agent-dealer 0.2.0 → 1.0.0

package/bundle/server/dist/adapters/authority-lifecycle.js

@@ -0,0 +1,289 @@
+// packages/server/src/adapters/authority-lifecycle.ts
+//
+// Shared mint/reuse/revoke lifecycle for every caller of execution-authority.ts (NOT-91):
+// agent-deck-bind.ts (developer/reviewer worker attempts), reflect-trigger.ts (post-review
+// reflection), and queue/approve-deliver.ts (outbound-draft delivery). Each of those used to
+// call mintAuthority directly and hold the result only in a local variable for the duration
+// of one async function — a crash anywhere in that window left a live, unrevoked authority
+// with nothing durable to reconcile against. This module makes `authority_attempts`
+// (repository/authority-attempts.ts) the one place that happens, so:
+//
+//   - a same-owner retry always revokes its predecessor's authority first ("revoke-before-
+//     new-attempt" — a superseded attempt has no legitimate further use);
+//   - an idempotent remint (Deck reuses a still-live authority for a repeated key and
+//     returns no new secret, NOT-85 §7) is recovered from automatically — revoke the
+//     orphaned authority, mint again under a derived key — instead of failing the caller's
+//     whole attempt, as agent-deck-bind.ts / reflect-trigger.ts / approve-deliver.ts each
+//     used to;
+//   - AUTHORITY_EXPIRED (benign — the referenced authority merely aged out) auto-retries
+//     under a fresh key, while AUTHORITY_REVOKED (an operator/policy decision) is never
+//     silently retried — both fold into the same `interaction_required` outcome every
+//     caller already parks on, so an explicit revoke gets a human decision before another
+//     attempt, exactly like Deck's own INTERACTION_REQUIRED;
+//   - recovery.ts / commands.ts's abortIssue can revoke whatever authority a dead/cancelled
+//     owner still holds, and reconcileAuthoritiesAtStartup can sweep every attempt a crashed
+//     coordinator left open, because the ledger — not a local variable — is authoritative.
+import { activateAuthorityAttempt, closeAuthorityAttempt, createAuthorityAttempt, listAllOpenAuthorityAttempts, listOpenAcquiringAuthorityAttempts, listStaleAcquiringAuthorityAttempts, markAuthorityAttemptFailed, markAuthorityAttemptRevoked, markAuthorityAttemptStale, revokeOpenActiveAuthorityAttempts, } from "../repository/authority-attempts.js";
+import { listWorkItemsForIssue } from "../repository/work-items.js";
+import { mintAuthority as defaultMintAuthority, revokeAuthority as defaultRevokeAuthority, } from "./execution-authority.js";
+/** One bounded auto-retry (AUTHORITY_EXPIRED or a secret-less idempotent remint) beyond the
+ * genuine first attempt — enough to recover from a benign, single stale-key collision
+ * without looping forever against a persistently misbehaving Deck. */
+const MAX_MINT_ATTEMPTS = 2;
+export async function acquireAuthorityForAttempt(input) {
+    const mint = input.mint ?? defaultMintAuthority;
+    const revoke = input.revoke ?? defaultRevokeAuthority;
+    // Revoke-before-new-attempt: this idempotencyKey is a fresh attempt for this owner, so any
+    // authority still open under a *different* key belonged to a superseded one.
+    const closed = await closeOpenAuthorityAttemptsForOwner(input.ownerKind, input.ownerId, { mint, revoke });
+    if (closed.unresolved.length > 0) {
+        // A predecessor's live/dead state is genuinely unknown (Deck unreachable, an
+        // enrollment/policy error, ...) — minting a new authority beside it would risk two live
+        // authorities for the same owner if the predecessor turns out to have been live all
+        // along. Fail closed: the caller's own infra-retry policy tries again once the
+        // predecessor is reconciled (by this same check on the next attempt, the startup sweep,
+        // or the periodic retry), instead of proceeding beside an authority of unknown state
+        // (NOT-91 review, round 4).
