEnvironmentPreparation(taskId, params.preparationId);
+                if (!prepared?.directory)
+                    throw new Error("Plugin validation needs an existing directory preparation.");
+                const access = environmentAccess(taskId, prepared.id, via);
+                if (access.state !== "authorized")
+                    return access;
+                const directory = resolve(prepared.directory.path, params.directory);
+                packagePath(relative(prepared.directory.path, directory));
+                // Capture data only. Never run a build, prepare an environment or
+                // initialize a Provider just to assess the source's exact grant.
+                pkg = readPluginPackage(directory, false);
+                preparationId = prepared.id;
+                path = prepared.directory.path;
+                phase = "validate";
+            }
+            else if (descriptor.name === "plugin.activate") {
+                if (input === undefined)
+                    return undefined;
+                validationId = input.validationId;
+                phase = "activate";
+            }
+            else {
+                const selected = active.get(descriptor.provider.id);
+                if (!selected || selected.ref.generation !== descriptor.provider.generation)
+                    return undefined;
+                validationId = selected.validationId;
+                phase = "call";
+            }
+            // Inspect captured authorization parameters, not Host availability,
+            // filesystem readiness or author code. Execution owns those checks.
+            if (validationId !== undefined) {
+                const report = store.getPluginValidation(taskId, validationId);
+                if (!report)
+                    throw new Error("Plugin validation not found in this Task.");
+                pkg = report.package;
+                preparationId = report.preparationId;
+                path = report.environment.path;
+            }
+            if (phase !== "validate") {
+                const access = environmentAccess(taskId, preparationId, via);
+                if (access.state !== "authorized")
+                    return access;
+            }
+            if (pkg.manifest.kind === "declarative")
+                return { state: "authorized" };
+            const params = executionParams(taskId, preparationId, pkg, phase);
+            const phases = phase === "validate" && pkg.manifest.build ? ["build", "validate"] : [phase];
+            // Simulate the same ordered selection as execution, without persisting
+            // uses. A broad Grant may fund multiple phases only if it has capacity.
+            const plannedUses = new Map();
+            const missing = phases.filter(value => {
+                const grant = executionGrant(taskId, { ...params, phase: value }, path, plannedUses);
+                if (!grant)
+                    return true;
+                plannedUses.set(grant.id, (plannedUses.get(grant.id) ?? 0) + 1);
+                return false;
+            });
+            if (!missing.length)
+                return { state: "authorized" };
+            return { state: "requestable", request: {
+                    action: "plugin.execute", taskId,
+                    bounds: { ...Object.fromEntries(Object.entries(params).map(([key, value]) => [key, [value]])), phase: missing },
+                    via, explanation: "Trusted-local author code needs an exact, irreversible execution Grant. Use the existing authorization source and Grant path; discovery consumes no uses."
+                } };
+        },
         current: inspect,
         list(taskId) {
             return store.transaction(() => store.listPluginIntents(taskId)

package/dist/release/releaseWorkflowEngine.js

@@ -228,7 +228,8 @@ async function runReleaseWorkflowLocked(store, taskId, workflowId, ports, option
         if (grant === null) {
             return finish(workflow, "unauthorized", "unauthorized:grant-missing", attempted);
         }
-        const params = resolveParams(workflow, plan);
+        const params = grant.authorizationSource === undefined ? resolveParams(workflow, plan)
+            : Object.freeze({ ...resolveParams(workflow, plan), sourceCommit: workflow.source.commit });
         const effectiveIrreversibility = effectiveStepIrreversibility(plan);
         const decision = checkGrant(grant, {
             action: grantAction(plan),
@@ -615,6 +616,12 @@ function cliUpdateVersionDenial(plan, params) {
 function versionTagCheckoutDenial(grant, plan, params) {
     if (plan.kind !== "version-tag")
         return undefined;
+    // Leader authorization names a release version; the adapter pushes tag,
+    // not version. Validate that actual effect before consuming a grant use.
+    if (grant.authorizationSource !== undefined
+        && (!params.version || ![params.version, `v${params.version}`].includes(params.tag ?? ""))) {
+        return "grant-version-tag-mismatch";
+    }
     const repositories = grant.scope.repositories;
     if (repositories === undefined || repositories.length === 0)
         return undefined;