+        return {
+            ok: false,
+            kind: "infra_failure",
+            reason: "a predecessor execution-authority attempt for this owner could not be resolved (still acquiring, Deck unreachable or an enrollment/policy error) — refusing to mint a new one until it is reconciled",
+        };
+    }
+    let idempotencyKey = input.idempotencyKey;
+    for (let attempt = 1; attempt <= MAX_MINT_ATTEMPTS; attempt++) {
+        const row = createAuthorityAttempt({
+            ownerKind: input.ownerKind,
+            ownerId: input.ownerId,
+            idempotencyKey,
+            deckId: input.deckId,
+            runId: input.runId,
+            attemptId: input.attemptId,
+            ttlMs: input.ttlMs,
+            toolScopeHint: input.toolScopeHint,
+        });
+        const minted = await mint({
+            runId: input.runId,
+            attemptId: input.attemptId,
+            deckId: input.deckId,
+            ttlMs: input.ttlMs,
+            idempotencyKey,
+            ...(input.toolScopeHint ? { toolScopeHint: input.toolScopeHint } : {}),
+        });
+        if (!minted.ok) {
+            markAuthorityAttemptFailed(row.id);
+            if (minted.code === "AUTHORITY_EXPIRED" && attempt < MAX_MINT_ATTEMPTS) {
+                // Benign — the authority this key used to reference simply aged out. A fresh key
+                // mints a genuinely new one; never surfaced to the caller as a failure.
+                idempotencyKey = `${input.idempotencyKey}::retry${attempt}`;
+                continue;
+            }
+            if (minted.code === "INTERACTION_REQUIRED" || minted.code === "AUTHORITY_REVOKED") {
+                return {
+                    ok: false,
+                    kind: "interaction_required",
+                    reason: minted.message || "Agent Deck requires a control-plane decision before this attempt can continue.",
+                    requestId: minted.requestId,
+                };
+            }
+            return { ok: false, kind: "infra_failure", reason: `${minted.code}: ${minted.message}` };
+        }
+        const { authority } = minted;
+        if (!authority.authoritySecret) {
+            // Idempotent remint of a still-live authority under a reused key (NOT-85 §7) — this
+            // caller has no secret to use it with. Revoke the orphaned authority and mint again
+            // under a derived key rather than fail the whole attempt.
+            await revoke(authority.authorityId);
+            markAuthorityAttemptFailed(row.id);
+            if (attempt < MAX_MINT_ATTEMPTS) {
+                idempotencyKey = `${input.idempotencyKey}::retry${attempt}`;
+                continue;
+            }
+            return {
+                ok: false,
+                kind: "infra_failure",
+                reason: `authority ${authority.authorityId} minted without a secret (idempotent remint) twice in a row`,
+            };
+        }
+        const activated = activateAuthorityAttempt(row.id, {
+            authorityId: authority.authorityId,
+            expiresAt: authority.expiresAt,
+        });
+        if (!activated) {
+            // Revoked out from under us between mint and activate (e.g. a concurrent abort) —
+            // never hand the caller an authority the ledger no longer considers open.
+            await revoke(authority.authorityId);
+            return { ok: false, kind: "infra_failure", reason: "attempt was cancelled while its authority was being minted" };
+        }
+        return { ok: true, attemptRowId: row.id, authority };
+    }
+    /* istanbul ignore next -- the loop always returns from within its body */
+    return { ok: false, kind: "infra_failure", reason: "authority acquisition exhausted its bounded retry" };
+}
+/** Normal end-of-use — one mint, one use, one revoke. */
+export async function releaseAuthority(attemptRowId, authorityId, revoke = defaultRevokeAuthority) {
+    await revoke(authorityId);
+    closeAuthorityAttempt(attemptRowId);
+}
+/** Verify/materialize/delivery failed after a successful mint — the authority has no
+ * further legitimate use. */
+export async function failAuthority(attemptRowId, authorityId, revoke = defaultRevokeAuthority) {
+    if (authorityId)
+        await revoke(authorityId);
+    markAuthorityAttemptFailed(attemptRowId);
+}
+/** Mint failure codes that *positively prove* no live authority remains for the replayed key
+ * — safe to terminalize with nothing left to revoke. Every other code (DECK_UNAVAILABLE, an
+ * enrollment/policy/scope error, ...) proves nothing about whether Deck actually committed the
+ * original mint, so it must never be treated as "safe to drop" (NOT-91 review, round 3). */
+const RESOLVED_NO_LIVE_AUTHORITY_CODES = new Set(["AUTHORITY_EXPIRED", "AUTHORITY_REVOKED"]);
+/**
+ * Closes one `acquiring` row that has no ledger `authorityId` — the one ambiguous case in this
+ * whole lifecycle: a coordinator can crash after Deck committed a mint but before that row was
+ * activated with the resulting id, so the ledger alone can't tell "nothing was ever minted"
+ * from "a live authority exists that only this row's idempotencyKey can still find." Resolves
+ * it the same way a live caller recovers from a secret-less idempotent remint (NOT-85 §7):
+ * replay the original mint request under its stored idempotencyKey/runId/attemptId/ttlMs/
+ * toolScopeHint. A mint success means a live authority exists (the original, or one this
+ * replay just freshly minted) — revoke it. Only `AUTHORITY_EXPIRED`/`AUTHORITY_REVOKED`
+ * positively prove nothing is left to revoke; every other failure leaves the row open.