package/dist/resources/projectResourceService.js

@@ -42,7 +42,7 @@ export function createProjectResources(store, now = () => new Date()) {
             throw new Error(`Local resource not found: ${resourceId}.`);
         return value;
     };
-    const grantFor = (taskId, resourceId, access, reservation, reservedOnly = false) => {
+    const findGrant = (taskId, resourceId, access, reservation, reservedOnly = false) => {
         const target = resource(resourceId);
         const grant = store.listCapabilityGrants(taskId).find((candidate) => {
             // A Project scope is visibility, not an exhaustive Resource grant. A
@@ -57,6 +57,10 @@ export function createProjectResources(store, now = () => new Date()) {
                 return false;
             return checkGrant(candidate, { action: `resource.local.${access}`, params: { resourceId } }, now(), { skipUsesCheck: reservation !== undefined && candidate.useReservations.includes(reservation) }).allowed;
         });
+        return grant;
+    };
+    const grantFor = (taskId, resourceId, access, reservation, reservedOnly = false) => {
+        const grant = findGrant(taskId, resourceId, access, reservation, reservedOnly);
         if (!grant)
             throw new Error(`Resource grant unavailable: ${resourceId}/${access}.`);
         return grant;
@@ -109,6 +113,24 @@ export function createProjectResources(store, now = () => new Date()) {
         });
     };
     return {
+        assessLocalAccess(taskId, resourceId, access, via, reservation, reservedOnly = false) {
+            const current = task(taskId);
+            // Only already-discoverable references may receive request guidance.
+            // Do not resolve an arbitrary global ID merely to confirm its existence.
+            const known = current.projectBindings.some(({ projectId }) => store.getProject(projectId)?.resourceRefs?.includes(resourceId))
+                || store.listCapabilityGrants(taskId).some(grant => grant.parameterBounds.resourceId?.includes(resourceId))
+                || store.listEnvironmentPreparations(taskId).some(value => value.resourceRefs.includes(resourceId))
+                || store.listEvents(taskId).some(event => event.type === "resource.local.registered" && event.payload.resourceId === resourceId);
+            if (!known)
+                return { state: "hidden" };
+            if (findGrant(taskId, resourceId, access, reservation, reservedOnly))
+                return { state: "authorized" };
+            return { state: "requestable", request: {
+                    action: `resource.local.${access}`, taskId, bounds: { resourceId: [resourceId] }, via,
+                    explanation: "Request this exact resource and access through existing Message/InputRequest and Grant authority. A response alone is not a Grant."
+                        + (reservedOnly ? " This environment's adoption reservation is no longer valid; inspect preparation/adoption before reusing it." : "")
+                } };
+        },
         resolveExecutionEnvironment,
         bindEnvironment(taskId, roleName, preparationId, source = { source: "environment.bind" }) {
             return store.transaction((tx) => {

package/dist/runtime/managedCaller.js

@@ -30,8 +30,8 @@ export function requireManagedGlobalCaller(store, env) {
  */
 export class ManagedRuntimeDriftError extends Error {
     name = "ManagedRuntimeDriftError";
-    constructor(message) {
-        super(message);
+    constructor(message, options) {
+        super(message, options);
     }
 }
 /** Reads the process's own immutable managed identity, or undefined when unmanaged. */

package/dist/runtime/managedIdentity.js

@@ -0,0 +1,6 @@
+/** Presence is not authentication. Even partial transport identity must not
+ * silently acquire the authority of an unbound public caller. */
+export function hasManagedIdentity(environment) {
+    return ["YUI_SESSION_SCOPE", "YUI_ROLE", "YUI_AGENT_ID", "YUI_NATIVE_SESSION_ID",
+        "YUI_TASK_ID", "YUI_SESSION_MANIFEST"].some(key => environment[key] !== undefined);
+}