+ */
+async function resolveAcquiringAttempt(row, mint, revoke) {
+    // Durably flags the row as needing resolution — see schema.sql's `stale_at` comment. If
+    // this replay doesn't manage to resolve it (returns "unresolved" below), the stamp is what
+    // makes it visible to `retryStaleAuthorityAttempts`'s next periodic tick, regardless of
+    // which of the four call sites (startup sweep, cancellation, worker-death reclaim, revoke-
+    // before-new-attempt) got here first (NOT-91 review, round 5).
+    markAuthorityAttemptStale(row.id);
+    const resolved = await mint({
+        runId: row.runId,
+        attemptId: row.attemptId,
+        deckId: row.deckId,
+        ttlMs: row.ttlMs,
+        idempotencyKey: row.idempotencyKey,
+        ...(row.toolScopeHint ? { toolScopeHint: row.toolScopeHint } : {}),
+    });
+    if (resolved.ok) {
+        await revoke(resolved.authority.authorityId);
+        markAuthorityAttemptRevoked(row.id);
+        return "revoked";
+    }
+    if (RESOLVED_NO_LIVE_AUTHORITY_CODES.has(resolved.code)) {
+        markAuthorityAttemptRevoked(row.id);
+        return "revoked";
+    }
+    return "unresolved";
+}
+/** Resolves a batch of `acquiring`/no-`authorityId` rows (e.g. gathered inside a cancellation
+ * or worker-death-reclaim transaction, before that transaction's synchronous DB work commits)
+ * — the async counterpart callers run afterward, outside any surrounding transaction. */
+export async function resolveAcquiringAttempts(rows, deps) {
+    const mint = deps?.mint ?? defaultMintAuthority;
+    const revoke = deps?.revoke ?? defaultRevokeAuthority;
+    const revoked = [];
+    const unresolved = [];
+    for (const row of rows) {
+        const outcome = await resolveAcquiringAttempt(row, mint, revoke);
+        (outcome === "revoked" ? revoked : unresolved).push(row.id);
+    }
+    return { revoked, unresolved };
+}
+/**
+ * Closes every open `authority_attempts` row for one owner: an `active` row (known
+ * `authorityId`) is revoked immediately; an `acquiring` row with none yet is resolved via
+ * `resolveAcquiringAttempts` instead of being terminalized on a guess. Used by
+ * `acquireAuthorityForAttempt`'s revoke-before-new-attempt step, which isn't itself inside a
+ * surrounding DB transaction, so it can freely await both steps in one call.
+ */
+export async function closeOpenAuthorityAttemptsForOwner(ownerKind, ownerId, deps) {
+    const revoke = deps?.revoke ?? defaultRevokeAuthority;
+    const revoked = [];
+    for (const row of revokeOpenActiveAuthorityAttempts(ownerKind, ownerId)) {
+        if (row.authorityId)
+            await revoke(row.authorityId);
+        revoked.push(row.id);
+    }
+    const acquiring = listOpenAcquiringAuthorityAttempts(ownerKind, ownerId);
+    const resolvedAcquiring = await resolveAcquiringAttempts(acquiring, deps);
+    return { revoked: [...revoked, ...resolvedAcquiring.revoked], unresolved: resolvedAcquiring.unresolved };
+}
+/** A developer/reviewer owner_id is `${issueId}:${ownerKind}` — stable across that role's own
+ * work-item retry rollover (NOT-91 review, round 5), never a work-item row's own UUID. Parses
+ * it back out to look up whether *any* work item currently filling that role for that issue is
+ * `leased` — a live lease means recovery.ts's own reclaim/dead-letter path (which already
+ * revokes on its own trigger) is the one to eventually close this row, not a sweep here. */
+function defaultIsOwnerLeased(ownerKind, ownerId) {
+    if (ownerKind !== "developer" && ownerKind !== "reviewer")
+        return false;
+    const suffix = `:${ownerKind}`;
+    if (!ownerId.endsWith(suffix))
+        return false;
+    const issueId = ownerId.slice(0, -suffix.length);
+    return listWorkItemsForIssue(issueId).some((item) => item.kind === ownerKind && item.status === "leased");
+}
+/**
+ * Startup-only (index.ts calls this exactly once, alongside recoverCoordinator(), before
+ * anything else can create a new `authority_attempts` row): revokes every row a crashed
+ * coordinator left open.