package/dist/runtime/runtimeCoherence.js

@@ -1,4 +1,5 @@
 import { resolve } from "node:path";
+import { StorageSchemaError } from "../storage/storageSchema.js";
 import { isStorageVersion, compareStorageVersions } from "../storage/storageVersions.js";
 import { callController as defaultCallController, ControllerClientError } from "../core/controllerClient.js";
 import { inspectStorageSchema } from "../storage/storageSchema.js";
@@ -8,10 +9,12 @@ export async function assertRuntimeCoherence(input, options = {}) {
     const identity = validateVersionIdentity(options.identity ?? yuiVersionIdentity());
     const storage = (options.inspectStorage ?? inspectStorageSchema)(home);
     if (storage.status !== "current") {
-        throw new Error(`Managed control-plane storage is not current: ${storage.status}.`);
+        throw new StorageSchemaError(storage.status === "uninitialized" ? "STORAGE_UNINITIALIZED"
+            : storage.status === "unsupported" ? "STORAGE_SCHEMA_UNSUPPORTED" : "STORAGE_SCHEMA_INVALID", `Managed control-plane storage is not current: ${storage.status}.`
+            + ("detail" in storage && typeof storage.detail === "string" ? ` ${storage.detail}` : ""));
     }
     if (storage.currentVersion !== identity.storageVersion) {
-        throw new Error("Managed control-plane storage version is incompatible "
+        throw new StorageSchemaError("STORAGE_SCHEMA_UNSUPPORTED", "Managed control-plane storage version is incompatible "
             + `(expected ${identity.storageVersion}, found `
             + `${storage.currentVersion ?? "unknown"}).`);
     }
@@ -37,7 +40,7 @@ export async function assertRuntimeCoherence(input, options = {}) {
 }
 export function assertControllerStatusIdentity(status, expected = yuiVersionIdentity()) {
     if (!isRecord(status) || status.running !== true) {
-        throw new Error("Controller status does not describe a running Controller.");
+        throw new ControllerClientError("INVALID_RESPONSE", "Controller status does not describe a running Controller.");
     }
     assertControllerField(status.protocolVersion, expected.controllerProtocolVersion, "protocol");
     assertControllerField(status.version, expected.version, "version");
@@ -66,20 +69,19 @@ function validateVersionIdentity(value) {
 }
 function assertControllerContinuityIdentity(status, expected) {
     if (!isRecord(status) || status.running !== true) {
-        throw new Error("Controller status does not describe a running Controller.");
+        throw new ControllerClientError("INVALID_RESPONSE", "Controller status does not describe a running Controller.");
     }
     if (typeof status.version !== "string" || status.version.trim().length === 0) {
-        throw new Error("Controller version is invalid at the managed continuity gate.");
+        throw new ControllerClientError("CONTROLLER_PROTOCOL_MISMATCH", "Controller version is invalid at the managed continuity gate.");
     }
     assertControllerField(status.protocolVersion, expected.controllerProtocolVersion, "protocol");
     assertControllerField(status.storageVersion, expected.storageVersion, "storage version");
 }
 function assertControllerField(actual, expected, label) {
     if (actual !== expected) {
-        throw new Error(`Controller ${label} is incompatible with the exact control plane `
+        throw new ControllerClientError("CONTROLLER_PROTOCOL_MISMATCH", `Controller ${label} is incompatible with the exact control plane `
             + `(expected ${expected}, found ${typeof actual === "string" || typeof actual === "number" ? actual : "unknown"}). `
-            + "Run controller restart through the matching exact control-plane invocation "
-            + "before writing new Task records.");
+            + "Verify Home, CLI and Controller identity before an authorized restart through the matching invocation.");
     }
 }
 function requireText(value, label) {

package/dist/storage/sqliteSchema.js

@@ -24,6 +24,16 @@ const MINOR_UPGRADES = Object.freeze([{
         targetChecksum: CURRENT_SCHEMA_CHECKSUM,
         sql: "",
         dataMigration: "task-main-workspace"
+    }, {
+        fromVersion: "1.1",
+        toVersion: "1.2",
+        name: "task-authorization-source",
+        introducedIn: "next",
+        sourceChecksum: CURRENT_SCHEMA_CHECKSUM,
+        targetChecksum: CURRENT_SCHEMA_CHECKSUM,
+        // New grants can carry source evidence. Valid historical Operator grants
+        // remain unchanged; migration must not invent authorization provenance.
+        sql: ""
     }]);
 export function storageMinorUpgradePlan(from) {
     if (from === CURRENT_STORAGE_VERSION)

package/dist/storage/storageVersions.js

@@ -1,4 +1,4 @@
-export const CURRENT_STORAGE_VERSION = "1.1";
+export const CURRENT_STORAGE_VERSION = "1.2";
 export const MIN_SUPPORTED_STORAGE_VERSION = "1.0";
 export const STORAGE_FORMAT = "yui-home";
 export function isStorageVersion(value) {

package/dist/storage/taskStore.js

@@ -180,6 +180,8 @@ export function storedCapabilityGrant(value) {
         fields.push("revokedAt");
     if (grant.revokedBy !== undefined)
         fields.push("revokedBy");
+    if (grant.authorizationSource !== undefined)
+        fields.push("authorizationSource");
     exact(grant, fields, "Capability grant");
     requireRecordIdentity(grant.id, "Capability grant id");
     requireRecordIdentity(grant.taskId, "Capability grant Task id");
@@ -303,6 +305,7 @@ export function isValidCapabilityGrantTransition(existing, candidate) {
     const immutable = candidate.id === existing.id
         && candidate.taskId === existing.taskId
         && candidate.granter === existing.granter
+        && isDeepStrictEqual(candidate.authorizationSource, existing.authorizationSource)
         && isDeepStrictEqual(candidate.scope, existing.scope)
         && isDeepStrictEqual(candidate.actions, existing.actions)
         && isDeepStrictEqual(candidate.parameterBounds, existing.parameterBounds)

package/dist/surface/surfaceContributions.js

@@ -10,11 +10,14 @@ export class SurfaceContributions {
         return this.registry.search(context).map((entry) => ({
             ...reference(entry), name: entry.surfaces?.cli?.name ?? entry.name,
             help: entry.surfaces?.cli?.help ?? entry.summary, effect: entry.effect,
+            ...(entry.access === undefined ? {} : { access: entry.access }),
             ...(entry.unavailable === undefined ? {} : { unavailable: entry.unavailable })
         }));
     }
     listPanels(context) {
         return this.registry.search(context).flatMap((entry) => {
+            if (entry.access?.state === "requestable")
+                return [];
             const panel = entry.surfaces?.panel
                 ?? (entry.effect === "query" ? { kind: "data", title: entry.summary, renderer: "json" } : undefined);
             return panel ? [{