+ *
+ * This whole sweep's premise — "every `acquiring` row and every `reflect`/`outbound_delivery`
+ * row is stale" — is true only at a genuine process boundary. Calling this again while the
+ * *same* process keeps running would revoke a legitimately in-flight mint or a live
+ * reflect/outbound-delivery call out from under it (NOT-91 review, round 4) — that is exactly
+ * why the periodic path is a separate function, `retryStaleAuthorityAttempts`, that never
+ * rescans every open row and instead only ever retries rows durably flagged `stale_at`.
+ *
+ * - `acquiring` never legitimately survives a process boundary (it is a sub-second
+ *   pre-mint state) — always stale here.
+ * - `developer`/`reviewer` rows are stale unless their owning role is still `leased` for that
+ *   issue (`defaultIsOwnerLeased`) — closing one here too would race a still-legitimately-
+ *   running worker.
+ * - `reflect`/`outbound_delivery` rows are always one-shot, coordinator-process-local calls
+ *   with no lease of their own — at a genuine process boundary, if one is still open, the
+ *   process that opened it is definitionally gone.
+ *
+ * A stale `acquiring` row with no `authorityId` goes through `resolveAcquiringAttempts`
+ * rather than being terminalized directly — see its doc comment for why.
+ */
+export async function reconcileAuthoritiesAtStartup(deps) {
+    const revoke = deps?.revoke ?? defaultRevokeAuthority;
+    const mint = deps?.mint ?? defaultMintAuthority;
+    const isOwnerLeased = deps?.isOwnerLeased ?? defaultIsOwnerLeased;
+    const revoked = [];
+    const acquiringToResolve = [];
+    for (const row of listAllOpenAuthorityAttempts()) {
+        const stale = row.status === "acquiring" ||
+            (row.ownerKind === "developer" || row.ownerKind === "reviewer" ? !isOwnerLeased(row.ownerKind, row.ownerId) : true);
+        if (!stale)
+            continue;
+        if (row.status === "acquiring" && !row.authorityId) {
+            acquiringToResolve.push(row);
+            continue;
+        }
+        if (row.authorityId)
+            await revoke(row.authorityId);
+        markAuthorityAttemptRevoked(row.id);
+        revoked.push(row.id);
+    }
+    const resolvedAcquiring = await resolveAcquiringAttempts(acquiringToResolve, { mint, revoke });
+    return { revoked: [...revoked, ...resolvedAcquiring.revoked], unresolved: resolvedAcquiring.unresolved };
+}
+/**
+ * The periodic counterpart to `reconcileAuthoritiesAtStartup` (index.ts calls this on a
+ * bounded interval — no state threaded between ticks). Never rescans
+ * `listAllOpenAuthorityAttempts()`: unlike the one-time startup sweep, this runs while the
+ * process is still live, so re-deriving "every acquiring/process-local row is stale" would
+ * revoke a legitimately in-flight mint or a live reflect/outbound-delivery call (NOT-91
+ * review, round 4). Instead queries `listStaleAcquiringAuthorityAttempts()` — rows durably
+ * flagged `stale_at` by `resolveAcquiringAttempt`, from *any* of the four call sites (startup
+ * sweep, cancellation, worker-death reclaim, revoke-before-new-attempt), not just what the
+ * startup sweep itself found (NOT-91 review, round 5: a row that only became stale after
+ * startup, e.g. via a later cancellation, used to have no path back into the periodic retry
+ * at all). A defensive lease check still applies before resolving any of them, in case a row
+ * were ever (incorrectly) flagged stale while still genuinely live.
+ */
+export async function retryStaleAuthorityAttempts(deps) {
+    const isOwnerLeased = deps?.isOwnerLeased ?? defaultIsOwnerLeased;
+    const rows = listStaleAcquiringAuthorityAttempts().filter((row) => !((row.ownerKind === "developer" || row.ownerKind === "reviewer") && isOwnerLeased(row.ownerKind, row.ownerId)));
+    return resolveAcquiringAttempts(rows, deps);
+}

package/bundle/server/dist/adapters/codex-scoped-config.js

@@ -0,0 +1,103 @@
+// packages/server/src/adapters/codex-scoped-config.ts
+//
+// The per-attempt codex `config.toml`: the one spelling of the send-gate tool name, the
+// builder that writes the scoped `mcp_servers` table, and the reader the spawn preflight
+// uses to check it.
+//
+// These live together, and apart from `agent-deck-bind.ts`, for two reasons. Together,
+// because the writer and the reader must agree on one tool name — codex's `disabled_tools`
+// is a per-server list, so the entry is the server-side name, NOT claude's namespaced
+// `mcp__agent-deck__call_service_tool` (args.ts). Two spellings of one fact is how this
+// stack's original bug happened. Apart, because `coordinator/permissions.ts` needs the
+// reader to enforce a read-only invariant, and importing the adapter for it would drag the
+// deck client, the repository layer, the DB module and the MCP SDK into the invariant
+// module and all of its unit tests — for ~15 lines of fs + TOML (NOT-134 review).
+import fs from "node:fs";
+import path from "node:path";
+import { parse as parseToml } from "smol-toml";
+/**
+ * The send gate (docs/PRD_SEND_GATE.md) as *codex* names it — server-side, unnamespaced.
+ */
+export const CODEX_SEND_GATE_TOOL = "call_service_tool";
+/**
+ * The deck reads a worker legitimately needs, in codex's unnamespaced spelling. Mirrors
+ * claude's `DECK_READ_TOOLS` (args.ts) one-for-one; the send gate is deliberately absent.
+ *
+ * These need an explicit `approval_mode` because a non-interactive `codex exec` runs with
+ * an approval policy of `never` — there is no human to answer a prompt, so any MCP call
+ * that requires approval is refused outright ("MCP tool call requires approval, but
+ * approval policy is never"). Without this the deck is configured, reachable, and unusable.
+ */
+export const CODEX_DECK_READ_TOOLS = [
+    "bind_workspace",
+    "get_bound_deck",
+    "get_playbook",
+    "list_service_tools",
+];
+/**
+ * The scoped `mcp_servers` table for one attempt.
+ *
+ * `disabled_tools` is the only place a codex session's tool surface can be narrowed —
+ * codex has no `--disallowedTools` equivalent — so a policy-blind config silently grants
+ * whatever the deck exposes. Verified against codex 0.154.0: with the key present the
+ * tool is not exposed to the session at all; without it the tool is exposed and reachable.
+ * It denies one tool, not the server, so deck reads are unaffected by it.
+ *
+ * `allowOutboundMutation` is currently unreachable in the `true` direction, and that is
+ * deliberate rather than an oversight. Both role ceilings set `outboundMutation: false`
+ * (shared/profile-snapshot.ts:50,57) and `resolvePermissionPolicy` can only turn a
+ * capability off, never raise the ceiling — so today NO worker session, either role, any
+ * runtime, can reach the send gate, and no profile setting re-enables it. The gated send
+ * is the only route out (docs/PRD_SEND_GATE.md). claude carries the identical dead branch
+ * (`claudeDisallowedTools`, args.ts), so this is parity, not a special case.
+ *
+ * The parameter exists so the ceiling stays the one place that decides — flip
+ * `outboundMutation` there and this follows, rather than needing a second edit here. If
+ * you came looking for the profile toggle that turns outbound writes on: there isn't one,
+ * by design.
+ */
+export function codexMcpServersTable(opts) {
+    return {
+        "agent-deck": {
+            url: opts.mcpUrl,
+            http_headers: opts.headers,
+            ...(opts.allowOutboundMutation ? {} : { disabled_tools: [CODEX_SEND_GATE_TOOL] }),
+            // Pre-approve exactly the reads, and nothing else. Verified against codex 0.154.0:
+            // with these the deck read returns data; without them it is refused by the
+            // approval policy even though the server is configured and connected. The send gate
+            // is never listed here — it is removed by `disabled_tools` above, and listing it
+            // would be the one entry that could undo that.
+            tools: Object.fromEntries(CODEX_DECK_READ_TOOLS.map((t) => [t, { approval_mode: "approve" }])),
+        },
+    };
+}
+/**
+ * Does this scoped CODEX_HOME's config.toml deny the send gate on every configured server?
+ *
+ * Reads the file codex itself will read, rather than trusting whoever wrote it — the spawn
+ * preflight needs the fact, not a flag passed alongside it. A missing or unparseable
+ * config reads as "not denied": the strict answer, since an assertion must only ever
+ * over-reject. No servers at all is denial by absence — there is nothing to call.
+ */
+export function codexScopedConfigDeniesSendGate(codexHome) {
+    try {
+        const parsed = parseToml(fs.readFileSync(path.join(codexHome, "config.toml"), "utf8"));
+        const servers = parsed.mcp_servers ?? {};
+        const names = Object.keys(servers);
+        if (names.length === 0)
+            return true;
+        return names.every((n) => {
+            const server = servers[n];
+            const denied = server?.disabled_tools;
+            if (!Array.isArray(denied) || !denied.includes(CODEX_SEND_GATE_TOOL))
+                return false;
+            // A per-tool approval entry for the send gate would be the one line that could
+            // undo the removal above, so it is rejected rather than merely not written —
+            // the denial must not depend on nobody having added it.
+            return server?.tools?.[CODEX_SEND_GATE_TOOL] === undefined;
+        });
+    }
+    catch {
+        return false;
+    }
+}

package/bundle/server/dist/adapters/execution-authority.js

@@ -0,0 +1,103 @@
+// packages/server/src/adapters/execution-authority.ts
+//
+// Mint/revoke short-lived Agent Deck execution authority for one run attempt (NOT-85 §5.2,
+// §11; NOT-87). Replaces the legacy, spoofable `x-agent-deck-client` header paths and the
+// unauthenticated MCP connections in agent-deck-bind.ts / agent-deck.ts's
+// deliverOutboundDraft: every unattended Deck call must now carry a freshly minted
+// authority, never a persistent grant copied into a worktree or prompt.
+//
+// A minted authority is used for exactly one attempt (one mint, one worker spawn or one
+// coordinator-side call, then revoke) — callers never reuse an authority across attempts;
+// a new attempt always mints again with a new idempotency key (NOT-85 §6.2, §8).
+import { getAgentDeckApiUrl } from "./agent-deck.js";
+/** Enrollment bearer for legacy mint/revoke (kept for PR2 / authority-lifecycle). */
+function getAgentDeckEnrollmentBearer() {
+    const enrollmentId = process.env.AGENT_DECK_ENROLLMENT_ID;
+    const secret = process.env.AGENT_DECK_ENROLLMENT_SECRET;
+    if (!enrollmentId || !secret)
+        return null;
+    return `${enrollmentId}:${secret}`;
+}
+const KNOWN_CODES = new Set([
+    "COORDINATOR_NOT_ENROLLED",
+    "ENROLLMENT_REVOKED",
+    "RESOURCE_OUT_OF_SCOPE",
+    "INTERACTION_REQUIRED",
+    "AUTHORITY_EXPIRED",
+    "AUTHORITY_REVOKED",
+    "INVALID_MINT_REQUEST",
+]);
+function mapErrorCode(code) {
+    if (code && KNOWN_CODES.has(code))
+        return code;
+    return "DECK_UNAVAILABLE";
+}
+/** Mint execution authority for one run attempt. Never throws — every failure is a typed result. */
+export async function mintAuthority(input) {
+    const bearer = getAgentDeckEnrollmentBearer();
+    if (!bearer) {
+        return {
+            ok: false,
+            code: "COORDINATOR_NOT_ENROLLED",
+            message: "Agent Deck coordinator is not enrolled — run `agent-deck coordinator enroll` and set " +
+                "AGENT_DECK_COORDINATOR_ID / AGENT_DECK_ENROLLMENT_ID / AGENT_DECK_ENROLLMENT_SECRET.",
+        };
+    }
+    try {
+        const res = await fetch(`${getAgentDeckApiUrl()}/api/execution-authority/authorities`, {
+            method: "POST",
+            headers: { Authorization: `Bearer ${bearer}`, "Content-Type": "application/json" },
+            body: JSON.stringify({
+                runId: input.runId,
+                attemptId: input.attemptId,
+                deckId: input.deckId,
+                audience: "dealer-worker",
+                idempotencyKey: input.idempotencyKey,
+                ttlMs: input.ttlMs,
+                ...(input.toolScopeHint ? { toolScopeHint: input.toolScopeHint } : {}),
+            }),
+            signal: AbortSignal.timeout(8000),
+        });
+        const json = (await res.json().catch(() => null));
+        if (!res.ok || !json || json.ok === false || !json.data) {
+            return {
+                ok: false,
+                code: mapErrorCode(json?.error_code),
+                message: json?.message ?? `mint failed: HTTP ${res.status}`,
+                requestId: json?.correlation?.requestId,
+            };
+        }
+        const { authority, authoritySecret } = json.data;
+        return {
+            ok: true,
+            authority: {
+                authorityId: authority.authorityId,
+                authoritySecret,
+                deckId: authority.deckId,
+                audience: authority.audience,
+                allowedServices: authority.allowedServices,
+                allowedTools: authority.allowedTools,
+                expiresAt: authority.expiresAt,
+            },
+        };
+    }
+    catch (e) {
+        return { ok: false, code: "DECK_UNAVAILABLE", message: String(e) };
+    }
+}
+/** Best-effort — an authority that fails to revoke still expires by TTL (NOT-85 §9). */
+export async function revokeAuthority(authorityId) {
+    const bearer = getAgentDeckEnrollmentBearer();
+    if (!bearer)
+        return;
+    try {
+        await fetch(`${getAgentDeckApiUrl()}/api/execution-authority/authorities/${encodeURIComponent(authorityId)}/revoke`, {
+            method: "POST",
+            headers: { Authorization: `Bearer ${bearer}` },
+            signal: AbortSignal.timeout(5000),
+        });
+    }
+    catch {
+        // best-effort — TTL still bounds exposure
+    }
+}

package/bundle/server/dist/adapters/execution-authority.test.js

@@ -0,0 +1,166 @@
+// packages/server/src/adapters/execution-authority.test.ts
+//
+// mintAuthority/revokeAuthority never throw — every Deck failure (missing enrollment,
+// a typed contract error, or the backend being unreachable) comes back as a typed result
+// the caller branches on (NOT-87).
+import { test, mock } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+process.env.AGENT_DEALER_HOME = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-execauth-"));
+const { migrate } = await import("../db/index.js");
+const { mintAuthority, revokeAuthority } = await import("./execution-authority.js");
+migrate();
+const ENV_KEYS = ["AGENT_DECK_COORDINATOR_ID", "AGENT_DECK_ENROLLMENT_ID", "AGENT_DECK_ENROLLMENT_SECRET"];
+function withEnv(vars, fn) {
+    const saved = Object.fromEntries(ENV_KEYS.map((k) => [k, process.env[k]]));
+    for (const k of ENV_KEYS) {
+        if (vars[k] === undefined)
+            delete process.env[k];
+        else
+            process.env[k] = vars[k];
+    }
+    return fn().finally(() => {
+        for (const k of ENV_KEYS) {
+            if (saved[k] === undefined)
+                delete process.env[k];
+            else
+                process.env[k] = saved[k];
+        }
+    });
+}
+const ENROLLED = {
+    AGENT_DECK_COORDINATOR_ID: "coord-1",
+    AGENT_DECK_ENROLLMENT_ID: "enr_abc",
+    AGENT_DECK_ENROLLMENT_SECRET: "enrs_secret",
+};
+const MINT_INPUT = {
+    runId: "run-1",
+    attemptId: "attempt-1",
+    deckId: "deck-1",
+    ttlMs: 60_000,
+    idempotencyKey: "attempt-1",
+};
+test("mintAuthority returns COORDINATOR_NOT_ENROLLED without calling fetch when no enrollment env is set", async () => {
+    await withEnv({}, async () => {
+        const fetchMock = mock.method(globalThis, "fetch", async () => {
+            throw new Error("fetch should not be called");
+        });
+        try {
+            const result = await mintAuthority(MINT_INPUT);
+            assert.equal(result.ok, false);
+            if (!result.ok)
+                assert.equal(result.code, "COORDINATOR_NOT_ENROLLED");
+            assert.equal(fetchMock.mock.callCount(), 0);
+        }
+        finally {
+            fetchMock.mock.restore();
+        }
+    });
+});
+test("mintAuthority sends the enrollment bearer and returns the minted authority on success", async () => {
+    await withEnv(ENROLLED, async () => {
+        let capturedUrl = "";
+        let capturedAuth = "";
+        let capturedBody = {};
+        const fetchMock = mock.method(globalThis, "fetch", async (url, init) => {
+            capturedUrl = String(url);
+            capturedAuth = init?.headers?.Authorization ?? "";
+            capturedBody = JSON.parse(String(init?.body ?? "{}"));
+            return new Response(JSON.stringify({
+                ok: true,
+                data: {
+                    authority: {
+                        authorityId: "authz_1",
+                        deckId: "deck-1",
+                        audience: "dealer-worker",
+                        allowedServices: ["slack"],
+                        allowedTools: [{ serviceId: "slack", toolName: "send_message" }],
+                        expiresAt: "2026-01-01T00:01:00Z",
+                    },
+                    authoritySecret: "authzs_secret",
+                    secretIssued: true,
+                },
+            }), { status: 200 });
+        });
+        try {
+            const result = await mintAuthority(MINT_INPUT);
+            assert.equal(result.ok, true);
+            if (result.ok) {
+                assert.equal(result.authority.authorityId, "authz_1");
+                assert.equal(result.authority.authoritySecret, "authzs_secret");
+                assert.deepEqual(result.authority.allowedTools, [{ serviceId: "slack", toolName: "send_message" }]);
+            }
+            assert.match(capturedUrl, /\/api\/execution-authority\/authorities$/);
+            assert.equal(capturedAuth, "Bearer enr_abc:enrs_secret");
+            assert.equal(capturedBody.runId, "run-1");
+            assert.equal(capturedBody.idempotencyKey, "attempt-1");
+            assert.equal(capturedBody.audience, "dealer-worker");
+        }
+        finally {
+            fetchMock.mock.restore();
+        }
+    });
+});
+test("mintAuthority maps a typed contract error (INTERACTION_REQUIRED) instead of throwing", async () => {
+    await withEnv(ENROLLED, async () => {
+        const fetchMock = mock.method(globalThis, "fetch", async () => {
+            return new Response(JSON.stringify({ ok: false, error_code: "INTERACTION_REQUIRED", message: "Control-plane decision required" }), { status: 409 });
+        });
+        try {
+            const result = await mintAuthority(MINT_INPUT);
+            assert.equal(result.ok, false);
+            if (!result.ok) {
+                assert.equal(result.code, "INTERACTION_REQUIRED");
+                assert.equal(result.message, "Control-plane decision required");
+            }
+        }
+        finally {
+            fetchMock.mock.restore();
+        }
+    });
+});
+test("mintAuthority maps a network failure to DECK_UNAVAILABLE", async () => {
+    await withEnv(ENROLLED, async () => {
+        const fetchMock = mock.method(globalThis, "fetch", async () => {
+            throw new Error("ECONNREFUSED");
+        });
+        try {
+            const result = await mintAuthority(MINT_INPUT);
+            assert.equal(result.ok, false);
+            if (!result.ok)
+                assert.equal(result.code, "DECK_UNAVAILABLE");
+        }
+        finally {
+            fetchMock.mock.restore();
+        }
+    });
+});
+test("revokeAuthority is a best-effort no-op when unreachable (never throws)", async () => {
+    await withEnv(ENROLLED, async () => {
+        const fetchMock = mock.method(globalThis, "fetch", async () => {
+            throw new Error("ECONNREFUSED");
+        });
+        try {
+            await assert.doesNotReject(revokeAuthority("authz_1"));
+        }
+        finally {
+            fetchMock.mock.restore();
+        }
+    });
+});
+test("revokeAuthority skips the call entirely when not enrolled", async () => {
+    await withEnv({}, async () => {
+        const fetchMock = mock.method(globalThis, "fetch", async () => {
+            throw new Error("fetch should not be called");
+        });
+        try {
+            await revokeAuthority("authz_1");
+            assert.equal(fetchMock.mock.callCount(), 0);
+        }
+        finally {
+            fetchMock.mock.restore();
+        }
+    });
+});

package/bundle/server/dist/adapters/external.js

@@ -1,5 +1,4 @@
 import { listLinearCandidates } from "./linear-inbox.js";
-export { checkAgentDeckHealth, fetchAgentDeckDecks } from "./agent-deck.js";
 export async function pollLinearIssues() {
     if (process.env.LINEAR_AUTO_ENQUEUE === "1") {
         console.warn("[linear] LINEAR_AUTO_ENQUEUE=1 is deprecated — use Intake promote");